525c2441299dc2147f42796fff8a6d66bc8b9a3925c5eeafa769bc1e9548f057

Analysis

user interaction
yes
max time kernel
298s
max time network
154s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260911-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260911-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
23/09/2026, 19:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
rvtools4.8.1.msi
Size 20.2MB
Sample260923-ydma1sbc49
SHA256 525c2441299dc2147f42796fff8a6d66bc8b9a3925c5eeafa769bc1e9548f057
MD5 ecfd42bfba903d955ba72dcf2dfe46c2
SHA1 c9028866100a6b67620201ef29d1d57a337c8d36
SHA512 53ebc48a04d99ae77373f88c040eba2b886fc609ea5dae3f53b71a8530fe97ef0c490864f32720a5a0f8f5fd493c8f298377fa88e51869dd798ddf576d02f775
SSDEEP 3::
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

persistence privilege_escalation

Malware Config

Signatures

Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs

persistence privilege_escalation

Installer Packages

T1546.016

Msiexec

T1218.007

pid	Process
5024	msiexec.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeShutdownPrivilege	5024	msiexec.exe
Token: SeIncreaseQuotaPrivilege	5024	msiexec.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
5024	msiexec.exe
5024	msiexec.exe

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\rvtools4.8.1.msi
1⤵
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:5024

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Installer Packages

T1546.016

Privilege Escalation

Event Triggered Execution

T1546

Installer Packages

T1546.016

Defense Evasion

System Binary Proxy Execution

T1218

Msiexec

T1218.007

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads