Analysis
-
max time kernel
1192s -
max time network
1193s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
11-10-2024 01:48
Static task
static1
Behavioral task
behavioral1
Sample
nvinstall.msi
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral2
Sample
nvinstall.msi
Resource
win11-20240802-en
windows11-21h2-x64
General
-
Target
nvinstall.msi
-
Size
4.5MB
-
MD5
bc9f159c780f8092641faa7cb0ba81a1
-
SHA1
66d338e045b58295de3657fa0ea1f491435837e1
-
SHA256
0ab5b3e9790aa8ada1bbadd5d22908b5ba7b9f078e8f5b4e8fcc27cc0011cce7
-
SHA512
2bfcf7684eb5698d1a6d76aabf79a0b4c918891000fdf15cd6ded1a244e2487fbe7de302f7794b9a0651e34a742808e0553c5613e2972e503513ad91bb442c44
-
SSDEEP
98304:kkufFmgXZDBMPnafxyZN5znYFSk0VGWfVlwsfpnm:kkpEZDByEojnYFSHLwsf
Malware Config
Extracted
bumblebee
msi
-
dga
tvx1ovdepj8.life
acgr6r8zdot.life
ilofx941igp.life
8x2apo5m7ri.life
x9yrzer0ndt.life
93j4v4jopzd.life
ameagxzo2f7.life
nyy41uibsv5.life
ru4jvijdytq.life
l9t6r0y6cvi.life
f4vb9n3tdvh.life
9do3mcejztt.life
pxu1ajsdhqr.life
7exy2b231n2.life
vu5b47m18jn.life
6mnudp7zj73.life
p5047yjrb8q.life
d0xtxp89bb9.life
ygo9u1fkwux.life
fig3gj0v6qe.life
38f5wvwwn7o.life
txgogs9p8a1.life
uyn0icgx1kv.life
2z1ls31az7s.life
0cc2z8zrnhf.life
fsr2hskx44p.life
du19ek78tjw.life
234ct3lkozp.life
he8fq4k8d3w.life
7ewh8ltr7il.life
dw34kmgfl7t.life
f2j20ayqh8y.life
331k2rdkmmb.life
37z6li6l9y2.life
dpgs2lt1sbz.life
plll0xq4y82.life
bzc9sq2pz53.life
7r8ln1wswth.life
y9neib92f2m.life
m5iukps17y7.life
xo8be64ejh2.life
widn8soih8u.life
08mkuqnx6gv.life
lzeqr3apopn.life
o4m5a5no7e8.life
2u8znzsbrto.life
dxyob8x456a.life
lrugnff8fkc.life
38i6lh0rpze.life
mjb3r6mcs1f.life
vl41cymzzfq.life
qc4mwjiop45.life
z3z4fq0420z.life
0tab35o0swu.life
4izk0gc9is6.life
6brdh3p893b.life
736d0mvetjw.life
drmk5rdefb5.life
1v0xhie4os8.life
khxcp22s3dz.life
8z9m8hndrhp.life
xeoz1f1vjs0.life
lobavyclh8e.life
in4pzu7t2pv.life
j280b59doxz.life
6q894zusd4k.life
y7pzxau0717.life
bev8ymaajb7.life
glux8x5b8d6.life
yan95akxgqt.life
9qiliikd3sp.life
ge0lpqif3ar.life
ar7xakeve0o.life
eb4l6wisq9z.life
1grovn87c8s.life
wdga570b8pz.life
nzs8vi9w5o8.life
q7dfpyyhe08.life
exueqqmz3ia.life
65r8nx12fqr.life
vauy5ah65sx.life
8hjv8mbhrlj.life
eeqwg3mzq07.life
b1h0uaabzyz.life
8qvt5iabz5n.life
8ru044xed25.life
w8ligr695sd.life
3e6rrifr5fn.life
9f6p9g7x13s.life
ibcm5at6qrz.life
spd22scperm.life
4k59ij2ujeu.life
07zxfo0kere.life
nhdeapyfg7e.life
y0zvqpi42no.life
zdf5ki8x9r0.life
8mgj12azbyd.life
l6syolvczan.life
mk7plk9c6i2.life
hudrx8fn980.life
-
dga_seed
1.0163655285949564e+18
-
domain_length
11
-
num_dga_domains
100
-
port
443
Signatures
-
Blocklisted process makes network request 39 IoCs
flow pid Process 34 4644 MsiExec.exe 37 4644 MsiExec.exe 43 4644 MsiExec.exe 51 4644 MsiExec.exe 53 4644 MsiExec.exe 55 4644 MsiExec.exe 57 4644 MsiExec.exe 60 4644 MsiExec.exe 62 4644 MsiExec.exe 64 4644 MsiExec.exe 66 4644 MsiExec.exe 68 4644 MsiExec.exe 70 4644 MsiExec.exe 72 4644 MsiExec.exe 76 4644 MsiExec.exe 78 4644 MsiExec.exe 80 4644 MsiExec.exe 82 4644 MsiExec.exe 84 4644 MsiExec.exe 88 4644 MsiExec.exe 90 4644 MsiExec.exe 93 4644 MsiExec.exe 95 4644 MsiExec.exe 98 4644 MsiExec.exe 101 4644 MsiExec.exe 104 4644 MsiExec.exe 106 4644 MsiExec.exe 109 4644 MsiExec.exe 110 4644 MsiExec.exe 111 4644 MsiExec.exe 112 4644 MsiExec.exe 113 4644 MsiExec.exe 114 4644 MsiExec.exe 115 4644 MsiExec.exe 116 4644 MsiExec.exe 117 4644 MsiExec.exe 118 4644 MsiExec.exe 119 4644 MsiExec.exe 121 4644 MsiExec.exe -
Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\Y: msiexec.exe -
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 103 api.ipify.org 104 api.ipify.org -
Drops file in Windows directory 10 IoCs
description ioc Process File opened for modification C:\Windows\Installer\e582b60.msi msiexec.exe File opened for modification C:\Windows\Installer\MSI2BCE.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI2C5B.tmp msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File opened for modification C:\Windows\Installer\MSI2DA6.tmp msiexec.exe File created C:\Windows\Installer\e582b60.msi msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\MSI2C7C.tmp msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\Installer\SourceHash{4940F33E-F184-4E77-BB3B-CE26AC9D6D5A} msiexec.exe -
Loads dropped DLL 11 IoCs
pid Process 2908 MsiExec.exe 2908 MsiExec.exe 2908 MsiExec.exe 2908 MsiExec.exe 2908 MsiExec.exe 2908 MsiExec.exe 2908 MsiExec.exe 2024 MsiExec.exe 2024 MsiExec.exe 2024 MsiExec.exe 4644 MsiExec.exe -
Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
pid Process 380 msiexec.exe -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe -
Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000a47b29fbd6f9c3720000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000a47b29fb0000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff000000000700010000680900a47b29fb000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1da47b29fb000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000a47b29fb00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 404 msiexec.exe 404 msiexec.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 380 msiexec.exe Token: SeIncreaseQuotaPrivilege 380 msiexec.exe Token: SeSecurityPrivilege 404 msiexec.exe Token: SeCreateTokenPrivilege 380 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 380 msiexec.exe Token: SeLockMemoryPrivilege 380 msiexec.exe Token: SeIncreaseQuotaPrivilege 380 msiexec.exe Token: SeMachineAccountPrivilege 380 msiexec.exe Token: SeTcbPrivilege 380 msiexec.exe Token: SeSecurityPrivilege 380 msiexec.exe Token: SeTakeOwnershipPrivilege 380 msiexec.exe Token: SeLoadDriverPrivilege 380 msiexec.exe Token: SeSystemProfilePrivilege 380 msiexec.exe Token: SeSystemtimePrivilege 380 msiexec.exe Token: SeProfSingleProcessPrivilege 380 msiexec.exe Token: SeIncBasePriorityPrivilege 380 msiexec.exe Token: SeCreatePagefilePrivilege 380 msiexec.exe Token: SeCreatePermanentPrivilege 380 msiexec.exe Token: SeBackupPrivilege 380 msiexec.exe Token: SeRestorePrivilege 380 msiexec.exe Token: SeShutdownPrivilege 380 msiexec.exe Token: SeDebugPrivilege 380 msiexec.exe Token: SeAuditPrivilege 380 msiexec.exe Token: SeSystemEnvironmentPrivilege 380 msiexec.exe Token: SeChangeNotifyPrivilege 380 msiexec.exe Token: SeRemoteShutdownPrivilege 380 msiexec.exe Token: SeUndockPrivilege 380 msiexec.exe Token: SeSyncAgentPrivilege 380 msiexec.exe Token: SeEnableDelegationPrivilege 380 msiexec.exe Token: SeManageVolumePrivilege 380 msiexec.exe Token: SeImpersonatePrivilege 380 msiexec.exe Token: SeCreateGlobalPrivilege 380 msiexec.exe Token: SeCreateTokenPrivilege 380 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 380 msiexec.exe Token: SeLockMemoryPrivilege 380 msiexec.exe Token: SeIncreaseQuotaPrivilege 380 msiexec.exe Token: SeMachineAccountPrivilege 380 msiexec.exe Token: SeTcbPrivilege 380 msiexec.exe Token: SeSecurityPrivilege 380 msiexec.exe Token: SeTakeOwnershipPrivilege 380 msiexec.exe Token: SeLoadDriverPrivilege 380 msiexec.exe Token: SeSystemProfilePrivilege 380 msiexec.exe Token: SeSystemtimePrivilege 380 msiexec.exe Token: SeProfSingleProcessPrivilege 380 msiexec.exe Token: SeIncBasePriorityPrivilege 380 msiexec.exe Token: SeCreatePagefilePrivilege 380 msiexec.exe Token: SeCreatePermanentPrivilege 380 msiexec.exe Token: SeBackupPrivilege 380 msiexec.exe Token: SeRestorePrivilege 380 msiexec.exe Token: SeShutdownPrivilege 380 msiexec.exe Token: SeDebugPrivilege 380 msiexec.exe Token: SeAuditPrivilege 380 msiexec.exe Token: SeSystemEnvironmentPrivilege 380 msiexec.exe Token: SeChangeNotifyPrivilege 380 msiexec.exe Token: SeRemoteShutdownPrivilege 380 msiexec.exe Token: SeUndockPrivilege 380 msiexec.exe Token: SeSyncAgentPrivilege 380 msiexec.exe Token: SeEnableDelegationPrivilege 380 msiexec.exe Token: SeManageVolumePrivilege 380 msiexec.exe Token: SeImpersonatePrivilege 380 msiexec.exe Token: SeCreateGlobalPrivilege 380 msiexec.exe Token: SeCreateTokenPrivilege 380 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 380 msiexec.exe Token: SeLockMemoryPrivilege 380 msiexec.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 380 msiexec.exe -
Suspicious use of WriteProcessMemory 10 IoCs
description pid Process procid_target PID 404 wrote to memory of 2908 404 msiexec.exe 87 PID 404 wrote to memory of 2908 404 msiexec.exe 87 PID 404 wrote to memory of 2908 404 msiexec.exe 87 PID 404 wrote to memory of 320 404 msiexec.exe 97 PID 404 wrote to memory of 320 404 msiexec.exe 97 PID 404 wrote to memory of 2024 404 msiexec.exe 99 PID 404 wrote to memory of 2024 404 msiexec.exe 99 PID 404 wrote to memory of 2024 404 msiexec.exe 99 PID 404 wrote to memory of 4644 404 msiexec.exe 100 PID 404 wrote to memory of 4644 404 msiexec.exe 100 -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\nvinstall.msi1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:380
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:404 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 9BF2CCD31F828F7A49667656067223F6 C2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2908
-
-
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵PID:320
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 049B972FBAF5D960216CC750DECC418D2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2024
-
-
C:\Windows\System32\MsiExec.exe"C:\Windows\System32\MsiExec.exe" /Y "C:\Users\Admin\AppData\Roaming\zoHnNvuTkk.dll"2⤵
- Blocklisted process makes network request
- Loads dropped DLL
PID:4644
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
PID:816
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
816KB
MD5aa88d8f40a286b6d40de0f3abc836cfa
SHA1c24eab9e4b10b159b589f4c3b64ef3db111ea1c8
SHA2568d633efeda1249356b11bf8f46583242356e4f903056b53bd25a99511d1790a1
SHA5126c2f2f6a2d66015f30158962d653e381136f0f30023380a0ce95bd0944d856113fbde65db52dbb3b5de1c0e2edf2cd53184e721c64b916834be4198c61224519
-
Filesize
4.1MB
MD522cc610a0dc995b24733ab10a0de155b
SHA15fdf0793cc0a81462b1cf0370fa1912900a54a6e
SHA2569e07d09f1457297a9a229def9771f6badaa8798751b22611dd915327069fa831
SHA512c2fe130e9db35f71c45e1a0b8a2d1016875f36655223b4a8f742bce812e28e1f14dec99331a7fb0603888a18cc9ee87c33450e79eb845523e0bd182870c4b363
-
Filesize
24.1MB
MD55d2c4463a3628da02cd4c1176403820e
SHA14b8c1fefa219dcf8bf7c5e00794a5514069de8d2
SHA2563b2136344d380ae4fd42c7ab1c5e5534bddc220b31c4e97c30e9d8044ce7d062
SHA5126f2d14f98df0cf948cc60a38f8440eefcd47699c2d3c3c92cf91db2af7857ed438173ca5a631e4e4e77e700c09411cd4820d2da8d2a45c50de302ffc5e910b8a
-
\??\Volume{fb297ba4-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{bda6c3ca-a37a-4591-b337-136edf931062}_OnDiskSnapshotProp
Filesize6KB
MD5dffe376fa8cb4bd871737ab81c95fd49
SHA17e3763ec1c89f64e3141854fa8458fefb6137b11
SHA2560f7f7b894a86294d53cca1b0a4a71ef81598bf0160be61700c4a26edb76fbe6d
SHA5128c3d104eaf12a353c7bb31ec24cdc753c1487aace6763bfac6f7588dc965e639f96a09ec6b9e30644c74de2c0b791701a65dbf849c241cf6a04cbcb08173a0f5