Overview

overview

6

Static

static

1

ffdec_26.3.0.msi

windows10-2004-x64

6

Analysis

  • user interaction
    yes
  • max time kernel
    38s
  • max time network
    40s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260911-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    11/10/2026, 03:40

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    ffdec_26.3.0.msi
  • Size 19.7MB
  • Sample261011-d8cd3sdv5m
  • SHA256 dc21e84df77daa9aaa6c4a4a3e92cfa949907abc59533371e5cf8d8195bcf983
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
persistenceprivilege_escalationransomware

Malware Config

Signatures

  • Badlisted process makes network request 5 IoCs

    Network request originating from process or tool commonly abused by malware.

  • Enumerates connected drives 3 TTPs 46 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 10 IoCs
  • Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
    persistenceprivilege_escalation
  • Checks SCSI registry key(s) 3 TTPs 5 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 3 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of WriteProcessMemory 1 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Windows\system32\msiexec.exe
    msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\ffdec_26.3.0.msi
    1⤵
    • Badlisted process makes network request
    • Enumerates connected drives
    • Event Triggered Execution: Installer Packages
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    PID:2128
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Enumerates connected drives
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Modifies data under HKEY_USERS
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3016
    • C:\Windows\system32\srtasks.exe
      C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:4504
  • C:\Windows\system32\vssvc.exe
    C:\Windows\system32\vssvc.exe
    1⤵
    • Checks SCSI registry key(s)
    • Suspicious use of AdjustPrivilegeToken
    PID:1468

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        e5905e3.rbs
        • Path C:\Config.Msi\e5905e3.rbs
        • Size 35KB
        • SHA256 0b72a8628e522d41941a4c855bd2bc5dc97cfe0e56558ea01835f984e6c4110f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ffdec.exe
        • Path C:\Program Files (x86)\FFDec\ffdec.exe
        • Size 396KB
        • SHA256 f016b6df147bb42767782e297239bda0f1b6fe6a6a70e214244f45266f02fc3b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        18E6B4A57A6BC7EC9B861CDF2D6D0D02_C3B142D2C5374581DC2FDFFDEDBDEDDB
        • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\18E6B4A57A6BC7EC9B861CDF2D6D0D02_C3B142D2C5374581DC2FDFFDEDBDEDDB
        • Size 765B
        • SHA256 9338c592de13d9d8fe92458e540aff1a9a0f403e9b144f180ac9e071639fb5e4
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        AEACCDA8653DD8D7B2EA32F21D15D44F_689B70E36BEC6030B08141A97F423D80
        • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\AEACCDA8653DD8D7B2EA32F21D15D44F_689B70E36BEC6030B08141A97F423D80
        • Size 637B
        • SHA256 535c95841f7eee565036ae3779eebe7121843c11dcaf76cca82e0411ca2026d2
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        B2FAF7692FD9FFBD64EDE317E42334BA_93702E680A5530C052C8D2BA33A2225F
        • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B2FAF7692FD9FFBD64EDE317E42334BA_93702E680A5530C052C8D2BA33A2225F
        • Size 1KB
        • SHA256 86a0791785508dffa81faa9db1feb70e4c078669a7f1b94f82843db529009060
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        18E6B4A57A6BC7EC9B861CDF2D6D0D02_C3B142D2C5374581DC2FDFFDEDBDEDDB
        • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\18E6B4A57A6BC7EC9B861CDF2D6D0D02_C3B142D2C5374581DC2FDFFDEDBDEDDB
        • Size 484B
        • SHA256 840018da36af0cfcf8f7a7a629d980dab9f685519686a827b2052377dc75a15d
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        AEACCDA8653DD8D7B2EA32F21D15D44F_689B70E36BEC6030B08141A97F423D80
        • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\AEACCDA8653DD8D7B2EA32F21D15D44F_689B70E36BEC6030B08141A97F423D80
        • Size 492B
        • SHA256 f34399c028022839787e4d59d6dd980ecebdb3dee7af58843b0248a29317be63
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        B2FAF7692FD9FFBD64EDE317E42334BA_93702E680A5530C052C8D2BA33A2225F
        • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_93702E680A5530C052C8D2BA33A2225F
        • Size 482B
        • SHA256 594e948454a7aca002274613ca616f6441ebafb09b4a050da8b8dce0cc46bd61
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        e5905e4.msi
        • Path C:\Windows\Installer\e5905e4.msi
        • Size 19.7MB
        • SHA256 dc21e84df77daa9aaa6c4a4a3e92cfa949907abc59533371e5cf8d8195bcf983
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        metadata-2
        • Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
        • Size 24.1MB
        • SHA256 c61bb04eec83fb06cf3bfa4d5ed1e5c3ae9b3611d999783a231b86a9390d2e52
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        {01ae751c-66b6-43de-96a0-97ef8ef77e2f}_OnDiskSnapshotProp
        • Path \??\Volume{c4d211c3-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{01ae751c-66b6-43de-96a0-97ef8ef77e2f}_OnDiskSnapshotProp
        • Size 6KB
        • SHA256 0b5dc4960c2b2fae9e8e758c3152000abcd18cd3b7d86bfccdd493d47dcb50d7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download