Analysis
- max time kernel
148s - max time network
141s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
22/08/2026, 00:17
Static task
static1
Behavioral task
behavioral1
Sample
msodbcsql.msi
Resource
win10v2004-20260513-en
windows10-2004-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
msodbcsql.msi
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
7 signatures
150 seconds
General
- Target msodbcsql.msi
- Size 6.9MB
- Sample260822-alfansek3w
- SHA256 3ff9042787efc544191b002cc398516c75dc974df37bb532502e7f6468c6337f
- MD5 7cd6bac876f25b170a40ca7c91d2a94c
- SHA1 078a44bbcc811f8bce96ec74bb756223171102ec
- SHA512 b4c4c7f61e9d583f116361f79f994144d77c03bab527a22a1e25928fbd5209c7420e3d12212a78142f8a8bab7533c80a1fbfd3991ce6fcf09bb380f023c76086
- SSDEEP 196608:h0mQDE3C0tGY5YKthjyxdfIVC87QRpqbyuUHFk:hpZttGQLhjGdfMCdxuI
- TLSH T1CC76124A7AF09023D263833F966307A6E5657F14C72C42FF254776AE2E727E14A343A1
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Loads dropped DLL 2 IoCs
pid Process 2332 MsiExec.exe 2332 MsiExec.exe - Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\D: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\D: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\Z: msiexec.exe - Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
pid Process 3516 msiexec.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 3516 msiexec.exe Token: SeIncreaseQuotaPrivilege 3516 msiexec.exe Token: SeSecurityPrivilege 3652 msiexec.exe Token: SeCreateTokenPrivilege 3516 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 3516 msiexec.exe Token: SeLockMemoryPrivilege 3516 msiexec.exe Token: SeIncreaseQuotaPrivilege 3516 msiexec.exe Token: SeMachineAccountPrivilege 3516 msiexec.exe Token: SeTcbPrivilege 3516 msiexec.exe Token: SeSecurityPrivilege 3516 msiexec.exe Token: SeTakeOwnershipPrivilege 3516 msiexec.exe Token: SeLoadDriverPrivilege 3516 msiexec.exe Token: SeSystemProfilePrivilege 3516 msiexec.exe Token: SeSystemtimePrivilege 3516 msiexec.exe Token: SeProfSingleProcessPrivilege 3516 msiexec.exe Token: SeIncBasePriorityPrivilege 3516 msiexec.exe Token: SeCreatePagefilePrivilege 3516 msiexec.exe Token: SeCreatePermanentPrivilege 3516 msiexec.exe Token: SeBackupPrivilege 3516 msiexec.exe Token: SeRestorePrivilege 3516 msiexec.exe Token: SeShutdownPrivilege 3516 msiexec.exe Token: SeDebugPrivilege 3516 msiexec.exe Token: SeAuditPrivilege 3516 msiexec.exe Token: SeSystemEnvironmentPrivilege 3516 msiexec.exe Token: SeChangeNotifyPrivilege 3516 msiexec.exe Token: SeRemoteShutdownPrivilege 3516 msiexec.exe Token: SeUndockPrivilege 3516 msiexec.exe Token: SeSyncAgentPrivilege 3516 msiexec.exe Token: SeEnableDelegationPrivilege 3516 msiexec.exe Token: SeManageVolumePrivilege 3516 msiexec.exe Token: SeImpersonatePrivilege 3516 msiexec.exe Token: SeCreateGlobalPrivilege 3516 msiexec.exe Token: SeCreateTokenPrivilege 3516 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 3516 msiexec.exe Token: SeLockMemoryPrivilege 3516 msiexec.exe Token: SeIncreaseQuotaPrivilege 3516 msiexec.exe Token: SeMachineAccountPrivilege 3516 msiexec.exe Token: SeTcbPrivilege 3516 msiexec.exe Token: SeSecurityPrivilege 3516 msiexec.exe Token: SeTakeOwnershipPrivilege 3516 msiexec.exe Token: SeLoadDriverPrivilege 3516 msiexec.exe Token: SeSystemProfilePrivilege 3516 msiexec.exe Token: SeSystemtimePrivilege 3516 msiexec.exe Token: SeProfSingleProcessPrivilege 3516 msiexec.exe Token: SeIncBasePriorityPrivilege 3516 msiexec.exe Token: SeCreatePagefilePrivilege 3516 msiexec.exe Token: SeCreatePermanentPrivilege 3516 msiexec.exe Token: SeBackupPrivilege 3516 msiexec.exe Token: SeRestorePrivilege 3516 msiexec.exe Token: SeShutdownPrivilege 3516 msiexec.exe Token: SeDebugPrivilege 3516 msiexec.exe Token: SeAuditPrivilege 3516 msiexec.exe Token: SeSystemEnvironmentPrivilege 3516 msiexec.exe Token: SeChangeNotifyPrivilege 3516 msiexec.exe Token: SeRemoteShutdownPrivilege 3516 msiexec.exe Token: SeUndockPrivilege 3516 msiexec.exe Token: SeSyncAgentPrivilege 3516 msiexec.exe Token: SeEnableDelegationPrivilege 3516 msiexec.exe Token: SeManageVolumePrivilege 3516 msiexec.exe Token: SeImpersonatePrivilege 3516 msiexec.exe Token: SeCreateGlobalPrivilege 3516 msiexec.exe Token: SeCreateTokenPrivilege 3516 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 3516 msiexec.exe Token: SeLockMemoryPrivilege 3516 msiexec.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 3516 msiexec.exe - Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 3516 msiexec.exe 3652 msiexec.exe 2332 MsiExec.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 3652 wrote to memory of 2332 3652 msiexec.exe 89
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\msodbcsql.msi1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:3516
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3652 -
C:\Windows\System32\MsiExec.exeC:\Windows\System32\MsiExec.exe -Embedding B753C2932A5AB2ECF3D34879598C5453 C2⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:2332
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\MSIE313.tmp
- Size 121KB
- SHA256 a16dc706d22a5c22ab5d4f2ea4597fbf5239699c5caa509f0cc0d52b22ef5da2
- MD5 2e71fcddfef1213d05131b369e11e2b1
- SHA1 aefeed5150a1482a539a6af889dc28847d0a6cb7
- SHA512 a95c1673278d52edbcc97946bb3706312f5784a0e648018a4c725f81ed2e387fd9e7b3b075d466d3cf3cdf6504ec6ac341b8938524dd4bbe9a96c1666a22e0d4
- SSDEEP 3072:5ulUwe7+V64rzVIZd/pASIZ24iZJqMlqAwHPtLk:5u47+V6RZdhAHacPt
- TLSH T1E7C35B54B7E910AAE137823D88A15B06EA76F41207219BFF036C025E1F63BD18D3DFA1
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\MSIE3A1.tmp
- Size 29KB
- SHA256 8075c1f208c3f4957c3f516a920b2c7fbae6c26612d6720a8b75f52f8f9346cd
- MD5 0b75036c1ac640ad02e444364c16aeaa
- SHA1 5008cd427a42b9a0410bf2427eb0e60ecc23df51
- SHA512 69ff58e7fb6c962c265b764a4c6e9a7990354dbdf5fba2cde56582330b19283f2fd092e005a54950860483262b69c58c8d9ab27e75de53c5923eb7ff7d7b8394
- SSDEEP 384:RXdeAkSGKjc0jjKaaehAei1LgLPW++WG1+aHRN7zhER9zoSKd:vtYCKa3vi1Lgtq+2do9zY
- TLSH T13DD24D4AABB85092F8B7957841B2DE1ABC35B7920720D3CF0371960D0E63FD4B636399
- MD5 SHA1 SHA512 SSDEEP TLSH