Extracted

• • Target
    node-v24.18.1-x64.msi
  • Size 31.4MB
  • SHA256 af4a0651a26f04ac240f00fec872f305547ca2aa56301c41dfd63a29eb2ab836
  • MD5 0bc2e654f47640564fbe23df0251fccd
  • SHA1 784060b258e09171710734d4dc49c3be074df807
  • SHA512 25c19bbd14fe5a45d9a70218c27b658e435a81b69553d876e1e1135bb054002dd5352b08f6d5dd9e0254ad5c88fd40f8c153ccc38e3b7f78f32e1a8c912bd126
  • SSDEEP 786432:MbwKCwvRc6JqUpIU+xPeuW1ZpW2c5OI7f6uIKa+mWT3B:wwKZRrpJYeDNc5OI7fVTaCT
  • TLSH
    T1F6773323B7D20932D6EA4132E0B39711AE3A7D142320499F9775A55CFE312F066FBB46
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutionpersistenceprivilege_escalationransomwarespywaretrojan

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Event Triggered Execution: Image File Execution Options Injection

    persistence

  • Event Triggered Execution: Component Object Model Hijacking

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory

  behavioral1