Overview

overview

7

Static

static

1

node-v24.18.0-x64.msi

windows10-2004-x64

7

node-v24.18.0-x64.msi

windows11-ltsc_2024-x64

7

Analysis

  • user interaction
    yes
  • max time kernel
    148s
  • max time network
    126s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260710-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    17/07/2026, 04:03

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    node-v24.18.0-x64.msi
  • Size 31.4MB
  • Sample260717-emmtcset41
  • SHA256 e30cd4ca15529583afe0efc978f1ae3ab3a93c2400c222d0752d17900552ebb3
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discoverypersistenceprivilege_escalationransomware

Malware Config

Signatures

  • Loads dropped DLL 7 IoCs
  • Badlisted process makes network request 1 IoCs

    Network request originating from process or tool commonly abused by malware.

  • Enumerates connected drives 3 TTPs 46 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 19 IoCs
  • Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
    persistenceprivilege_escalation
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 5 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 3 IoCs
  • Modifies registry class 29 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 5 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Windows\system32\msiexec.exe
    msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\node-v24.18.0-x64.msi
    1⤵
    • Badlisted process makes network request
    • Enumerates connected drives
    • Event Triggered Execution: Installer Packages
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    PID:3600
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Enumerates connected drives
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Modifies data under HKEY_USERS
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:5544
    • C:\Windows\System32\MsiExec.exe
      C:\Windows\System32\MsiExec.exe -Embedding CAC9369A618FF6D79966219E7B3E399A C
      2⤵
      • Loads dropped DLL
      • Suspicious use of SetWindowsHookEx
      PID:4480
    • C:\Windows\system32\srtasks.exe
      C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
      2⤵
        PID:4764
      • C:\Windows\System32\MsiExec.exe
        C:\Windows\System32\MsiExec.exe -Embedding D0C56060D271769BC4B4947AF04B9E0D
        2⤵
        • Loads dropped DLL
        • Suspicious use of SetWindowsHookEx
        PID:5348
      • C:\Windows\System32\MsiExec.exe
        C:\Windows\System32\MsiExec.exe -Embedding 387B15655D2D2BA88F0236C9083ABE69 E Global\MSI0000
        2⤵
        • Loads dropped DLL
        • Suspicious use of SetWindowsHookEx
        PID:4168
      • C:\Windows\syswow64\MsiExec.exe
        C:\Windows\syswow64\MsiExec.exe -Embedding B4D5DCF90BC62BF7F4AEB4B342EBD317
        2⤵
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:5364
    • C:\Windows\system32\vssvc.exe
      C:\Windows\system32\vssvc.exe
      1⤵
      • Checks SCSI registry key(s)
      PID:4672

    Network

          MITRE ATT&CK Enterprise v16

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          e5a5bfd.rbs
          • Path C:\Config.Msi\e5a5bfd.rbs
          • Size 810KB
          • SHA256 8878092a5543349bac0fad9acb75aa69c1550877eed69521839ac0c0323f61cb
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          LICENSE
          • Path C:\Program Files\nodejs\node_modules\npm\node_modules\@sigstore\tuf\LICENSE
          • Size 11KB
          • SHA256 7b0ce3425a26fdba501cb13508af096ade77e4036dd2bd8849031ddecf64f7c9
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          shared.types.js
          • Path C:\Program Files\nodejs\node_modules\npm\node_modules\@sigstore\verify\dist\shared.types.js
          • Size 79B
          • SHA256 ef1f170ad28f2d870a474d2f96ae353d770fff5f20e642cd8f9b6f1d7742df13
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          LICENSE
          • Path C:\Program Files\nodejs\node_modules\npm\node_modules\bin-links\LICENSE
          • Size 754B
          • SHA256 45e433413760dc3ae8169be5ed9c2c77adc31ad4d1bc5a28939576df240f29a0
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          package.json
          • Path C:\Program Files\nodejs\node_modules\npm\node_modules\common-ancestor-path\dist\commonjs\package.json
          • Size 28B
          • SHA256 58b55392b5778941e1e96892a70edc12e2d7bb8541289b237fbddc9926ed51bd
          • MD5 SHA1 SHA512
          Submit Download

          package.json
          • Path C:\Program Files\nodejs\node_modules\npm\node_modules\common-ancestor-path\dist\esm\package.json
          • Size 26B
          • SHA256 1bf0e53fc74b05f1aade7451fbac72f1944b067d4229d96bae7a225519a250e4
          • MD5 SHA1 SHA512
          Submit Download

          LICENSE
          • Path C:\Program Files\nodejs\node_modules\npm\node_modules\json-stringify-nice\LICENSE
          • Size 780B
          • SHA256 3f24d692d165989cd9a00fe35ca15a2bc6859e3361fa42aa20babd435f2e4706
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          LICENSE
          • Path C:\Program Files\nodejs\node_modules\npm\node_modules\libnpmsearch\LICENSE
          • Size 730B
          • SHA256 2ef361317adeda98117f14c5110182c28eae233af1f7050c83d4396961d14013
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          LICENSE.md
          • Path C:\Program Files\nodejs\node_modules\npm\node_modules\minipass-flush\LICENSE.md
          • Size 1KB
          • SHA256 865576de51d520f97c8869b9b9f96caf8efd69b82bb6e575fc00b0964dc7a3ca
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          LICENSE.md
          • Path C:\Program Files\nodejs\node_modules\npm\node_modules\npm-profile\LICENSE.md
          • Size 818B
          • SHA256 733dcbf5b1c95dc765b76db969b998ce0cbb26f01be2e55e7bccd6c7af29cb04
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          LICENSE
          • Path C:\Program Files\nodejs\node_modules\npm\node_modules\promzard\LICENSE
          • Size 763B
          • SHA256 1fccd0ad2e7e0e31ddfadeaf0660d7318947b425324645aa85afd7227cab52d7
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          Node.js documentation.url
          • Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Node.js\Node.js documentation.url
          • Size 168B
          • SHA256 08095c9a9bb7a5e1cc5cc715b1f5bc012285370c0643085f0985d30de2b1d4b5
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          MSIB339.tmp
          • Path C:\Users\Admin\AppData\Local\Temp\MSIB339.tmp
          • Size 142KB
          • SHA256 07acb65ce67366b92e12ea2fa5cb9883dd9fe4416898460a87d8f5ee103499b2
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          MSIB463.tmp
          • Path C:\Users\Admin\AppData\Local\Temp\MSIB463.tmp
          • Size 390KB
          • SHA256 6ad2dc761ef5e3f2048148e390cf314c3a2a47c75be57917eb0b66783424bf8b
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          MSI9E0B.tmp
          • Path C:\Windows\Installer\MSI9E0B.tmp
          • Size 342KB
          • SHA256 69cdc445cd2b1ade4074853f11c8a229c7501e176b5b113b47ac18c5564148b6
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          e5a5bfc.msi
          • Path C:\Windows\Installer\e5a5bfc.msi
          • Size 31.4MB
          • SHA256 e30cd4ca15529583afe0efc978f1ae3ab3a93c2400c222d0752d17900552ebb3
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          metadata-2
          • Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
          • Size 26.1MB
          • SHA256 693d531dddffd547bb0c8b7e703f5b22a542ce636f7d0be91ed49b50cf8fbff7
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          {d37f7fd8-0602-4b3a-b8ab-4c6395f08b86}_OnDiskSnapshotProp
          • Path \??\Volume{5d76dc85-0000-0000-0000-d08302000000}\System Volume Information\SPP\OnlineMetadataCache\{d37f7fd8-0602-4b3a-b8ab-4c6395f08b86}_OnDiskSnapshotProp
          • Size 6KB
          • SHA256 dee3fdb523c357c181d60263f080eace6fcd8ddc8a1a36131afa184dcac7e407
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download