bumblebee | 69d3cf7d850bd05b3a901bc923f3c48392cedc1f863e6fe2b44e07096a180905

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
09/06/2026, 01:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
tmps3mxcb4g.msi
Size 21.7MB
Sample260609-bc995aav8m
SHA256 69d3cf7d850bd05b3a901bc923f3c48392cedc1f863e6fe2b44e07096a180905
MD5 fd990d3d2706f16151404f9e4cdc26b7
SHA1 fadccd0e05ef4d121da7dee9b957a42667ebe062
SHA512 3a71781f7bde204643a08cb0e3bd923f2d17c2b53a69b8053b009bbdacd2b3c055a4bdf8ee7f5c9c1878b48a44f85ea3e531aa2da03cbd5d1da5e2143f67b04a
SSDEEP 393216:1FbgvkXDSlnAH4LnIg2xWzQ6jwqOfvo7FZJeWLIYX45sVzMwObRb9q7+jklofNoi:zsvJnK4KxqmvaXJeWLs2VKkzGiSqws
TLSH
T1FA3733AFB16D8F39EC5A607CC4D937CA66006D9C32058533F219F1F727B62B742A9690
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

grp0002 discovery bumblebee installer loader persistence privilege_escalation ransomware

Malware Config

Extracted

Family

bumblebee

Botnet

grp0002

Attributes

dga
ev2sirbd269o5j.org

ijt0l3i8brit6q.org

ewujsfb1dp5ran.org

8doj8uvx604eck.org

kwywztxoo2xdot.org

2rxyt9urhq0bgj.org

ky1d1p1daahe5t.org

ovh1kn1tcqw5kp.org

6cimu4mc085em8.org

5ka8rxp6t6eup2.org

ks50ioz9nm3v05.org

v5rjsdqogstopr.org

epnl524h4k03mu.org

hpzmehtnkk4q22.org

ygvmhd7ll9v2nu.org

oovlcxvht9kupu.org

1074slp8zafyz3.org

vfwlzltibeg7ne.org

wp67lr8ysypurn.org

1ge03xy5vtwn5s.org

958xz3300iu8oe.org

dlbqduy9gjprko.org

tycl4o5dep10cd.org

ui9bex45gw70az.org

trj1qy559ygvx3.org

w823niq7veztr9.org

01t05hb4armbco.org

igl71zhw25qw3d.org

j8ku0xu0dqduxr.org

jy3y61q6hyhf4c.org

s96phai2s1wzen.org

usguzk6xqox3ss.org

vfo2q74c1y0x74.org

tig85m8n7xixaz.org

0jfv3ru6slys8b.org

mh4bjdyhen3d9z.org

v3hm711ignzez6.org

xuixp4uro6pl3z.org

haq82ih59xa38b.org

zs2u14kk7bqbn2.org

zrym1d73kdmimj.org

r2r3qzjb3bp1ar.org

z3vni7gw9q1i8p.org

nlvskzui15vxju.org

13ov5ypehzqx5l.org

2x51hwe9cnidu4.org

gydu03jt8n5e41.org

gd2i9y77jhbjqb.org

9g055w2ak8hd6t.org

x5x2vq5joobqxe.org

acl1omagtzq38v.org

18xsm4245vgytb.org

q008rx2d58h76q.org

cybf5coa1t2xr2.org

tx6jny2iaea186.org

3pvk0zw1k7g28h.org

nrd1qnd4l7tcp9.org

bvt69kywl2s8rg.org

0youdp14i4r4h5.org

r4aadwqq9d2h24.org

l2q3fkrpgyxr8r.org

s6mngnfnj9nrfj.org

2yr46kghd39ise.org

fo1463oipy7oq8.org

gkukvtxlew982a.org

3h98rycjvt3gj5.org

xgcibmd1rd21us.org

kecah03gobzlrt.org

jpgw5b5zv4vdoy.org

hnxkyiagzxlvv0.org

aelovxoinqta4a.org

ae7a1pbhn5ytpe.org

fbixeudnf6vbhh.org

cjlv1576zqgb47.org

j8plhuz7p6052k.org

pk743hnddx0nds.org

3pu8prnkr8v31d.org

2gdaqm18d6p9d8.org

avm2dir92zqv9x.org

54jmh8bnrpha7y.org

y9e05pr4v7lhp9.org

o44e59aio5jk9q.org

u0tkv94vt86y23.org

q2myvg0j1nna57.org

x5b6lm11d90dht.org

invutsz52frzl8.org

t052317kru670j.org

011jn31n05qzpp.org

tqilxwrw5m54pj.org

pkzwaki575nsll.org

z3l0kxd46ulurv.org

z55s2t6ca702es.org

nrej2ipydbg40k.org

15eaytwast9oig.org

560tvzwrobbl2k.org

1v6pqsve9hg3gy.org

7p788ywb3z9fwe.org

vzf1g0it8gpvq7.org

oqu78tlfbxcf50.org

th87nd6s31jke7.org
dga_seed
4792266342353752649
domain_length
14
num_dga_domains
300
port
443
tld
.org

rc4.plain

Signatures

Family: BumbleBee
BumbleBee is a loader malware written in C++.
loader bumblebee

Executes dropped EXE 3 IoCs

pid	Process
3520	consent.exe
3800	Advanced_IP_Scanner_2.5.4594.1.exe
2520	Advanced_IP_Scanner_2.5.4594.1.tmp

Loads dropped DLL 1 IoCs

pid	Process
3520	consent.exe

Badlisted process makes network request 8 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
5	4020	msiexec.exe
19	4020	msiexec.exe
38	4020	msiexec.exe
46	4020	msiexec.exe
52	4020	msiexec.exe
55	4020	msiexec.exe
56	4020	msiexec.exe
64	4020	msiexec.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe

Drops file in Windows directory 8 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI54AE.tmp	msiexec.exe
File created	C:\Windows\Installer\e5952d9.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e5952d9.msi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{DD475EBC-D961-4AF4-BB8A-BE91FA942757}	msiexec.exe
File created	C:\Windows\Installer\e5952db.msi	msiexec.exe

Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs

persistence privilege_escalation

Installer Packages

T1546.016

Msiexec

T1218.007

pid	Process
4020	msiexec.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Advanced_IP_Scanner_2.5.4594.1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Advanced_IP_Scanner_2.5.4594.1.tmp

Inno Setup is an open-source installation builder for Windows applications. 3 IoCs

Inno Setup installer

installer

resource	yara_rule
behavioral2/files/0x0007000000024555-37.dat	innosetup
behavioral2/memory/3800-45-0x0000000000400000-0x000000000042D000-memory.dmp	innosetup
behavioral2/memory/3800-58-0x0000000000400000-0x000000000042D000-memory.dmp	innosetup

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000306421734df6c2060000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000306421730000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed35000000ffffffff00000000070001000068090030642173000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff350000000000000005000000ffffffff000000000700010000f8ff1a30642173000000000000f0ff350000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d30642173000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe

Modifies registry class 20 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CBE574DD169D4FA4BBA8EB19AF497275\ProductName = "Advanced-IP-Scanner"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CBE574DD169D4FA4BBA8EB19AF497275\PackageCode = "6C6600C723BF9D44A834CEB9A3CA7085"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CBE574DD169D4FA4BBA8EB19AF497275\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CBE574DD169D4FA4BBA8EB19AF497275\SourceList\Media	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CBE574DD169D4FA4BBA8EB19AF497275	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CBE574DD169D4FA4BBA8EB19AF497275\AuthorizedLUAApp = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CBE574DD169D4FA4BBA8EB19AF497275\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\CBE574DD169D4FA4BBA8EB19AF497275	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CBE574DD169D4FA4BBA8EB19AF497275\Language = "1033"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CBE574DD169D4FA4BBA8EB19AF497275\InstanceType = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CBE574DD169D4FA4BBA8EB19AF497275\SourceList\PackageName = "tmps3mxcb4g.msi"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CBE574DD169D4FA4BBA8EB19AF497275\SourceList\Media\1 = ";"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\CBE574DD169D4FA4BBA8EB19AF497275\AppLicense	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CBE574DD169D4FA4BBA8EB19AF497275\Version = "16777216"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CBE574DD169D4FA4BBA8EB19AF497275\Assignment = "1"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CBE574DD169D4FA4BBA8EB19AF497275\AdvertiseFlags = "388"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CBE574DD169D4FA4BBA8EB19AF497275\DeploymentFlags = "3"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CBE574DD169D4FA4BBA8EB19AF497275\SourceList	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CBE574DD169D4FA4BBA8EB19AF497275\SourceList\Net	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CBE574DD169D4FA4BBA8EB19AF497275\Clients = 3a0000000000	msiexec.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4280	msiexec.exe
4280	msiexec.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4020	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4020	msiexec.exe
Token: SeSecurityPrivilege	4280	msiexec.exe
Token: SeCreateTokenPrivilege	4020	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	4020	msiexec.exe
Token: SeLockMemoryPrivilege	4020	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4020	msiexec.exe
Token: SeMachineAccountPrivilege	4020	msiexec.exe
Token: SeTcbPrivilege	4020	msiexec.exe
Token: SeSecurityPrivilege	4020	msiexec.exe
Token: SeTakeOwnershipPrivilege	4020	msiexec.exe
Token: SeLoadDriverPrivilege	4020	msiexec.exe
Token: SeSystemProfilePrivilege	4020	msiexec.exe
Token: SeSystemtimePrivilege	4020	msiexec.exe
Token: SeProfSingleProcessPrivilege	4020	msiexec.exe
Token: SeIncBasePriorityPrivilege	4020	msiexec.exe
Token: SeCreatePagefilePrivilege	4020	msiexec.exe
Token: SeCreatePermanentPrivilege	4020	msiexec.exe
Token: SeBackupPrivilege	4020	msiexec.exe
Token: SeRestorePrivilege	4020	msiexec.exe
Token: SeShutdownPrivilege	4020	msiexec.exe
Token: SeDebugPrivilege	4020	msiexec.exe
Token: SeAuditPrivilege	4020	msiexec.exe
Token: SeSystemEnvironmentPrivilege	4020	msiexec.exe
Token: SeChangeNotifyPrivilege	4020	msiexec.exe
Token: SeRemoteShutdownPrivilege	4020	msiexec.exe
Token: SeUndockPrivilege	4020	msiexec.exe
Token: SeSyncAgentPrivilege	4020	msiexec.exe
Token: SeEnableDelegationPrivilege	4020	msiexec.exe
Token: SeManageVolumePrivilege	4020	msiexec.exe
Token: SeImpersonatePrivilege	4020	msiexec.exe
Token: SeCreateGlobalPrivilege	4020	msiexec.exe
Token: SeBackupPrivilege	4644	vssvc.exe
Token: SeRestorePrivilege	4644	vssvc.exe
Token: SeAuditPrivilege	4644	vssvc.exe
Token: SeBackupPrivilege	4280	msiexec.exe
Token: SeRestorePrivilege	4280	msiexec.exe
Token: SeRestorePrivilege	4280	msiexec.exe
Token: SeTakeOwnershipPrivilege	4280	msiexec.exe
Token: SeRestorePrivilege	4280	msiexec.exe
Token: SeTakeOwnershipPrivilege	4280	msiexec.exe
Token: SeRestorePrivilege	4280	msiexec.exe
Token: SeTakeOwnershipPrivilege	4280	msiexec.exe
Token: SeRestorePrivilege	4280	msiexec.exe
Token: SeTakeOwnershipPrivilege	4280	msiexec.exe
Token: SeRestorePrivilege	4280	msiexec.exe
Token: SeTakeOwnershipPrivilege	4280	msiexec.exe
Token: SeRestorePrivilege	4280	msiexec.exe
Token: SeTakeOwnershipPrivilege	4280	msiexec.exe
Token: SeRestorePrivilege	4280	msiexec.exe
Token: SeTakeOwnershipPrivilege	4280	msiexec.exe
Token: SeRestorePrivilege	4280	msiexec.exe
Token: SeTakeOwnershipPrivilege	4280	msiexec.exe
Token: SeRestorePrivilege	4280	msiexec.exe
Token: SeTakeOwnershipPrivilege	4280	msiexec.exe
Token: SeRestorePrivilege	4280	msiexec.exe
Token: SeTakeOwnershipPrivilege	4280	msiexec.exe
Token: SeRestorePrivilege	4280	msiexec.exe
Token: SeTakeOwnershipPrivilege	4280	msiexec.exe
Token: SeRestorePrivilege	4280	msiexec.exe
Token: SeTakeOwnershipPrivilege	4280	msiexec.exe
Token: SeRestorePrivilege	4280	msiexec.exe
Token: SeTakeOwnershipPrivilege	4280	msiexec.exe
Token: SeRestorePrivilege	4280	msiexec.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
4020	msiexec.exe
4020	msiexec.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 4280 wrote to memory of 1104	4280	msiexec.exe	115
PID 4280 wrote to memory of 3520	4280	msiexec.exe	117
PID 4280 wrote to memory of 3800	4280	msiexec.exe	118
PID 3800 wrote to memory of 2520	3800	Advanced_IP_Scanner_2.5.4594.1.exe	119

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\tmps3mxcb4g.msi
1⤵
- Badlisted process makes network request
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4020

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4280
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:1104
- C:\Users\Admin\AppData\Local\Temp\ApplicationInstallationFolder_11\consent.exe
  "C:\Users\Admin\AppData\Local\Temp\ApplicationInstallationFolder_11\consent.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:3520
- C:\Users\Admin\AppData\Local\Temp\ApplicationInstallationFolder_11\Advanced_IP_Scanner_2.5.4594.1.exe
  "C:\Users\Admin\AppData\Local\Temp\ApplicationInstallationFolder_11\Advanced_IP_Scanner_2.5.4594.1.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3800
- - C:\Users\Admin\AppData\Local\Temp\is-4P637.tmp\Advanced_IP_Scanner_2.5.4594.1.tmp
    "C:\Users\Admin\AppData\Local\Temp\is-4P637.tmp\Advanced_IP_Scanner_2.5.4594.1.tmp" /SL5="$702F6,20439558,139776,C:\Users\Admin\AppData\Local\Temp\ApplicationInstallationFolder_11\Advanced_IP_Scanner_2.5.4594.1.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2520

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:4644

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Installer Packages

T1546.016

Privilege Escalation

Event Triggered Execution

T1546

Installer Packages

T1546.016

Defense Evasion

System Binary Proxy Execution

T1218

Msiexec

T1218.007

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e5952da.rbs

Path C:\Config.Msi\e5952da.rbs
Size 7KB
SHA256 4ab4922a2477275cba728c1b4aaa9eb73605056b08722b1336e789cb39f74c00
MD5 948f0058e3ffee3491273596a44e02b0
SHA1 eabc47587bb7fda78261e033d57d3a118791fbf4
SHA512 e5bb32b7186f4c2181bee1e4c7e23a03a81a54eeef61866c0774747e139280984e64e57cf57efa6977f4b4ea31f55f0c0cdd66ae719fdc34e1d1036d368e2fdc
SSDEEP 96:mmGVXJ6JEUCVOYA8ZeaYMaUCrVTCsTlqUCrVTCWd/gTlrmA5UhZWXuLNCMpUBGjb:fAE38ZeotiOIbiOTlkZ4MpH
TLSH
T160F13241B31185E2EC92573ACB0B276637E7D3DDD7D0230B09CD92685F5278A5FE228A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

357F04AD41BCF5FE18FCB69F60C6680F_D1C51BA358EBA5378FCED4E3967B0097

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\357F04AD41BCF5FE18FCB69F60C6680F_D1C51BA358EBA5378FCED4E3967B0097
Size 1KB
SHA256 ac31a41fd3522a9c498d2ff783962961aacc7c8de02e1f205afff8069d727e9c
MD5 ecdef40edc4e6467825ffcd162f0dde7
SHA1 16c925be433afc1f76f5b5c44ead202b87fc337f
SHA512 119c1a278559de67816ef74b57e52c85d02464c65bc0766d8759312d7c1f3c6f52cb070b572fd734b857ba7c7933b1c72e16a013df403a41c21e24c944da4efd
TLSH
T10B31D69A0E2D1CD7AE8E8E685CC7A1087D6DA0E16DA9B521213AC135BA403D36F7041A
MD5 SHA1 SHA512 TLSH

Submit Download

9CB4373A4252DE8D2212929836304EC5_1AB74AA2E3A56E1B8AD8D3FEC287554E

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\9CB4373A4252DE8D2212929836304EC5_1AB74AA2E3A56E1B8AD8D3FEC287554E
Size 1KB
SHA256 0e463db8726b9ec19b1770d5790ea4727af39c85b4d951f56b7cb00b639816d9
MD5 b8ba8f85f7c99fad7c22cd60f641a964
SHA1 1ee69e5d2f0de776851c90a3e2cb4fdaf63fa934
SHA512 5c3f06b145fb795f194e08ca7cc23c3f180757575126e756d843c87b2607d6295c8cb69f457658733efbe509283f57f3cd4f88f7855b3f486e68a01e89881720
TLSH
T13F31D8771F6CB5208E128D8426CDFA725970DAE0989A10797218DB176C80BB38B1559B
MD5 SHA1 SHA512 TLSH

Submit Download

357F04AD41BCF5FE18FCB69F60C6680F_D1C51BA358EBA5378FCED4E3967B0097

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\357F04AD41BCF5FE18FCB69F60C6680F_D1C51BA358EBA5378FCED4E3967B0097
Size 540B
SHA256 1056f9a53090c0bbcf4c2fb518b8398a7c7e7026b6c8dbdae2a537137e758e45
MD5 d2b4c21993ec3219abd5507029ae3e02
SHA1 df8892bc66ddc5c7702789382ea5928c10cf5002
SHA512 732b56f6c4876e952740ef10e0b531d7a41087e8ebbeb750983389b00a7aeff0943cbfd649ba1f826d327194a6378eec4184bf89f65025237a637a66683956b4
TLSH
T117F02E3860FE110FF172DAF817D1A5419E55FB2734279A6924DA471D7930E006C42B3E
MD5 SHA1 SHA512 TLSH

Submit Download

9CB4373A4252DE8D2212929836304EC5_1AB74AA2E3A56E1B8AD8D3FEC287554E

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\9CB4373A4252DE8D2212929836304EC5_1AB74AA2E3A56E1B8AD8D3FEC287554E
Size 536B
SHA256 194ce923a05f8ce20071296f8a0be4925e08bf0a644be5c5ceadc893df69029c
MD5 d59d147bccc78773a765861a2d22134f
SHA1 bc4c5ad6d58d90cb7c0fb1612d26ea42048643d9
SHA512 48090e0fafd252bf5f0296336c4505b5bdee1444d6a1e3f67abe0d670374acf6488f5b9840ec2a7bc4e6e007a51e303028c741d79058efbaa161531f2d30569d
TLSH
T181F0DC0409F5431EF8B2CA7A0DE99517EA15F8027C258BEC029A4B1E3C20F108D3382D
MD5 SHA1 SHA512 TLSH

Submit Download

Advanced_IP_Scanner_2.5.4594.1.exe

Path C:\Users\Admin\AppData\Local\Temp\ApplicationInstallationFolder_11\Advanced_IP_Scanner_2.5.4594.1.exe
Size 20.1MB
SHA256 26d5748ffe6bd95e3fee6ce184d388a1a681006dc23a0f08d53c083c593c193b
MD5 5537c708edb9a2c21f88e34e8a0f1744
SHA1 86233a285363c2a6863bf642deab7e20f062b8eb
SHA512 35f44c0df4635a1020f52743d7cf3e4346d1bdf9010161326e572250ac93e0285b202532a07d2db8dbc67f6f0ced864083769e904bd5d82611244339ca8d31a1
SSDEEP 393216:Plu7Txs0NDmNh9D4HaSYz2Kj0Cz1gEVmWdQOjM/y3tFfs5IRRViGmMQZ+Bw5i:A7Th9mT97S7CzNwWCJK05IRTX+Fi
TLSH
T1B0273382B79A8A32FC5E2438496652E54F00FC547BD54127BE35F39E4F723A08DBA391
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

consent.exe

Path C:\Users\Admin\AppData\Local\Temp\ApplicationInstallationFolder_11\consent.exe
Size 109KB
SHA256 ccad775decb5aec98118b381eeccc6d540928035cfb955abcb4ad3ded390b79b
MD5 0b5511674394666e9d221f8681b2c2e6
SHA1 6e4e720dfc424a12383f0b8194e4477e3bc346dc
SHA512 00d28a00fd3ceaeae42ba6882ffb42aa4cc8b92b07a10f28df8e1931df4b806aebdcfab1976bf8d5ce0b98c64da19d4ee06a6315734fa5f885ecd1f6e1ff16a7
SSDEEP 1536:HT3RGRM9dooAXR1cMfb5/0ivhWZpzNKD4h:HT3Rj9dotXRPjd0ckzNHh
TLSH
T1C6B3F75292100455F3598B7146A6F6E149A0BD3D1BE4E6CFF138BD3A2E322E35A3760F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msimg32.dll

Path C:\Users\Admin\AppData\Local\Temp\ApplicationInstallationFolder_11\msimg32.dll
Size 2.7MB
SHA256 f204f90627a08dbe68547e8eefe5fc8961f39e728d007bf10b06f5c8433aad51
MD5 e1f6546ebc8d9a299c292a540439a62c
SHA1 ca30fc1df691bed72b69055bcdf26604ae52618a
SHA512 8c7d87017c003c50fc873f4e150f39535865debfa0c8426e08fb62637697e63b46a99d1c3014a51f809f2f25719b901a2a3aee96efda159b33aa8a13695d8f5a
SSDEEP 49152:vvjBHx3diZ5SvktSkn6/J3+FkEQTRfDPGbB22vBhzahro2cpJbRARYEPNR:s5DtSxOFFQTRfbG122vvzAo2cpJbRAes
TLSH
T11DD59D0A6F3B4B9AD514C4BE967B1263C959BD0CD028B9748DC04B417F96F6092BE3EC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Advanced_IP_Scanner_2.5.4594.1.tmp

Path C:\Users\Admin\AppData\Local\Temp\is-4P637.tmp\Advanced_IP_Scanner_2.5.4594.1.tmp
Size 1.1MB
SHA256 ec8252a333f68865160e26dc95607f2c49af00f78c657f7f8417ab9d86e90bf7
MD5 b87639f9a6cf5ba8c9e1f297c5745a67
SHA1 ce4758849b53af582d2d8a1bc0db20683e139fcc
SHA512 9626fc4aa4604eee7ededa62b9dc78a3f6fe388eaf1fa6c916a3715b0dff65c417eede156d82398c2400977a36457122565e15e0ed0e435b28cb9f796005c1c0
SSDEEP 24576:Z4VN4kkKF3hDXq8xeidJLvkU99kkkkJE58dlX3IiAtp3Nq3E/HoQYx96BxYx9v1:iT90guMXEdqwHkUBK3
TLSH
T1CE454A22A3924437E5732F759D6BC6946C36BE202EB4D54A7EF89E0C0E38B417D35392
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5952d9.msi

Path C:\Windows\Installer\e5952d9.msi
Size 21.7MB
SHA256 69d3cf7d850bd05b3a901bc923f3c48392cedc1f863e6fe2b44e07096a180905
MD5 fd990d3d2706f16151404f9e4cdc26b7
SHA1 fadccd0e05ef4d121da7dee9b957a42667ebe062
SHA512 3a71781f7bde204643a08cb0e3bd923f2d17c2b53a69b8053b009bbdacd2b3c055a4bdf8ee7f5c9c1878b48a44f85ea3e531aa2da03cbd5d1da5e2143f67b04a
SSDEEP 393216:1FbgvkXDSlnAH4LnIg2xWzQ6jwqOfvo7FZJeWLIYX45sVzMwObRb9q7+jklofNoi:zsvJnK4KxqmvaXJeWLs2VKkzGiSqws
TLSH
T1FA3733AFB16D8F39EC5A607CC4D937CA66006D9C32058533F219F1F727B62B742A9690
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata-2

Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
Size 24.1MB
SHA256 7a16108b006e16034ee487efcf41bfedfd64d6a68edb9ad7bf8baddfdb7543bf
MD5 17dd68c010ad48207cf6b3a4025758f3
SHA1 589e64368f121f23bd75c6283458c2b0f40687c6
SHA512 729688ece916fa4dddad81b4184a4d4bbe58f472f935e60f42b417a0d999131f151142fe32d33f95166fdf111cb06685d8cedc6a0104423bfd49bc86544a93bf
SSDEEP 24576:9u8m+1zedoO/vvTLbWzuGWKHiakzLlzi/FW9R8iF7kaiu0qOIPlqr1YRG:M
TLSH
T1D647D42832F92210E7F79F3C68F0AA2749397D579C19DE8D45411F4E0921BB1E8B2F5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{3304a01b-f9e0-458b-894c-b3f42fcc12c0}_OnDiskSnapshotProp

Path \??\Volume{73216430-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{3304a01b-f9e0-458b-894c-b3f42fcc12c0}_OnDiskSnapshotProp
Size 6KB
SHA256 bb2be4abdcac9de97256145c06348ff6fe04bf11edac3b8270c04156a77474a4
MD5 f9b03925982d67c9938347438588e7df
SHA1 47526e5ad1a08e6de2e8774b2b69fa263d62f5f7
SHA512 fb1725e4116985dcf0efee388a26d6709324fe5075463cd72643995f138233ba8803dc460916cfde55318df3dec0d421e8c05470370cdd007fd876435d422a9a
SSDEEP 96:FpyWnaShdByvc8DD84LTHzbOHXOHBlBRQ88Sc9XE56tOSVQpu:yWnayTIb++ZVm
TLSH
T1CFD189085AF54311E2B3AB3129F18557A477B911EF33CB8E0198238E6670910F875F5F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2520-59-0x0000000000400000-0x0000000000530000-memory.dmp

Download

memory/3520-51-0x0000000003720000-0x0000000003E5F000-memory.dmp

Download

memory/3520-57-0x0000000003720000-0x0000000003E5F000-memory.dmp

Download

memory/3800-45-0x0000000000400000-0x000000000042D000-memory.dmp

Download

memory/3800-58-0x0000000000400000-0x000000000042D000-memory.dmp

Download