bumblebee | 69d3cf7d850bd05b3a901bc923f3c48392cedc1f863e6fe2b44e07096a180905

Analysis

max time kernel
149s
max time network
151s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260513-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260513-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
09/06/2026, 01:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
tmps3mxcb4g.msi
Size 21.7MB
Sample260609-bc995aav8m
SHA256 69d3cf7d850bd05b3a901bc923f3c48392cedc1f863e6fe2b44e07096a180905
MD5 fd990d3d2706f16151404f9e4cdc26b7
SHA1 fadccd0e05ef4d121da7dee9b957a42667ebe062
SHA512 3a71781f7bde204643a08cb0e3bd923f2d17c2b53a69b8053b009bbdacd2b3c055a4bdf8ee7f5c9c1878b48a44f85ea3e531aa2da03cbd5d1da5e2143f67b04a
SSDEEP 393216:1FbgvkXDSlnAH4LnIg2xWzQ6jwqOfvo7FZJeWLIYX45sVzMwObRb9q7+jklofNoi:zsvJnK4KxqmvaXJeWLs2VKkzGiSqws
TLSH
T1FA3733AFB16D8F39EC5A607CC4D937CA66006D9C32058533F219F1F727B62B742A9690
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

grp0002 discovery bumblebee installer loader persistence privilege_escalation ransomware

Malware Config

Extracted

Family

bumblebee

Botnet

grp0002

Attributes

dga
ev2sirbd269o5j.org

ijt0l3i8brit6q.org

ewujsfb1dp5ran.org

8doj8uvx604eck.org

kwywztxoo2xdot.org

2rxyt9urhq0bgj.org

ky1d1p1daahe5t.org

ovh1kn1tcqw5kp.org

6cimu4mc085em8.org

5ka8rxp6t6eup2.org

ks50ioz9nm3v05.org

v5rjsdqogstopr.org

epnl524h4k03mu.org

hpzmehtnkk4q22.org

ygvmhd7ll9v2nu.org

oovlcxvht9kupu.org

1074slp8zafyz3.org

vfwlzltibeg7ne.org

wp67lr8ysypurn.org

1ge03xy5vtwn5s.org

958xz3300iu8oe.org

dlbqduy9gjprko.org

tycl4o5dep10cd.org

ui9bex45gw70az.org

trj1qy559ygvx3.org

w823niq7veztr9.org

01t05hb4armbco.org

igl71zhw25qw3d.org

j8ku0xu0dqduxr.org

jy3y61q6hyhf4c.org

s96phai2s1wzen.org

usguzk6xqox3ss.org

vfo2q74c1y0x74.org

tig85m8n7xixaz.org

0jfv3ru6slys8b.org

mh4bjdyhen3d9z.org

v3hm711ignzez6.org

xuixp4uro6pl3z.org

haq82ih59xa38b.org

zs2u14kk7bqbn2.org

zrym1d73kdmimj.org

r2r3qzjb3bp1ar.org

z3vni7gw9q1i8p.org

nlvskzui15vxju.org

13ov5ypehzqx5l.org

2x51hwe9cnidu4.org

gydu03jt8n5e41.org

gd2i9y77jhbjqb.org

9g055w2ak8hd6t.org

x5x2vq5joobqxe.org

acl1omagtzq38v.org

18xsm4245vgytb.org

q008rx2d58h76q.org

cybf5coa1t2xr2.org

tx6jny2iaea186.org

3pvk0zw1k7g28h.org

nrd1qnd4l7tcp9.org

bvt69kywl2s8rg.org

0youdp14i4r4h5.org

r4aadwqq9d2h24.org

l2q3fkrpgyxr8r.org

s6mngnfnj9nrfj.org

2yr46kghd39ise.org

fo1463oipy7oq8.org

gkukvtxlew982a.org

3h98rycjvt3gj5.org

xgcibmd1rd21us.org

kecah03gobzlrt.org

jpgw5b5zv4vdoy.org

hnxkyiagzxlvv0.org

aelovxoinqta4a.org

ae7a1pbhn5ytpe.org

fbixeudnf6vbhh.org

cjlv1576zqgb47.org

j8plhuz7p6052k.org

pk743hnddx0nds.org

3pu8prnkr8v31d.org

2gdaqm18d6p9d8.org

avm2dir92zqv9x.org

54jmh8bnrpha7y.org

y9e05pr4v7lhp9.org

o44e59aio5jk9q.org

u0tkv94vt86y23.org

q2myvg0j1nna57.org

x5b6lm11d90dht.org

invutsz52frzl8.org

t052317kru670j.org

011jn31n05qzpp.org

tqilxwrw5m54pj.org

pkzwaki575nsll.org

z3l0kxd46ulurv.org

z55s2t6ca702es.org

nrej2ipydbg40k.org

15eaytwast9oig.org

560tvzwrobbl2k.org

1v6pqsve9hg3gy.org

7p788ywb3z9fwe.org

vzf1g0it8gpvq7.org

oqu78tlfbxcf50.org

th87nd6s31jke7.org
dga_seed
4792266342353752649
domain_length
14
num_dga_domains
300
port
443
tld
.org

rc4.plain

Signatures

Family: BumbleBee
BumbleBee is a loader malware written in C++.
loader bumblebee

Executes dropped EXE 3 IoCs

pid	Process
2604	consent.exe
4920	Advanced_IP_Scanner_2.5.4594.1.exe
1600	Advanced_IP_Scanner_2.5.4594.1.tmp

Loads dropped DLL 2 IoCs

pid	Process
2604	consent.exe
1600	Advanced_IP_Scanner_2.5.4594.1.tmp

Badlisted process makes network request 9 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
5	4824	msiexec.exe
13	4824	msiexec.exe
14	4824	msiexec.exe
16	4824	msiexec.exe
17	4824	msiexec.exe
19	4824	msiexec.exe
22	4824	msiexec.exe
36	4824	msiexec.exe
45	4824	msiexec.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe

Drops file in Windows directory 8 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\e58e877.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{DD475EBC-D961-4AF4-BB8A-BE91FA942757}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIEB17.tmp	msiexec.exe
File created	C:\Windows\Installer\e58e877.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File created	C:\Windows\Installer\e58e879.msi	msiexec.exe

Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs

persistence privilege_escalation

Installer Packages

T1546.016

Msiexec

T1218.007

pid	Process
4824	msiexec.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Advanced_IP_Scanner_2.5.4594.1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Advanced_IP_Scanner_2.5.4594.1.tmp

Inno Setup is an open-source installation builder for Windows applications. 3 IoCs

Inno Setup installer

installer

resource	yara_rule
behavioral1/files/0x0007000000028597-35.dat	innosetup
behavioral1/memory/4920-38-0x0000000000400000-0x000000000042D000-memory.dmp	innosetup
behavioral1/memory/4920-64-0x0000000000400000-0x000000000042D000-memory.dmp	innosetup

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 000000000400000064924c57361694940000000000000000000000000000000000000000000000000000000000000000000000000000000000001071020000000000c01200000000ffffffff00000000270101000088380164924c570000000000001071020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d083020000000000c050dc000000ffffffff000000000700010000e8410164924c57000000000000d08302000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000090d4de0000000000000005000000ffffffff000000000700010000486a6f64924c5700000000000090d4de000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000090d4e30000000000000005000000ffffffff00000000070001000048ea7164924c5700000000000090d4e300000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe

Modifies data under HKEY_USERS 10 IoCs

description	ioc	Process
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	Advanced_IP_Scanner_2.5.4594.1.tmp
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	Advanced_IP_Scanner_2.5.4594.1.tmp
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager	Advanced_IP_Scanner_2.5.4594.1.tmp
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\Owner = 400600008f442299abf7dc01	Advanced_IP_Scanner_2.5.4594.1.tmp
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\Sequence = "1"	Advanced_IP_Scanner_2.5.4594.1.tmp
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000	Advanced_IP_Scanner_2.5.4594.1.tmp
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\SessionHash = 452a93d27bba38c3a755b6b34db3ddec4190ba1eb3d870afbdbd37d4eed778a8	Advanced_IP_Scanner_2.5.4594.1.tmp

Modifies registry class 20 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CBE574DD169D4FA4BBA8EB19AF497275\ProductName = "Advanced-IP-Scanner"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CBE574DD169D4FA4BBA8EB19AF497275\AdvertiseFlags = "388"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CBE574DD169D4FA4BBA8EB19AF497275\InstanceType = "0"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CBE574DD169D4FA4BBA8EB19AF497275\AuthorizedLUAApp = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CBE574DD169D4FA4BBA8EB19AF497275\SourceList\Net	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CBE574DD169D4FA4BBA8EB19AF497275\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CBE574DD169D4FA4BBA8EB19AF497275\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CBE574DD169D4FA4BBA8EB19AF497275\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CBE574DD169D4FA4BBA8EB19AF497275\SourceList\PackageName = "tmps3mxcb4g.msi"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\CBE574DD169D4FA4BBA8EB19AF497275	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CBE574DD169D4FA4BBA8EB19AF497275\PackageCode = "6C6600C723BF9D44A834CEB9A3CA7085"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CBE574DD169D4FA4BBA8EB19AF497275\Version = "16777216"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CBE574DD169D4FA4BBA8EB19AF497275\Assignment = "1"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CBE574DD169D4FA4BBA8EB19AF497275\Clients = 3a0000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\CBE574DD169D4FA4BBA8EB19AF497275\AppLicense	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CBE574DD169D4FA4BBA8EB19AF497275	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CBE574DD169D4FA4BBA8EB19AF497275\Language = "1033"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CBE574DD169D4FA4BBA8EB19AF497275\DeploymentFlags = "3"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CBE574DD169D4FA4BBA8EB19AF497275\SourceList\Media	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CBE574DD169D4FA4BBA8EB19AF497275\SourceList\Media\1 = ";"	msiexec.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
940	msiexec.exe
940	msiexec.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4824	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4824	msiexec.exe
Token: SeSecurityPrivilege	940	msiexec.exe
Token: SeCreateTokenPrivilege	4824	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	4824	msiexec.exe
Token: SeLockMemoryPrivilege	4824	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4824	msiexec.exe
Token: SeMachineAccountPrivilege	4824	msiexec.exe
Token: SeTcbPrivilege	4824	msiexec.exe
Token: SeSecurityPrivilege	4824	msiexec.exe
Token: SeTakeOwnershipPrivilege	4824	msiexec.exe
Token: SeLoadDriverPrivilege	4824	msiexec.exe
Token: SeSystemProfilePrivilege	4824	msiexec.exe
Token: SeSystemtimePrivilege	4824	msiexec.exe
Token: SeProfSingleProcessPrivilege	4824	msiexec.exe
Token: SeIncBasePriorityPrivilege	4824	msiexec.exe
Token: SeCreatePagefilePrivilege	4824	msiexec.exe
Token: SeCreatePermanentPrivilege	4824	msiexec.exe
Token: SeBackupPrivilege	4824	msiexec.exe
Token: SeRestorePrivilege	4824	msiexec.exe
Token: SeShutdownPrivilege	4824	msiexec.exe
Token: SeDebugPrivilege	4824	msiexec.exe
Token: SeAuditPrivilege	4824	msiexec.exe
Token: SeSystemEnvironmentPrivilege	4824	msiexec.exe
Token: SeChangeNotifyPrivilege	4824	msiexec.exe
Token: SeRemoteShutdownPrivilege	4824	msiexec.exe
Token: SeUndockPrivilege	4824	msiexec.exe
Token: SeSyncAgentPrivilege	4824	msiexec.exe
Token: SeEnableDelegationPrivilege	4824	msiexec.exe
Token: SeManageVolumePrivilege	4824	msiexec.exe
Token: SeImpersonatePrivilege	4824	msiexec.exe
Token: SeCreateGlobalPrivilege	4824	msiexec.exe
Token: SeBackupPrivilege	2260	vssvc.exe
Token: SeRestorePrivilege	2260	vssvc.exe
Token: SeAuditPrivilege	2260	vssvc.exe
Token: SeBackupPrivilege	940	msiexec.exe
Token: SeRestorePrivilege	940	msiexec.exe
Token: SeRestorePrivilege	940	msiexec.exe
Token: SeTakeOwnershipPrivilege	940	msiexec.exe
Token: SeRestorePrivilege	940	msiexec.exe
Token: SeTakeOwnershipPrivilege	940	msiexec.exe
Token: SeRestorePrivilege	940	msiexec.exe
Token: SeTakeOwnershipPrivilege	940	msiexec.exe
Token: SeRestorePrivilege	940	msiexec.exe
Token: SeTakeOwnershipPrivilege	940	msiexec.exe
Token: SeRestorePrivilege	940	msiexec.exe
Token: SeTakeOwnershipPrivilege	940	msiexec.exe
Token: SeRestorePrivilege	940	msiexec.exe
Token: SeTakeOwnershipPrivilege	940	msiexec.exe
Token: SeRestorePrivilege	940	msiexec.exe
Token: SeTakeOwnershipPrivilege	940	msiexec.exe
Token: SeRestorePrivilege	940	msiexec.exe
Token: SeTakeOwnershipPrivilege	940	msiexec.exe
Token: SeRestorePrivilege	940	msiexec.exe
Token: SeTakeOwnershipPrivilege	940	msiexec.exe
Token: SeRestorePrivilege	940	msiexec.exe
Token: SeTakeOwnershipPrivilege	940	msiexec.exe
Token: SeRestorePrivilege	940	msiexec.exe
Token: SeTakeOwnershipPrivilege	940	msiexec.exe
Token: SeRestorePrivilege	940	msiexec.exe
Token: SeTakeOwnershipPrivilege	940	msiexec.exe
Token: SeRestorePrivilege	940	msiexec.exe
Token: SeTakeOwnershipPrivilege	940	msiexec.exe
Token: SeRestorePrivilege	940	msiexec.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
4824	msiexec.exe
4824	msiexec.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 940 wrote to memory of 1336	940	msiexec.exe	96
PID 940 wrote to memory of 2604	940	msiexec.exe	98
PID 940 wrote to memory of 4920	940	msiexec.exe	99
PID 4920 wrote to memory of 1600	4920	Advanced_IP_Scanner_2.5.4594.1.exe	100

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\tmps3mxcb4g.msi
1⤵
- Badlisted process makes network request
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4824

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:940
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:1336
- C:\Users\Admin\AppData\Local\Temp\ApplicationInstallationFolder_11\consent.exe
  "C:\Users\Admin\AppData\Local\Temp\ApplicationInstallationFolder_11\consent.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:2604
- C:\Users\Admin\AppData\Local\Temp\ApplicationInstallationFolder_11\Advanced_IP_Scanner_2.5.4594.1.exe
  "C:\Users\Admin\AppData\Local\Temp\ApplicationInstallationFolder_11\Advanced_IP_Scanner_2.5.4594.1.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4920
- - C:\Users\Admin\AppData\Local\Temp\is-ERIEM.tmp\Advanced_IP_Scanner_2.5.4594.1.tmp
    "C:\Users\Admin\AppData\Local\Temp\is-ERIEM.tmp\Advanced_IP_Scanner_2.5.4594.1.tmp" /SL5="$602AA,20439558,139776,C:\Users\Admin\AppData\Local\Temp\ApplicationInstallationFolder_11\Advanced_IP_Scanner_2.5.4594.1.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Modifies data under HKEY_USERS
    PID:1600

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:2260

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Installer Packages

T1546.016

Privilege Escalation

Event Triggered Execution

T1546

Installer Packages

T1546.016

Defense Evasion

System Binary Proxy Execution

T1218

Msiexec

T1218.007

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e58e878.rbs

Path C:\Config.Msi\e58e878.rbs
Size 7KB
SHA256 487e1c8931d293ddd90816a9457b92a14df5b7ec77b756429376277f559a4e43
MD5 466d49ca816d69fc8277bffae825171b
SHA1 21a28d1da4333de68dd042e7f8ed7423f1652ea1
SHA512 338dcb5501114ec791de0e6734a0d720ad930920d983552d367ba826e84a7fb443815e5725ae5f261a731afa436fa3bf6d9ea4e9688ee732f68c5bef9b0dcade
SSDEEP 96:smGVXJ6JEUCVOYA8ZeynMaUCrVTCsTlqUCrVTCWd/gTlrmA5UhZWXuLNCMpUBGjb:pAE38ZeNtiOIbiOTlkZ4MpH
TLSH
T120F13241B31185E2EC92573ACB0B276637A3D3DDD7D0230B09CD92685F5278A5FE628A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

357F04AD41BCF5FE18FCB69F60C6680F_D1C51BA358EBA5378FCED4E3967B0097

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\357F04AD41BCF5FE18FCB69F60C6680F_D1C51BA358EBA5378FCED4E3967B0097
Size 1KB
SHA256 ac31a41fd3522a9c498d2ff783962961aacc7c8de02e1f205afff8069d727e9c
MD5 ecdef40edc4e6467825ffcd162f0dde7
SHA1 16c925be433afc1f76f5b5c44ead202b87fc337f
SHA512 119c1a278559de67816ef74b57e52c85d02464c65bc0766d8759312d7c1f3c6f52cb070b572fd734b857ba7c7933b1c72e16a013df403a41c21e24c944da4efd
TLSH
T10B31D69A0E2D1CD7AE8E8E685CC7A1087D6DA0E16DA9B521213AC135BA403D36F7041A
MD5 SHA1 SHA512 TLSH

Submit Download

9CB4373A4252DE8D2212929836304EC5_1AB74AA2E3A56E1B8AD8D3FEC287554E

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\9CB4373A4252DE8D2212929836304EC5_1AB74AA2E3A56E1B8AD8D3FEC287554E
Size 1KB
SHA256 0e463db8726b9ec19b1770d5790ea4727af39c85b4d951f56b7cb00b639816d9
MD5 b8ba8f85f7c99fad7c22cd60f641a964
SHA1 1ee69e5d2f0de776851c90a3e2cb4fdaf63fa934
SHA512 5c3f06b145fb795f194e08ca7cc23c3f180757575126e756d843c87b2607d6295c8cb69f457658733efbe509283f57f3cd4f88f7855b3f486e68a01e89881720
TLSH
T13F31D8771F6CB5208E128D8426CDFA725970DAE0989A10797218DB176C80BB38B1559B
MD5 SHA1 SHA512 TLSH

Submit Download

357F04AD41BCF5FE18FCB69F60C6680F_D1C51BA358EBA5378FCED4E3967B0097

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\357F04AD41BCF5FE18FCB69F60C6680F_D1C51BA358EBA5378FCED4E3967B0097
Size 540B
SHA256 12735ba82b46f228ed4cd8258cb51d46e173e54bc8129e68701af5137131eaea
MD5 43c578e0f0f81be8f033b1c7aee818ce
SHA1 5cbeb1e3d596b1800e5db19f8370dcad99f3bf4c
SHA512 ee2b80eb296a4323a250c73641c15416e571852aa448bfdf70a68e4d1be8f2ca12123f6e2c14c16008a47a8150dcec7c379e3cd9753f36c419f8214a6f2d074d
TLSH
T10AF02E3850FE110FF172DAF817D1A5419E55FB2734279A6924DA4719B930D006C42B3F
MD5 SHA1 SHA512 TLSH

Submit Download

9CB4373A4252DE8D2212929836304EC5_1AB74AA2E3A56E1B8AD8D3FEC287554E

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\9CB4373A4252DE8D2212929836304EC5_1AB74AA2E3A56E1B8AD8D3FEC287554E
Size 536B
SHA256 ed4ddf047fa1c8a6f6e8c02b3127630b55c2a39a46b9f0865f37e486be6fb8d4
MD5 920669b6549251969ff73f892543d8e2
SHA1 b64b531ee02e836aa2d1a712486ceb41f58fc699
SHA512 94c4588449c1b2ad523f2f69ef19ee96f1b59961adfef18611a1d096fb70b6b25937de05c598cee848157d219972480d59039cb358bff82d1b0b32542d3ad052
TLSH
T178F0DC0409F5431EF8B2CA790DE95516FA15F9027C21CBAC036A4B0E3C20B008D3382D
MD5 SHA1 SHA512 TLSH

Submit Download

Advanced_IP_Scanner_2.5.4594.1.exe

Path C:\Users\Admin\AppData\Local\Temp\ApplicationInstallationFolder_11\Advanced_IP_Scanner_2.5.4594.1.exe
Size 20.1MB
SHA256 26d5748ffe6bd95e3fee6ce184d388a1a681006dc23a0f08d53c083c593c193b
MD5 5537c708edb9a2c21f88e34e8a0f1744
SHA1 86233a285363c2a6863bf642deab7e20f062b8eb
SHA512 35f44c0df4635a1020f52743d7cf3e4346d1bdf9010161326e572250ac93e0285b202532a07d2db8dbc67f6f0ced864083769e904bd5d82611244339ca8d31a1
SSDEEP 393216:Plu7Txs0NDmNh9D4HaSYz2Kj0Cz1gEVmWdQOjM/y3tFfs5IRRViGmMQZ+Bw5i:A7Th9mT97S7CzNwWCJK05IRTX+Fi
TLSH
T1B0273382B79A8A32FC5E2438496652E54F00FC547BD54127BE35F39E4F723A08DBA391
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

consent.exe

Path C:\Users\Admin\AppData\Local\Temp\ApplicationInstallationFolder_11\consent.exe
Size 109KB
SHA256 ccad775decb5aec98118b381eeccc6d540928035cfb955abcb4ad3ded390b79b
MD5 0b5511674394666e9d221f8681b2c2e6
SHA1 6e4e720dfc424a12383f0b8194e4477e3bc346dc
SHA512 00d28a00fd3ceaeae42ba6882ffb42aa4cc8b92b07a10f28df8e1931df4b806aebdcfab1976bf8d5ce0b98c64da19d4ee06a6315734fa5f885ecd1f6e1ff16a7
SSDEEP 1536:HT3RGRM9dooAXR1cMfb5/0ivhWZpzNKD4h:HT3Rj9dotXRPjd0ckzNHh
TLSH
T1C6B3F75292100455F3598B7146A6F6E149A0BD3D1BE4E6CFF138BD3A2E322E35A3760F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msimg32.dll

Path C:\Users\Admin\AppData\Local\Temp\ApplicationInstallationFolder_11\msimg32.dll
Size 2.7MB
SHA256 f204f90627a08dbe68547e8eefe5fc8961f39e728d007bf10b06f5c8433aad51
MD5 e1f6546ebc8d9a299c292a540439a62c
SHA1 ca30fc1df691bed72b69055bcdf26604ae52618a
SHA512 8c7d87017c003c50fc873f4e150f39535865debfa0c8426e08fb62637697e63b46a99d1c3014a51f809f2f25719b901a2a3aee96efda159b33aa8a13695d8f5a
SSDEEP 49152:vvjBHx3diZ5SvktSkn6/J3+FkEQTRfDPGbB22vBhzahro2cpJbRARYEPNR:s5DtSxOFFQTRfbG122vvzAo2cpJbRAes
TLSH
T11DD59D0A6F3B4B9AD514C4BE967B1263C959BD0CD028B9748DC04B417F96F6092BE3EC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Advanced_IP_Scanner_2.5.4594.1.tmp

Path C:\Users\Admin\AppData\Local\Temp\is-ERIEM.tmp\Advanced_IP_Scanner_2.5.4594.1.tmp
Size 1.1MB
SHA256 ec8252a333f68865160e26dc95607f2c49af00f78c657f7f8417ab9d86e90bf7
MD5 b87639f9a6cf5ba8c9e1f297c5745a67
SHA1 ce4758849b53af582d2d8a1bc0db20683e139fcc
SHA512 9626fc4aa4604eee7ededa62b9dc78a3f6fe388eaf1fa6c916a3715b0dff65c417eede156d82398c2400977a36457122565e15e0ed0e435b28cb9f796005c1c0
SSDEEP 24576:Z4VN4kkKF3hDXq8xeidJLvkU99kkkkJE58dlX3IiAtp3Nq3E/HoQYx96BxYx9v1:iT90guMXEdqwHkUBK3
TLSH
T1CE454A22A3924437E5732F759D6BC6946C36BE202EB4D54A7EF89E0C0E38B417D35392
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

aips_is_install_dll.dll

Path C:\Users\Admin\AppData\Local\Temp\is-RD798.tmp\aips_is_install_dll.dll
Size 149KB
SHA256 3a7a8aa906c65124c4ee82aacb81d723ce69864ccaf041f631b8131de59e4a88
MD5 57e73855fad786a59893d6581e9fb5b9
SHA1 630e52b9e88a05add68401bd62790ed8e2c3282a
SHA512 be0cf0925535dd667488175f2eac660d1ebf8429ce6725252c59fb70b00fc2f21b1e0b7ce632eaa53337ae25e44c641e13a3df0b415724498d30daf00b296f4d
SSDEEP 3072:RMmLlzH5vVOS6vHZM+70gxvlou/xq+1f2auYpLAbPTxTTtFBImEQ3F65D:dZ/OSO7gK5q+N2ahjOF65D
TLSH
T181E37D117580C432E6BF19385878D6765B3E7930DF6089CB63981ABA5E30AC1DF34B7A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e58e877.msi

Path C:\Windows\Installer\e58e877.msi
Size 21.7MB
SHA256 69d3cf7d850bd05b3a901bc923f3c48392cedc1f863e6fe2b44e07096a180905
MD5 fd990d3d2706f16151404f9e4cdc26b7
SHA1 fadccd0e05ef4d121da7dee9b957a42667ebe062
SHA512 3a71781f7bde204643a08cb0e3bd923f2d17c2b53a69b8053b009bbdacd2b3c055a4bdf8ee7f5c9c1878b48a44f85ea3e531aa2da03cbd5d1da5e2143f67b04a
SSDEEP 393216:1FbgvkXDSlnAH4LnIg2xWzQ6jwqOfvo7FZJeWLIYX45sVzMwObRb9q7+jklofNoi:zsvJnK4KxqmvaXJeWLs2VKkzGiSqws
TLSH
T1FA3733AFB16D8F39EC5A607CC4D937CA66006D9C32058533F219F1F727B62B742A9690
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata-2

Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
Size 24.0MB
SHA256 68924c6304659bff69888f5e91657d07f6524185a6e870fdc65f20a70e59a84b
MD5 5dbbae3d6513d6a6e6e68713af23cab3
SHA1 964494781ea8ac47da4f344fdbc32a6d9eaf3021
SHA512 60fd0c8f7e1d480a4bd23a6a21d6960212f6f31ade1f7cee61e1912b3e2aa732b853ecc9f92ccdd24c2ab205f9fe5ff149073c1e0480e21a5463510c4f8c6457
SSDEEP 24576:3Epmg3MudoO/vvTLz64Oip22gMbx1A3uUYINOjUK8taDEWWIIt7GtkBDzt:e0
TLSH
T13347F52436F92211E7F39E3CA8F0AA134D397D579C1ADE8D45851B4E0821F71E872F6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{c72f7311-be4a-4850-bcba-236f752e1abc}_OnDiskSnapshotProp

Path \??\Volume{574c9264-0000-0000-0000-d08302000000}\System Volume Information\SPP\OnlineMetadataCache\{c72f7311-be4a-4850-bcba-236f752e1abc}_OnDiskSnapshotProp
Size 6KB
SHA256 8a125966a522ef2925a2e171ed96a6001241014e3c902558799d900e5cdae8a0
MD5 d46794a7b89ce4925b1127908ecb7e5a
SHA1 772d251a4d58ff175720f283160676f04dd31518
SHA512 3b8911d3014a9c3e687ed702ee2465bd6738749914f0ae2c639f2ea7ca7ed1c570ea18b706f12eced91a4c9fb2da4b31e8cd05cb8a85e0f559722765c4979b27
SSDEEP 96:FQxnaSA4yMj0vc8DD84LTHzbOHXOHBlBRQ88Sc9XE56tOSVQpu:SnagOb++ZVm
TLSH
T1B6D199085AF54311E2B3AB7129F18557A877B811EF33CB8E0198238E6671A10F975F5F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1600-68-0x0000000000400000-0x0000000000530000-memory.dmp

Download

memory/1600-65-0x0000000000400000-0x0000000000530000-memory.dmp

Download

memory/1600-71-0x0000000000400000-0x0000000000530000-memory.dmp

Download

memory/1600-74-0x0000000000400000-0x0000000000530000-memory.dmp

Download

memory/1600-80-0x0000000000400000-0x0000000000530000-memory.dmp

Download

memory/1600-83-0x0000000000400000-0x0000000000530000-memory.dmp

Download

memory/1600-86-0x0000000000400000-0x0000000000530000-memory.dmp

Download

memory/1600-89-0x0000000000400000-0x0000000000530000-memory.dmp

Download

memory/1600-92-0x0000000000400000-0x0000000000530000-memory.dmp

Download

memory/2604-63-0x0000000002CC0000-0x000000000342C000-memory.dmp

Download

memory/2604-40-0x0000000002CC0000-0x000000000342C000-memory.dmp

Download

memory/4920-38-0x0000000000400000-0x000000000042D000-memory.dmp

Download

memory/4920-64-0x0000000000400000-0x000000000042D000-memory.dmp

Download