Analysis
- max time kernel
40s - max time network
24s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
17/10/2026, 10:31
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Win7.USB.DVD.Download.Tool.msi
Resource
win10v2004-20260911-en
windows10-2004-x64
7 signatures
40 seconds
Behavioral task
behavioral2
Sample
Win7.USB.DVD.Download.Tool.msi
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
8 signatures
40 seconds
General
- Target Win7.USB.DVD.Download.Tool.msi
- Size 2.9MB
- Sample261017-mkl32sed46
- SHA256 08870b89b697e6c54b6ee14581913fa8044df0cb10dac13bfe89eece2b711703
- MD5 03745c7883194f00f657cdf0421837c5
- SHA1 18fadac53154fbc5e1a3503e2f663df8bf67aef6
- SHA512 f7b2e081668d2eaeee080b7c156e713805a923fe7261d38eefa1d3b59ade0d1623211cf341a44b7e53eeac7a2beecb7c47a14f6e328197dcd2882cf8b7bcdfb9
- SSDEEP 49152:64CkwNYyAzYGB7PyaUWgiFm9B9pL36svcgiSsELjagLup8L1yogv/Ut3MieWif2B:6NYyAzYGslL6/giEfagc8L1f9Miieo1R
- TLSH T1AAD52362B5825F22D1111A34162B977542395C095BB38803F36EFA1F3F729B173FA6CA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Loads dropped DLL 1 IoCs
pid Process 5844 MsiExec.exe - Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\D: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\D: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\R: msiexec.exe - Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
pid Process 3872 msiexec.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 3872 msiexec.exe Token: SeIncreaseQuotaPrivilege 3872 msiexec.exe Token: SeSecurityPrivilege 4696 msiexec.exe Token: SeCreateTokenPrivilege 3872 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 3872 msiexec.exe Token: SeLockMemoryPrivilege 3872 msiexec.exe Token: SeIncreaseQuotaPrivilege 3872 msiexec.exe Token: SeMachineAccountPrivilege 3872 msiexec.exe Token: SeTcbPrivilege 3872 msiexec.exe Token: SeSecurityPrivilege 3872 msiexec.exe Token: SeTakeOwnershipPrivilege 3872 msiexec.exe Token: SeLoadDriverPrivilege 3872 msiexec.exe Token: SeSystemProfilePrivilege 3872 msiexec.exe Token: SeSystemtimePrivilege 3872 msiexec.exe Token: SeProfSingleProcessPrivilege 3872 msiexec.exe Token: SeIncBasePriorityPrivilege 3872 msiexec.exe Token: SeCreatePagefilePrivilege 3872 msiexec.exe Token: SeCreatePermanentPrivilege 3872 msiexec.exe Token: SeBackupPrivilege 3872 msiexec.exe Token: SeRestorePrivilege 3872 msiexec.exe Token: SeShutdownPrivilege 3872 msiexec.exe Token: SeDebugPrivilege 3872 msiexec.exe Token: SeAuditPrivilege 3872 msiexec.exe Token: SeSystemEnvironmentPrivilege 3872 msiexec.exe Token: SeChangeNotifyPrivilege 3872 msiexec.exe Token: SeRemoteShutdownPrivilege 3872 msiexec.exe Token: SeUndockPrivilege 3872 msiexec.exe Token: SeSyncAgentPrivilege 3872 msiexec.exe Token: SeEnableDelegationPrivilege 3872 msiexec.exe Token: SeManageVolumePrivilege 3872 msiexec.exe Token: SeImpersonatePrivilege 3872 msiexec.exe Token: SeCreateGlobalPrivilege 3872 msiexec.exe Token: SeCreateTokenPrivilege 3872 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 3872 msiexec.exe Token: SeLockMemoryPrivilege 3872 msiexec.exe Token: SeIncreaseQuotaPrivilege 3872 msiexec.exe Token: SeMachineAccountPrivilege 3872 msiexec.exe Token: SeTcbPrivilege 3872 msiexec.exe Token: SeSecurityPrivilege 3872 msiexec.exe Token: SeTakeOwnershipPrivilege 3872 msiexec.exe Token: SeLoadDriverPrivilege 3872 msiexec.exe Token: SeSystemProfilePrivilege 3872 msiexec.exe Token: SeSystemtimePrivilege 3872 msiexec.exe Token: SeProfSingleProcessPrivilege 3872 msiexec.exe Token: SeIncBasePriorityPrivilege 3872 msiexec.exe Token: SeCreatePagefilePrivilege 3872 msiexec.exe Token: SeCreatePermanentPrivilege 3872 msiexec.exe Token: SeBackupPrivilege 3872 msiexec.exe Token: SeRestorePrivilege 3872 msiexec.exe Token: SeShutdownPrivilege 3872 msiexec.exe Token: SeDebugPrivilege 3872 msiexec.exe Token: SeAuditPrivilege 3872 msiexec.exe Token: SeSystemEnvironmentPrivilege 3872 msiexec.exe Token: SeChangeNotifyPrivilege 3872 msiexec.exe Token: SeRemoteShutdownPrivilege 3872 msiexec.exe Token: SeUndockPrivilege 3872 msiexec.exe Token: SeSyncAgentPrivilege 3872 msiexec.exe Token: SeEnableDelegationPrivilege 3872 msiexec.exe Token: SeManageVolumePrivilege 3872 msiexec.exe Token: SeImpersonatePrivilege 3872 msiexec.exe Token: SeCreateGlobalPrivilege 3872 msiexec.exe Token: SeCreateTokenPrivilege 3872 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 3872 msiexec.exe Token: SeLockMemoryPrivilege 3872 msiexec.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 3872 msiexec.exe - Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 3872 msiexec.exe 4696 msiexec.exe 5844 MsiExec.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 4696 wrote to memory of 5844 4696 msiexec.exe 90
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\Win7.USB.DVD.Download.Tool.msi1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:3872
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4696 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding C967F7CE6A23D9744D6105598ED5B32B C2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:5844
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\MSI354F.tmp
- Size 40KB
- SHA256 c450e09eb96cca3b07d3b12e4b37de2dbc7adfef63eb3dc06a572a990ef37dee
- MD5 cea58f3d51d61a5d2f45d460b71a7482
- SHA1 b185fe0fe6c120048205f21dfa9e40f4bdb89a16
- SHA512 8e03b94367372eaf1f1636826c3be2563ab67a7ae0c36a2b4ebd2f9ee8de64c989a1fcaa345cc32029ace71c83d7f237b57c3ca838bad51f929d80200a5a62c4
- SSDEEP 768:gsApN3ohb/Q8cnLdP8GG+HZ2hmKaeCthq4SQv1m+dM:gsApN3oBQnLhZ2hmkgtv
- TLSH T12E032B0172E850B2F59236707FFED616C277F4A42522C45BC362094F2AE5992FB2B376
- MD5 SHA1 SHA512 SSDEEP TLSH