Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
05-02-2025 04:29
Static task
static1
Behavioral task
behavioral1
Sample
f82d15eed385a7a913b98a28bce9b27a7e3611e1c0c4d9fa65741d3fdd76d23c.msi
Resource
win7-20240708-en
windows7-x64
16 signatures
150 seconds
Behavioral task
behavioral2
Sample
f82d15eed385a7a913b98a28bce9b27a7e3611e1c0c4d9fa65741d3fdd76d23c.msi
Resource
win10v2004-20250129-en
windows10-2004-x64
34 signatures
150 seconds
General
-
Target
f82d15eed385a7a913b98a28bce9b27a7e3611e1c0c4d9fa65741d3fdd76d23c.msi
-
Size
85.7MB
-
MD5
bf866d9b4395b3c819a4cd3fd639c412
-
SHA1
79b7f01af68b13036a493e25c83d80457a654c4c
-
SHA256
f82d15eed385a7a913b98a28bce9b27a7e3611e1c0c4d9fa65741d3fdd76d23c
-
SHA512
8c80f7d86d8b4df1c73b2da3cecd09f02a28b57edcf3e2597e874e549ff7cf183acb644a731ed95fb29aeea3334fc72d9144f536ad7e4868b6eec63a4bd83e13
-
SSDEEP
1572864:BWVw9CW/3bB1B68jRGRdJFqisNA6IwEU7dwq3LnEpF2UOrZ+c4CGFyzodK2aZq9:BW5SrB6uRG6iQIu5LEzVON+vCjVY
Malware Config
Extracted
Family
bumblebee
Botnet
2
Attributes
-
dga
45urhm0ldgxb.live
gx6xly9rp6vl.live
zv46ga4ntybq.live
7n1hfolmrnbl.live
vivh2xlt9i6q.live
97t3nh4kk510.live
kbkdtwucfl40.live
qk6a1ahb63uz.live
whko7loy7h5z.live
dad1zg44n0bn.live
7xwz4hw8dts9.live
ovekd5n3gklq.live
amwnef8mjo4v.live
e7ivqfhnss0x.live
rjql4nicl6bg.live
4mo318kk29i4.live
zpo18lm8vg1x.live
jc51pt290y0n.live
rg26t2dc4hf4.live
qw9a58vunuja.live
ugm94zjzl5nl.live
mckag832orba.live
pdw0v9voxlxr.live
m4tx2apfmoxo.live
n2uc737ef71m.live
hkk3112645hz.live
ugko9g5ipa4o.live
8wgq2x4dybx9.live
h81fx7sj8srr.live
a4tgoqi1cm8x.live
kse2q7uxyrwp.live
mfwnbxvt9qme.live
x99ahfftf28l.live
9n6bmko47gxe.live
6l96lk6edlyf.live
st5j8zqdrppf.live
dxjeucbj4p0j.live
bnpuxnov7lhr.live
a8bxv8lqe1m0.live
yczi2ujcyyro.live
sbeo0cztn1kh.live
o337yf9fh4bf.live
zoki7ma89z7b.live
x2r9bglz76r7.live
wi1w9yu1vush.live
mtqdvzkai700.live
r6o2sj70m85m.live
ut6qohwra5lm.live
9yi98fh7usy1.live
kkpjp9jzbzba.live
whvffwd7zphw.live
uztmazsno4y5.live
i3iubj73c21c.live
b72o02l2ilc6.live
wom4o4cutfx6.live
fek3qya20lid.live
nhkvd56j82xw.live
midyxlu6b22f.live
vp9c9rziba2a.live
rkffupb7i1gv.live
8u7r35mu2e4g.live
3c2xflq8mztc.live
wswis3sptby1.live
9rib57u1zu3c.live
sv3pldc5gkdl.live
bmdcn5celetq.live
y3mpywhmem7t.live
avwtkc23ffmw.live
nvgirtryox1z.live
3rlfa7w0bz37.live
vy9u47oyzltu.live
ysdwk0l8xass.live
tbt0aqol3sp2.live
xqqoo0a8zk0w.live
nevkq7lku38l.live
5u42wjin0vfz.live
y626kbnryktm.live
5k9b8nmc0x8r.live
i18t3jshekua.live
4hk1bcnxbse0.live
si00bu9fv5he.live
g3in90m5caz2.live
f6s4n6w41oov.live
sgl7og2qswmm.live
vrrbk7ykz8h1.live
zl7bmlfq8n9w.live
qydstwmw2imy.live
y9s73mnvurxr.live
7zggkh833im1.live
cvnsiogvl3kt.live
enf3gev34gis.live
doj6z5i9g803.live
zsm954jr5ek4.live
6z96z4mk84dc.live
e0et68offggh.live
au97foecnlrm.live
3ibjpmls5x46.live
mmmpa1byo300.live
3e60zvd64d8y.live
zt3nnzr70hn0.live
-
dga_seed
7834006444057268685
-
domain_length
12
-
num_dga_domains
300
-
port
443
rc4.plain
Signatures
-
Bumblebee family
-
Blocklisted process makes network request 42 IoCs
flow pid Process 2 2292 MsiExec.exe 3 2292 MsiExec.exe 4 2292 MsiExec.exe 5 2292 MsiExec.exe 6 2292 MsiExec.exe 7 2292 MsiExec.exe 8 2292 MsiExec.exe 9 2292 MsiExec.exe 10 2292 MsiExec.exe 11 2292 MsiExec.exe 12 2292 MsiExec.exe 13 2292 MsiExec.exe 14 2292 MsiExec.exe 15 2292 MsiExec.exe 16 2292 MsiExec.exe 17 2292 MsiExec.exe 18 2292 MsiExec.exe 19 2292 MsiExec.exe 20 2292 MsiExec.exe 21 2292 MsiExec.exe 22 2292 MsiExec.exe 23 2292 MsiExec.exe 24 2292 MsiExec.exe 25 2292 MsiExec.exe 26 2292 MsiExec.exe 27 2292 MsiExec.exe 28 2292 MsiExec.exe 29 2292 MsiExec.exe 30 2292 MsiExec.exe 31 2292 MsiExec.exe 32 2292 MsiExec.exe 33 2292 MsiExec.exe 34 2292 MsiExec.exe 35 2292 MsiExec.exe 36 2292 MsiExec.exe 37 2292 MsiExec.exe 38 2292 MsiExec.exe 39 2292 MsiExec.exe 40 2292 MsiExec.exe 41 2292 MsiExec.exe 42 2292 MsiExec.exe 43 2292 MsiExec.exe -
Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\V: msiexec.exe -
Drops file in Windows directory 11 IoCs
description ioc Process File created C:\Windows\Installer\f7785d3.msi msiexec.exe File opened for modification C:\Windows\Installer\MSI86EC.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI88C2.tmp msiexec.exe File opened for modification C:\Windows\INF\setupapi.ev3 DrvInst.exe File opened for modification C:\Windows\INF\setupapi.ev1 DrvInst.exe File opened for modification C:\Windows\INF\setupapi.dev.log DrvInst.exe File created C:\Windows\Installer\f7785d4.ipi msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File opened for modification C:\Windows\Installer\f7785d3.msi msiexec.exe File opened for modification C:\Windows\Installer\MSI864F.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI87A9.tmp msiexec.exe -
Executes dropped EXE 1 IoCs
pid Process 2928 OneDriveSetup.exe -
Loads dropped DLL 14 IoCs
pid Process 2952 MsiExec.exe 2952 MsiExec.exe 2952 MsiExec.exe 2952 MsiExec.exe 2952 MsiExec.exe 2952 MsiExec.exe 2952 MsiExec.exe 2952 MsiExec.exe 2952 MsiExec.exe 2952 MsiExec.exe 840 MsiExec.exe 840 MsiExec.exe 840 MsiExec.exe 2292 MsiExec.exe -
Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
pid Process 2272 msiexec.exe -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe -
Modifies data under HKEY_USERS 43 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\Certificates DrvInst.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CTLs DrvInst.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2792 msiexec.exe 2792 msiexec.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2272 msiexec.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 2272 msiexec.exe Token: SeIncreaseQuotaPrivilege 2272 msiexec.exe Token: SeRestorePrivilege 2792 msiexec.exe Token: SeTakeOwnershipPrivilege 2792 msiexec.exe Token: SeSecurityPrivilege 2792 msiexec.exe Token: SeCreateTokenPrivilege 2272 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 2272 msiexec.exe Token: SeLockMemoryPrivilege 2272 msiexec.exe Token: SeIncreaseQuotaPrivilege 2272 msiexec.exe Token: SeMachineAccountPrivilege 2272 msiexec.exe Token: SeTcbPrivilege 2272 msiexec.exe Token: SeSecurityPrivilege 2272 msiexec.exe Token: SeTakeOwnershipPrivilege 2272 msiexec.exe Token: SeLoadDriverPrivilege 2272 msiexec.exe Token: SeSystemProfilePrivilege 2272 msiexec.exe Token: SeSystemtimePrivilege 2272 msiexec.exe Token: SeProfSingleProcessPrivilege 2272 msiexec.exe Token: SeIncBasePriorityPrivilege 2272 msiexec.exe Token: SeCreatePagefilePrivilege 2272 msiexec.exe Token: SeCreatePermanentPrivilege 2272 msiexec.exe Token: SeBackupPrivilege 2272 msiexec.exe Token: SeRestorePrivilege 2272 msiexec.exe Token: SeShutdownPrivilege 2272 msiexec.exe Token: SeDebugPrivilege 2272 msiexec.exe Token: SeAuditPrivilege 2272 msiexec.exe Token: SeSystemEnvironmentPrivilege 2272 msiexec.exe Token: SeChangeNotifyPrivilege 2272 msiexec.exe Token: SeRemoteShutdownPrivilege 2272 msiexec.exe Token: SeUndockPrivilege 2272 msiexec.exe Token: SeSyncAgentPrivilege 2272 msiexec.exe Token: SeEnableDelegationPrivilege 2272 msiexec.exe Token: SeManageVolumePrivilege 2272 msiexec.exe Token: SeImpersonatePrivilege 2272 msiexec.exe Token: SeCreateGlobalPrivilege 2272 msiexec.exe Token: SeCreateTokenPrivilege 2272 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 2272 msiexec.exe Token: SeLockMemoryPrivilege 2272 msiexec.exe Token: SeIncreaseQuotaPrivilege 2272 msiexec.exe Token: SeMachineAccountPrivilege 2272 msiexec.exe Token: SeTcbPrivilege 2272 msiexec.exe Token: SeSecurityPrivilege 2272 msiexec.exe Token: SeTakeOwnershipPrivilege 2272 msiexec.exe Token: SeLoadDriverPrivilege 2272 msiexec.exe Token: SeSystemProfilePrivilege 2272 msiexec.exe Token: SeSystemtimePrivilege 2272 msiexec.exe Token: SeProfSingleProcessPrivilege 2272 msiexec.exe Token: SeIncBasePriorityPrivilege 2272 msiexec.exe Token: SeCreatePagefilePrivilege 2272 msiexec.exe Token: SeCreatePermanentPrivilege 2272 msiexec.exe Token: SeBackupPrivilege 2272 msiexec.exe Token: SeRestorePrivilege 2272 msiexec.exe Token: SeShutdownPrivilege 2272 msiexec.exe Token: SeDebugPrivilege 2272 msiexec.exe Token: SeAuditPrivilege 2272 msiexec.exe Token: SeSystemEnvironmentPrivilege 2272 msiexec.exe Token: SeChangeNotifyPrivilege 2272 msiexec.exe Token: SeRemoteShutdownPrivilege 2272 msiexec.exe Token: SeUndockPrivilege 2272 msiexec.exe Token: SeSyncAgentPrivilege 2272 msiexec.exe Token: SeEnableDelegationPrivilege 2272 msiexec.exe Token: SeManageVolumePrivilege 2272 msiexec.exe Token: SeImpersonatePrivilege 2272 msiexec.exe Token: SeCreateGlobalPrivilege 2272 msiexec.exe Token: SeCreateTokenPrivilege 2272 msiexec.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2272 msiexec.exe -
Suspicious use of WriteProcessMemory 23 IoCs
description pid Process procid_target PID 2792 wrote to memory of 2952 2792 msiexec.exe 32 PID 2792 wrote to memory of 2952 2792 msiexec.exe 32 PID 2792 wrote to memory of 2952 2792 msiexec.exe 32 PID 2792 wrote to memory of 2952 2792 msiexec.exe 32 PID 2792 wrote to memory of 2952 2792 msiexec.exe 32 PID 2792 wrote to memory of 2952 2792 msiexec.exe 32 PID 2792 wrote to memory of 2952 2792 msiexec.exe 32 PID 2952 wrote to memory of 2928 2952 MsiExec.exe 33 PID 2952 wrote to memory of 2928 2952 MsiExec.exe 33 PID 2952 wrote to memory of 2928 2952 MsiExec.exe 33 PID 2952 wrote to memory of 2928 2952 MsiExec.exe 33 PID 2792 wrote to memory of 840 2792 msiexec.exe 37 PID 2792 wrote to memory of 840 2792 msiexec.exe 37 PID 2792 wrote to memory of 840 2792 msiexec.exe 37 PID 2792 wrote to memory of 840 2792 msiexec.exe 37 PID 2792 wrote to memory of 840 2792 msiexec.exe 37 PID 2792 wrote to memory of 840 2792 msiexec.exe 37 PID 2792 wrote to memory of 840 2792 msiexec.exe 37 PID 2792 wrote to memory of 2292 2792 msiexec.exe 38 PID 2792 wrote to memory of 2292 2792 msiexec.exe 38 PID 2792 wrote to memory of 2292 2792 msiexec.exe 38 PID 2792 wrote to memory of 2292 2792 msiexec.exe 38 PID 2792 wrote to memory of 2292 2792 msiexec.exe 38 -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\f82d15eed385a7a913b98a28bce9b27a7e3611e1c0c4d9fa65741d3fdd76d23c.msi1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2272
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2792 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 24DB5C81B615D0AD00A42217A5D9562F C2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2952 -
C:\Users\Admin\AppData\Roaming\Microsoft\OneDrive\prerequisites\Microsoft OneDrive\OneDriveSetup.exe"C:\Users\Admin\AppData\Roaming\Microsoft\OneDrive\prerequisites\Microsoft OneDrive\OneDriveSetup.exe"3⤵
- Executes dropped EXE
PID:2928
-
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding DC3BF92E46150E2776636EB2699FA3592⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:840
-
-
C:\Windows\system32\MsiExec.exe"C:\Windows\system32\MsiExec.exe" /Y "C:\Users\Admin\AppData\Roaming\HFvlKgDlGU.dll"2⤵
- Blocklisted process makes network request
- Loads dropped DLL
PID:2292
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵PID:708
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "1" "200" "STORAGE\VolumeSnapshot\HarddiskVolumeSnapshot19" "" "" "61530dda3" "0000000000000000" "0000000000000590" "00000000000005E0"1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
PID:1840
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
816KB
MD5aa88d8f40a286b6d40de0f3abc836cfa
SHA1c24eab9e4b10b159b589f4c3b64ef3db111ea1c8
SHA2568d633efeda1249356b11bf8f46583242356e4f903056b53bd25a99511d1790a1
SHA5126c2f2f6a2d66015f30158962d653e381136f0f30023380a0ce95bd0944d856113fbde65db52dbb3b5de1c0e2edf2cd53184e721c64b916834be4198c61224519
-
Filesize
877KB
MD56a639b68fe7f4e67b7510af13403772b
SHA1255ba543d6fdd8f037823ff321ec00abe3575c54
SHA2567118cd0d6956c84dc8ede10db84491d7884bfb0baa4a0ab96afc7eea47f46dd0
SHA51243cfa4cdf669df71d7da59669ec9653c4facba4c2e6fe52deada469116b5c8b63a927a9ddc2f240ca9e1a2cc4335c12936007662bf47cd11c7e61392af219cef
-
Filesize
5.6MB
MD557349a38f042cdc28b34c9d3ba204587
SHA126617430dd8d931ce6892379791dd639afaaf05a
SHA2565b5abcbf5b08cc102d3aec8291bb1d1d1faa51ec6d09e9ba122e3e0d349a7f1c
SHA5124bf48e23a6a2401a377a6de2aa2df111cfbfb41ccfd3c6037d10a9f7587fca2f62c8a04a73d17211c690cfd850c5b66a1f6ee8d159c968e45ad54de5af2a0e1f