Overview

overview

7

Static

static

3

next.exe

windows10-2004-x64

7

next.exe

windows11-21h2-x64

7

Analysis

  • user interaction
    yes
  • max time kernel
    149s
  • max time network
    113s
  • platform
    windows11-21h2_x64
  • resource
    win11-20260513-en
  • resource tags

    arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
  • submitted
    04/08/2026, 18:57

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    next.exe
  • Size 47.4MB
  • Sample260804-xmervscl9v
  • SHA256 142c0cb75ea666873aa17b93543c8696071f19da87f41d462618f770b708c3a7
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discoveryinstallerpersistenceransomware

Malware Config

Signatures

  • Executes dropped EXE 8 IoCs
  • Loads dropped DLL 3 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Badlisted process makes network request 1 IoCs

    Network request originating from process or tool commonly abused by malware.

  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Enumerates connected drives 3 TTPs 23 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory 51 IoCs
  • Drops file in Program Files directory 62 IoCs
  • Drops file in Windows directory 23 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 12 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Inno Setup is an open-source installation builder for Windows applications. 3 IoCs

    Inno Setup installer

    installer
  • Checks SCSI registry key(s) 3 TTPs 5 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 9 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 10 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 10 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\next.exe
    "C:\Users\Admin\AppData\Local\Temp\next.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:1028
    • C:\Users\Admin\AppData\Local\Temp\is-TYNK2LZH0O.tmp\next.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-TYNK2LZH0O.tmp\next.tmp" /SL5="$600EA,48262374,842240,C:\Users\Admin\AppData\Local\Temp\next.exe"
      2⤵
      • Executes dropped EXE
      • Drops file in Program Files directory
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2492
      • C:\Users\Admin\AppData\Local\Temp\is-DNV7GPTILW.tmp\vc_redist.x64.exe
        "C:\Users\Admin\AppData\Local\Temp\is-DNV7GPTILW.tmp\vc_redist.x64.exe" /install /quiet /norestart
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:3596
        • C:\Windows\Temp\{7EDF3946-7523-49FB-BE52-F3544D72E21F}\.cr\vc_redist.x64.exe
          "C:\Windows\Temp\{7EDF3946-7523-49FB-BE52-F3544D72E21F}\.cr\vc_redist.x64.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\is-DNV7GPTILW.tmp\vc_redist.x64.exe" -burn.filehandle.attached=732 -burn.filehandle.self=736 /install /quiet /norestart
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:3600
          • C:\Windows\Temp\{4303296D-B416-43B6-87B2-66A2F1BDF671}\.be\VC_redist.x64.exe
            "C:\Windows\Temp\{4303296D-B416-43B6-87B2-66A2F1BDF671}\.be\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{B8FB9FFB-53F7-42B2-A1AE-4CB3AB10F997} {AD2BCAA3-861F-4B1E-B6B5-AAEF73B2930D} 3600
            5⤵
            • Executes dropped EXE
            • Adds Run key to start application
            • System Location Discovery: System Language Discovery
            • Modifies registry class
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:4860
            • C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe
              "C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -uninstall -quiet -burn.related.upgrade -burn.ancestors={c157798c-9519-4e56-98d9-f696f78f4a61} -burn.filehandle.self=1088 -burn.embedded BurnPipe.{A8EBC6B2-64DD-4E5B-AEAC-96868D76AA60} {A62DF09B-C7FF-45B3-84D3-976BCA7AF9F1} 4860
              6⤵
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:4340
              • C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe
                "C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -burn.clean.room="C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -burn.filehandle.attached=544 -burn.filehandle.self=560 -uninstall -quiet -burn.related.upgrade -burn.ancestors={c157798c-9519-4e56-98d9-f696f78f4a61} -burn.filehandle.self=1088 -burn.embedded BurnPipe.{A8EBC6B2-64DD-4E5B-AEAC-96868D76AA60} {A62DF09B-C7FF-45B3-84D3-976BCA7AF9F1} 4860
                7⤵
                • Loads dropped DLL
                • System Location Discovery: System Language Discovery
                • Suspicious use of WriteProcessMemory
                PID:1976
                • C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe
                  "C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{85843914-74F1-488E-86C4-B1F9E9AC2636} {289BCD0D-1D34-41AA-ACDA-BE17A12ABF3B} 1976
                  8⤵
                  • System Location Discovery: System Language Discovery
                  • Modifies registry class
                  PID:1148
  • C:\Windows\system32\vssvc.exe
    C:\Windows\system32\vssvc.exe
    1⤵
    • Checks SCSI registry key(s)
    • Suspicious use of AdjustPrivilegeToken
    PID:4400
  • C:\Windows\system32\srtasks.exe
    C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
    1⤵
      PID:1952
    • C:\Windows\system32\msiexec.exe
      C:\Windows\system32\msiexec.exe /V
      1⤵
      • Badlisted process makes network request
      • Enumerates connected drives
      • Drops file in System32 directory
      • Drops file in Windows directory
      • Modifies data under HKEY_USERS
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4780
    • C:\ProgramData\Package Cache\{c157798c-9519-4e56-98d9-f696f78f4a61}\VC_redist.x64.exe
      "C:\ProgramData\Package Cache\{c157798c-9519-4e56-98d9-f696f78f4a61}\VC_redist.x64.exe" /burn.runonce
      1⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:1208
      • C:\ProgramData\Package Cache\{c157798c-9519-4e56-98d9-f696f78f4a61}\VC_redist.x64.exe
        "C:\ProgramData\Package Cache\{c157798c-9519-4e56-98d9-f696f78f4a61}\VC_redist.x64.exe" /quiet /norestart /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260804195835.log" /install
        2⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:4060
        • C:\ProgramData\Package Cache\{c157798c-9519-4e56-98d9-f696f78f4a61}\VC_redist.x64.exe
          "C:\ProgramData\Package Cache\{c157798c-9519-4e56-98d9-f696f78f4a61}\VC_redist.x64.exe" -burn.clean.room="C:\ProgramData\Package Cache\{c157798c-9519-4e56-98d9-f696f78f4a61}\VC_redist.x64.exe" -burn.filehandle.attached=548 -burn.filehandle.self=564 /quiet /norestart /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260804195835.log" /install
          3⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:2356
          • C:\ProgramData\Package Cache\{c157798c-9519-4e56-98d9-f696f78f4a61}\VC_redist.x64.exe
            "C:\ProgramData\Package Cache\{c157798c-9519-4e56-98d9-f696f78f4a61}\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{7D495BCF-A41F-4387-A524-B30975FEAF24} {751E9C9B-FDBB-48EA-B842-D8CE8E8AD74B} 2356
            4⤵
            • Executes dropped EXE
            • Adds Run key to start application
            • System Location Discovery: System Language Discovery
            • Modifies registry class
            PID:3900

    Network

          MITRE ATT&CK Enterprise v16

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          e586726.rbs
          • Path C:\Config.Msi\e586726.rbs
          • Size 19KB
          • SHA256 d5e8041f8c2343a3d738a3d4a3cb173774dcca5ae931c81f928eaa4f4a89d928
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          e586732.rbs
          • Path C:\Config.Msi\e586732.rbs
          • Size 19KB
          • SHA256 9779461d77319baf7424becb75b528b1eac1d8d174cae85f0041623f65654fdf
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          e586739.rbs
          • Path C:\Config.Msi\e586739.rbs
          • Size 21KB
          • SHA256 6c2c4b98802d77f230541062b2e5e31f366a1035418ea388b1d53acdb8d0367e
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          e586748.rbs
          • Path C:\Config.Msi\e586748.rbs
          • Size 21KB
          • SHA256 b0dcd8fdf9ef83bdcb159f78d3afc7c5bc01169d72bb1d557f71c44093dbc17e
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          next.exe
          • Path C:\Program Files\NEXT+\next.exe
          • Size 740KB
          • SHA256 afce87c6572db86c50479983560e9aeb6fb516afc1f67b08447c997183ea1195
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          state.rsm
          • Path C:\ProgramData\Package Cache\{c157798c-9519-4e56-98d9-f696f78f4a61}\state.rsm
          • Size 992B
          • SHA256 6bb18efb73061cd13b31b0d3a6853093dada5bf57a82149ea333aa894c544ab3
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          dd_vcredist_amd64_20260804195835.log
          • Path C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260804195835.log
          • Size 12KB
          • SHA256 67a4fd9a45e13749c10ebd3e5b294e6d2dfb32b65557ebc824b52944585fe4c3
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          dd_vcredist_amd64_20260804195835_000_vcRuntimeMinimum_x64.log
          • Path C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260804195835_000_vcRuntimeMinimum_x64.log
          • Size 4KB
          • SHA256 1483660b82ce7c56921a40b59960f2920effbdcfbd814f60e7bbf5de72da2229
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          dd_vcredist_amd64_20260804195835_001_vcRuntimeAdditional_x64.log
          • Path C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260804195835_001_vcRuntimeAdditional_x64.log
          • Size 2KB
          • SHA256 7d01491f02cc35c0acbccedb22a553fb39970b3027fdab8d0dd2082baeeb0e9b
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          vc_redist.x64.exe
          • Path C:\Users\Admin\AppData\Local\Temp\is-DNV7GPTILW.tmp\vc_redist.x64.exe
          • Size 17.9MB
          • SHA256 90e48ade404e4576d023abfa374f323555f233982a8805ea9ac63dca9491a16b
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          next.tmp
          • Path C:\Users\Admin\AppData\Local\Temp\is-TYNK2LZH0O.tmp\next.tmp
          • Size 4.7MB
          • SHA256 bb2c9ced8fa7e12d6961b3f7f66bf982cf46b5dee5282b046f47d7cabdbfe74a
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          logo.png
          • Path C:\Windows\Temp\{4303296D-B416-43B6-87B2-66A2F1BDF671}\.ba\logo.png
          • Size 1KB
          • SHA256 335a256d4779ec5dcf283d007fb56fd8211bbcaf47dcd70fe60ded6a112744ef
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          wixstdba.dll
          • Path C:\Windows\Temp\{4303296D-B416-43B6-87B2-66A2F1BDF671}\.ba\wixstdba.dll
          • Size 215KB
          • SHA256 e921f69b9fb4b5ad4691809d06896c5f1d655ab75e0ce94a372319c243c56d4e
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          cab2C04DDC374BD96EB5C8EB8208F2C7C92
          • Path C:\Windows\Temp\{4303296D-B416-43B6-87B2-66A2F1BDF671}\cab2C04DDC374BD96EB5C8EB8208F2C7C92
          • Size 5.4MB
          • SHA256 718a88535f7bc81804646088ac4bfe70a888ed45fd0c130bc625ff9eaddd47c0
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          cab5046A8AB272BF37297BB7928664C9503
          • Path C:\Windows\Temp\{4303296D-B416-43B6-87B2-66A2F1BDF671}\cab5046A8AB272BF37297BB7928664C9503
          • Size 1.0MB
          • SHA256 99fda37db1ad396ca1049cf83e3ea5cb60c7aae315f4b94efc599c26bd54839b
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          vcRuntimeAdditional_x64
          • Path C:\Windows\Temp\{4303296D-B416-43B6-87B2-66A2F1BDF671}\vcRuntimeAdditional_x64
          • Size 208KB
          • SHA256 26d8f51e4683411633d7c45999fa948f33322b5728f06ff2242df06f0c63e695
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          vcRuntimeMinimum_x64
          • Path C:\Windows\Temp\{4303296D-B416-43B6-87B2-66A2F1BDF671}\vcRuntimeMinimum_x64
          • Size 208KB
          • SHA256 96ce3adfe6955fa343aeb5d1bdfe3a7c3936de75d0df74147074e4899f27f42f
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          vc_redist.x64.exe
          • Path C:\Windows\Temp\{7EDF3946-7523-49FB-BE52-F3544D72E21F}\.cr\vc_redist.x64.exe
          • Size 669KB
          • SHA256 7cdf942ae5869c0ee2fcc94db84c4999eb0b97801b291e74f61ebb8fe3925905
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          license.rtf
          • Path C:\Windows\Temp\{B07734B0-6EB7-49F5-A628-161954A24A20}\.ba\license.rtf
          • Size 9KB
          • SHA256 8099dc3cf9502c335da829e5c755948a12e3e6de490eb492a99deb673d883d8b
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          thm.wxl
          • Path C:\Windows\Temp\{B07734B0-6EB7-49F5-A628-161954A24A20}\.ba\thm.wxl
          • Size 2KB
          • SHA256 70400f181d00e1769774ff36bcd8b1ab5fbc431418067d31b876d18cc04ef4ce
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          thm.xml
          • Path C:\Windows\Temp\{B07734B0-6EB7-49F5-A628-161954A24A20}\.ba\thm.xml
          • Size 8KB
          • SHA256 f13bae0ec08c91b4a315bb2d86ee48fade597e7a5440dce6f751f98a3a4d6916
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          wixstdba.dll
          • Path C:\Windows\Temp\{B07734B0-6EB7-49F5-A628-161954A24A20}\.ba\wixstdba.dll
          • Size 191KB
          • SHA256 a4efbdb2ce55788ffe92a244cb775efd475526ef5b61ad78de2bcdfaddac7041
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          memory/1028-0-0x00000000004D0000-0x00000000005AC000-memory.dmp
          Download

          memory/1028-388-0x00000000004D0000-0x00000000005AC000-memory.dmp
          Download

          memory/1028-7-0x00000000004D0000-0x00000000005AC000-memory.dmp
          Download

          memory/1148-339-0x0000000000770000-0x00000000007E7000-memory.dmp
          Download

          memory/1952-364-0x000001BC47FB0000-0x000001BC4821E000-memory.dmp
          Download

          memory/1976-341-0x0000000000770000-0x00000000007E7000-memory.dmp
          Download

          memory/2492-366-0x00000000004A0000-0x0000000000986000-memory.dmp
          Download

          memory/2492-8-0x00000000004A0000-0x0000000000986000-memory.dmp
          Download

          memory/2492-160-0x00000000004A0000-0x0000000000986000-memory.dmp
          Download

          memory/2492-9-0x00000000011E0000-0x00000000011E1000-memory.dmp
          Download

          memory/2492-347-0x00000000004A0000-0x0000000000986000-memory.dmp
          Download

          memory/2492-5-0x00000000011E0000-0x00000000011E1000-memory.dmp
          Download

          memory/2492-387-0x00000000004A0000-0x0000000000986000-memory.dmp
          Download

          memory/4340-342-0x0000000000770000-0x00000000007E7000-memory.dmp
          Download

          memory/4400-360-0x00000187F6620000-0x00000187F688E000-memory.dmp
          Download

          memory/4400-173-0x00000187F6620000-0x00000187F688E000-memory.dmp
          Download