Analysis
- user interaction
yes - max time kernel
29s - max time network
47s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
22/07/2026, 22:10
Static task
static1
Behavioral task
behavioral1
Sample
ffdec_26.2.1.msi
Resource
win10v2004-20260513-en
windows10-2004-x64
13 signatures
150 seconds
Behavioral task
behavioral2
Sample
ffdec_26.2.1.msi
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
9 signatures
150 seconds
General
- Target ffdec_26.2.1.msi
- Size 19.7MB
- Sample260722-13phsawbnf
- SHA256 95c86739ff4d56dc96344687c3eb7056c76637f614f83d28fdffad29b53cade1
- MD5 84596b0c5d3f1f14679dfd799cf36823
- SHA1 60558282730064ee6066fbf6571088a6129a89c6
- SHA512 426d969a60eae74818c23f998fbe2405ad32aee753009d74f0b994d6f19cd58696e60a876d6b23c30833ccdc6c3f454bf413d719e2973a0cd7fa5f16200aa41e
- SSDEEP 393216:frbTesM8zfOv1v6/YtpIP5WmgdGe2uYSJ1Z6YBvBaL6eEkjZq6:fH0S2Vtpt9F2uXLnaxv
- TLSH T156273393FC75C6ADE81D0A30C197DBAE4E215C44C6B4064E5188FA1A39B3F53A36F58E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
Malware Config
Signatures
- Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\D: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\D: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\W: msiexec.exe - Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\Installer\e598b7d.msi msiexec.exe File opened for modification C:\Windows\Installer\e598b7d.msi msiexec.exe - Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
pid Process 4672 msiexec.exe - Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 00000000040000005b2aeec40121f1360000000000000000000000000000000000000000000000000000000000000000000000000000000000001071020000000000c01200000000000000000000000027010100008838015b2aeec40000000000001071020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d0830200000000006025c501000000000000000000000700010000e841015b2aeec4000000000000d08302000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9c701000000000000050000000000000000000000070001000098d4e35b2aeec400000000000030a9c7010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9cc0100000000000005000000000000000000000007000100009854e65b2aeec400000000000030a9cc01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe - Suspicious use of AdjustPrivilegeToken 39 IoCs
description pid Process Token: SeShutdownPrivilege 4672 msiexec.exe Token: SeIncreaseQuotaPrivilege 4672 msiexec.exe Token: SeSecurityPrivilege 5140 msiexec.exe Token: SeCreateTokenPrivilege 4672 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 4672 msiexec.exe Token: SeLockMemoryPrivilege 4672 msiexec.exe Token: SeIncreaseQuotaPrivilege 4672 msiexec.exe Token: SeMachineAccountPrivilege 4672 msiexec.exe Token: SeTcbPrivilege 4672 msiexec.exe Token: SeSecurityPrivilege 4672 msiexec.exe Token: SeTakeOwnershipPrivilege 4672 msiexec.exe Token: SeLoadDriverPrivilege 4672 msiexec.exe Token: SeSystemProfilePrivilege 4672 msiexec.exe Token: SeSystemtimePrivilege 4672 msiexec.exe Token: SeProfSingleProcessPrivilege 4672 msiexec.exe Token: SeIncBasePriorityPrivilege 4672 msiexec.exe Token: SeCreatePagefilePrivilege 4672 msiexec.exe Token: SeCreatePermanentPrivilege 4672 msiexec.exe Token: SeBackupPrivilege 4672 msiexec.exe Token: SeRestorePrivilege 4672 msiexec.exe Token: SeShutdownPrivilege 4672 msiexec.exe Token: SeDebugPrivilege 4672 msiexec.exe Token: SeAuditPrivilege 4672 msiexec.exe Token: SeSystemEnvironmentPrivilege 4672 msiexec.exe Token: SeChangeNotifyPrivilege 4672 msiexec.exe Token: SeRemoteShutdownPrivilege 4672 msiexec.exe Token: SeUndockPrivilege 4672 msiexec.exe Token: SeSyncAgentPrivilege 4672 msiexec.exe Token: SeEnableDelegationPrivilege 4672 msiexec.exe Token: SeManageVolumePrivilege 4672 msiexec.exe Token: SeImpersonatePrivilege 4672 msiexec.exe Token: SeCreateGlobalPrivilege 4672 msiexec.exe Token: SeBackupPrivilege 3040 vssvc.exe Token: SeRestorePrivilege 3040 vssvc.exe Token: SeAuditPrivilege 3040 vssvc.exe Token: SeBackupPrivilege 5140 msiexec.exe Token: SeRestorePrivilege 5140 msiexec.exe Token: SeRestorePrivilege 5140 msiexec.exe Token: SeTakeOwnershipPrivilege 5140 msiexec.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 4672 msiexec.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4672 msiexec.exe 5140 msiexec.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 5140 wrote to memory of 5288 5140 msiexec.exe 94 - Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\ffdec_26.2.1.msi1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:4672
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5140 -
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵PID:5288
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:3040
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Config.Msi\e598b7e.rbs
- Size 35KB
- SHA256 e89f5126de0166ded777473d2cf9cc651e65b0e1f33a610b53b4a4fcfa4bfd3f
- MD5 49bf645dcd620b0be9867bcc5af9120a
- SHA1 74041414b9b2100930077cb6a098b05b74709566
- SHA512 963aadf9086d18fcb4e5db4d835b2231810eab299d974fe10adcda27ab7826792065fad9d4274d2e08dc9f22aa54f186883363fc41eb66a377f815a893cfc476
- SSDEEP 768:kpTM0ISsARTbX/ziYOYZXJ2Y1XJiYJXJmYhXJCYcbzUeHY:STt5
- TLSH T1FAF22E439E21CAC3F9831BB0D785EF0B372DCB65D3A2075B6048912689D1BD53ADDCA6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\FFDec\ffdec.exe
- Size 396KB
- SHA256 437902fdbd61d8ba2fc9b4012cb2078bb4fd55c4f36ee2133151764c7246710b
- MD5 a3577bba5ae537db3f4473ce35c27a6b
- SHA1 e0cf3946fa6f479d7f577534bae46b59e2acf076
- SHA512 68e0a94fd8ddadf951d24e54c0d668f9ccaff87ede0d16e4ed3822c61ed6069e925fc093d379982296a41f3df9c98239ada49043e4ed5c878bb0d325585819c5
- SSDEEP 6144:vtcYWrxXqPQniD+zDJrzzzzzlgPoGNKUEca1LeVVV4:aYi9qoniD+zDJrzzzzzle1EL1LebV4
- TLSH T11B843384542B48F7F112693DCA7EE7A62CA85FB02C1413EA2ACEBED1743CD4590E5C79
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\e598b7d.msi
- Size 19.7MB
- SHA256 95c86739ff4d56dc96344687c3eb7056c76637f614f83d28fdffad29b53cade1
- MD5 84596b0c5d3f1f14679dfd799cf36823
- SHA1 60558282730064ee6066fbf6571088a6129a89c6
- SHA512 426d969a60eae74818c23f998fbe2405ad32aee753009d74f0b994d6f19cd58696e60a876d6b23c30833ccdc6c3f454bf413d719e2973a0cd7fa5f16200aa41e
- SSDEEP 393216:frbTesM8zfOv1v6/YtpIP5WmgdGe2uYSJ1Z6YBvBaL6eEkjZq6:fH0S2Vtpt9F2uXLnaxv
- TLSH T156273393FC75C6ADE81D0A30C197DBAE4E215C44C6B4064E5188FA1A39B3F53A36F58E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
- Size 26.1MB
- SHA256 1bcd9ac622ab987ff40dfc78e7e008c60e63f572431f897b84128c1338d3665a
- MD5 4c6f914ffba041f0e34fce25e73d1236
- SHA1 f3548e5ba10e88cb9a12f2201ca5058262bac2cf
- SHA512 c42985e5c4d311bf41981b25ddfba85c8144ffe75e5faeb16786d0e2cda2124819b37c0ad1e298991ee0e70271ca7c559f166ef9f875cfaf8c59f720ad54b220
- SSDEEP 24576:lFo3DMPndoO/vvTL/yghRClw/LubKr2iEMHD9MvZHkP6pWQRsYx2RILAVep:HHA
- TLSH T15C57D12436F92210E7B79E7CB8F06A634D3A7D5B9C15DE8D05411B4E0822F71E872F6A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\Volume{c4ee2a5b-0000-0000-0000-d08302000000}\System Volume Information\SPP\OnlineMetadataCache\{4a85b781-8910-46d0-b1fe-3d9b57d2c5eb}_OnDiskSnapshotProp
- Size 6KB
- SHA256 c58086d804ca75bced51fe60136b2b5b73f205f8f1f0cb19d26762104832e517
- MD5 d27e27112485d8d61223a171040fc400
- SHA1 244c7d9ca16039850edb9f03a8b7b776372ead26
- SHA512 e915149f1049d170bf67c08094c14d7941d117916585280b7f65ea5ce9fd8cfabdcb24eb477800ccb6d2fb46161fe17d0f009b34d301221601d25565d82e7ea6
- SSDEEP 96:FCguKvc6DD84LTHzbOHXOHBlBRQn8Sc9XE56tOSVQpu:Q2b++uVm
- TLSH T1D8D177081AF54711E2B3AB722DF18557A877B911EF33CB8E0198238E6621910F935F6B
- MD5 SHA1 SHA512 SSDEEP TLSH