Analysis
- user interaction
yes - max time kernel
150s - max time network
79s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
26/10/2026, 15:01
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
ARC Launcher_0.1.0_x64_en-US.msi
Resource
win10v2004-20260911-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
ARC Launcher_0.1.0_x64_en-US.msi
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
7 signatures
150 seconds
General
- Target ARC Launcher_0.1.0_x64_en-US.msi
- Size 10.9MB
- Sample261026-sedsdatv6j
- SHA256 4a197714fbb486e97d4cf5d91820d02b5a2c51ffbf3c0cdd4475f5ecca09b8cb
- MD5 8107a521eb39723023a1a12ae9fcac4e
- SHA1 ea274aa3762ec33a19d9b02e73bc41aa7346ae8a
- SHA512 789522fb03f95f85e74a270a1be14e6e528a9d125397d23ce43046aac58bc45c1753a9344664ba4cacfc1c5dedb3bf5838183e19f0a7c67e6e69c890f9716fa5
- SSDEEP 196608:KldjGsAUhLO5c5477QUrr7yZ2vMJZKzN6crhRTvt7ipUFo7rcQlqXJ15lLisSEXe:tsAUhIEOQa+ZrZKz/RtMUFEcRdfe
- TLSH T171B63367BE8289B2C04F6E70457B13F04B456C001306B587A7A77A7DDCF5AD22AB24F6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Loads dropped DLL 1 IoCs
pid Process 3812 MsiExec.exe - Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\D: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\D: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\O: msiexec.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 1844 msiexec.exe Token: SeIncreaseQuotaPrivilege 1844 msiexec.exe Token: SeSecurityPrivilege 4108 msiexec.exe Token: SeCreateTokenPrivilege 1844 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 1844 msiexec.exe Token: SeLockMemoryPrivilege 1844 msiexec.exe Token: SeIncreaseQuotaPrivilege 1844 msiexec.exe Token: SeMachineAccountPrivilege 1844 msiexec.exe Token: SeTcbPrivilege 1844 msiexec.exe Token: SeSecurityPrivilege 1844 msiexec.exe Token: SeTakeOwnershipPrivilege 1844 msiexec.exe Token: SeLoadDriverPrivilege 1844 msiexec.exe Token: SeSystemProfilePrivilege 1844 msiexec.exe Token: SeSystemtimePrivilege 1844 msiexec.exe Token: SeProfSingleProcessPrivilege 1844 msiexec.exe Token: SeIncBasePriorityPrivilege 1844 msiexec.exe Token: SeCreatePagefilePrivilege 1844 msiexec.exe Token: SeCreatePermanentPrivilege 1844 msiexec.exe Token: SeBackupPrivilege 1844 msiexec.exe Token: SeRestorePrivilege 1844 msiexec.exe Token: SeShutdownPrivilege 1844 msiexec.exe Token: SeDebugPrivilege 1844 msiexec.exe Token: SeAuditPrivilege 1844 msiexec.exe Token: SeSystemEnvironmentPrivilege 1844 msiexec.exe Token: SeChangeNotifyPrivilege 1844 msiexec.exe Token: SeRemoteShutdownPrivilege 1844 msiexec.exe Token: SeUndockPrivilege 1844 msiexec.exe Token: SeSyncAgentPrivilege 1844 msiexec.exe Token: SeEnableDelegationPrivilege 1844 msiexec.exe Token: SeManageVolumePrivilege 1844 msiexec.exe Token: SeImpersonatePrivilege 1844 msiexec.exe Token: SeCreateGlobalPrivilege 1844 msiexec.exe Token: SeCreateTokenPrivilege 1844 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 1844 msiexec.exe Token: SeLockMemoryPrivilege 1844 msiexec.exe Token: SeIncreaseQuotaPrivilege 1844 msiexec.exe Token: SeMachineAccountPrivilege 1844 msiexec.exe Token: SeTcbPrivilege 1844 msiexec.exe Token: SeSecurityPrivilege 1844 msiexec.exe Token: SeTakeOwnershipPrivilege 1844 msiexec.exe Token: SeLoadDriverPrivilege 1844 msiexec.exe Token: SeSystemProfilePrivilege 1844 msiexec.exe Token: SeSystemtimePrivilege 1844 msiexec.exe Token: SeProfSingleProcessPrivilege 1844 msiexec.exe Token: SeIncBasePriorityPrivilege 1844 msiexec.exe Token: SeCreatePagefilePrivilege 1844 msiexec.exe Token: SeCreatePermanentPrivilege 1844 msiexec.exe Token: SeBackupPrivilege 1844 msiexec.exe Token: SeRestorePrivilege 1844 msiexec.exe Token: SeShutdownPrivilege 1844 msiexec.exe Token: SeDebugPrivilege 1844 msiexec.exe Token: SeAuditPrivilege 1844 msiexec.exe Token: SeSystemEnvironmentPrivilege 1844 msiexec.exe Token: SeChangeNotifyPrivilege 1844 msiexec.exe Token: SeRemoteShutdownPrivilege 1844 msiexec.exe Token: SeUndockPrivilege 1844 msiexec.exe Token: SeSyncAgentPrivilege 1844 msiexec.exe Token: SeEnableDelegationPrivilege 1844 msiexec.exe Token: SeManageVolumePrivilege 1844 msiexec.exe Token: SeImpersonatePrivilege 1844 msiexec.exe Token: SeCreateGlobalPrivilege 1844 msiexec.exe Token: SeCreateTokenPrivilege 1844 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 1844 msiexec.exe Token: SeLockMemoryPrivilege 1844 msiexec.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1844 msiexec.exe - Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 1844 msiexec.exe 4108 msiexec.exe 3812 MsiExec.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 4108 wrote to memory of 3812 4108 msiexec.exe 91
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I "C:\Users\Admin\AppData\Local\Temp\ARC Launcher_0.1.0_x64_en-US.msi"1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:1844
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4108 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 276188E616772E1279435A41BA65B446 C2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3812
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\MSI52D9.tmp
- Size 132KB
- SHA256 7f47d98ab25cfea9b3a2e898c3376cc9ba1cd893b4948b0c27caa530fd0e34cc
- MD5 cfbb8568bd3711a97e6124c56fcfa8d9
- SHA1 d7a098ae58bdd5e93a3c1b04b3d69a14234d5e57
- SHA512 860cbf3286ac4915580cefaf56a9c3d48938eb08e3f31b7f024c4339c037d7c8bdf16e766d08106505ba535be4922a87dc46bd029aae99a64ea2fc02cf3aec04
- SSDEEP 3072:Kx2YbpcgwmiTPJDnCO+DATkURBnrskNwPj2:XXgwmY1CPx2XG2
- TLSH T1DBD39D02B5D0C473D9BE09390870DB229F7EB930DF909EDB636856699E702C19E35A37
- MD5 SHA1 SHA512 SSDEEP TLSH