Analysis
- max time kernel
148s - max time network
153s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
23/09/2026, 19:08
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
connect.msi
Resource
win10v2004-20260911-en
windows10-2004-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
connect.msi
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
8 signatures
150 seconds
General
- Target connect.msi
- Size 8.8MB
- Sample260923-xtck3sss2n
- SHA256 119a0c6959f126a8e6e2ff82ba597c95a00a2275858e03b62b110d60965bb3f3
- MD5 c142df3bb7a96a0757631aa0c42746cb
- SHA1 294277e7cb40af465584fa2304e4ae865c71d523
- SHA512 48cc5a93f976ec29e4767baab6f1f7e6a8925c8d433b34a3bfd8134d91c0211b99fcdee9a84eff906b4cc92e66246456f317e3aab969b07ae2e1cdd579180c7e
- SSDEEP 24576:gzKJVon1KJZ5I2YG/M+rWaL02LJ6VpZ+mx+TCgRwAHU7+bqUxcjZQAZMj+cppqkz:gzKrzK2YG0J4WZFYQ3SZkV5
- TLSH T1B396AC0DAB3E88975E780CD480D6B557076F6B49E217E9BDC43D605C1F0A80B91CBAAF
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Extracted
Family
-
adaptixc2
C2
-
187.77.30.227
Attributes
-
port
5005
-
user_agent
Mozilla/5.0 (Windows NT 6.2; rv:20.0) Gecko/20121202 Firefox/20.0
Signatures
- Executes dropped EXE 1 IoCs
pid Process 5124 MSI3629.tmp - Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\D: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\A: msiexec.exe - Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
pid Process 4532 msiexec.exe - Suspicious use of AdjustPrivilegeToken 32 IoCs
description pid Process Token: SeShutdownPrivilege 4532 msiexec.exe Token: SeIncreaseQuotaPrivilege 4532 msiexec.exe Token: SeSecurityPrivilege 1792 msiexec.exe Token: SeCreateTokenPrivilege 4532 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 4532 msiexec.exe Token: SeLockMemoryPrivilege 4532 msiexec.exe Token: SeIncreaseQuotaPrivilege 4532 msiexec.exe Token: SeMachineAccountPrivilege 4532 msiexec.exe Token: SeTcbPrivilege 4532 msiexec.exe Token: SeSecurityPrivilege 4532 msiexec.exe Token: SeTakeOwnershipPrivilege 4532 msiexec.exe Token: SeLoadDriverPrivilege 4532 msiexec.exe Token: SeSystemProfilePrivilege 4532 msiexec.exe Token: SeSystemtimePrivilege 4532 msiexec.exe Token: SeProfSingleProcessPrivilege 4532 msiexec.exe Token: SeIncBasePriorityPrivilege 4532 msiexec.exe Token: SeCreatePagefilePrivilege 4532 msiexec.exe Token: SeCreatePermanentPrivilege 4532 msiexec.exe Token: SeBackupPrivilege 4532 msiexec.exe Token: SeRestorePrivilege 4532 msiexec.exe Token: SeShutdownPrivilege 4532 msiexec.exe Token: SeDebugPrivilege 4532 msiexec.exe Token: SeAuditPrivilege 4532 msiexec.exe Token: SeSystemEnvironmentPrivilege 4532 msiexec.exe Token: SeChangeNotifyPrivilege 4532 msiexec.exe Token: SeRemoteShutdownPrivilege 4532 msiexec.exe Token: SeUndockPrivilege 4532 msiexec.exe Token: SeSyncAgentPrivilege 4532 msiexec.exe Token: SeEnableDelegationPrivilege 4532 msiexec.exe Token: SeManageVolumePrivilege 4532 msiexec.exe Token: SeImpersonatePrivilege 4532 msiexec.exe Token: SeCreateGlobalPrivilege 4532 msiexec.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 4532 msiexec.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4532 msiexec.exe 1792 msiexec.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 4532 wrote to memory of 5124 4532 msiexec.exe 91
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\connect.msi1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4532 -
C:\Users\Admin\AppData\Local\Temp\MSI3629.tmp"C:\Users\Admin\AppData\Local\Temp\MSI3629.tmp"2⤵
- Executes dropped EXE
PID:5124
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1792
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\MSI3629.tmp
- Size 8.7MB
- SHA256 27df8b11e83668baa91616583f27599251c2d554e4c941fe39ed2db2b86771ab
- MD5 070ecf4fff9374ed72a8210a37632bc0
- SHA1 5ec9722a1608a6a1c7275c39f76ee6c1fc11f01e
- SHA512 c38d22baf45ddb3e3c076d66cf8562f5fb3d74de7e039d98c1b60f41eab895ecdf633206d3d404e499d48ba247073df9f7b8a43d159a7cc7ba3f0fc33485c301
- SSDEEP 24576:QzKJVon1KJZ5I2YG/M+rWaL02LJ6VpZ+mx+TCgRwAHU7+bqUxcjZQAZMj+cppqkz:QzKrzK2YG0J4WZFYQ3SZkV5
- TLSH T19596AC0DAB3E88975E780CD480D6B557076F6B49E217E9BDC43D605C1F0A80B91CBAAF
- MD5 SHA1 SHA512 SSDEEP TLSH