bumblebee | fc53b952c593a93f7fa73e09796d144d4b2316f7907f86c791790ed57c632320

Analysis

max time kernel
150s
max time network
152s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
02/06/2026, 02:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
tmpja9f3sbs.msi
Size 43.7MB
Sample260602-ce7gpabs4z
SHA256 fc53b952c593a93f7fa73e09796d144d4b2316f7907f86c791790ed57c632320
MD5 c431a9053f1825573b7c3685ec399338
SHA1 051f6a19a09c2927e96244c89623dd26beec188d
SHA512 a6c0ebb1e15eb3516c1392946068b9071337cbe8fcc2c99eab963c5e2a4c0f7fdeb991089161ad6d0b793a16ae765b99e6570f00955c97432fe952b0df7d1add
SSDEEP 786432:OIAXENlMDo/j4WFqTXY7QLbgE/1bgRhVqGvknjvi+Rs:fAXEXMDo/EWFqTXY0LbgE564nj6+
TLSH
T14FA733BECC4EAF38CC0C0D7A50ACB88E06176D64581036D5D26E74E67BF196BACA1DD1
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

grp0004 discovery bumblebee installer loader persistence privilege_escalation ransomware

Malware Config

Extracted

Family

bumblebee

Botnet

grp0004

Attributes

dga
19ak90ckxyjxc.life

o2u1xbm9xoq4p.life

9b10t4vyvx6b5.life

9nl2a1qma4swd.life

gc9fctjq62t2e.life

apsgw881ol7rs.life

rmqa3jodwcmgd.life

85ur7zivhczam.life

evzftxl2qjfj4.life

cp2br7osw928r.life

lhunevjdxw5kz.life

jbrprj8im7aia.life

rdg0u5n7237r5.life

xwn7sukhzhbqv.life

8vh7uizstjhnb.life

u8karkeeu2qtj.life

j34duklow92k3.life

8sg769rvpe1lp.life

inkja7hekgcuv.life

r4a4n001s7uhi.life

r976ptnxbh52l.life

tv9jc206cpnyd.life

xf30997j6tp8z.life

nl2jkkuqs8efp.life

5395dg0j4h79n.life

v30ty639krk3p.life

oknzqkp6ph302.life

rlq13ng659buz.life

ey9n44bwtmjaw.life

trtiqjiry7k05.life

9vgvnzk51j1sy.life

wi88w99xo9zlt.life

hoieva2gl9tzx.life

7oo4hxt5haih5.life

ey8axyn00x8sf.life

kks80hyrpbmuz.life

zom3rkt078g1k.life

n2cy5wx4nfs8n.life

qnw1tsg4ogxa0.life

84ntpl4mk4cwm.life

m5f2awao92hp9.life

nq0tsip71ecq5.life

ithg3ysseil61.life

mvp5pt36h20vf.life

51415jvbttwu4.life

l0ecv85wptocs.life

nuq0isjlua30l.life

wd7jo4d8zlxg0.life

2885patz8ovcf.life

1zwze7b6jqovz.life

s23kd323qzj2l.life

4me127ppi31at.life

eifir9x2xpqsb.life

4hlnzokni29fh.life

ykv99faqy3ky4.life

bgiphdk30zk35.life

8n3rj69ohv8rv.life

29e8eji42sktd.life

bqlbyaavprz19.life

qj2suuu4ixgvf.life

b2ys2fltibnfu.life

z0lg8lijtw3mh.life

p3arx0taom00w.life

gquyy1qf8ncn7.life

ref18bh4aku24.life

epqykfhm5zq6l.life

zw96t31o1h768.life

c45ze0b5hhvdg.life

6kjpjs3v34hbf.life

qhyut7e0tjz2a.life

5p9udlfi4yvg6.life

5ew1715l4z3ef.life

xfi23ljskvgtg.life

ofvs2a3nhyrqi.life

7o3zfbd5rf5mz.life

flewo6le618h7.life

r7rw9inm558jg.life

7qjjcy6vg835x.life

8sz83ieffpzwj.life

0eftob9vxa877.life

0j62jm3djgxe7.life

v2vijxyqbqsbl.life

vuu79f2ne8xl1.life

ew3crbjgfbbhd.life

lqhhfpiqp5chx.life

f3be5ccj5ioc7.life

1ngmbwokqkiov.life

nh0hujf2w5xi9.life

daxbkb16ebdao.life

m4ivqiz0weqy7.life

0ei4jxf0cszgd.life

54zgxvq8jzq81.life

tesc2obtfbdke.life

w1nd36e506qqi.life

fc4v5wx4p4syq.life

43wubiwvmajs3.life

4w1b7rsnyg3sm.life

h8gw0cbhkkrrf.life

k2yu4bhadklet.life

wqfvb1lom02cg.life
dga_seed
7941704092191845612
domain_length
13
num_dga_domains
300
port
443
tld
.life

rc4.plain

Signatures

Family: BumbleBee
BumbleBee is a loader malware written in C++.
loader bumblebee

Executes dropped EXE 3 IoCs

pid	Process
4084	icardagt.exe
4636	NetCrunchTools2.exe
236	NetCrunchTools2.tmp

Loads dropped DLL 1 IoCs

pid	Process
4084	icardagt.exe

Badlisted process makes network request 3 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
2	4228	msiexec.exe
3	4228	msiexec.exe
4	4228	msiexec.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe

Drops file in Windows directory 12 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\e586bb5.msi	msiexec.exe
File created	C:\Windows\SystemTemp\~DFD2F742BBED8753AF.TMP	msiexec.exe
File created	C:\Windows\Installer\e586bb7.msi	msiexec.exe
File created	C:\Windows\SystemTemp\~DF6DA39EE307B99ACA.TMP	msiexec.exe
File created	C:\Windows\Installer\e586bb5.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{DD475EBC-D961-4AF4-BB8A-BE91FA942757}	msiexec.exe
File created	C:\Windows\SystemTemp\~DF30A3EC7F6FDDFBD1.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI6E74.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DFD4F14240734E54E2.TMP	msiexec.exe

Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs

persistence privilege_escalation

Installer Packages

T1546.016

Msiexec

T1218.007

pid	Process
4228	msiexec.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NetCrunchTools2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NetCrunchTools2.tmp

Inno Setup is an open-source installation builder for Windows applications. 3 IoCs

Inno Setup installer

installer

resource	yara_rule
behavioral3/files/0x001900000002b4d7-32.dat	innosetup
behavioral3/memory/4636-36-0x0000000000400000-0x0000000000481000-memory.dmp	innosetup
behavioral3/memory/4636-60-0x0000000000400000-0x0000000000481000-memory.dmp	innosetup

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000588ba66725cf3d120000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000588ba6670000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed35000000ffffffff000000000700010000680900588ba667000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff350000000000000005000000ffffffff000000000700010000f8ff1a588ba667000000000000f0ff350000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d588ba667000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe

Modifies data under HKEY_USERS 10 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager	NetCrunchTools2.tmp
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\Owner = ec0000000dac7da933f2dc01	NetCrunchTools2.tmp
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\Sequence = "1"	NetCrunchTools2.tmp
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	NetCrunchTools2.tmp
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	NetCrunchTools2.tmp
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\SessionHash = 8a428137f9bf73e9bf0f5ef9539afd86eb313ebf18bfdd25db81981d2d5b639b	NetCrunchTools2.tmp
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000	NetCrunchTools2.tmp

Modifies registry class 20 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CBE574DD169D4FA4BBA8EB19AF497275\Version = "16777216"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CBE574DD169D4FA4BBA8EB19AF497275\DeploymentFlags = "3"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CBE574DD169D4FA4BBA8EB19AF497275\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CBE574DD169D4FA4BBA8EB19AF497275\PackageCode = "0C7BB555AEF91984FBB6379143A8D37D"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CBE574DD169D4FA4BBA8EB19AF497275\InstanceType = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CBE574DD169D4FA4BBA8EB19AF497275\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CBE574DD169D4FA4BBA8EB19AF497275\SourceList\PackageName = "tmpja9f3sbs.msi"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CBE574DD169D4FA4BBA8EB19AF497275\SourceList\Media\1 = ";"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CBE574DD169D4FA4BBA8EB19AF497275\ProductName = "NetCrunch"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CBE574DD169D4FA4BBA8EB19AF497275\Assignment = "1"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CBE574DD169D4FA4BBA8EB19AF497275\AdvertiseFlags = "388"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CBE574DD169D4FA4BBA8EB19AF497275\SourceList\Net	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CBE574DD169D4FA4BBA8EB19AF497275\SourceList\Media	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CBE574DD169D4FA4BBA8EB19AF497275\Clients = 3a0000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CBE574DD169D4FA4BBA8EB19AF497275\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\CBE574DD169D4FA4BBA8EB19AF497275	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\CBE574DD169D4FA4BBA8EB19AF497275\AppLicense	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CBE574DD169D4FA4BBA8EB19AF497275\AuthorizedLUAApp = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CBE574DD169D4FA4BBA8EB19AF497275	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CBE574DD169D4FA4BBA8EB19AF497275\Language = "1033"	msiexec.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3736	msiexec.exe
3736	msiexec.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4228	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4228	msiexec.exe
Token: SeSecurityPrivilege	3736	msiexec.exe
Token: SeCreateTokenPrivilege	4228	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	4228	msiexec.exe
Token: SeLockMemoryPrivilege	4228	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4228	msiexec.exe
Token: SeMachineAccountPrivilege	4228	msiexec.exe
Token: SeTcbPrivilege	4228	msiexec.exe
Token: SeSecurityPrivilege	4228	msiexec.exe
Token: SeTakeOwnershipPrivilege	4228	msiexec.exe
Token: SeLoadDriverPrivilege	4228	msiexec.exe
Token: SeSystemProfilePrivilege	4228	msiexec.exe
Token: SeSystemtimePrivilege	4228	msiexec.exe
Token: SeProfSingleProcessPrivilege	4228	msiexec.exe
Token: SeIncBasePriorityPrivilege	4228	msiexec.exe
Token: SeCreatePagefilePrivilege	4228	msiexec.exe
Token: SeCreatePermanentPrivilege	4228	msiexec.exe
Token: SeBackupPrivilege	4228	msiexec.exe
Token: SeRestorePrivilege	4228	msiexec.exe
Token: SeShutdownPrivilege	4228	msiexec.exe
Token: SeDebugPrivilege	4228	msiexec.exe
Token: SeAuditPrivilege	4228	msiexec.exe
Token: SeSystemEnvironmentPrivilege	4228	msiexec.exe
Token: SeChangeNotifyPrivilege	4228	msiexec.exe
Token: SeRemoteShutdownPrivilege	4228	msiexec.exe
Token: SeUndockPrivilege	4228	msiexec.exe
Token: SeSyncAgentPrivilege	4228	msiexec.exe
Token: SeEnableDelegationPrivilege	4228	msiexec.exe
Token: SeManageVolumePrivilege	4228	msiexec.exe
Token: SeImpersonatePrivilege	4228	msiexec.exe
Token: SeCreateGlobalPrivilege	4228	msiexec.exe
Token: SeBackupPrivilege	1124	vssvc.exe
Token: SeRestorePrivilege	1124	vssvc.exe
Token: SeAuditPrivilege	1124	vssvc.exe
Token: SeBackupPrivilege	3736	msiexec.exe
Token: SeRestorePrivilege	3736	msiexec.exe
Token: SeRestorePrivilege	3736	msiexec.exe
Token: SeTakeOwnershipPrivilege	3736	msiexec.exe
Token: SeRestorePrivilege	3736	msiexec.exe
Token: SeTakeOwnershipPrivilege	3736	msiexec.exe
Token: SeRestorePrivilege	3736	msiexec.exe
Token: SeTakeOwnershipPrivilege	3736	msiexec.exe
Token: SeRestorePrivilege	3736	msiexec.exe
Token: SeTakeOwnershipPrivilege	3736	msiexec.exe
Token: SeRestorePrivilege	3736	msiexec.exe
Token: SeTakeOwnershipPrivilege	3736	msiexec.exe
Token: SeRestorePrivilege	3736	msiexec.exe
Token: SeTakeOwnershipPrivilege	3736	msiexec.exe
Token: SeRestorePrivilege	3736	msiexec.exe
Token: SeTakeOwnershipPrivilege	3736	msiexec.exe
Token: SeRestorePrivilege	3736	msiexec.exe
Token: SeTakeOwnershipPrivilege	3736	msiexec.exe
Token: SeRestorePrivilege	3736	msiexec.exe
Token: SeTakeOwnershipPrivilege	3736	msiexec.exe
Token: SeRestorePrivilege	3736	msiexec.exe
Token: SeTakeOwnershipPrivilege	3736	msiexec.exe
Token: SeRestorePrivilege	3736	msiexec.exe
Token: SeTakeOwnershipPrivilege	3736	msiexec.exe
Token: SeRestorePrivilege	3736	msiexec.exe
Token: SeTakeOwnershipPrivilege	3736	msiexec.exe
Token: SeRestorePrivilege	3736	msiexec.exe
Token: SeTakeOwnershipPrivilege	3736	msiexec.exe
Token: SeRestorePrivilege	3736	msiexec.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
4228	msiexec.exe
4228	msiexec.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3736 wrote to memory of 2192	3736	msiexec.exe	84
PID 3736 wrote to memory of 4084	3736	msiexec.exe	86
PID 3736 wrote to memory of 4636	3736	msiexec.exe	87
PID 4636 wrote to memory of 236	4636	NetCrunchTools2.exe	88

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\tmpja9f3sbs.msi
1⤵
- Badlisted process makes network request
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4228

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3736
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:2192
- C:\Users\Admin\AppData\Local\Temp\ApplicationInstallationFolder_11\icardagt.exe
  "C:\Users\Admin\AppData\Local\Temp\ApplicationInstallationFolder_11\icardagt.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:4084
- C:\Users\Admin\AppData\Local\Temp\ApplicationInstallationFolder_11\NetCrunchTools2.exe
  "C:\Users\Admin\AppData\Local\Temp\ApplicationInstallationFolder_11\NetCrunchTools2.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4636
- - C:\Users\Admin\AppData\Local\Temp\is-1A0LD.tmp\NetCrunchTools2.tmp
    "C:\Users\Admin\AppData\Local\Temp\is-1A0LD.tmp\NetCrunchTools2.tmp" /SL5="$100236,43311050,486912,C:\Users\Admin\AppData\Local\Temp\ApplicationInstallationFolder_11\NetCrunchTools2.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Modifies data under HKEY_USERS
    PID:236

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:1124

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Installer Packages

T1546.016

Privilege Escalation

Event Triggered Execution

T1546

Installer Packages

T1546.016

Defense Evasion

System Binary Proxy Execution

T1218

Msiexec

T1218.007

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e586bb6.rbs

Path C:\Config.Msi\e586bb6.rbs
Size 7KB
SHA256 3d091bcc10c4fb68e9308251a0adb7df1d2bf59b3f17d0c2be3f8f010781f808
MD5 45aa451901a6035deeff8d4e7bfc6c1a
SHA1 97d915bc1f3476df7ab66935f77af96ac33ad2bb
SHA512 efd0746cac812f0dcf645c2814c2dfa578be70fb66ead972ecfe8ce1e12daa245e1948ef41a9bd7d52c552694598008bdec1a744a75b5ed2a99032caac74e1bd
SSDEEP 96:hmWsJ6JCyjMwp8oCDVMaUbWTTCsTlqUbWTTCWd/3TlrHA5UhZWXuLJ1HwCMp4BGH:cfEf8oCutgOIbgOA+kZx1H3MpD
TLSH
T14DF13041B31181E2EC56573ACB0B275637A3D3DDD6D0230F09CD92686E5278A5FE62CA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

357F04AD41BCF5FE18FCB69F60C6680F_33E4C7534F38E75439A639B049B41DA3

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\357F04AD41BCF5FE18FCB69F60C6680F_33E4C7534F38E75439A639B049B41DA3
Size 1KB
SHA256 b09b91192ee8acd3ff8773295c225a94738142016d0274f995be6607e490e4db
MD5 e2e75b94041d085d1ce54f2b781ef516
SHA1 5c0bdbc781d9198a0fa393c403bdd41ba2f2f53e
SHA512 91fd97a988c23fed6be4505361a1cc66bfe12204930d0cf1f7da6eef62276d86a8ef84ace186626236c956f7e5841bfce90ec7874a3dafd3cacd2415b16b72e7
TLSH
T11831DBCD191E3DC3A98BCE349CC6A4057D3CA5F06DDCA512152B916574403E36F7A05A
MD5 SHA1 SHA512 TLSH

Submit Download

9CB4373A4252DE8D2212929836304EC5_1AB74AA2E3A56E1B8AD8D3FEC287554E

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\9CB4373A4252DE8D2212929836304EC5_1AB74AA2E3A56E1B8AD8D3FEC287554E
Size 1KB
SHA256 b35260221236e2997429a3d05d79273d0e1944bd47e9e065b9e0b3d88c2b0ddd
MD5 a74993266a1bc95bb82f4a1417f3d34a
SHA1 933edfe02e1aff2a934902f8b1ee215324e062d2
SHA512 a25fc9b33736bf77fa2701ec6f3d18c090fab6c0977c72c4c5ee23d1c4a85cfa448a71b8b4e2016b629045e965c29b0fa28dcdab2cc635823962fb8486d79b28
TLSH
T1A1311A274F2E6921CF228D8415C6F9322970E9D22CEA246A7218EA0B2884BB34F1554B
MD5 SHA1 SHA512 TLSH

Submit Download

357F04AD41BCF5FE18FCB69F60C6680F_33E4C7534F38E75439A639B049B41DA3

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\357F04AD41BCF5FE18FCB69F60C6680F_33E4C7534F38E75439A639B049B41DA3
Size 536B
SHA256 e6fc411d87492d1c66a72cc8d7369de789ea7d371c018fc1bf730d697c28f303
MD5 134f3405ac4e3365b1ed2f2b99f4851d
SHA1 58e0bf60559782522f1fd145e055c7689559dc30
SHA512 b475c1947e1f3f8f607ef094c5a2a508333dc028026029fe67604b7f8b51c8ca3a13cabe94f4b8acc7203cd92686f69e27ea579b322a66693fa3bed1666e2adf
TLSH
T1C0F09E3054F5011EF075DA3807C5A9D65D5AFE5325305A151D6943097D12E802D5393F
MD5 SHA1 SHA512 TLSH

Submit Download

9CB4373A4252DE8D2212929836304EC5_1AB74AA2E3A56E1B8AD8D3FEC287554E

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\9CB4373A4252DE8D2212929836304EC5_1AB74AA2E3A56E1B8AD8D3FEC287554E
Size 536B
SHA256 1c43d53abf7fbbb0af3d765cf9bc395c7a24e685b205a0a4f6d2737a18b21e06
MD5 f75a599ccf468a933f1893d899810c1a
SHA1 585720298280d6d38bfb3b51e76aca7042bbd88a
SHA512 b295c60921ab00fe77b6e65582f3b7d13ef8f8509fddb7b32db76a21a1b77acd1ffebc2f8aef63cd93f64a5e1457b5765bd52ee2ad102f763800564b7de4a888
TLSH
T164F0DC0C08F5422EF0B6C97A0DF86812951AF9131824962E02A04B0E3D20F00AD2792D
MD5 SHA1 SHA512 TLSH

Submit Download

NetCrunchTools2.exe

Path C:\Users\Admin\AppData\Local\Temp\ApplicationInstallationFolder_11\NetCrunchTools2.exe
Size 41.7MB
SHA256 63a0032cdd664708f493a4c15e52c35619d9180477d575fab08a5f1ffa2dc70e
MD5 aaf66d2abb7e9bd38027779e5a80299e
SHA1 a45c45bc14fb0bec2c099000b3bd38c544715536
SHA512 b78dd5a6e8470ea2ac89dca99c597046be2cbede3bf3f3a988ba9ded039eac2430c0c2936c8a232590e43c9cfe9738abe9e120dbed40000ef7a2b566c20963e5
SSDEEP 786432:5KvLeHVjdnNJPmyhENfnen8Yf6DM7Taj4GIa1:kvLe1jdnN1myhENfen8Yf70r1
TLSH
T173A733BC8C16A7B3D9182430A4A48CC05D32BD8431E879D26D77FF9D29749C7D429ABB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

icardagt.exe

Path C:\Users\Admin\AppData\Local\Temp\ApplicationInstallationFolder_11\icardagt.exe
Size 1.3MB
SHA256 473d17e571d6947ce93103454f1e9fe27136403125152b97acb6cad5cc2a9ac7
MD5 2fe97a3052e847190a9775431292a3a3
SHA1 43edc451ac97365600391fa4af15476a30423ff6
SHA512 93ed1f9ef6fb256b53df9c6f2ce03301c0d3a0ef49c3f0604872653e4ba3fce369256f50604dd8386f543e1ea9231f5700213e683d3ea9af9e4d6c427a19117a
SSDEEP 12288:pvRneDBcP5s/UdTEQa8DOmJRJmILwCHEA188KijZZLr0X+c/d2zlNRTSTNo7I8:phe4kRQa8DO6JmJCvrKimZ4zlNRTST38
TLSH
T1D955F969F97C4176E121D4BFD183DA4AD1B230422B305AE74262CF6E1E3F5D6A13A732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

version.dll

Path C:\Users\Admin\AppData\Local\Temp\ApplicationInstallationFolder_11\version.dll
Size 2.7MB
SHA256 a09923899b318848d44dc706ccc1d3489a383b9af0921351134d14a152a7925b
MD5 18689fd0311a64a712a313d58fccbbfe
SHA1 c135d29186faa04602d90e96d17aaf58fe16b8f7
SHA512 3a7d0129da9d079f4cf5266b3c70ea950ed852b3573abae9aadd9eab1db68dea330eac5ed23c78426ea1bffd5d75aa416b2d2ce39349bafccea9e429301212e0
SSDEEP 49152:/yCl4fYhi7rch+A0UiepgqALMwajmaPUDiLIscxgyLGURN+y4J:/R/Pge0bLGUS9
TLSH
T1ADD58D0A2B3B4A5ED521C4BD92771223C469BDFCC018B5798DC04B457FA2F60A67A7EC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NetCrunchTools2.tmp

Path C:\Users\Admin\AppData\Local\Temp\is-1A0LD.tmp\NetCrunchTools2.tmp
Size 1.5MB
SHA256 4b656f22388ef8577af2084b973e3438164a3b66ab53b6a9622a708890439df9
MD5 59a325063285a02a0a430cf4aaf42865
SHA1 1891d52937a20e2def65ed4ef58ceb3f0981cf3c
SHA512 9145070c5a81878673e2a7240eb00bc805371455c7d658395875ab9998de9814367e1cc481f579c7c2557a66fc14dbb9995228baeeb89b64b392f7e6b6191b09
SSDEEP 24576:11VqyG3T/+ofiDIZE2kChYYmpY9a2nWEdEC6GnJJ3GZ7lInLGjjvx9X:fQdhZgEN6GnJa7lICjV
TLSH
T10C754C25A6518633D5312A30DC6AC9C45835BD103AF8E9C67DB6FF5C1D38BC2A8253BB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e586bb5.msi

Path C:\Windows\Installer\e586bb5.msi
Size 43.7MB
SHA256 fc53b952c593a93f7fa73e09796d144d4b2316f7907f86c791790ed57c632320
MD5 c431a9053f1825573b7c3685ec399338
SHA1 051f6a19a09c2927e96244c89623dd26beec188d
SHA512 a6c0ebb1e15eb3516c1392946068b9071337cbe8fcc2c99eab963c5e2a4c0f7fdeb991089161ad6d0b793a16ae765b99e6570f00955c97432fe952b0df7d1add
SSDEEP 786432:OIAXENlMDo/j4WFqTXY7QLbgE/1bgRhVqGvknjvi+Rs:fAXEXMDo/EWFqTXY0LbgE564nj6+
TLSH
T14FA733BECC4EAF38CC0C0D7A50ACB88E06176D64581036D5D26E74E67BF196BACA1DD1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata-2

Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
Size 24.6MB
SHA256 9074c7c10db9b12b45c04078bcb56c7682b7e64e175554240cfecf52220f8622
MD5 7bb7d2d7a27ecd810e4531c4e662162e
SHA1 40704482c47c6fad197c3d49687082d8ac66b37b
SHA512 1ebff36ed32720439a6402553bb097fc5c3e14581a39d9f7b1332eb0ac18e02a5d009dea8b9e221722b966809a5c92d19d7ae463ef4e7d64015eae63c67d656b
SSDEEP 24576:O2gmSp1SdoO/vvTLcW3OhkXafKJ8A4jt22kt3JkH+M64ErjS48mwLqtwx:B
TLSH
T15647072436F92100E7F79E3CB8F06A27593A7D579C15EE8D05411B8D0922FB1E872F6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{a85708f1-a91c-474c-99e1-1b69d3ac0ff7}_OnDiskSnapshotProp

Path \??\Volume{67a68b58-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{a85708f1-a91c-474c-99e1-1b69d3ac0ff7}_OnDiskSnapshotProp
Size 6KB
SHA256 f597188a9cbedaea99c9a0ea757976a2414d0b5576525d93d36b4114b8063643
MD5 d60ceeece56004add7641032ce7367be
SHA1 351a800a1530ace44b48ec82da2317fb8fc89aab
SHA512 eb5b99c2ea69e971a52b19772910ee0d42735080c7061dfbadbd097cce53f40f44544dd10594a1297d6d811ebf3a9e6d858c8310feb0bfc54832d0b5e8d276bf
SSDEEP 96:FoozBvc8DD84LTHzbOHXOHBlBRQ88Sc9XE56tOSVQpuN:6Ib++ZVmN
TLSH
T12ED188084AF54711E2B3AB3228F14557A877B811EF33CB8E0198238E2671911F876F6F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/236-76-0x0000000000400000-0x0000000000585000-memory.dmp

Download

memory/236-88-0x0000000000400000-0x0000000000585000-memory.dmp

Download

memory/236-61-0x0000000000400000-0x0000000000585000-memory.dmp

Download

memory/236-100-0x0000000000400000-0x0000000000585000-memory.dmp

Download

memory/236-97-0x0000000000400000-0x0000000000585000-memory.dmp

Download

memory/236-64-0x0000000000400000-0x0000000000585000-memory.dmp

Download

memory/236-67-0x0000000000400000-0x0000000000585000-memory.dmp

Download

memory/236-94-0x0000000000400000-0x0000000000585000-memory.dmp

Download

memory/236-70-0x0000000000400000-0x0000000000585000-memory.dmp

Download

memory/236-91-0x0000000000400000-0x0000000000585000-memory.dmp

Download

memory/236-79-0x0000000000400000-0x0000000000585000-memory.dmp

Download

memory/236-82-0x0000000000400000-0x0000000000585000-memory.dmp

Download

memory/236-85-0x0000000000400000-0x0000000000585000-memory.dmp

Download

memory/4084-53-0x0000000002EA0000-0x000000000364E000-memory.dmp

Download

memory/4084-65-0x0000000002EA0000-0x000000000364E000-memory.dmp

Download

memory/4084-59-0x0000000002EA0000-0x000000000364E000-memory.dmp

Download

memory/4636-36-0x0000000000400000-0x0000000000481000-memory.dmp

Download

memory/4636-60-0x0000000000400000-0x0000000000481000-memory.dmp

Download