bumblebee | 1164b944f47a9701ddd682f59c60425faed350647e3f9e562e1abc140a89c7f2

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20240903-en
submitted
22-11-2024 03:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Acrobat_DC_x64_VIP_v10.12.msi
Size

2.7MB
MD5

b9632555b2c19b9182cab9c098c22d8e
SHA1

100d612540c51413141f52c3888114cddb76e9a0
SHA256

1164b944f47a9701ddd682f59c60425faed350647e3f9e562e1abc140a89c7f2
SHA512

b90b26af09115c4ad37f5cb40135de51835ccffbd666168934062fb587a9111fa535e21c1e231aed76a5e871d63a9f71b686367defed3d584f6d76f75e5acb52
SSDEEP

49152:/O05mqQDiCjwnwVv+i2MF/NtSftHFDSy4dx21N+NfSf/wXoCBBUQZcUJ8+mp3gi/:/rABiCjwnwVmGF1t6R1j4dx8Njf/w4C2

Score

10^/10

bumblebee 138704 discovery loader persistence privilege_escalation upx

Malware Config

Extracted

Family

bumblebee

Botnet

138704

Attributes

dga
45urhm0ldgxb.live

gx6xly9rp6vl.live

zv46ga4ntybq.live

7n1hfolmrnbl.live

vivh2xlt9i6q.live

97t3nh4kk510.live

kbkdtwucfl40.live

qk6a1ahb63uz.live

whko7loy7h5z.live

dad1zg44n0bn.live

7xwz4hw8dts9.live

ovekd5n3gklq.live

amwnef8mjo4v.live

e7ivqfhnss0x.live

rjql4nicl6bg.live

4mo318kk29i4.live

zpo18lm8vg1x.live

jc51pt290y0n.live

rg26t2dc4hf4.live

qw9a58vunuja.live

ugm94zjzl5nl.live

mckag832orba.live

pdw0v9voxlxr.live

m4tx2apfmoxo.live

n2uc737ef71m.live

hkk3112645hz.live

ugko9g5ipa4o.live

8wgq2x4dybx9.live

h81fx7sj8srr.live

a4tgoqi1cm8x.live

kse2q7uxyrwp.live

mfwnbxvt9qme.live

x99ahfftf28l.live

9n6bmko47gxe.live

6l96lk6edlyf.live

st5j8zqdrppf.live

dxjeucbj4p0j.live

bnpuxnov7lhr.live

a8bxv8lqe1m0.live

yczi2ujcyyro.live

sbeo0cztn1kh.live

o337yf9fh4bf.live

zoki7ma89z7b.live

x2r9bglz76r7.live

wi1w9yu1vush.live

mtqdvzkai700.live

r6o2sj70m85m.live

ut6qohwra5lm.live

9yi98fh7usy1.live

kkpjp9jzbzba.live

whvffwd7zphw.live

uztmazsno4y5.live

i3iubj73c21c.live

b72o02l2ilc6.live

wom4o4cutfx6.live

fek3qya20lid.live

nhkvd56j82xw.live

midyxlu6b22f.live

vp9c9rziba2a.live

rkffupb7i1gv.live

8u7r35mu2e4g.live

3c2xflq8mztc.live

wswis3sptby1.live

9rib57u1zu3c.live

sv3pldc5gkdl.live

bmdcn5celetq.live

y3mpywhmem7t.live

avwtkc23ffmw.live

nvgirtryox1z.live

3rlfa7w0bz37.live

vy9u47oyzltu.live

ysdwk0l8xass.live

tbt0aqol3sp2.live

xqqoo0a8zk0w.live

nevkq7lku38l.live

5u42wjin0vfz.live

y626kbnryktm.live

5k9b8nmc0x8r.live

i18t3jshekua.live

4hk1bcnxbse0.live

si00bu9fv5he.live

g3in90m5caz2.live

f6s4n6w41oov.live

sgl7og2qswmm.live

vrrbk7ykz8h1.live

zl7bmlfq8n9w.live

qydstwmw2imy.live

y9s73mnvurxr.live

7zggkh833im1.live

cvnsiogvl3kt.live

enf3gev34gis.live

doj6z5i9g803.live

zsm954jr5ek4.live

6z96z4mk84dc.live

e0et68offggh.live

au97foecnlrm.live

3ibjpmls5x46.live

mmmpa1byo300.live

3e60zvd64d8y.live

zt3nnzr70hn0.live
dga_seed
7834006444057268685
domain_length
12
num_dga_domains
300
port
443

rc4.plain

Signatures

BumbleBee
BumbleBee is a loader malware written in C++.
loader bumblebee
Bumblebee family
bumblebee

Blocklisted process makes network request 17 IoCs

flow	pid	Process
25	2052	rundll32.exe
28	2052	rundll32.exe
30	2052	rundll32.exe
32	2052	rundll32.exe
35	2052	rundll32.exe
38	2052	rundll32.exe
42	2052	rundll32.exe
47	2052	rundll32.exe
51	2052	rundll32.exe
55	2052	rundll32.exe
59	2052	rundll32.exe
63	2052	rundll32.exe
68	2052	rundll32.exe
72	2052	rundll32.exe
77	2052	rundll32.exe
84	2052	rundll32.exe
89	2052	rundll32.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2144-28-0x0000000000E40000-0x0000000001285000-memory.dmp	upx
behavioral1/files/0x0008000000015da1-21.dat	upx
behavioral1/memory/2144-317-0x0000000000E40000-0x0000000001285000-memory.dmp	upx
behavioral1/memory/2144-818-0x0000000000E40000-0x0000000001285000-memory.dmp	upx

Drops file in Windows directory 10 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File opened for modification	C:\Windows\Installer\f7709a2.msi	msiexec.exe
File created	C:\Windows\Installer\f7709a3.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIA7C.tmp	msiexec.exe
File created	C:\Windows\Installer\f7709a5.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\f7709a3.ipi	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.ev3	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.ev1	DrvInst.exe
File created	C:\Windows\Installer\f7709a2.msi	msiexec.exe

Executes dropped EXE 1 IoCs

pid	Process
2144	Reader_Install_Setup.exe

Loads dropped DLL 4 IoCs

pid	Process
2052	rundll32.exe
2052	rundll32.exe
2052	rundll32.exe
2052	rundll32.exe

Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs

persistence privilege_escalation

Installer Packages

T1546.016

Msiexec

T1218.007

pid	Process
2692	msiexec.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Reader_Install_Setup.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main	Reader_Install_Setup.exe

Modifies data under HKEY_USERS 43 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\Certificates	DrvInst.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe

Modifies system certificate store 2 TTPs 2 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436	Reader_Install_Setup.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436\Blob = 04000000010000001000000079e4a9840d7d3a96d7c04fe2434c892e0f0000000100000014000000b34ddd372ed92e8f2abfbb9e20a9d31f204f194b090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000003de503556d14cbb66f0a3e21b1bc397b23dd1550b00000001000000120000004400690067006900430065007200740000001d000000010000001000000059779e39e21a2e3dfced6857ed5c5fd9030000000100000014000000a8985d3a65e5e5c4b2d7d66d40c6dd2fb19c54361900000001000000100000000f3a0527d242de2dc98e5cfcb1e991ee2000000001000000b3030000308203af30820297a0030201020210083be056904246b1a1756ac95991c74a300d06092a864886f70d01010505003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100e23be11172dea8a4d3a357aa50a28f0b7790c9a2a5ee12ce965b010920cc0193a74e30b753f743c46900579de28d22dd870640008109cece1b83bfdfcd3b7146e2d666c705b37627168f7b9e1e957deeb748a308dad6af7a0c3906657f4a5d1fbc17f8abbeee28d7747f7a78995985686e5c23324bbf4ec0e85a6de370bf7710bffc01f685d9a844105832a97518d5d1a2be47e2276af49a33f84908608bd45fb43a84bfa1aa4a4c7d3ecf4f5f6c765ea04b37919edc22e66dce141a8e6acbfecdb3146417c75b299e32bff2eefad30b42d4abb74132da0cd4eff881d5bb8d583fb51be84928a270da3104ddf7b216f24c0a4e07a8ed4a3d5eb57fa390c3af270203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041403de503556d14cbb66f0a3e21b1bc397b23dd155301f0603551d2304183016801403de503556d14cbb66f0a3e21b1bc397b23dd155300d06092a864886f70d01010505000382010100cb9c37aa4813120afadd449c4f52b0f4dfae04f5797908a32418fc4b2b84c02db9d5c7fef4c11f58cbb86d9c7a74e79829ab11b5e370a0a1cd4c8899938c9170e2ab0f1cbe93a9ff63d5e40760d3a3bf9d5b09f1d58ee353f48e63fa3fa7dbb466df6266d6d16e418df22db5ea774a9f9d58e22b59c04023ed2d2882453e7954922698e08048a837eff0d6796016deace80ecd6eac4417382f49dae1453e2ab93653cf3a5006f72ee8c457496c612118d504ad783c2c3a806ba7ebaf1514e9d889c1b9386ce2916c8aff64b977255730c01b24a3e1dce9df477cb5b424080530ec2dbd0bbf45bf50b9a9f3eb980112adc888c698345f8d0a3cc6e9d595956dde	Reader_Install_Setup.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2696	msiexec.exe
2696	msiexec.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2692	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2692	msiexec.exe
Token: SeRestorePrivilege	2696	msiexec.exe
Token: SeTakeOwnershipPrivilege	2696	msiexec.exe
Token: SeSecurityPrivilege	2696	msiexec.exe
Token: SeCreateTokenPrivilege	2692	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	2692	msiexec.exe
Token: SeLockMemoryPrivilege	2692	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2692	msiexec.exe
Token: SeMachineAccountPrivilege	2692	msiexec.exe
Token: SeTcbPrivilege	2692	msiexec.exe
Token: SeSecurityPrivilege	2692	msiexec.exe
Token: SeTakeOwnershipPrivilege	2692	msiexec.exe
Token: SeLoadDriverPrivilege	2692	msiexec.exe
Token: SeSystemProfilePrivilege	2692	msiexec.exe
Token: SeSystemtimePrivilege	2692	msiexec.exe
Token: SeProfSingleProcessPrivilege	2692	msiexec.exe
Token: SeIncBasePriorityPrivilege	2692	msiexec.exe
Token: SeCreatePagefilePrivilege	2692	msiexec.exe
Token: SeCreatePermanentPrivilege	2692	msiexec.exe
Token: SeBackupPrivilege	2692	msiexec.exe
Token: SeRestorePrivilege	2692	msiexec.exe
Token: SeShutdownPrivilege	2692	msiexec.exe
Token: SeDebugPrivilege	2692	msiexec.exe
Token: SeAuditPrivilege	2692	msiexec.exe
Token: SeSystemEnvironmentPrivilege	2692	msiexec.exe
Token: SeChangeNotifyPrivilege	2692	msiexec.exe
Token: SeRemoteShutdownPrivilege	2692	msiexec.exe
Token: SeUndockPrivilege	2692	msiexec.exe
Token: SeSyncAgentPrivilege	2692	msiexec.exe
Token: SeEnableDelegationPrivilege	2692	msiexec.exe
Token: SeManageVolumePrivilege	2692	msiexec.exe
Token: SeImpersonatePrivilege	2692	msiexec.exe
Token: SeCreateGlobalPrivilege	2692	msiexec.exe
Token: SeBackupPrivilege	2820	vssvc.exe
Token: SeRestorePrivilege	2820	vssvc.exe
Token: SeAuditPrivilege	2820	vssvc.exe
Token: SeBackupPrivilege	2696	msiexec.exe
Token: SeRestorePrivilege	2696	msiexec.exe
Token: SeRestorePrivilege	1260	DrvInst.exe
Token: SeRestorePrivilege	1260	DrvInst.exe
Token: SeRestorePrivilege	1260	DrvInst.exe
Token: SeRestorePrivilege	1260	DrvInst.exe
Token: SeRestorePrivilege	1260	DrvInst.exe
Token: SeRestorePrivilege	1260	DrvInst.exe
Token: SeRestorePrivilege	1260	DrvInst.exe
Token: SeLoadDriverPrivilege	1260	DrvInst.exe
Token: SeLoadDriverPrivilege	1260	DrvInst.exe
Token: SeLoadDriverPrivilege	1260	DrvInst.exe
Token: SeRestorePrivilege	2696	msiexec.exe
Token: SeTakeOwnershipPrivilege	2696	msiexec.exe
Token: SeRestorePrivilege	2696	msiexec.exe
Token: SeTakeOwnershipPrivilege	2696	msiexec.exe
Token: SeRestorePrivilege	2696	msiexec.exe
Token: SeTakeOwnershipPrivilege	2696	msiexec.exe
Token: SeRestorePrivilege	2696	msiexec.exe
Token: SeTakeOwnershipPrivilege	2696	msiexec.exe
Token: SeRestorePrivilege	2696	msiexec.exe
Token: SeTakeOwnershipPrivilege	2696	msiexec.exe
Token: SeRestorePrivilege	2696	msiexec.exe
Token: SeTakeOwnershipPrivilege	2696	msiexec.exe
Token: SeRestorePrivilege	2696	msiexec.exe
Token: SeTakeOwnershipPrivilege	2696	msiexec.exe
Token: SeRestorePrivilege	2696	msiexec.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
2692	msiexec.exe
2692	msiexec.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2144	Reader_Install_Setup.exe
2144	Reader_Install_Setup.exe
2144	Reader_Install_Setup.exe
2144	Reader_Install_Setup.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 2696 wrote to memory of 2052	2696	msiexec.exe	35
PID 2696 wrote to memory of 2052	2696	msiexec.exe	35
PID 2696 wrote to memory of 2052	2696	msiexec.exe	35
PID 2696 wrote to memory of 2144	2696	msiexec.exe	36
PID 2696 wrote to memory of 2144	2696	msiexec.exe	36
PID 2696 wrote to memory of 2144	2696	msiexec.exe	36
PID 2696 wrote to memory of 2144	2696	msiexec.exe	36
PID 2696 wrote to memory of 2144	2696	msiexec.exe	36
PID 2696 wrote to memory of 2144	2696	msiexec.exe	36
PID 2696 wrote to memory of 2144	2696	msiexec.exe	36

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\Acrobat_DC_x64_VIP_v10.12.msi
1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2692

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2696
- C:\Windows\system32\rundll32.exe
  "rundll32.exe" "C:\Users\Admin\AppData\Local\Temp\Package Installation Dir\qpgEZsswIP.dll",DllRegisterServer
  2⤵
  - Blocklisted process makes network request
  - Loads dropped DLL
  PID:2052
- C:\Users\Admin\AppData\Local\Temp\Package Installation Dir\Reader_Install_Setup.exe
  "C:\Users\Admin\AppData\Local\Temp\Package Installation Dir\Reader_Install_Setup.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Modifies system certificate store
  - Suspicious use of SetWindowsHookEx
  PID:2144

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2820

C:\Windows\system32\DrvInst.exe
DrvInst.exe "1" "200" "STORAGE\VolumeSnapshot\HarddiskVolumeSnapshot19" "" "" "61530dda3" "0000000000000000" "00000000000003DC" "00000000000003D8"
1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:1260

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Installer Packages

T1546.016

Privilege Escalation

Event Triggered Execution

T1546

Installer Packages

T1546.016

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

System Binary Proxy Execution

T1218

Msiexec

T1218.007

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\f7709a4.rbs

Filesize
7KB

MD5
b7b7530cac0e97a0d7bb6763cf2808e8

SHA1
61fd9e575eb33e859948e657db2c7edf0fd5738e

SHA256
f37475cfaf4d4e3babaeb85151187b2bd4d0c9ff9119b5ca91cd01aef4a11a3e

SHA512
e3eb325055dedcbf2194c80c0eab1f345315719f01d1716f84762585cc8a70d50db2afbdd1682ed4c2d1b59177b2da6d31c1126994403252e232044f29c9a41b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c02213aa46d28a93d790974f291d2e15

SHA1
ad104bc8ad93e8af90f3c7e3319d5317dd677373

SHA256
b32b87b793c8aa2317c383e588e182486be07e1b4176b8e66dc3f739449950a7

SHA512
7f4b74815d1389a9cde19564f80dcf519af39f867b2df427a462c7ccb7c0b47f83359e9e0730dea6deeb8a3e43d974cfeba9e2762d2eb6dce5d099524f725b14

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
50841579290a583767d638e367570ff7

SHA1
cba3bd0c54db58c9e8ddaf1595d5f7d7d3ad9ca8

SHA256
0a45e0e6e8f18a8d6f0708444ee61ceb929c17cff8850aeb9aa79afe4e81ede3

SHA512
1de95555b831f198ac6389ed493b6a97438bfcb369a1e21fea968d9c01114256f0b54124a071816b17b3607e6ee1726b86322a76075a1f896fe0379d5ee7d1b4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d77ea2e99d2e5c7dd6dc07790ba307b8

SHA1
b985cf63487ed9b1371ef557eeaa45004a03f761

SHA256
b98a06b002f1e8c6d73ca5ff6a54096862adc843ce5d2037ef8f64e1838b4750

SHA512
6c42d6a1198cdbf09a10113e1f0501c85b80b3fc77a2285379b39f52935fa5995eefd6567fab60c90fefdcd1e96a72e39c0317a734ae88bdd98c0e102bf2bf3c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
454ccfed2134525b9745e79aa28c2799

SHA1
7a2a64a9b849fe3026099cdc2f4c9be55581eb8e

SHA256
5ec653267121b788cadfad19e8da55e10bdcfecb26d5ff4de694463060e37cfd

SHA512
169ab22ff8c99764cba35b19a4e05723251005d820da00600bb1d7835e289911c1d092630fd8a5d352c079300f547ccb9740e0af651c4b7528e9e8aa727390e0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab11BE.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Package Installation Dir\Reader_Install_Setup.exe

Filesize
1.4MB

MD5
e4e96d377207c990295577e0ebd93f79

SHA1
6c6ed98b484f8a1a145ebe7d900df36fb4abc931

SHA256
ac6311039d5bfe719198c15577d3ee870185529f9510f5c0ddc066f1c8d8c462

SHA512
3db14a6f3dfa2e2768b1c25a65bc6f48c5dc763d80fee576cd7d0b21f3ecdcd25c0096b10c947f6b24999c23df75709604a4dc0fd1d894cdb1b9a556e1e6eaf7

Download Submit
C:\Users\Admin\AppData\Local\Temp\Package Installation Dir\qpgEZsswIP.dll

Filesize
2.3MB

MD5
3cf367e01d074e622e14c36fe1685c0a

SHA1
f9b347b843f438564e606a7d3e273659e0fb7cc7

SHA256
2cb0aea0f3dfe49b99f5f7a0e6f6020413c916e4a21d05d2df1cca3de3e7e91d

SHA512
4033d7e17e673ec67947367fed5f5992d578b61a0da0d24743d03ab0e1bf17f26bce7f80d5b0d23f87736e3d8c429fd4420bec708c295d81d125700bbf4ab3a9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar122F.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
C:\Windows\Installer\f7709a2.msi

Filesize
2.7MB

MD5
b9632555b2c19b9182cab9c098c22d8e

SHA1
100d612540c51413141f52c3888114cddb76e9a0

SHA256
1164b944f47a9701ddd682f59c60425faed350647e3f9e562e1abc140a89c7f2

SHA512
b90b26af09115c4ad37f5cb40135de51835ccffbd666168934062fb587a9111fa535e21c1e231aed76a5e871d63a9f71b686367defed3d584f6d76f75e5acb52

Download Submit
memory/2052-91-0x0000000002340000-0x000000000255E000-memory.dmp

Filesize
2.1MB

Download
memory/2052-62-0x0000000002340000-0x000000000255E000-memory.dmp

Filesize
2.1MB

Download
memory/2052-63-0x0000000002340000-0x000000000255E000-memory.dmp

Filesize
2.1MB

Download
memory/2144-317-0x0000000000E40000-0x0000000001285000-memory.dmp

Filesize
4.3MB

Download
memory/2144-28-0x0000000000E40000-0x0000000001285000-memory.dmp

Filesize
4.3MB

Download
memory/2144-818-0x0000000000E40000-0x0000000001285000-memory.dmp

Filesize
4.3MB

Download