Analysis
- max time kernel
149s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
09/09/2026, 07:28
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
a078ea491822b8d8014821cdcce8bcb450947a9e1c5e0b55d259df864978ee17.msi
Resource
win10v2004-20260513-en
windows10-2004-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
a078ea491822b8d8014821cdcce8bcb450947a9e1c5e0b55d259df864978ee17.msi
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
9 signatures
150 seconds
General
- Target a078ea491822b8d8014821cdcce8bcb450947a9e1c5e0b55d259df864978ee17.msi
- Size 1.5MB
- Sample260909-janx4stdmg
- SHA256 a078ea491822b8d8014821cdcce8bcb450947a9e1c5e0b55d259df864978ee17
- MD5 8c6e41076bffd798cf2a96afc6e1c259
- SHA1 e6abb362a5bac3a5322590e2b7836555348a397f
- SHA512 db2cb265c2bd27df377476dadb902887e85316e0a827df344dbf1228d69a4a1c6635d3780a2f0a24756d63160505bf471d4669c88d3f8815534c0bf9de926241
- SSDEEP 24576:raSabiciRXdA7rD8jVssaSab0QYECTyu9U2kNf4PCql8r:JatiZdA7rYjhaIQ1pu9hKNr
- TLSH T10E75CE0B7F952925E8A34E758937076DD2767D0026A0869B02B0F279DEF73C0593BBD2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
Malware Config
Signatures
- Badlisted process makes network request 11 IoCs
Network request originating from process or tool commonly abused by malware.
flow pid Process 3 1268 rundll32.exe 4 1268 rundll32.exe 4 1268 rundll32.exe 12 1268 rundll32.exe 25 1268 rundll32.exe 26 1268 rundll32.exe 27 1268 rundll32.exe 28 1268 rundll32.exe 31 1268 rundll32.exe 33 1268 rundll32.exe 34 1268 rundll32.exe - Loads dropped DLL 4 IoCs
pid Process 1704 MsiExec.exe 1268 rundll32.exe 1268 rundll32.exe 1268 rundll32.exe - Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\S: msiexec.exe - Drops file in Windows directory 4 IoCs
description ioc Process File opened for modification C:\Windows\Installer\SFXCAF49F4070984EF0CB5B6A49D79D3AA420\WixSharp.dll rundll32.exe File opened for modification C:\Windows\Installer\SFXCAF49F4070984EF0CB5B6A49D79D3AA420\CustomAction.config rundll32.exe File opened for modification C:\Windows\Installer\SFXCAF49F4070984EF0CB5B6A49D79D3AA420\WindowsMSI.exe rundll32.exe File opened for modification C:\Windows\Installer\SFXCAF49F4070984EF0CB5B6A49D79D3AA420\WixToolset.Dtf.WindowsInstaller.dll rundll32.exe - Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
pid Process 3860 msiexec.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 3860 msiexec.exe Token: SeIncreaseQuotaPrivilege 3860 msiexec.exe Token: SeSecurityPrivilege 3872 msiexec.exe Token: SeCreateTokenPrivilege 3860 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 3860 msiexec.exe Token: SeLockMemoryPrivilege 3860 msiexec.exe Token: SeIncreaseQuotaPrivilege 3860 msiexec.exe Token: SeMachineAccountPrivilege 3860 msiexec.exe Token: SeTcbPrivilege 3860 msiexec.exe Token: SeSecurityPrivilege 3860 msiexec.exe Token: SeTakeOwnershipPrivilege 3860 msiexec.exe Token: SeLoadDriverPrivilege 3860 msiexec.exe Token: SeSystemProfilePrivilege 3860 msiexec.exe Token: SeSystemtimePrivilege 3860 msiexec.exe Token: SeProfSingleProcessPrivilege 3860 msiexec.exe Token: SeIncBasePriorityPrivilege 3860 msiexec.exe Token: SeCreatePagefilePrivilege 3860 msiexec.exe Token: SeCreatePermanentPrivilege 3860 msiexec.exe Token: SeBackupPrivilege 3860 msiexec.exe Token: SeRestorePrivilege 3860 msiexec.exe Token: SeShutdownPrivilege 3860 msiexec.exe Token: SeDebugPrivilege 3860 msiexec.exe Token: SeAuditPrivilege 3860 msiexec.exe Token: SeSystemEnvironmentPrivilege 3860 msiexec.exe Token: SeChangeNotifyPrivilege 3860 msiexec.exe Token: SeRemoteShutdownPrivilege 3860 msiexec.exe Token: SeUndockPrivilege 3860 msiexec.exe Token: SeSyncAgentPrivilege 3860 msiexec.exe Token: SeEnableDelegationPrivilege 3860 msiexec.exe Token: SeManageVolumePrivilege 3860 msiexec.exe Token: SeImpersonatePrivilege 3860 msiexec.exe Token: SeCreateGlobalPrivilege 3860 msiexec.exe Token: SeCreateTokenPrivilege 3860 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 3860 msiexec.exe Token: SeLockMemoryPrivilege 3860 msiexec.exe Token: SeIncreaseQuotaPrivilege 3860 msiexec.exe Token: SeMachineAccountPrivilege 3860 msiexec.exe Token: SeTcbPrivilege 3860 msiexec.exe Token: SeSecurityPrivilege 3860 msiexec.exe Token: SeTakeOwnershipPrivilege 3860 msiexec.exe Token: SeLoadDriverPrivilege 3860 msiexec.exe Token: SeSystemProfilePrivilege 3860 msiexec.exe Token: SeSystemtimePrivilege 3860 msiexec.exe Token: SeProfSingleProcessPrivilege 3860 msiexec.exe Token: SeIncBasePriorityPrivilege 3860 msiexec.exe Token: SeCreatePagefilePrivilege 3860 msiexec.exe Token: SeCreatePermanentPrivilege 3860 msiexec.exe Token: SeBackupPrivilege 3860 msiexec.exe Token: SeRestorePrivilege 3860 msiexec.exe Token: SeShutdownPrivilege 3860 msiexec.exe Token: SeDebugPrivilege 3860 msiexec.exe Token: SeAuditPrivilege 3860 msiexec.exe Token: SeSystemEnvironmentPrivilege 3860 msiexec.exe Token: SeChangeNotifyPrivilege 3860 msiexec.exe Token: SeRemoteShutdownPrivilege 3860 msiexec.exe Token: SeUndockPrivilege 3860 msiexec.exe Token: SeSyncAgentPrivilege 3860 msiexec.exe Token: SeEnableDelegationPrivilege 3860 msiexec.exe Token: SeManageVolumePrivilege 3860 msiexec.exe Token: SeImpersonatePrivilege 3860 msiexec.exe Token: SeCreateGlobalPrivilege 3860 msiexec.exe Token: SeCreateTokenPrivilege 3860 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 3860 msiexec.exe Token: SeLockMemoryPrivilege 3860 msiexec.exe - Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 3860 msiexec.exe 3860 msiexec.exe - Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 3872 wrote to memory of 1704 3872 msiexec.exe 87 PID 1704 wrote to memory of 1268 1704 MsiExec.exe 88
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\a078ea491822b8d8014821cdcce8bcb450947a9e1c5e0b55d259df864978ee17.msi1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3860
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3872 -
C:\Windows\System32\MsiExec.exeC:\Windows\System32\MsiExec.exe -Embedding A7C85D74B0E9B64961C6FCCCAF80DA20 C2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1704 -
C:\Windows\system32\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSIFB67.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240647125 1 WixSharp!WixSharp.ManagedProjectActions.WixSharp_Load_Action3⤵
- Badlisted process makes network request
- Loads dropped DLL
- Drops file in Windows directory
PID:1268
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\MSIFB67.tmp
- Size 565KB
- SHA256 cfb3edf8a6db313a22a777e41e07eb4fa9fba7dce748be36c849c68e342155eb
- MD5 e54b03b28667b356e3f606de4ad1aa52
- SHA1 3ef9eed23651be8cdea932a6f71913e7a9d8d004
- SHA512 e2aea358eff5f641b194cf202716865900a9f3a8fd113bc67097c0ddbac874ade39a582becd516a9679188c63e8c578ddef511c220e6719f9beb3f4035fb32d3
- SSDEEP 12288:YaSabyWAm8BdCoZjTnvcCTyux3W5442kNaUjy04W2Pqun:YaSab0QYECTyu9U2kNf4PCi
- TLSH T154C4E01977F50D66FCB7913989630605E6B27C529B31CADF0390425A9F2F7D0A83AF22
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\SFXCAF49F4070984EF0CB5B6A49D79D3AA420\WindowsMSI.exe
- Size 19KB
- SHA256 f0a50fdff418e7785cb402b5e9cf676ea22a59a6507ca8d295a3e7b586167b0b
- MD5 706008a8d03e6df8897acb2bda41f4f1
- SHA1 55d29e00c58bc0771347d0a3396856add84d79ef
- SHA512 69a362b4b9be79835d5745bc8beb639d4a5b03c593b653f6123f712ba56f74f740bb352c6850edc756851fdf56bb0119957bbb2a63fce0bc00854a7a8cca4abe
- SSDEEP 384:cJ5kOGYQwDaULlBRQpuXj9Oqb3iBvYeD92Z4y6i0ojuT5KPHCvYQeG+n:wdG0pfJj9tmXPrqBGu
- TLSH T134920849EBE40236E5FF07B56D72821246F1FA060E22CF5E09C450DE6FB77984626B72
- MD5 SHA1 SHA512 SSDEEP TLSH