Analysis
- max time kernel
150s - max time network
125s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
07/11/2026, 10:30
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
8971f3c55b1836d226226f110305f68c7ff6df9af26ffa28f682059aaac4c715.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
8971f3c55b1836d226226f110305f68c7ff6df9af26ffa28f682059aaac4c715.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
2 signatures
150 seconds
General
- Target 8971f3c55b1836d226226f110305f68c7ff6df9af26ffa28f682059aaac4c715.exe
- Size 115KB
- Sample261107-mkbbjsct8j
- SHA256 8971f3c55b1836d226226f110305f68c7ff6df9af26ffa28f682059aaac4c715
- MD5 242ac3714af5c0cb7dd991156f6fcb7d
- SHA1 ba82be0b303e9206ed1e4791c786db3c4f9abbbb
- SHA512 883471b8dbb97cf49cd4ba427446fe28bd547fd4d33e3d5f6d1696226dfffbc95ae7e693d0327a0848aad8d71d7375dfff15ee690c47d64ee2798e259fe49043
- SSDEEP 3072:flMAvoB9nTU/FO3j5ktQSGZHG9HGhUGNFGiEG:flQBNTU/FOF8f6GloA
- TLSH T1F2C34C01BBF9C515F2F32B71ADB9A7604A7ABC616835C65E62502E0F2833B10DD64B37
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
Malware Config
Signatures
- Event Triggered Execution: Image File Execution Options Injection 1 TTPs 64 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msiexec.exe\VxKex_E14E8625B15D2C29\KEX_WinVerSpoof = "0" 8971f3c55b1836d226226f110305f68c7ff6df9af26ffa28f682059aaac4c715.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msiexec.exe\VxKex_B7E32342018A2160\VerifierFlags = "2147483648" 8971f3c55b1836d226226f110305f68c7ff6df9af26ffa28f682059aaac4c715.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msiexec.exe\VxKex_535E596BE6694227 8971f3c55b1836d226226f110305f68c7ff6df9af26ffa28f682059aaac4c715.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msiexec.exe\VxKex_E14E8625B15D2C29\FilterFullPath = "C:\\Windows\\system32\\msiexec.exe" 8971f3c55b1836d226226f110305f68c7ff6df9af26ffa28f682059aaac4c715.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msiexec.exe\VxKex_E14E8625B15D2C29\KEX_StrongVersionSpoof = "0" 8971f3c55b1836d226226f110305f68c7ff6df9af26ffa28f682059aaac4c715.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msiexec.exe\VxKex_E14E8625B15D2C29\VerifierDlls = "kexdll.dll" 8971f3c55b1836d226226f110305f68c7ff6df9af26ffa28f682059aaac4c715.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msiexec.exe\VxKex_6C1EA869AEEF2A3F\KEX_DisableAppSpecific = "0" 8971f3c55b1836d226226f110305f68c7ff6df9af26ffa28f682059aaac4c715.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msiexec.exe\VxKex_2EC6F036BBE510B1\KEX_DisableAppSpecific = "0" 8971f3c55b1836d226226f110305f68c7ff6df9af26ffa28f682059aaac4c715.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msiexec.exe\VxKex_4AB27456758B4C50\FilterFullPath = "C:\\Windows\\system32\\msiexec.exe" 8971f3c55b1836d226226f110305f68c7ff6df9af26ffa28f682059aaac4c715.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msiexec.exe\VxKex_4AB27456758B4C50\GlobalFlag = "256" 8971f3c55b1836d226226f110305f68c7ff6df9af26ffa28f682059aaac4c715.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msiexec.exe\VxKex_65C8E7F47787385B\FilterFullPath = "C:\\Windows\\system32\\msiexec.exe" 8971f3c55b1836d226226f110305f68c7ff6df9af26ffa28f682059aaac4c715.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msiexec.exe\VxKex_65C8E7F47787385B\VerifierFlags = "2147483648" 8971f3c55b1836d226226f110305f68c7ff6df9af26ffa28f682059aaac4c715.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msiexec.exe\VxKex_5F4EC30BAD20236F\VerifierDlls = "kexdll.dll" 8971f3c55b1836d226226f110305f68c7ff6df9af26ffa28f682059aaac4c715.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msiexec.exe\VxKex_B7E32342018A2160\FilterFullPath = "C:\\Windows\\system32\\msiexec.exe" 8971f3c55b1836d226226f110305f68c7ff6df9af26ffa28f682059aaac4c715.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msiexec.exe\VxKex_B7E32342018A2160\KEX_StrongVersionSpoof = "0" 8971f3c55b1836d226226f110305f68c7ff6df9af26ffa28f682059aaac4c715.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msiexec.exe\VxKex_20C419AD6EEA61B1 8971f3c55b1836d226226f110305f68c7ff6df9af26ffa28f682059aaac4c715.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msiexec.exe\VxKex_5F4EC30BAD20236F 8971f3c55b1836d226226f110305f68c7ff6df9af26ffa28f682059aaac4c715.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msiexec.exe\VxKex_5F4EC30BAD20236F\KEX_DisableAppSpecific = "0" 8971f3c55b1836d226226f110305f68c7ff6df9af26ffa28f682059aaac4c715.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msiexec.exe\VxKex_535E596BE6694227\KEX_WinVerSpoof = "0" 8971f3c55b1836d226226f110305f68c7ff6df9af26ffa28f682059aaac4c715.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msiexec.exe\VxKex_535E596BE6694227\GlobalFlag = "256" 8971f3c55b1836d226226f110305f68c7ff6df9af26ffa28f682059aaac4c715.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msiexec.exe\VxKex_535E596BE6694227\VerifierDlls = "kexdll.dll" 8971f3c55b1836d226226f110305f68c7ff6df9af26ffa28f682059aaac4c715.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msiexec.exe\VxKex_874B7F7028D26399\GlobalFlag = "256" 8971f3c55b1836d226226f110305f68c7ff6df9af26ffa28f682059aaac4c715.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msiexec.exe\VxKex_E14E8625B15D2C29\KEX_DisableAppSpecific = "0" 8971f3c55b1836d226226f110305f68c7ff6df9af26ffa28f682059aaac4c715.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msiexec.exe\VxKex_65C8E7F47787385B\GlobalFlag = "256" 8971f3c55b1836d226226f110305f68c7ff6df9af26ffa28f682059aaac4c715.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msiexec.exe\VxKex_5F4EC30BAD20236F\KEX_StrongVersionSpoof = "0" 8971f3c55b1836d226226f110305f68c7ff6df9af26ffa28f682059aaac4c715.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msiexec.exe\VxKex_5F4EC30BAD20236F\GlobalFlag = "256" 8971f3c55b1836d226226f110305f68c7ff6df9af26ffa28f682059aaac4c715.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msiexec.exe\VxKex_FBD41602EC483532\KEX_WinVerSpoof = "0" 8971f3c55b1836d226226f110305f68c7ff6df9af26ffa28f682059aaac4c715.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msiexec.exe\VxKex_6C1EA869AEEF2A3F\KEX_DisableForChild = "0" 8971f3c55b1836d226226f110305f68c7ff6df9af26ffa28f682059aaac4c715.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msiexec.exe\VxKex_6C1EA869AEEF2A3F\KEX_StrongVersionSpoof = "0" 8971f3c55b1836d226226f110305f68c7ff6df9af26ffa28f682059aaac4c715.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msiexec.exe\VxKex_2EC6F036BBE510B1\KEX_WinVerSpoof = "0" 8971f3c55b1836d226226f110305f68c7ff6df9af26ffa28f682059aaac4c715.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msiexec.exe\VxKex_535E596BE6694227\VerifierFlags = "2147483648" 8971f3c55b1836d226226f110305f68c7ff6df9af26ffa28f682059aaac4c715.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msiexec.exe\VxKex_874B7F7028D26399 8971f3c55b1836d226226f110305f68c7ff6df9af26ffa28f682059aaac4c715.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msiexec.exe\VxKex_E14E8625B15D2C29\KEX_DisableForChild = "0" 8971f3c55b1836d226226f110305f68c7ff6df9af26ffa28f682059aaac4c715.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msiexec.exe\VxKex_6C1EA869AEEF2A3F\VerifierDlls = "kexdll.dll" 8971f3c55b1836d226226f110305f68c7ff6df9af26ffa28f682059aaac4c715.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msiexec.exe\VxKex_65C8E7F47787385B\KEX_StrongVersionSpoof = "0" 8971f3c55b1836d226226f110305f68c7ff6df9af26ffa28f682059aaac4c715.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msiexec.exe\VxKex_5F4EC30BAD20236F\KEX_WinVerSpoof = "0" 8971f3c55b1836d226226f110305f68c7ff6df9af26ffa28f682059aaac4c715.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msiexec.exe\VxKex_B7E32342018A2160\KEX_DisableAppSpecific = "0" 8971f3c55b1836d226226f110305f68c7ff6df9af26ffa28f682059aaac4c715.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msiexec.exe\VxKex_B7E32342018A2160\KEX_WinVerSpoof = "0" 8971f3c55b1836d226226f110305f68c7ff6df9af26ffa28f682059aaac4c715.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msiexec.exe\VxKex_FBD41602EC483532\GlobalFlag = "256" 8971f3c55b1836d226226f110305f68c7ff6df9af26ffa28f682059aaac4c715.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msiexec.exe\VxKex_FBD41602EC483532\VerifierDlls = "kexdll.dll" 8971f3c55b1836d226226f110305f68c7ff6df9af26ffa28f682059aaac4c715.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msiexec.exe\VxKex_874B7F7028D26399\FilterFullPath = "C:\\Windows\\system32\\msiexec.exe" 8971f3c55b1836d226226f110305f68c7ff6df9af26ffa28f682059aaac4c715.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msiexec.exe\VxKex_874B7F7028D26399\KEX_DisableForChild = "0" 8971f3c55b1836d226226f110305f68c7ff6df9af26ffa28f682059aaac4c715.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msiexec.exe\VxKex_20C419AD6EEA61B1\GlobalFlag = "256" 8971f3c55b1836d226226f110305f68c7ff6df9af26ffa28f682059aaac4c715.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msiexec.exe\VxKex_2EC6F036BBE510B1\KEX_StrongVersionSpoof = "0" 8971f3c55b1836d226226f110305f68c7ff6df9af26ffa28f682059aaac4c715.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msiexec.exe\VxKex_65C8E7F47787385B\KEX_DisableForChild = "0" 8971f3c55b1836d226226f110305f68c7ff6df9af26ffa28f682059aaac4c715.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msiexec.exe\VxKex_535E596BE6694227\KEX_StrongVersionSpoof = "0" 8971f3c55b1836d226226f110305f68c7ff6df9af26ffa28f682059aaac4c715.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msiexec.exe\VxKex_FBD41602EC483532\VerifierFlags = "2147483648" 8971f3c55b1836d226226f110305f68c7ff6df9af26ffa28f682059aaac4c715.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msiexec.exe\VxKex_874B7F7028D26399\KEX_StrongVersionSpoof = "0" 8971f3c55b1836d226226f110305f68c7ff6df9af26ffa28f682059aaac4c715.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msiexec.exe\VxKex_E14E8625B15D2C29 8971f3c55b1836d226226f110305f68c7ff6df9af26ffa28f682059aaac4c715.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msiexec.exe\VxKex_E14E8625B15D2C29\VerifierFlags = "2147483648" 8971f3c55b1836d226226f110305f68c7ff6df9af26ffa28f682059aaac4c715.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msiexec.exe\VxKex_2EC6F036BBE510B1\KEX_DisableForChild = "0" 8971f3c55b1836d226226f110305f68c7ff6df9af26ffa28f682059aaac4c715.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msiexec.exe\VxKex_65C8E7F47787385B\KEX_DisableAppSpecific = "0" 8971f3c55b1836d226226f110305f68c7ff6df9af26ffa28f682059aaac4c715.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msiexec.exe\VxKex_535E596BE6694227\KEX_DisableForChild = "0" 8971f3c55b1836d226226f110305f68c7ff6df9af26ffa28f682059aaac4c715.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msiexec.exe\VxKex_FBD41602EC483532\FilterFullPath = "C:\\Windows\\system32\\msiexec.exe" 8971f3c55b1836d226226f110305f68c7ff6df9af26ffa28f682059aaac4c715.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msiexec.exe\VxKex_874B7F7028D26399\VerifierDlls = "kexdll.dll" 8971f3c55b1836d226226f110305f68c7ff6df9af26ffa28f682059aaac4c715.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msiexec.exe\VxKex_6C1EA869AEEF2A3F\FilterFullPath = "C:\\Windows\\system32\\msiexec.exe" 8971f3c55b1836d226226f110305f68c7ff6df9af26ffa28f682059aaac4c715.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msiexec.exe\VxKex_6C1EA869AEEF2A3F\VerifierFlags = "2147483648" 8971f3c55b1836d226226f110305f68c7ff6df9af26ffa28f682059aaac4c715.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msiexec.exe\VxKex_20C419AD6EEA61B1\FilterFullPath = "C:\\Windows\\system32\\msiexec.exe" 8971f3c55b1836d226226f110305f68c7ff6df9af26ffa28f682059aaac4c715.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msiexec.exe\VxKex_20C419AD6EEA61B1\VerifierFlags = "2147483648" 8971f3c55b1836d226226f110305f68c7ff6df9af26ffa28f682059aaac4c715.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msiexec.exe\VxKex_20C419AD6EEA61B1\VerifierDlls = "kexdll.dll" 8971f3c55b1836d226226f110305f68c7ff6df9af26ffa28f682059aaac4c715.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msiexec.exe\VxKex_2EC6F036BBE510B1\VerifierFlags = "2147483648" 8971f3c55b1836d226226f110305f68c7ff6df9af26ffa28f682059aaac4c715.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msiexec.exe\VxKex_4AB27456758B4C50\VerifierDlls = "kexdll.dll" 8971f3c55b1836d226226f110305f68c7ff6df9af26ffa28f682059aaac4c715.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msiexec.exe\VxKex_65C8E7F47787385B 8971f3c55b1836d226226f110305f68c7ff6df9af26ffa28f682059aaac4c715.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msiexec.exe\VxKex_535E596BE6694227\FilterFullPath = "C:\\Windows\\system32\\msiexec.exe" 8971f3c55b1836d226226f110305f68c7ff6df9af26ffa28f682059aaac4c715.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8971f3c55b1836d226226f110305f68c7ff6df9af26ffa28f682059aaac4c715.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\8971f3c55b1836d226226f110305f68c7ff6df9af26ffa28f682059aaac4c715.exe"C:\Users\Admin\AppData\Local\Temp\8971f3c55b1836d226226f110305f68c7ff6df9af26ffa28f682059aaac4c715.exe"1⤵
- Event Triggered Execution: Image File Execution Options Injection
- System Location Discovery: System Language Discovery
PID:2508