Overview

overview

6

Static

static

1

ffdec_26.2.1.msi

windows10-2004-x64

6

ffdec_26.2.1.msi

windows11-ltsc_2024-x64

6

Analysis

  • user interaction
    yes
  • max time kernel
    60s
  • max time network
    63s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    22/07/2026, 22:10

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    ffdec_26.2.1.msi
  • Size 19.7MB
  • Sample260722-13phsawbnf
  • SHA256 95c86739ff4d56dc96344687c3eb7056c76637f614f83d28fdffad29b53cade1
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
persistenceprivilege_escalationransomware

Malware Config

Signatures

  • Badlisted process makes network request 13 IoCs

    Network request originating from process or tool commonly abused by malware.

  • Enumerates connected drives 3 TTPs 46 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 10 IoCs
  • Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
    persistenceprivilege_escalation
  • Checks SCSI registry key(s) 3 TTPs 5 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 3 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of WriteProcessMemory 1 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Windows\system32\msiexec.exe
    msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\ffdec_26.2.1.msi
    1⤵
    • Badlisted process makes network request
    • Enumerates connected drives
    • Event Triggered Execution: Installer Packages
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    PID:4704
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Enumerates connected drives
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Modifies data under HKEY_USERS
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1084
    • C:\Windows\system32\srtasks.exe
      C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:1180
  • C:\Windows\system32\vssvc.exe
    C:\Windows\system32\vssvc.exe
    1⤵
    • Checks SCSI registry key(s)
    • Suspicious use of AdjustPrivilegeToken
    PID:1192

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        e58fac7.rbs
        • Path C:\Config.Msi\e58fac7.rbs
        • Size 35KB
        • SHA256 6f3185cc9c7ef280ae535a61ad088ecc8a786e5807eab22581993ee64f442a5f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ffdec.exe
        • Path C:\Program Files (x86)\FFDec\ffdec.exe
        • Size 396KB
        • SHA256 437902fdbd61d8ba2fc9b4012cb2078bb4fd55c4f36ee2133151764c7246710b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        18E6B4A57A6BC7EC9B861CDF2D6D0D02_C3B142D2C5374581DC2FDFFDEDBDEDDB
        • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\18E6B4A57A6BC7EC9B861CDF2D6D0D02_C3B142D2C5374581DC2FDFFDEDBDEDDB
        • Size 765B
        • SHA256 b27981fd05a03470321b38933214514036b9826061c99346fdd3a9087e095e65
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        43B41D246473AA455DCC6019A9AF9545
        • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\43B41D246473AA455DCC6019A9AF9545
        • Size 96KB
        • SHA256 e79f658db4c58b0eb5f778e53906965d0818ffbd5792ca14cd63c27445e388f5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        572BF21E454637C9F000BE1AF9B1E1A9
        • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\572BF21E454637C9F000BE1AF9B1E1A9
        • Size 1007B
        • SHA256 591a56b13040a1da5a964543273bb65ad3123d2f8869fbe5480d4471f1313f16
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        18E6B4A57A6BC7EC9B861CDF2D6D0D02_C3B142D2C5374581DC2FDFFDEDBDEDDB
        • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\18E6B4A57A6BC7EC9B861CDF2D6D0D02_C3B142D2C5374581DC2FDFFDEDBDEDDB
        • Size 484B
        • SHA256 282d439a8c5a14adc8802bcc3fc293efcd266d61739df8661487c878c63d12c1
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        43B41D246473AA455DCC6019A9AF9545
        • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\43B41D246473AA455DCC6019A9AF9545
        • Size 316B
        • SHA256 71e1860b4c7c5e5eef04d42ae6afb728af01ed4dad69c1d615180a95c1a8ebfe
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        572BF21E454637C9F000BE1AF9B1E1A9
        • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\572BF21E454637C9F000BE1AF9B1E1A9
        • Size 304B
        • SHA256 130595d5185a6c6dfa3bd7f3c61714f0d9b002007af59c4e7f7c320ec92a0d29
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        e58fac6.msi
        • Path C:\Windows\Installer\e58fac6.msi
        • Size 19.7MB
        • SHA256 95c86739ff4d56dc96344687c3eb7056c76637f614f83d28fdffad29b53cade1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        metadata-2
        • Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
        • Size 24.1MB
        • SHA256 7cb6d197f5de99bd4bcc75910e9cc4c1210461a214eb84186d0f97411d7567a9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        {d0d642b3-4218-4576-8eee-3848069f220a}_OnDiskSnapshotProp
        • Path \??\Volume{20c84cf9-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{d0d642b3-4218-4576-8eee-3848069f220a}_OnDiskSnapshotProp
        • Size 6KB
        • SHA256 b6358c4e5b026d2328e093f198b4a80e25b6eac6854daacf627216ff0d78f57e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download