Analysis
- max time kernel
149s - max time network
149s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
30/07/2026, 23:15
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
cds.msi
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
cds.msi
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
12 signatures
150 seconds
General
- Target cds.msi
- Size 2.2MB
- Sample260730-28ndcastbv
- SHA256 86f1e8695d3e2acc6fddf1655899b9bd7df5b0245f7dd76b4c23fe44e16af757
- MD5 3b7b4914af002e560bad848b271cf915
- SHA1 a4c882631a995ef57968e0cde5c26e7be1a242d6
- SHA512 c6e208d50e7156877caefecb16c679c83e7b91191921ecab65ea0fb133f2dbc0bf65e77566154def4a65ec9034a60f940f5e84584878799d5c4bd68374131cc0
- SSDEEP 49152:BQPTPd3wpqPq9nM/jzoM7T871UEHzopHeU47fkR9LeFZ:BQPjtw4PknkzLEJTzHb4Lez
- TLSH T1F9B533523B6C21E1EA08467059FA03E4D63CBD88B7CBAD42E755F35C563DCBD62B09A0
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\Y: msiexec.exe - Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
pid Process 2824 MSBuild.exe - Drops file in Windows directory 8 IoCs
description ioc Process File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\Installer\e587b94.msi msiexec.exe File opened for modification C:\Windows\Installer\e587b94.msi msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File created C:\Windows\Installer\SourceHash{C87FAACC-A4FA-470F-9252-62F7C6EE1FBE} msiexec.exe File opened for modification C:\Windows\Installer\MSI7C6E.tmp msiexec.exe File created C:\Windows\Installer\e587b96.msi msiexec.exe - Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
pid Process 4408 msiexec.exe - Executes a command shell one-liner 1 TTPs 2 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 1248 cmd.exe 3384 cmd.exe - Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000aea20acdcfb7d9ac0000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000aea20acd0000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed35000000ffffffff000000000700010000680900aea20acd000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff350000000000000005000000ffffffff000000000700010000f8ff1aaea20acd000000000000f0ff350000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1daea20acd000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 408 msiexec.exe 408 msiexec.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 4408 msiexec.exe Token: SeIncreaseQuotaPrivilege 4408 msiexec.exe Token: SeSecurityPrivilege 408 msiexec.exe Token: SeCreateTokenPrivilege 4408 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 4408 msiexec.exe Token: SeLockMemoryPrivilege 4408 msiexec.exe Token: SeIncreaseQuotaPrivilege 4408 msiexec.exe Token: SeMachineAccountPrivilege 4408 msiexec.exe Token: SeTcbPrivilege 4408 msiexec.exe Token: SeSecurityPrivilege 4408 msiexec.exe Token: SeTakeOwnershipPrivilege 4408 msiexec.exe Token: SeLoadDriverPrivilege 4408 msiexec.exe Token: SeSystemProfilePrivilege 4408 msiexec.exe Token: SeSystemtimePrivilege 4408 msiexec.exe Token: SeProfSingleProcessPrivilege 4408 msiexec.exe Token: SeIncBasePriorityPrivilege 4408 msiexec.exe Token: SeCreatePagefilePrivilege 4408 msiexec.exe Token: SeCreatePermanentPrivilege 4408 msiexec.exe Token: SeBackupPrivilege 4408 msiexec.exe Token: SeRestorePrivilege 4408 msiexec.exe Token: SeShutdownPrivilege 4408 msiexec.exe Token: SeDebugPrivilege 4408 msiexec.exe Token: SeAuditPrivilege 4408 msiexec.exe Token: SeSystemEnvironmentPrivilege 4408 msiexec.exe Token: SeChangeNotifyPrivilege 4408 msiexec.exe Token: SeRemoteShutdownPrivilege 4408 msiexec.exe Token: SeUndockPrivilege 4408 msiexec.exe Token: SeSyncAgentPrivilege 4408 msiexec.exe Token: SeEnableDelegationPrivilege 4408 msiexec.exe Token: SeManageVolumePrivilege 4408 msiexec.exe Token: SeImpersonatePrivilege 4408 msiexec.exe Token: SeCreateGlobalPrivilege 4408 msiexec.exe Token: SeBackupPrivilege 1984 vssvc.exe Token: SeRestorePrivilege 1984 vssvc.exe Token: SeAuditPrivilege 1984 vssvc.exe Token: SeBackupPrivilege 408 msiexec.exe Token: SeRestorePrivilege 408 msiexec.exe Token: SeRestorePrivilege 408 msiexec.exe Token: SeTakeOwnershipPrivilege 408 msiexec.exe Token: SeRestorePrivilege 408 msiexec.exe Token: SeTakeOwnershipPrivilege 408 msiexec.exe Token: SeRestorePrivilege 408 msiexec.exe Token: SeTakeOwnershipPrivilege 408 msiexec.exe Token: SeRestorePrivilege 408 msiexec.exe Token: SeTakeOwnershipPrivilege 408 msiexec.exe Token: SeRestorePrivilege 408 msiexec.exe Token: SeTakeOwnershipPrivilege 408 msiexec.exe Token: SeRestorePrivilege 408 msiexec.exe Token: SeTakeOwnershipPrivilege 408 msiexec.exe Token: SeRestorePrivilege 408 msiexec.exe Token: SeTakeOwnershipPrivilege 408 msiexec.exe Token: SeRestorePrivilege 408 msiexec.exe Token: SeTakeOwnershipPrivilege 408 msiexec.exe Token: SeRestorePrivilege 408 msiexec.exe Token: SeTakeOwnershipPrivilege 408 msiexec.exe Token: SeRestorePrivilege 408 msiexec.exe Token: SeTakeOwnershipPrivilege 408 msiexec.exe Token: SeRestorePrivilege 408 msiexec.exe Token: SeTakeOwnershipPrivilege 408 msiexec.exe Token: SeRestorePrivilege 408 msiexec.exe Token: SeTakeOwnershipPrivilege 408 msiexec.exe Token: SeRestorePrivilege 408 msiexec.exe Token: SeTakeOwnershipPrivilege 408 msiexec.exe Token: SeRestorePrivilege 408 msiexec.exe - Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 4408 msiexec.exe 4408 msiexec.exe - Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 408 wrote to memory of 5032 408 msiexec.exe 91 PID 408 wrote to memory of 1248 408 msiexec.exe 93 PID 1248 wrote to memory of 2404 1248 cmd.exe 95 PID 1248 wrote to memory of 5104 1248 cmd.exe 96 PID 5104 wrote to memory of 3384 5104 conhost.exe 97 PID 3384 wrote to memory of 2824 3384 cmd.exe 98 - Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\cds.msi1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4408
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:408 -
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵PID:5032
-
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /d /s /c ""C:\Users\Admin\AppData\Local\Broadcom\NetLink Helper\bootstrap_3201.cmd""2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1248 -
C:\Windows\system32\where.exewhere conhost.exe3⤵PID:2404
-
-
C:\Windows\System32\conhost.exe"C:\Windows\System32\conhost.exe" --headless cmd.exe /c "C:\Users\Admin\AppData\Local\Broadcom\NetLink Helper\bootstrap_3201.cmd" /launched3⤵
- Suspicious use of WriteProcessMemory
PID:5104 -
C:\Windows\System32\cmd.execmd.exe /c "C:\Users\Admin\AppData\Local\Broadcom\NetLink Helper\bootstrap_3201.cmd" /launched4⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3384 -
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe" "C:\Users\Admin\AppData\Local\Broadcom\NetLink Helper\NewtonsoftJson.csproj" /nologo /v:q5⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:2824
-
-
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:1984
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Config.Msi\e587b95.rbs
- Size 9KB
- SHA256 a6311f9a7c1ced5e99575d441142d4772eda4cc58aac3a79e10fc5fc7b3e846c
- MD5 36f1fed3884cab8d5489e5c652b6fac6
- SHA1 f044bc583cdbdb645b0c3ab7f4cc4b77d874d16c
- SHA512 68eb54f72b18c45348cf16ddaec7b459d6ac8473448289133e2fb86cf66eaacd0fc0273b5a87c47dbc7809ff6971d80deb3b4c83521f3ed2319768e796e471eb
- SSDEEP 96:McDklEmleVguEr4f2Lw40E8ReGbWbCkYLbUw6I1CsThquYLbUw6I1C6jVbjb5ZT7:Mmmy5ZRe4k3iIIT3iIwnVeORph
- TLSH T188228543255499E6EC681FB6B6136B103366E3E9C726338F008DC2188F52BD9AF5A5D3
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Broadcom\NetLink Helper\Internal.props
- Size 262KB
- SHA256 4952eee846ffdc2935359dd58a50388187e31686e7c39baa4e323cbec04c8bae
- MD5 fb1029b3b5fe711b0929c11b77f95c8d
- SHA1 bffc250f45d58dc22a4944bfc4509e39d4d627d7
- SHA512 65107a3d097ed31c4027f4b1059a2ff2a76fce8d048fece6e207a258de62b357831d7eddc612f5ffd75a4ea90345ba31e7797d91a5e140fdc08399e6f4e08830
- SSDEEP 1536:wznGYte/p4xwRdHDxKXakoDpMlKvZhY+h/zu9Jr9EGKrkmAX4Yi/b4CEN28SDzb4:c5te+4tB3ImAoJTjDSTKfC
- TLSH T14C4477746AED0265E6C7C82A2ABCBE7111B334D7EAD62915035CE5201F7CE773F09A09
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Broadcom\NetLink Helper\NewtonsoftJson.Internal.targets
- Size 535KB
- SHA256 4044d32f895e13f0877a1942a90dc18946f6cbfca98bdbd1e34545db09daf059
- MD5 65c6c5a6fd963b21540216607b1ce927
- SHA1 47c83f19373136b96ed1edc19338cc801261166a
- SHA512 fd11ac720eb20811aef206b2c648e9a1fedae1d0f9d4e19e664cfdd962d31c4413e2755d5c5ab16380803dee872489c2a43e01be301af0c6c6b098b0588355d9
- SSDEEP 3072:cDNUMXTaQHsv1eFhlSAFytyFEKp+zLtYGYA:4UMXTawsv1eF+AFytyFEKp+zLh5
- TLSH T1EAC400A8A98FA4F4F57F812066ED7D994472318783C62DA4A77CF40057E6BC63E284CD
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Broadcom\NetLink Helper\NewtonsoftJson.csproj
- Size 8.5MB
- SHA256 cd905db480bac6aa4826877a5359a5e31d26b4fc5767ac8943bdd6c010b7aa45
- MD5 393269b16b2b910668178ebfbea1df06
- SHA1 73f106255b1b37864f53662968f9f1dd54d2e7d4
- SHA512 4679789b05dd225317abe37f4d82f3a9f37ebfc762c4827eb7777ba88b7c91bafaaeff37d9632721b0767d13df3c80b16b77bff63b0a116c6b822d76bcc010ad
- SSDEEP 1536:8yYQt/j61YlwkhZgdOpF9tbBOYEZMTduXMcUHHa0YWsA//mZ/tFq13QlbeJioCDZ:k
- TLSH T16796CD7B078047BBF3D40BC0855A255E26F9E5A5B534309AAB7368EFBC2E9D74038643
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Broadcom\NetLink Helper\NewtonsoftJson.csproj.user
- Size 637KB
- SHA256 233a1a9345ee97a03a314692fa69c97ae32d7177f20cd4d4caafa6797cdfb983
- MD5 25af2849b8b9df249e84eb428896f311
- SHA1 4ddbb5b3ee7b40581e7d597714a51d58fccd1548
- SHA512 c98b137c4dead1d49e60b27c1aa8b0366a1eaae01878c81da5a1d41e97390bbdb726dfd19bdd7addbc187d0994a1e53ca377733366801564223d014601113f26
- SSDEEP 6144:WxcIroowouME05XeWqj9wz9CMQC3FOz5Ym16HwyDr4xIBFY5KcwU71E06MjSn:z0/KxIBZz
- TLSH T147D4AFF4D4EF10B5E247CD002ABCBE6445B271C7EBCA756823AEE7558F68B662B0404D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Broadcom\NetLink Helper\bootstrap_3201.cmd
- Size 1KB
- SHA256 bd01632b8beb86954cedb4414a3a8c36e71ef4e6580e229554f7aaec653bc3ef
- MD5 62b176883d716d3e8c5b69886c4bc07f
- SHA1 5f8fb3b814407a913b46664a6bfe71263fc61877
- SHA512 b1919307d98d458bd31a95c836dd562b7a02f2ccbe520e2244ac7be48e7f854dbe2463fa40f3934a385300b8313f0ee81a183dde168c9ee598725682e05d324b
- TLSH T13A212996B022452D94B437BA4B354733630E72C37984F5ACB1A4C89D74CF52EBAB12D4
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\Installer\e587b94.msi
- Size 2.2MB
- SHA256 86f1e8695d3e2acc6fddf1655899b9bd7df5b0245f7dd76b4c23fe44e16af757
- MD5 3b7b4914af002e560bad848b271cf915
- SHA1 a4c882631a995ef57968e0cde5c26e7be1a242d6
- SHA512 c6e208d50e7156877caefecb16c679c83e7b91191921ecab65ea0fb133f2dbc0bf65e77566154def4a65ec9034a60f940f5e84584878799d5c4bd68374131cc0
- SSDEEP 49152:BQPTPd3wpqPq9nM/jzoM7T871UEHzopHeU47fkR9LeFZ:BQPjtw4PknkzLEJTzHb4Lez
- TLSH T1F9B533523B6C21E1EA08467059FA03E4D63CBD88B7CBAD42E755F35C563DCBD62B09A0
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
- Size 24.1MB
- SHA256 22950d21ef1553d4a268f9471cef8d70993378e7efdad2a552ca73f9b4467544
- MD5 567db1c1f72760e6391027f9c3971ec2
- SHA1 3f65b051036c3e188f3b1d5ce03f4f899db200d0
- SHA512 cb3fc7e1754e6477fd3cd9e0bbd23691c912e2b5373917d3770f07b8527f135efc93de02ba32d5049f8b8a04c4694d5c74af836942d1ff8b42ca7fd3b7680c2f
- SSDEEP 24576:Pu8m+1zBdoO/vvTLLWceJma49F0zEVsCwqmteTtlUU6tOrFhov1Fk63Rp:t
- TLSH T1D447C22836F92200F7F79E3D68F46A274D3A7D5B9C159E8D05811B4E0921FB0E872F5A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\Volume{cd0aa2ae-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{fef45454-912e-4bb2-bc88-36fc0f0c9fe2}_OnDiskSnapshotProp
- Size 6KB
- SHA256 75157e4ba48eb33fb6ddb8e78ae24d3f36f5c7703e1791938c04c40717a749f7
- MD5 6e84e17b9951e63beb3810d9b261f116
- SHA1 46e94482de14f7fc0e428b9cb0a5279cd6708d09
- SHA512 179b4e712aeb1409f2bef51575ba64adf2d7ce486846c2157fe1c125c4081211fe66bfa7e3663a03f038abfd489b902640f9a4e1e9efb0f16181f70368a7ed56
- SSDEEP 96:FqBDPclsnvc8DD84LTHzbOHXOHBlBRQ88Sc9XE56tOSVQpu:qDBb++ZVm
- TLSH T16CD18A085AF54311E2B3AB7128F54557A877B911EF33CB8E0298238E6670914F935F5F
- MD5 SHA1 SHA512 SSDEEP TLSH