Analysis
- max time kernel
148s - max time network
153s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
10/09/2026, 23:59
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
a078ea491822b8d8014821cdcce8bcb450947a9e1c5e0b55d259df864978ee17.msi
Resource
win10v2004-20260513-en
windows10-2004-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
a078ea491822b8d8014821cdcce8bcb450947a9e1c5e0b55d259df864978ee17.msi
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
9 signatures
150 seconds
General
- Target a078ea491822b8d8014821cdcce8bcb450947a9e1c5e0b55d259df864978ee17.msi
- Size 1.5MB
- Sample260910-312rfazvdv
- SHA256 a078ea491822b8d8014821cdcce8bcb450947a9e1c5e0b55d259df864978ee17
- MD5 8c6e41076bffd798cf2a96afc6e1c259
- SHA1 e6abb362a5bac3a5322590e2b7836555348a397f
- SHA512 db2cb265c2bd27df377476dadb902887e85316e0a827df344dbf1228d69a4a1c6635d3780a2f0a24756d63160505bf471d4669c88d3f8815534c0bf9de926241
- SSDEEP 24576:raSabiciRXdA7rD8jVssaSab0QYECTyu9U2kNf4PCql8r:JatiZdA7rYjhaIQ1pu9hKNr
- TLSH T10E75CE0B7F952925E8A34E758937076DD2767D0026A0869B02B0F279DEF73C0593BBD2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
Malware Config
Signatures
- Badlisted process makes network request 12 IoCs
Network request originating from process or tool commonly abused by malware.
flow pid Process 8 5040 rundll32.exe 9 5040 rundll32.exe 9 5040 rundll32.exe 13 5040 rundll32.exe 14 5040 rundll32.exe 14 5040 rundll32.exe 16 5040 rundll32.exe 17 5040 rundll32.exe 18 5040 rundll32.exe 19 5040 rundll32.exe 20 5040 rundll32.exe 20 5040 rundll32.exe - Loads dropped DLL 4 IoCs
pid Process 3716 MsiExec.exe 5040 rundll32.exe 5040 rundll32.exe 5040 rundll32.exe - Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\D: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\D: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\T: msiexec.exe - Drops file in Windows directory 4 IoCs
description ioc Process File opened for modification C:\Windows\Installer\SFXCA9FB35CD10041E4F84C7BEB4F38C2B7C3\WixToolset.Dtf.WindowsInstaller.dll rundll32.exe File opened for modification C:\Windows\Installer\SFXCA9FB35CD10041E4F84C7BEB4F38C2B7C3\WixSharp.dll rundll32.exe File opened for modification C:\Windows\Installer\SFXCA9FB35CD10041E4F84C7BEB4F38C2B7C3\CustomAction.config rundll32.exe File opened for modification C:\Windows\Installer\SFXCA9FB35CD10041E4F84C7BEB4F38C2B7C3\WindowsMSI.exe rundll32.exe - Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
pid Process 4428 msiexec.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 4428 msiexec.exe Token: SeIncreaseQuotaPrivilege 4428 msiexec.exe Token: SeSecurityPrivilege 5748 msiexec.exe Token: SeCreateTokenPrivilege 4428 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 4428 msiexec.exe Token: SeLockMemoryPrivilege 4428 msiexec.exe Token: SeIncreaseQuotaPrivilege 4428 msiexec.exe Token: SeMachineAccountPrivilege 4428 msiexec.exe Token: SeTcbPrivilege 4428 msiexec.exe Token: SeSecurityPrivilege 4428 msiexec.exe Token: SeTakeOwnershipPrivilege 4428 msiexec.exe Token: SeLoadDriverPrivilege 4428 msiexec.exe Token: SeSystemProfilePrivilege 4428 msiexec.exe Token: SeSystemtimePrivilege 4428 msiexec.exe Token: SeProfSingleProcessPrivilege 4428 msiexec.exe Token: SeIncBasePriorityPrivilege 4428 msiexec.exe Token: SeCreatePagefilePrivilege 4428 msiexec.exe Token: SeCreatePermanentPrivilege 4428 msiexec.exe Token: SeBackupPrivilege 4428 msiexec.exe Token: SeRestorePrivilege 4428 msiexec.exe Token: SeShutdownPrivilege 4428 msiexec.exe Token: SeDebugPrivilege 4428 msiexec.exe Token: SeAuditPrivilege 4428 msiexec.exe Token: SeSystemEnvironmentPrivilege 4428 msiexec.exe Token: SeChangeNotifyPrivilege 4428 msiexec.exe Token: SeRemoteShutdownPrivilege 4428 msiexec.exe Token: SeUndockPrivilege 4428 msiexec.exe Token: SeSyncAgentPrivilege 4428 msiexec.exe Token: SeEnableDelegationPrivilege 4428 msiexec.exe Token: SeManageVolumePrivilege 4428 msiexec.exe Token: SeImpersonatePrivilege 4428 msiexec.exe Token: SeCreateGlobalPrivilege 4428 msiexec.exe Token: SeCreateTokenPrivilege 4428 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 4428 msiexec.exe Token: SeLockMemoryPrivilege 4428 msiexec.exe Token: SeIncreaseQuotaPrivilege 4428 msiexec.exe Token: SeMachineAccountPrivilege 4428 msiexec.exe Token: SeTcbPrivilege 4428 msiexec.exe Token: SeSecurityPrivilege 4428 msiexec.exe Token: SeTakeOwnershipPrivilege 4428 msiexec.exe Token: SeLoadDriverPrivilege 4428 msiexec.exe Token: SeSystemProfilePrivilege 4428 msiexec.exe Token: SeSystemtimePrivilege 4428 msiexec.exe Token: SeProfSingleProcessPrivilege 4428 msiexec.exe Token: SeIncBasePriorityPrivilege 4428 msiexec.exe Token: SeCreatePagefilePrivilege 4428 msiexec.exe Token: SeCreatePermanentPrivilege 4428 msiexec.exe Token: SeBackupPrivilege 4428 msiexec.exe Token: SeRestorePrivilege 4428 msiexec.exe Token: SeShutdownPrivilege 4428 msiexec.exe Token: SeDebugPrivilege 4428 msiexec.exe Token: SeAuditPrivilege 4428 msiexec.exe Token: SeSystemEnvironmentPrivilege 4428 msiexec.exe Token: SeChangeNotifyPrivilege 4428 msiexec.exe Token: SeRemoteShutdownPrivilege 4428 msiexec.exe Token: SeUndockPrivilege 4428 msiexec.exe Token: SeSyncAgentPrivilege 4428 msiexec.exe Token: SeEnableDelegationPrivilege 4428 msiexec.exe Token: SeManageVolumePrivilege 4428 msiexec.exe Token: SeImpersonatePrivilege 4428 msiexec.exe Token: SeCreateGlobalPrivilege 4428 msiexec.exe Token: SeCreateTokenPrivilege 4428 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 4428 msiexec.exe Token: SeLockMemoryPrivilege 4428 msiexec.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 4428 msiexec.exe - Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 4428 msiexec.exe 5748 msiexec.exe 3716 MsiExec.exe - Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 5748 wrote to memory of 3716 5748 msiexec.exe 90 PID 3716 wrote to memory of 5040 3716 MsiExec.exe 91
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\a078ea491822b8d8014821cdcce8bcb450947a9e1c5e0b55d259df864978ee17.msi1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:4428
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5748 -
C:\Windows\System32\MsiExec.exeC:\Windows\System32\MsiExec.exe -Embedding A6F5AB9E7FE80285C9A1853A26216398 C2⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3716 -
C:\Windows\system32\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSIA33B.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240755718 1 WixSharp!WixSharp.ManagedProjectActions.WixSharp_Load_Action3⤵
- Badlisted process makes network request
- Loads dropped DLL
- Drops file in Windows directory
PID:5040
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\MSIA33B.tmp
- Size 565KB
- SHA256 cfb3edf8a6db313a22a777e41e07eb4fa9fba7dce748be36c849c68e342155eb
- MD5 e54b03b28667b356e3f606de4ad1aa52
- SHA1 3ef9eed23651be8cdea932a6f71913e7a9d8d004
- SHA512 e2aea358eff5f641b194cf202716865900a9f3a8fd113bc67097c0ddbac874ade39a582becd516a9679188c63e8c578ddef511c220e6719f9beb3f4035fb32d3
- SSDEEP 12288:YaSabyWAm8BdCoZjTnvcCTyux3W5442kNaUjy04W2Pqun:YaSab0QYECTyu9U2kNf4PCi
- TLSH T154C4E01977F50D66FCB7913989630605E6B27C529B31CADF0390425A9F2F7D0A83AF22
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\SFXCA9FB35CD10041E4F84C7BEB4F38C2B7C3\WindowsMSI.exe
- Size 19KB
- SHA256 f0a50fdff418e7785cb402b5e9cf676ea22a59a6507ca8d295a3e7b586167b0b
- MD5 706008a8d03e6df8897acb2bda41f4f1
- SHA1 55d29e00c58bc0771347d0a3396856add84d79ef
- SHA512 69a362b4b9be79835d5745bc8beb639d4a5b03c593b653f6123f712ba56f74f740bb352c6850edc756851fdf56bb0119957bbb2a63fce0bc00854a7a8cca4abe
- SSDEEP 384:cJ5kOGYQwDaULlBRQpuXj9Oqb3iBvYeD92Z4y6i0ojuT5KPHCvYQeG+n:wdG0pfJj9tmXPrqBGu
- TLSH T134920849EBE40236E5FF07B56D72821246F1FA060E22CF5E09C450DE6FB77984626B72
- MD5 SHA1 SHA512 SSDEEP TLSH