Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    151s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • submitted
    05/12/2024, 03:10 UTC

General

  • Target

    b8794c9251e2c6fbb96c458a5e1821ddd029335933dfbb03efa7db63673562e8.msi

  • Size

    4.7MB

  • MD5

    e63911bf851f892bab6d3933349a987e

  • SHA1

    c3f5bd1aca61bd086f1aea3e4b86419a836888ce

  • SHA256

    b8794c9251e2c6fbb96c458a5e1821ddd029335933dfbb03efa7db63673562e8

  • SHA512

    f00874b37580152bbb563b29763212de0452e8117f54e4199150cb8cebf3f4d8d1c31ed28d896b7b0cbb63c17e8847019ed76b53f7c0ae07021527705e1af17c

  • SSDEEP

    49152:37Vh102T9dhkuqES58NtvUoBV0Sccd2b5+pnQ2fP1r8+/J4OV7AEqj7D4Uv6ZCOX:37VTVkufFN0ScaruSmHR9vaXZTUa3vg

Malware Config

Extracted

Family

bumblebee

Botnet

1

Attributes
  • dga

    45urhm0ldgxb.live

    gx6xly9rp6vl.live

    zv46ga4ntybq.live

    7n1hfolmrnbl.live

    vivh2xlt9i6q.live

    97t3nh4kk510.live

    kbkdtwucfl40.live

    qk6a1ahb63uz.live

    whko7loy7h5z.live

    dad1zg44n0bn.live

    7xwz4hw8dts9.live

    ovekd5n3gklq.live

    amwnef8mjo4v.live

    e7ivqfhnss0x.live

    rjql4nicl6bg.live

    4mo318kk29i4.live

    zpo18lm8vg1x.live

    jc51pt290y0n.live

    rg26t2dc4hf4.live

    qw9a58vunuja.live

    ugm94zjzl5nl.live

    mckag832orba.live

    pdw0v9voxlxr.live

    m4tx2apfmoxo.live

    n2uc737ef71m.live

    hkk3112645hz.live

    ugko9g5ipa4o.live

    8wgq2x4dybx9.live

    h81fx7sj8srr.live

    a4tgoqi1cm8x.live

  • dga_seed

    7834006444057268685

  • domain_length

    12

  • num_dga_domains

    300

  • port

    443

rc4.plain
1
NEW_BLACK

Signatures

  • BumbleBee

    BumbleBee is a loader malware written in C++.

  • Bumblebee family
  • Blocklisted process makes network request 15 IoCs
  • Enumerates connected drives 3 TTPs 46 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Windows directory 11 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 14 IoCs
  • Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies data under HKEY_USERS 43 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 26 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

Processes

  • C:\Windows\system32\msiexec.exe
    msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\b8794c9251e2c6fbb96c458a5e1821ddd029335933dfbb03efa7db63673562e8.msi
    1⤵
    • Enumerates connected drives
    • Event Triggered Execution: Installer Packages
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    PID:2888
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Enumerates connected drives
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2464
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding 1C1B6E52A724F456A5A8D7AA9154AD89 C
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2708
      • C:\Users\Admin\AppData\Roaming\Cisco Systems\Cisco Anyconnect\prerequisites\Cisco Installer\AnyConnect Installer.exe
        "C:\Users\Admin\AppData\Roaming\Cisco Systems\Cisco Anyconnect\prerequisites\Cisco Installer\AnyConnect Installer.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:2056
        • C:\Windows\system32\WerFault.exe
          C:\Windows\system32\WerFault.exe -u -p 2056 -s 628
          4⤵
            PID:2136
      • C:\Windows\syswow64\MsiExec.exe
        C:\Windows\syswow64\MsiExec.exe -Embedding 33DFC9A4155955347D1D32F181890FB5
        2⤵
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        PID:2488
      • C:\Windows\system32\MsiExec.exe
        "C:\Windows\system32\MsiExec.exe" /Y "C:\Users\Admin\AppData\Roaming\BmgqLbJUHL.dll"
        2⤵
        • Blocklisted process makes network request
        • Loads dropped DLL
        PID:2992
    • C:\Windows\system32\vssvc.exe
      C:\Windows\system32\vssvc.exe
      1⤵
        PID:2868
      • C:\Windows\system32\DrvInst.exe
        DrvInst.exe "1" "200" "STORAGE\VolumeSnapshot\HarddiskVolumeSnapshot19" "" "" "61530dda3" "0000000000000000" "0000000000000594" "0000000000000068"
        1⤵
        • Drops file in Windows directory
        • Modifies data under HKEY_USERS
        PID:2252

      Network

      • flag-us
        DNS
        45urhm0ldgxb.live
        MsiExec.exe
        Remote address:
        8.8.8.8:53
        Request
        45urhm0ldgxb.live
        IN A
        Response
        45urhm0ldgxb.live
        IN A
        149.154.153.2
      • flag-us
        DNS
        gx6xly9rp6vl.live
        MsiExec.exe
        Remote address:
        8.8.8.8:53
        Request
        gx6xly9rp6vl.live
        IN A
        Response
        gx6xly9rp6vl.live
        IN A
        45.155.37.158
      • flag-us
        DNS
        zv46ga4ntybq.live
        MsiExec.exe
        Remote address:
        8.8.8.8:53
        Request
        zv46ga4ntybq.live
        IN A
        Response
        zv46ga4ntybq.live
        IN A
        188.166.15.250
      • flag-us
        DNS
        7n1hfolmrnbl.live
        MsiExec.exe
        Remote address:
        8.8.8.8:53
        Request
        7n1hfolmrnbl.live
        IN A
        Response
        7n1hfolmrnbl.live
        IN A
        188.166.15.250
      • flag-us
        DNS
        vivh2xlt9i6q.live
        MsiExec.exe
        Remote address:
        8.8.8.8:53
        Request
        vivh2xlt9i6q.live
        IN A
        Response
        vivh2xlt9i6q.live
        IN A
        188.166.15.250
      • flag-us
        DNS
        97t3nh4kk510.live
        MsiExec.exe
        Remote address:
        8.8.8.8:53
        Request
        97t3nh4kk510.live
        IN A
        Response
        97t3nh4kk510.live
        IN A
        188.166.15.250
      • flag-us
        DNS
        kbkdtwucfl40.live
        MsiExec.exe
        Remote address:
        8.8.8.8:53
        Request
        kbkdtwucfl40.live
        IN A
        Response
        kbkdtwucfl40.live
        IN A
        188.166.15.250
      • flag-us
        DNS
        qk6a1ahb63uz.live
        MsiExec.exe
        Remote address:
        8.8.8.8:53
        Request
        qk6a1ahb63uz.live
        IN A
        Response
        qk6a1ahb63uz.live
        IN A
        188.166.15.250
      • flag-us
        DNS
        whko7loy7h5z.live
        MsiExec.exe
        Remote address:
        8.8.8.8:53
        Request
        whko7loy7h5z.live
        IN A
        Response
        whko7loy7h5z.live
        IN A
        188.40.187.128
      • flag-us
        DNS
        dad1zg44n0bn.live
        MsiExec.exe
        Remote address:
        8.8.8.8:53
        Request
        dad1zg44n0bn.live
        IN A
        Response
        dad1zg44n0bn.live
        IN A
        188.166.15.250
      • flag-us
        DNS
        7xwz4hw8dts9.live
        MsiExec.exe
        Remote address:
        8.8.8.8:53
        Request
        7xwz4hw8dts9.live
        IN A
        Response
        7xwz4hw8dts9.live
        IN A
        188.166.15.250
      • flag-us
        DNS
        ovekd5n3gklq.live
        MsiExec.exe
        Remote address:
        8.8.8.8:53
        Request
        ovekd5n3gklq.live
        IN A
        Response
        ovekd5n3gklq.live
        IN A
        188.166.15.250
      • flag-us
        DNS
        amwnef8mjo4v.live
        MsiExec.exe
        Remote address:
        8.8.8.8:53
        Request
        amwnef8mjo4v.live
        IN A
        Response
        amwnef8mjo4v.live
        IN A
        188.166.15.250
      • flag-us
        DNS
        e7ivqfhnss0x.live
        MsiExec.exe
        Remote address:
        8.8.8.8:53
        Request
        e7ivqfhnss0x.live
        IN A
        Response
        e7ivqfhnss0x.live
        IN A
        188.166.15.250
      • flag-us
        DNS
        rjql4nicl6bg.live
        MsiExec.exe
        Remote address:
        8.8.8.8:53
        Request
        rjql4nicl6bg.live
        IN A
        Response
        rjql4nicl6bg.live
        IN A
        188.166.15.250
      • flag-us
        DNS
        4mo318kk29i4.live
        MsiExec.exe
        Remote address:
        8.8.8.8:53
        Request
        4mo318kk29i4.live
        IN A
        Response
        4mo318kk29i4.live
        IN A
        188.166.15.250
      • flag-us
        DNS
        zpo18lm8vg1x.live
        MsiExec.exe
        Remote address:
        8.8.8.8:53
        Request
        zpo18lm8vg1x.live
        IN A
        Response
        zpo18lm8vg1x.live
        IN A
        188.40.187.128
      • flag-us
        DNS
        jc51pt290y0n.live
        MsiExec.exe
        Remote address:
        8.8.8.8:53
        Request
        jc51pt290y0n.live
        IN A
        Response
        jc51pt290y0n.live
        IN A
        188.166.15.250
      • flag-us
        DNS
        rg26t2dc4hf4.live
        MsiExec.exe
        Remote address:
        8.8.8.8:53
        Request
        rg26t2dc4hf4.live
        IN A
        Response
        rg26t2dc4hf4.live
        IN A
        188.166.15.250
      • flag-us
        DNS
        qw9a58vunuja.live
        MsiExec.exe
        Remote address:
        8.8.8.8:53
        Request
        qw9a58vunuja.live
        IN A
        Response
        qw9a58vunuja.live
        IN A
        188.166.15.250
      • flag-us
        DNS
        ugm94zjzl5nl.live
        MsiExec.exe
        Remote address:
        8.8.8.8:53
        Request
        ugm94zjzl5nl.live
        IN A
        Response
        ugm94zjzl5nl.live
        IN A
        188.166.15.250
      • flag-us
        DNS
        mckag832orba.live
        MsiExec.exe
        Remote address:
        8.8.8.8:53
        Request
        mckag832orba.live
        IN A
        Response
        mckag832orba.live
        IN A
        188.166.15.250
      • flag-us
        DNS
        pdw0v9voxlxr.live
        MsiExec.exe
        Remote address:
        8.8.8.8:53
        Request
        pdw0v9voxlxr.live
        IN A
        Response
        pdw0v9voxlxr.live
        IN A
        188.166.15.250
      • flag-us
        DNS
        m4tx2apfmoxo.live
        MsiExec.exe
        Remote address:
        8.8.8.8:53
        Request
        m4tx2apfmoxo.live
        IN A
        Response
        m4tx2apfmoxo.live
        IN A
        188.166.15.250
      • flag-us
        DNS
        n2uc737ef71m.live
        MsiExec.exe
        Remote address:
        8.8.8.8:53
        Request
        n2uc737ef71m.live
        IN A
        Response
        n2uc737ef71m.live
        IN A
        188.166.15.250
      • flag-us
        DNS
        hkk3112645hz.live
        MsiExec.exe
        Remote address:
        8.8.8.8:53
        Request
        hkk3112645hz.live
        IN A
        Response
        hkk3112645hz.live
        IN A
        188.166.15.250
      • flag-us
        DNS
        ugko9g5ipa4o.live
        MsiExec.exe
        Remote address:
        8.8.8.8:53
        Request
        ugko9g5ipa4o.live
        IN A
        Response
        ugko9g5ipa4o.live
        IN A
        188.166.15.250
      • flag-us
        DNS
        8wgq2x4dybx9.live
        MsiExec.exe
        Remote address:
        8.8.8.8:53
        Request
        8wgq2x4dybx9.live
        IN A
        Response
        8wgq2x4dybx9.live
        IN A
        188.166.15.250
      • flag-us
        DNS
        h81fx7sj8srr.live
        MsiExec.exe
        Remote address:
        8.8.8.8:53
        Request
        h81fx7sj8srr.live
        IN A
        Response
        h81fx7sj8srr.live
        IN A
        188.166.15.250
      • flag-us
        DNS
        a4tgoqi1cm8x.live
        MsiExec.exe
        Remote address:
        8.8.8.8:53
        Request
        a4tgoqi1cm8x.live
        IN A
        Response
        a4tgoqi1cm8x.live
        IN A
        188.166.15.250
      • flag-us
        DNS
        kse2q7uxyrwp.live
        MsiExec.exe
        Remote address:
        8.8.8.8:53
        Request
        kse2q7uxyrwp.live
        IN A
        Response
        kse2q7uxyrwp.live
        IN A
        188.166.15.250
      • flag-us
        DNS
        mfwnbxvt9qme.live
        MsiExec.exe
        Remote address:
        8.8.8.8:53
        Request
        mfwnbxvt9qme.live
        IN A
        Response
        mfwnbxvt9qme.live
        IN A
        188.166.15.250
      • flag-us
        DNS
        x99ahfftf28l.live
        MsiExec.exe
        Remote address:
        8.8.8.8:53
        Request
        x99ahfftf28l.live
        IN A
        Response
        x99ahfftf28l.live
        IN A
        188.40.187.128
      • flag-us
        DNS
        9n6bmko47gxe.live
        MsiExec.exe
        Remote address:
        8.8.8.8:53
        Request
        9n6bmko47gxe.live
        IN A
        Response
        9n6bmko47gxe.live
        IN A
        188.166.15.250
      • flag-us
        DNS
        6l96lk6edlyf.live
        MsiExec.exe
        Remote address:
        8.8.8.8:53
        Request
        6l96lk6edlyf.live
        IN A
        Response
        6l96lk6edlyf.live
        IN A
        188.166.15.250
      • flag-us
        DNS
        st5j8zqdrppf.live
        MsiExec.exe
        Remote address:
        8.8.8.8:53
        Request
        st5j8zqdrppf.live
        IN A
        Response
        st5j8zqdrppf.live
        IN A
        188.166.15.250
      • flag-us
        DNS
        dxjeucbj4p0j.live
        MsiExec.exe
        Remote address:
        8.8.8.8:53
        Request
        dxjeucbj4p0j.live
        IN A
        Response
        dxjeucbj4p0j.live
        IN A
        188.166.15.250
      • flag-us
        DNS
        bnpuxnov7lhr.live
        MsiExec.exe
        Remote address:
        8.8.8.8:53
        Request
        bnpuxnov7lhr.live
        IN A
        Response
        bnpuxnov7lhr.live
        IN A
        188.166.15.250
      • 188.166.15.250:443
        vivh2xlt9i6q.live
        https
        MsiExec.exe
        438 B
        252 B
        6
        6
      • 188.166.15.250:443
        97t3nh4kk510.live
        https
        MsiExec.exe
        438 B
        252 B
        6
        6
      • 188.166.15.250:443
        kbkdtwucfl40.live
        https
        MsiExec.exe
        438 B
        252 B
        6
        6
      • 188.166.15.250:443
        qk6a1ahb63uz.live
        https
        MsiExec.exe
        438 B
        252 B
        6
        6
      • 188.40.187.128:443
        whko7loy7h5z.live
        https
        MsiExec.exe
        438 B
        212 B
        6
        5
      • 188.166.15.250:443
        7xwz4hw8dts9.live
        https
        MsiExec.exe
        346 B
        172 B
        4
        4
      • 188.166.15.250:443
        e7ivqfhnss0x.live
        https
        MsiExec.exe
        438 B
        252 B
        6
        6
      • 188.40.187.128:443
        zpo18lm8vg1x.live
        https
        MsiExec.exe
        484 B
        212 B
        7
        5
      • 188.166.15.250:443
        qw9a58vunuja.live
        https
        MsiExec.exe
        438 B
        252 B
        6
        6
      • 188.166.15.250:443
        pdw0v9voxlxr.live
        https
        MsiExec.exe
        438 B
        252 B
        6
        6
      • 188.166.15.250:443
        hkk3112645hz.live
        https
        MsiExec.exe
        438 B
        252 B
        6
        6
      • 188.166.15.250:443
        h81fx7sj8srr.live
        https
        MsiExec.exe
        438 B
        252 B
        6
        6
      • 188.166.15.250:443
        mfwnbxvt9qme.live
        https
        MsiExec.exe
        438 B
        252 B
        6
        6
      • 188.166.15.250:443
        6l96lk6edlyf.live
        https
        MsiExec.exe
        438 B
        252 B
        6
        6
      • 188.166.15.250:443
        bnpuxnov7lhr.live
        https
        MsiExec.exe
        346 B
        172 B
        4
        4
      • 8.8.8.8:53
        45urhm0ldgxb.live
        dns
        MsiExec.exe
        63 B
        79 B
        1
        1

        DNS Request

        45urhm0ldgxb.live

        DNS Response

        149.154.153.2

      • 8.8.8.8:53
        gx6xly9rp6vl.live
        dns
        MsiExec.exe
        63 B
        79 B
        1
        1

        DNS Request

        gx6xly9rp6vl.live

        DNS Response

        45.155.37.158

      • 8.8.8.8:53
        zv46ga4ntybq.live
        dns
        MsiExec.exe
        63 B
        79 B
        1
        1

        DNS Request

        zv46ga4ntybq.live

        DNS Response

        188.166.15.250

      • 8.8.8.8:53
        7n1hfolmrnbl.live
        dns
        MsiExec.exe
        63 B
        79 B
        1
        1

        DNS Request

        7n1hfolmrnbl.live

        DNS Response

        188.166.15.250

      • 8.8.8.8:53
        vivh2xlt9i6q.live
        dns
        MsiExec.exe
        63 B
        79 B
        1
        1

        DNS Request

        vivh2xlt9i6q.live

        DNS Response

        188.166.15.250

      • 8.8.8.8:53
        97t3nh4kk510.live
        dns
        MsiExec.exe
        63 B
        79 B
        1
        1

        DNS Request

        97t3nh4kk510.live

        DNS Response

        188.166.15.250

      • 8.8.8.8:53
        kbkdtwucfl40.live
        dns
        MsiExec.exe
        63 B
        79 B
        1
        1

        DNS Request

        kbkdtwucfl40.live

        DNS Response

        188.166.15.250

      • 8.8.8.8:53
        qk6a1ahb63uz.live
        dns
        MsiExec.exe
        63 B
        79 B
        1
        1

        DNS Request

        qk6a1ahb63uz.live

        DNS Response

        188.166.15.250

      • 8.8.8.8:53
        whko7loy7h5z.live
        dns
        MsiExec.exe
        63 B
        79 B
        1
        1

        DNS Request

        whko7loy7h5z.live

        DNS Response

        188.40.187.128

      • 8.8.8.8:53
        dad1zg44n0bn.live
        dns
        MsiExec.exe
        63 B
        79 B
        1
        1

        DNS Request

        dad1zg44n0bn.live

        DNS Response

        188.166.15.250

      • 8.8.8.8:53
        7xwz4hw8dts9.live
        dns
        MsiExec.exe
        63 B
        79 B
        1
        1

        DNS Request

        7xwz4hw8dts9.live

        DNS Response

        188.166.15.250

      • 8.8.8.8:53
        ovekd5n3gklq.live
        dns
        MsiExec.exe
        63 B
        79 B
        1
        1

        DNS Request

        ovekd5n3gklq.live

        DNS Response

        188.166.15.250

      • 8.8.8.8:53
        amwnef8mjo4v.live
        dns
        MsiExec.exe
        63 B
        79 B
        1
        1

        DNS Request

        amwnef8mjo4v.live

        DNS Response

        188.166.15.250

      • 8.8.8.8:53
        e7ivqfhnss0x.live
        dns
        MsiExec.exe
        63 B
        79 B
        1
        1

        DNS Request

        e7ivqfhnss0x.live

        DNS Response

        188.166.15.250

      • 8.8.8.8:53
        rjql4nicl6bg.live
        dns
        MsiExec.exe
        63 B
        79 B
        1
        1

        DNS Request

        rjql4nicl6bg.live

        DNS Response

        188.166.15.250

      • 8.8.8.8:53
        4mo318kk29i4.live
        dns
        MsiExec.exe
        63 B
        79 B
        1
        1

        DNS Request

        4mo318kk29i4.live

        DNS Response

        188.166.15.250

      • 8.8.8.8:53
        zpo18lm8vg1x.live
        dns
        MsiExec.exe
        63 B
        79 B
        1
        1

        DNS Request

        zpo18lm8vg1x.live

        DNS Response

        188.40.187.128

      • 8.8.8.8:53
        jc51pt290y0n.live
        dns
        MsiExec.exe
        63 B
        79 B
        1
        1

        DNS Request

        jc51pt290y0n.live

        DNS Response

        188.166.15.250

      • 8.8.8.8:53
        rg26t2dc4hf4.live
        dns
        MsiExec.exe
        63 B
        79 B
        1
        1

        DNS Request

        rg26t2dc4hf4.live

        DNS Response

        188.166.15.250

      • 8.8.8.8:53
        qw9a58vunuja.live
        dns
        MsiExec.exe
        63 B
        79 B
        1
        1

        DNS Request

        qw9a58vunuja.live

        DNS Response

        188.166.15.250

      • 8.8.8.8:53
        ugm94zjzl5nl.live
        dns
        MsiExec.exe
        63 B
        79 B
        1
        1

        DNS Request

        ugm94zjzl5nl.live

        DNS Response

        188.166.15.250

      • 8.8.8.8:53
        mckag832orba.live
        dns
        MsiExec.exe
        63 B
        79 B
        1
        1

        DNS Request

        mckag832orba.live

        DNS Response

        188.166.15.250

      • 8.8.8.8:53
        pdw0v9voxlxr.live
        dns
        MsiExec.exe
        63 B
        79 B
        1
        1

        DNS Request

        pdw0v9voxlxr.live

        DNS Response

        188.166.15.250

      • 8.8.8.8:53
        m4tx2apfmoxo.live
        dns
        MsiExec.exe
        63 B
        79 B
        1
        1

        DNS Request

        m4tx2apfmoxo.live

        DNS Response

        188.166.15.250

      • 8.8.8.8:53
        n2uc737ef71m.live
        dns
        MsiExec.exe
        63 B
        79 B
        1
        1

        DNS Request

        n2uc737ef71m.live

        DNS Response

        188.166.15.250

      • 8.8.8.8:53
        hkk3112645hz.live
        dns
        MsiExec.exe
        63 B
        79 B
        1
        1

        DNS Request

        hkk3112645hz.live

        DNS Response

        188.166.15.250

      • 8.8.8.8:53
        ugko9g5ipa4o.live
        dns
        MsiExec.exe
        63 B
        79 B
        1
        1

        DNS Request

        ugko9g5ipa4o.live

        DNS Response

        188.166.15.250

      • 8.8.8.8:53
        8wgq2x4dybx9.live
        dns
        MsiExec.exe
        63 B
        79 B
        1
        1

        DNS Request

        8wgq2x4dybx9.live

        DNS Response

        188.166.15.250

      • 8.8.8.8:53
        h81fx7sj8srr.live
        dns
        MsiExec.exe
        63 B
        79 B
        1
        1

        DNS Request

        h81fx7sj8srr.live

        DNS Response

        188.166.15.250

      • 8.8.8.8:53
        a4tgoqi1cm8x.live
        dns
        MsiExec.exe
        63 B
        79 B
        1
        1

        DNS Request

        a4tgoqi1cm8x.live

        DNS Response

        188.166.15.250

      • 8.8.8.8:53
        kse2q7uxyrwp.live
        dns
        MsiExec.exe
        63 B
        79 B
        1
        1

        DNS Request

        kse2q7uxyrwp.live

        DNS Response

        188.166.15.250

      • 8.8.8.8:53
        mfwnbxvt9qme.live
        dns
        MsiExec.exe
        63 B
        79 B
        1
        1

        DNS Request

        mfwnbxvt9qme.live

        DNS Response

        188.166.15.250

      • 8.8.8.8:53
        x99ahfftf28l.live
        dns
        MsiExec.exe
        63 B
        79 B
        1
        1

        DNS Request

        x99ahfftf28l.live

        DNS Response

        188.40.187.128

      • 8.8.8.8:53
        9n6bmko47gxe.live
        dns
        MsiExec.exe
        63 B
        79 B
        1
        1

        DNS Request

        9n6bmko47gxe.live

        DNS Response

        188.166.15.250

      • 8.8.8.8:53
        6l96lk6edlyf.live
        dns
        MsiExec.exe
        63 B
        79 B
        1
        1

        DNS Request

        6l96lk6edlyf.live

        DNS Response

        188.166.15.250

      • 8.8.8.8:53
        st5j8zqdrppf.live
        dns
        MsiExec.exe
        63 B
        79 B
        1
        1

        DNS Request

        st5j8zqdrppf.live

        DNS Response

        188.166.15.250

      • 8.8.8.8:53
        dxjeucbj4p0j.live
        dns
        MsiExec.exe
        63 B
        79 B
        1
        1

        DNS Request

        dxjeucbj4p0j.live

        DNS Response

        188.166.15.250

      • 8.8.8.8:53
        bnpuxnov7lhr.live
        dns
        MsiExec.exe
        63 B
        79 B
        1
        1

        DNS Request

        bnpuxnov7lhr.live

        DNS Response

        188.166.15.250

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\MSI6326.tmp

        Filesize

        816KB

        MD5

        aa88d8f40a286b6d40de0f3abc836cfa

        SHA1

        c24eab9e4b10b159b589f4c3b64ef3db111ea1c8

        SHA256

        8d633efeda1249356b11bf8f46583242356e4f903056b53bd25a99511d1790a1

        SHA512

        6c2f2f6a2d66015f30158962d653e381136f0f30023380a0ce95bd0944d856113fbde65db52dbb3b5de1c0e2edf2cd53184e721c64b916834be4198c61224519

      • C:\Users\Admin\AppData\Local\Temp\MSI6471.tmp

        Filesize

        877KB

        MD5

        6a639b68fe7f4e67b7510af13403772b

        SHA1

        255ba543d6fdd8f037823ff321ec00abe3575c54

        SHA256

        7118cd0d6956c84dc8ede10db84491d7884bfb0baa4a0ab96afc7eea47f46dd0

        SHA512

        43cfa4cdf669df71d7da59669ec9653c4facba4c2e6fe52deada469116b5c8b63a927a9ddc2f240ca9e1a2cc4335c12936007662bf47cd11c7e61392af219cef

      • C:\Users\Admin\AppData\Roaming\BmgqLbJUHL.dll

        Filesize

        2.1MB

        MD5

        29e117e9f0ce89cb29a3b14f39a2624b

        SHA1

        1c1060ef434826f6785ea248b647da569e83cd6a

        SHA256

        3844008c0697a64633357ba8d7088ee41e36ac321969bb442b97eb31e530e4a6

        SHA512

        757ac09a94ac4b434daeaf19509183e778208c5b82865e877ee25027080fb367a0e6a177a2ebb0e10dff1307975efb0d45b81568866bec478beca59bd822ab45

      • \Users\Admin\AppData\Roaming\Cisco Systems\Cisco Anyconnect\prerequisites\Cisco Installer\AnyConnect Installer.exe

        Filesize

        1.0MB

        MD5

        5e9965bc72df9f663ca049d40b1fa3af

        SHA1

        3fb8de364e3e67f093c1a6c73dc0cac1fd9b2202

        SHA256

        ffa9df9f2ee9b98a9c9d2edf1521d2e8b952f58e1382cc1d84964d0054564091

        SHA512

        418abf3447f885a8fee31cf367a83264eaedfa8a90cd30684f9291d9c37c402595e5f782aa8335bc081adf8f2b18b45171a52d846b48c372a00013da64b61339

      • memory/2056-42-0x00000000008D0000-0x00000000009D2000-memory.dmp

        Filesize

        1.0MB

      • memory/2992-70-0x0000000002590000-0x00000000027AE000-memory.dmp

        Filesize

        2.1MB

      • memory/2992-68-0x0000000002590000-0x00000000027AE000-memory.dmp

        Filesize

        2.1MB

      • memory/2992-71-0x0000000002590000-0x00000000027AE000-memory.dmp

        Filesize

        2.1MB

      • memory/2992-72-0x0000000002590000-0x00000000027AE000-memory.dmp

        Filesize

        2.1MB

      We care about your privacy.

      This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.