Analysis
- max time kernel
148s - max time network
129s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
09/10/2026, 19:15
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
b11.msi
Resource
win10v2004-20260911-en
windows10-2004-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
b11.msi
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
8 signatures
150 seconds
General
- Target b11.msi
- Size 35.6MB
- Sample261009-xygetsty7p
- SHA256 979c729256fbbc3a8862ce29cc33dee295a2ff2cce145123d3a87712863985ef
- MD5 1d5afce5c947336477797e7d52f66ae0
- SHA1 5acce8e146121fb550d217b3cd88b2978fdb1fb8
- SHA512 bed45d1ae1ec19314a04806b65b4bf24aa3c1e0880012eb4d37b8e83e74e852b130c52d0383e661776f9631aa0a424db4097ebe92aff1c621a315a37848aae24
- SSDEEP 786432:im3izW8Sg0RpD3vKGyqB/Wwm7vVa9Vh23EDUFGHf5CWfghFY:imSz9v0R2GZP9VA3EDuGHfihFY
- TLSH T10787336E383F612FF46EE87D1D35A65D95F2B12260460C4AA3393B5314EF6E071F824A
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\D: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\D: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\U: msiexec.exe - Command and Scripting Interpreter: JavaScript 1 TTPs
- Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
pid Process 4472 msiexec.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wscript.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 4472 msiexec.exe Token: SeIncreaseQuotaPrivilege 4472 msiexec.exe Token: SeSecurityPrivilege 5792 msiexec.exe Token: SeCreateTokenPrivilege 4472 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 4472 msiexec.exe Token: SeLockMemoryPrivilege 4472 msiexec.exe Token: SeIncreaseQuotaPrivilege 4472 msiexec.exe Token: SeMachineAccountPrivilege 4472 msiexec.exe Token: SeTcbPrivilege 4472 msiexec.exe Token: SeSecurityPrivilege 4472 msiexec.exe Token: SeTakeOwnershipPrivilege 4472 msiexec.exe Token: SeLoadDriverPrivilege 4472 msiexec.exe Token: SeSystemProfilePrivilege 4472 msiexec.exe Token: SeSystemtimePrivilege 4472 msiexec.exe Token: SeProfSingleProcessPrivilege 4472 msiexec.exe Token: SeIncBasePriorityPrivilege 4472 msiexec.exe Token: SeCreatePagefilePrivilege 4472 msiexec.exe Token: SeCreatePermanentPrivilege 4472 msiexec.exe Token: SeBackupPrivilege 4472 msiexec.exe Token: SeRestorePrivilege 4472 msiexec.exe Token: SeShutdownPrivilege 4472 msiexec.exe Token: SeDebugPrivilege 4472 msiexec.exe Token: SeAuditPrivilege 4472 msiexec.exe Token: SeSystemEnvironmentPrivilege 4472 msiexec.exe Token: SeChangeNotifyPrivilege 4472 msiexec.exe Token: SeRemoteShutdownPrivilege 4472 msiexec.exe Token: SeUndockPrivilege 4472 msiexec.exe Token: SeSyncAgentPrivilege 4472 msiexec.exe Token: SeEnableDelegationPrivilege 4472 msiexec.exe Token: SeManageVolumePrivilege 4472 msiexec.exe Token: SeImpersonatePrivilege 4472 msiexec.exe Token: SeCreateGlobalPrivilege 4472 msiexec.exe Token: SeCreateTokenPrivilege 4472 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 4472 msiexec.exe Token: SeLockMemoryPrivilege 4472 msiexec.exe Token: SeIncreaseQuotaPrivilege 4472 msiexec.exe Token: SeMachineAccountPrivilege 4472 msiexec.exe Token: SeTcbPrivilege 4472 msiexec.exe Token: SeSecurityPrivilege 4472 msiexec.exe Token: SeTakeOwnershipPrivilege 4472 msiexec.exe Token: SeLoadDriverPrivilege 4472 msiexec.exe Token: SeSystemProfilePrivilege 4472 msiexec.exe Token: SeSystemtimePrivilege 4472 msiexec.exe Token: SeProfSingleProcessPrivilege 4472 msiexec.exe Token: SeIncBasePriorityPrivilege 4472 msiexec.exe Token: SeCreatePagefilePrivilege 4472 msiexec.exe Token: SeCreatePermanentPrivilege 4472 msiexec.exe Token: SeBackupPrivilege 4472 msiexec.exe Token: SeRestorePrivilege 4472 msiexec.exe Token: SeShutdownPrivilege 4472 msiexec.exe Token: SeDebugPrivilege 4472 msiexec.exe Token: SeAuditPrivilege 4472 msiexec.exe Token: SeSystemEnvironmentPrivilege 4472 msiexec.exe Token: SeChangeNotifyPrivilege 4472 msiexec.exe Token: SeRemoteShutdownPrivilege 4472 msiexec.exe Token: SeUndockPrivilege 4472 msiexec.exe Token: SeSyncAgentPrivilege 4472 msiexec.exe Token: SeEnableDelegationPrivilege 4472 msiexec.exe Token: SeManageVolumePrivilege 4472 msiexec.exe Token: SeImpersonatePrivilege 4472 msiexec.exe Token: SeCreateGlobalPrivilege 4472 msiexec.exe Token: SeCreateTokenPrivilege 4472 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 4472 msiexec.exe Token: SeLockMemoryPrivilege 4472 msiexec.exe - Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 4472 msiexec.exe 4472 msiexec.exe - Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 4472 msiexec.exe 5792 msiexec.exe 2392 MsiExec.exe - Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 5792 wrote to memory of 2392 5792 msiexec.exe 90 PID 2392 wrote to memory of 3240 2392 MsiExec.exe 91
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\b11.msi1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:4472
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5792 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 6148583B7B9E34B530BE5CEF7D1721EE C2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2392 -
C:\Windows\SysWOW64\wscript.exe"C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Local\Temp\rad579DB.tmp.js" "C:\Users\Admin\AppData\Local\Temp\b11.msi"3⤵
- System Location Discovery: System Language Discovery
PID:3240
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\rad579DB.tmp.js
- Size 531B
- SHA256 3c9e0d59478cc3eedfee65079211fc5eb3642430580011ed23853a02b4b3922b
- MD5 431d1fa9b305e8ffe10b96a1a50c142f
- SHA1 f276e817f632124c514e81c40c622c42a515407c
- SHA512 3cde100cc58cc5241fdbfa0686ebbdd62540e67434cf2c81614eec994cbdd8ce6b2b029082a6f8fcddf65e25cb00c83cab1e2593f1d21c3b0d40d3e55928ca29
- TLSH T19FF0564F4C08D57E40A1225716BAD10FCA915160DE10D6CDF4DCDDC07D765750DE5D97
- MD5 SHA1 SHA512 TLSH