Analysis
- max time kernel
149s - max time network
152s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
20/08/2026, 14:12
Static task
static1
Behavioral task
behavioral1
Sample
AdblockForYoutube_AdBlock360.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
AdblockForYoutube_AdBlock360.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
9 signatures
150 seconds
General
- Target AdblockForYoutube_AdBlock360.exe
- Size 756KB
- Sample260820-rh56csdn31
- SHA256 9aab6d00818bc8ab93945e4d22652e296fb72a283b51b4cf29ce15e02ebf207a
- MD5 15066d55056b5d06d43a4f097838ac3a
- SHA1 f75728463e85066e988e7e1e59f6180829724fa3
- SHA512 32466e3a27ea13afcfc2073fc6920bf7d03bd9df77174209bc5ff5ad8e8f5f14b9fe3648870b0455c51f470e8f61401b33b6e8a7f876b27078252b85bbf39c69
- SSDEEP 12288:vNyCHRSsbNjBgnuNwW8Vph0lhSMXlixC1gkBvfZH:vNLHJbN1gn0wtnh0lhSMXlT1h
- TLSH T16CF49D12F3B041F9E0A6C175896A457AFB727C8307A8874F13B0666E5F376945E3A332
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
Malware Config
Signatures
- Badlisted process makes network request 1 IoCs
Network request originating from process or tool commonly abused by malware.
flow pid Process 8 4648 MsiExec.exe - Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\D: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\D: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\Y: msiexec.exe - Drops file in Program Files directory 1 IoCs
description ioc Process File created C:\Program Files\AdBlock360\write_test.tmp MsiExec.exe - Loads dropped DLL 1 IoCs
pid Process 4648 MsiExec.exe - Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 4648 MsiExec.exe 4648 MsiExec.exe 4648 MsiExec.exe 4648 MsiExec.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 6792 msiexec.exe Token: SeIncreaseQuotaPrivilege 6792 msiexec.exe Token: SeSecurityPrivilege 1096 msiexec.exe Token: SeCreateTokenPrivilege 6792 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 6792 msiexec.exe Token: SeLockMemoryPrivilege 6792 msiexec.exe Token: SeIncreaseQuotaPrivilege 6792 msiexec.exe Token: SeMachineAccountPrivilege 6792 msiexec.exe Token: SeTcbPrivilege 6792 msiexec.exe Token: SeSecurityPrivilege 6792 msiexec.exe Token: SeTakeOwnershipPrivilege 6792 msiexec.exe Token: SeLoadDriverPrivilege 6792 msiexec.exe Token: SeSystemProfilePrivilege 6792 msiexec.exe Token: SeSystemtimePrivilege 6792 msiexec.exe Token: SeProfSingleProcessPrivilege 6792 msiexec.exe Token: SeIncBasePriorityPrivilege 6792 msiexec.exe Token: SeCreatePagefilePrivilege 6792 msiexec.exe Token: SeCreatePermanentPrivilege 6792 msiexec.exe Token: SeBackupPrivilege 6792 msiexec.exe Token: SeRestorePrivilege 6792 msiexec.exe Token: SeShutdownPrivilege 6792 msiexec.exe Token: SeDebugPrivilege 6792 msiexec.exe Token: SeAuditPrivilege 6792 msiexec.exe Token: SeSystemEnvironmentPrivilege 6792 msiexec.exe Token: SeChangeNotifyPrivilege 6792 msiexec.exe Token: SeRemoteShutdownPrivilege 6792 msiexec.exe Token: SeUndockPrivilege 6792 msiexec.exe Token: SeSyncAgentPrivilege 6792 msiexec.exe Token: SeEnableDelegationPrivilege 6792 msiexec.exe Token: SeManageVolumePrivilege 6792 msiexec.exe Token: SeImpersonatePrivilege 6792 msiexec.exe Token: SeCreateGlobalPrivilege 6792 msiexec.exe Token: SeCreateTokenPrivilege 6792 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 6792 msiexec.exe Token: SeLockMemoryPrivilege 6792 msiexec.exe Token: SeIncreaseQuotaPrivilege 6792 msiexec.exe Token: SeMachineAccountPrivilege 6792 msiexec.exe Token: SeTcbPrivilege 6792 msiexec.exe Token: SeSecurityPrivilege 6792 msiexec.exe Token: SeTakeOwnershipPrivilege 6792 msiexec.exe Token: SeLoadDriverPrivilege 6792 msiexec.exe Token: SeSystemProfilePrivilege 6792 msiexec.exe Token: SeSystemtimePrivilege 6792 msiexec.exe Token: SeProfSingleProcessPrivilege 6792 msiexec.exe Token: SeIncBasePriorityPrivilege 6792 msiexec.exe Token: SeCreatePagefilePrivilege 6792 msiexec.exe Token: SeCreatePermanentPrivilege 6792 msiexec.exe Token: SeBackupPrivilege 6792 msiexec.exe Token: SeRestorePrivilege 6792 msiexec.exe Token: SeShutdownPrivilege 6792 msiexec.exe Token: SeDebugPrivilege 6792 msiexec.exe Token: SeAuditPrivilege 6792 msiexec.exe Token: SeSystemEnvironmentPrivilege 6792 msiexec.exe Token: SeChangeNotifyPrivilege 6792 msiexec.exe Token: SeRemoteShutdownPrivilege 6792 msiexec.exe Token: SeUndockPrivilege 6792 msiexec.exe Token: SeSyncAgentPrivilege 6792 msiexec.exe Token: SeEnableDelegationPrivilege 6792 msiexec.exe Token: SeManageVolumePrivilege 6792 msiexec.exe Token: SeImpersonatePrivilege 6792 msiexec.exe Token: SeCreateGlobalPrivilege 6792 msiexec.exe Token: SeCreateTokenPrivilege 6792 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 6792 msiexec.exe Token: SeLockMemoryPrivilege 6792 msiexec.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 6792 msiexec.exe - Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 6792 msiexec.exe 1096 msiexec.exe 4648 MsiExec.exe - Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 3732 wrote to memory of 6792 3732 AdblockForYoutube_AdBlock360.exe 90 PID 1096 wrote to memory of 4648 1096 msiexec.exe 92
Processes
-
C:\Users\Admin\AppData\Local\Temp\AdblockForYoutube_AdBlock360.exe"C:\Users\Admin\AppData\Local\Temp\AdblockForYoutube_AdBlock360.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3732 -
C:\Windows\SYSTEM32\msiexec.exemsiexec /i "C:\Users\Admin\AppData\Local\Temp\D69BB574-E533-4232-990B-A7FABF9452E4\AdBlock360-Setup_4.3.1.0010.msi" /L*V "C:\Users\Admin\AppData\Local\Temp\AdBlock360-Installer.log"2⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:6792
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1096 -
C:\Windows\System32\MsiExec.exeC:\Windows\System32\MsiExec.exe -Embedding E6BEBC2DD135560B2578015C685649C6 U2⤵
- Badlisted process makes network request
- Drops file in Program Files directory
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4648
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\D69BB574-E533-4232-990B-A7FABF9452E4\AdBlock360-Setup_4.3.1.0010.msi
- Size 32.8MB
- SHA256 7437a53313e01d7c49dc28ae4f2b955c009eded90ba1aabaeee65b901f81106b
- MD5 45cbae3cc2719e49fbdf1decb913603e
- SHA1 d9abd345f56836cea674d6e64170203f6bd73049
- SHA512 59643238cab3f3f63ba7e4cb99678deec1ab57a80d0b6ff6cdd07dd38a2cc5a8a18007995709d079769e9fe72638dba5f1d74fe02c14ab32ec7dbf27f0e39bdd
- SSDEEP 786432:8vhgP3GqfTuQxbI9w6S/bS3yOW8Uc4OzLj0vhQwc4IVqd1h:8vsGSqQuwp/btOW8UcPzsv2wcJ8T
- TLSH T137772207FEB489E4D9628870597E03FD7D2368C706AD859A2570233FDBA62CC85766F0
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\MSI16826\EmbeddedUI.config
- Size 980B
- SHA256 1a67f60962ca1cbf19873b62a8518efe8c701a09cd609af4c50ecc7f0b468bb8
- MD5 c9c40af1656f8531eaa647caceb1e436
- SHA1 907837497508de13d5a7e60697fc9d050e327e19
- SHA512 0f7033686befa3f4acf3ed355c1674eaa6e349fba97e906446c8a7000be6876f157bc015bf5d3011fbbdc2c771bcbaea97918b8d24c064cbbd302741cc70cbc7
- TLSH T1E2111C2C85E4F92B9A325A533A208896EFB0A1B2A174510CB09FBA170F720CE8257325
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\MSI16826\WixSharp.UI.CA.dll
- Size 2.9MB
- SHA256 d96266f1ed975265d8a560079e3e6c084baf23bc30cdc82a7adcee9adddf009d
- MD5 dd8c136f37e06401c15df2dc7682e810
- SHA1 f52b62e7ffd4faaf0c115db8b47921456de063aa
- SHA512 6cd546dd43fb6dc1a2e8f83f7216f258a64fbed91102837004ee2a7a649b906abc444a0c789a1c25f508fa3cfcf401b67722a02a5c2a83164489471d6a1624a6
- SSDEEP 49152:sziIZJlKzDh1T8hNUoKqpLl/JDFyG1SQKs4MlR7wiNIAXjeSQiHu7u2KwWESFr:94fGh1T8EofPDFyG1vKsjkiNIbn62Kio
- TLSH T1A4E5236737F909A9F8775279886B46099633BD009730E6FF03601549DF3B7E0447ABA2
- MD5 SHA1 SHA512 SSDEEP TLSH