Analysis
- max time kernel
150s - max time network
152s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
09/06/2026, 00:56
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
tmpvtlb_eo8.msi
Resource
win10ltsc2021-20260513-en
windows10-ltsc_2021-x64
15 signatures
150 seconds
Behavioral task
behavioral2
Sample
tmpvtlb_eo8.msi
Resource
win10v2004-20260513-en
windows10-2004-x64
15 signatures
150 seconds
Behavioral task
behavioral3
Sample
tmpvtlb_eo8.msi
Resource
win11-20260513-en
windows11-21h2-x64
15 signatures
150 seconds
General
- Target tmpvtlb_eo8.msi
- Size 5.3MB
- Sample260609-bak78aav6k
- SHA256 46279bf47f037c5e05e84ecd3aa6f7c0074696bfe0ccb8df4781033e79e8aa1d
- MD5 f58e3b05bb9e467bc013a21d3114908d
- SHA1 b14cdd98caa179f9f3865396720b4be727f4a20c
- SHA512 e413105e3ddeba534fbd1698c15125882be9c2a4bcda6e05dc964bd7ddfb37233dc869b572db0789fbde051ea7e574f0b20c9a0bf4f16c5fc6ab4f5957000dbd
- SSDEEP 98304:LHrk3bVI2OzboNeQBWkl43yRev9CcTnuKUUainpK3F63SzzWzsphnm:3sq5zboN6F9BLubqpG6Cuzsph
- TLSH T11346332DA1D48FF4D6893332899D38778E5CDD94F0A7EC05664373222A74E680E35BE9
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Extracted
Family
-
bumblebee
Botnet
-
10112
Attributes
-
dga
vca3utda017.click
knvop5puf3w.click
fuoor4i9488.click
e27y0btovqa.click
4td54jwr0zo.click
8u1tf686x8r.click
7rbvv9nr7ux.click
0qlcz1igan7.click
1ywg4j0oomt.click
uk2cx2bz9oh.click
mmh6zjh9rws.click
tyv7socu189.click
nu1ry3ywid2.click
qbjc9488vee.click
v8tarf4uflp.click
nubhcl6uvd6.click
pj2h7xw21zx.click
n22xrd1xrto.click
1age5rpmnbq.click
s7ebb7t79vn.click
t8vxfebri9r.click
77ch3dlvcuc.click
4k2znm7tg08.click
ie4jzevdaka.click
pweekbw7x9i.click
dg4j9l1r2ay.click
6linr1ga29p.click
ae4fgatomcn.click
i0rwy7k6rh8.click
zrvvmchlzab.click
ld6w0ra2n5v.click
0iy3kqu94si.click
a2h8x65mhmb.click
n8sbjfep5yd.click
mxnz6y6v6it.click
tj17eq1yv9p.click
ih1fzdij3lw.click
trjwgh2g6wj.click
uecqk6x4j8t.click
b2fqqlxq123.click
efu7sqzes6x.click
7avrr81op36.click
yn20wnog91u.click
gypx84c0psc.click
tiitp659yg7.click
xdfbgydlc05.click
zpz5jkazftt.click
w5o0gvbo6gz.click
u4fhmu65x9q.click
mwu8dx0r8l6.click
hwcnz0dhias.click
zj7zlpwpgk2.click
es6fj45yryo.click
vfhfp5pv5jq.click
n6uv59241o8.click
vxg5zt80xk1.click
f8vdyr368rr.click
u0hs21xo0oj.click
lk34zp37aa8.click
qbn8ng1n4y6.click
anwx8vvu2tn.click
amwy9i160dz.click
mhd2v73drk9.click
e64hgph4fpf.click
gisulurnufk.click
wsswivqef2j.click
tay4gok6gyf.click
2wbw7n1xihz.click
otuk9puv3dy.click
8ra21ma0ldn.click
6wo9w60mg4p.click
119qwh18wha.click
88crnaq8rxq.click
l52j1936qx7.click
0ffmtln7j1y.click
c2h9uj4rq5j.click
99e0wxgydv3.click
8x4zwderijh.click
aoh4pifqjfw.click
pfga45i3mid.click
6u8p3dxuusp.click
73wkg93t6yb.click
9d2285jpz2p.click
q8h20fokn7m.click
sjq07uvdff3.click
kmm14f207e0.click
96l0jwdfwsf.click
5t86twnzcmf.click
jgyffzjilwz.click
gb52rzeqsel.click
jsnwvpzo96y.click
5ijbx337vd2.click
e107j7ub2do.click
2plnxces98r.click
6r3ypuoxg63.click
kmmfsxcqiyv.click
2aecwymugah.click
s38tusi2x3c.click
lznvqhcqtqs.click
wnmatvjf2h9.click
-
dga_seed
7827833623176771557
-
domain_length
11
-
num_dga_domains
300
-
port
443
-
tld
.click
rc4.plain
Signatures
- Badlisted process makes network request 28 IoCs
Network request originating from process or tool commonly abused by malware.
flow pid Process 2 4024 rundll32.exe 3 4240 MsiExec.exe 4 4240 MsiExec.exe 5 4240 MsiExec.exe 6 4240 MsiExec.exe 12 236 rundll32.exe 13 236 rundll32.exe 14 236 rundll32.exe 15 236 rundll32.exe 16 236 rundll32.exe 17 236 rundll32.exe 18 236 rundll32.exe 19 236 rundll32.exe 20 236 rundll32.exe 21 236 rundll32.exe 22 236 rundll32.exe 23 236 rundll32.exe 24 236 rundll32.exe 25 236 rundll32.exe 26 236 rundll32.exe 27 236 rundll32.exe 28 236 rundll32.exe 29 236 rundll32.exe 30 236 rundll32.exe 31 236 rundll32.exe 32 236 rundll32.exe 34 236 rundll32.exe 35 236 rundll32.exe - Executes dropped EXE 2 IoCs
pid Process 1208 ZipItNow.exe 4720 upd.exe - Loads dropped DLL 29 IoCs
pid Process 236 rundll32.exe 1208 ZipItNow.exe 1208 ZipItNow.exe 496 MsiExec.exe 4240 MsiExec.exe 4240 MsiExec.exe 4024 rundll32.exe 4240 MsiExec.exe 4240 MsiExec.exe 4240 MsiExec.exe 4240 MsiExec.exe 1208 ZipItNow.exe 4024 rundll32.exe 4024 rundll32.exe 4240 MsiExec.exe 4024 rundll32.exe 4024 rundll32.exe 4240 MsiExec.exe 4240 MsiExec.exe 4240 MsiExec.exe 2068 rundll32.exe 2068 rundll32.exe 2068 rundll32.exe 2068 rundll32.exe 2068 rundll32.exe 2068 rundll32.exe 2068 rundll32.exe 4240 MsiExec.exe 4240 MsiExec.exe - Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\G: ZipItNow.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\I: ZipItNow.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\B: ZipItNow.exe File opened (read-only) \??\N: ZipItNow.exe File opened (read-only) \??\O: ZipItNow.exe File opened (read-only) \??\Y: ZipItNow.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\A: ZipItNow.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\L: ZipItNow.exe File opened (read-only) \??\Z: ZipItNow.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\R: ZipItNow.exe File opened (read-only) \??\V: ZipItNow.exe File opened (read-only) \??\X: ZipItNow.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\K: ZipItNow.exe File opened (read-only) \??\M: ZipItNow.exe File opened (read-only) \??\W: ZipItNow.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\J: ZipItNow.exe File opened (read-only) \??\S: ZipItNow.exe - Drops file in Windows directory 42 IoCs
description ioc Process File opened for modification C:\Windows\Installer\SFXCAE3FE1E3CD24DBD7BB1D8C7A76E5D2CCC\RequestSender.dll rundll32.exe File created C:\Windows\Installer\SourceHash{DD475EBC-D960-4AF4-BB8A-BE91FA942756} msiexec.exe File created C:\Windows\SystemTemp\~DF80DBAF65624FFE53.TMP msiexec.exe File created C:\Windows\SystemTemp\~DF5E3F336FFDB1E76E.TMP msiexec.exe File opened for modification C:\Windows\Installer\MSIA7CF.tmp msiexec.exe File opened for modification C:\Windows\Installer\SFXCA020447B5EF4AC69A483AB0E33026B690\CustomAction.config rundll32.exe File opened for modification C:\Windows\Installer\MSI9D06.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIA5D3.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIA603.tmp msiexec.exe File created C:\Windows\Installer\SourceHash{A5863F7C-1873-400B-A58B-82D197645A40} msiexec.exe File created C:\Windows\SystemTemp\~DFBE1F8CD3424DF5A6.TMP msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\SystemTemp\~DFFA1D4DA4DB536E6D.TMP msiexec.exe File opened for modification C:\Windows\Installer\SFXCAE3FE1E3CD24DBD7BB1D8C7A76E5D2CCC\WixToolset.Dtf.WindowsInstaller.dll rundll32.exe File opened for modification C:\Windows\Installer\SFXCAE3FE1E3CD24DBD7BB1D8C7A76E5D2CCC\CustomAction.config rundll32.exe File opened for modification C:\Windows\Installer\MSIAA03.tmp msiexec.exe File created C:\Windows\SystemTemp\~DF67953D0D7E75E0E8.TMP msiexec.exe File opened for modification C:\Windows\Installer\SFXCAE3FE1E3CD24DBD7BB1D8C7A76E5D2CCC\Microsoft.Win32.TaskScheduler.resources.dll rundll32.exe File opened for modification C:\Windows\Installer\SFXCA020447B5EF4AC69A483AB0E33026B690\WixToolset.Dtf.WindowsInstaller.dll rundll32.exe File opened for modification C:\Windows\Installer\SFXCA020447B5EF4AC69A483AB0E33026B690\Microsoft.Win32.TaskScheduler.resources.dll rundll32.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\MSIA790.tmp msiexec.exe File created C:\Windows\Installer\e589bdd.msi msiexec.exe File created C:\Windows\SystemTemp\~DF0F3FE471B3C6C496.TMP msiexec.exe File created C:\Windows\Installer\e589bdf.msi msiexec.exe File opened for modification C:\Windows\Installer\SFXCA020447B5EF4AC69A483AB0E33026B690\RequestSender.dll rundll32.exe File opened for modification C:\Windows\Installer\SFXCA020447B5EF4AC69A483AB0E33026B690\Microsoft.Win32.TaskScheduler.dll rundll32.exe File opened for modification C:\Windows\Installer\MSIF342.tmp msiexec.exe File created C:\Windows\SystemTemp\~DF84101A9C61D6C2F2.TMP msiexec.exe File opened for modification C:\Windows\Installer\MSIA6C2.tmp msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File opened for modification C:\Windows\Installer\SFXCAE3FE1E3CD24DBD7BB1D8C7A76E5D2CCC\Microsoft.Win32.TaskScheduler.dll rundll32.exe File opened for modification C:\Windows\Installer\MSIA633.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIA653.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIA730.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIA760.tmp msiexec.exe File opened for modification C:\Windows\Installer\e589bdd.msi msiexec.exe File created C:\Windows\SystemTemp\~DFCE1764864C12F579.TMP msiexec.exe File created C:\Windows\Installer\e589be0.msi msiexec.exe File opened for modification C:\Windows\Installer\e589be0.msi msiexec.exe File opened for modification C:\Windows\Installer\MSIA516.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIA517.tmp msiexec.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
pid Process 1288 msiexec.exe - System Location Discovery: System Language Discovery 1 TTPs 6 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZipItNow.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language msiexec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe - Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000643a9eb9192046c00000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000643a9eb90000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed35000000ffffffff000000000700010000680900643a9eb9000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff350000000000000005000000ffffffff000000000700010000f8ff1a643a9eb9000000000000f0ff350000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d643a9eb9000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe - Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 2036 msiexec.exe 2036 msiexec.exe 2036 msiexec.exe 2036 msiexec.exe 4720 upd.exe 4720 upd.exe 4720 upd.exe 4720 upd.exe 4720 upd.exe 4720 upd.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 1288 msiexec.exe Token: SeIncreaseQuotaPrivilege 1288 msiexec.exe Token: SeSecurityPrivilege 2036 msiexec.exe Token: SeCreateTokenPrivilege 1288 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 1288 msiexec.exe Token: SeLockMemoryPrivilege 1288 msiexec.exe Token: SeIncreaseQuotaPrivilege 1288 msiexec.exe Token: SeMachineAccountPrivilege 1288 msiexec.exe Token: SeTcbPrivilege 1288 msiexec.exe Token: SeSecurityPrivilege 1288 msiexec.exe Token: SeTakeOwnershipPrivilege 1288 msiexec.exe Token: SeLoadDriverPrivilege 1288 msiexec.exe Token: SeSystemProfilePrivilege 1288 msiexec.exe Token: SeSystemtimePrivilege 1288 msiexec.exe Token: SeProfSingleProcessPrivilege 1288 msiexec.exe Token: SeIncBasePriorityPrivilege 1288 msiexec.exe Token: SeCreatePagefilePrivilege 1288 msiexec.exe Token: SeCreatePermanentPrivilege 1288 msiexec.exe Token: SeBackupPrivilege 1288 msiexec.exe Token: SeRestorePrivilege 1288 msiexec.exe Token: SeShutdownPrivilege 1288 msiexec.exe Token: SeDebugPrivilege 1288 msiexec.exe Token: SeAuditPrivilege 1288 msiexec.exe Token: SeSystemEnvironmentPrivilege 1288 msiexec.exe Token: SeChangeNotifyPrivilege 1288 msiexec.exe Token: SeRemoteShutdownPrivilege 1288 msiexec.exe Token: SeUndockPrivilege 1288 msiexec.exe Token: SeSyncAgentPrivilege 1288 msiexec.exe Token: SeEnableDelegationPrivilege 1288 msiexec.exe Token: SeManageVolumePrivilege 1288 msiexec.exe Token: SeImpersonatePrivilege 1288 msiexec.exe Token: SeCreateGlobalPrivilege 1288 msiexec.exe Token: SeBackupPrivilege 2076 vssvc.exe Token: SeRestorePrivilege 2076 vssvc.exe Token: SeAuditPrivilege 2076 vssvc.exe Token: SeBackupPrivilege 2036 msiexec.exe Token: SeRestorePrivilege 2036 msiexec.exe Token: SeRestorePrivilege 2036 msiexec.exe Token: SeTakeOwnershipPrivilege 2036 msiexec.exe Token: SeRestorePrivilege 2036 msiexec.exe Token: SeTakeOwnershipPrivilege 2036 msiexec.exe Token: SeRestorePrivilege 2036 msiexec.exe Token: SeTakeOwnershipPrivilege 2036 msiexec.exe Token: SeRestorePrivilege 2036 msiexec.exe Token: SeTakeOwnershipPrivilege 2036 msiexec.exe Token: SeRestorePrivilege 2036 msiexec.exe Token: SeTakeOwnershipPrivilege 2036 msiexec.exe Token: SeRestorePrivilege 2036 msiexec.exe Token: SeTakeOwnershipPrivilege 2036 msiexec.exe Token: SeRestorePrivilege 2036 msiexec.exe Token: SeTakeOwnershipPrivilege 2036 msiexec.exe Token: SeRestorePrivilege 2036 msiexec.exe Token: SeTakeOwnershipPrivilege 2036 msiexec.exe Token: SeRestorePrivilege 2036 msiexec.exe Token: SeTakeOwnershipPrivilege 2036 msiexec.exe Token: SeRestorePrivilege 2036 msiexec.exe Token: SeTakeOwnershipPrivilege 2036 msiexec.exe Token: SeRestorePrivilege 2036 msiexec.exe Token: SeTakeOwnershipPrivilege 2036 msiexec.exe Token: SeRestorePrivilege 2036 msiexec.exe Token: SeTakeOwnershipPrivilege 2036 msiexec.exe Token: SeRestorePrivilege 2036 msiexec.exe Token: SeTakeOwnershipPrivilege 2036 msiexec.exe Token: SeRestorePrivilege 2036 msiexec.exe - Suspicious use of FindShellTrayWindow 5 IoCs
pid Process 1288 msiexec.exe 1288 msiexec.exe 1208 ZipItNow.exe 1884 msiexec.exe 1884 msiexec.exe - Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 2036 wrote to memory of 1012 2036 msiexec.exe 87 PID 2036 wrote to memory of 236 2036 msiexec.exe 89 PID 2036 wrote to memory of 1208 2036 msiexec.exe 90 PID 2036 wrote to memory of 496 2036 msiexec.exe 91 PID 1208 wrote to memory of 1884 1208 ZipItNow.exe 92 PID 2036 wrote to memory of 4240 2036 msiexec.exe 93 PID 4240 wrote to memory of 4024 4240 MsiExec.exe 94 PID 4240 wrote to memory of 2068 4240 MsiExec.exe 95 - Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\tmpvtlb_eo8.msi1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1288
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2036 -
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵PID:1012
-
-
C:\Windows\system32\rundll32.exe"rundll32.exe" "C:\Users\Admin\AppData\Local\Temp\ApplicationInstallationFolder_11\ZipItNow.dll",DllRegisterServer2⤵
- Badlisted process makes network request
- Loads dropped DLL
PID:236
-
-
C:\Users\Admin\AppData\Local\Temp\ApplicationInstallationFolder_11\ZipItNow.exe"C:\Users\Admin\AppData\Local\Temp\ApplicationInstallationFolder_11\ZipItNow.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1208 -
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Roaming\Zip It Now\Zip It Now 1.4.0.0\install\7645A40\ZipItNow.msi" AI_SETUPEXEPATH=C:\Users\Admin\AppData\Local\Temp\ApplicationInstallationFolder_11\ZipItNow.exe SETUPEXEDIR=C:\Users\Admin\AppData\Local\Temp\ApplicationInstallationFolder_11\ EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1780725918 " AI_EUIMSI=""3⤵
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
PID:1884
-
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 106D93F43A3C21D0A6481C9C1BB132C8 C2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:496
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 0F7EA94C0092872ECE4AAD61A3C934DF2⤵
- Badlisted process makes network request
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4240 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Windows\Installer\MSIA516.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240690578 3 RequestSender!RequestSender.CustomActions.Start3⤵
- Badlisted process makes network request
- Loads dropped DLL
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4024
-
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Windows\Installer\MSIA7CF.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240691156 61 RequestSender!RequestSender.CustomActions.CreateScheduledTask3⤵
- Loads dropped DLL
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2068
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:2076
-
C:\Users\Admin\AppData\Roaming\Zip It Now\upd.exe"C:\Users\Admin\AppData\Roaming\Zip It Now\upd.exe"1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:4720
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Config.Msi\e589bde.rbs
- Size 8KB
- SHA256 e84435b9c53362ecf399f757ea2e5033225d46aa37cd233cd2acf594a9f09d3c
- MD5 99414a2400ccd085b4c5f00696b31e4d
- SHA1 15e06bd82cc12c116395a7b4f25851caaff4fd89
- SHA512 76971e3220b22356cddbb2f531fc43d072ef99a208fdba47767b3dc452f84f20de69631f4f045a8380caf943a8f0dba87d8ad9ad4bcc69b491deba839797a9bd
- SSDEEP 96:kmYJeJCysw28oCzADaUCrOTCsTl0UCrOTCiCawTlY6YFMrKi89maJmACLpZTT12f:hiYy8oCCtbOIhbOTi1enLpu
- TLSH T154024081F340C5D2E85A233ADE8B17247B73D3EEDA91330B688D82281F52B984FD55C6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\rundll32.exe.log
- Size 847B
- SHA256 f4d1c038db378dec10e7e2fc81ccc2e2d4b8132ef0d66905e3625a0b0cbbde5f
- MD5 ef375f28c91db0202bf7db29c0cbc2ce
- SHA1 5a3f5d4ec75a468b908c2eb2b9e6f4b1e76c1017
- SHA512 f18141e352fcd253e02cb25fa0cff29ab06dec62bafd5aa80ca48c959d1dba97deae830d01bf521f851a8143b9416747eb170d0cedafa32b59155027c02f244d
- TLSH T14C0126712331B6D989523F53095D66841AFF0745B5A4EE2CB599225ED82A0172F222E3
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\ApplicationInstallationFolder_11\ZipItNow.dll
- Size 2.1MB
- SHA256 7010549cf7d4ce19718a43c7cbceadef3a7e7900da8d21c5a37319825c9d20de
- MD5 005803929d59eede8a08558a418b7e7a
- SHA1 9d2ec76db46acdf726d6e05686491f02b167129a
- SHA512 65ef3b886fb7a01c17055cf9a358e5099786e104e53bcd805761cf77d808d29dfef1d2052a0d834aff33db940d91c4fc879de1fb26fde08bce7b330009473034
- SSDEEP 49152:UCADm8JWasnxpSfHQ2031JEQ7qcLBNuF9OPOsAN:UCAD55snbSfEFP7qkW9O
- TLSH T141A5224401A732E0DA40EFF71A29BFAECB7B73E2161705116C4473B98269F62A5DCD87
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\ApplicationInstallationFolder_11\ZipItNow.exe
- Size 4.7MB
- SHA256 956713b1bca39dc306f5402815f1258cfe4279c85c42758c0e107e5f8ee5576a
- MD5 534cd01067c81867723338b17697ee32
- SHA1 a4e5a835909c7289a3372d58d80dc539309d6736
- SHA512 df259beb1b0b30b24e02754f9da688092274c7ec7e775f8fd4b9bdfbb75a1be8f9107562568d6223fa9ee61e51f4d93f8bf9c6a83b47f1611f16a521bc5f8172
- SSDEEP 98304:9AhUCyxeAi0D4QZmrT5cKdCZVhJAh4lqlCjdganVLn3R:OeCau+SCZVMtaVjB
- TLSH T1A236CF31778AC53BD56215B16A2CDBAF51287FA20F7240C793E81E6F14B58C28732E67
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\MSIA276.tmp
- Size 386KB
- SHA256 bf7f6f7e527ab8617766bb7a21c21b2895b5275c0e808756c2aadcd66eff8a97
- MD5 72b1c6699ddc2baab105d32761285df2
- SHA1 fc85e9fb190f205e6752624a5231515c4ee4e155
- SHA512 cde1e754d8dfb2fa55db243517b5dd3d75b209ea6387ef2e4be6157875e536db2373f23434a9e66c119150301c7b7cdf97de5a5544d94c03247b4ae716cbc170
- SSDEEP 6144:ti1/q935N0IGlLJ9HZX9uoYcu8ugbcJZyZPAOliTVKzAZq7Y:w/qKIGlLJ9H7u8ugbYENLyVRq7Y
- TLSH T142845B2072EAC836D5BE05B03979C9AF45297EA55BF2C4EB13C81D1F09B29C25335F26
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Zip It Now\Zip It Now 1.4.0.0\install\7645A40\ZipItNow.msi
- Size 2.6MB
- SHA256 39da510263e23e8b172f460f8946f0934eeff7c1bb8aeb2f92e4439fd6eea1b8
- MD5 54f36f1b9118b35e2dbb2e0eb0c377ab
- SHA1 74c4144ec0d694d2cd047d235444ae309fc2a3aa
- SHA512 d51360bce9efa04208123df0e303c5364ad19b75fd2605ed21fe06f6e63f59c95d0595d4776292e6b0160b295873c1ce3dddf70c328fb2f85d4a83ba22efb22a
- SSDEEP 49152:khG5dYodoVG6Aq67dCWYVWzwPYCR+Q0WaQOOnk8G+uKn4mrasbUGtrpMMERbTnVg:H5dYodkAq0gWzWlLuKn4mes5JpMM8YQ
- TLSH T127D59C207696C136D4BE0570292DDA7A527D7EB00B7684DBA3C85E2F2EB09C25335F27
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Zip It Now\Zip It Now 1.4.0.0\install\7645A40\upd.exe
- Size 1.6MB
- SHA256 5ac47d4b9de6a7a45202417bfbd65501ed227a02aeae19c8a5b4e902299ef1df
- MD5 d68a0453311d9645436889d698dfd3bc
- SHA1 40a614fe230373bb4c7e9d1791cf3c1dcc56a966
- SHA512 beda42b97063edd4be7d14342e965ce214c1228ac65fd81213614d1279e33ad230e5f77beaef000b05badb3cf32bcd72df73269e29422b9697c7900c5df5dc91
- SSDEEP 24576:wJa371cyvO5Y+dHY8W1jLvJ4YyzdTLxqegEVxn0Xke23a6hLpTW+MBF8OZTCDH/:wgOQAY4W1fJ4xdEezyXpwa6hLpTCnGDf
- TLSH T10E75BE4BEAB541F0C5BAC1399542613AFCB134E64370A7CB57918B5B1B22BE4EB3E710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Zip It Now\Zip It Now 1.4.0.0\install\7645A40\zip_it_now.exe
- Size 517KB
- SHA256 941580cbad9e1c9e3e62c49a80ce2c7931ee4a931a00e36309b3b4d2f1c69907
- MD5 4a2ee83f3ad69f81df42c4e87af013f8
- SHA1 c3f65d6aabfa419d510ea5aefe0ded17e2bdee73
- SHA512 6101578090fe05568308ada1f8b65950448bde47e7e37f8d0113d1c22a2262b5cac9dfd5800cc1121dae2be37a7d1ee64c398e417d5511af8952aabbd0100308
- SSDEEP 12288:FESQRfF9BofVtWJAY3h4RMPzE5vjaIa6IkrZHJHQ:FESEd4nWGz6Pzajy8BQ
- TLSH T1BBB4D06E661803E6E058D278D946C631D572FC4647528BEF46D7FD3B3E632D22C3A288
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Zip It Now\Zip It Now 1.4.0.0\install\decoder.dll
- Size 206KB
- SHA256 9b7ff49f7e1d0a39826ec458c8004b20a65a4bd0592b083f38b01e2dbc2b510f
- MD5 9d45f2790dda55df2d99ef66dcb2019d
- SHA1 f2a369c1b82476e2e0641f95394dd4dee8223f01
- SHA512 9bef561ec6908dcd7e75f5f63cff8b1ec73e9be2b4e4aa5602182cde18d691cc28259b980c87246c5d27b4284bc783fba44d92a202f77b15f3e65c89dd3aa069
- SSDEEP 3072:DhFksRwhQlCuhUuOJ8TMoxO252xXqpg9HUP+JFkKtyNuoVL0ZhpA7Lq2VHM93LPb:9HguquwuqXaqUMkK8uoVL0ehVebsN
- TLSH T1B8247C603683C97AD66F1A30553AEA6B063D76480F20D8EBE7981D3E1E394C35735C6B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\MSIA516.tmp
- Size 416KB
- SHA256 45608820ac1375e4490f0bb1b289745ef7183370f2411138f50a88d363f9cad0
- MD5 9d0601206bfe26161f88caf174a0771a
- SHA1 d0edc2cedaac22c56d740ee2631cd3b7c868c6bf
- SHA512 ee1c60fbc45dc73b679d895b896ab0c056b640b279a52c1fac5e95181a7128f15ce88d7cc6f6105ef33c20b01eb9016452866387328b0cc7ed07bf5c6a3de9a1
- SSDEEP 6144:Lz9G/EaiyLS/QQqHrxXMNIKTP3bDm+niQBuc4RrABCB7rN4m7PXVn/SeTdD/S:tqEahS/QQqdvKTP+gi4uc4R9GmzZSeVa
- TLSH T19A94D01079E48135E4FF2D3854384A65897FBA605B70CECFAB484DAE9D707C28A35B27
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\MSIA653.tmp
- Size 544KB
- SHA256 32211c43bcfee2ea3ae54899af178d1fc0c2b1111b2a9e3cc3fd125e1ab7daad
- MD5 40117f705bff008c3d96a73162dad044
- SHA1 2735813836f36b5de83a745c47628053a0f61f66
- SHA512 eace1d55d479c4cf5692ec1dc98a6738e94874901bebe14a0a0a93eefd00fc4bd55a701e4629a1f7c47f72ac91fe3b698d590a8463119998852e05d6682f91a4
- SSDEEP 12288:ZPLl5a0nxpqIHwLZ51wgqjVWjYiiout8/09wjmwYMNULr9VSuOzwPYUbR+B:t6+wdjwx5WLuTLBVWzwPYUbR+B
- TLSH T1B9C44A20769AC136D46D45B01AAECB6B51697FB10B7A54EBE3C85A7F09F08C20335F27
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\MSIA760.tmp
- Size 401KB
- SHA256 8a77ed5526ecf88b81844993b5c55bdf6e056aade9c8cb3e1fd89a3b4d41a780
- MD5 ec4cd2159189ffa5d293a24e92964b6d
- SHA1 d16bbb7b4504afa4d70442e051e548372586b5d3
- SHA512 099663cd0584dce7ec17322fcecef330341a711a1d6854f57eb852650ab8272b44708f18ebf6ca0e42b2ca0ed10ad99ea7729562de553353afb615604ea19101
- SSDEEP 12288:pIS7IPlz5PiwtBZmaMwyqpYS2uryKiRL5R58MNTxhV2LQZyF9lt/:8iwrZbMMERWcTnVzZujt/
- TLSH T168947C20759AC136D87D0930753DDA6B122D3BB00B7A84E7E7CC5AAF0974AC21635F6B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\SFXCA020447B5EF4AC69A483AB0E33026B690\Microsoft.Win32.TaskScheduler.dll
- Size 325KB
- SHA256 ea27c65491119eee5c8e87ce3d470783580db8fc5bd141c496768d7d0cce779a
- MD5 0616ea42b68a8f5f2f01bcd985bdcbc7
- SHA1 88d6aae1f17b00f4391e0e7b17e98c494be73ba1
- SHA512 ce4657908615c4837084c75d806c083b8f7e63965a2e7866b8c96de7c0278a0857235b74cd9443769968165db250eba042a5b05927febff5bb70bebb7dcbd814
- SSDEEP 3072:QJA5RylsHmDFin8nhWvGzOJ1mYAFeYXxCJIrkp9TD6qaXn69aKCax8weCycJ5Dfa:ZHmDxnhWvGSJYRFeYXEee9TWqa369An
- TLSH T10A645B6117EC862EDAEF1F79F074121186B9F816B97ADB0D9A80E5DD4C23781D922333
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\SFXCA020447B5EF4AC69A483AB0E33026B690\RequestSender.dll
- Size 13KB
- SHA256 a3f2df576e23e27904150abe24b4a03c7dfa2fb52bb847ab54e8b4cd0032103d
- MD5 208affd76ff5813c6ffd74fe02780953
- SHA1 2edf070cbbd4031d470db0e68af7f36c7c68c3a3
- SHA512 9bab13a330e00a62e20957e4508e7ef2cef00187783363fdcdb23ce257e48d3ceb4a9b830f6e1b6021ecabdcb3bb3d2852b8d898b32bc506d30e7848c7fff51f
- SSDEEP 192:0fz0xy7I3V/XRXDCTqWTFpbfoFVfBzyjjL/bD6EzL+bqZeQrDq/ug:0fYxy6V/duBpbfcj2/HBxe8Wu
- TLSH T18C52E80077D88736ED7F8B3AADB106504571BBCA9927CF2F4D8C608D1E22509EA51FB6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\SFXCA020447B5EF4AC69A483AB0E33026B690\WixToolset.Dtf.WindowsInstaller.dll
- Size 193KB
- SHA256 a614884ea627da1925131ebf41e8ae202caeac0fe543b86384f5eb2bfaf1aa75
- MD5 ef8d5785ac8669f5fd54e22f52770e6b
- SHA1 4c94ae7ef233be33a56c0a5d9b8e2211d5d5792c
- SHA512 ab3b140bd6531f22e994606820e6511442c23d9015b1e1a38aaed43aa42ba29a996511151d0b3a383c05c2b11f670e52cdd7f507ad1a1ad8cebea57fb22ade5a
- SSDEEP 3072:8Of7tVL+l4lj19l4uDHYHj69UgoTqdda7CnfKlRUjW01KytaljYqCDPC:8gQQx54Hj6jomdrzalMqb
- TLSH T14A149C2A57F84B3ECEFF8778E2614252C7B1F1E67103DB1D9D8281A52163784B682397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\SFXCAE3FE1E3CD24DBD7BB1D8C7A76E5D2CCC\CustomAction.config
- Size 959B
- SHA256 7e1096d6f39ebe04d6e38bc714983af05ed92cc2bb4d3365ed4c85e733cb145c
- MD5 ee9a8381338b060d86c58e2415f481f3
- SHA1 200f3ed7c773f50c80644f3976e09e876f45993f
- SHA512 26b9108b9522574e08560bc45a6470f85ca149317bd763f3a357040e0f0e743fd7bfc05e0ce2d9fb52bf89e22c61d221ddf8a7163f5143848717ca3d56847ef1
- TLSH T1A311100D4A842B7724322783BFACA0C4E76090BA3D94411C749BB9151F39938176338F
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\Installer\e589bdd.msi
- Size 5.3MB
- SHA256 46279bf47f037c5e05e84ecd3aa6f7c0074696bfe0ccb8df4781033e79e8aa1d
- MD5 f58e3b05bb9e467bc013a21d3114908d
- SHA1 b14cdd98caa179f9f3865396720b4be727f4a20c
- SHA512 e413105e3ddeba534fbd1698c15125882be9c2a4bcda6e05dc964bd7ddfb37233dc869b572db0789fbde051ea7e574f0b20c9a0bf4f16c5fc6ab4f5957000dbd
- SSDEEP 98304:LHrk3bVI2OzboNeQBWkl43yRev9CcTnuKUUainpK3F63SzzWzsphnm:3sq5zboN6F9BLubqpG6Cuzsph
- TLSH T11346332DA1D48FF4D6893332899D38778E5CDD94F0A7EC05664373222A74E680E35BE9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
- Size 24.6MB
- SHA256 903f15ff36269da9ac4a88c079463845ebb345418802e1aaf3cf36addf21b4ca
- MD5 87a4413ee970ec2387bb39e180443a7b
- SHA1 084321a90e7faec4313c600c3d2a07a7ff20fd31
- SHA512 fb096b9e2b581e8b6c51033deec7d09c76eb55b7eb393339ad7b49187ec5446fec2e14b92118da9654681697d1d31a496152dce4c0576118bed92477924c124b
- SSDEEP 24576:C2gmSp1/doO/vvTLaWxOBk3afqpaA4Fr22CN3JEBYK6YktF046AWrMr2x:8
- TLSH T10B47C22436F92210E7F79E3CA8F06A234A3E7D5B9C15DE8D45451B4E0921FB0E872F5A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\Volume{b99e3a64-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{052b9f25-f7de-4b5f-87c7-0063d2ec9aad}_OnDiskSnapshotProp
- Size 6KB
- SHA256 0cbc603bd0e499e01a084fcebaac2db338e174ad4d32a503ef80b41992a95c61
- MD5 a1cf18a357f060b4de69ffec316ba568
- SHA1 49c8bfdfd31f6f833b73c99d652c061418970928
- SHA512 0170d3bf77dbba9478080e1ba4981a912d0a2e6f05446c38377ad6478a703d5483ecf52a4c9c9c28fb080d4cbd13b80118df9b623c17f4e7cc65929c10817f91
- SSDEEP 96:FCWtezvc8DD84LTHzbOHXOHBlBRQ88Sc9XE56tOSVQpu:ALb++ZVm
- TLSH T1BFD189085AE54711E2B3AB3129F54557A877B911EF33CB8E0198638E2670A10F935F5F
- MD5 SHA1 SHA512 SSDEEP TLSH