bumblebee | 69d3cf7d850bd05b3a901bc923f3c48392cedc1f863e6fe2b44e07096a180905

Analysis

max time kernel
149s
max time network
152s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
09/06/2026, 01:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
tmps3mxcb4g.msi
Size 21.7MB
Sample260609-bc995aav8m
SHA256 69d3cf7d850bd05b3a901bc923f3c48392cedc1f863e6fe2b44e07096a180905
MD5 fd990d3d2706f16151404f9e4cdc26b7
SHA1 fadccd0e05ef4d121da7dee9b957a42667ebe062
SHA512 3a71781f7bde204643a08cb0e3bd923f2d17c2b53a69b8053b009bbdacd2b3c055a4bdf8ee7f5c9c1878b48a44f85ea3e531aa2da03cbd5d1da5e2143f67b04a
SSDEEP 393216:1FbgvkXDSlnAH4LnIg2xWzQ6jwqOfvo7FZJeWLIYX45sVzMwObRb9q7+jklofNoi:zsvJnK4KxqmvaXJeWLs2VKkzGiSqws
TLSH
T1FA3733AFB16D8F39EC5A607CC4D937CA66006D9C32058533F219F1F727B62B742A9690
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

grp0002 discovery bumblebee installer loader persistence privilege_escalation ransomware

Malware Config

Extracted

Family

bumblebee

Botnet

grp0002

Attributes

dga
ev2sirbd269o5j.org

ijt0l3i8brit6q.org

ewujsfb1dp5ran.org

8doj8uvx604eck.org

kwywztxoo2xdot.org

2rxyt9urhq0bgj.org

ky1d1p1daahe5t.org

ovh1kn1tcqw5kp.org

6cimu4mc085em8.org

5ka8rxp6t6eup2.org

ks50ioz9nm3v05.org

v5rjsdqogstopr.org

epnl524h4k03mu.org

hpzmehtnkk4q22.org

ygvmhd7ll9v2nu.org

oovlcxvht9kupu.org

1074slp8zafyz3.org

vfwlzltibeg7ne.org

wp67lr8ysypurn.org

1ge03xy5vtwn5s.org

958xz3300iu8oe.org

dlbqduy9gjprko.org

tycl4o5dep10cd.org

ui9bex45gw70az.org

trj1qy559ygvx3.org

w823niq7veztr9.org

01t05hb4armbco.org

igl71zhw25qw3d.org

j8ku0xu0dqduxr.org

jy3y61q6hyhf4c.org

s96phai2s1wzen.org

usguzk6xqox3ss.org

vfo2q74c1y0x74.org

tig85m8n7xixaz.org

0jfv3ru6slys8b.org

mh4bjdyhen3d9z.org

v3hm711ignzez6.org

xuixp4uro6pl3z.org

haq82ih59xa38b.org

zs2u14kk7bqbn2.org

zrym1d73kdmimj.org

r2r3qzjb3bp1ar.org

z3vni7gw9q1i8p.org

nlvskzui15vxju.org

13ov5ypehzqx5l.org

2x51hwe9cnidu4.org

gydu03jt8n5e41.org

gd2i9y77jhbjqb.org

9g055w2ak8hd6t.org

x5x2vq5joobqxe.org

acl1omagtzq38v.org

18xsm4245vgytb.org

q008rx2d58h76q.org

cybf5coa1t2xr2.org

tx6jny2iaea186.org

3pvk0zw1k7g28h.org

nrd1qnd4l7tcp9.org

bvt69kywl2s8rg.org

0youdp14i4r4h5.org

r4aadwqq9d2h24.org

l2q3fkrpgyxr8r.org

s6mngnfnj9nrfj.org

2yr46kghd39ise.org

fo1463oipy7oq8.org

gkukvtxlew982a.org

3h98rycjvt3gj5.org

xgcibmd1rd21us.org

kecah03gobzlrt.org

jpgw5b5zv4vdoy.org

hnxkyiagzxlvv0.org

aelovxoinqta4a.org

ae7a1pbhn5ytpe.org

fbixeudnf6vbhh.org

cjlv1576zqgb47.org

j8plhuz7p6052k.org

pk743hnddx0nds.org

3pu8prnkr8v31d.org

2gdaqm18d6p9d8.org

avm2dir92zqv9x.org

54jmh8bnrpha7y.org

y9e05pr4v7lhp9.org

o44e59aio5jk9q.org

u0tkv94vt86y23.org

q2myvg0j1nna57.org

x5b6lm11d90dht.org

invutsz52frzl8.org

t052317kru670j.org

011jn31n05qzpp.org

tqilxwrw5m54pj.org

pkzwaki575nsll.org

z3l0kxd46ulurv.org

z55s2t6ca702es.org

nrej2ipydbg40k.org

15eaytwast9oig.org

560tvzwrobbl2k.org

1v6pqsve9hg3gy.org

7p788ywb3z9fwe.org

vzf1g0it8gpvq7.org

oqu78tlfbxcf50.org

th87nd6s31jke7.org
dga_seed
4792266342353752649
domain_length
14
num_dga_domains
300
port
443
tld
.org

rc4.plain

Signatures

Family: BumbleBee
BumbleBee is a loader malware written in C++.
loader bumblebee

Executes dropped EXE 3 IoCs

pid	Process
5168	consent.exe
4744	Advanced_IP_Scanner_2.5.4594.1.exe
3740	Advanced_IP_Scanner_2.5.4594.1.tmp

Loads dropped DLL 2 IoCs

pid	Process
5168	consent.exe
3740	Advanced_IP_Scanner_2.5.4594.1.tmp

Badlisted process makes network request 7 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
2	5004	msiexec.exe
3	5004	msiexec.exe
4	5004	msiexec.exe
5	5004	msiexec.exe
6	5004	msiexec.exe
7	5004	msiexec.exe
8	5004	msiexec.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe

Drops file in Windows directory 12 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{DD475EBC-D961-4AF4-BB8A-BE91FA942757}	msiexec.exe
File created	C:\Windows\SystemTemp\~DF7463872C7D9242A7.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIC464.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DF3888D91A2140EDE0.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\SystemTemp\~DFA155DE4EB93D07BD.TMP	msiexec.exe
File created	C:\Windows\Installer\e58c243.msi	msiexec.exe
File created	C:\Windows\SystemTemp\~DF9357CE80036E3D71.TMP	msiexec.exe
File created	C:\Windows\Installer\e58c241.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e58c241.msi	msiexec.exe

Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs

persistence privilege_escalation

Installer Packages

T1546.016

Msiexec

T1218.007

pid	Process
5004	msiexec.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Advanced_IP_Scanner_2.5.4594.1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Advanced_IP_Scanner_2.5.4594.1.tmp

Inno Setup is an open-source installation builder for Windows applications. 3 IoCs

Inno Setup installer

installer

resource	yara_rule
behavioral3/files/0x001900000002b636-35.dat	innosetup
behavioral3/memory/4744-39-0x0000000000400000-0x000000000042D000-memory.dmp	innosetup
behavioral3/memory/4744-66-0x0000000000400000-0x000000000042D000-memory.dmp	innosetup

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000ab511af7d208ca820000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000ab511af70000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed35000000ffffffff000000000700010000680900ab511af7000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff350000000000000005000000ffffffff000000000700010000f8ff1aab511af7000000000000f0ff350000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1dab511af7000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe

Modifies data under HKEY_USERS 10 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	Advanced_IP_Scanner_2.5.4594.1.tmp
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager	Advanced_IP_Scanner_2.5.4594.1.tmp
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\Owner = 9c0e000094863596abf7dc01	Advanced_IP_Scanner_2.5.4594.1.tmp
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\SessionHash = 190d1ab4ecc324c55ca2d86d46ca7a45b9c9c808ea2f037a3702afdbb71cdf45	Advanced_IP_Scanner_2.5.4594.1.tmp
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\Sequence = "1"	Advanced_IP_Scanner_2.5.4594.1.tmp
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000	Advanced_IP_Scanner_2.5.4594.1.tmp
Key created	\REGISTRY\USER\.DEFAULT\Software	Advanced_IP_Scanner_2.5.4594.1.tmp
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe

Modifies registry class 20 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CBE574DD169D4FA4BBA8EB19AF497275\PackageCode = "6C6600C723BF9D44A834CEB9A3CA7085"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CBE574DD169D4FA4BBA8EB19AF497275\AuthorizedLUAApp = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CBE574DD169D4FA4BBA8EB19AF497275\SourceList\Net	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CBE574DD169D4FA4BBA8EB19AF497275\SourceList\Media	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CBE574DD169D4FA4BBA8EB19AF497275\Clients = 3a0000000000	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CBE574DD169D4FA4BBA8EB19AF497275\SourceList	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CBE574DD169D4FA4BBA8EB19AF497275	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CBE574DD169D4FA4BBA8EB19AF497275\Language = "1033"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CBE574DD169D4FA4BBA8EB19AF497275\Version = "16777216"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CBE574DD169D4FA4BBA8EB19AF497275\InstanceType = "0"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CBE574DD169D4FA4BBA8EB19AF497275\DeploymentFlags = "3"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CBE574DD169D4FA4BBA8EB19AF497275\SourceList\Media\1 = ";"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CBE574DD169D4FA4BBA8EB19AF497275\SourceList\PackageName = "tmps3mxcb4g.msi"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CBE574DD169D4FA4BBA8EB19AF497275\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CBE574DD169D4FA4BBA8EB19AF497275\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CBE574DD169D4FA4BBA8EB19AF497275\ProductName = "Advanced-IP-Scanner"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CBE574DD169D4FA4BBA8EB19AF497275\Assignment = "1"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CBE574DD169D4FA4BBA8EB19AF497275\AdvertiseFlags = "388"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\CBE574DD169D4FA4BBA8EB19AF497275	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\CBE574DD169D4FA4BBA8EB19AF497275\AppLicense	msiexec.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5064	msiexec.exe
5064	msiexec.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	5004	msiexec.exe
Token: SeIncreaseQuotaPrivilege	5004	msiexec.exe
Token: SeSecurityPrivilege	5064	msiexec.exe
Token: SeCreateTokenPrivilege	5004	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	5004	msiexec.exe
Token: SeLockMemoryPrivilege	5004	msiexec.exe
Token: SeIncreaseQuotaPrivilege	5004	msiexec.exe
Token: SeMachineAccountPrivilege	5004	msiexec.exe
Token: SeTcbPrivilege	5004	msiexec.exe
Token: SeSecurityPrivilege	5004	msiexec.exe
Token: SeTakeOwnershipPrivilege	5004	msiexec.exe
Token: SeLoadDriverPrivilege	5004	msiexec.exe
Token: SeSystemProfilePrivilege	5004	msiexec.exe
Token: SeSystemtimePrivilege	5004	msiexec.exe
Token: SeProfSingleProcessPrivilege	5004	msiexec.exe
Token: SeIncBasePriorityPrivilege	5004	msiexec.exe
Token: SeCreatePagefilePrivilege	5004	msiexec.exe
Token: SeCreatePermanentPrivilege	5004	msiexec.exe
Token: SeBackupPrivilege	5004	msiexec.exe
Token: SeRestorePrivilege	5004	msiexec.exe
Token: SeShutdownPrivilege	5004	msiexec.exe
Token: SeDebugPrivilege	5004	msiexec.exe
Token: SeAuditPrivilege	5004	msiexec.exe
Token: SeSystemEnvironmentPrivilege	5004	msiexec.exe
Token: SeChangeNotifyPrivilege	5004	msiexec.exe
Token: SeRemoteShutdownPrivilege	5004	msiexec.exe
Token: SeUndockPrivilege	5004	msiexec.exe
Token: SeSyncAgentPrivilege	5004	msiexec.exe
Token: SeEnableDelegationPrivilege	5004	msiexec.exe
Token: SeManageVolumePrivilege	5004	msiexec.exe
Token: SeImpersonatePrivilege	5004	msiexec.exe
Token: SeCreateGlobalPrivilege	5004	msiexec.exe
Token: SeBackupPrivilege	5132	vssvc.exe
Token: SeRestorePrivilege	5132	vssvc.exe
Token: SeAuditPrivilege	5132	vssvc.exe
Token: SeBackupPrivilege	5064	msiexec.exe
Token: SeRestorePrivilege	5064	msiexec.exe
Token: SeRestorePrivilege	5064	msiexec.exe
Token: SeTakeOwnershipPrivilege	5064	msiexec.exe
Token: SeRestorePrivilege	5064	msiexec.exe
Token: SeTakeOwnershipPrivilege	5064	msiexec.exe
Token: SeRestorePrivilege	5064	msiexec.exe
Token: SeTakeOwnershipPrivilege	5064	msiexec.exe
Token: SeRestorePrivilege	5064	msiexec.exe
Token: SeTakeOwnershipPrivilege	5064	msiexec.exe
Token: SeRestorePrivilege	5064	msiexec.exe
Token: SeTakeOwnershipPrivilege	5064	msiexec.exe
Token: SeRestorePrivilege	5064	msiexec.exe
Token: SeTakeOwnershipPrivilege	5064	msiexec.exe
Token: SeRestorePrivilege	5064	msiexec.exe
Token: SeTakeOwnershipPrivilege	5064	msiexec.exe
Token: SeRestorePrivilege	5064	msiexec.exe
Token: SeTakeOwnershipPrivilege	5064	msiexec.exe
Token: SeRestorePrivilege	5064	msiexec.exe
Token: SeTakeOwnershipPrivilege	5064	msiexec.exe
Token: SeRestorePrivilege	5064	msiexec.exe
Token: SeTakeOwnershipPrivilege	5064	msiexec.exe
Token: SeRestorePrivilege	5064	msiexec.exe
Token: SeTakeOwnershipPrivilege	5064	msiexec.exe
Token: SeRestorePrivilege	5064	msiexec.exe
Token: SeTakeOwnershipPrivilege	5064	msiexec.exe
Token: SeRestorePrivilege	5064	msiexec.exe
Token: SeTakeOwnershipPrivilege	5064	msiexec.exe
Token: SeRestorePrivilege	5064	msiexec.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
5004	msiexec.exe
5004	msiexec.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 5064 wrote to memory of 4556	5064	msiexec.exe	85
PID 5064 wrote to memory of 5168	5064	msiexec.exe	87
PID 5064 wrote to memory of 4744	5064	msiexec.exe	88
PID 4744 wrote to memory of 3740	4744	Advanced_IP_Scanner_2.5.4594.1.exe	89

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\tmps3mxcb4g.msi
1⤵
- Badlisted process makes network request
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:5004

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5064
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:4556
- C:\Users\Admin\AppData\Local\Temp\ApplicationInstallationFolder_11\consent.exe
  "C:\Users\Admin\AppData\Local\Temp\ApplicationInstallationFolder_11\consent.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:5168
- C:\Users\Admin\AppData\Local\Temp\ApplicationInstallationFolder_11\Advanced_IP_Scanner_2.5.4594.1.exe
  "C:\Users\Admin\AppData\Local\Temp\ApplicationInstallationFolder_11\Advanced_IP_Scanner_2.5.4594.1.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4744
- - C:\Users\Admin\AppData\Local\Temp\is-CGGKQ.tmp\Advanced_IP_Scanner_2.5.4594.1.tmp
    "C:\Users\Admin\AppData\Local\Temp\is-CGGKQ.tmp\Advanced_IP_Scanner_2.5.4594.1.tmp" /SL5="$A00F4,20439558,139776,C:\Users\Admin\AppData\Local\Temp\ApplicationInstallationFolder_11\Advanced_IP_Scanner_2.5.4594.1.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Modifies data under HKEY_USERS
    PID:3740

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:5132

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Installer Packages

T1546.016

Privilege Escalation

Event Triggered Execution

T1546

Installer Packages

T1546.016

Defense Evasion

System Binary Proxy Execution

T1218

Msiexec

T1218.007

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e58c242.rbs

Path C:\Config.Msi\e58c242.rbs
Size 7KB
SHA256 f1846626fbec6aec30bd6fe10f30595e2afe5f1741645720b0841c9e8d68a5ad
MD5 84bc4ffc1d992d9221008ba31024c029
SHA1 a2d1ef44e22fe5d8f128d8a86ea5ff352d085596
SHA512 5db188a2c266141aa60143e95753dc76ba2ca6f524a81d3d1b2c4f474bb788c88f7f8a76d6c9eb3a5fafd3140e3065703f896b4ca77c50ece6d6c4f34fc51b21
SSDEEP 96:+mGVsJ6JCyCVOYA8oCzyMaUCrVTCsTlqUCrVTCWd/gTlrIA5UhZWXuLNCMpUBGjb:3LEp8oCHtiOIbiOT/kZ4MpH
TLSH
T13DF12241B31185E2EC96573ACB07176637A3D3DDD7D0230B09CD92686F5278A5FE22CA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

357F04AD41BCF5FE18FCB69F60C6680F_D1C51BA358EBA5378FCED4E3967B0097

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\357F04AD41BCF5FE18FCB69F60C6680F_D1C51BA358EBA5378FCED4E3967B0097
Size 1KB
SHA256 ac31a41fd3522a9c498d2ff783962961aacc7c8de02e1f205afff8069d727e9c
MD5 ecdef40edc4e6467825ffcd162f0dde7
SHA1 16c925be433afc1f76f5b5c44ead202b87fc337f
SHA512 119c1a278559de67816ef74b57e52c85d02464c65bc0766d8759312d7c1f3c6f52cb070b572fd734b857ba7c7933b1c72e16a013df403a41c21e24c944da4efd
TLSH
T10B31D69A0E2D1CD7AE8E8E685CC7A1087D6DA0E16DA9B521213AC135BA403D36F7041A
MD5 SHA1 SHA512 TLSH

Submit Download

BD92F95DED26541D3AF7F44DC7914843

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\BD92F95DED26541D3AF7F44DC7914843
Size 721B
SHA256 4900b7c4a1e108d5f6230e5db947856d9497c66edbd68cde74583fc7451e96cd
MD5 9b3ebe23c1028517438fb96a56503c39
SHA1 b920ad1b17ab2dc112cbd69410be5af8a44f814e
SHA512 2221841a98c017cb1119771493263b5e167e41b3052c14920fc2471c4ff92ac3904afdd69b413063a51e189e5001bf53e1388cbecf387c15ac997a10cb7b9074
TLSH
T19C01944C3B6C41C0CB016E8DAA87BCBA1EBA758378C0910243EA961321C83925F9B75A
MD5 SHA1 SHA512 TLSH

Submit Download

357F04AD41BCF5FE18FCB69F60C6680F_D1C51BA358EBA5378FCED4E3967B0097

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\357F04AD41BCF5FE18FCB69F60C6680F_D1C51BA358EBA5378FCED4E3967B0097
Size 540B
SHA256 c1099ac7c66a94d7750c1939686b3a9eb2ff2ca253e42f86e5f026b88f5a1496
MD5 323ff15ce7c6c17da08c9e4496b2cfdd
SHA1 0f598a8fc04c701beb4a07f5a4793a62da177a4d
SHA512 70067d5abf6ffbdf5e9a18238f212c5c0f87db7162f19197859950d4bdd2854f5b4a1b563d7f99d798c08a9929e3ff396aa8b3fff6966780354c35b0236b3f66
TLSH
T1EEF02E3854FE110FF172DAF807D1A5419E55FB2335275A6924DA47197930D006C82B3E
MD5 SHA1 SHA512 TLSH

Submit Download

BD92F95DED26541D3AF7F44DC7914843

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\BD92F95DED26541D3AF7F44DC7914843
Size 214B
SHA256 db29f0002e0e7519b22021d6e5e10df1b635e2bf15722e79ccc079377a503bcd
MD5 c32b8368bbe10c5d104da0564ec03b56
SHA1 8074a5cd881e3ab9ac5bf2ff4e8343e0f7d5d879
SHA512 6ce1409bff194e3735fc8429b72bd79b08477279a44225d84f003b39087397c9815354f7365dc78bb050526d9ea8ab30aca76b3ada378ff0d73c627dea02759f
TLSH
T187D08C0193B8831BF0A20A7F2D011C969FB1EF825B23C74C0B2A315C6C7AA408D30B26
MD5 SHA1 SHA512 TLSH

Submit Download

Advanced_IP_Scanner_2.5.4594.1.exe

Path C:\Users\Admin\AppData\Local\Temp\ApplicationInstallationFolder_11\Advanced_IP_Scanner_2.5.4594.1.exe
Size 20.1MB
SHA256 26d5748ffe6bd95e3fee6ce184d388a1a681006dc23a0f08d53c083c593c193b
MD5 5537c708edb9a2c21f88e34e8a0f1744
SHA1 86233a285363c2a6863bf642deab7e20f062b8eb
SHA512 35f44c0df4635a1020f52743d7cf3e4346d1bdf9010161326e572250ac93e0285b202532a07d2db8dbc67f6f0ced864083769e904bd5d82611244339ca8d31a1
SSDEEP 393216:Plu7Txs0NDmNh9D4HaSYz2Kj0Cz1gEVmWdQOjM/y3tFfs5IRRViGmMQZ+Bw5i:A7Th9mT97S7CzNwWCJK05IRTX+Fi
TLSH
T1B0273382B79A8A32FC5E2438496652E54F00FC547BD54127BE35F39E4F723A08DBA391
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSIMG32.dll

Path C:\Users\Admin\AppData\Local\Temp\ApplicationInstallationFolder_11\MSIMG32.dll
Size 2.7MB
SHA256 f204f90627a08dbe68547e8eefe5fc8961f39e728d007bf10b06f5c8433aad51
MD5 e1f6546ebc8d9a299c292a540439a62c
SHA1 ca30fc1df691bed72b69055bcdf26604ae52618a
SHA512 8c7d87017c003c50fc873f4e150f39535865debfa0c8426e08fb62637697e63b46a99d1c3014a51f809f2f25719b901a2a3aee96efda159b33aa8a13695d8f5a
SSDEEP 49152:vvjBHx3diZ5SvktSkn6/J3+FkEQTRfDPGbB22vBhzahro2cpJbRARYEPNR:s5DtSxOFFQTRfbG122vvzAo2cpJbRAes
TLSH
T11DD59D0A6F3B4B9AD514C4BE967B1263C959BD0CD028B9748DC04B417F96F6092BE3EC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

consent.exe

Path C:\Users\Admin\AppData\Local\Temp\ApplicationInstallationFolder_11\consent.exe
Size 109KB
SHA256 ccad775decb5aec98118b381eeccc6d540928035cfb955abcb4ad3ded390b79b
MD5 0b5511674394666e9d221f8681b2c2e6
SHA1 6e4e720dfc424a12383f0b8194e4477e3bc346dc
SHA512 00d28a00fd3ceaeae42ba6882ffb42aa4cc8b92b07a10f28df8e1931df4b806aebdcfab1976bf8d5ce0b98c64da19d4ee06a6315734fa5f885ecd1f6e1ff16a7
SSDEEP 1536:HT3RGRM9dooAXR1cMfb5/0ivhWZpzNKD4h:HT3Rj9dotXRPjd0ckzNHh
TLSH
T1C6B3F75292100455F3598B7146A6F6E149A0BD3D1BE4E6CFF138BD3A2E322E35A3760F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

aips_is_install_dll.dll

Path C:\Users\Admin\AppData\Local\Temp\is-9LM3S.tmp\aips_is_install_dll.dll
Size 149KB
SHA256 3a7a8aa906c65124c4ee82aacb81d723ce69864ccaf041f631b8131de59e4a88
MD5 57e73855fad786a59893d6581e9fb5b9
SHA1 630e52b9e88a05add68401bd62790ed8e2c3282a
SHA512 be0cf0925535dd667488175f2eac660d1ebf8429ce6725252c59fb70b00fc2f21b1e0b7ce632eaa53337ae25e44c641e13a3df0b415724498d30daf00b296f4d
SSDEEP 3072:RMmLlzH5vVOS6vHZM+70gxvlou/xq+1f2auYpLAbPTxTTtFBImEQ3F65D:dZ/OSO7gK5q+N2ahjOF65D
TLSH
T181E37D117580C432E6BF19385878D6765B3E7930DF6089CB63981ABA5E30AC1DF34B7A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Advanced_IP_Scanner_2.5.4594.1.tmp

Path C:\Users\Admin\AppData\Local\Temp\is-CGGKQ.tmp\Advanced_IP_Scanner_2.5.4594.1.tmp
Size 1.1MB
SHA256 ec8252a333f68865160e26dc95607f2c49af00f78c657f7f8417ab9d86e90bf7
MD5 b87639f9a6cf5ba8c9e1f297c5745a67
SHA1 ce4758849b53af582d2d8a1bc0db20683e139fcc
SHA512 9626fc4aa4604eee7ededa62b9dc78a3f6fe388eaf1fa6c916a3715b0dff65c417eede156d82398c2400977a36457122565e15e0ed0e435b28cb9f796005c1c0
SSDEEP 24576:Z4VN4kkKF3hDXq8xeidJLvkU99kkkkJE58dlX3IiAtp3Nq3E/HoQYx96BxYx9v1:iT90guMXEdqwHkUBK3
TLSH
T1CE454A22A3924437E5732F759D6BC6946C36BE202EB4D54A7EF89E0C0E38B417D35392
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e58c241.msi

Path C:\Windows\Installer\e58c241.msi
Size 21.7MB
SHA256 69d3cf7d850bd05b3a901bc923f3c48392cedc1f863e6fe2b44e07096a180905
MD5 fd990d3d2706f16151404f9e4cdc26b7
SHA1 fadccd0e05ef4d121da7dee9b957a42667ebe062
SHA512 3a71781f7bde204643a08cb0e3bd923f2d17c2b53a69b8053b009bbdacd2b3c055a4bdf8ee7f5c9c1878b48a44f85ea3e531aa2da03cbd5d1da5e2143f67b04a
SSDEEP 393216:1FbgvkXDSlnAH4LnIg2xWzQ6jwqOfvo7FZJeWLIYX45sVzMwObRb9q7+jklofNoi:zsvJnK4KxqmvaXJeWLs2VKkzGiSqws
TLSH
T1FA3733AFB16D8F39EC5A607CC4D937CA66006D9C32058533F219F1F727B62B742A9690
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata-2

Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
Size 24.6MB
SHA256 63fb79dc3356ac2942860724fdce441945f90a6b135ce378e5d0ff56db45c140
MD5 de24ef5f09de091d909aec66c5aeae49
SHA1 44654397b240717375959b0f4ab9a31343e98e18
SHA512 35e9ddddf3f92df46fbaafe8153c9b7f72faa4924c61014083bacc5cb5af6013de1f752deda1e70c9c8f08e394c2b1ef66afd18c1122fa379a1d862a0adaf44c
SSDEEP 24576:C2gmSp1gdoO/vvTLjWouhknavK5jQI8iGmrtX50ohTa40UM9oDJfrFyvR:r
TLSH
T18447E32432F92210E7F79E3C68F06A67493E7D5B9C15DE8D05421F4E0A61BB0E872F5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{59879895-3287-41ac-ba43-7e0f097753e9}_OnDiskSnapshotProp

Path \??\Volume{f71a51ab-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{59879895-3287-41ac-ba43-7e0f097753e9}_OnDiskSnapshotProp
Size 6KB
SHA256 7189b9d57226a851359d28071ae9f5cc37d0c4a65eb0628289c9e87f384ad2ac
MD5 626f595566737c1e4809cfe529398d6f
SHA1 1c3384b88672bec0537295b3ed4d10d5da830118
SHA512 261084cf95604123b8144eff78a2e419a9e112da6f182b87ea2b604017b3694fa25221bb4c4d68645efdf5053f9b689888fe8033f649762802c4daae3539cc4f
SSDEEP 96:FinaSsIvc8DD84LTHzbOHXOHBlBRQ88Sc9XE56tOSVQpu:0naWb++ZVm
TLSH
T12CD189085AE54311E2B3AB3229F18557A877B911FF33CB8E0298678E6670910F875F5F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3740-79-0x0000000000400000-0x0000000000530000-memory.dmp

Download

memory/3740-75-0x0000000000400000-0x0000000000530000-memory.dmp

Download

memory/3740-106-0x0000000000400000-0x0000000000530000-memory.dmp

Download

memory/3740-102-0x0000000000400000-0x0000000000530000-memory.dmp

Download

memory/3740-67-0x0000000000400000-0x0000000000530000-memory.dmp

Download

memory/3740-98-0x0000000000400000-0x0000000000530000-memory.dmp

Download

memory/3740-71-0x0000000000400000-0x0000000000530000-memory.dmp

Download

memory/3740-94-0x0000000000400000-0x0000000000530000-memory.dmp

Download

memory/3740-90-0x0000000000400000-0x0000000000530000-memory.dmp

Download

memory/3740-86-0x0000000000400000-0x0000000000530000-memory.dmp

Download

memory/4744-39-0x0000000000400000-0x000000000042D000-memory.dmp

Download

memory/4744-66-0x0000000000400000-0x000000000042D000-memory.dmp

Download

memory/5064-62-0x000001E6364F0000-0x000001E636FB2000-memory.dmp

Download

memory/5168-65-0x0000000002EE0000-0x000000000368E000-memory.dmp

Download

memory/5168-46-0x0000000002EE0000-0x000000000368E000-memory.dmp

Download