Introduction

The investigation began with a Microsoft Defender for Endpoint alert for suspicious screen capture activity involving PowerShell. Examining the process ancestry revealed a larger execution chain involving FbtRYX8x.exe, a renamed Node.js runtime communicating with several public Ethereum RPC providers. The observed behavior was consistent with EtherRAT, a Node.js-based backdoor previously documented by Atos Threat Research Center, The DFIR Report, and Malwarebytes.

Further hunting identified the same malware on four managed endpoints, all of which had received a malicious MSI through Microsoft Intune. The deployment itself was not the result of an identified compromise of Intune. Instead, the customer had imported what appeared to be a legitimate Advanced IP Scanner installer into its existing software distribution workflow, inadvertently deploying the malware to multiple systems.

Retracing activity on the earliest affected endpoint led to a Bing search for “advanced ip scanner msi” and a GitHub repository impersonating the software vendor. The repository was no longer available during the investigation, but browser artefacts preserved evidence of the visit. This Field Note examines the relationship between the initial software lure, the malicious MSI, and the legitimate Intune deployment process that subsequently distributed the payload.

Scoping the Infection

Analysis of the execution chain identified an obfuscated PowerShell script staged in a randomized directory under %LOCALAPPDATA%. In the initial case, the script was executed from C:\Users\username\AppData\Local\WwajyG9wqS3U\aWhXKGlA.ps1 and handled the preparation of the Node.js runtime used by the subsequent malware stage. It first checked for an existing Node.js installation and, if none was available, retrieved a legitimate Node.js distribution from the official website. The downloaded archive was extracted into the staging directory before the runtime was launched with DdkExG1tIy.ini as an argument (obfuscated JavaScript - the .ini extension is solely to blend in, but is executed by node.exe).

Hunting for related activity identified four affected systems with a similar execution chain, including the same payload filename and connections to public Ethereum RPC providers. Three endpoints used identical copies of a downloaded Node.js runtime, whereas the fourth reused an existing installation by copying C:\Program Files\nodejs\node.exe to C:\Program Files\nodejs\FbtRYX8x.exe. Consequently, the executable hash differed on the fourth system despite the otherwise consistent execution behavior, illustrating why hunting exclusively for the hash of the renamed runtime would have missed part of the infection.

The malware repeatedly contacted several public Ethereum RPC providers over TCP/443:

• eth.merkle[.]io
• rpc.mevblocker[.]io
• eth-mainnet.public.blastapi[.]io
• eth.drpc[.]org
• mainnet.gateway.tenderly[.]co
• ethereum-rpc.publicnode[.]com
• rpc.flashbots[.]net

Intune as an Unintentional Distribution Mechanism

Examining the MSI installation process ancestry revealed that the affected endpoints had received the package through the Windows MDM application deployment mechanism rather than through independent user execution. Defender telemetry showed msiexec.exe being launched through MDMAppInstaller.exe and omadmclient.exe, using the expected silent MSI installation switches to install the package without user interaction.

The MSI was associated with ProductCode {6FB2BB4F-67D5-4B13-8829-001C1E5E05DF}. Local installation metadata contained an apparently randomized display name (9FAj2kCcNs) and publisher (nAQUEdLa), with version 7.5.12.0. Querying the Intune application inventory revealed an application registered as Advanced IP Scanner with the same ProductCode and version, connecting the suspicious endpoint installation to a package managed through Intune.

Connect-MgGraph -Scopes "DeviceManagementApps.Read.All"

Get-MgDeviceAppManagementMobileApp -All |
    Where-Object {
        $_.AdditionalProperties['@odata.type'] -eq
        '#microsoft.graph.windowsMobileMSI'
    } |
    Select-Object DisplayName, @{
        Name = 'ProductCode'
        Expression = { $_.AdditionalProperties['productCode'] }
    }, @{
        Name = 'Version'
        Expression = { $_.AdditionalProperties['productVersion'] }
    }

Name                ProductCode                            Version
----                -----------                            -------
Advanced IP Scanner {6FB2BB4F-67D5-4B13-8829-001C1E5E05DF} 7.5.12.0

Reviewing the installations across the four affected systems showed that the package had been distributed over approximately one month. The customer confirmed that the MSI had been imported into Intune as an apparently legitimate Advanced IP Scanner installer and subsequently assigned to managed devices. Rather than requiring every affected user to encounter the original malicious download, the attacker-controlled installer had entered an existing administrative deployment process, which then distributed the malware to additional endpoints.

Tracing the Initial Download

To understand how the malicious installer entered the software deployment process, we examined browser artefacts from the earliest affected endpoint. Five days before the first known malicious installation through Intune, Chromium history records showed a Bing search for advanced ip scanner msi, followed by visits to https://github.com/AdvancedIPScanner/download. The repository presented itself as a distribution point for Advanced IP Scanner and advertised MSI-based enterprise deployment.

The repository had been removed by the time of the investigation, preventing us from examining the originally advertised installer. However, the retained browser history confirmed that the user had visited a repository impersonating Advanced IP Scanner five days before the first known malicious Intune installation. While this sequence provides a plausible explanation for how the MSI entered the environment, we could not conclusively determine whether the original download matched the package subsequently deployed through Intune.

Post-Compromise Activity

Following execution, Defender telemetry showed the malware collecting information about the local system, including the Windows locale, installed antivirus products, GPU information, domain membership, Machine GUID, and available logical disks. Additional commands such as net session and net use were observed, indicating attempts to enumerate accessible sessions and network resources.

On one endpoint, the execution chain also invoked PowerShell to capture the contents of the primary display. The script used the .NET System.Windows.Forms and System.Drawing assemblies to copy the screen into a bitmap, encode the resulting PNG image as Base64, and write it to %LOCALAPPDATA%\Temp\ss_1790589100185.txt. This activity corresponded to the suspicious screen capture behavior that triggered the original Microsoft Defender for Endpoint alert.

Add-Type -AssemblyName System.Windows.Forms
Add-Type -AssemblyName System.Drawing

$bounds = [System.Windows.Forms.Screen]::PrimaryScreen.Bounds

$bitmap = New-Object System.Drawing.Bitmap(
    $bounds.Width,
    $bounds.Height
)

$graphics = [System.Drawing.Graphics]::FromImage($bitmap)

$graphics.CopyFromScreen(
    $bounds.Location,
    [System.Drawing.Point]::Empty,
    $bounds.Size
)

$ms = New-Object System.IO.MemoryStream

$bitmap.Save(
    $ms,
    [System.Drawing.Imaging.ImageFormat]::Png
)

$base64 = [Convert]::ToBase64String(
    $ms.ToArray()
)

[System.IO.File]::WriteAllText(
    'C:\Users\username\AppData\Local\Temp\ss_1790589100185.txt',
    $base64
)

$graphics.Dispose()
$bitmap.Dispose()
$ms.Dispose()

A Second Malicious Advanced IP Scanner Repository

During the investigation, we identified another GitHub repository impersonating Advanced IP Scanner and distributing a malicious MSI installer.

The repository impersonated Advanced IP Scanner, referenced the legitimate vendor website, and advertised version 2.5.4594.1, including an MSI installer named Advanced_IP_Scanner_2.5.4594.1.msi. Its README described familiar functionality such as network discovery, Wake-on-LAN, and remote desktop access, while also emphasizing enterprise deployment. Together, these details made the repository appear to be a plausible distribution source for administrators looking for an MSI version of the software.

The supplied MSI from this repository had SHA-256: 48ce8681167128a8cd84b6befd98b94d97c00a4f4868a3dbdfc01c44d887e49f

The subsequent chain again involved a legitimate Node.js runtime and JavaScript execution. The same GitHub account also hosted several other repositories impersonating software utilities, suggesting that the Advanced IP Scanner lure was not an isolated project. However, we did not independently verify whether those repositories distributed malicious content.

Correlation with EtherRAT

The observed execution chain shares several characteristics with previously documented EtherRAT campaigns. In April 2026, Atos Threat Research Center published an analysis of an operation targeting administrators and other technical users through search-engine poisoning and GitHub repositories impersonating legitimate software. The campaign used repositories advertising common administrative utilities to distribute malicious MSI installers, which subsequently staged Node.js-based malware.

One of EtherRAT’s distinguishing characteristics is its use of Ethereum smart contracts as a dead-drop mechanism for retrieving C2 configuration. Rather than relying on a static C2 address embedded in the payload, the malware queries public Ethereum RPC services to obtain its current configuration. The repeated connections to Ethereum RPC providers observed across the affected endpoints were consistent with this behavior, although the network destinations alone were insufficient to conclusively identify the malware family.

Malwarebytes documented a related EtherRAT loader in June 2026 that searched for an existing Node.js installation and downloaded the runtime from the legitimate distribution site when necessary. This behavior closely resembled the installation chain observed in our case, including the reuse of an existing Node.js runtime on one endpoint and the subsequent execution of malicious JavaScript.

The Advanced IP Scanner lure also fits the broader targeting pattern described by Atos, which included impersonation of administrative utilities such as PsExec, AzCopy, Sysmon, LAPS, and Kusto Explorer. Advanced IP Scanner was not among the tools listed in that publication, making its appearance in this investigation a useful additional example of the technique.

Conclusion

This investigation illustrates how a malicious software installer can move beyond the original user who encountered it when introduced into a legitimate enterprise deployment workflow. The customer had imported an MSI impersonating Advanced IP Scanner into Intune and subsequently distributed it to four managed endpoints, resulting in repeated execution of a Node.js-based malware chain consistent with EtherRAT. The available evidence did not indicate that Intune itself had been compromised; the distribution occurred through an authorized software deployment process.

Browser artefacts from the earliest affected endpoint showed that a user had searched for an Advanced IP Scanner MSI and visited a suspicious GitHub repository five days before the first known malicious Intune installation. Although the repository was no longer available and the original download could not be conclusively linked to the later Intune package, the sequence provides a plausible explanation for how the installer entered the environment.

From a forensic perspective, the most significant finding was the correlation between endpoint installation artefacts and the application inventory in Intune. The MSI ProductCode, MDM installation process ancestry, and deployment history allowed us to trace infections on several endpoints back to a common administrative deployment. The case also demonstrates why searching exclusively for malware executable hashes can produce incomplete results when the payload uses legitimate runtimes that may differ between systems.

Field Notes: Short blog posts about interesting techniques we encounter in the wild.