Analysis
- max time kernel
149s - max time network
144s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
07/11/2026, 10:30
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
8971f3c55b1836d226226f110305f68c7ff6df9af26ffa28f682059aaac4c715.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
8971f3c55b1836d226226f110305f68c7ff6df9af26ffa28f682059aaac4c715.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
2 signatures
150 seconds
General
- Target 8971f3c55b1836d226226f110305f68c7ff6df9af26ffa28f682059aaac4c715.exe
- Size 115KB
- Sample261107-mkbbjsct8j
- SHA256 8971f3c55b1836d226226f110305f68c7ff6df9af26ffa28f682059aaac4c715
- MD5 242ac3714af5c0cb7dd991156f6fcb7d
- SHA1 ba82be0b303e9206ed1e4791c786db3c4f9abbbb
- SHA512 883471b8dbb97cf49cd4ba427446fe28bd547fd4d33e3d5f6d1696226dfffbc95ae7e693d0327a0848aad8d71d7375dfff15ee690c47d64ee2798e259fe49043
- SSDEEP 3072:flMAvoB9nTU/FO3j5ktQSGZHG9HGhUGNFGiEG:flQBNTU/FOF8f6GloA
- TLSH T1F2C34C01BBF9C515F2F32B71ADB9A7604A7ABC616835C65E62502E0F2833B10DD64B37
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
Malware Config
Signatures
- Event Triggered Execution: Image File Execution Options Injection 1 TTPs 64 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msiexec.exe\VxKex_6546042284B9DB57\VerifierFlags = "2147483648" 8971f3c55b1836d226226f110305f68c7ff6df9af26ffa28f682059aaac4c715.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msiexec.exe\VxKex_0490BA0148CDE4E3\KEX_StrongVersionSpoof = "0" 8971f3c55b1836d226226f110305f68c7ff6df9af26ffa28f682059aaac4c715.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msiexec.exe 8971f3c55b1836d226226f110305f68c7ff6df9af26ffa28f682059aaac4c715.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msiexec.exe\UseFilter = "1" 8971f3c55b1836d226226f110305f68c7ff6df9af26ffa28f682059aaac4c715.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msiexec.exe\VxKex_C55DBFBCEEE6EE46 8971f3c55b1836d226226f110305f68c7ff6df9af26ffa28f682059aaac4c715.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msiexec.exe\VxKex_C55DBFBCEEE6EE46\KEX_StrongVersionSpoof = "0" 8971f3c55b1836d226226f110305f68c7ff6df9af26ffa28f682059aaac4c715.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msiexec.exe\VxKex_2AD7E14E8933B65F 8971f3c55b1836d226226f110305f68c7ff6df9af26ffa28f682059aaac4c715.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msiexec.exe\VxKex_E5F5290484DCDE00\KEX_DisableAppSpecific = "0" 8971f3c55b1836d226226f110305f68c7ff6df9af26ffa28f682059aaac4c715.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msiexec.exe\VxKex_2F09607C54CF4BCF\FilterFullPath = "C:\\Windows\\system32\\msiexec.exe" 8971f3c55b1836d226226f110305f68c7ff6df9af26ffa28f682059aaac4c715.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msiexec.exe\VxKex_1CCB783D278C75AD\KEX_DisableForChild = "0" 8971f3c55b1836d226226f110305f68c7ff6df9af26ffa28f682059aaac4c715.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msiexec.exe\VxKex_1CCB783D278C75AD\KEX_DisableAppSpecific = "0" 8971f3c55b1836d226226f110305f68c7ff6df9af26ffa28f682059aaac4c715.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msiexec.exe\VxKex_1CCB783D278C75AD\GlobalFlag = "256" 8971f3c55b1836d226226f110305f68c7ff6df9af26ffa28f682059aaac4c715.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msiexec.exe\VxKex_2AD7E14E8933B65F\VerifierFlags = "2147483648" 8971f3c55b1836d226226f110305f68c7ff6df9af26ffa28f682059aaac4c715.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msiexec.exe\VxKex_E5F5290484DCDE00\KEX_WinVerSpoof = "0" 8971f3c55b1836d226226f110305f68c7ff6df9af26ffa28f682059aaac4c715.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msiexec.exe\VxKex_2F09607C54CF4BCF\KEX_StrongVersionSpoof = "0" 8971f3c55b1836d226226f110305f68c7ff6df9af26ffa28f682059aaac4c715.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msiexec.exe\VxKex_C4F8FFDFB4444692\KEX_DisableForChild = "0" 8971f3c55b1836d226226f110305f68c7ff6df9af26ffa28f682059aaac4c715.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msiexec.exe\VxKex_C4F8FFDFB4444692\VerifierDlls = "kexdll.dll" 8971f3c55b1836d226226f110305f68c7ff6df9af26ffa28f682059aaac4c715.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msiexec.exe\VxKex_1CCB783D278C75AD\KEX_WinVerSpoof = "0" 8971f3c55b1836d226226f110305f68c7ff6df9af26ffa28f682059aaac4c715.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msiexec.exe\VxKex_1CCB783D278C75AD\VerifierDlls = "kexdll.dll" 8971f3c55b1836d226226f110305f68c7ff6df9af26ffa28f682059aaac4c715.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msiexec.exe\VxKex_C55DBFBCEEE6EE46\FilterFullPath = "C:\\Windows\\system32\\msiexec.exe" 8971f3c55b1836d226226f110305f68c7ff6df9af26ffa28f682059aaac4c715.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msiexec.exe\VxKex_C55DBFBCEEE6EE46\KEX_DisableAppSpecific = "0" 8971f3c55b1836d226226f110305f68c7ff6df9af26ffa28f682059aaac4c715.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msiexec.exe\VxKex_6546042284B9DB57\KEX_WinVerSpoof = "0" 8971f3c55b1836d226226f110305f68c7ff6df9af26ffa28f682059aaac4c715.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msiexec.exe\VxKex_6546042284B9DB57\KEX_StrongVersionSpoof = "0" 8971f3c55b1836d226226f110305f68c7ff6df9af26ffa28f682059aaac4c715.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msiexec.exe\VxKex_6546042284B9DB57\VerifierDlls = "kexdll.dll" 8971f3c55b1836d226226f110305f68c7ff6df9af26ffa28f682059aaac4c715.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msiexec.exe\VxKex_A2E1F9D39F1C03DE\FilterFullPath = "C:\\Windows\\system32\\msiexec.exe" 8971f3c55b1836d226226f110305f68c7ff6df9af26ffa28f682059aaac4c715.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msiexec.exe\VxKex_C476EC84135AD8FC\KEX_StrongVersionSpoof = "0" 8971f3c55b1836d226226f110305f68c7ff6df9af26ffa28f682059aaac4c715.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msiexec.exe\VxKex_04BDFFDC3E534F8A\VerifierDlls = "kexdll.dll" 8971f3c55b1836d226226f110305f68c7ff6df9af26ffa28f682059aaac4c715.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msiexec.exe\VxKex_E5F5290484DCDE00\KEX_StrongVersionSpoof = "0" 8971f3c55b1836d226226f110305f68c7ff6df9af26ffa28f682059aaac4c715.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msiexec.exe\VxKex_C4F8FFDFB4444692\GlobalFlag = "256" 8971f3c55b1836d226226f110305f68c7ff6df9af26ffa28f682059aaac4c715.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msiexec.exe\VxKex_A2E1F9D39F1C03DE\KEX_DisableForChild = "0" 8971f3c55b1836d226226f110305f68c7ff6df9af26ffa28f682059aaac4c715.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msiexec.exe\VxKex_A2E1F9D39F1C03DE\KEX_WinVerSpoof = "0" 8971f3c55b1836d226226f110305f68c7ff6df9af26ffa28f682059aaac4c715.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msiexec.exe\VxKex_A2E1F9D39F1C03DE\KEX_StrongVersionSpoof = "0" 8971f3c55b1836d226226f110305f68c7ff6df9af26ffa28f682059aaac4c715.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msiexec.exe\VxKex_A2E1F9D39F1C03DE\GlobalFlag = "256" 8971f3c55b1836d226226f110305f68c7ff6df9af26ffa28f682059aaac4c715.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msiexec.exe\VxKex_2AD7E14E8933B65F\KEX_StrongVersionSpoof = "0" 8971f3c55b1836d226226f110305f68c7ff6df9af26ffa28f682059aaac4c715.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msiexec.exe\VxKex_C476EC84135AD8FC\KEX_DisableAppSpecific = "0" 8971f3c55b1836d226226f110305f68c7ff6df9af26ffa28f682059aaac4c715.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msiexec.exe\VxKex_A2E1F9D39F1C03DE\VerifierDlls = "kexdll.dll" 8971f3c55b1836d226226f110305f68c7ff6df9af26ffa28f682059aaac4c715.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msiexec.exe\VxKex_2AD7E14E8933B65F\VerifierDlls = "kexdll.dll" 8971f3c55b1836d226226f110305f68c7ff6df9af26ffa28f682059aaac4c715.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msiexec.exe\VxKex_2F09607C54CF4BCF 8971f3c55b1836d226226f110305f68c7ff6df9af26ffa28f682059aaac4c715.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msiexec.exe\VxKex_2F09607C54CF4BCF\VerifierDlls = "kexdll.dll" 8971f3c55b1836d226226f110305f68c7ff6df9af26ffa28f682059aaac4c715.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msiexec.exe\VxKex_C4F8FFDFB4444692\KEX_WinVerSpoof = "0" 8971f3c55b1836d226226f110305f68c7ff6df9af26ffa28f682059aaac4c715.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msiexec.exe\VxKex_C55DBFBCEEE6EE46\KEX_WinVerSpoof = "0" 8971f3c55b1836d226226f110305f68c7ff6df9af26ffa28f682059aaac4c715.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msiexec.exe\VxKex_C55DBFBCEEE6EE46\VerifierDlls = "kexdll.dll" 8971f3c55b1836d226226f110305f68c7ff6df9af26ffa28f682059aaac4c715.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msiexec.exe\VxKex_C476EC84135AD8FC\GlobalFlag = "256" 8971f3c55b1836d226226f110305f68c7ff6df9af26ffa28f682059aaac4c715.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msiexec.exe\VxKex_0490BA0148CDE4E3\FilterFullPath = "C:\\Windows\\system32\\msiexec.exe" 8971f3c55b1836d226226f110305f68c7ff6df9af26ffa28f682059aaac4c715.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msiexec.exe\VxKex_0490BA0148CDE4E3\KEX_DisableForChild = "0" 8971f3c55b1836d226226f110305f68c7ff6df9af26ffa28f682059aaac4c715.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msiexec.exe\VxKex_E5F5290484DCDE00\VerifierFlags = "2147483648" 8971f3c55b1836d226226f110305f68c7ff6df9af26ffa28f682059aaac4c715.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msiexec.exe\VxKex_2F09607C54CF4BCF\GlobalFlag = "256" 8971f3c55b1836d226226f110305f68c7ff6df9af26ffa28f682059aaac4c715.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msiexec.exe\VxKex_2F09607C54CF4BCF\VerifierFlags = "2147483648" 8971f3c55b1836d226226f110305f68c7ff6df9af26ffa28f682059aaac4c715.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msiexec.exe\VxKex_04BDFFDC3E534F8A\KEX_DisableForChild = "0" 8971f3c55b1836d226226f110305f68c7ff6df9af26ffa28f682059aaac4c715.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msiexec.exe\VxKex_1CCB783D278C75AD\FilterFullPath = "C:\\Windows\\system32\\msiexec.exe" 8971f3c55b1836d226226f110305f68c7ff6df9af26ffa28f682059aaac4c715.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msiexec.exe\VxKex_1CCB783D278C75AD\KEX_StrongVersionSpoof = "0" 8971f3c55b1836d226226f110305f68c7ff6df9af26ffa28f682059aaac4c715.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msiexec.exe\VxKex_0490BA0148CDE4E3\GlobalFlag = "256" 8971f3c55b1836d226226f110305f68c7ff6df9af26ffa28f682059aaac4c715.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msiexec.exe\VxKex_E5F5290484DCDE00\KEX_DisableForChild = "0" 8971f3c55b1836d226226f110305f68c7ff6df9af26ffa28f682059aaac4c715.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msiexec.exe\VxKex_6546042284B9DB57\KEX_DisableForChild = "0" 8971f3c55b1836d226226f110305f68c7ff6df9af26ffa28f682059aaac4c715.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msiexec.exe\VxKex_A2E1F9D39F1C03DE\KEX_DisableAppSpecific = "0" 8971f3c55b1836d226226f110305f68c7ff6df9af26ffa28f682059aaac4c715.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msiexec.exe\VxKex_0490BA0148CDE4E3 8971f3c55b1836d226226f110305f68c7ff6df9af26ffa28f682059aaac4c715.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msiexec.exe\VxKex_1CCB783D278C75AD\VerifierFlags = "2147483648" 8971f3c55b1836d226226f110305f68c7ff6df9af26ffa28f682059aaac4c715.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msiexec.exe\VxKex_2AD7E14E8933B65F\KEX_WinVerSpoof = "0" 8971f3c55b1836d226226f110305f68c7ff6df9af26ffa28f682059aaac4c715.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msiexec.exe\VxKex_C476EC84135AD8FC\FilterFullPath = "C:\\Windows\\system32\\msiexec.exe" 8971f3c55b1836d226226f110305f68c7ff6df9af26ffa28f682059aaac4c715.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msiexec.exe\VxKex_C4F8FFDFB4444692 8971f3c55b1836d226226f110305f68c7ff6df9af26ffa28f682059aaac4c715.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msiexec.exe\VxKex_C4F8FFDFB4444692\KEX_StrongVersionSpoof = "0" 8971f3c55b1836d226226f110305f68c7ff6df9af26ffa28f682059aaac4c715.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msiexec.exe\VxKex_6546042284B9DB57\KEX_DisableAppSpecific = "0" 8971f3c55b1836d226226f110305f68c7ff6df9af26ffa28f682059aaac4c715.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msiexec.exe\VxKex_A2E1F9D39F1C03DE\VerifierFlags = "2147483648" 8971f3c55b1836d226226f110305f68c7ff6df9af26ffa28f682059aaac4c715.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msiexec.exe\VxKex_0490BA0148CDE4E3\VerifierDlls = "kexdll.dll" 8971f3c55b1836d226226f110305f68c7ff6df9af26ffa28f682059aaac4c715.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8971f3c55b1836d226226f110305f68c7ff6df9af26ffa28f682059aaac4c715.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\8971f3c55b1836d226226f110305f68c7ff6df9af26ffa28f682059aaac4c715.exe"C:\Users\Admin\AppData\Local\Temp\8971f3c55b1836d226226f110305f68c7ff6df9af26ffa28f682059aaac4c715.exe"1⤵
- Event Triggered Execution: Image File Execution Options Injection
- System Location Discovery: System Language Discovery
PID:4872