Overview

overview

7

Static

static

1

node-v24.21.0-x64.msi

windows10-2004-x64

7

node-v24.21.0-x64.msi

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    148s
  • max time network
    127s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    25/09/2026, 05:19

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    node-v24.21.0-x64.msi
  • Size 31.7MB
  • Sample260925-fzybastthy
  • SHA256 bb0eaee134f9357f22aea915ee793343e627aefc1e66488164bac6915bce2cac
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discoveryexecutionpersistenceprivilege_escalationransomware

Malware Config

Signatures

  • Loads dropped DLL 8 IoCs
  • Badlisted process makes network request 1 IoCs

    Network request originating from process or tool commonly abused by malware.

  • Enumerates connected drives 3 TTPs 46 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 19 IoCs
  • Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
    persistenceprivilege_escalation
  • Executes a command shell one-liner 1 TTPs 1 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 5 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 3 IoCs
  • Modifies registry class 29 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 7 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Windows\system32\msiexec.exe
    msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\node-v24.21.0-x64.msi
    1⤵
    • Badlisted process makes network request
    • Enumerates connected drives
    • Event Triggered Execution: Installer Packages
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    PID:2956
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Enumerates connected drives
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Modifies data under HKEY_USERS
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:5596
    • C:\Windows\System32\MsiExec.exe
      C:\Windows\System32\MsiExec.exe -Embedding C3D079CB313A79CB439D8B154BC3D9BC C
      2⤵
      • Loads dropped DLL
      • Suspicious use of SetWindowsHookEx
      PID:2264
    • C:\Windows\system32\srtasks.exe
      C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
      2⤵
        PID:4924
      • C:\Windows\System32\MsiExec.exe
        C:\Windows\System32\MsiExec.exe -Embedding 1B41661358CF7763A38359AF2F8D6720
        2⤵
        • Loads dropped DLL
        • Suspicious use of SetWindowsHookEx
        PID:868
      • C:\Windows\System32\MsiExec.exe
        C:\Windows\System32\MsiExec.exe -Embedding 799479BD2E17F94F7FC39578B225616E E Global\MSI0000
        2⤵
        • Loads dropped DLL
        • Suspicious use of SetWindowsHookEx
        PID:948
      • C:\Windows\syswow64\MsiExec.exe
        C:\Windows\syswow64\MsiExec.exe -Embedding 238634DBFA888EAD0F1EC2C96548F233
        2⤵
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:4776
      • C:\Windows\syswow64\MsiExec.exe
        C:\Windows\syswow64\MsiExec.exe -Embedding 0A83CE76AF7C86451B0E2519115BBE2C C
        2⤵
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:3648
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c ""C:\Program Files\nodejs\install_tools.bat" "
          3⤵
          • Executes a command shell one-liner
          • System Location Discovery: System Language Discovery
          PID:1240
    • C:\Windows\system32\vssvc.exe
      C:\Windows\system32\vssvc.exe
      1⤵
      • Checks SCSI registry key(s)
      PID:6068

    Network

          MITRE ATT&CK Enterprise v16

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          e5a27dd.rbs
          • Path C:\Config.Msi\e5a27dd.rbs
          • Size 812KB
          • SHA256 5f526ac462df95b79191d150b17e461685d11abc9ef734d253df0cc69b11f240
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          install_tools.bat
          • Path C:\Program Files\nodejs\install_tools.bat
          • Size 3KB
          • SHA256 56b0737b893d96c09bbf64acd701e73d01438f0acec81e63c9588d303cf083b4
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          LICENSE
          • Path C:\Program Files\nodejs\node_modules\npm\node_modules\@sigstore\tuf\LICENSE
          • Size 11KB
          • SHA256 7b0ce3425a26fdba501cb13508af096ade77e4036dd2bd8849031ddecf64f7c9
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          shared.types.js
          • Path C:\Program Files\nodejs\node_modules\npm\node_modules\@sigstore\verify\dist\shared.types.js
          • Size 79B
          • SHA256 ef1f170ad28f2d870a474d2f96ae353d770fff5f20e642cd8f9b6f1d7742df13
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          LICENSE
          • Path C:\Program Files\nodejs\node_modules\npm\node_modules\bin-links\LICENSE
          • Size 754B
          • SHA256 45e433413760dc3ae8169be5ed9c2c77adc31ad4d1bc5a28939576df240f29a0
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          package.json
          • Path C:\Program Files\nodejs\node_modules\npm\node_modules\common-ancestor-path\dist\commonjs\package.json
          • Size 28B
          • SHA256 58b55392b5778941e1e96892a70edc12e2d7bb8541289b237fbddc9926ed51bd
          • MD5 SHA1 SHA512
          Submit Download

          package.json
          • Path C:\Program Files\nodejs\node_modules\npm\node_modules\common-ancestor-path\dist\esm\package.json
          • Size 26B
          • SHA256 1bf0e53fc74b05f1aade7451fbac72f1944b067d4229d96bae7a225519a250e4
          • MD5 SHA1 SHA512
          Submit Download

          LICENSE
          • Path C:\Program Files\nodejs\node_modules\npm\node_modules\json-stringify-nice\LICENSE
          • Size 780B
          • SHA256 3f24d692d165989cd9a00fe35ca15a2bc6859e3361fa42aa20babd435f2e4706
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          LICENSE
          • Path C:\Program Files\nodejs\node_modules\npm\node_modules\libnpmsearch\LICENSE
          • Size 730B
          • SHA256 2ef361317adeda98117f14c5110182c28eae233af1f7050c83d4396961d14013
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          LICENSE.md
          • Path C:\Program Files\nodejs\node_modules\npm\node_modules\minipass-flush\LICENSE.md
          • Size 1KB
          • SHA256 865576de51d520f97c8869b9b9f96caf8efd69b82bb6e575fc00b0964dc7a3ca
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          LICENSE.md
          • Path C:\Program Files\nodejs\node_modules\npm\node_modules\npm-profile\LICENSE.md
          • Size 818B
          • SHA256 733dcbf5b1c95dc765b76db969b998ce0cbb26f01be2e55e7bccd6c7af29cb04
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          LICENSE
          • Path C:\Program Files\nodejs\node_modules\npm\node_modules\promzard\LICENSE
          • Size 763B
          • SHA256 1fccd0ad2e7e0e31ddfadeaf0660d7318947b425324645aa85afd7227cab52d7
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          Node.js documentation.url
          • Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Node.js\Node.js documentation.url
          • Size 168B
          • SHA256 3fe978eba4eb049a6f1c0502cc408a5f448ce789a8089ba5fa96ab9b3b64d686
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          MSI330C.tmp
          • Path C:\Users\Admin\AppData\Local\Temp\MSI330C.tmp
          • Size 142KB
          • SHA256 aacc35644b370c8b9a91284c4da38df0c3fb247eb0b683033d3ef7b724972ffa
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          MSI3436.tmp
          • Path C:\Users\Admin\AppData\Local\Temp\MSI3436.tmp
          • Size 390KB
          • SHA256 6ad2dc761ef5e3f2048148e390cf314c3a2a47c75be57917eb0b66783424bf8b
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          MSI76DC.tmp
          • Path C:\Windows\Installer\MSI76DC.tmp
          • Size 342KB
          • SHA256 69cdc445cd2b1ade4074853f11c8a229c7501e176b5b113b47ac18c5564148b6
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          e5a27dc.msi
          • Path C:\Windows\Installer\e5a27dc.msi
          • Size 31.7MB
          • SHA256 bb0eaee134f9357f22aea915ee793343e627aefc1e66488164bac6915bce2cac
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          metadata-2
          • Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
          • Size 26.1MB
          • SHA256 3c1f4075018716441c9aeb8909fb6cb2e5c8bb69339bc8cd12edae366878c8c9
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          {c013728e-329b-49a2-8c35-bf544050b68f}_OnDiskSnapshotProp
          • Path \??\Volume{e42a0d43-0000-0000-0000-d08302000000}\System Volume Information\SPP\OnlineMetadataCache\{c013728e-329b-49a2-8c35-bf544050b68f}_OnDiskSnapshotProp
          • Size 6KB
          • SHA256 f45bd389ff46fd74b62e1eab2612295bbb066e0029b1a627b4f2410cf6cdb6ae
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          memory/5596-30-0x0000025455060000-0x0000025455A04000-memory.dmp
          Download