Analysis
- max time kernel
148s - max time network
154s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
19/07/2026, 23:47
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
c0ddf84e29374cd53ff4a44ff50e88e1b663fae404bc1a5200bbac38c8d1df36.msi
Resource
win10v2004-20260513-en
windows10-2004-x64
14 signatures
150 seconds
Behavioral task
behavioral2
Sample
c0ddf84e29374cd53ff4a44ff50e88e1b663fae404bc1a5200bbac38c8d1df36.msi
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
14 signatures
150 seconds
General
- Target c0ddf84e29374cd53ff4a44ff50e88e1b663fae404bc1a5200bbac38c8d1df36.msi
- Size 32KB
- Sample260719-3s2fpsbw21
- SHA256 c0ddf84e29374cd53ff4a44ff50e88e1b663fae404bc1a5200bbac38c8d1df36
- MD5 f771bacddb1ea53e4e04f73cdb5f799e
- SHA1 51105a9b8201817ec70ea1dba43f09fbfa5a8663
- SHA512 4f461543abd03eb650de9e930e13beeaa4ab862f71efc8494671f7f8034ab43305666ae7da8958b54bc2e7bf950915d8d5d9072ccb1e7882fefb4c4f324fe0ab
- SSDEEP 384:pWU4afig0dV2ePOYly3M5NEXagSoex5Pey3M5sC0x:lgf3PfWMdeWMmCU
- TLSH T1C3E2C61776449331C58657314A2FD7F48B36AC588F675522329AF38C2F729D062BBBE0
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Extracted
Language
-
ps1
Deobfuscated
Source
URLs
-
exe.dropper
https://nodejs.org/dist/v22.16.0/node-v22.16.0-win-x64.zip
-
exe.dropper
https://newfolder.click?cid=ca48856ee0083815
Signatures
- Badlisted process makes network request 3 IoCs
Network request originating from process or tool commonly abused by malware.
flow pid Process 7 4100 powershell.exe 8 4100 powershell.exe 9 4100 powershell.exe - Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell and hide display window.
pid Process 4100 powershell.exe - Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\D: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\D: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\I: msiexec.exe - Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs
pid Process 4084 wscript.exe - Drops file in Windows directory 12 IoCs
description ioc Process File created C:\Windows\Installer\e5a2e26.msi msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File created C:\Windows\SystemTemp\~DF64803DB04826C289.TMP msiexec.exe File created C:\Windows\Installer\SourceHash{B9B002B2-D53B-44B6-AFE8-45CE069F39A5} msiexec.exe File created C:\Windows\SystemTemp\~DFAEFFC46E9ED5F992.TMP msiexec.exe File opened for modification C:\Windows\Installer\MSI3385.tmp msiexec.exe File created C:\Windows\Installer\e5a2e28.msi msiexec.exe File opened for modification C:\Windows\Installer\e5a2e26.msi msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\SystemTemp\~DF8BA9E69234A569AF.TMP msiexec.exe File created C:\Windows\SystemTemp\~DFBDA58E3DC88AA365.TMP msiexec.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
pid Process 4832 msiexec.exe - Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000ad3b1fc6af0fc0350000000000000000000000000000000000000000000000000000000000000000000000000000000000001071020000000000c0120000000000000000000000002701010000883801ad3b1fc60000000000001071020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d0830200000000006025c501000000000000000000000700010000e84101ad3b1fc6000000000000d08302000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9c701000000000000050000000000000000000000070001000098d4e3ad3b1fc600000000000030a9c7010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9cc0100000000000005000000000000000000000007000100009854e6ad3b1fc600000000000030a9cc01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe - Suspicious behavior: EnumeratesProcesses 5 IoCs
pid Process 5544 msiexec.exe 5544 msiexec.exe 4100 powershell.exe 4100 powershell.exe 4100 powershell.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 4832 msiexec.exe Token: SeIncreaseQuotaPrivilege 4832 msiexec.exe Token: SeSecurityPrivilege 5544 msiexec.exe Token: SeCreateTokenPrivilege 4832 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 4832 msiexec.exe Token: SeLockMemoryPrivilege 4832 msiexec.exe Token: SeIncreaseQuotaPrivilege 4832 msiexec.exe Token: SeMachineAccountPrivilege 4832 msiexec.exe Token: SeTcbPrivilege 4832 msiexec.exe Token: SeSecurityPrivilege 4832 msiexec.exe Token: SeTakeOwnershipPrivilege 4832 msiexec.exe Token: SeLoadDriverPrivilege 4832 msiexec.exe Token: SeSystemProfilePrivilege 4832 msiexec.exe Token: SeSystemtimePrivilege 4832 msiexec.exe Token: SeProfSingleProcessPrivilege 4832 msiexec.exe Token: SeIncBasePriorityPrivilege 4832 msiexec.exe Token: SeCreatePagefilePrivilege 4832 msiexec.exe Token: SeCreatePermanentPrivilege 4832 msiexec.exe Token: SeBackupPrivilege 4832 msiexec.exe Token: SeRestorePrivilege 4832 msiexec.exe Token: SeShutdownPrivilege 4832 msiexec.exe Token: SeDebugPrivilege 4832 msiexec.exe Token: SeAuditPrivilege 4832 msiexec.exe Token: SeSystemEnvironmentPrivilege 4832 msiexec.exe Token: SeChangeNotifyPrivilege 4832 msiexec.exe Token: SeRemoteShutdownPrivilege 4832 msiexec.exe Token: SeUndockPrivilege 4832 msiexec.exe Token: SeSyncAgentPrivilege 4832 msiexec.exe Token: SeEnableDelegationPrivilege 4832 msiexec.exe Token: SeManageVolumePrivilege 4832 msiexec.exe Token: SeImpersonatePrivilege 4832 msiexec.exe Token: SeCreateGlobalPrivilege 4832 msiexec.exe Token: SeBackupPrivilege 1356 vssvc.exe Token: SeRestorePrivilege 1356 vssvc.exe Token: SeAuditPrivilege 1356 vssvc.exe Token: SeBackupPrivilege 5544 msiexec.exe Token: SeRestorePrivilege 5544 msiexec.exe Token: SeRestorePrivilege 5544 msiexec.exe Token: SeTakeOwnershipPrivilege 5544 msiexec.exe Token: SeRestorePrivilege 5544 msiexec.exe Token: SeTakeOwnershipPrivilege 5544 msiexec.exe Token: SeRestorePrivilege 5544 msiexec.exe Token: SeTakeOwnershipPrivilege 5544 msiexec.exe Token: SeRestorePrivilege 5544 msiexec.exe Token: SeTakeOwnershipPrivilege 5544 msiexec.exe Token: SeRestorePrivilege 5544 msiexec.exe Token: SeTakeOwnershipPrivilege 5544 msiexec.exe Token: SeRestorePrivilege 5544 msiexec.exe Token: SeTakeOwnershipPrivilege 5544 msiexec.exe Token: SeRestorePrivilege 5544 msiexec.exe Token: SeTakeOwnershipPrivilege 5544 msiexec.exe Token: SeRestorePrivilege 5544 msiexec.exe Token: SeTakeOwnershipPrivilege 5544 msiexec.exe Token: SeRestorePrivilege 5544 msiexec.exe Token: SeTakeOwnershipPrivilege 5544 msiexec.exe Token: SeRestorePrivilege 5544 msiexec.exe Token: SeTakeOwnershipPrivilege 5544 msiexec.exe Token: SeRestorePrivilege 5544 msiexec.exe Token: SeTakeOwnershipPrivilege 5544 msiexec.exe Token: SeRestorePrivilege 5544 msiexec.exe Token: SeTakeOwnershipPrivilege 5544 msiexec.exe Token: SeRestorePrivilege 5544 msiexec.exe Token: SeTakeOwnershipPrivilege 5544 msiexec.exe Token: SeRestorePrivilege 5544 msiexec.exe - Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 4832 msiexec.exe 4832 msiexec.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4832 msiexec.exe 5544 msiexec.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 5544 wrote to memory of 2232 5544 msiexec.exe 93 PID 5544 wrote to memory of 4084 5544 msiexec.exe 95 PID 4084 wrote to memory of 4100 4084 wscript.exe 96 - Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\c0ddf84e29374cd53ff4a44ff50e88e1b663fae404bc1a5200bbac38c8d1df36.msi1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:4832
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5544 -
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵PID:2232
-
-
C:\Windows\system32\wscript.exewscript.exe "helper.vbs"2⤵
- Executes a VBScript file via the Windows Script Host.
- Suspicious use of WriteProcessMemory
PID:4084 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -File "C:\Users\Admin\AppData\Local\empty\run-script.ps1"3⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:4100
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:1356
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Config.Msi\e5a2e27.rbs
- Size 8KB
- SHA256 2036584d9ece47042c5c3a10eed230abaa6e584e1176057ae4f8134e6cbe52e5
- MD5 0f9580f518307bdc01c7afafc2189704
- SHA1 50e10e890621647a323301817aaa8da62adb25e7
- SHA512 c8ea99c0d589d5e7e1544200ca9cebdfe803160b56139f91822c6918d953ebaddfc12e38dd93b900bef5daa0ec13be6241502e95a3c8ec7ee9e3ac537d1ec4b0
- SSDEEP 192:kkjCsW/O4OIP4OnUulnq4PHzl/CQVaVELpF7U+S3hYLUuw:kk14V4szg
- TLSH T1D5120E82B72584E6F8942B76C32747247BFAD3F78255331B4889C6344E17F8A9E990C3
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\empty\helper.vbs
- Size 683B
- SHA256 88ebed34ab9ff0e16dc32b789fc25295ea570f86244e89cb68803c517597cfdd
- MD5 e7d23ea2f97b4ad6673f0d64c3097205
- SHA1 7f8c32f7750a5c5b98c88ac18a1682fc7920da5a
- SHA512 710e177c05b8513e4ea8bbac111ca4b5a0466ea1517c0f048f632dd85e8a6a47e93fc75643c90c19cbacdb017578fc95980554afd37dd97e49bf24fb09e8c5b6
- TLSH T19801D331D83BC7A45B4BCD0E41F2CD3CE5165127111CE66979A4C99CBF14BB4CB5C6A8
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\empty\run-script.ps1
- Size 812B
- SHA256 d20e1d680171e813754399cf23e61dd637765e0b59c088cc2b3ceceb44d8d3f8
- MD5 d7a4361434f0ff08b799889bf2b7574e
- SHA1 8cdde07119c56b93daa89d3dffa59b4f130f1c65
- SHA512 09468fd363ae3e55b9fa49121b350e7404d8eec7e81cc0c74fe5f233782256cf4fc9ed96dabb66296e4612e80c00960fc9d616de902e37520dde99a09ae4fe2f
- TLSH T12701B16721600330DD21CB7D8AC390BC919784FE18446D9972AD0AD56DB63F01BEBB68
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\Installer\e5a2e26.msi
- Size 32KB
- SHA256 c0ddf84e29374cd53ff4a44ff50e88e1b663fae404bc1a5200bbac38c8d1df36
- MD5 f771bacddb1ea53e4e04f73cdb5f799e
- SHA1 51105a9b8201817ec70ea1dba43f09fbfa5a8663
- SHA512 4f461543abd03eb650de9e930e13beeaa4ab862f71efc8494671f7f8034ab43305666ae7da8958b54bc2e7bf950915d8d5d9072ccb1e7882fefb4c4f324fe0ab
- SSDEEP 384:pWU4afig0dV2ePOYly3M5NEXagSoex5Pey3M5sC0x:lgf3PfWMdeWMmCU
- TLSH T1C3E2C61776449331C58657314A2FD7F48B36AC588F675522329AF38C2F729D062BBBE0
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
- Size 26.1MB
- SHA256 f1f27ec5f827241826ff84fca48765ea10f06002af590f2e77ab3c87943db36e
- MD5 a51ee136ba730d28159d57c69d590a5b
- SHA1 079e9fda17dc5d722ef2fc82054c797ae5306112
- SHA512 1091c89044542e945cd2c7b5c922026cf61cdf77a22bda8cdff97a862564d118a23698d8688b27686bd4a09ccca136ae53a5b46bc30bb6118d8d142803992dcd
- SSDEEP 24576:SFo3DMPjdoO/vvTL/Sg88iFQvrumHb7P0BKudxSUKpyKpb9cMoRWclmd4+S:UHU
- TLSH T17457B42436F92200E7F79E3DA8F06A234D397D5BAC15DE8D45511B4E0822F71E872F6A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\Volume{c61f3bad-0000-0000-0000-d08302000000}\System Volume Information\SPP\OnlineMetadataCache\{99e00c14-f73f-4d4e-b4f0-0ac97283783f}_OnDiskSnapshotProp
- Size 6KB
- SHA256 2486e838811911bc60acce25a035451d54fcc5ea544b636b913636aa12f777af
- MD5 68090c8512f00c44a56237a6f57f7ac6
- SHA1 bf67e2f74c4aff7fe5c6794974f6ea6aa39cff0f
- SHA512 5841a597d11030ea03d3b60a2bc02f3afe7efc64ce2a463e7a131755de960fbaf45d6b42c304f5ebe667e147c9033df2fa322be13ac5ad4b3fd0bb841cd598f0
- SSDEEP 96:FBNS7SCvc6DD84LTHzbOHXOHBlBRQn8Sc9XE56tOSVQpuN:DNXeb++uVmN
- TLSH T15ED178185AE54711E2B3AB3229F14557A837B811EF33CB8E0198238E2631A10F935F6F
- MD5 SHA1 SHA512 SSDEEP TLSH