Analysis
- max time kernel
149s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
19/07/2026, 23:47
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
c0ddf84e29374cd53ff4a44ff50e88e1b663fae404bc1a5200bbac38c8d1df36.msi
Resource
win10v2004-20260513-en
windows10-2004-x64
14 signatures
150 seconds
Behavioral task
behavioral2
Sample
c0ddf84e29374cd53ff4a44ff50e88e1b663fae404bc1a5200bbac38c8d1df36.msi
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
14 signatures
150 seconds
General
- Target c0ddf84e29374cd53ff4a44ff50e88e1b663fae404bc1a5200bbac38c8d1df36.msi
- Size 32KB
- Sample260719-3s2fpsbw21
- SHA256 c0ddf84e29374cd53ff4a44ff50e88e1b663fae404bc1a5200bbac38c8d1df36
- MD5 f771bacddb1ea53e4e04f73cdb5f799e
- SHA1 51105a9b8201817ec70ea1dba43f09fbfa5a8663
- SHA512 4f461543abd03eb650de9e930e13beeaa4ab862f71efc8494671f7f8034ab43305666ae7da8958b54bc2e7bf950915d8d5d9072ccb1e7882fefb4c4f324fe0ab
- SSDEEP 384:pWU4afig0dV2ePOYly3M5NEXagSoex5Pey3M5sC0x:lgf3PfWMdeWMmCU
- TLSH T1C3E2C61776449331C58657314A2FD7F48B36AC588F675522329AF38C2F729D062BBBE0
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Extracted
Language
-
ps1
Deobfuscated
Source
URLs
-
exe.dropper
https://nodejs.org/dist/v22.16.0/node-v22.16.0-win-x64.zip
-
exe.dropper
https://newfolder.click?cid=ca48856ee0083815
Signatures
- Badlisted process makes network request 6 IoCs
Network request originating from process or tool commonly abused by malware.
flow pid Process 15 2400 powershell.exe 19 2400 powershell.exe 21 2400 powershell.exe 29 2400 powershell.exe 46 2400 powershell.exe 47 2400 powershell.exe - Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell and hide display window.
pid Process 2400 powershell.exe - Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\Control Panel\International\Geo\Nation wscript.exe - Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\V: msiexec.exe - Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs
pid Process 1400 wscript.exe - Drops file in Windows directory 8 IoCs
description ioc Process File opened for modification C:\Windows\Installer\e58a36f.msi msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File created C:\Windows\Installer\SourceHash{B9B002B2-D53B-44B6-AFE8-45CE069F39A5} msiexec.exe File opened for modification C:\Windows\Installer\MSIA469.tmp msiexec.exe File created C:\Windows\Installer\e58a36f.msi msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File created C:\Windows\Installer\e58a371.msi msiexec.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
pid Process 4036 msiexec.exe - Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000f94cc820840d1c590000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000f94cc8200000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed35000000ffffffff000000000700010000680900f94cc820000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff350000000000000005000000ffffffff000000000700010000f8ff1af94cc820000000000000f0ff350000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1df94cc820000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe - Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 2044 msiexec.exe 2044 msiexec.exe 2400 powershell.exe 2400 powershell.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 4036 msiexec.exe Token: SeIncreaseQuotaPrivilege 4036 msiexec.exe Token: SeSecurityPrivilege 2044 msiexec.exe Token: SeCreateTokenPrivilege 4036 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 4036 msiexec.exe Token: SeLockMemoryPrivilege 4036 msiexec.exe Token: SeIncreaseQuotaPrivilege 4036 msiexec.exe Token: SeMachineAccountPrivilege 4036 msiexec.exe Token: SeTcbPrivilege 4036 msiexec.exe Token: SeSecurityPrivilege 4036 msiexec.exe Token: SeTakeOwnershipPrivilege 4036 msiexec.exe Token: SeLoadDriverPrivilege 4036 msiexec.exe Token: SeSystemProfilePrivilege 4036 msiexec.exe Token: SeSystemtimePrivilege 4036 msiexec.exe Token: SeProfSingleProcessPrivilege 4036 msiexec.exe Token: SeIncBasePriorityPrivilege 4036 msiexec.exe Token: SeCreatePagefilePrivilege 4036 msiexec.exe Token: SeCreatePermanentPrivilege 4036 msiexec.exe Token: SeBackupPrivilege 4036 msiexec.exe Token: SeRestorePrivilege 4036 msiexec.exe Token: SeShutdownPrivilege 4036 msiexec.exe Token: SeDebugPrivilege 4036 msiexec.exe Token: SeAuditPrivilege 4036 msiexec.exe Token: SeSystemEnvironmentPrivilege 4036 msiexec.exe Token: SeChangeNotifyPrivilege 4036 msiexec.exe Token: SeRemoteShutdownPrivilege 4036 msiexec.exe Token: SeUndockPrivilege 4036 msiexec.exe Token: SeSyncAgentPrivilege 4036 msiexec.exe Token: SeEnableDelegationPrivilege 4036 msiexec.exe Token: SeManageVolumePrivilege 4036 msiexec.exe Token: SeImpersonatePrivilege 4036 msiexec.exe Token: SeCreateGlobalPrivilege 4036 msiexec.exe Token: SeBackupPrivilege 4952 vssvc.exe Token: SeRestorePrivilege 4952 vssvc.exe Token: SeAuditPrivilege 4952 vssvc.exe Token: SeBackupPrivilege 2044 msiexec.exe Token: SeRestorePrivilege 2044 msiexec.exe Token: SeRestorePrivilege 2044 msiexec.exe Token: SeTakeOwnershipPrivilege 2044 msiexec.exe Token: SeRestorePrivilege 2044 msiexec.exe Token: SeTakeOwnershipPrivilege 2044 msiexec.exe Token: SeRestorePrivilege 2044 msiexec.exe Token: SeTakeOwnershipPrivilege 2044 msiexec.exe Token: SeRestorePrivilege 2044 msiexec.exe Token: SeTakeOwnershipPrivilege 2044 msiexec.exe Token: SeRestorePrivilege 2044 msiexec.exe Token: SeTakeOwnershipPrivilege 2044 msiexec.exe Token: SeRestorePrivilege 2044 msiexec.exe Token: SeTakeOwnershipPrivilege 2044 msiexec.exe Token: SeRestorePrivilege 2044 msiexec.exe Token: SeTakeOwnershipPrivilege 2044 msiexec.exe Token: SeRestorePrivilege 2044 msiexec.exe Token: SeTakeOwnershipPrivilege 2044 msiexec.exe Token: SeRestorePrivilege 2044 msiexec.exe Token: SeTakeOwnershipPrivilege 2044 msiexec.exe Token: SeRestorePrivilege 2044 msiexec.exe Token: SeTakeOwnershipPrivilege 2044 msiexec.exe Token: SeRestorePrivilege 2044 msiexec.exe Token: SeTakeOwnershipPrivilege 2044 msiexec.exe Token: SeRestorePrivilege 2044 msiexec.exe Token: SeTakeOwnershipPrivilege 2044 msiexec.exe Token: SeRestorePrivilege 2044 msiexec.exe Token: SeTakeOwnershipPrivilege 2044 msiexec.exe Token: SeRestorePrivilege 2044 msiexec.exe - Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 4036 msiexec.exe 4036 msiexec.exe - Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2044 wrote to memory of 1796 2044 msiexec.exe 92 PID 2044 wrote to memory of 1400 2044 msiexec.exe 94 PID 1400 wrote to memory of 2400 1400 wscript.exe 95 PID 2400 wrote to memory of 3060 2400 powershell.exe 105 - Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\c0ddf84e29374cd53ff4a44ff50e88e1b663fae404bc1a5200bbac38c8d1df36.msi1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4036
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2044 -
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵PID:1796
-
-
C:\Windows\system32\wscript.exewscript.exe "helper.vbs"2⤵
- Checks computer location settings
- Executes a VBScript file via the Windows Script Host.
- Suspicious use of WriteProcessMemory
PID:1400 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -File "C:\Users\Admin\AppData\Local\empty\run-script.ps1"3⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2400 -
C:\Windows\system32\setx.exe"C:\Windows\system32\setx.exe" PATH "C:\Users\Admin\AppData\Local\nodejs\node-v22.16.0-win-x64;C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Program Files\dotnet\"4⤵PID:3060
-
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:4952
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Config.Msi\e58a370.rbs
- Size 8KB
- SHA256 9fefc40e7d318f498c485e87ea88b5a1397195a3123ab409671adb1dc9facb4a
- MD5 562d2ccf3a5eaaccbb1ad21e0f3ea9b5
- SHA1 a21aaa65f2af8f0ac9070e9aca659d51a3639eb5
- SHA512 f0887a18ef001f0d555a4c4d7c5a4accbfa7eedfb3121c9ee57da7d857c53d9712452d014733e8e984aa12f3243fe9eda4d25e126bac02dc5e5f681c61dd7a4a
- SSDEEP 96:WpROxAd0s7OszWe5c2c/1Uy9TCsThq9Uy9TC6j2UqcFcmgThqoHxVelBcvvzFcPl:WKCKeAO4OIP4OnU0Kuzv7ELpuUf
- TLSH T11A123542A79484E7E8692B72C72B537037ABD3EA9705324F4889C6340E07B8A5FD91C7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_mrlrhg24.fcf.ps1
- Size 60B
- SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
- MD5 d17fe0a3f47be24a6453e9ef58c94641
- SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
- SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
- TLSH T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\empty\helper.vbs
- Size 683B
- SHA256 88ebed34ab9ff0e16dc32b789fc25295ea570f86244e89cb68803c517597cfdd
- MD5 e7d23ea2f97b4ad6673f0d64c3097205
- SHA1 7f8c32f7750a5c5b98c88ac18a1682fc7920da5a
- SHA512 710e177c05b8513e4ea8bbac111ca4b5a0466ea1517c0f048f632dd85e8a6a47e93fc75643c90c19cbacdb017578fc95980554afd37dd97e49bf24fb09e8c5b6
- TLSH T19801D331D83BC7A45B4BCD0E41F2CD3CE5165127111CE66979A4C99CBF14BB4CB5C6A8
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\empty\run-script.ps1
- Size 812B
- SHA256 d20e1d680171e813754399cf23e61dd637765e0b59c088cc2b3ceceb44d8d3f8
- MD5 d7a4361434f0ff08b799889bf2b7574e
- SHA1 8cdde07119c56b93daa89d3dffa59b4f130f1c65
- SHA512 09468fd363ae3e55b9fa49121b350e7404d8eec7e81cc0c74fe5f233782256cf4fc9ed96dabb66296e4612e80c00960fc9d616de902e37520dde99a09ae4fe2f
- TLSH T12701B16721600330DD21CB7D8AC390BC919784FE18446D9972AD0AD56DB63F01BEBB68
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\Installer\e58a36f.msi
- Size 32KB
- SHA256 c0ddf84e29374cd53ff4a44ff50e88e1b663fae404bc1a5200bbac38c8d1df36
- MD5 f771bacddb1ea53e4e04f73cdb5f799e
- SHA1 51105a9b8201817ec70ea1dba43f09fbfa5a8663
- SHA512 4f461543abd03eb650de9e930e13beeaa4ab862f71efc8494671f7f8034ab43305666ae7da8958b54bc2e7bf950915d8d5d9072ccb1e7882fefb4c4f324fe0ab
- SSDEEP 384:pWU4afig0dV2ePOYly3M5NEXagSoex5Pey3M5sC0x:lgf3PfWMdeWMmCU
- TLSH T1C3E2C61776449331C58657314A2FD7F48B36AC588F675522329AF38C2F729D062BBBE0
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
- Size 24.1MB
- SHA256 1096b4380efd7a42c26152c04d16b7fa5c23411cb3e6d702f09e14b09d25462c
- MD5 8adb95a38f4535e6421154e955fa0b2f
- SHA1 83a60089ce5c795987de0cc228ebea5846c8e3db
- SHA512 63d735bb55b4aaa1664077eb03d2c0c631ef59e2d6903125834a08debe70ae31f9b7271cc49c1cac9d66c61fe584b18d247620289f96af10179fe07f7e376430
- SSDEEP 24576:Pu8m+1zwdoO/vvTLrWceJG64dl0zEVMiwKmNeTtlU06tuLlBovVFk6XRp:c
- TLSH T14647E42436F92110E7F79E3CA8F16A234D3A7D5B8C159E8D05411B4E0962FB1E872F6B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\Volume{20c84cf9-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{eff51bf2-b129-4178-8850-30d439d69099}_OnDiskSnapshotProp
- Size 6KB
- SHA256 4cf5950b5cf71f4bfdf6074987d0a58bc57a3d6ecc99b494119593afa88c40f5
- MD5 658f017b0de18041a7cb187338a7c638
- SHA1 c6f8bd4784a704f1dadb14d506d5e35a563d4e08
- SHA512 cb62afc98aba82d1f6dd91f4706c34762316ea2e57f483d5839bfdd3d0f8456d665763e78a85fb2c85ef31b2d4908638f60cb2ad0b153b000f12914933dc63a8
- SSDEEP 96:Fe38ScAg5vc8DD84LTHzbOHXOHBlBRQ88Sc9XE56tOSVQpuN:M38rb++ZVmN
- TLSH T175D1790C5AE54711E2B3AB7129F18557A877B911EF33CB8E0298238E2671910F935F6F
- MD5 SHA1 SHA512 SSDEEP TLSH