Analysis
- user interaction
yes - max time kernel
208s - max time network
213s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
28/08/2026, 16:14
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
SafariSetup.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
18 signatures
150 seconds
Behavioral task
behavioral2
Sample
SafariSetup.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
10 signatures
150 seconds
General
- Target SafariSetup.exe
- Size 36.7MB
- Sample260828-tpxtnszhld
- SHA256 155bb96bc972f227c563e2c3db12ea00d212af6c1fe882e0e944d6b5e1aaa3ee
- MD5 0a5b39a859eb84484d5559a8ba22f736
- SHA1 f601df0106987bfffc3f22b046ba835e4f8d29c6
- SHA512 2b202c765ca9dc8b44e5a280c4b383bb94c0ac8329de4c1d5e6cae779eec8dba93875837823922a23a3a3ecdbbb3382abf274e49e8c5a28412f69249193c0fd4
- SSDEEP 786432:ih/DSDRXOhV6/PxKsr5xq5FMr8Tig4kPWywo6r0A2zZ23gtXycoHjxlx7UnH3L3F:4gRXkA952FMQD9WXfJ2z499VT7geK
- TLSH T1F587334B2264049AF5DF1672310112A0E3B5CAB2526AC7F52386A7975E133C1FEFD36E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 5800 SetupAdmin.exe - Loads dropped DLL 5 IoCs
pid Process 5788 MsiExec.exe 5788 MsiExec.exe 5788 MsiExec.exe 5788 MsiExec.exe 5788 MsiExec.exe - Badlisted process makes network request 1 IoCs
Network request originating from process or tool commonly abused by malware.
flow pid Process 2 4704 msiexec.exe - Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\D: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\D: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\H: msiexec.exe - System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SafariSetup.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language msiexec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SetupAdmin.exe - Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 5788 MsiExec.exe 5788 MsiExec.exe 5788 MsiExec.exe 5788 MsiExec.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: 33 2524 SafariSetup.exe Token: SeIncBasePriorityPrivilege 2524 SafariSetup.exe Token: SeShutdownPrivilege 4704 msiexec.exe Token: SeIncreaseQuotaPrivilege 4704 msiexec.exe Token: SeSecurityPrivilege 4788 msiexec.exe Token: SeCreateTokenPrivilege 4704 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 4704 msiexec.exe Token: SeLockMemoryPrivilege 4704 msiexec.exe Token: SeIncreaseQuotaPrivilege 4704 msiexec.exe Token: SeMachineAccountPrivilege 4704 msiexec.exe Token: SeTcbPrivilege 4704 msiexec.exe Token: SeSecurityPrivilege 4704 msiexec.exe Token: SeTakeOwnershipPrivilege 4704 msiexec.exe Token: SeLoadDriverPrivilege 4704 msiexec.exe Token: SeSystemProfilePrivilege 4704 msiexec.exe Token: SeSystemtimePrivilege 4704 msiexec.exe Token: SeProfSingleProcessPrivilege 4704 msiexec.exe Token: SeIncBasePriorityPrivilege 4704 msiexec.exe Token: SeCreatePagefilePrivilege 4704 msiexec.exe Token: SeCreatePermanentPrivilege 4704 msiexec.exe Token: SeBackupPrivilege 4704 msiexec.exe Token: SeRestorePrivilege 4704 msiexec.exe Token: SeShutdownPrivilege 4704 msiexec.exe Token: SeDebugPrivilege 4704 msiexec.exe Token: SeAuditPrivilege 4704 msiexec.exe Token: SeSystemEnvironmentPrivilege 4704 msiexec.exe Token: SeChangeNotifyPrivilege 4704 msiexec.exe Token: SeRemoteShutdownPrivilege 4704 msiexec.exe Token: SeUndockPrivilege 4704 msiexec.exe Token: SeSyncAgentPrivilege 4704 msiexec.exe Token: SeEnableDelegationPrivilege 4704 msiexec.exe Token: SeManageVolumePrivilege 4704 msiexec.exe Token: SeImpersonatePrivilege 4704 msiexec.exe Token: SeCreateGlobalPrivilege 4704 msiexec.exe Token: SeCreateTokenPrivilege 4704 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 4704 msiexec.exe Token: SeLockMemoryPrivilege 4704 msiexec.exe Token: SeIncreaseQuotaPrivilege 4704 msiexec.exe Token: SeMachineAccountPrivilege 4704 msiexec.exe Token: SeTcbPrivilege 4704 msiexec.exe Token: SeSecurityPrivilege 4704 msiexec.exe Token: SeTakeOwnershipPrivilege 4704 msiexec.exe Token: SeLoadDriverPrivilege 4704 msiexec.exe Token: SeSystemProfilePrivilege 4704 msiexec.exe Token: SeSystemtimePrivilege 4704 msiexec.exe Token: SeProfSingleProcessPrivilege 4704 msiexec.exe Token: SeIncBasePriorityPrivilege 4704 msiexec.exe Token: SeCreatePagefilePrivilege 4704 msiexec.exe Token: SeCreatePermanentPrivilege 4704 msiexec.exe Token: SeBackupPrivilege 4704 msiexec.exe Token: SeRestorePrivilege 4704 msiexec.exe Token: SeShutdownPrivilege 4704 msiexec.exe Token: SeDebugPrivilege 4704 msiexec.exe Token: SeAuditPrivilege 4704 msiexec.exe Token: SeSystemEnvironmentPrivilege 4704 msiexec.exe Token: SeChangeNotifyPrivilege 4704 msiexec.exe Token: SeRemoteShutdownPrivilege 4704 msiexec.exe Token: SeUndockPrivilege 4704 msiexec.exe Token: SeSyncAgentPrivilege 4704 msiexec.exe Token: SeEnableDelegationPrivilege 4704 msiexec.exe Token: SeManageVolumePrivilege 4704 msiexec.exe Token: SeImpersonatePrivilege 4704 msiexec.exe Token: SeCreateGlobalPrivilege 4704 msiexec.exe Token: SeCreateTokenPrivilege 4704 msiexec.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 4704 msiexec.exe - Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 4704 msiexec.exe 4788 msiexec.exe 5788 MsiExec.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2524 wrote to memory of 4704 2524 SafariSetup.exe 89 PID 4788 wrote to memory of 5788 4788 msiexec.exe 91 PID 5788 wrote to memory of 5800 5788 MsiExec.exe 92
Processes
-
C:\Users\Admin\AppData\Local\Temp\SafariSetup.exe"C:\Users\Admin\AppData\Local\Temp\SafariSetup.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2524 -
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\IXP981.TMP\Safari.msi"2⤵
- Badlisted process makes network request
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:4704
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4788 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding A64D19E3972846BE49B08A6EE5FDBAF8 C2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5788 -
C:\Users\Admin\AppData\Local\Temp\IXP981.TMP\SetupAdmin.exe"C:\Users\Admin\AppData\Local\Temp\IXP981.TMP\SetupAdmin.exe" /evt E0E4 /pid 5788 /mon 772 8163⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5800
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\IXP981.TMP\Safari.msi
- Size 36.5MB
- SHA256 284980414194a17f06a69e98668298e60541355da9cc98dbf5e463060489c346
- MD5 f773b94495158efdebd8c0d4eaf8f811
- SHA1 dd000af044d8e71da7e37b80664638168ca57061
- SHA512 714bf2314d16b02016b5d5f5177b8eaa9bb8430b6f136f10a658a40d1e2b5359f40f1496ce641ba660c84f22a38c2bd02a68fa77c961b5aa92e763cdfb2d5cf8
- SSDEEP 786432:sycB87Hjtg/dVn1ZH1vP5U94KYFRXrGu8Ku71sWyoR5RDzu9D:sLB8DjEdVJvy9WRiuQbq9D
- TLSH T19887233FFA915125DAEE03FA8D2783DA55FB4D15CA31901E7C9CB20B0D73388926B586
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\IXP981.TMP\SetupAdmin.exe
- Size 71KB
- SHA256 2775f70e2a46727214411601ca877c1634691d0195d6e3d1a0ed378982a12c78
- MD5 95fd3dfe3726203b4c41b9f86ef754e4
- SHA1 89582a9c5ad75ac213fdde577ac9a445e3b60e75
- SHA512 f654225b1caaf726173addfdc2864ba263a118b1e5ab2ddd48c934fac6a1fba0d073120caec42237686bba722d6095ea59772ca050977247bfaefd0c8f475905
- SSDEEP 1536:LRl/+GUzWi3CqhP7oaB9QP8tWtXMxhY3H:tt6cP8tWtcxyX
- TLSH T186737D12F600C432C44558749569D3B28A3EB9329BB894C777D90BFE9F213E1A73A34B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\MSI14A7.tmp
- Size 107KB
- SHA256 8fa25a80b268d1564e2363c96fbd6d19886fd4d6423f6bf85cd4ce9de5608018
- MD5 a458c54d774b188338e7b6128b0d60df
- SHA1 06ad2bc811ba5b9ad3a816ee645ab0802809c19b
- SHA512 6cbae4445bb996a6add7932f16b749b5c5edd7786dc6cc276e22eb503f8a512c4021a447240390eb9404fe4fb47506e0908cbae7fcd9c51615365dbc5f7fb14b
- SSDEEP 1536:Nb+zq3km2IhUqupm1dShIDRjBlkD2ALe+vit0GhS8mACrtK3XZ0vtQsnXK:1jUmkIdMINB2X6S80rtK3XZ0vF6
- TLSH T1C2B37C11B690C033C4DA187D4226D761AA3FBD705FA8DCC7B7A40B794F707D1AA3629A
- MD5 SHA1 SHA512 SSDEEP TLSH