Analysis
- max time kernel
149s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
10/09/2026, 23:59
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
a078ea491822b8d8014821cdcce8bcb450947a9e1c5e0b55d259df864978ee17.msi
Resource
win10v2004-20260513-en
windows10-2004-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
a078ea491822b8d8014821cdcce8bcb450947a9e1c5e0b55d259df864978ee17.msi
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
9 signatures
150 seconds
General
- Target a078ea491822b8d8014821cdcce8bcb450947a9e1c5e0b55d259df864978ee17.msi
- Size 1.5MB
- Sample260910-312rfazvdv
- SHA256 a078ea491822b8d8014821cdcce8bcb450947a9e1c5e0b55d259df864978ee17
- MD5 8c6e41076bffd798cf2a96afc6e1c259
- SHA1 e6abb362a5bac3a5322590e2b7836555348a397f
- SHA512 db2cb265c2bd27df377476dadb902887e85316e0a827df344dbf1228d69a4a1c6635d3780a2f0a24756d63160505bf471d4669c88d3f8815534c0bf9de926241
- SSDEEP 24576:raSabiciRXdA7rD8jVssaSab0QYECTyu9U2kNf4PCql8r:JatiZdA7rYjhaIQ1pu9hKNr
- TLSH T10E75CE0B7F952925E8A34E758937076DD2767D0026A0869B02B0F279DEF73C0593BBD2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
Malware Config
Signatures
- Badlisted process makes network request 12 IoCs
Network request originating from process or tool commonly abused by malware.
flow pid Process 5 3892 rundll32.exe 10 3892 rundll32.exe 11 3892 rundll32.exe 12 3892 rundll32.exe 17 3892 rundll32.exe 20 3892 rundll32.exe 20 3892 rundll32.exe 38 3892 rundll32.exe 39 3892 rundll32.exe 40 3892 rundll32.exe 41 3892 rundll32.exe 41 3892 rundll32.exe - Loads dropped DLL 4 IoCs
pid Process 3328 MsiExec.exe 3892 rundll32.exe 3892 rundll32.exe 3892 rundll32.exe - Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\Q: msiexec.exe - Drops file in Windows directory 4 IoCs
description ioc Process File opened for modification C:\Windows\Installer\SFXCAEEE22AFD144914BB358CEA1618699BE8\CustomAction.config rundll32.exe File opened for modification C:\Windows\Installer\SFXCAEEE22AFD144914BB358CEA1618699BE8\WindowsMSI.exe rundll32.exe File opened for modification C:\Windows\Installer\SFXCAEEE22AFD144914BB358CEA1618699BE8\WixToolset.Dtf.WindowsInstaller.dll rundll32.exe File opened for modification C:\Windows\Installer\SFXCAEEE22AFD144914BB358CEA1618699BE8\WixSharp.dll rundll32.exe - Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
pid Process 1276 msiexec.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 1276 msiexec.exe Token: SeIncreaseQuotaPrivilege 1276 msiexec.exe Token: SeSecurityPrivilege 3688 msiexec.exe Token: SeCreateTokenPrivilege 1276 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 1276 msiexec.exe Token: SeLockMemoryPrivilege 1276 msiexec.exe Token: SeIncreaseQuotaPrivilege 1276 msiexec.exe Token: SeMachineAccountPrivilege 1276 msiexec.exe Token: SeTcbPrivilege 1276 msiexec.exe Token: SeSecurityPrivilege 1276 msiexec.exe Token: SeTakeOwnershipPrivilege 1276 msiexec.exe Token: SeLoadDriverPrivilege 1276 msiexec.exe Token: SeSystemProfilePrivilege 1276 msiexec.exe Token: SeSystemtimePrivilege 1276 msiexec.exe Token: SeProfSingleProcessPrivilege 1276 msiexec.exe Token: SeIncBasePriorityPrivilege 1276 msiexec.exe Token: SeCreatePagefilePrivilege 1276 msiexec.exe Token: SeCreatePermanentPrivilege 1276 msiexec.exe Token: SeBackupPrivilege 1276 msiexec.exe Token: SeRestorePrivilege 1276 msiexec.exe Token: SeShutdownPrivilege 1276 msiexec.exe Token: SeDebugPrivilege 1276 msiexec.exe Token: SeAuditPrivilege 1276 msiexec.exe Token: SeSystemEnvironmentPrivilege 1276 msiexec.exe Token: SeChangeNotifyPrivilege 1276 msiexec.exe Token: SeRemoteShutdownPrivilege 1276 msiexec.exe Token: SeUndockPrivilege 1276 msiexec.exe Token: SeSyncAgentPrivilege 1276 msiexec.exe Token: SeEnableDelegationPrivilege 1276 msiexec.exe Token: SeManageVolumePrivilege 1276 msiexec.exe Token: SeImpersonatePrivilege 1276 msiexec.exe Token: SeCreateGlobalPrivilege 1276 msiexec.exe Token: SeCreateTokenPrivilege 1276 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 1276 msiexec.exe Token: SeLockMemoryPrivilege 1276 msiexec.exe Token: SeIncreaseQuotaPrivilege 1276 msiexec.exe Token: SeMachineAccountPrivilege 1276 msiexec.exe Token: SeTcbPrivilege 1276 msiexec.exe Token: SeSecurityPrivilege 1276 msiexec.exe Token: SeTakeOwnershipPrivilege 1276 msiexec.exe Token: SeLoadDriverPrivilege 1276 msiexec.exe Token: SeSystemProfilePrivilege 1276 msiexec.exe Token: SeSystemtimePrivilege 1276 msiexec.exe Token: SeProfSingleProcessPrivilege 1276 msiexec.exe Token: SeIncBasePriorityPrivilege 1276 msiexec.exe Token: SeCreatePagefilePrivilege 1276 msiexec.exe Token: SeCreatePermanentPrivilege 1276 msiexec.exe Token: SeBackupPrivilege 1276 msiexec.exe Token: SeRestorePrivilege 1276 msiexec.exe Token: SeShutdownPrivilege 1276 msiexec.exe Token: SeDebugPrivilege 1276 msiexec.exe Token: SeAuditPrivilege 1276 msiexec.exe Token: SeSystemEnvironmentPrivilege 1276 msiexec.exe Token: SeChangeNotifyPrivilege 1276 msiexec.exe Token: SeRemoteShutdownPrivilege 1276 msiexec.exe Token: SeUndockPrivilege 1276 msiexec.exe Token: SeSyncAgentPrivilege 1276 msiexec.exe Token: SeEnableDelegationPrivilege 1276 msiexec.exe Token: SeManageVolumePrivilege 1276 msiexec.exe Token: SeImpersonatePrivilege 1276 msiexec.exe Token: SeCreateGlobalPrivilege 1276 msiexec.exe Token: SeCreateTokenPrivilege 1276 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 1276 msiexec.exe Token: SeLockMemoryPrivilege 1276 msiexec.exe - Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 1276 msiexec.exe 1276 msiexec.exe - Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 3688 wrote to memory of 3328 3688 msiexec.exe 86 PID 3328 wrote to memory of 3892 3328 MsiExec.exe 87
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\a078ea491822b8d8014821cdcce8bcb450947a9e1c5e0b55d259df864978ee17.msi1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1276
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3688 -
C:\Windows\System32\MsiExec.exeC:\Windows\System32\MsiExec.exe -Embedding 04924E25E7A2F62D6E9C959DD433E2F4 C2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3328 -
C:\Windows\system32\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSICBD.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240651500 1 WixSharp!WixSharp.ManagedProjectActions.WixSharp_Load_Action3⤵
- Badlisted process makes network request
- Loads dropped DLL
- Drops file in Windows directory
PID:3892
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\MSICBD.tmp
- Size 565KB
- SHA256 cfb3edf8a6db313a22a777e41e07eb4fa9fba7dce748be36c849c68e342155eb
- MD5 e54b03b28667b356e3f606de4ad1aa52
- SHA1 3ef9eed23651be8cdea932a6f71913e7a9d8d004
- SHA512 e2aea358eff5f641b194cf202716865900a9f3a8fd113bc67097c0ddbac874ade39a582becd516a9679188c63e8c578ddef511c220e6719f9beb3f4035fb32d3
- SSDEEP 12288:YaSabyWAm8BdCoZjTnvcCTyux3W5442kNaUjy04W2Pqun:YaSab0QYECTyu9U2kNf4PCi
- TLSH T154C4E01977F50D66FCB7913989630605E6B27C529B31CADF0390425A9F2F7D0A83AF22
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\SFXCAEEE22AFD144914BB358CEA1618699BE8\WindowsMSI.exe
- Size 19KB
- SHA256 f0a50fdff418e7785cb402b5e9cf676ea22a59a6507ca8d295a3e7b586167b0b
- MD5 706008a8d03e6df8897acb2bda41f4f1
- SHA1 55d29e00c58bc0771347d0a3396856add84d79ef
- SHA512 69a362b4b9be79835d5745bc8beb639d4a5b03c593b653f6123f712ba56f74f740bb352c6850edc756851fdf56bb0119957bbb2a63fce0bc00854a7a8cca4abe
- SSDEEP 384:cJ5kOGYQwDaULlBRQpuXj9Oqb3iBvYeD92Z4y6i0ojuT5KPHCvYQeG+n:wdG0pfJj9tmXPrqBGu
- TLSH T134920849EBE40236E5FF07B56D72821246F1FA060E22CF5E09C450DE6FB77984626B72
- MD5 SHA1 SHA512 SSDEEP TLSH