Analysis
- max time kernel
149s - max time network
152s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
20/08/2026, 14:12
Static task
static1
Behavioral task
behavioral1
Sample
AdblockForYoutube_AdBlock360.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
AdblockForYoutube_AdBlock360.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
9 signatures
150 seconds
General
- Target AdblockForYoutube_AdBlock360.exe
- Size 756KB
- Sample260820-rh56csdn31
- SHA256 9aab6d00818bc8ab93945e4d22652e296fb72a283b51b4cf29ce15e02ebf207a
- MD5 15066d55056b5d06d43a4f097838ac3a
- SHA1 f75728463e85066e988e7e1e59f6180829724fa3
- SHA512 32466e3a27ea13afcfc2073fc6920bf7d03bd9df77174209bc5ff5ad8e8f5f14b9fe3648870b0455c51f470e8f61401b33b6e8a7f876b27078252b85bbf39c69
- SSDEEP 12288:vNyCHRSsbNjBgnuNwW8Vph0lhSMXlixC1gkBvfZH:vNLHJbN1gn0wtnh0lhSMXlT1h
- TLSH T16CF49D12F3B041F9E0A6C175896A457AFB727C8307A8874F13B0666E5F376945E3A332
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
Malware Config
Signatures
- Badlisted process makes network request 12 IoCs
Network request originating from process or tool commonly abused by malware.
flow pid Process 13 4436 msiexec.exe 15 4436 msiexec.exe 16 4436 msiexec.exe 17 4660 MsiExec.exe 19 4436 msiexec.exe 20 4660 MsiExec.exe 23 4660 MsiExec.exe 24 4660 MsiExec.exe 25 4436 msiexec.exe 26 4660 MsiExec.exe 28 4436 msiexec.exe 30 4436 msiexec.exe - Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\X: msiexec.exe - Drops file in Program Files directory 1 IoCs
description ioc Process File created C:\Program Files\AdBlock360\write_test.tmp MsiExec.exe - Loads dropped DLL 1 IoCs
pid Process 4660 MsiExec.exe - Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 4660 MsiExec.exe 4660 MsiExec.exe 4660 MsiExec.exe 4660 MsiExec.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 4436 msiexec.exe Token: SeIncreaseQuotaPrivilege 4436 msiexec.exe Token: SeSecurityPrivilege 4484 msiexec.exe Token: SeCreateTokenPrivilege 4436 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 4436 msiexec.exe Token: SeLockMemoryPrivilege 4436 msiexec.exe Token: SeIncreaseQuotaPrivilege 4436 msiexec.exe Token: SeMachineAccountPrivilege 4436 msiexec.exe Token: SeTcbPrivilege 4436 msiexec.exe Token: SeSecurityPrivilege 4436 msiexec.exe Token: SeTakeOwnershipPrivilege 4436 msiexec.exe Token: SeLoadDriverPrivilege 4436 msiexec.exe Token: SeSystemProfilePrivilege 4436 msiexec.exe Token: SeSystemtimePrivilege 4436 msiexec.exe Token: SeProfSingleProcessPrivilege 4436 msiexec.exe Token: SeIncBasePriorityPrivilege 4436 msiexec.exe Token: SeCreatePagefilePrivilege 4436 msiexec.exe Token: SeCreatePermanentPrivilege 4436 msiexec.exe Token: SeBackupPrivilege 4436 msiexec.exe Token: SeRestorePrivilege 4436 msiexec.exe Token: SeShutdownPrivilege 4436 msiexec.exe Token: SeDebugPrivilege 4436 msiexec.exe Token: SeAuditPrivilege 4436 msiexec.exe Token: SeSystemEnvironmentPrivilege 4436 msiexec.exe Token: SeChangeNotifyPrivilege 4436 msiexec.exe Token: SeRemoteShutdownPrivilege 4436 msiexec.exe Token: SeUndockPrivilege 4436 msiexec.exe Token: SeSyncAgentPrivilege 4436 msiexec.exe Token: SeEnableDelegationPrivilege 4436 msiexec.exe Token: SeManageVolumePrivilege 4436 msiexec.exe Token: SeImpersonatePrivilege 4436 msiexec.exe Token: SeCreateGlobalPrivilege 4436 msiexec.exe Token: SeCreateTokenPrivilege 4436 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 4436 msiexec.exe Token: SeLockMemoryPrivilege 4436 msiexec.exe Token: SeIncreaseQuotaPrivilege 4436 msiexec.exe Token: SeMachineAccountPrivilege 4436 msiexec.exe Token: SeTcbPrivilege 4436 msiexec.exe Token: SeSecurityPrivilege 4436 msiexec.exe Token: SeTakeOwnershipPrivilege 4436 msiexec.exe Token: SeLoadDriverPrivilege 4436 msiexec.exe Token: SeSystemProfilePrivilege 4436 msiexec.exe Token: SeSystemtimePrivilege 4436 msiexec.exe Token: SeProfSingleProcessPrivilege 4436 msiexec.exe Token: SeIncBasePriorityPrivilege 4436 msiexec.exe Token: SeCreatePagefilePrivilege 4436 msiexec.exe Token: SeCreatePermanentPrivilege 4436 msiexec.exe Token: SeBackupPrivilege 4436 msiexec.exe Token: SeRestorePrivilege 4436 msiexec.exe Token: SeShutdownPrivilege 4436 msiexec.exe Token: SeDebugPrivilege 4436 msiexec.exe Token: SeAuditPrivilege 4436 msiexec.exe Token: SeSystemEnvironmentPrivilege 4436 msiexec.exe Token: SeChangeNotifyPrivilege 4436 msiexec.exe Token: SeRemoteShutdownPrivilege 4436 msiexec.exe Token: SeUndockPrivilege 4436 msiexec.exe Token: SeSyncAgentPrivilege 4436 msiexec.exe Token: SeEnableDelegationPrivilege 4436 msiexec.exe Token: SeManageVolumePrivilege 4436 msiexec.exe Token: SeImpersonatePrivilege 4436 msiexec.exe Token: SeCreateGlobalPrivilege 4436 msiexec.exe Token: SeCreateTokenPrivilege 4436 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 4436 msiexec.exe Token: SeLockMemoryPrivilege 4436 msiexec.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 4436 msiexec.exe - Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 1596 wrote to memory of 4436 1596 AdblockForYoutube_AdBlock360.exe 86 PID 4484 wrote to memory of 4660 4484 msiexec.exe 88
Processes
-
C:\Users\Admin\AppData\Local\Temp\AdblockForYoutube_AdBlock360.exe"C:\Users\Admin\AppData\Local\Temp\AdblockForYoutube_AdBlock360.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1596 -
C:\Windows\SYSTEM32\msiexec.exemsiexec /i "C:\Users\Admin\AppData\Local\Temp\D69BB574-E533-4232-990B-A7FABF9452E4\AdBlock360-Setup_4.3.1.0010.msi" /L*V "C:\Users\Admin\AppData\Local\Temp\AdBlock360-Installer.log"2⤵
- Badlisted process makes network request
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4436
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4484 -
C:\Windows\System32\MsiExec.exeC:\Windows\System32\MsiExec.exe -Embedding 47A39FFAD8DDBC77CB1E60B4FADC0B6E U2⤵
- Badlisted process makes network request
- Drops file in Program Files directory
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:4660
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\D69BB574-E533-4232-990B-A7FABF9452E4\AdBlock360-Setup_4.3.1.0010.msi
- Size 32.8MB
- SHA256 7437a53313e01d7c49dc28ae4f2b955c009eded90ba1aabaeee65b901f81106b
- MD5 45cbae3cc2719e49fbdf1decb913603e
- SHA1 d9abd345f56836cea674d6e64170203f6bd73049
- SHA512 59643238cab3f3f63ba7e4cb99678deec1ab57a80d0b6ff6cdd07dd38a2cc5a8a18007995709d079769e9fe72638dba5f1d74fe02c14ab32ec7dbf27f0e39bdd
- SSDEEP 786432:8vhgP3GqfTuQxbI9w6S/bS3yOW8Uc4OzLj0vhQwc4IVqd1h:8vsGSqQuwp/btOW8UcPzsv2wcJ8T
- TLSH T137772207FEB489E4D9628870597E03FD7D2368C706AD859A2570233FDBA62CC85766F0
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\MSI16875\EmbeddedUI.config
- Size 980B
- SHA256 1a67f60962ca1cbf19873b62a8518efe8c701a09cd609af4c50ecc7f0b468bb8
- MD5 c9c40af1656f8531eaa647caceb1e436
- SHA1 907837497508de13d5a7e60697fc9d050e327e19
- SHA512 0f7033686befa3f4acf3ed355c1674eaa6e349fba97e906446c8a7000be6876f157bc015bf5d3011fbbdc2c771bcbaea97918b8d24c064cbbd302741cc70cbc7
- TLSH T1E2111C2C85E4F92B9A325A533A208896EFB0A1B2A174510CB09FBA170F720CE8257325
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\MSI16875\WixSharp.UI.CA.dll
- Size 2.9MB
- SHA256 d96266f1ed975265d8a560079e3e6c084baf23bc30cdc82a7adcee9adddf009d
- MD5 dd8c136f37e06401c15df2dc7682e810
- SHA1 f52b62e7ffd4faaf0c115db8b47921456de063aa
- SHA512 6cd546dd43fb6dc1a2e8f83f7216f258a64fbed91102837004ee2a7a649b906abc444a0c789a1c25f508fa3cfcf401b67722a02a5c2a83164489471d6a1624a6
- SSDEEP 49152:sziIZJlKzDh1T8hNUoKqpLl/JDFyG1SQKs4MlR7wiNIAXjeSQiHu7u2KwWESFr:94fGh1T8EofPDFyG1vKsjkiNIbn62Kio
- TLSH T1A4E5236737F909A9F8775279886B46099633BD009730E6FF03601549DF3B7E0447ABA2
- MD5 SHA1 SHA512 SSDEEP TLSH