Analysis
- max time kernel
149s - max time network
153s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
09/10/2026, 19:15
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
b11.msi
Resource
win10v2004-20260911-en
windows10-2004-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
b11.msi
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
8 signatures
150 seconds
General
- Target b11.msi
- Size 35.6MB
- Sample261009-xygetsty7p
- SHA256 979c729256fbbc3a8862ce29cc33dee295a2ff2cce145123d3a87712863985ef
- MD5 1d5afce5c947336477797e7d52f66ae0
- SHA1 5acce8e146121fb550d217b3cd88b2978fdb1fb8
- SHA512 bed45d1ae1ec19314a04806b65b4bf24aa3c1e0880012eb4d37b8e83e74e852b130c52d0383e661776f9631aa0a424db4097ebe92aff1c621a315a37848aae24
- SSDEEP 786432:im3izW8Sg0RpD3vKGyqB/Wwm7vVa9Vh23EDUFGHf5CWfghFY:imSz9v0R2GZP9VA3EDuGHfihFY
- TLSH T10787336E383F612FF46EE87D1D35A65D95F2B12260460C4AA3393B5314EF6E071F824A
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\Z: msiexec.exe - Command and Scripting Interpreter: JavaScript 1 TTPs
- Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
pid Process 668 msiexec.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wscript.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 668 msiexec.exe Token: SeIncreaseQuotaPrivilege 668 msiexec.exe Token: SeSecurityPrivilege 3416 msiexec.exe Token: SeCreateTokenPrivilege 668 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 668 msiexec.exe Token: SeLockMemoryPrivilege 668 msiexec.exe Token: SeIncreaseQuotaPrivilege 668 msiexec.exe Token: SeMachineAccountPrivilege 668 msiexec.exe Token: SeTcbPrivilege 668 msiexec.exe Token: SeSecurityPrivilege 668 msiexec.exe Token: SeTakeOwnershipPrivilege 668 msiexec.exe Token: SeLoadDriverPrivilege 668 msiexec.exe Token: SeSystemProfilePrivilege 668 msiexec.exe Token: SeSystemtimePrivilege 668 msiexec.exe Token: SeProfSingleProcessPrivilege 668 msiexec.exe Token: SeIncBasePriorityPrivilege 668 msiexec.exe Token: SeCreatePagefilePrivilege 668 msiexec.exe Token: SeCreatePermanentPrivilege 668 msiexec.exe Token: SeBackupPrivilege 668 msiexec.exe Token: SeRestorePrivilege 668 msiexec.exe Token: SeShutdownPrivilege 668 msiexec.exe Token: SeDebugPrivilege 668 msiexec.exe Token: SeAuditPrivilege 668 msiexec.exe Token: SeSystemEnvironmentPrivilege 668 msiexec.exe Token: SeChangeNotifyPrivilege 668 msiexec.exe Token: SeRemoteShutdownPrivilege 668 msiexec.exe Token: SeUndockPrivilege 668 msiexec.exe Token: SeSyncAgentPrivilege 668 msiexec.exe Token: SeEnableDelegationPrivilege 668 msiexec.exe Token: SeManageVolumePrivilege 668 msiexec.exe Token: SeImpersonatePrivilege 668 msiexec.exe Token: SeCreateGlobalPrivilege 668 msiexec.exe Token: SeCreateTokenPrivilege 668 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 668 msiexec.exe Token: SeLockMemoryPrivilege 668 msiexec.exe Token: SeIncreaseQuotaPrivilege 668 msiexec.exe Token: SeMachineAccountPrivilege 668 msiexec.exe Token: SeTcbPrivilege 668 msiexec.exe Token: SeSecurityPrivilege 668 msiexec.exe Token: SeTakeOwnershipPrivilege 668 msiexec.exe Token: SeLoadDriverPrivilege 668 msiexec.exe Token: SeSystemProfilePrivilege 668 msiexec.exe Token: SeSystemtimePrivilege 668 msiexec.exe Token: SeProfSingleProcessPrivilege 668 msiexec.exe Token: SeIncBasePriorityPrivilege 668 msiexec.exe Token: SeCreatePagefilePrivilege 668 msiexec.exe Token: SeCreatePermanentPrivilege 668 msiexec.exe Token: SeBackupPrivilege 668 msiexec.exe Token: SeRestorePrivilege 668 msiexec.exe Token: SeShutdownPrivilege 668 msiexec.exe Token: SeDebugPrivilege 668 msiexec.exe Token: SeAuditPrivilege 668 msiexec.exe Token: SeSystemEnvironmentPrivilege 668 msiexec.exe Token: SeChangeNotifyPrivilege 668 msiexec.exe Token: SeRemoteShutdownPrivilege 668 msiexec.exe Token: SeUndockPrivilege 668 msiexec.exe Token: SeSyncAgentPrivilege 668 msiexec.exe Token: SeEnableDelegationPrivilege 668 msiexec.exe Token: SeManageVolumePrivilege 668 msiexec.exe Token: SeImpersonatePrivilege 668 msiexec.exe Token: SeCreateGlobalPrivilege 668 msiexec.exe Token: SeCreateTokenPrivilege 668 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 668 msiexec.exe Token: SeLockMemoryPrivilege 668 msiexec.exe - Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 668 msiexec.exe 668 msiexec.exe - Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 3416 wrote to memory of 5092 3416 msiexec.exe 88 PID 5092 wrote to memory of 2500 5092 MsiExec.exe 91
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\b11.msi1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:668
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3416 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 279E8B9C4B4900D9E32ECD5B09F57880 C2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5092 -
C:\Windows\SysWOW64\wscript.exe"C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Local\Temp\rad8B3DD.tmp.js" "C:\Users\Admin\AppData\Local\Temp\b11.msi"3⤵
- System Location Discovery: System Language Discovery
PID:2500
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\rad8B3DD.tmp.js
- Size 531B
- SHA256 3c9e0d59478cc3eedfee65079211fc5eb3642430580011ed23853a02b4b3922b
- MD5 431d1fa9b305e8ffe10b96a1a50c142f
- SHA1 f276e817f632124c514e81c40c622c42a515407c
- SHA512 3cde100cc58cc5241fdbfa0686ebbdd62540e67434cf2c81614eec994cbdd8ce6b2b029082a6f8fcddf65e25cb00c83cab1e2593f1d21c3b0d40d3e55928ca29
- TLSH T19FF0564F4C08D57E40A1225716BAD10FCA915160DE10D6CDF4DCDDC07D765750DE5D97
- MD5 SHA1 SHA512 TLSH