Analysis
-
max time kernel
148s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20240903-en -
submitted
14-10-2024 17:03
Static task
static1
Behavioral task
behavioral1
Sample
nvinstall.msi
Resource
win7-20240903-en
windows7-x64
14 signatures
150 seconds
Behavioral task
behavioral2
Sample
nvinstall.msi
Resource
win10v2004-20241007-en
windows10-2004-x64
13 signatures
150 seconds
General
-
Target
nvinstall.msi
-
Size
3.8MB
-
MD5
392419d9747a11165f669091eca260af
-
SHA1
5f415e18f3aa030934e26f0209397f0682ca22ca
-
SHA256
d3f551d1fb2c307edfceb65793e527d94d76eba1cd8ab0a5d1f86db11c9474c3
-
SHA512
55576ccee796a35fe6d0dde2d642bb850ec4304d7906cff7b091dc3b0bd431168870c715675945dbdbb21f0e5a2f0b8980098c4369f2bdabef1e34dbfd3be3b9
-
SSDEEP
98304:7kufF+tb8U9+TgVz/GdYAg2CT2uM103hh5s5:7kF8JTgtOY72CLRz
Malware Config
Extracted
Family
bumblebee
Botnet
lnk001
Attributes
-
dga
tvx1ovdepj8.life
acgr6r8zdot.life
ilofx941igp.life
8x2apo5m7ri.life
x9yrzer0ndt.life
93j4v4jopzd.life
ameagxzo2f7.life
nyy41uibsv5.life
ru4jvijdytq.life
l9t6r0y6cvi.life
f4vb9n3tdvh.life
9do3mcejztt.life
pxu1ajsdhqr.life
7exy2b231n2.life
vu5b47m18jn.life
6mnudp7zj73.life
p5047yjrb8q.life
d0xtxp89bb9.life
ygo9u1fkwux.life
fig3gj0v6qe.life
38f5wvwwn7o.life
txgogs9p8a1.life
uyn0icgx1kv.life
2z1ls31az7s.life
0cc2z8zrnhf.life
fsr2hskx44p.life
du19ek78tjw.life
234ct3lkozp.life
he8fq4k8d3w.life
7ewh8ltr7il.life
dw34kmgfl7t.life
f2j20ayqh8y.life
331k2rdkmmb.life
37z6li6l9y2.life
dpgs2lt1sbz.life
plll0xq4y82.life
bzc9sq2pz53.life
7r8ln1wswth.life
y9neib92f2m.life
m5iukps17y7.life
xo8be64ejh2.life
widn8soih8u.life
08mkuqnx6gv.life
lzeqr3apopn.life
o4m5a5no7e8.life
2u8znzsbrto.life
dxyob8x456a.life
lrugnff8fkc.life
38i6lh0rpze.life
mjb3r6mcs1f.life
vl41cymzzfq.life
qc4mwjiop45.life
z3z4fq0420z.life
0tab35o0swu.life
4izk0gc9is6.life
6brdh3p893b.life
736d0mvetjw.life
drmk5rdefb5.life
1v0xhie4os8.life
khxcp22s3dz.life
8z9m8hndrhp.life
xeoz1f1vjs0.life
lobavyclh8e.life
in4pzu7t2pv.life
j280b59doxz.life
6q894zusd4k.life
y7pzxau0717.life
bev8ymaajb7.life
glux8x5b8d6.life
yan95akxgqt.life
9qiliikd3sp.life
ge0lpqif3ar.life
ar7xakeve0o.life
eb4l6wisq9z.life
1grovn87c8s.life
wdga570b8pz.life
nzs8vi9w5o8.life
q7dfpyyhe08.life
exueqqmz3ia.life
65r8nx12fqr.life
vauy5ah65sx.life
8hjv8mbhrlj.life
eeqwg3mzq07.life
b1h0uaabzyz.life
8qvt5iabz5n.life
8ru044xed25.life
w8ligr695sd.life
3e6rrifr5fn.life
9f6p9g7x13s.life
ibcm5at6qrz.life
spd22scperm.life
4k59ij2ujeu.life
07zxfo0kere.life
nhdeapyfg7e.life
y0zvqpi42no.life
zdf5ki8x9r0.life
8mgj12azbyd.life
l6syolvczan.life
mk7plk9c6i2.life
hudrx8fn980.life
-
dga_seed
1016365528594956469
-
domain_length
11
-
num_dga_domains
100
-
port
443
rc4.plain
Signatures
-
Bumblebee family
-
Blocklisted process makes network request 10 IoCs
flow pid Process 7 2848 MsiExec.exe 9 2848 MsiExec.exe 11 2848 MsiExec.exe 13 2848 MsiExec.exe 15 2848 MsiExec.exe 18 2848 MsiExec.exe 21 2848 MsiExec.exe 25 2848 MsiExec.exe 29 2848 MsiExec.exe 33 2848 MsiExec.exe -
Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\N: msiexec.exe -
Drops file in Windows directory 9 IoCs
description ioc Process File opened for modification C:\Windows\INF\setupapi.ev1 DrvInst.exe File created C:\Windows\Installer\f77163f.msi msiexec.exe File created C:\Windows\Installer\f771640.ipi msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File opened for modification C:\Windows\INF\setupapi.ev3 DrvInst.exe File opened for modification C:\Windows\INF\setupapi.dev.log DrvInst.exe File opened for modification C:\Windows\Installer\f77163f.msi msiexec.exe File opened for modification C:\Windows\Installer\MSI168D.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI17A7.tmp msiexec.exe -
Loads dropped DLL 7 IoCs
pid Process 2316 MsiExec.exe 2316 MsiExec.exe 2316 MsiExec.exe 2316 MsiExec.exe 2316 MsiExec.exe 2856 MsiExec.exe 2848 MsiExec.exe -
Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
pid Process 1884 msiexec.exe -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe -
Modifies data under HKEY_USERS 43 IoCs
description ioc Process Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot DrvInst.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1372 msiexec.exe 1372 msiexec.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1884 msiexec.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 1884 msiexec.exe Token: SeIncreaseQuotaPrivilege 1884 msiexec.exe Token: SeRestorePrivilege 1372 msiexec.exe Token: SeTakeOwnershipPrivilege 1372 msiexec.exe Token: SeSecurityPrivilege 1372 msiexec.exe Token: SeCreateTokenPrivilege 1884 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 1884 msiexec.exe Token: SeLockMemoryPrivilege 1884 msiexec.exe Token: SeIncreaseQuotaPrivilege 1884 msiexec.exe Token: SeMachineAccountPrivilege 1884 msiexec.exe Token: SeTcbPrivilege 1884 msiexec.exe Token: SeSecurityPrivilege 1884 msiexec.exe Token: SeTakeOwnershipPrivilege 1884 msiexec.exe Token: SeLoadDriverPrivilege 1884 msiexec.exe Token: SeSystemProfilePrivilege 1884 msiexec.exe Token: SeSystemtimePrivilege 1884 msiexec.exe Token: SeProfSingleProcessPrivilege 1884 msiexec.exe Token: SeIncBasePriorityPrivilege 1884 msiexec.exe Token: SeCreatePagefilePrivilege 1884 msiexec.exe Token: SeCreatePermanentPrivilege 1884 msiexec.exe Token: SeBackupPrivilege 1884 msiexec.exe Token: SeRestorePrivilege 1884 msiexec.exe Token: SeShutdownPrivilege 1884 msiexec.exe Token: SeDebugPrivilege 1884 msiexec.exe Token: SeAuditPrivilege 1884 msiexec.exe Token: SeSystemEnvironmentPrivilege 1884 msiexec.exe Token: SeChangeNotifyPrivilege 1884 msiexec.exe Token: SeRemoteShutdownPrivilege 1884 msiexec.exe Token: SeUndockPrivilege 1884 msiexec.exe Token: SeSyncAgentPrivilege 1884 msiexec.exe Token: SeEnableDelegationPrivilege 1884 msiexec.exe Token: SeManageVolumePrivilege 1884 msiexec.exe Token: SeImpersonatePrivilege 1884 msiexec.exe Token: SeCreateGlobalPrivilege 1884 msiexec.exe Token: SeCreateTokenPrivilege 1884 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 1884 msiexec.exe Token: SeLockMemoryPrivilege 1884 msiexec.exe Token: SeIncreaseQuotaPrivilege 1884 msiexec.exe Token: SeMachineAccountPrivilege 1884 msiexec.exe Token: SeTcbPrivilege 1884 msiexec.exe Token: SeSecurityPrivilege 1884 msiexec.exe Token: SeTakeOwnershipPrivilege 1884 msiexec.exe Token: SeLoadDriverPrivilege 1884 msiexec.exe Token: SeSystemProfilePrivilege 1884 msiexec.exe Token: SeSystemtimePrivilege 1884 msiexec.exe Token: SeProfSingleProcessPrivilege 1884 msiexec.exe Token: SeIncBasePriorityPrivilege 1884 msiexec.exe Token: SeCreatePagefilePrivilege 1884 msiexec.exe Token: SeCreatePermanentPrivilege 1884 msiexec.exe Token: SeBackupPrivilege 1884 msiexec.exe Token: SeRestorePrivilege 1884 msiexec.exe Token: SeShutdownPrivilege 1884 msiexec.exe Token: SeDebugPrivilege 1884 msiexec.exe Token: SeAuditPrivilege 1884 msiexec.exe Token: SeSystemEnvironmentPrivilege 1884 msiexec.exe Token: SeChangeNotifyPrivilege 1884 msiexec.exe Token: SeRemoteShutdownPrivilege 1884 msiexec.exe Token: SeUndockPrivilege 1884 msiexec.exe Token: SeSyncAgentPrivilege 1884 msiexec.exe Token: SeEnableDelegationPrivilege 1884 msiexec.exe Token: SeManageVolumePrivilege 1884 msiexec.exe Token: SeImpersonatePrivilege 1884 msiexec.exe Token: SeCreateGlobalPrivilege 1884 msiexec.exe Token: SeCreateTokenPrivilege 1884 msiexec.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1884 msiexec.exe -
Suspicious use of WriteProcessMemory 19 IoCs
description pid Process procid_target PID 1372 wrote to memory of 2316 1372 msiexec.exe 31 PID 1372 wrote to memory of 2316 1372 msiexec.exe 31 PID 1372 wrote to memory of 2316 1372 msiexec.exe 31 PID 1372 wrote to memory of 2316 1372 msiexec.exe 31 PID 1372 wrote to memory of 2316 1372 msiexec.exe 31 PID 1372 wrote to memory of 2316 1372 msiexec.exe 31 PID 1372 wrote to memory of 2316 1372 msiexec.exe 31 PID 1372 wrote to memory of 2856 1372 msiexec.exe 36 PID 1372 wrote to memory of 2856 1372 msiexec.exe 36 PID 1372 wrote to memory of 2856 1372 msiexec.exe 36 PID 1372 wrote to memory of 2856 1372 msiexec.exe 36 PID 1372 wrote to memory of 2856 1372 msiexec.exe 36 PID 1372 wrote to memory of 2856 1372 msiexec.exe 36 PID 1372 wrote to memory of 2856 1372 msiexec.exe 36 PID 1372 wrote to memory of 2848 1372 msiexec.exe 37 PID 1372 wrote to memory of 2848 1372 msiexec.exe 37 PID 1372 wrote to memory of 2848 1372 msiexec.exe 37 PID 1372 wrote to memory of 2848 1372 msiexec.exe 37 PID 1372 wrote to memory of 2848 1372 msiexec.exe 37 -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\nvinstall.msi1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1884
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1372 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 89C02EAA59545681DDF3FC1763D92724 C2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2316
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 9DB624BB865296A7D7ADF8A4A038DC342⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2856
-
-
C:\Windows\system32\MsiExec.exe"C:\Windows\system32\MsiExec.exe" /Y "C:\Users\Admin\AppData\Roaming\AdXrbBrQjR.dll"2⤵
- Blocklisted process makes network request
- Loads dropped DLL
PID:2848
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵PID:2948
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "1" "200" "STORAGE\VolumeSnapshot\HarddiskVolumeSnapshot19" "" "" "61530dda3" "0000000000000000" "00000000000005A0" "0000000000000588"1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
PID:556
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
816KB
MD5aa88d8f40a286b6d40de0f3abc836cfa
SHA1c24eab9e4b10b159b589f4c3b64ef3db111ea1c8
SHA2568d633efeda1249356b11bf8f46583242356e4f903056b53bd25a99511d1790a1
SHA5126c2f2f6a2d66015f30158962d653e381136f0f30023380a0ce95bd0944d856113fbde65db52dbb3b5de1c0e2edf2cd53184e721c64b916834be4198c61224519
-
Filesize
2.7MB
MD5a907ba8832cb5814651c66643edff9cf
SHA15a1c30cdcb989385f9252c745c40e0e05ea2c6fd
SHA25641e0c02901f4ad04874574d3020eecc8b9d74c14840db1b10c18484de4713105
SHA512b7f3f63d765fe0ee8b29f09d9640115b2bdf7d90bae4dd1fc7ac02c03711ff57d854ca5a95719e49ee1b3f9df7e1763a893c522947b9e206a3e18b024a6625ab