Analysis
- user interaction
yes - max time kernel
71s - max time network
71s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
- submitted
02/11/2026, 10:44
General
- Target MSI 5.9 .exe
- Size 1.1MB
- Sample261102-ms8a9abs8m
- SHA256 c5605d9911aa7c3308efe16370be500922f04189efe6389e13702181a6c44689
Malware Config
Signatures
- Checks computer location settings 2 TTPs 3 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 4 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
- System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 13 IoCs
- Suspicious behavior: RenamesItself 1 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 5 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\MSI 5.9 .exe"C:\Users\Admin\AppData\Local\Temp\MSI 5.9 .exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zSCB34F648\BlueStacksInstaller.exe"C:\Users\Admin\AppData\Local\Temp\7zSCB34F648\BlueStacksInstaller.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zSCB34F648\HD-CheckCpu.exe"C:\Users\Admin\AppData\Local\Temp\7zSCB34F648\HD-CheckCpu.exe" --cmd checkHypervEnabled3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\7zSCB34F648\HD-CheckCpu.exe"C:\Users\Admin\AppData\Local\Temp\7zSCB34F648\HD-CheckCpu.exe" --cmd checkSSE43⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\BlueStacksSetup\MSI 5.9 .exe"C:\Users\Admin\AppData\Local\BlueStacksSetup\MSI 5.9 .exe" -versionMachineID=f30c68ea-dc51-44e1-b04b-65cc95f5d872 -machineID=99603855-d1fd-4789-a89a-bceb4d86cbab -pddir="C:\ProgramData\BlueStacks_msi5" -defaultImageName=Nougat32 -imageToLaunch=Nougat32 -isSSE4Available=1 -appToLaunch=bs5 -bsxVersion= -country=GB3⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zSC7BE6A59\BlueStacksInstaller.exe"C:\Users\Admin\AppData\Local\Temp\7zSC7BE6A59\BlueStacksInstaller.exe" -versionMachineID=f30c68ea-dc51-44e1-b04b-65cc95f5d872 -machineID=99603855-d1fd-4789-a89a-bceb4d86cbab -pddir="C:\ProgramData\BlueStacks_msi5" -defaultImageName=Nougat32 -imageToLaunch=Nougat32 -isSSE4Available=1 -appToLaunch=bs5 -bsxVersion= -country=GB4⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
BlueStacksMicroInstaller_5.9.300.6315.log
Logs.log
BlueStacksInstaller.exe.log
checked_gray_hover.png
close_red_click.png
custom_click.png
custom_hover.png
error_icon.png
exit_close_hover.png
installer_minimize_click.png
installer_minimize_hover.png
installer_upgrade_image_bg.jpg
minimize_progress_hover.png
powered_by_bs.png
setpath_click.png
setpath_hover.png
unchecked_gray_hover.png
i18n.ar-EG.txt
i18n.ar-IL.txt
i18n.de-DE.txt
i18n.es-ES.txt
i18n.fr-FR.txt
i18n.id-ID.txt
i18n.it-IT.txt
i18n.ja-JP.txt
i18n.ko-KR.txt
i18n.pl-PL.txt
i18n.pt-BR.txt
i18n.ru-RU.txt
i18n.th-TH.txt
i18n.tr-TR.txt
i18n.vi-VN.txt
i18n.zh-CN.txt
i18n.zh-TW.txt
ThemeFile
backicon.png
checked_gray.png
close_red.png
close_red_hover.png
custom.png
exit_close_click.png
installer_bg.jpg
installer_logo.png
installer_minimize.png
loader.png
minimize_progress_click.png
setpath.png
unchecked_gray.png
BlueStacksInstaller.exe
BlueStacksInstaller.exe.config
HD-CheckCpu.exe
JSON.dll
i18n.en-US.txt
ThemeFile
memory/4284-117-0x000000001D300000-0x000000001D368000-memory.dmp
memory/4284-115-0x0000000000E10000-0x0000000000EA4000-memory.dmp
memory/4284-131-0x000000001DD50000-0x000000001DD5E000-memory.dmp
memory/4284-130-0x000000001E250000-0x000000001E288000-memory.dmp
memory/4284-123-0x000000001E2E0000-0x000000001E808000-memory.dmp
memory/4284-122-0x0000000002F50000-0x0000000002F60000-memory.dmp
memory/4284-151-0x0000000002F50000-0x0000000002F60000-memory.dmp
memory/4284-118-0x0000000002F50000-0x0000000002F60000-memory.dmp
memory/4284-128-0x0000000002F50000-0x0000000002F60000-memory.dmp
memory/4284-129-0x0000000002F50000-0x0000000002F60000-memory.dmp
memory/4284-150-0x0000000002F50000-0x0000000002F60000-memory.dmp
memory/4284-148-0x000000001E810000-0x000000001E9DE000-memory.dmp
memory/4284-149-0x0000000002F50000-0x0000000002F60000-memory.dmp
memory/4284-292-0x000000001E810000-0x000000001E9DE000-memory.dmp
memory/4284-147-0x0000000002F50000-0x0000000002F60000-memory.dmp
memory/4284-144-0x00000000221B0000-0x00000000221B8000-memory.dmp
memory/4556-288-0x000000001DDE0000-0x000000001DFAE000-memory.dmp
memory/5052-294-0x0000000000400000-0x0000000000450000-memory.dmp