Overview

overview

7

Static

static

3

PI-windows...-t.exe

windows10-2004-x64

7

PI-windows...-t.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    150s
  • max time network
    144s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    13/10/2026, 22:11

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    PI-windows-x64-01.08.05.1353-20170809-t.exe
  • Size 233.6MB
  • Sample261013-133qeade38
  • SHA256 f02cafb2bd8c744573f5c3d0b870bef6c3b633132c72809f8ca89fc7e205d0dc
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discovery

Malware Config

Signatures

  • Loads dropped DLL 14 IoCs
  • Badlisted process makes network request 1 IoCs

    Network request originating from process or tool commonly abused by malware.

  • Enumerates connected drives 3 TTPs 46 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\PI-windows-x64-01.08.05.1353-20170809-t.exe
    "C:\Users\Admin\AppData\Local\Temp\PI-windows-x64-01.08.05.1353-20170809-t.exe"
    1⤵
    • Loads dropped DLL
    • Enumerates connected drives
    • System Location Discovery: System Language Discovery
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    PID:4900
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Enumerates connected drives
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4592
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding DB759FBE48F1F82961F735ECABF804BD C
      2⤵
      • Loads dropped DLL
      • Badlisted process makes network request
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:3356

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        tracking.ini
        • Path C:\Users\Admin\AppData\Local\AdvinstAnalytics\593a7c1f36132f5c4fa48211\1.8.5.1353\tracking.ini
        • Size 84B
        • SHA256 fce7dbf86e6765b1050b09c1614a2e342202d9634a816f48072d8286d82339f3
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        {ED8A200B-88BF-4BAE-BB4F-0F6C6ADCC02F}.session
        • Path C:\Users\Admin\AppData\Local\AdvinstAnalytics\593a7c1f36132f5c4fa48211\1.8.5.1353\{ED8A200B-88BF-4BAE-BB4F-0F6C6ADCC02F}.session
        • Size 4KB
        • SHA256 4b0a20040fb426a20d8fd791dc9f0450d1235e3a23022d50261f6b6f7a0f7941
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        {ED8A200B-88BF-4BAE-BB4F-0F6C6ADCC02F}.session
        • Path C:\Users\Admin\AppData\Local\AdvinstAnalytics\593a7c1f36132f5c4fa48211\1.8.5.1353\{ED8A200B-88BF-4BAE-BB4F-0F6C6ADCC02F}.session
        • Size 5KB
        • SHA256 91077a6c50bfe294681d1d451a6f157a63b2a9e3e80fd5db90be262c15165c3b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        PixInsight.ico
        • Path C:\Users\Admin\AppData\Local\Temp\AI_EXTUI_BIN_4900\PixInsight.ico
        • Size 173KB
        • SHA256 e1c083e35b186cc6f4916c5cd391b8d62b3c6bbc9907c5d7394fe8053dbe1cd0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        PrepareDlgProgress.gif
        • Path C:\Users\Admin\AppData\Local\Temp\AI_EXTUI_BIN_4900\PrepareDlgProgress.gif
        • Size 24KB
        • SHA256 0ee7650c7faf97126ddbc7d21812e093af4f2317f3edcff16d2d6137d3c0544d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        backbutton
        • Path C:\Users\Admin\AppData\Local\Temp\AI_EXTUI_BIN_4900\backbutton
        • Size 404B
        • SHA256 71836c56ec4765d858dc756541123e44680f98da255faf1ece7b83d79809b1c3
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        background
        • Path C:\Users\Admin\AppData\Local\Temp\AI_EXTUI_BIN_4900\background
        • Size 134B
        • SHA256 f044f542bc46464054084c63596877f06c6e2c215c0e954c4ace9787ced82787
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        browsebutton
        • Path C:\Users\Admin\AppData\Local\Temp\AI_EXTUI_BIN_4900\browsebutton
        • Size 253B
        • SHA256 f4302ee2090bc7d7a27c4bc970af6eb61c050f14f0876541a8d2f32bc41b9bab
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        checkbox
        • Path C:\Users\Admin\AppData\Local\Temp\AI_EXTUI_BIN_4900\checkbox
        • Size 1KB
        • SHA256 787b6e964ce0b74d08c69e3c4fccd44afda06d473fd74a876a3ec2bd257684d4
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        frame_top_right_inactive.bmp
        • Path C:\Users\Admin\AppData\Local\Temp\AI_EXTUI_BIN_4900\frame_top_right_inactive.bmp
        • Size 154B
        • SHA256 17b5cd496d98db14e7c9757e38892883c7b378407e1f136889a9921abe040741
        • MD5 SHA1 SHA512
        Submit Download

        metroinstallbutton
        • Path C:\Users\Admin\AppData\Local\Temp\AI_EXTUI_BIN_4900\metroinstallbutton
        • Size 520B
        • SHA256 3a0a5b69f9da7cae9fc631326ed8aa97abbaaecf2bf15d0a73169a29f3381e83
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        nextcancelbuttons
        • Path C:\Users\Admin\AppData\Local\Temp\AI_EXTUI_BIN_4900\nextcancelbuttons
        • Size 404B
        • SHA256 65172283ee04f2fa18d0e57b21471be2e68017d1f61816aaaa6be070b446346f
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        Ins30.tmp
        • Path C:\Users\Admin\AppData\Local\Temp\Ins30.tmp
        • Size 486KB
        • SHA256 91c7b3f6c1f6852c801a92c27417a406e5d9cd89ef5515e19653720e41a4882b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MSI179.tmp
        • Path C:\Users\Admin\AppData\Local\Temp\MSI179.tmp
        • Size 207KB
        • SHA256 83d01e65e19e736054daa09be4a5246322b1271db347a45d726ec28b8a9dd656
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MSI275.tmp
        • Path C:\Users\Admin\AppData\Local\Temp\MSI275.tmp
        • Size 360KB
        • SHA256 2b54bb9e63adfd25a7016739cfaafa1a72d89bb55529b295a20bcd7b331fb4cf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        PI-windows-x64-01.08.05.1353-20170809-t.msi
        • Path C:\Users\Admin\AppData\Roaming\Pleiades Astrophoto\PixInsight 1.8.5.1353\install\PI-windows-x64-01.08.05.1353-20170809-t.msi
        • Size 2.9MB
        • SHA256 34feef96cf314f215b442f5321cb41fc34a4e10ea521747bc9d4316ffd8f748a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download