Analysis
- max time kernel
898s - max time network
888s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260618-en - resource tags
- submitted
23/06/2026, 18:23
General
- Target Cloudflare_WARP_2026.3.851.0.msi
- Size 129.4MB
- Sample260623-w1jsasft9t
- SHA256 381178d3a2ebb0aab4c11d2125f2fa247ffeccc561b4195155901c4b60e3941c
Malware Config
Signatures
- Creates new service(s) 2 TTPs
- Executes dropped EXE 3 IoCs
- Loads dropped DLL 19 IoCs
- Badlisted process makes network request 1 IoCs
Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Network Service Discovery 1 TTPs 2 IoCs
Attempt to gather information on host's network.
- Drops file in Program Files directory 9 IoCs
- Drops file in Windows directory 30 IoCs
- Launches sc.exe 5 IoCs
Sc.exe is a Windows utlilty to control services on the system.
- Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Modifies data under HKEY_USERS 3 IoCs
- Modifies registry class 36 IoCs
- Suspicious behavior: EnumeratesProcesses 13 IoCs
- Suspicious behavior: LoadsDriver 2 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of FindShellTrayWindow 2 IoCs
- Suspicious use of SetWindowsHookEx 5 IoCs
- Suspicious use of WriteProcessMemory 12 IoCs
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\Cloudflare_WARP_2026.3.851.0.msi1⤵
- Badlisted process makes network request
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 4D5C52B10525D88F95B25E90EA1C0B382⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\System32\MsiExec.exeC:\Windows\System32\MsiExec.exe -Embedding 784ADCE1E2C675004DC81A3A7C9D7C95 E Global\MSI00002⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\rundll32.exerundll32.exe "C:\Windows\Installer\MSIE122.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240771453 25 Warp.Installer.Actions!Warp.Installer.Actions.CustomActions.ReadCmdLineParams3⤵
- Loads dropped DLL
- Drops file in Windows directory
-
-
C:\Windows\system32\rundll32.exerundll32.exe "C:\Windows\Installer\MSIEA6A.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240773812 36 Warp.Installer.Actions!Warp.Installer.Actions.CustomActions.InstallService3⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\sc.exe"sc.exe" create CloudflareWARP binPath= "\"C:\Program Files\Cloudflare\Cloudflare WARP\warp-svc.exe"\" displayname= "Cloudflare WARP" start= "auto"4⤵
- Network Service Discovery
- Launches sc.exe
-
-
C:\Windows\system32\sc.exe"sc.exe" config CloudflareWARP depend= "wlansvc"4⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exe"sc.exe" failure CloudflareWARP reset= 86400 actions= restart/0/restart/1000/restart/50004⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exe"sc.exe" failureflag CloudflareWARP 14⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exe"sc.exe" config CloudflareWARP start=AUTO4⤵
- Launches sc.exe
-
-
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 70F9694F5359F06D90F8D6DEC49049F0 E Global\MSI00002⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files\Cloudflare\Cloudflare WARP\Cloudflare WARP.exe"C:\Program Files\Cloudflare\Cloudflare WARP\Cloudflare WARP.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵
-
C:\Program Files\Cloudflare\Cloudflare WARP\warp-svc.exe"C:\Program Files\Cloudflare\Cloudflare WARP\warp-svc.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Network Service Discovery
- Suspicious behavior: EnumeratesProcesses
-
C:\PROGRA~1\CLOUDF~1\CLOUDF~1\Cloudflare WARP.exeC:\PROGRA~1\CLOUDF~1\CLOUDF~1\CLOUDF~1.EXE1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\System32\SecurityHealthHost.exe\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding1⤵
Network
MITRE ATT&CK Enterprise v16
Persistence
Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Installer Packages
1Privilege Escalation
Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Installer Packages
1Replay Monitor
Loading Replay Monitor...
Downloads
e59ce05.rbs
warp_ipc.DLL
aws_lc_fips_0_13_7_crypto.dll
PresentationNative_cor3.dll
MSI95848.LOG
MSIDF99.tmp
MSIE122.tmp
Common.dll
Warp.Installer.Actions.dll
CustomAction.config
Microsoft.Deployment.WindowsInstaller.dll
MSIF23C.tmp
metadata-2
{d2dd7a2a-9670-4ccd-9f36-d614b8592425}_OnDiskSnapshotProp
memory/4060-36-0x0000024482570000-0x000002448257A000-memory.dmp
memory/4060-40-0x00000244825A0000-0x00000244825A8000-memory.dmp
memory/4060-32-0x0000024483490000-0x00000244834BE000-memory.dmp
memory/4060-41-0x00000244834E0000-0x00000244834FA000-memory.dmp
memory/5236-283-0x0000019F5B250000-0x0000019F5B258000-memory.dmp
memory/5236-256-0x0000019F5B0A0000-0x0000019F5B0AA000-memory.dmp
memory/5236-124-0x0000019F5A270000-0x0000019F5A664000-memory.dmp
memory/5236-154-0x0000019F5A000000-0x0000019F5A040000-memory.dmp
memory/5236-163-0x0000019F39780000-0x0000019F39789000-memory.dmp
memory/5236-157-0x0000019F5AAD0000-0x0000019F5ACF3000-memory.dmp
memory/5236-193-0x0000019F5A090000-0x0000019F5A095000-memory.dmp
memory/5236-202-0x0000019F5A0A0000-0x0000019F5A0B8000-memory.dmp
memory/5236-199-0x0000019F5A0E0000-0x0000019F5A0F6000-memory.dmp
memory/5236-196-0x0000019F5A0C0000-0x0000019F5A0D9000-memory.dmp
memory/5236-217-0x0000019F5ADF0000-0x0000019F5ADFA000-memory.dmp
memory/5236-211-0x0000019F5F3D0000-0x0000019F5FBEC000-memory.dmp
memory/5236-298-0x0000019F5B2A0000-0x0000019F5B2A9000-memory.dmp
memory/5236-310-0x0000019F5EC30000-0x0000019F5ECB6000-memory.dmp
memory/5236-313-0x0000019F5B590000-0x0000019F5B60C000-memory.dmp
memory/5236-307-0x0000019F5B3B0000-0x0000019F5B3E4000-memory.dmp
memory/5236-304-0x0000019F5B340000-0x0000019F5B361000-memory.dmp
memory/5236-301-0x0000019F5B310000-0x0000019F5B336000-memory.dmp
memory/5236-290-0x0000019F5B420000-0x0000019F5B589000-memory.dmp
memory/5236-295-0x0000019F5B190000-0x0000019F5B19E000-memory.dmp
memory/5236-292-0x0000019F5B260000-0x0000019F5B267000-memory.dmp
memory/5236-286-0x0000019F5B280000-0x0000019F5B29C000-memory.dmp
memory/5236-130-0x0000019F59E60000-0x0000019F59EA7000-memory.dmp
memory/5236-280-0x0000019F5B170000-0x0000019F5B17A000-memory.dmp
memory/5236-277-0x0000019F5B180000-0x0000019F5B189000-memory.dmp
memory/5236-274-0x0000019F5B220000-0x0000019F5B241000-memory.dmp
memory/5236-271-0x0000019F5B200000-0x0000019F5B216000-memory.dmp
memory/5236-268-0x0000019F5B1A0000-0x0000019F5B1BD000-memory.dmp
memory/5236-265-0x0000019F5B130000-0x0000019F5B147000-memory.dmp
memory/5236-262-0x0000019F5B1C0000-0x0000019F5B1FC000-memory.dmp
memory/5236-259-0x0000019F5B150000-0x0000019F5B162000-memory.dmp
memory/5236-127-0x0000019F59F20000-0x0000019F59FA2000-memory.dmp
memory/5236-253-0x0000019F5B0B0000-0x0000019F5B0C3000-memory.dmp
memory/5236-250-0x0000019F5AE60000-0x0000019F5AE6A000-memory.dmp
memory/5236-247-0x0000019F5AEC0000-0x0000019F5AEC8000-memory.dmp
memory/5236-244-0x0000019F5B070000-0x0000019F5B083000-memory.dmp
memory/5236-241-0x0000019F5B0D0000-0x0000019F5B12C000-memory.dmp
memory/5236-238-0x0000019F5B050000-0x0000019F5B063000-memory.dmp
memory/5236-235-0x0000019F5B030000-0x0000019F5B044000-memory.dmp
memory/5236-232-0x0000019F5AE40000-0x0000019F5AE48000-memory.dmp
memory/5236-226-0x0000019F5AFD0000-0x0000019F5AFF1000-memory.dmp
memory/5236-220-0x0000019F5AE70000-0x0000019F5AE95000-memory.dmp
memory/5236-229-0x0000019F5B000000-0x0000019F5B02F000-memory.dmp
memory/5236-223-0x0000019F5AEA0000-0x0000019F5AEB7000-memory.dmp
memory/5236-214-0x0000019F5AE00000-0x0000019F5AE29000-memory.dmp
memory/5236-208-0x0000019F5AED0000-0x0000019F5AFC4000-memory.dmp
memory/5236-133-0x0000019F39740000-0x0000019F39752000-memory.dmp
memory/5236-190-0x0000019F59FD0000-0x0000019F59FDD000-memory.dmp
memory/5236-184-0x0000019F5E350000-0x0000019F5EB92000-memory.dmp
memory/5236-181-0x0000019F5AD00000-0x0000019F5AD44000-memory.dmp
memory/5236-178-0x0000019F59EF0000-0x0000019F59EFB000-memory.dmp
memory/5236-175-0x0000019F59FE0000-0x0000019F59FF4000-memory.dmp
memory/5236-172-0x0000019F59FB0000-0x0000019F59FBE000-memory.dmp
memory/5236-169-0x0000019F59F00000-0x0000019F59F08000-memory.dmp
memory/5236-136-0x0000019F5B610000-0x0000019F5C598000-memory.dmp
memory/5236-187-0x0000019F5AD50000-0x0000019F5ADC6000-memory.dmp
memory/5236-166-0x0000019F5A040000-0x0000019F5A07E000-memory.dmp
memory/5236-160-0x0000019F396C0000-0x0000019F396C5000-memory.dmp
memory/5236-142-0x0000019F5A110000-0x0000019F5A26E000-memory.dmp
memory/5236-151-0x0000019F39700000-0x0000019F39707000-memory.dmp
memory/5236-148-0x0000019F39720000-0x0000019F39733000-memory.dmp
memory/5236-145-0x0000019F59EB0000-0x0000019F59EDA000-memory.dmp
memory/5236-139-0x0000019F5A670000-0x0000019F5A898000-memory.dmp
memory/5236-121-0x0000000180000000-0x0000000180A25000-memory.dmp