bumblebee | 27487060866209922c13a92bbcc3457fbbf977f5aaff25e199778e8a023d9c24

Analysis

max time kernel
149s
max time network
152s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
02/06/2026, 01:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
tmpzx8m0tzj.msi
Size 9.3MB
Sample260602-cedvdacw7j
SHA256 27487060866209922c13a92bbcc3457fbbf977f5aaff25e199778e8a023d9c24
MD5 bd99a02d8afdc468d315d47870202198
SHA1 67d6e46cf006d34d7606c03f48052fcd7af58d86
SHA512 e8b1aee097276a6a77f76daa99676a62843e310277027a08d538f6504b6babf498f1a5776e233783f9322fe2028bec10e2b789ef3ef2cecdf82752fa2239d9e4
SSDEEP 196608:YKhpGIqbo0qpUd5DxbN9QZc1GmbL8bdeIlntj/8/Vy5XgLF9fmR2Q:Y+RGdt0ckmcb8IltzvxgTm
TLSH
T17EA6336E3BB8A70BC73E75B499931280804EACD352C8F846F25DF7A833787606E55356
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

rvt1 discovery bumblebee loader persistence privilege_escalation ransomware

Malware Config

Extracted

Family

bumblebee

Botnet

rvt1

Attributes

dga
7g342zvzn3uqq.life

xsenlg0qhhi1b.life

g0yw5p28hbx0s.life

52szf55f8gmk8.life

rkrjtpvvmeals.life

17ek6ne63tvp1.life

iwzkgwcv5ebat.life

9n9tal4hw00ip.life

6rzcyj1sswqm2.life

b51lj50er7i5c.life

7gup8m7nsh4bl.life

pxu2liz19adny.life

pdyckgp144x0w.life

hsxe8ye2venfd.life

oh6qtkwfuus46.life

xigticnxbhrv8.life

euod9uk8f3l81.life

i6r4k2jo8giob.life

9qnk0nmyswkvz.life

3tkemqy8wipsj.life

yo2blls44tlmy.life

aftxgkj92l0in.life

awov62djki4y0.life

duhhgvdrjx5m8.life

zucscj1mnafjq.life

u0dvovexg8a9r.life

94y5pkgk1etpy.life

jced3p0f46gyy.life

h3t6oau35fj9w.life

ch7bk8l5jzsdy.life

iy4sgebvy7irq.life

pg3k818fzjx8x.life

q2afcbxeqvlvp.life

yrdzyc58ivnz2.life

5rysu08g3k6gc.life

cbo4qfnw25cvh.life

q77e1ox1itdb4.life

s7m284fqxpzmw.life

p55dbejqk240n.life

lbrizkb47cwrc.life

hl81xtzjv36jf.life

3rv3hcanv2go8.life

mw3bn6jeeodm5.life

4j20prz1zjnfj.life

o10m4i9qkdlym.life

62mqkuu1q1o15.life

i8670z8zhfp8t.life

ww9uswruc5bfm.life

c11t50tj3160n.life

mlxjgjbdkpww3.life

zel0o851i608p.life

n5xvvdz9y896o.life

5zf7kj41fuqr9.life

dhfl9u35aao7j.life

8svblqs899cjr.life

b05tsf8p68rbe.life

hik8gmiewwu0r.life

y3vmprmb726we.life

dtramz0feg4dw.life

yx1zja0dj8qju.life

r23sxlqhzx8vg.life

i32jgcz842stw.life

e7rn9f4gseyzp.life

ol3sj2hi7bb2c.life

9kb3iv3ou95tt.life

wf8gacjbp9imr.life

39werlh4rv5s8.life

ptr5rfuuq7juc.life

eh8gll5bhpt91.life

dg0ffst21bgvr.life

i0unymq8nqf8e.life

m0b88ot97bjsb.life

c66pqivko6n8o.life

agp9y0wg814pa.life

i449op4jt9r92.life

ll5q20efbibpr.life

23hixodoyv0dd.life

c2euwefme48jz.life

r17o8laaolhog.life

fcung4iggr5p3.life

di1cn3vl5228i.life

pqoq7q5lty905.life

zn4fgfonyn1qn.life

0gh9do46p1l2y.life

cjglyj70nhu28.life

9vueh00h1bdwv.life

44n306fqocyhv.life

ox6pb5okf6aoh.life

37hrryyz275k8.life

8cx1dqbdb6ch8.life

jjpz3ywa12xe7.life

kw6ahe9ib2rxc.life

6gl5viz85n1mt.life

iikz0tznluj1j.life

13zljo99byc7n.life

zf20ias6u41qg.life

qv3f3zwf9brmd.life

dzydy8wal311h.life

qd0gy4oktstgt.life

o64zkgme71j8y.life
dga_seed
-7827392873490824478
domain_length
13
num_dga_domains
300
port
443
tld
.life

rc4.plain

Signatures

Family: BumbleBee
BumbleBee is a loader malware written in C++.
loader bumblebee

Badlisted process makes network request 25 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
2	3356	msiexec.exe
3	3356	msiexec.exe
4	3356	msiexec.exe
5	3356	msiexec.exe
6	3356	msiexec.exe
7	4196	msiexec.exe
11	3292	rundll32.exe
12	3292	rundll32.exe
14	3292	rundll32.exe
15	3292	rundll32.exe
16	3292	rundll32.exe
17	3292	rundll32.exe
18	3292	rundll32.exe
19	3292	rundll32.exe
20	3292	rundll32.exe
21	3292	rundll32.exe
22	3292	rundll32.exe
23	3292	rundll32.exe
24	3292	rundll32.exe
25	3292	rundll32.exe
26	3292	rundll32.exe
28	3292	rundll32.exe
29	3292	rundll32.exe
31	3292	rundll32.exe
32	3292	rundll32.exe

Loads dropped DLL 5 IoCs

pid	Process
3292	rundll32.exe
2548	MsiExec.exe
2548	MsiExec.exe
4372	MsiExec.exe
4372	MsiExec.exe

Enumerates connected drives 3 TTPs 64 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe

Drops file in Program Files directory 32 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Dell\RVTools\RVTools.exe.config	msiexec.exe
File created	C:\Program Files (x86)\Dell\RVTools\System.Diagnostics.DiagnosticSource.dll	msiexec.exe
File created	C:\Program Files (x86)\Dell\RVTools\FastMember.Signed.dll	msiexec.exe
File created	C:\Program Files (x86)\Dell\RVTools\System.Buffers.dll	msiexec.exe
File created	C:\Program Files (x86)\Dell\RVTools\System.IO.FileSystem.Primitives.dll	msiexec.exe
File created	C:\Program Files (x86)\Dell\RVTools\FastMember.dll	msiexec.exe
File created	C:\Program Files (x86)\Dell\RVTools\RVToolsSendMail.exe	msiexec.exe
File created	C:\Program Files (x86)\Dell\RVTools\RVToolsSendMail.exe.config	msiexec.exe
File created	C:\Program Files (x86)\Dell\RVTools\RVToolsBatchMultipleVCs.ps1	msiexec.exe
File created	C:\Program Files (x86)\Dell\RVTools\RVToolsMergeExcelFiles.exe	msiexec.exe
File created	C:\Program Files (x86)\Dell\RVTools\System.Runtime.CompilerServices.Unsafe.dll	msiexec.exe
File created	C:\Program Files (x86)\Dell\RVTools\System.Memory.dll	msiexec.exe
File created	C:\Program Files (x86)\Dell\RVTools\ExcelNumberFormat.dll	msiexec.exe
File created	C:\Program Files (x86)\Dell\RVTools\DocumentFormat.OpenXml.dll	msiexec.exe
File created	C:\Program Files (x86)\Dell\RVTools\log4net.dll	msiexec.exe
File created	C:\Program Files (x86)\Dell\RVTools\log4net.config	msiexec.exe
File created	C:\Program Files (x86)\Dell\RVTools\System.Net.Http.dll	msiexec.exe
File created	C:\Program Files (x86)\Dell\RVTools\RVTools.pdf	msiexec.exe
File created	C:\Program Files (x86)\Dell\RVTools\VMware.Binding.WsTrust.dll	msiexec.exe
File created	C:\Program Files (x86)\Dell\RVTools\ClosedXML.dll	msiexec.exe
File created	C:\Program Files (x86)\Dell\RVTools\STSService.dll	msiexec.exe
File created	C:\Program Files (x86)\Dell\RVTools\Microsoft.ApplicationInsights.dll	msiexec.exe
File created	C:\Program Files (x86)\Dell\RVTools\Newtonsoft.Json.dll	msiexec.exe
File created	C:\Program Files (x86)\Dell\RVTools\RVToolsCreateLocalUser.ps1	msiexec.exe
File created	C:\Program Files (x86)\Dell\RVTools\EULA.rtf	msiexec.exe
File created	C:\Program Files (x86)\Dell\RVTools\RVToolsFindBadVM.ps1	msiexec.exe
File created	C:\Program Files (x86)\Dell\RVTools\System.Numerics.Vectors.dll	msiexec.exe
File created	C:\Program Files (x86)\Dell\RVTools\rvtools32x32.ico	msiexec.exe
File created	C:\Program Files (x86)\Dell\RVTools\Vim25Service.dll	msiexec.exe
File created	C:\Program Files (x86)\Dell\RVTools\RVToolsPasswordEncryption.ps1	msiexec.exe
File created	C:\Program Files (x86)\Dell\RVTools\RVToolsMergeExcelFiles.exe.config	msiexec.exe
File created	C:\Program Files (x86)\Dell\RVTools\RVTools.exe	msiexec.exe

Drops file in Windows directory 37 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\~DF1D78AD8253E988DA.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DF9624C0C39C98C2B8.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\e58af39.msi	msiexec.exe
File created	C:\Windows\SystemTemp\~DF4B1F20EC1F86C1EE.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DFADF22C95518145EE.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI3001.tmp	msiexec.exe
File created	C:\Windows\Installer\{803A037A-6E5F-4088-B880-1AD90D542187}\_853F67D554F05449430E7E.exe	msiexec.exe
File created	C:\Windows\SystemTemp\~DFB4D3225C630333E3.TMP	msiexec.exe
File created	C:\Windows\Installer\e58af39.msi	msiexec.exe
File created	C:\Windows\SystemTemp\~DFCED6A51AB31C74E8.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI30ED.tmp	msiexec.exe
File created	C:\Windows\Installer\e58af3b.msi	msiexec.exe
File created	C:\Windows\SystemTemp\~DFF7B3FDA7799F3BE7.TMP	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\SystemTemp\~DF662418E7887361A0.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\SourceHash{DD475EBC-D961-4AF4-BB8A-BE91FA942756}	msiexec.exe
File created	C:\Windows\Installer\SourceHash{803A037A-6E5F-4088-B880-1AD90D542187}	msiexec.exe
File created	C:\Windows\SystemTemp\~DF1054594F6E9746B8.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DFBA938B47FAF1DC9A.TMP	msiexec.exe
File opened for modification	C:\Windows\SystemTemp\MSIB32F.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\e58af36.msi	msiexec.exe
File created	C:\Windows\Installer\e58af38.msi	msiexec.exe
File opened for modification	C:\Windows\SystemTemp\MSIB282.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DFA3947F125D7D5A25.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIB13A.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DF341560C45DC8F467.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\{803A037A-6E5F-4088-B880-1AD90D542187}\_853F67D554F05449430E7E.exe	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI2FA2.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DF70E7DDCAFCB5FBB1.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DFEC385DD6E009DD95.TMP	msiexec.exe
File created	C:\Windows\Installer\e58af36.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File created	C:\Windows\SystemTemp\~DFAC5EB1B037BB6D69.TMP	msiexec.exe
File created	C:\Windows\Installer\{803A037A-6E5F-4088-B880-1AD90D542187}\_4B94857914A0BD97A1B4FE.exe	msiexec.exe
File opened for modification	C:\Windows\Installer\{803A037A-6E5F-4088-B880-1AD90D542187}\_4B94857914A0BD97A1B4FE.exe	msiexec.exe
File created	C:\Windows\SystemTemp\~DF8A9A1637420760C6.TMP	msiexec.exe

Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs

persistence privilege_escalation

Installer Packages

T1546.016

Msiexec

T1218.007

pid	Process
3356	msiexec.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000512b028b2c2fe2ee0000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000512b028b0000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed35000000ffffffff000000000700010000680900512b028b000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff350000000000000005000000ffffffff000000000700010000f8ff1a512b028b000000000000f0ff350000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d512b028b000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows Script\Settings	MsiExec.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\Owner = 6410000002062f6f33f2dc01	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\28	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\29	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	msiexec.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\SessionHash = 1dff8cffa2fde64501b120ac48e89ffba2e8018eebf651a36f583c1148e68cf3	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Dell	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager	msiexec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\Sequence = "1"	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Dell\RVTools	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E	msiexec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows Script\Settings\JITDebug = "0"	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	msiexec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Dell\RVTools\ProductImprovementOptIn = "1"	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000	msiexec.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:\|Program Files (x86)\|Dell\|RVTools\|Vim25Service.dll\Vim25Service,Version="0.0.0.0",Culture="neutral",ProcessorArchitecture="MSIL" = 61006c002100360051006a0042007b006700380055004a0025006b006e002d005e005b004c0053003e0053007400480068004300600050002b0024007a0067007e00520076004e005e004c0024004a00690000000000	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:\|Program Files (x86)\|Dell\|RVTools\|ExcelNumberFormat.dll	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:\|Program Files (x86)\|Dell\|RVTools\|ExcelNumberFormat.dll\ExcelNumberFormat,Version="1.1.0.0",Culture="neutral",ProcessorArchitecture="MSIL",PublicKeyToken="23C6F5D73BE07ECA" = 61006c002100360051006a0042007b006700380055004a0025006b006e002d005e005b004c0053003e0043007800570064003800770044005e00710033003500760059004b0052004e004e00390051002d0000000000	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:\|Program Files (x86)\|Dell\|RVTools\|VMware.Binding.WsTrust.dll\VMware.Binding.WsTrust,Version="1.0.0.0",Culture="neutral",ProcessorArchitecture="MSIL" = 61006c002100360051006a0042007b006700380055004a0025006b006e002d005e005b004c0053003e005f0058004300300040004f0033002c004e00540056007b007d00470043002a0042005a003d00530000000000	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:\|Program Files (x86)\|Dell\|RVTools\|RVTools.exe\RVTools,Version="4.7.1.4",Culture="neutral",ProcessorArchitecture="MSIL" = 61006c002100360051006a0042007b006700380055004a0025006b006e002d005e005b004c0053003e00430075005b00500040007a0057003f00450032004400680064004c0072004c005500290024007a0000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\A730A308F5E688048B08A19DD0451278\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\ApplicationInstallationFolder_11\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:\|Program Files (x86)\|Dell\|RVTools\|log4net.dll	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:\|Program Files (x86)\|Dell\|RVTools\|RVToolsMergeExcelFiles.exe	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:\|Program Files (x86)\|Dell\|RVTools\|System.Net.Http.dll\System.Net.Http,Version="4.0.0.0",Culture="neutral",ProcessorArchitecture="MSIL",PublicKeyToken="B03F5F7F11D50A3A" = 61006c002100360051006a0042007b006700380055004a0025006b006e002d005e005b004c0053003e004900440029002d006a003f005b0059003900280059004d0028004300360041006a0032003100380000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CBE574DD169D4FA4BBA8EB19AF497265\ProductName = "RVTools"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CBE574DD169D4FA4BBA8EB19AF497265\SourceList\Media	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:\|Program Files (x86)\|Dell\|RVTools\|ClosedXML.dll\ClosedXML,Version="0.95.4.0",Culture="neutral",ProcessorArchitecture="MSIL" = 61006c002100360051006a0042007b006700380055004a0025006b006e002d005e005b004c0053003e0034006b004800650026003f00510070006a0055002c00350029006200290034005a0055002a00310000000000	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\A730A308F5E688048B08A19DD0451278\DeploymentFlags = "3"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:\|Program Files (x86)\|Dell\|RVTools\|FastMember.Signed.dll\FastMember.Signed,Version="1.5.0.0",Culture="neutral",ProcessorArchitecture="MSIL",PublicKeyToken="9E8F22703BEF9A29" = 61006c002100360051006a0042007b006700380055004a0025006b006e002d005e005b004c0053003e00560055006b004d0027005b00380057007700350044002d0074006a002b007a007d0061003300610000000000	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:\|Program Files (x86)\|Dell\|RVTools\|System.Buffers.dll\System.Buffers,Version="4.0.3.0",Culture="neutral",ProcessorArchitecture="MSIL",PublicKeyToken="CC7B13FFCD2DDD51" = 61006c002100360051006a0042007b006700380055004a0025006b006e002d005e005b004c0053003e0032003f006a007a0060002b003f00760067005a0055004600540049006e007b004d00310055002d0000000000	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:\|Program Files (x86)\|Dell\|RVTools\|System.IO.FileSystem.Primitives.dll	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CBE574DD169D4FA4BBA8EB19AF497265\Language = "1033"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CBE574DD169D4FA4BBA8EB19AF497265\SourceList\PackageName = "tmpzx8m0tzj.msi"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\A730A308F5E688048B08A19DD0451278\ProductIcon = "C:\\Windows\\Installer\\{803A037A-6E5F-4088-B880-1AD90D542187}\\_853F67D554F05449430E7E.exe"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\A730A308F5E688048B08A19DD0451278\SourceList\PackageName = "RVTools4.7.1.msi"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CBE574DD169D4FA4BBA8EB19AF497265\Assignment = "1"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CBE574DD169D4FA4BBA8EB19AF497265\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:\|Program Files (x86)\|Dell\|RVTools\|System.IO.FileSystem.Primitives.dll\System.IO.FileSystem.Primitives,Version="4.0.3.0",Culture="neutral",ProcessorArchitecture="MSIL",PublicKeyToken="B03F5F7F11D50A3 = 61006c002100360051006a0042007b006700380055004a0025006b006e002d005e005b004c0053003e007b005d0038006800240024004000640027007500470074004200310065006d00500025002c002d0000000000	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:\|Program Files (x86)\|Dell\|RVTools\|RVToolsSendMail.exe	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\D776E87A51EAD0E4C89AC389B4778FD0	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\CBE574DD169D4FA4BBA8EB19AF497265	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:\|Program Files (x86)\|Dell\|RVTools\|System.Runtime.CompilerServices.Unsafe.dll	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:\|Program Files (x86)\|Dell\|RVTools\|Newtonsoft.Json.dll\Newtonsoft.Json,Version="13.0.0.0",Culture="neutral",ProcessorArchitecture="MSIL",PublicKeyToken="30AD4FE6B2A6AEED" = 61006c002100360051006a0042007b006700380055004a0025006b006e002d005e005b004c0053003e00760026004b003d00780048007e00530062002b0032007d006600680066007e0076005d007200430000000000	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:\|Program Files (x86)\|Dell\|RVTools\|log4net.dll\log4net,Version="2.0.15.0",Culture="neutral",ProcessorArchitecture="MSIL",PublicKeyToken="669E0DDF0BB1AA2A" = 61006c002100360051006a0042007b006700380055004a0025006b006e002d005e005b004c0053003e002c005b00660042003300320075006d003f004e0038004f002e00770050002400580076004b00650000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\CBE574DD169D4FA4BBA8EB19AF497265\AppLicense	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CBE574DD169D4FA4BBA8EB19AF497265\SourceList\Media\1 = ";"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:\|Program Files (x86)\|Dell\|RVTools\|System.Numerics.Vectors.dll	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:\|Program Files (x86)\|Dell\|RVTools\|Newtonsoft.Json.dll	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:\|Program Files (x86)\|Dell\|RVTools\|RVToolsSendMail.exe\RVToolsSendMail,Version="4.7.1.4",Culture="neutral",ProcessorArchitecture="MSIL" = 61006c002100360051006a0042007b006700380055004a0025006b006e002d005e005b004c0053003e007a006400590032006b00720055007700290030006a00450037002a00710032006e0025007b00250000000000	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\A730A308F5E688048B08A19DD0451278\InstanceType = "0"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:\|Program Files (x86)\|Dell\|RVTools\|Microsoft.ApplicationInsights.dll\Microsoft.ApplicationInsights,Version="2.22.0.997",Culture="neutral",ProcessorArchitecture="MSIL",PublicKeyToken="31BF3856AD364E35 = 61006c002100360051006a0042007b006700380055004a0025006b006e002d005e005b004c0053003e005f00290058004700480067006400400078006d003500760051005e0067004b0039005a006e00370000000000	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:\|Program Files (x86)\|Dell\|RVTools\|RVToolsMergeExcelFiles.exe\RVToolsMergeExcelFiles,Version="4.7.1.4",Culture="neutral",ProcessorArchitecture="MSIL" = 61006c002100360051006a0042007b006700380055004a0025006b006e002d005e005b004c0053003e0072003900290066006d0044007a00790031003400730055005a00260028006f007a0077005900710000000000	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\A730A308F5E688048B08A19DD0451278	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\A730A308F5E688048B08A19DD0451278	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CBE574DD169D4FA4BBA8EB19AF497265\SourceList\Net	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:\|Program Files (x86)\|Dell\|RVTools\|System.Memory.dll\System.Memory,Version="4.0.1.1",Culture="neutral",ProcessorArchitecture="MSIL",PublicKeyToken="CC7B13FFCD2DDD51" = 61006c002100360051006a0042007b006700380055004a0025006b006e002d005e005b004c0053003e0062002100270050005a002c0058006e0066007a00270021005b006b0056007200470071004800320000000000	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:\|Program Files (x86)\|Dell\|RVTools\|DocumentFormat.OpenXml.dll\DocumentFormat.OpenXml,Version="2.12.0.0",Culture="neutral",ProcessorArchitecture="MSIL",PublicKeyToken="8FB06CB64D019A17" = 61006c002100360051006a0042007b006700380055004a0025006b006e002d005e005b004c0053003e004e0073005600260056006f004b006e00530064003d004e00690064005000760024002a007800400000000000	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:\|Program Files (x86)\|Dell\|RVTools\|VMware.Binding.WsTrust.dll	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:\|Program Files (x86)\|Dell\|RVTools\|RVTools.exe	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\A730A308F5E688048B08A19DD0451278\Assignment = "1"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\A730A308F5E688048B08A19DD0451278\AdvertiseFlags = "388"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CBE574DD169D4FA4BBA8EB19AF497265\AuthorizedLUAApp = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:\|Program Files (x86)\|Dell\|RVTools\|FastMember.Signed.dll	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\A730A308F5E688048B08A19DD0451278\PackageCode = "BC0FEFB58D74A934FB554FFE92FC3004"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:\|Program Files (x86)\|Dell\|RVTools\|System.Buffers.dll	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:\|Program Files (x86)\|Dell\|RVTools\|DocumentFormat.OpenXml.dll	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:\|Program Files (x86)\|Dell\|RVTools\|System.Runtime.CompilerServices.Unsafe.dll\System.Runtime.CompilerServices.Unsafe,Version="5.0.0.0",Culture="neutral",ProcessorArchitecture="MSIL",PublicKeyToken="B = 61006c002100360051006a0042007b006700380055004a0025006b006e002d005e005b004c0053003e003600600025007400610033004800520025002a003100630027005e0044006400570068007500590000000000	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:\|Program Files (x86)\|Dell\|RVTools\|ClosedXML.dll	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:\|Program Files (x86)\|Dell\|RVTools\|STSService.dll	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:\|Program Files (x86)\|Dell\|RVTools\|System.Diagnostics.DiagnosticSource.dll	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:\|Program Files (x86)\|Dell\|RVTools\|System.Diagnostics.DiagnosticSource.dll\System.Diagnostics.DiagnosticSource,Version="5.0.0.0",Culture="neutral",ProcessorArchitecture="MSIL",PublicKeyToken="CC7B13F = 61006c002100360051006a0042007b006700380055004a0025006b006e002d005e005b004c0053003e00610065004d0030002d0025005600720043006300480040004300410042003300730056006500360000000000	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\A730A308F5E688048B08A19DD0451278\AuthorizedLUAApp = "0"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:\|Program Files (x86)\|Dell\|RVTools\|FastMember.dll\FastMember,Version="1.5.0.0",Culture="neutral",ProcessorArchitecture="MSIL" = 61006c002100360051006a0042007b006700380055004a0025006b006e002d005e005b004c0053003e004f003000340024005a006500390029004500250075006f004e00670074007d00640026004e00520000000000	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:\|Program Files (x86)\|Dell\|RVTools\|System.Memory.dll	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CBE574DD169D4FA4BBA8EB19AF497265\AdvertiseFlags = "388"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CBE574DD169D4FA4BBA8EB19AF497265\DeploymentFlags = "3"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:\|Program Files (x86)\|Dell\|RVTools\|Vim25Service.dll	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:\|Program Files (x86)\|Dell\|RVTools\|STSService.dll\STSService,Version="6.5.0.0",Culture="neutral",ProcessorArchitecture="MSIL" = 61006c002100360051006a0042007b006700380055004a0025006b006e002d005e005b004c0053003e0070007e006100730074006c006e00390043002700290028007d006b003d00380062004c0067002e0000000000	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:\|Program Files (x86)\|Dell\|RVTools\|System.Numerics.Vectors.dll\System.Numerics.Vectors,Version="4.1.4.0",Culture="neutral",ProcessorArchitecture="MSIL",PublicKeyToken="B03F5F7F11D50A3A" = 61006c002100360051006a0042007b006700380055004a0025006b006e002d005e005b004c0053003e002b007a0076005f00490025002a006c002b003f0078004400740033002a002d0036006a002c00460000000000	msiexec.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4196	msiexec.exe
4196	msiexec.exe
4196	msiexec.exe
4196	msiexec.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3356	msiexec.exe
Token: SeIncreaseQuotaPrivilege	3356	msiexec.exe
Token: SeSecurityPrivilege	4196	msiexec.exe
Token: SeCreateTokenPrivilege	3356	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	3356	msiexec.exe
Token: SeLockMemoryPrivilege	3356	msiexec.exe
Token: SeIncreaseQuotaPrivilege	3356	msiexec.exe
Token: SeMachineAccountPrivilege	3356	msiexec.exe
Token: SeTcbPrivilege	3356	msiexec.exe
Token: SeSecurityPrivilege	3356	msiexec.exe
Token: SeTakeOwnershipPrivilege	3356	msiexec.exe
Token: SeLoadDriverPrivilege	3356	msiexec.exe
Token: SeSystemProfilePrivilege	3356	msiexec.exe
Token: SeSystemtimePrivilege	3356	msiexec.exe
Token: SeProfSingleProcessPrivilege	3356	msiexec.exe
Token: SeIncBasePriorityPrivilege	3356	msiexec.exe
Token: SeCreatePagefilePrivilege	3356	msiexec.exe
Token: SeCreatePermanentPrivilege	3356	msiexec.exe
Token: SeBackupPrivilege	3356	msiexec.exe
Token: SeRestorePrivilege	3356	msiexec.exe
Token: SeShutdownPrivilege	3356	msiexec.exe
Token: SeDebugPrivilege	3356	msiexec.exe
Token: SeAuditPrivilege	3356	msiexec.exe
Token: SeSystemEnvironmentPrivilege	3356	msiexec.exe
Token: SeChangeNotifyPrivilege	3356	msiexec.exe
Token: SeRemoteShutdownPrivilege	3356	msiexec.exe
Token: SeUndockPrivilege	3356	msiexec.exe
Token: SeSyncAgentPrivilege	3356	msiexec.exe
Token: SeEnableDelegationPrivilege	3356	msiexec.exe
Token: SeManageVolumePrivilege	3356	msiexec.exe
Token: SeImpersonatePrivilege	3356	msiexec.exe
Token: SeCreateGlobalPrivilege	3356	msiexec.exe
Token: SeBackupPrivilege	5004	vssvc.exe
Token: SeRestorePrivilege	5004	vssvc.exe
Token: SeAuditPrivilege	5004	vssvc.exe
Token: SeBackupPrivilege	4196	msiexec.exe
Token: SeRestorePrivilege	4196	msiexec.exe
Token: SeRestorePrivilege	4196	msiexec.exe
Token: SeTakeOwnershipPrivilege	4196	msiexec.exe
Token: SeRestorePrivilege	4196	msiexec.exe
Token: SeTakeOwnershipPrivilege	4196	msiexec.exe
Token: SeRestorePrivilege	4196	msiexec.exe
Token: SeTakeOwnershipPrivilege	4196	msiexec.exe
Token: SeRestorePrivilege	4196	msiexec.exe
Token: SeTakeOwnershipPrivilege	4196	msiexec.exe
Token: SeRestorePrivilege	4196	msiexec.exe
Token: SeTakeOwnershipPrivilege	4196	msiexec.exe
Token: SeRestorePrivilege	4196	msiexec.exe
Token: SeTakeOwnershipPrivilege	4196	msiexec.exe
Token: SeRestorePrivilege	4196	msiexec.exe
Token: SeTakeOwnershipPrivilege	4196	msiexec.exe
Token: SeRestorePrivilege	4196	msiexec.exe
Token: SeTakeOwnershipPrivilege	4196	msiexec.exe
Token: SeRestorePrivilege	4196	msiexec.exe
Token: SeTakeOwnershipPrivilege	4196	msiexec.exe
Token: SeRestorePrivilege	4196	msiexec.exe
Token: SeTakeOwnershipPrivilege	4196	msiexec.exe
Token: SeRestorePrivilege	4196	msiexec.exe
Token: SeTakeOwnershipPrivilege	4196	msiexec.exe
Token: SeRestorePrivilege	4196	msiexec.exe
Token: SeTakeOwnershipPrivilege	4196	msiexec.exe
Token: SeRestorePrivilege	4196	msiexec.exe
Token: SeTakeOwnershipPrivilege	4196	msiexec.exe
Token: SeRestorePrivilege	4196	msiexec.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
3356	msiexec.exe
2424	msiexec.exe
3356	msiexec.exe
2424	msiexec.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 4196 wrote to memory of 1152	4196	msiexec.exe	84
PID 4196 wrote to memory of 2424	4196	msiexec.exe	86
PID 4196 wrote to memory of 3292	4196	msiexec.exe	87
PID 4196 wrote to memory of 2548	4196	msiexec.exe	88
PID 4196 wrote to memory of 4372	4196	msiexec.exe	90

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\tmpzx8m0tzj.msi
1⤵
- Badlisted process makes network request
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3356

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Badlisted process makes network request
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4196
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:1152
- C:\Windows\system32\msiexec.exe
  msiexec /i "C:\Users\Admin\AppData\Local\Temp\ApplicationInstallationFolder_11\RVTools4.7.1.msi"
  2⤵
  - Enumerates connected drives
  - Drops file in Windows directory
  - Suspicious use of FindShellTrayWindow
  PID:2424
- C:\Windows\system32\rundll32.exe
  "rundll32.exe" "C:\Users\Admin\AppData\Local\Temp\ApplicationInstallationFolder_11\RVTools.dll",DllRegisterServer
  2⤵
  - Badlisted process makes network request
  - Loads dropped DLL
  PID:3292
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 2157B06AE297DF0DB96C123B131B9390 C
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Modifies data under HKEY_USERS
  PID:2548
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 6BE1B649C50737D1B5F88F6A64C4E96E E Global\MSI0000
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:4372

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:5004

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Installer Packages

T1546.016

Privilege Escalation

Event Triggered Execution

T1546

Installer Packages

T1546.016

Defense Evasion

System Binary Proxy Execution

T1218

Msiexec

T1218.007

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e58af37.rbs

Path C:\Config.Msi\e58af37.rbs
Size 7KB
SHA256 0bffea297229b6dadf600a073e055c780dc480ef5365c21e365ba83aef6fbe5e
MD5 e0ab9fd86aefcb4432a9eb9cc1b313c1
SHA1 9530355355eb129f7d982735294dd32f0eb82792
SHA512 6e6dc1405b58a5cbc39133d88f602e046c0618bce8775e5c897c20075aae88ef1f4df4922bebe8b929536afb2642969fcc85957141c5066e86de0b78f4be3b05
SSDEEP 96:ImP8DoJjJCyARz8oCzTZaUbXBTCsTlBUbXBTCW4UBuxTlF6Ba55ZhZW2XozFCMpT:dk2lu8oCBtNOIgNOxvdFZ3MpT
TLSH
T1CCF14181B31191E2EC92173ACB4B17563BE3D3DDC390230B19CD92686F567895FE22CA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e58af3a.rbs

Path C:\Config.Msi\e58af3a.rbs
Size 19KB
SHA256 9e58aecd80cb645ab641daba2111fefe3fbda629ae9fd7182dd9be65d59eddc1
MD5 cb232220791f9b5bcb2e1c90ef3b8d59
SHA1 705fb66a1bb50272766b78949f5bdc5e1a98bba3
SHA512 2813cb3625e5131719b2e947b241afebcbab7647566fd43757aaa5e31b4b01d2463f4f0de30b928c27043e64f7863091b088bf3d24fd3dc5ddc0af9c794dee52
SSDEEP 384:ur3PQeCwyLjN0poPrwSPrwu1kcyusmDtpdArf3ezjpVu7T7i:uLFwnepoP0SP0IFBIi
TLSH
T16D92B405A409D6C2FE11637173917E1637B18E48E2A4226D46C9D92D8FC8E4D2BBB3ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

357F04AD41BCF5FE18FCB69F60C6680F_516886BFB2BA4E910846C2BE07CD737A

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\357F04AD41BCF5FE18FCB69F60C6680F_516886BFB2BA4E910846C2BE07CD737A
Size 1KB
SHA256 d58f74d4e8e99394dfca60ee58ee41911581e7ec470e5a92234dc3854f7f6b39
MD5 a0ad638d6f3e95830fd5dc6149edc665
SHA1 cbe971d9ba7fe4f397f9cf2138dd75bb947bb4f1
SHA512 2178425f6f30e5421126ef60c67ee04055c1e95473e3bfe2cb56543968d48f8f202a34722578e8e0ac761511f3704ea06fc27ad6fbc2653ab227f69431939b2b
TLSH
T17031FA951E1E19966ACECF2C8CCA9614BC29A4D06A6C64311137D769A5803D3AF7501E
MD5 SHA1 SHA512 TLSH

Submit Download

57C8EDB95DF3F0AD4EE2DC2B8CFD4157

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157
Size 4KB
SHA256 0300e9ddb527990e8b59d06e9ccf3ec2bd92d3bbd0ef4fba69d6336e4195e82d
MD5 5f036f91e86e30f749961506951d51eb
SHA1 acb87b59117c6e2db86f98c4c8bac52eade97cd4
SHA512 341f250cf3764207b5328a12b31016c0750daddcd16722b4bcef502bcbef7ef379abb601649ee6c3fdf121f3d3cd6890c8a80e5dae3169fe56ef82af20631944
SSDEEP 96:Dbonzjs6o1BXl7EV4/sClywa3UHimRkISatmQFjm:Dbsns6KXxUrClywawinLatvFjm
TLSH
T100A19E44A75AEB61C331EBB6829B7B51033B6D20178468FAEFDAA1E1695B44C143C3C2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9CB4373A4252DE8D2212929836304EC5_1AB74AA2E3A56E1B8AD8D3FEC287554E

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\9CB4373A4252DE8D2212929836304EC5_1AB74AA2E3A56E1B8AD8D3FEC287554E
Size 1KB
SHA256 b35260221236e2997429a3d05d79273d0e1944bd47e9e065b9e0b3d88c2b0ddd
MD5 a74993266a1bc95bb82f4a1417f3d34a
SHA1 933edfe02e1aff2a934902f8b1ee215324e062d2
SHA512 a25fc9b33736bf77fa2701ec6f3d18c090fab6c0977c72c4c5ee23d1c4a85cfa448a71b8b4e2016b629045e965c29b0fa28dcdab2cc635823962fb8486d79b28
TLSH
T1A1311A274F2E6921CF228D8415C6F9322970E9D22CEA246A7218EA0B2884BB34F1554B
MD5 SHA1 SHA512 TLSH

Submit Download

357F04AD41BCF5FE18FCB69F60C6680F_516886BFB2BA4E910846C2BE07CD737A

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\357F04AD41BCF5FE18FCB69F60C6680F_516886BFB2BA4E910846C2BE07CD737A
Size 540B
SHA256 c43b7eece4f3a5f57d1bfc4f3dc5d8fba1bca46a40f7011b2e7e62ffa81b6ba8
MD5 e29b3ccc89bea6a2ec44e348f2b44324
SHA1 896a6523bc8164ce5425943c3e8df130e4b3dd5e
SHA512 9bede7744033f3178834d61c5fb73e172de79e891a174cf0234af28f92317f5903d288eb2fc40d114b2b716d0ff83034d395c65bc0125b6da23b0a21ff110f53
TLSH
T120F0973054FA002FF07ACE380BC0E9A94C69FA1234365B6A087C87197D20E015C93A3A
MD5 SHA1 SHA512 TLSH

Submit Download

57C8EDB95DF3F0AD4EE2DC2B8CFD4157

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157
Size 342B
SHA256 130e6df97149e7b9ef392c52421cbd631ca4f989126db3dedd5ffbe5fceec831
MD5 e96f002918add93644384130b576c108
SHA1 23a33a4894d524c34c0a49f68e2070251ffef311
SHA512 990604b063d2de23a565fc1dd13140eecb6e14de96aaba07469d1c7fbc168b07caad343aacae28519a705dff2838deecb05fde6b292d530d38b3e20aea12d711
TLSH
T1BDE05E113BE80218F5770A3CAC736589A977B76B6A51CADD0275008D2C22F62CD7271D
MD5 SHA1 SHA512 TLSH

Submit Download

9CB4373A4252DE8D2212929836304EC5_1AB74AA2E3A56E1B8AD8D3FEC287554E

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\9CB4373A4252DE8D2212929836304EC5_1AB74AA2E3A56E1B8AD8D3FEC287554E
Size 536B
SHA256 5b69594be6a7caf2d14639d91a4cf631f5d1fe3b9d213340716fb656a796e437
MD5 0415d80b766b6ee992885b811dd448ca
SHA1 722fef1806ba4665e0f8170e9273aa207c3eb5af
SHA512 7e303ec6c4b3f8c09ac79748d49b53d79deb18116c0e2113338dfbd95039fe6f58098a0ddbf8ffdc8ee4b8646ba7d3fc23dbae957a73c28b36e3742184ad2063
TLSH
T175F0DC0C08F5822EF0B6C97A0DF868129519F90318249A2E02A04F0E7E20F00AD2652D
MD5 SHA1 SHA512 TLSH

Submit Download

RVTools.dll

Path C:\Users\Admin\AppData\Local\Temp\ApplicationInstallationFolder_11\RVTools.dll
Size 2.1MB
SHA256 fb51b8123a5f6f9e886af8f9455f7992ba58bebe905c4fd74cd8568eee60eef2
MD5 9aa24fb8c7dabb6c5120b9d7adcc1dfb
SHA1 ffc419abc8a93c671ecf0ffa87b483c0b8cbfe7b
SHA512 14dbbcf36a8050df64cf1c77942451d46b2e5b799c1f7c5ac19e968cd749bf4136b478d2a3bde05bf0593ee85e6b2bb10c97f46adccbf5a04a0da1a3c20b38d9
SSDEEP 49152:xQW1vx+wfJHk5x0YBQj4a40X0cOk+YJ6ARcGydWw0eizwLJMO:mAvnHix0YBQj4a40XHncGydWwriA
TLSH
T1B3A501D8C48911CFF3A80B3C26395B96FEC4A44DFCD8AD8DCA564BCE0AF956812557C2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RVTools4.7.1.msi

Path C:\Users\Admin\AppData\Local\Temp\ApplicationInstallationFolder_11\RVTools4.7.1.msi
Size 8.0MB
SHA256 0506126bcbc4641d41c138e88d9ea9f10fb65f1eeab3bff90ad25330108b324c
MD5 10610e3e81158e7f2a0c48e2b2f26d99
SHA1 8bc692cb4478b317bbc74ee60771b1f723d85649
SHA512 922b549abab60cae3a61941841c5da97297f84d9e76003364f19eaef2aae173ee91859e14cb2a0ad31ea153aee76228f432ebab4cbcbd473bd6b9e92a78a2abc
SSDEEP 196608:/E8GMQtdn/62RNOIGIcTvuOjkbV44GB1Shbo7OhnqM9ASZCHI:/EWWR62RNOdIcTLjkbV4HBEhgOZqM6Y
TLSH
T1AD86239C25078332D3B623F16877F2885C27FC2035A198967399F97D077AA90B375E62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e58af36.msi

Path C:\Windows\Installer\e58af36.msi
Size 9.3MB
SHA256 27487060866209922c13a92bbcc3457fbbf977f5aaff25e199778e8a023d9c24
MD5 bd99a02d8afdc468d315d47870202198
SHA1 67d6e46cf006d34d7606c03f48052fcd7af58d86
SHA512 e8b1aee097276a6a77f76daa99676a62843e310277027a08d538f6504b6babf498f1a5776e233783f9322fe2028bec10e2b789ef3ef2cecdf82752fa2239d9e4
SSDEEP 196608:YKhpGIqbo0qpUd5DxbN9QZc1GmbL8bdeIlntj/8/Vy5XgLF9fmR2Q:Y+RGdt0ckmcb8IltzvxgTm
TLSH
T17EA6336E3BB8A70BC73E75B499931280804EACD352C8F846F25DF7A833787606E55356
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSIB282.tmp

Path C:\Windows\SystemTemp\MSIB282.tmp
Size 285KB
SHA256 f74c97b1a53541b059d3bfafe41a79005ce5065f8210d7de9f1b600dc4e28aa0
MD5 b77a2a2768b9cc78a71bbffb9812b978
SHA1 b70e27eb446fe1c3bc8ea03dabbee2739a782e04
SHA512 a8b16bc60f8559c78c64ca9e85cd7fd704bba1f55b362465b7accef1bb853d1c9616995a35f972256c57fbe877ce880398ba1fbceaa658604883aa12dcbc4f57
SSDEEP 6144:cAOfnUdzb4m26KFHF/jliAYktxjw0gCvo5VGWg6AZzGbasKHr45I:cRUFb4H6KJF/pDYkw0gCvoKWg6AZznX4
TLSH
T18B547C117AD5D432E1BE0530397DABA52ABEF8316DF0C68F9384566D2D712C0A728F27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata-2

Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
Size 24.6MB
SHA256 71f2c96b02f357dc20c3fd40aea41a667dedbb80a8866bf64382cf7030e7f875
MD5 6cbd98d1e2d116381f9eb35a474a2d72
SHA1 8272d3199985e0dc4e95e8e61656dc989dc275cd
SHA512 d077b528ba0107c1bd12a7a5c0ea3c2b32bb4e255dd1a54303c6c542f0bb42d334b4ae0d014aa4d187dced74fa7962a0c1c41d305ec721f9b2af7bb790710996
SSDEEP 24576:B2gmSp1HdoO/vvTL5GyuxEHKv65pg4WoGWBdHJESL5KoEe2HoZTVrf4lx:f
TLSH
T13E47F61832F92140E7F39E3DA8F06A67493A7D5B9C15DE8D05811B8D0921FB1E872F6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{1e145caa-68b2-4e8e-bfda-2dc1a33fe259}_OnDiskSnapshotProp

Path \??\Volume{8b022b51-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{1e145caa-68b2-4e8e-bfda-2dc1a33fe259}_OnDiskSnapshotProp
Size 6KB
SHA256 dc98f784e35e23600a6a71ce1b0b077b9a3e98022931cfdbd978c14e1239faa3
MD5 7272f2e2fd74d05d800f1d7818e107e2
SHA1 7e5beee7bb43aab6ab3c97eb3afec651ea44b899
SHA512 6cff0618b1b40d9e3497264ada30fef9226ef9a605ee2b10ca5a21f769c4215e5d4bdb2e666dc9bcc6acbd02342da2b7eeb1b38ab03d58576c6dc374c271cd08
SSDEEP 96:FZphC4NH/vc8DD84LTHzbOHXOHBlBRQ88Sc9XE56tOSVQpu:zpDH1b++ZVm
TLSH
T1AED189085AF54711E2B3AB7229F14557A477B911EF33CB8E0298238E2670911F875F6F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3292-53-0x00007FFC45B70000-0x00007FFC45D92000-memory.dmp

Download

memory/3292-34-0x00007FFC45B70000-0x00007FFC45D92000-memory.dmp

Download

memory/3292-115-0x00007FFC45B70000-0x00007FFC45D92000-memory.dmp

Download

memory/3292-117-0x00007FFC45B70000-0x00007FFC45D92000-memory.dmp

Download

memory/3292-118-0x00007FFC45B70000-0x00007FFC45D92000-memory.dmp

Download

memory/3292-119-0x00007FFC45B70000-0x00007FFC45D92000-memory.dmp

Download

memory/3292-122-0x00007FFC45B70000-0x00007FFC45D92000-memory.dmp

Download

memory/3292-123-0x00007FFC45B70000-0x00007FFC45D92000-memory.dmp

Download

memory/3292-124-0x00007FFC45B70000-0x00007FFC45D92000-memory.dmp

Download