Analysis
- max time kernel
149s - max time network
147s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
02/06/2026, 01:57
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
tmp7eygw1z3.msi
Resource
win10ltsc2021-20260513-en
windows10-ltsc_2021-x64
15 signatures
150 seconds
Behavioral task
behavioral2
Sample
tmp7eygw1z3.msi
Resource
win10v2004-20260513-en
windows10-2004-x64
15 signatures
150 seconds
Behavioral task
behavioral3
Sample
tmp7eygw1z3.msi
Resource
win11-20260513-en
windows11-21h2-x64
15 signatures
150 seconds
General
- Target tmp7eygw1z3.msi
- Size 5.3MB
- Sample260602-cdl5cscw5k
- SHA256 834875b1149dde2148145b28f379c37235d4eb9671ddaeb7722b7c0e75c2aca9
- MD5 b6a96e71ad5c0f9b96b2f1d7021e4e09
- SHA1 73eabaad78c61de825ed0c8bec9e3b81f5568dbd
- SHA512 bff28c1b4b7e3ca6dbfdf44203bb06c0872e5b2e29eceea39f1669afc783527be40460d73d50ea1a9cee9583c8fd538f5b14f3481aa42cca1e0bef9da9c8a800
- SSDEEP 98304:/Hrk3bVI2OzboNeQBWkl43yRev9CcTnuKLFKcwD8OfL4vWmCP82wajDOOInENX:jsq5zboN6F9BLuuKcxOfL4vW225jDOO/
- TLSH T1534633F8A6B16EF4D32577714F8D4875CA348C1AB023CE8A761375268770B8C296DB39
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Extracted
Family
-
bumblebee
Botnet
-
10111
Attributes
-
dga
vca3utda017.click
knvop5puf3w.click
fuoor4i9488.click
e27y0btovqa.click
4td54jwr0zo.click
8u1tf686x8r.click
7rbvv9nr7ux.click
0qlcz1igan7.click
1ywg4j0oomt.click
uk2cx2bz9oh.click
mmh6zjh9rws.click
tyv7socu189.click
nu1ry3ywid2.click
qbjc9488vee.click
v8tarf4uflp.click
nubhcl6uvd6.click
pj2h7xw21zx.click
n22xrd1xrto.click
1age5rpmnbq.click
s7ebb7t79vn.click
t8vxfebri9r.click
77ch3dlvcuc.click
4k2znm7tg08.click
ie4jzevdaka.click
pweekbw7x9i.click
dg4j9l1r2ay.click
6linr1ga29p.click
ae4fgatomcn.click
i0rwy7k6rh8.click
zrvvmchlzab.click
ld6w0ra2n5v.click
0iy3kqu94si.click
a2h8x65mhmb.click
n8sbjfep5yd.click
mxnz6y6v6it.click
tj17eq1yv9p.click
ih1fzdij3lw.click
trjwgh2g6wj.click
uecqk6x4j8t.click
b2fqqlxq123.click
efu7sqzes6x.click
7avrr81op36.click
yn20wnog91u.click
gypx84c0psc.click
tiitp659yg7.click
xdfbgydlc05.click
zpz5jkazftt.click
w5o0gvbo6gz.click
u4fhmu65x9q.click
mwu8dx0r8l6.click
hwcnz0dhias.click
zj7zlpwpgk2.click
es6fj45yryo.click
vfhfp5pv5jq.click
n6uv59241o8.click
vxg5zt80xk1.click
f8vdyr368rr.click
u0hs21xo0oj.click
lk34zp37aa8.click
qbn8ng1n4y6.click
anwx8vvu2tn.click
amwy9i160dz.click
mhd2v73drk9.click
e64hgph4fpf.click
gisulurnufk.click
wsswivqef2j.click
tay4gok6gyf.click
2wbw7n1xihz.click
otuk9puv3dy.click
8ra21ma0ldn.click
6wo9w60mg4p.click
119qwh18wha.click
88crnaq8rxq.click
l52j1936qx7.click
0ffmtln7j1y.click
c2h9uj4rq5j.click
99e0wxgydv3.click
8x4zwderijh.click
aoh4pifqjfw.click
pfga45i3mid.click
6u8p3dxuusp.click
73wkg93t6yb.click
9d2285jpz2p.click
q8h20fokn7m.click
sjq07uvdff3.click
kmm14f207e0.click
96l0jwdfwsf.click
5t86twnzcmf.click
jgyffzjilwz.click
gb52rzeqsel.click
jsnwvpzo96y.click
5ijbx337vd2.click
e107j7ub2do.click
2plnxces98r.click
6r3ypuoxg63.click
kmmfsxcqiyv.click
2aecwymugah.click
s38tusi2x3c.click
lznvqhcqtqs.click
wnmatvjf2h9.click
-
dga_seed
7827833623176771557
-
domain_length
11
-
num_dga_domains
300
-
port
443
-
tld
.click
rc4.plain
Signatures
- Badlisted process makes network request 5 IoCs
Network request originating from process or tool commonly abused by malware.
flow pid Process 39 3136 rundll32.exe 41 3532 MsiExec.exe 43 3532 MsiExec.exe 45 3532 MsiExec.exe 61 1948 rundll32.exe - Executes dropped EXE 1 IoCs
pid Process 1676 ZipItNow.exe - Loads dropped DLL 35 IoCs
pid Process 1100 rundll32.exe 1676 ZipItNow.exe 1676 ZipItNow.exe 1452 MsiExec.exe 3532 MsiExec.exe 3532 MsiExec.exe 3136 rundll32.exe 3532 MsiExec.exe 3532 MsiExec.exe 3136 rundll32.exe 3136 rundll32.exe 3136 rundll32.exe 3136 rundll32.exe 3532 MsiExec.exe 3532 MsiExec.exe 1676 ZipItNow.exe 3532 MsiExec.exe 3532 MsiExec.exe 3532 MsiExec.exe 3532 MsiExec.exe 2752 rundll32.exe 2752 rundll32.exe 2752 rundll32.exe 2752 rundll32.exe 2752 rundll32.exe 2752 rundll32.exe 2752 rundll32.exe 3532 MsiExec.exe 3532 MsiExec.exe 3532 MsiExec.exe 1948 rundll32.exe 1948 rundll32.exe 1948 rundll32.exe 1948 rundll32.exe 1948 rundll32.exe - Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\G: ZipItNow.exe File opened (read-only) \??\S: ZipItNow.exe File opened (read-only) \??\X: ZipItNow.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\N: ZipItNow.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\A: ZipItNow.exe File opened (read-only) \??\E: ZipItNow.exe File opened (read-only) \??\W: ZipItNow.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\P: ZipItNow.exe File opened (read-only) \??\U: ZipItNow.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\Z: ZipItNow.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\J: ZipItNow.exe File opened (read-only) \??\L: ZipItNow.exe File opened (read-only) \??\V: ZipItNow.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\M: ZipItNow.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\H: ZipItNow.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Q: ZipItNow.exe File opened (read-only) \??\T: ZipItNow.exe - Drops file in Windows directory 41 IoCs
description ioc Process File created C:\Windows\Installer\SourceHash{A5863F7C-1873-400B-A58B-82D197645A40} msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File created C:\Windows\Installer\e58d7e0.msi msiexec.exe File opened for modification C:\Windows\Installer\SFXCA4666069A2F4A3EFA75DF506D86D797BB\Microsoft.Win32.TaskScheduler.dll rundll32.exe File opened for modification C:\Windows\Installer\SFXCA4666069A2F4A3EFA75DF506D86D797BB\WixToolset.Dtf.WindowsInstaller.dll rundll32.exe File opened for modification C:\Windows\Installer\SFXCAE223C417824A92EA3C50FD395817827B\RequestSender.dll rundll32.exe File opened for modification C:\Windows\Installer\SFXCAE223C417824A92EA3C50FD395817827B\WixToolset.Dtf.WindowsInstaller.dll rundll32.exe File opened for modification C:\Windows\Installer\SFXCAEBE821978F43E999E3623AA9F98724C9\RequestSender.dll rundll32.exe File opened for modification C:\Windows\Installer\SFXCAEBE821978F43E999E3623AA9F98724C9\CustomAction.config rundll32.exe File opened for modification C:\Windows\Installer\MSIF12D.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI2B88.tmp msiexec.exe File opened for modification C:\Windows\Installer\SFXCAE223C417824A92EA3C50FD395817827B\Microsoft.Win32.TaskScheduler.resources.dll rundll32.exe File created C:\Windows\Installer\e58d7df.msi msiexec.exe File opened for modification C:\Windows\Installer\MSIE58B.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIE938.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIECE6.tmp msiexec.exe File opened for modification C:\Windows\Installer\SFXCAEBE821978F43E999E3623AA9F98724C9\WixToolset.Dtf.WindowsInstaller.dll rundll32.exe File opened for modification C:\Windows\Installer\MSI2F42.tmp msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\MSID8D7.tmp msiexec.exe File opened for modification C:\Windows\Installer\SFXCA4666069A2F4A3EFA75DF506D86D797BB\RequestSender.dll rundll32.exe File opened for modification C:\Windows\Installer\SFXCA4666069A2F4A3EFA75DF506D86D797BB\CustomAction.config rundll32.exe File opened for modification C:\Windows\Installer\SFXCAEBE821978F43E999E3623AA9F98724C9\Microsoft.Win32.TaskScheduler.dll rundll32.exe File opened for modification C:\Windows\Installer\MSIE7B0.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIE8BA.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIEC58.tmp msiexec.exe File created C:\Windows\Installer\SourceHash{DD475EBC-D960-4AF4-BB8A-BE91FA942756} msiexec.exe File opened for modification C:\Windows\Installer\MSIE57A.tmp msiexec.exe File opened for modification C:\Windows\Installer\SFXCA4666069A2F4A3EFA75DF506D86D797BB\Microsoft.Win32.TaskScheduler.resources.dll rundll32.exe File opened for modification C:\Windows\Installer\SFXCAEBE821978F43E999E3623AA9F98724C9\Microsoft.Win32.TaskScheduler.resources.dll rundll32.exe File opened for modification C:\Windows\Installer\SFXCAE223C417824A92EA3C50FD395817827B\CustomAction.config rundll32.exe File created C:\Windows\Installer\e58d7e4.msi msiexec.exe File opened for modification C:\Windows\Installer\MSIE722.tmp msiexec.exe File opened for modification C:\Windows\Installer\e58d7dd.msi msiexec.exe File opened for modification C:\Windows\Installer\MSIEB2E.tmp msiexec.exe File created C:\Windows\Installer\e58d7dd.msi msiexec.exe File opened for modification C:\Windows\Installer\e58d7e0.msi msiexec.exe File opened for modification C:\Windows\Installer\MSIEA62.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIEDB2.tmp msiexec.exe File opened for modification C:\Windows\Installer\SFXCAE223C417824A92EA3C50FD395817827B\Microsoft.Win32.TaskScheduler.dll rundll32.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
pid Process 2872 msiexec.exe - System Location Discovery: System Language Discovery 1 TTPs 7 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language msiexec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZipItNow.exe - Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000f94cc820840d1c590000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000f94cc8200000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed35000000ffffffff000000000700010000680900f94cc820000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff350000000000000005000000ffffffff000000000700010000f8ff1af94cc820000000000000f0ff350000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1df94cc820000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe - Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 3992 msiexec.exe 3992 msiexec.exe 3992 msiexec.exe 3992 msiexec.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 2872 msiexec.exe Token: SeIncreaseQuotaPrivilege 2872 msiexec.exe Token: SeSecurityPrivilege 3992 msiexec.exe Token: SeCreateTokenPrivilege 2872 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 2872 msiexec.exe Token: SeLockMemoryPrivilege 2872 msiexec.exe Token: SeIncreaseQuotaPrivilege 2872 msiexec.exe Token: SeMachineAccountPrivilege 2872 msiexec.exe Token: SeTcbPrivilege 2872 msiexec.exe Token: SeSecurityPrivilege 2872 msiexec.exe Token: SeTakeOwnershipPrivilege 2872 msiexec.exe Token: SeLoadDriverPrivilege 2872 msiexec.exe Token: SeSystemProfilePrivilege 2872 msiexec.exe Token: SeSystemtimePrivilege 2872 msiexec.exe Token: SeProfSingleProcessPrivilege 2872 msiexec.exe Token: SeIncBasePriorityPrivilege 2872 msiexec.exe Token: SeCreatePagefilePrivilege 2872 msiexec.exe Token: SeCreatePermanentPrivilege 2872 msiexec.exe Token: SeBackupPrivilege 2872 msiexec.exe Token: SeRestorePrivilege 2872 msiexec.exe Token: SeShutdownPrivilege 2872 msiexec.exe Token: SeDebugPrivilege 2872 msiexec.exe Token: SeAuditPrivilege 2872 msiexec.exe Token: SeSystemEnvironmentPrivilege 2872 msiexec.exe Token: SeChangeNotifyPrivilege 2872 msiexec.exe Token: SeRemoteShutdownPrivilege 2872 msiexec.exe Token: SeUndockPrivilege 2872 msiexec.exe Token: SeSyncAgentPrivilege 2872 msiexec.exe Token: SeEnableDelegationPrivilege 2872 msiexec.exe Token: SeManageVolumePrivilege 2872 msiexec.exe Token: SeImpersonatePrivilege 2872 msiexec.exe Token: SeCreateGlobalPrivilege 2872 msiexec.exe Token: SeBackupPrivilege 3500 vssvc.exe Token: SeRestorePrivilege 3500 vssvc.exe Token: SeAuditPrivilege 3500 vssvc.exe Token: SeBackupPrivilege 3992 msiexec.exe Token: SeRestorePrivilege 3992 msiexec.exe Token: SeRestorePrivilege 3992 msiexec.exe Token: SeTakeOwnershipPrivilege 3992 msiexec.exe Token: SeRestorePrivilege 3992 msiexec.exe Token: SeTakeOwnershipPrivilege 3992 msiexec.exe Token: SeRestorePrivilege 3992 msiexec.exe Token: SeTakeOwnershipPrivilege 3992 msiexec.exe Token: SeRestorePrivilege 3992 msiexec.exe Token: SeTakeOwnershipPrivilege 3992 msiexec.exe Token: SeRestorePrivilege 3992 msiexec.exe Token: SeTakeOwnershipPrivilege 3992 msiexec.exe Token: SeRestorePrivilege 3992 msiexec.exe Token: SeTakeOwnershipPrivilege 3992 msiexec.exe Token: SeRestorePrivilege 3992 msiexec.exe Token: SeTakeOwnershipPrivilege 3992 msiexec.exe Token: SeRestorePrivilege 3992 msiexec.exe Token: SeTakeOwnershipPrivilege 3992 msiexec.exe Token: SeRestorePrivilege 3992 msiexec.exe Token: SeTakeOwnershipPrivilege 3992 msiexec.exe Token: SeRestorePrivilege 3992 msiexec.exe Token: SeTakeOwnershipPrivilege 3992 msiexec.exe Token: SeRestorePrivilege 3992 msiexec.exe Token: SeTakeOwnershipPrivilege 3992 msiexec.exe Token: SeRestorePrivilege 3992 msiexec.exe Token: SeTakeOwnershipPrivilege 3992 msiexec.exe Token: SeRestorePrivilege 3992 msiexec.exe Token: SeTakeOwnershipPrivilege 3992 msiexec.exe Token: SeRestorePrivilege 3992 msiexec.exe - Suspicious use of FindShellTrayWindow 5 IoCs
pid Process 2872 msiexec.exe 2872 msiexec.exe 1676 ZipItNow.exe 3328 msiexec.exe 3328 msiexec.exe - Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 3992 wrote to memory of 4456 3992 msiexec.exe 97 PID 3992 wrote to memory of 1100 3992 msiexec.exe 99 PID 3992 wrote to memory of 1676 3992 msiexec.exe 100 PID 3992 wrote to memory of 1452 3992 msiexec.exe 101 PID 1676 wrote to memory of 3328 1676 ZipItNow.exe 102 PID 3992 wrote to memory of 3532 3992 msiexec.exe 103 PID 3532 wrote to memory of 3136 3532 MsiExec.exe 104 PID 3532 wrote to memory of 2752 3532 MsiExec.exe 106 PID 3532 wrote to memory of 1948 3532 MsiExec.exe 114 - Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\tmp7eygw1z3.msi1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2872
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3992 -
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵PID:4456
-
-
C:\Windows\system32\rundll32.exe"rundll32.exe" "C:\Users\Admin\AppData\Local\Temp\ApplicationInstallationFolder_11\ZipItNow.dll",DllRegisterServer2⤵
- Loads dropped DLL
PID:1100
-
-
C:\Users\Admin\AppData\Local\Temp\ApplicationInstallationFolder_11\ZipItNow.exe"C:\Users\Admin\AppData\Local\Temp\ApplicationInstallationFolder_11\ZipItNow.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1676 -
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Roaming\Zip It Now\Zip It Now 1.4.0.0\install\7645A40\ZipItNow.msi" AI_SETUPEXEPATH=C:\Users\Admin\AppData\Local\Temp\ApplicationInstallationFolder_11\ZipItNow.exe SETUPEXEDIR=C:\Users\Admin\AppData\Local\Temp\ApplicationInstallationFolder_11\ EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1780124778 " AI_EUIMSI=""3⤵
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
PID:3328
-
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 6A0D0ED574E7F59B6A5E149F36023767 C2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1452
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding F4729B6A8FAA79B884AE37CDE3C4D0B12⤵
- Badlisted process makes network request
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3532 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Windows\Installer\MSIE57A.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240707062 3 RequestSender!RequestSender.CustomActions.Start3⤵
- Badlisted process makes network request
- Loads dropped DLL
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3136
-
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Windows\Installer\MSIEDB2.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240709062 61 RequestSender!RequestSender.CustomActions.CreateScheduledTask3⤵
- Loads dropped DLL
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2752
-
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Windows\Installer\MSI2F42.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240725875 1949 RequestSender!RequestSender.CustomActions.Finish3⤵
- Badlisted process makes network request
- Loads dropped DLL
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1948
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:3500
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Config.Msi\e58d7de.rbs
- Size 8KB
- SHA256 4d060705d7186b179b639618b1614fdf8e28ef6c31b85a7559017f897b2c8239
- MD5 303fe6fbeba1ebf7a5a536d68cd74f5f
- SHA1 8a859fcfdbf36c24477cc80ea70841d5defaf1bf
- SHA512 e805c90e96502a4884059a32ed065313372b85898fe7de1c2a489c5b5e094983216cd88caf495f7852b409a6ea940ea1f7a0cf520a7f210aa9c5bec29c77d007
- SSDEEP 96:SmOJeJEUsw28Zexc2cYaUbOTCsTl0UbOTCZcGc7wTlY62VehcYKFcwcRc/IepeuL:TIY88ZeLtiOIhiORi1ELpS
- TLSH T113021F81B79085E2D8AB1737CB5F13243B63D2DDD691234F298D86580E52BC98FE52C6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Config.Msi\e58d7e3.rbs
- Size 817KB
- SHA256 74c5bd1dbab360d2bc1656c170fe265a66a5e7c8e3d881fe13990f06d5c3d23a
- MD5 9f7e88eba6e3b545558cb123ef5ce48e
- SHA1 d632310d41d3f135c76ec0b0d2073f033f5903c5
- SHA512 6c7a86407096f7030ae526c469d7649bd97704490182dede7f3cbd2f6345605d4d5252e2666ac48755f3628ffe8812e4d6d6cce617a739599a8384b41df6f3ae
- SSDEEP 24576:XiwrZbMMERWcTnVzZujtniwrZbMMERWcTnVzZujtE:XtrpMMERbTnVzZujtntrpMMERbTnVzZz
- TLSH T104057C20759AC136D87D0930753EDA6B122D7BB00B7A84E7E7CC5AAF0970AC11635F6B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\rundll32.exe.log
- Size 939B
- SHA256 549d4c2e8009fbb2a10874de96b7d46a54beafa62e5bdca8b05aeda5efb2a7ed
- MD5 ced6c139f9a465c182d9e15ca5018661
- SHA1 c9bced4cc6f2376cfc7f1e2f5d1d60d4bec92b67
- SHA512 69486a71495a87ee81c2bbabd8a3e97061951411c2c986a1d9b893dfbd3fbc6888b1c6b0523b68e68bfd3345bca6e567ddd6f9821ed1151925bdc18c21aa33ac
- TLSH T1341199303322B5D889023F43185C658512FF4758B660EE2CB9A9221ED92A0176F322E3
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\ApplicationInstallationFolder_11\ZipItNow.dll
- Size 2.1MB
- SHA256 8c03d230f87215d048b58265d09fa256fd4c0088dc279da033854ddbf389c3e5
- MD5 a4721159fba7ebdffe823468dc858288
- SHA1 ff1a9d6dc6b008ff69d6ed16b762ba399a92c60c
- SHA512 e2258457344a366518d5b697e97eb20c5923ef08eb8533ef9ef093bd401ee2e58105431b3a8b2ebdab61db4145e4b346ed534acf428a6f97289f801277de7a77
- SSDEEP 49152:GFFCAJqL8ZgRr0Br1dmeIuEnUGmRGQhg3fDz:GFRJvZgRYBbDloD
- TLSH T18EA52289A5ECF3E5D11892BE31E261DBF5B7CB3672C35B0E5401168F9510BACF204AA7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\ApplicationInstallationFolder_11\ZipItNow.exe
- Size 4.7MB
- SHA256 956713b1bca39dc306f5402815f1258cfe4279c85c42758c0e107e5f8ee5576a
- MD5 534cd01067c81867723338b17697ee32
- SHA1 a4e5a835909c7289a3372d58d80dc539309d6736
- SHA512 df259beb1b0b30b24e02754f9da688092274c7ec7e775f8fd4b9bdfbb75a1be8f9107562568d6223fa9ee61e51f4d93f8bf9c6a83b47f1611f16a521bc5f8172
- SSDEEP 98304:9AhUCyxeAi0D4QZmrT5cKdCZVhJAh4lqlCjdganVLn3R:OeCau+SCZVMtaVjB
- TLSH T1A236CF31778AC53BD56215B16A2CDBAF51287FA20F7240C793E81E6F14B58C28732E67
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\MSIE2CB.tmp
- Size 386KB
- SHA256 bf7f6f7e527ab8617766bb7a21c21b2895b5275c0e808756c2aadcd66eff8a97
- MD5 72b1c6699ddc2baab105d32761285df2
- SHA1 fc85e9fb190f205e6752624a5231515c4ee4e155
- SHA512 cde1e754d8dfb2fa55db243517b5dd3d75b209ea6387ef2e4be6157875e536db2373f23434a9e66c119150301c7b7cdf97de5a5544d94c03247b4ae716cbc170
- SSDEEP 6144:ti1/q935N0IGlLJ9HZX9uoYcu8ugbcJZyZPAOliTVKzAZq7Y:w/qKIGlLJ9H7u8ugbYENLyVRq7Y
- TLSH T142845B2072EAC836D5BE05B03979C9AF45297EA55BF2C4EB13C81D1F09B29C25335F26
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Zip It Now\Zip It Now 1.4.0.0\install\7645A40\ZipItNow.msi
- Size 2.6MB
- SHA256 39da510263e23e8b172f460f8946f0934eeff7c1bb8aeb2f92e4439fd6eea1b8
- MD5 54f36f1b9118b35e2dbb2e0eb0c377ab
- SHA1 74c4144ec0d694d2cd047d235444ae309fc2a3aa
- SHA512 d51360bce9efa04208123df0e303c5364ad19b75fd2605ed21fe06f6e63f59c95d0595d4776292e6b0160b295873c1ce3dddf70c328fb2f85d4a83ba22efb22a
- SSDEEP 49152:khG5dYodoVG6Aq67dCWYVWzwPYCR+Q0WaQOOnk8G+uKn4mrasbUGtrpMMERbTnVg:H5dYodkAq0gWzWlLuKn4mes5JpMM8YQ
- TLSH T127D59C207696C136D4BE0570292DDA7A527D7EB00B7684DBA3C85E2F2EB09C25335F27
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Zip It Now\Zip It Now 1.4.0.0\install\7645A40\upd.exe
- Size 1.6MB
- SHA256 5ac47d4b9de6a7a45202417bfbd65501ed227a02aeae19c8a5b4e902299ef1df
- MD5 d68a0453311d9645436889d698dfd3bc
- SHA1 40a614fe230373bb4c7e9d1791cf3c1dcc56a966
- SHA512 beda42b97063edd4be7d14342e965ce214c1228ac65fd81213614d1279e33ad230e5f77beaef000b05badb3cf32bcd72df73269e29422b9697c7900c5df5dc91
- SSDEEP 24576:wJa371cyvO5Y+dHY8W1jLvJ4YyzdTLxqegEVxn0Xke23a6hLpTW+MBF8OZTCDH/:wgOQAY4W1fJ4xdEezyXpwa6hLpTCnGDf
- TLSH T10E75BE4BEAB541F0C5BAC1399542613AFCB134E64370A7CB57918B5B1B22BE4EB3E710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Zip It Now\Zip It Now 1.4.0.0\install\7645A40\zip_it_now.exe
- Size 517KB
- SHA256 941580cbad9e1c9e3e62c49a80ce2c7931ee4a931a00e36309b3b4d2f1c69907
- MD5 4a2ee83f3ad69f81df42c4e87af013f8
- SHA1 c3f65d6aabfa419d510ea5aefe0ded17e2bdee73
- SHA512 6101578090fe05568308ada1f8b65950448bde47e7e37f8d0113d1c22a2262b5cac9dfd5800cc1121dae2be37a7d1ee64c398e417d5511af8952aabbd0100308
- SSDEEP 12288:FESQRfF9BofVtWJAY3h4RMPzE5vjaIa6IkrZHJHQ:FESEd4nWGz6Pzajy8BQ
- TLSH T1BBB4D06E661803E6E058D278D946C631D572FC4647528BEF46D7FD3B3E632D22C3A288
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Zip It Now\Zip It Now 1.4.0.0\install\decoder.dll
- Size 206KB
- SHA256 9b7ff49f7e1d0a39826ec458c8004b20a65a4bd0592b083f38b01e2dbc2b510f
- MD5 9d45f2790dda55df2d99ef66dcb2019d
- SHA1 f2a369c1b82476e2e0641f95394dd4dee8223f01
- SHA512 9bef561ec6908dcd7e75f5f63cff8b1ec73e9be2b4e4aa5602182cde18d691cc28259b980c87246c5d27b4284bc783fba44d92a202f77b15f3e65c89dd3aa069
- SSDEEP 3072:DhFksRwhQlCuhUuOJ8TMoxO252xXqpg9HUP+JFkKtyNuoVL0ZhpA7Lq2VHM93LPb:9HguquwuqXaqUMkK8uoVL0ehVebsN
- TLSH T1B8247C603683C97AD66F1A30553AEA6B063D76480F20D8EBE7981D3E1E394C35735C6B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\MSIE57A.tmp
- Size 416KB
- SHA256 45608820ac1375e4490f0bb1b289745ef7183370f2411138f50a88d363f9cad0
- MD5 9d0601206bfe26161f88caf174a0771a
- SHA1 d0edc2cedaac22c56d740ee2631cd3b7c868c6bf
- SHA512 ee1c60fbc45dc73b679d895b896ab0c056b640b279a52c1fac5e95181a7128f15ce88d7cc6f6105ef33c20b01eb9016452866387328b0cc7ed07bf5c6a3de9a1
- SSDEEP 6144:Lz9G/EaiyLS/QQqHrxXMNIKTP3bDm+niQBuc4RrABCB7rN4m7PXVn/SeTdD/S:tqEahS/QQqdvKTP+gi4uc4R9GmzZSeVa
- TLSH T19A94D01079E48135E4FF2D3854384A65897FBA605B70CECFAB484DAE9D707C28A35B27
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\MSIE938.tmp
- Size 544KB
- SHA256 32211c43bcfee2ea3ae54899af178d1fc0c2b1111b2a9e3cc3fd125e1ab7daad
- MD5 40117f705bff008c3d96a73162dad044
- SHA1 2735813836f36b5de83a745c47628053a0f61f66
- SHA512 eace1d55d479c4cf5692ec1dc98a6738e94874901bebe14a0a0a93eefd00fc4bd55a701e4629a1f7c47f72ac91fe3b698d590a8463119998852e05d6682f91a4
- SSDEEP 12288:ZPLl5a0nxpqIHwLZ51wgqjVWjYiiout8/09wjmwYMNULr9VSuOzwPYUbR+B:t6+wdjwx5WLuTLBVWzwPYUbR+B
- TLSH T1B9C44A20769AC136D46D45B01AAECB6B51697FB10B7A54EBE3C85A7F09F08C20335F27
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\MSIEC58.tmp
- Size 401KB
- SHA256 8a77ed5526ecf88b81844993b5c55bdf6e056aade9c8cb3e1fd89a3b4d41a780
- MD5 ec4cd2159189ffa5d293a24e92964b6d
- SHA1 d16bbb7b4504afa4d70442e051e548372586b5d3
- SHA512 099663cd0584dce7ec17322fcecef330341a711a1d6854f57eb852650ab8272b44708f18ebf6ca0e42b2ca0ed10ad99ea7729562de553353afb615604ea19101
- SSDEEP 12288:pIS7IPlz5PiwtBZmaMwyqpYS2uryKiRL5R58MNTxhV2LQZyF9lt/:8iwrZbMMERWcTnVzZujt/
- TLSH T168947C20759AC136D87D0930753DDA6B122D3BB00B7A84E7E7CC5AAF0974AC21635F6B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\SFXCA4666069A2F4A3EFA75DF506D86D797BB\CustomAction.config
- Size 959B
- SHA256 7e1096d6f39ebe04d6e38bc714983af05ed92cc2bb4d3365ed4c85e733cb145c
- MD5 ee9a8381338b060d86c58e2415f481f3
- SHA1 200f3ed7c773f50c80644f3976e09e876f45993f
- SHA512 26b9108b9522574e08560bc45a6470f85ca149317bd763f3a357040e0f0e743fd7bfc05e0ce2d9fb52bf89e22c61d221ddf8a7163f5143848717ca3d56847ef1
- TLSH T1A311100D4A842B7724322783BFACA0C4E76090BA3D94411C749BB9151F39938176338F
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\Installer\SFXCA4666069A2F4A3EFA75DF506D86D797BB\RequestSender.dll
- Size 13KB
- SHA256 a3f2df576e23e27904150abe24b4a03c7dfa2fb52bb847ab54e8b4cd0032103d
- MD5 208affd76ff5813c6ffd74fe02780953
- SHA1 2edf070cbbd4031d470db0e68af7f36c7c68c3a3
- SHA512 9bab13a330e00a62e20957e4508e7ef2cef00187783363fdcdb23ce257e48d3ceb4a9b830f6e1b6021ecabdcb3bb3d2852b8d898b32bc506d30e7848c7fff51f
- SSDEEP 192:0fz0xy7I3V/XRXDCTqWTFpbfoFVfBzyjjL/bD6EzL+bqZeQrDq/ug:0fYxy6V/duBpbfcj2/HBxe8Wu
- TLSH T18C52E80077D88736ED7F8B3AADB106504571BBCA9927CF2F4D8C608D1E22509EA51FB6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\SFXCA4666069A2F4A3EFA75DF506D86D797BB\WixToolset.Dtf.WindowsInstaller.dll
- Size 193KB
- SHA256 a614884ea627da1925131ebf41e8ae202caeac0fe543b86384f5eb2bfaf1aa75
- MD5 ef8d5785ac8669f5fd54e22f52770e6b
- SHA1 4c94ae7ef233be33a56c0a5d9b8e2211d5d5792c
- SHA512 ab3b140bd6531f22e994606820e6511442c23d9015b1e1a38aaed43aa42ba29a996511151d0b3a383c05c2b11f670e52cdd7f507ad1a1ad8cebea57fb22ade5a
- SSDEEP 3072:8Of7tVL+l4lj19l4uDHYHj69UgoTqdda7CnfKlRUjW01KytaljYqCDPC:8gQQx54Hj6jomdrzalMqb
- TLSH T14A149C2A57F84B3ECEFF8778E2614252C7B1F1E67103DB1D9D8281A52163784B682397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\SFXCAEBE821978F43E999E3623AA9F98724C9\Microsoft.Win32.TaskScheduler.dll
- Size 325KB
- SHA256 ea27c65491119eee5c8e87ce3d470783580db8fc5bd141c496768d7d0cce779a
- MD5 0616ea42b68a8f5f2f01bcd985bdcbc7
- SHA1 88d6aae1f17b00f4391e0e7b17e98c494be73ba1
- SHA512 ce4657908615c4837084c75d806c083b8f7e63965a2e7866b8c96de7c0278a0857235b74cd9443769968165db250eba042a5b05927febff5bb70bebb7dcbd814
- SSDEEP 3072:QJA5RylsHmDFin8nhWvGzOJ1mYAFeYXxCJIrkp9TD6qaXn69aKCax8weCycJ5Dfa:ZHmDxnhWvGSJYRFeYXEee9TWqa369An
- TLSH T10A645B6117EC862EDAEF1F79F074121186B9F816B97ADB0D9A80E5DD4C23781D922333
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\e58d7dd.msi
- Size 5.3MB
- SHA256 834875b1149dde2148145b28f379c37235d4eb9671ddaeb7722b7c0e75c2aca9
- MD5 b6a96e71ad5c0f9b96b2f1d7021e4e09
- SHA1 73eabaad78c61de825ed0c8bec9e3b81f5568dbd
- SHA512 bff28c1b4b7e3ca6dbfdf44203bb06c0872e5b2e29eceea39f1669afc783527be40460d73d50ea1a9cee9583c8fd538f5b14f3481aa42cca1e0bef9da9c8a800
- SSDEEP 98304:/Hrk3bVI2OzboNeQBWkl43yRev9CcTnuKLFKcwD8OfL4vWmCP82wajDOOInENX:jsq5zboN6F9BLuuKcxOfL4vW225jDOO/
- TLSH T1534633F8A6B16EF4D32577714F8D4875CA348C1AB023CE8A761375268770B8C296DB39
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
- Size 24.1MB
- SHA256 2a0c24ac23be0c9e975add477a33394dc272eefd37a3447355bb7f75d594cdb3
- MD5 5dadc021080f4b87377fc1caf582e7b4
- SHA1 4b706d745fed58c3ec9aa8e56005ba32d9c6a3e8
- SHA512 bf44e875fde7603a303b753eb29d40738d0d74beeb1e32a6c56d6c385de7c129e073e190a3ebaa15b03ad5c414e87644412c13095e088b084fb9d74d63acbaaf
- SSDEEP 24576:uu8m+1zwdoO/vvTLrWceJG64dl0zEVMiwKmNeTtlU06tuLlBovVFk6XRp:p
- TLSH T11B47E42436F92110E7F79E3CA8F16A234D3A7D5B8C159E8D05411B4E0962FB1E872F6B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\Volume{20c84cf9-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{df573456-89ba-4eff-baab-6664a7c7a0e6}_OnDiskSnapshotProp
- Size 6KB
- SHA256 65e956fdc1228a21097ab6995eaecc9177609334cab4b00910751dd2085acdb3
- MD5 096f5c444bcb8cadd388021344a7e28e
- SHA1 3f8946bbeff4f869e342c8aba797b2fc666d30ee
- SHA512 f644c5ac0b57f240e25010220d18a4e42dd5ba2001734f2b97d506c82af2750e42cc218493244b4f4dfd2dacd40acf507c759c8c22d73b857184f10ba116d067
- SSDEEP 96:Fkh3WcAJvc8DD84LTHzbOHXOHBlBRQ88Sc9XE56tOSVQpu:6h3cb++ZVm
- TLSH T143D189085AF54711E2B3AB7129F18557A877B911EF33CB8E0298238E2671910F935F5B
- MD5 SHA1 SHA512 SSDEEP TLSH