Analysis
- max time kernel
149s - max time network
149s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
02/06/2026, 02:00
Behavioral task
behavioral1
Sample
tmpja9f3sbs.msi
Resource
win10ltsc2021-20260513-en
windows10-ltsc_2021-x64
17 signatures
150 seconds
Behavioral task
behavioral2
Sample
tmpja9f3sbs.msi
Resource
win10v2004-20260513-en
windows10-2004-x64
17 signatures
150 seconds
Behavioral task
behavioral3
Sample
tmpja9f3sbs.msi
Resource
win11-20260513-en
windows11-21h2-x64
17 signatures
150 seconds
General
- Target tmpja9f3sbs.msi
- Size 43.7MB
- Sample260602-ce7gpabs4z
- SHA256 fc53b952c593a93f7fa73e09796d144d4b2316f7907f86c791790ed57c632320
- MD5 c431a9053f1825573b7c3685ec399338
- SHA1 051f6a19a09c2927e96244c89623dd26beec188d
- SHA512 a6c0ebb1e15eb3516c1392946068b9071337cbe8fcc2c99eab963c5e2a4c0f7fdeb991089161ad6d0b793a16ae765b99e6570f00955c97432fe952b0df7d1add
- SSDEEP 786432:OIAXENlMDo/j4WFqTXY7QLbgE/1bgRhVqGvknjvi+Rs:fAXEXMDo/EWFqTXY0LbgE564nj6+
- TLSH T14FA733BECC4EAF38CC0C0D7A50ACB88E06176D64581036D5D26E74E67BF196BACA1DD1
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Extracted
Family
-
bumblebee
Botnet
-
grp0004
Attributes
-
dga
19ak90ckxyjxc.life
o2u1xbm9xoq4p.life
9b10t4vyvx6b5.life
9nl2a1qma4swd.life
gc9fctjq62t2e.life
apsgw881ol7rs.life
rmqa3jodwcmgd.life
85ur7zivhczam.life
evzftxl2qjfj4.life
cp2br7osw928r.life
lhunevjdxw5kz.life
jbrprj8im7aia.life
rdg0u5n7237r5.life
xwn7sukhzhbqv.life
8vh7uizstjhnb.life
u8karkeeu2qtj.life
j34duklow92k3.life
8sg769rvpe1lp.life
inkja7hekgcuv.life
r4a4n001s7uhi.life
r976ptnxbh52l.life
tv9jc206cpnyd.life
xf30997j6tp8z.life
nl2jkkuqs8efp.life
5395dg0j4h79n.life
v30ty639krk3p.life
oknzqkp6ph302.life
rlq13ng659buz.life
ey9n44bwtmjaw.life
trtiqjiry7k05.life
9vgvnzk51j1sy.life
wi88w99xo9zlt.life
hoieva2gl9tzx.life
7oo4hxt5haih5.life
ey8axyn00x8sf.life
kks80hyrpbmuz.life
zom3rkt078g1k.life
n2cy5wx4nfs8n.life
qnw1tsg4ogxa0.life
84ntpl4mk4cwm.life
m5f2awao92hp9.life
nq0tsip71ecq5.life
ithg3ysseil61.life
mvp5pt36h20vf.life
51415jvbttwu4.life
l0ecv85wptocs.life
nuq0isjlua30l.life
wd7jo4d8zlxg0.life
2885patz8ovcf.life
1zwze7b6jqovz.life
s23kd323qzj2l.life
4me127ppi31at.life
eifir9x2xpqsb.life
4hlnzokni29fh.life
ykv99faqy3ky4.life
bgiphdk30zk35.life
8n3rj69ohv8rv.life
29e8eji42sktd.life
bqlbyaavprz19.life
qj2suuu4ixgvf.life
b2ys2fltibnfu.life
z0lg8lijtw3mh.life
p3arx0taom00w.life
gquyy1qf8ncn7.life
ref18bh4aku24.life
epqykfhm5zq6l.life
zw96t31o1h768.life
c45ze0b5hhvdg.life
6kjpjs3v34hbf.life
qhyut7e0tjz2a.life
5p9udlfi4yvg6.life
5ew1715l4z3ef.life
xfi23ljskvgtg.life
ofvs2a3nhyrqi.life
7o3zfbd5rf5mz.life
flewo6le618h7.life
r7rw9inm558jg.life
7qjjcy6vg835x.life
8sz83ieffpzwj.life
0eftob9vxa877.life
0j62jm3djgxe7.life
v2vijxyqbqsbl.life
vuu79f2ne8xl1.life
ew3crbjgfbbhd.life
lqhhfpiqp5chx.life
f3be5ccj5ioc7.life
1ngmbwokqkiov.life
nh0hujf2w5xi9.life
daxbkb16ebdao.life
m4ivqiz0weqy7.life
0ei4jxf0cszgd.life
54zgxvq8jzq81.life
tesc2obtfbdke.life
w1nd36e506qqi.life
fc4v5wx4p4syq.life
43wubiwvmajs3.life
4w1b7rsnyg3sm.life
h8gw0cbhkkrrf.life
k2yu4bhadklet.life
wqfvb1lom02cg.life
-
dga_seed
7941704092191845612
-
domain_length
13
-
num_dga_domains
300
-
port
443
-
tld
.life
rc4.plain
Signatures
- Executes dropped EXE 3 IoCs
pid Process 2752 icardagt.exe 4956 NetCrunchTools2.exe 3772 NetCrunchTools2.tmp - Loads dropped DLL 1 IoCs
pid Process 2752 icardagt.exe - Badlisted process makes network request 3 IoCs
Network request originating from process or tool commonly abused by malware.
flow pid Process 4 3548 msiexec.exe 7 3548 msiexec.exe 19 3548 msiexec.exe - Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\A: msiexec.exe - Drops file in Windows directory 8 IoCs
description ioc Process File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File created C:\Windows\Installer\e587be4.msi msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File created C:\Windows\Installer\SourceHash{DD475EBC-D961-4AF4-BB8A-BE91FA942757} msiexec.exe File opened for modification C:\Windows\Installer\MSI7EFF.tmp msiexec.exe File created C:\Windows\Installer\e587be2.msi msiexec.exe File opened for modification C:\Windows\Installer\e587be2.msi msiexec.exe - Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
pid Process 3548 msiexec.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NetCrunchTools2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NetCrunchTools2.tmp - Inno Setup is an open-source installation builder for Windows applications. 3 IoCs
Inno Setup installer
resource yara_rule behavioral2/files/0x00070000000245b2-38.dat innosetup behavioral2/memory/4956-43-0x0000000000400000-0x0000000000481000-memory.dmp innosetup behavioral2/memory/4956-60-0x0000000000400000-0x0000000000481000-memory.dmp innosetup - Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 000000000400000020c8f0fe5d92f37a0000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff00000000270101000008000020c8f0fe0000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed35000000ffffffff00000000070001000068090020c8f0fe000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff350000000000000005000000ffffffff000000000700010000f8ff1a20c8f0fe000000000000f0ff350000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d20c8f0fe000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe - Modifies data under HKEY_USERS 10 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft NetCrunchTools2.tmp Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager NetCrunchTools2.tmp Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\SessionHash = ee2b15e0e14f7dbf9b2ddc4702b08ce724fcfe77334127bf5175ebbd4ca7b407 NetCrunchTools2.tmp Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000 NetCrunchTools2.tmp Key created \REGISTRY\USER\.DEFAULT\Software NetCrunchTools2.tmp Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\Owner = bc0e0000e7ea86ac33f2dc01 NetCrunchTools2.tmp Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\Sequence = "1" NetCrunchTools2.tmp Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28 msiexec.exe - Modifies registry class 20 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CBE574DD169D4FA4BBA8EB19AF497275\AdvertiseFlags = "388" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CBE574DD169D4FA4BBA8EB19AF497275\DeploymentFlags = "3" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CBE574DD169D4FA4BBA8EB19AF497275\SourceList\Net msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CBE574DD169D4FA4BBA8EB19AF497275\Clients = 3a0000000000 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\CBE574DD169D4FA4BBA8EB19AF497275\AppLicense msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CBE574DD169D4FA4BBA8EB19AF497275 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CBE574DD169D4FA4BBA8EB19AF497275\PackageCode = "0C7BB555AEF91984FBB6379143A8D37D" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CBE574DD169D4FA4BBA8EB19AF497275\InstanceType = "0" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CBE574DD169D4FA4BBA8EB19AF497275\SourceList\PackageName = "tmpja9f3sbs.msi" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CBE574DD169D4FA4BBA8EB19AF497275\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\CBE574DD169D4FA4BBA8EB19AF497275 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CBE574DD169D4FA4BBA8EB19AF497275\ProductName = "NetCrunch" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CBE574DD169D4FA4BBA8EB19AF497275\AuthorizedLUAApp = "0" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CBE574DD169D4FA4BBA8EB19AF497275\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CBE574DD169D4FA4BBA8EB19AF497275\Version = "16777216" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CBE574DD169D4FA4BBA8EB19AF497275\Assignment = "1" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CBE574DD169D4FA4BBA8EB19AF497275\SourceList msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CBE574DD169D4FA4BBA8EB19AF497275\SourceList\Media msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CBE574DD169D4FA4BBA8EB19AF497275\SourceList\Media\1 = ";" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CBE574DD169D4FA4BBA8EB19AF497275\Language = "1033" msiexec.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4860 msiexec.exe 4860 msiexec.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 3548 msiexec.exe Token: SeIncreaseQuotaPrivilege 3548 msiexec.exe Token: SeSecurityPrivilege 4860 msiexec.exe Token: SeCreateTokenPrivilege 3548 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 3548 msiexec.exe Token: SeLockMemoryPrivilege 3548 msiexec.exe Token: SeIncreaseQuotaPrivilege 3548 msiexec.exe Token: SeMachineAccountPrivilege 3548 msiexec.exe Token: SeTcbPrivilege 3548 msiexec.exe Token: SeSecurityPrivilege 3548 msiexec.exe Token: SeTakeOwnershipPrivilege 3548 msiexec.exe Token: SeLoadDriverPrivilege 3548 msiexec.exe Token: SeSystemProfilePrivilege 3548 msiexec.exe Token: SeSystemtimePrivilege 3548 msiexec.exe Token: SeProfSingleProcessPrivilege 3548 msiexec.exe Token: SeIncBasePriorityPrivilege 3548 msiexec.exe Token: SeCreatePagefilePrivilege 3548 msiexec.exe Token: SeCreatePermanentPrivilege 3548 msiexec.exe Token: SeBackupPrivilege 3548 msiexec.exe Token: SeRestorePrivilege 3548 msiexec.exe Token: SeShutdownPrivilege 3548 msiexec.exe Token: SeDebugPrivilege 3548 msiexec.exe Token: SeAuditPrivilege 3548 msiexec.exe Token: SeSystemEnvironmentPrivilege 3548 msiexec.exe Token: SeChangeNotifyPrivilege 3548 msiexec.exe Token: SeRemoteShutdownPrivilege 3548 msiexec.exe Token: SeUndockPrivilege 3548 msiexec.exe Token: SeSyncAgentPrivilege 3548 msiexec.exe Token: SeEnableDelegationPrivilege 3548 msiexec.exe Token: SeManageVolumePrivilege 3548 msiexec.exe Token: SeImpersonatePrivilege 3548 msiexec.exe Token: SeCreateGlobalPrivilege 3548 msiexec.exe Token: SeBackupPrivilege 2008 vssvc.exe Token: SeRestorePrivilege 2008 vssvc.exe Token: SeAuditPrivilege 2008 vssvc.exe Token: SeBackupPrivilege 4860 msiexec.exe Token: SeRestorePrivilege 4860 msiexec.exe Token: SeRestorePrivilege 4860 msiexec.exe Token: SeTakeOwnershipPrivilege 4860 msiexec.exe Token: SeRestorePrivilege 4860 msiexec.exe Token: SeTakeOwnershipPrivilege 4860 msiexec.exe Token: SeRestorePrivilege 4860 msiexec.exe Token: SeTakeOwnershipPrivilege 4860 msiexec.exe Token: SeRestorePrivilege 4860 msiexec.exe Token: SeTakeOwnershipPrivilege 4860 msiexec.exe Token: SeRestorePrivilege 4860 msiexec.exe Token: SeTakeOwnershipPrivilege 4860 msiexec.exe Token: SeRestorePrivilege 4860 msiexec.exe Token: SeTakeOwnershipPrivilege 4860 msiexec.exe Token: SeRestorePrivilege 4860 msiexec.exe Token: SeTakeOwnershipPrivilege 4860 msiexec.exe Token: SeRestorePrivilege 4860 msiexec.exe Token: SeTakeOwnershipPrivilege 4860 msiexec.exe Token: SeRestorePrivilege 4860 msiexec.exe Token: SeTakeOwnershipPrivilege 4860 msiexec.exe Token: SeRestorePrivilege 4860 msiexec.exe Token: SeTakeOwnershipPrivilege 4860 msiexec.exe Token: SeRestorePrivilege 4860 msiexec.exe Token: SeTakeOwnershipPrivilege 4860 msiexec.exe Token: SeRestorePrivilege 4860 msiexec.exe Token: SeTakeOwnershipPrivilege 4860 msiexec.exe Token: SeRestorePrivilege 4860 msiexec.exe Token: SeTakeOwnershipPrivilege 4860 msiexec.exe Token: SeRestorePrivilege 4860 msiexec.exe - Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 3548 msiexec.exe 3548 msiexec.exe - Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 4860 wrote to memory of 4984 4860 msiexec.exe 104 PID 4860 wrote to memory of 2752 4860 msiexec.exe 106 PID 4860 wrote to memory of 4956 4860 msiexec.exe 107 PID 4956 wrote to memory of 3772 4956 NetCrunchTools2.exe 108 - Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\tmpja9f3sbs.msi1⤵
- Badlisted process makes network request
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3548
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4860 -
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵PID:4984
-
-
C:\Users\Admin\AppData\Local\Temp\ApplicationInstallationFolder_11\icardagt.exe"C:\Users\Admin\AppData\Local\Temp\ApplicationInstallationFolder_11\icardagt.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2752
-
-
C:\Users\Admin\AppData\Local\Temp\ApplicationInstallationFolder_11\NetCrunchTools2.exe"C:\Users\Admin\AppData\Local\Temp\ApplicationInstallationFolder_11\NetCrunchTools2.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4956 -
C:\Users\Admin\AppData\Local\Temp\is-9IEQI.tmp\NetCrunchTools2.tmp"C:\Users\Admin\AppData\Local\Temp\is-9IEQI.tmp\NetCrunchTools2.tmp" /SL5="$D0224,43311050,486912,C:\Users\Admin\AppData\Local\Temp\ApplicationInstallationFolder_11\NetCrunchTools2.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
PID:3772
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:2008
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Config.Msi\e587be3.rbs
- Size 7KB
- SHA256 2e4ca9759d42ccbc48f881e3c422726221d04a749d2c9e90dfcef3a1602adef3
- MD5 9007607b72f444d157c0d690b4a8a4b9
- SHA1 48921b12a77640da64ccc7b06303d3b19b636850
- SHA512 54e2fb2c6211bb3f2ce43bb34fab9f0c828cef623123833bdf75f382d8614af404360a91d183036cd885a79c667621aebd6e793572f9183121cda29cc8ca4f7d
- SSDEEP 96:TmWXJ6JEUjMwp8ZeP4/faMaUbWTTCsTlqUbWTTCWd/3TlrfA5UhZWXuLJ1HwCMpD:KcE98ZeGtgOIbgOA+kZx1H3MpD
- TLSH T189F13F41B31181E2EC96573ACB0B275637A3D3DDD7D0230F09CD92686E5278A5FE228A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\357F04AD41BCF5FE18FCB69F60C6680F_33E4C7534F38E75439A639B049B41DA3
- Size 1KB
- SHA256 b09b91192ee8acd3ff8773295c225a94738142016d0274f995be6607e490e4db
- MD5 e2e75b94041d085d1ce54f2b781ef516
- SHA1 5c0bdbc781d9198a0fa393c403bdd41ba2f2f53e
- SHA512 91fd97a988c23fed6be4505361a1cc66bfe12204930d0cf1f7da6eef62276d86a8ef84ace186626236c956f7e5841bfce90ec7874a3dafd3cacd2415b16b72e7
- TLSH T11831DBCD191E3DC3A98BCE349CC6A4057D3CA5F06DDCA512152B916574403E36F7A05A
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\9CB4373A4252DE8D2212929836304EC5_1AB74AA2E3A56E1B8AD8D3FEC287554E
- Size 1KB
- SHA256 b35260221236e2997429a3d05d79273d0e1944bd47e9e065b9e0b3d88c2b0ddd
- MD5 a74993266a1bc95bb82f4a1417f3d34a
- SHA1 933edfe02e1aff2a934902f8b1ee215324e062d2
- SHA512 a25fc9b33736bf77fa2701ec6f3d18c090fab6c0977c72c4c5ee23d1c4a85cfa448a71b8b4e2016b629045e965c29b0fa28dcdab2cc635823962fb8486d79b28
- TLSH T1A1311A274F2E6921CF228D8415C6F9322970E9D22CEA246A7218EA0B2884BB34F1554B
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\357F04AD41BCF5FE18FCB69F60C6680F_33E4C7534F38E75439A639B049B41DA3
- Size 536B
- SHA256 719df0878e4a87f7c815000a856e60237e4cfaa82714588cdbea367b8f9ac4ca
- MD5 8c8d11d45077dab4126410808f1a33d7
- SHA1 66b310d4cf7c2b463d5acecf5ceb45ee71240581
- SHA512 d72897638463da27a5f9ace8c3ef9df0b28aaca64896d7cc5966769c439acccac2b8f1bb8973c1d34cd57dd27f1b410884d1f93f6c29dbec51c9afc6a6ae1285
- TLSH T13FF0973058FA011EF075DE380BC5A6EA8D6AFE1725305A151D79430ABD22E802E53A3E
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\9CB4373A4252DE8D2212929836304EC5_1AB74AA2E3A56E1B8AD8D3FEC287554E
- Size 536B
- SHA256 5a88b1f53d4479aa9a8dbcd7cb27fa9a38078a9bd6474a05b742124f3fba0699
- MD5 659e0b69e19d444f377fe8a5de0e164c
- SHA1 55c93e54a219677dc71464d9e53d78fdac555550
- SHA512 0f06d5f08f24aafe5b769ec92a9132a3e5745f8ff0501c580fe01922b98d1a591e2585cc681eef187438727a4578b37eba5dd52d42f604d76b9e2b5c41a6bbb7
- TLSH T148F0DC0C48F5422EF0B6DD7A0DF8A812991AF9031824962E02A04B0E3D20F00AD2652D
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\ApplicationInstallationFolder_11\NetCrunchTools2.exe
- Size 41.7MB
- SHA256 63a0032cdd664708f493a4c15e52c35619d9180477d575fab08a5f1ffa2dc70e
- MD5 aaf66d2abb7e9bd38027779e5a80299e
- SHA1 a45c45bc14fb0bec2c099000b3bd38c544715536
- SHA512 b78dd5a6e8470ea2ac89dca99c597046be2cbede3bf3f3a988ba9ded039eac2430c0c2936c8a232590e43c9cfe9738abe9e120dbed40000ef7a2b566c20963e5
- SSDEEP 786432:5KvLeHVjdnNJPmyhENfnen8Yf6DM7Taj4GIa1:kvLe1jdnN1myhENfen8Yf70r1
- TLSH T173A733BC8C16A7B3D9182430A4A48CC05D32BD8431E879D26D77FF9D29749C7D429ABB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\ApplicationInstallationFolder_11\icardagt.exe
- Size 1.3MB
- SHA256 473d17e571d6947ce93103454f1e9fe27136403125152b97acb6cad5cc2a9ac7
- MD5 2fe97a3052e847190a9775431292a3a3
- SHA1 43edc451ac97365600391fa4af15476a30423ff6
- SHA512 93ed1f9ef6fb256b53df9c6f2ce03301c0d3a0ef49c3f0604872653e4ba3fce369256f50604dd8386f543e1ea9231f5700213e683d3ea9af9e4d6c427a19117a
- SSDEEP 12288:pvRneDBcP5s/UdTEQa8DOmJRJmILwCHEA188KijZZLr0X+c/d2zlNRTSTNo7I8:phe4kRQa8DO6JmJCvrKimZ4zlNRTST38
- TLSH T1D955F969F97C4176E121D4BFD183DA4AD1B230422B305AE74262CF6E1E3F5D6A13A732
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\ApplicationInstallationFolder_11\version.dll
- Size 2.7MB
- SHA256 a09923899b318848d44dc706ccc1d3489a383b9af0921351134d14a152a7925b
- MD5 18689fd0311a64a712a313d58fccbbfe
- SHA1 c135d29186faa04602d90e96d17aaf58fe16b8f7
- SHA512 3a7d0129da9d079f4cf5266b3c70ea950ed852b3573abae9aadd9eab1db68dea330eac5ed23c78426ea1bffd5d75aa416b2d2ce39349bafccea9e429301212e0
- SSDEEP 49152:/yCl4fYhi7rch+A0UiepgqALMwajmaPUDiLIscxgyLGURN+y4J:/R/Pge0bLGUS9
- TLSH T1ADD58D0A2B3B4A5ED521C4BD92771223C469BDFCC018B5798DC04B457FA2F60A67A7EC
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\is-9IEQI.tmp\NetCrunchTools2.tmp
- Size 1.5MB
- SHA256 4b656f22388ef8577af2084b973e3438164a3b66ab53b6a9622a708890439df9
- MD5 59a325063285a02a0a430cf4aaf42865
- SHA1 1891d52937a20e2def65ed4ef58ceb3f0981cf3c
- SHA512 9145070c5a81878673e2a7240eb00bc805371455c7d658395875ab9998de9814367e1cc481f579c7c2557a66fc14dbb9995228baeeb89b64b392f7e6b6191b09
- SSDEEP 24576:11VqyG3T/+ofiDIZE2kChYYmpY9a2nWEdEC6GnJJ3GZ7lInLGjjvx9X:fQdhZgEN6GnJa7lICjV
- TLSH T10C754C25A6518633D5312A30DC6AC9C45835BD103AF8E9C67DB6FF5C1D38BC2A8253BB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\e587be2.msi
- Size 43.7MB
- SHA256 fc53b952c593a93f7fa73e09796d144d4b2316f7907f86c791790ed57c632320
- MD5 c431a9053f1825573b7c3685ec399338
- SHA1 051f6a19a09c2927e96244c89623dd26beec188d
- SHA512 a6c0ebb1e15eb3516c1392946068b9071337cbe8fcc2c99eab963c5e2a4c0f7fdeb991089161ad6d0b793a16ae765b99e6570f00955c97432fe952b0df7d1add
- SSDEEP 786432:OIAXENlMDo/j4WFqTXY7QLbgE/1bgRhVqGvknjvi+Rs:fAXEXMDo/EWFqTXY0LbgE564nj6+
- TLSH T14FA733BECC4EAF38CC0C0D7A50ACB88E06176D64581036D5D26E74E67BF196BACA1DD1
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
- Size 24.1MB
- SHA256 028ea4d4fa076ba534a394cf7511df3cf155c9752d043304b5156c922356e006
- MD5 638746f1e621ccade7a68d33e58854f9
- SHA1 e1c86628d4878418ac6407ab9c31ef0dcf4ccc6a
- SHA512 66b7d9c0d7ffd5bec5466062ea5bb3494e74b101bdbc0d2d2d530c9235495f7694ac849e1fa797e317129b4de4ba524aa572e2db41076c565b093a2fe7b7f1fd
- SSDEEP 24576:1u8m+1z3doO/vvTL7WBeU26FA4kDJFhitHmNjegl5Uqwe2YMYvlYpXqhU:p
- TLSH T10947D22432F92510E7F39E3CA8F1AA2389397D579C199E8D05411F4E0961FB1E872F6B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\Volume{fef0c820-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{674621db-9f9b-4424-b555-a68397447010}_OnDiskSnapshotProp
- Size 6KB
- SHA256 0aad6430daee2d9a8d60ddd5fb7d842cbafec3389c12bb8908e49f2b57d88761
- MD5 9f951371c0e5b4e89e09e38c589dda2e
- SHA1 e146cb0306cb688c9378fa58952cad6696a4ee6c
- SHA512 55b2ab98b71a06fc678f2c930851e5121e1ff7a16567469931448d22d2518b86466dce3b36004bc18ec6b1ac39e8722e1ef029cdeda5165610ca012a69a08422
- SSDEEP 96:FcoMulSvc8DD84LTHzbOHXOHBlBRQ88Sc9XE56tOSVQpuN:KXb++ZVmN
- TLSH T17CD19A085AF54711E2B3AB7129F18557A877B911EF33CB8E0198238E2670910F976F6F
- MD5 SHA1 SHA512 SSDEEP TLSH