Analysis
- max time kernel
148s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
22/08/2026, 16:36
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
QuickLook-4.5.0.msi
Resource
win10v2004-20260513-en
windows10-2004-x64
18 signatures
150 seconds
Behavioral task
behavioral2
Sample
QuickLook-4.5.0.msi
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
5 signatures
150 seconds
General
- Target QuickLook-4.5.0.msi
- Size 90.1MB
- Sample260822-t4e76swfph
- SHA256 130f601eab7c388025351312f949749adebc6429b1042bd2001ac32a17a2748c
- MD5 9677c88390b435cddf98f895f83c893d
- SHA1 b25a7f88045027d680777b21f7f18742498ab346
- SHA512 bbe19d900b3ca6aaa101c0d23668dce143d8ae04b0589deafb2224e5ed4945ae039f0871bd96952caed35bc702b6c105e956f0f8b557453f2f2e0669b8235e89
- SSDEEP 1572864:8dvv0au3Cqt9O4h6JOZbP1xOuMYCoI12J8mP7DyIjbIBlSpTCCH5rwAJwKtBanwU:8x63C5CBZro0DPXvjx55wzCw
- TLSH T14D2833633D924C31E489AE7687FA27C587768C3CB365904A16253A1FCCFE5E84A4E0F5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
Malware Config
Signatures
- Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\D: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\X: msiexec.exe - Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
pid Process 5460 msiexec.exe - Suspicious use of AdjustPrivilegeToken 32 IoCs
description pid Process Token: SeShutdownPrivilege 5460 msiexec.exe Token: SeIncreaseQuotaPrivilege 5460 msiexec.exe Token: SeSecurityPrivilege 3272 msiexec.exe Token: SeCreateTokenPrivilege 5460 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 5460 msiexec.exe Token: SeLockMemoryPrivilege 5460 msiexec.exe Token: SeIncreaseQuotaPrivilege 5460 msiexec.exe Token: SeMachineAccountPrivilege 5460 msiexec.exe Token: SeTcbPrivilege 5460 msiexec.exe Token: SeSecurityPrivilege 5460 msiexec.exe Token: SeTakeOwnershipPrivilege 5460 msiexec.exe Token: SeLoadDriverPrivilege 5460 msiexec.exe Token: SeSystemProfilePrivilege 5460 msiexec.exe Token: SeSystemtimePrivilege 5460 msiexec.exe Token: SeProfSingleProcessPrivilege 5460 msiexec.exe Token: SeIncBasePriorityPrivilege 5460 msiexec.exe Token: SeCreatePagefilePrivilege 5460 msiexec.exe Token: SeCreatePermanentPrivilege 5460 msiexec.exe Token: SeBackupPrivilege 5460 msiexec.exe Token: SeRestorePrivilege 5460 msiexec.exe Token: SeShutdownPrivilege 5460 msiexec.exe Token: SeDebugPrivilege 5460 msiexec.exe Token: SeAuditPrivilege 5460 msiexec.exe Token: SeSystemEnvironmentPrivilege 5460 msiexec.exe Token: SeChangeNotifyPrivilege 5460 msiexec.exe Token: SeRemoteShutdownPrivilege 5460 msiexec.exe Token: SeUndockPrivilege 5460 msiexec.exe Token: SeSyncAgentPrivilege 5460 msiexec.exe Token: SeEnableDelegationPrivilege 5460 msiexec.exe Token: SeManageVolumePrivilege 5460 msiexec.exe Token: SeImpersonatePrivilege 5460 msiexec.exe Token: SeCreateGlobalPrivilege 5460 msiexec.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 5460 msiexec.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 5460 msiexec.exe 3272 msiexec.exe
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\QuickLook-4.5.0.msi1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:5460
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:3272