Analysis
- max time kernel
148s - max time network
133s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
19/08/2026, 12:19
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
InstalaProgramadorTupa.msi
Resource
win10v2004-20260513-en
windows10-2004-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
InstalaProgramadorTupa.msi
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
8 signatures
150 seconds
Behavioral task
behavioral3
Sample
setup.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
8 signatures
150 seconds
Behavioral task
behavioral4
Sample
setup.exe
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
8 signatures
150 seconds
General
- Target InstalaProgramadorTupa.msi
- Size 6.3MB
- Sample260819-pha9watemg
- SHA256 e7818bc830ef140c0155a7468e8cd848b6cb37666fb99cedd9ff7419b76202ad
- MD5 115d6d049815630b1a6702f3f9a75b5e
- SHA1 b0636f321458e07eac54106d8cda5ad419c8c912
- SHA512 9d22a8256bd0ef58bd29bb6d295bffbc753bc957df9730410392e8d12816308a29309095e4e0eb5ec24fb319dd97f47fbbefa096955d46a334e3e74a99178668
- SSDEEP 196608:klSuBwn6ChygvP09FfEkMBREqoKBsxo31dLYhFL:klpjhe0okxm1v0hF
- TLSH T1266633113AC8C736C1CA163099BAD729453E9D714F7182876325BBDE2FB2AC2537C786
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Loads dropped DLL 2 IoCs
pid Process 4224 MsiExec.exe 4224 MsiExec.exe - Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\D: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\D: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\J: msiexec.exe - Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
pid Process 1416 msiexec.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 1416 msiexec.exe Token: SeIncreaseQuotaPrivilege 1416 msiexec.exe Token: SeSecurityPrivilege 5152 msiexec.exe Token: SeCreateTokenPrivilege 1416 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 1416 msiexec.exe Token: SeLockMemoryPrivilege 1416 msiexec.exe Token: SeIncreaseQuotaPrivilege 1416 msiexec.exe Token: SeMachineAccountPrivilege 1416 msiexec.exe Token: SeTcbPrivilege 1416 msiexec.exe Token: SeSecurityPrivilege 1416 msiexec.exe Token: SeTakeOwnershipPrivilege 1416 msiexec.exe Token: SeLoadDriverPrivilege 1416 msiexec.exe Token: SeSystemProfilePrivilege 1416 msiexec.exe Token: SeSystemtimePrivilege 1416 msiexec.exe Token: SeProfSingleProcessPrivilege 1416 msiexec.exe Token: SeIncBasePriorityPrivilege 1416 msiexec.exe Token: SeCreatePagefilePrivilege 1416 msiexec.exe Token: SeCreatePermanentPrivilege 1416 msiexec.exe Token: SeBackupPrivilege 1416 msiexec.exe Token: SeRestorePrivilege 1416 msiexec.exe Token: SeShutdownPrivilege 1416 msiexec.exe Token: SeDebugPrivilege 1416 msiexec.exe Token: SeAuditPrivilege 1416 msiexec.exe Token: SeSystemEnvironmentPrivilege 1416 msiexec.exe Token: SeChangeNotifyPrivilege 1416 msiexec.exe Token: SeRemoteShutdownPrivilege 1416 msiexec.exe Token: SeUndockPrivilege 1416 msiexec.exe Token: SeSyncAgentPrivilege 1416 msiexec.exe Token: SeEnableDelegationPrivilege 1416 msiexec.exe Token: SeManageVolumePrivilege 1416 msiexec.exe Token: SeImpersonatePrivilege 1416 msiexec.exe Token: SeCreateGlobalPrivilege 1416 msiexec.exe Token: SeCreateTokenPrivilege 1416 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 1416 msiexec.exe Token: SeLockMemoryPrivilege 1416 msiexec.exe Token: SeIncreaseQuotaPrivilege 1416 msiexec.exe Token: SeMachineAccountPrivilege 1416 msiexec.exe Token: SeTcbPrivilege 1416 msiexec.exe Token: SeSecurityPrivilege 1416 msiexec.exe Token: SeTakeOwnershipPrivilege 1416 msiexec.exe Token: SeLoadDriverPrivilege 1416 msiexec.exe Token: SeSystemProfilePrivilege 1416 msiexec.exe Token: SeSystemtimePrivilege 1416 msiexec.exe Token: SeProfSingleProcessPrivilege 1416 msiexec.exe Token: SeIncBasePriorityPrivilege 1416 msiexec.exe Token: SeCreatePagefilePrivilege 1416 msiexec.exe Token: SeCreatePermanentPrivilege 1416 msiexec.exe Token: SeBackupPrivilege 1416 msiexec.exe Token: SeRestorePrivilege 1416 msiexec.exe Token: SeShutdownPrivilege 1416 msiexec.exe Token: SeDebugPrivilege 1416 msiexec.exe Token: SeAuditPrivilege 1416 msiexec.exe Token: SeSystemEnvironmentPrivilege 1416 msiexec.exe Token: SeChangeNotifyPrivilege 1416 msiexec.exe Token: SeRemoteShutdownPrivilege 1416 msiexec.exe Token: SeUndockPrivilege 1416 msiexec.exe Token: SeSyncAgentPrivilege 1416 msiexec.exe Token: SeEnableDelegationPrivilege 1416 msiexec.exe Token: SeManageVolumePrivilege 1416 msiexec.exe Token: SeImpersonatePrivilege 1416 msiexec.exe Token: SeCreateGlobalPrivilege 1416 msiexec.exe Token: SeCreateTokenPrivilege 1416 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 1416 msiexec.exe Token: SeLockMemoryPrivilege 1416 msiexec.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1416 msiexec.exe - Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 1416 msiexec.exe 5152 msiexec.exe 4224 MsiExec.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 5152 wrote to memory of 4224 5152 msiexec.exe 90
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\InstalaProgramadorTupa.msi1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:1416
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5152 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 54BB3D029AB2F322BE19F4DC67315115 C2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4224
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\MSIB656.tmp
- Size 231KB
- SHA256 97a55524e0bf06419143b1b71778c0ec867716079ab477e8404a0f3125da7dc3
- MD5 0a2626fc9e4e0ca18386c029e9efffd9
- SHA1 ac5576497afac2456f485cdb14bf52d895769651
- SHA512 40b25e507e64b5634e13e83d4bc420196b1294d533e60b01dae8898a8eed939417aec8341b409f59a722d14fb63884c24c5a31985da63933b761f1fc3acb24da
- SSDEEP 3072:Z7PyQaeLAxV9EcU95qWCn7B1kkJQGGhKTWAvdEhMqmc1wtI6M/CoKpixBrnQYaeW:8n3Nn7ByILdEODlcOnlpOuodL+8Y
- TLSH T140346D2036D4DA32E4E321B456BCE67519BEF4705B30C1C7A3941BEE9EA96C0AB34747
- MD5 SHA1 SHA512 SSDEEP TLSH