Analysis
- max time kernel
149s - max time network
152s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
09/06/2026, 00:59
Static task
static1
Behavioral task
behavioral1
Sample
tmp0mi28a04.msi
Resource
win10ltsc2021-20260513-en
windows10-ltsc_2021-x64
16 signatures
150 seconds
Behavioral task
behavioral2
Sample
tmp0mi28a04.msi
Resource
win10v2004-20260513-en
windows10-2004-x64
16 signatures
150 seconds
Behavioral task
behavioral3
Sample
tmp0mi28a04.msi
Resource
win11-20260513-en
windows11-21h2-x64
16 signatures
150 seconds
General
- Target tmp0mi28a04.msi
- Size 3.7MB
- Sample260609-bcat9sh19w
- SHA256 31dd6d070a65a648b2be9ea2edc9efca26762c3875a8dde2d018eb064bc41e32
- MD5 28c0caed1c9c242f60c8e0884ccbf976
- SHA1 0e6abeb79a84fc3e7683c5439607c8a17ef6ae77
- SHA512 7b3637ef5de221dc34684fa2a5746b54d8cdc373cba9486cfd9e496c930088713b8875759fe6027b4c827be8f8a11fc3d97d31d8519f62eb31244dea00ddb7ee
- SSDEEP 98304:uU8uEL5HQ++zzvBXzSnmw5KxYXyuDB7KR5:uU87Qt1iCOBA5
- TLSH T13706338236458F03D5D7A53B02E56DCA4A2EFC20EF6F910A12A67F4D07317472BB86D9
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Extracted
Family
-
bumblebee
Botnet
-
grp0003
Attributes
-
dga
19ak90ckxyjxc.life
o2u1xbm9xoq4p.life
9b10t4vyvx6b5.life
9nl2a1qma4swd.life
gc9fctjq62t2e.life
apsgw881ol7rs.life
rmqa3jodwcmgd.life
85ur7zivhczam.life
evzftxl2qjfj4.life
cp2br7osw928r.life
lhunevjdxw5kz.life
jbrprj8im7aia.life
rdg0u5n7237r5.life
xwn7sukhzhbqv.life
8vh7uizstjhnb.life
u8karkeeu2qtj.life
j34duklow92k3.life
8sg769rvpe1lp.life
inkja7hekgcuv.life
r4a4n001s7uhi.life
r976ptnxbh52l.life
tv9jc206cpnyd.life
xf30997j6tp8z.life
nl2jkkuqs8efp.life
5395dg0j4h79n.life
v30ty639krk3p.life
oknzqkp6ph302.life
rlq13ng659buz.life
ey9n44bwtmjaw.life
trtiqjiry7k05.life
9vgvnzk51j1sy.life
wi88w99xo9zlt.life
hoieva2gl9tzx.life
7oo4hxt5haih5.life
ey8axyn00x8sf.life
kks80hyrpbmuz.life
zom3rkt078g1k.life
n2cy5wx4nfs8n.life
qnw1tsg4ogxa0.life
84ntpl4mk4cwm.life
m5f2awao92hp9.life
nq0tsip71ecq5.life
ithg3ysseil61.life
mvp5pt36h20vf.life
51415jvbttwu4.life
l0ecv85wptocs.life
nuq0isjlua30l.life
wd7jo4d8zlxg0.life
2885patz8ovcf.life
1zwze7b6jqovz.life
s23kd323qzj2l.life
4me127ppi31at.life
eifir9x2xpqsb.life
4hlnzokni29fh.life
ykv99faqy3ky4.life
bgiphdk30zk35.life
8n3rj69ohv8rv.life
29e8eji42sktd.life
bqlbyaavprz19.life
qj2suuu4ixgvf.life
b2ys2fltibnfu.life
z0lg8lijtw3mh.life
p3arx0taom00w.life
gquyy1qf8ncn7.life
ref18bh4aku24.life
epqykfhm5zq6l.life
zw96t31o1h768.life
c45ze0b5hhvdg.life
6kjpjs3v34hbf.life
qhyut7e0tjz2a.life
5p9udlfi4yvg6.life
5ew1715l4z3ef.life
xfi23ljskvgtg.life
ofvs2a3nhyrqi.life
7o3zfbd5rf5mz.life
flewo6le618h7.life
r7rw9inm558jg.life
7qjjcy6vg835x.life
8sz83ieffpzwj.life
0eftob9vxa877.life
0j62jm3djgxe7.life
v2vijxyqbqsbl.life
vuu79f2ne8xl1.life
ew3crbjgfbbhd.life
lqhhfpiqp5chx.life
f3be5ccj5ioc7.life
1ngmbwokqkiov.life
nh0hujf2w5xi9.life
daxbkb16ebdao.life
m4ivqiz0weqy7.life
0ei4jxf0cszgd.life
54zgxvq8jzq81.life
tesc2obtfbdke.life
w1nd36e506qqi.life
fc4v5wx4p4syq.life
43wubiwvmajs3.life
4w1b7rsnyg3sm.life
h8gw0cbhkkrrf.life
k2yu4bhadklet.life
wqfvb1lom02cg.life
-
dga_seed
7941704092191845612
-
domain_length
13
-
num_dga_domains
300
-
port
443
-
tld
.life
rc4.plain
Signatures
- Executes dropped EXE 2 IoCs
pid Process 436 WinMTR.exe 4048 icardagt.exe - Loads dropped DLL 1 IoCs
pid Process 4048 icardagt.exe - Badlisted process makes network request 6 IoCs
Network request originating from process or tool commonly abused by malware.
flow pid Process 2 3180 msiexec.exe 3 3180 msiexec.exe 4 3180 msiexec.exe 5 3180 msiexec.exe 6 3180 msiexec.exe 7 3180 msiexec.exe - Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\O: msiexec.exe - Drops file in Windows directory 12 IoCs
description ioc Process File created C:\Windows\Installer\e58b59f.msi msiexec.exe File opened for modification C:\Windows\Installer\e58b59f.msi msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File created C:\Windows\SystemTemp\~DF1ABFC68CDF24AFA2.TMP msiexec.exe File created C:\Windows\Installer\SourceHash{DD475EBC-D961-4AF4-BB8A-BE91FA942757} msiexec.exe File opened for modification C:\Windows\Installer\MSIB735.tmp msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File created C:\Windows\SystemTemp\~DF1074A335157EAD28.TMP msiexec.exe File created C:\Windows\Installer\e58b5a1.msi msiexec.exe File created C:\Windows\SystemTemp\~DFA2D40AB966D96627.TMP msiexec.exe File created C:\Windows\SystemTemp\~DF613070547F02AC3F.TMP msiexec.exe - Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
pid Process 3180 msiexec.exe - Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000ae741e68cfe5c5110000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000ae741e680000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed35000000ffffffff000000000700010000680900ae741e68000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff350000000000000005000000ffffffff000000000700010000f8ff1aae741e68000000000000f0ff350000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1dae741e68000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe - Modifies data under HKEY_USERS 15 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software WinMTR.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\WinMTR\Version = "0.9" WinMTR.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\WinMTR\Config\UseDNS = "1" WinMTR.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\WinMTR WinMTR.exe Key created \REGISTRY\USER\.DEFAULT\Software\WinMTR\Config WinMTR.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\WinMTR\Config\PingSize = "64" WinMTR.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\WinMTR\Config\Interval = "1000" WinMTR.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\WinMTR\HomePage = "http://WinMTR.sourceforge.net" WinMTR.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\WinMTR\Config\MaxLRU = "128" WinMTR.exe Key created \REGISTRY\USER\.DEFAULT\Software\WinMTR\LRU WinMTR.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28 msiexec.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\WinMTR\License = "GPL - GNU Public License" WinMTR.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\WinMTR\LRU\NrLRU = "0" WinMTR.exe - Modifies registry class 20 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\CBE574DD169D4FA4BBA8EB19AF497275 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CBE574DD169D4FA4BBA8EB19AF497275 msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CBE574DD169D4FA4BBA8EB19AF497275\Language = "1033" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CBE574DD169D4FA4BBA8EB19AF497275\Assignment = "1" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CBE574DD169D4FA4BBA8EB19AF497275\DeploymentFlags = "3" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CBE574DD169D4FA4BBA8EB19AF497275\PackageCode = "A254DD783317BC94C9DD65976D82B1C1" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CBE574DD169D4FA4BBA8EB19AF497275\AdvertiseFlags = "388" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CBE574DD169D4FA4BBA8EB19AF497275\SourceList\Net msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CBE574DD169D4FA4BBA8EB19AF497275\SourceList\Media msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CBE574DD169D4FA4BBA8EB19AF497275\Clients = 3a0000000000 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CBE574DD169D4FA4BBA8EB19AF497275\ProductName = "WinMTR" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CBE574DD169D4FA4BBA8EB19AF497275\Version = "16777216" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CBE574DD169D4FA4BBA8EB19AF497275\SourceList msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CBE574DD169D4FA4BBA8EB19AF497275\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\CBE574DD169D4FA4BBA8EB19AF497275\AppLicense msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CBE574DD169D4FA4BBA8EB19AF497275\InstanceType = "0" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CBE574DD169D4FA4BBA8EB19AF497275\AuthorizedLUAApp = "0" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CBE574DD169D4FA4BBA8EB19AF497275\SourceList\PackageName = "tmp0mi28a04.msi" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CBE574DD169D4FA4BBA8EB19AF497275\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CBE574DD169D4FA4BBA8EB19AF497275\SourceList\Media\1 = ";" msiexec.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1532 msiexec.exe 1532 msiexec.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 3180 msiexec.exe Token: SeIncreaseQuotaPrivilege 3180 msiexec.exe Token: SeSecurityPrivilege 1532 msiexec.exe Token: SeCreateTokenPrivilege 3180 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 3180 msiexec.exe Token: SeLockMemoryPrivilege 3180 msiexec.exe Token: SeIncreaseQuotaPrivilege 3180 msiexec.exe Token: SeMachineAccountPrivilege 3180 msiexec.exe Token: SeTcbPrivilege 3180 msiexec.exe Token: SeSecurityPrivilege 3180 msiexec.exe Token: SeTakeOwnershipPrivilege 3180 msiexec.exe Token: SeLoadDriverPrivilege 3180 msiexec.exe Token: SeSystemProfilePrivilege 3180 msiexec.exe Token: SeSystemtimePrivilege 3180 msiexec.exe Token: SeProfSingleProcessPrivilege 3180 msiexec.exe Token: SeIncBasePriorityPrivilege 3180 msiexec.exe Token: SeCreatePagefilePrivilege 3180 msiexec.exe Token: SeCreatePermanentPrivilege 3180 msiexec.exe Token: SeBackupPrivilege 3180 msiexec.exe Token: SeRestorePrivilege 3180 msiexec.exe Token: SeShutdownPrivilege 3180 msiexec.exe Token: SeDebugPrivilege 3180 msiexec.exe Token: SeAuditPrivilege 3180 msiexec.exe Token: SeSystemEnvironmentPrivilege 3180 msiexec.exe Token: SeChangeNotifyPrivilege 3180 msiexec.exe Token: SeRemoteShutdownPrivilege 3180 msiexec.exe Token: SeUndockPrivilege 3180 msiexec.exe Token: SeSyncAgentPrivilege 3180 msiexec.exe Token: SeEnableDelegationPrivilege 3180 msiexec.exe Token: SeManageVolumePrivilege 3180 msiexec.exe Token: SeImpersonatePrivilege 3180 msiexec.exe Token: SeCreateGlobalPrivilege 3180 msiexec.exe Token: SeBackupPrivilege 3268 vssvc.exe Token: SeRestorePrivilege 3268 vssvc.exe Token: SeAuditPrivilege 3268 vssvc.exe Token: SeBackupPrivilege 1532 msiexec.exe Token: SeRestorePrivilege 1532 msiexec.exe Token: SeRestorePrivilege 1532 msiexec.exe Token: SeTakeOwnershipPrivilege 1532 msiexec.exe Token: SeRestorePrivilege 1532 msiexec.exe Token: SeTakeOwnershipPrivilege 1532 msiexec.exe Token: SeRestorePrivilege 1532 msiexec.exe Token: SeTakeOwnershipPrivilege 1532 msiexec.exe Token: SeRestorePrivilege 1532 msiexec.exe Token: SeTakeOwnershipPrivilege 1532 msiexec.exe Token: SeRestorePrivilege 1532 msiexec.exe Token: SeTakeOwnershipPrivilege 1532 msiexec.exe Token: SeRestorePrivilege 1532 msiexec.exe Token: SeTakeOwnershipPrivilege 1532 msiexec.exe Token: SeRestorePrivilege 1532 msiexec.exe Token: SeTakeOwnershipPrivilege 1532 msiexec.exe Token: SeRestorePrivilege 1532 msiexec.exe Token: SeTakeOwnershipPrivilege 1532 msiexec.exe Token: SeRestorePrivilege 1532 msiexec.exe Token: SeTakeOwnershipPrivilege 1532 msiexec.exe Token: SeRestorePrivilege 1532 msiexec.exe Token: SeTakeOwnershipPrivilege 1532 msiexec.exe Token: SeRestorePrivilege 1532 msiexec.exe Token: SeTakeOwnershipPrivilege 1532 msiexec.exe Token: SeRestorePrivilege 1532 msiexec.exe Token: SeTakeOwnershipPrivilege 1532 msiexec.exe Token: SeRestorePrivilege 1532 msiexec.exe Token: SeTakeOwnershipPrivilege 1532 msiexec.exe Token: SeRestorePrivilege 1532 msiexec.exe - Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 3180 msiexec.exe 3180 msiexec.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 436 WinMTR.exe 436 WinMTR.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1532 wrote to memory of 4936 1532 msiexec.exe 85 PID 1532 wrote to memory of 436 1532 msiexec.exe 88 PID 1532 wrote to memory of 4048 1532 msiexec.exe 87 - Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\tmp0mi28a04.msi1⤵
- Badlisted process makes network request
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3180
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1532 -
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵PID:4936
-
-
C:\Users\Admin\AppData\Local\Temp\ApplicationInstallationFolder_11\icardagt.exe"C:\Users\Admin\AppData\Local\Temp\ApplicationInstallationFolder_11\icardagt.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:4048
-
-
C:\Users\Admin\AppData\Local\Temp\ApplicationInstallationFolder_11\WinMTR.exe"C:\Users\Admin\AppData\Local\Temp\ApplicationInstallationFolder_11\WinMTR.exe"2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:436
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:3268
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Config.Msi\e58b5a0.rbs
- Size 7KB
- SHA256 1ea6e0bfc7c21a66cf6b356194877b99a2e38a37a85540180a27de71802e2f11
- MD5 416e05f3ed8219f3224a898a3a476b7a
- SHA1 efc02aee10a1f81db304ceeec895f5908ba70591
- SHA512 ca1ae18b6a83193e6139b0e508f9844ab63303e0ed9118e2a8bc7da3fe5844c932e8f839bb16a734e6dbbac572427682d7df44997456c0eb2a415ea02e3691e5
- SSDEEP 96:5mYUtYJ6JCyKUwp8oCvxMaUCrjKITCsTlqUCrjKITCWd/XTlrnA5UhZWXuLZCMpr:0JiEi8oC+tSOIbSO+ukZ0Mpr
- TLSH T1BBF11241B31181D2EC92573ACB0B175A37B3D3DDD6D0230F09CD92686E927895FE528A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\9CB4373A4252DE8D2212929836304EC5_1AB74AA2E3A56E1B8AD8D3FEC287554E
- Size 1KB
- SHA256 0e463db8726b9ec19b1770d5790ea4727af39c85b4d951f56b7cb00b639816d9
- MD5 b8ba8f85f7c99fad7c22cd60f641a964
- SHA1 1ee69e5d2f0de776851c90a3e2cb4fdaf63fa934
- SHA512 5c3f06b145fb795f194e08ca7cc23c3f180757575126e756d843c87b2607d6295c8cb69f457658733efbe509283f57f3cd4f88f7855b3f486e68a01e89881720
- TLSH T13F31D8771F6CB5208E128D8426CDFA725970DAE0989A10797218DB176C80BB38B1559B
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\A90AB99B5CC057007BC33B2303FE2710
- Size 36KB
- SHA256 d9d5cd1b0409f032f30ffbae8f5fe1c0b317aa89e389dcd87857f80a388bc5dc
- MD5 569f125175b0c5c2d8c8eadaf9d0fd22
- SHA1 13be81b87279ed3d001e47124870493835040122
- SHA512 7090a54fb88d04f892e1b3c2f6c82def07c8a032066455bba266f0f91f8412096156830fac4ae0451b32f8ebe873dcb552d08651bb4feeee13d02d68a0bfff5d
- SSDEEP 768:skuTmM8h4ciFPw+JHofn1Q8mPqecaTEiw79kWM:+TmM86tXsvmPHcaNwBnM
- TLSH T141F2B860BE7C6A70E6CDCE720CADD75BDFA264CA2612571A47649AD078036CFCF36840
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\9CB4373A4252DE8D2212929836304EC5_1AB74AA2E3A56E1B8AD8D3FEC287554E
- Size 536B
- SHA256 beaecbbd42913678db48b5784a80a5c15d8ec5de764f3ccaad7c23d9c05f05b7
- MD5 24fe7a2d25f5b0df8b4183f9b0efbcf6
- SHA1 6efe8c7f012254bc2dd762fd42e6a60d1babe6f6
- SHA512 08ead4b5a26d351bde3d69a8a3f59f85887a591e6b8cb855893d89fd6cd13b18b0aecfa146583e4e224552833d431ed48454d363c7372bdcc762f149c3a1b304
- TLSH T143F05C1419F5831EF8B2DA791DE99526FA15FD027C259BAD035A4B1E3C60F108D3782D
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\A90AB99B5CC057007BC33B2303FE2710
- Size 226B
- SHA256 0c904af9c2b20f47c7ba61304707c795965ac115df04d038d057f108cefbdd00
- MD5 0e379fd66a46176d3afb1154dbe229d2
- SHA1 fa42556cd68ab05607f98037c84bd26464abce50
- SHA512 a3cec1dc8859a750e30743a28390e6bd8eb26109b42988cd857e94cadf6f4c4f9acfd667ac8d679a61c40044a76aa1985d1cb71f6446f4016c13ba0ad0591c1a
- TLSH T1B7D012145B94030EF1619F3A2CE38953DF71AE168CB2C724057A13445970D408C31E6E
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\ApplicationInstallationFolder_11\WinMTR.exe
- Size 2.3MB
- SHA256 9ad74a0f18ce39a0d92a9dabc6ef7ebb2aebf1471ed868f14e183faf0123eb87
- MD5 7174ccf02161dab6e424e2de83807deb
- SHA1 dbaef2cbdd50d56e2d6bbd63991d22391526894b
- SHA512 3feb78fc4b60dc089c7c84b31ab3d676458c82d91b3a1c12db469dbb6d56b13a62cb3cfa3e5bd94490a89c659d6d17caff8e1a5060ebb49a81529aeda15e0f5f
- SSDEEP 49152:jgUtLamQ9h/eWg7dfN/RODru+USamit26nFd2b3g2:kua9c17dpt26n2b3g
- TLSH T1FBB55B5B22B861F4E0668176C407874BC7F274720B35C3CF50A517AE1FB76B60DAA7A2
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\ApplicationInstallationFolder_11\icardagt.exe
- Size 1.3MB
- SHA256 473d17e571d6947ce93103454f1e9fe27136403125152b97acb6cad5cc2a9ac7
- MD5 2fe97a3052e847190a9775431292a3a3
- SHA1 43edc451ac97365600391fa4af15476a30423ff6
- SHA512 93ed1f9ef6fb256b53df9c6f2ce03301c0d3a0ef49c3f0604872653e4ba3fce369256f50604dd8386f543e1ea9231f5700213e683d3ea9af9e4d6c427a19117a
- SSDEEP 12288:pvRneDBcP5s/UdTEQa8DOmJRJmILwCHEA188KijZZLr0X+c/d2zlNRTSTNo7I8:phe4kRQa8DO6JmJCvrKimZ4zlNRTST38
- TLSH T1D955F969F97C4176E121D4BFD183DA4AD1B230422B305AE74262CF6E1E3F5D6A13A732
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\ApplicationInstallationFolder_11\version.dll
- Size 3.4MB
- SHA256 96480ef5ccfa8fcb0646538c440103d97ab741ed83f4c2bcb7b4717569f88770
- MD5 a67fa1a060c07934c3de8612aaa0ebc2
- SHA1 d1c5b38d3d91f925b16d616c1c9d3e05542f025d
- SHA512 303daff6ef1e8f84fce5528badfb8eb935c8b6f9688ebfbbadfe0a43dae208363ff96172429200d014d0e608cf99d8595906f7e774cb5efd68bfe9f1686fb6ce
- SSDEEP 49152:+3PYkqzfH5TWZzpHWO2WYIgzMhGByFi2T1QKTZMmC5lZLVNLjssT6Rvl:+3AkuH9WZzpHWO2WYFMIBebizsTf
- TLSH T134F55B06EB7F4A5DE550C4BE96771263D8697D0CD028B8758EC00B057FA2F60A67A3EC
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\e58b59f.msi
- Size 3.7MB
- SHA256 31dd6d070a65a648b2be9ea2edc9efca26762c3875a8dde2d018eb064bc41e32
- MD5 28c0caed1c9c242f60c8e0884ccbf976
- SHA1 0e6abeb79a84fc3e7683c5439607c8a17ef6ae77
- SHA512 7b3637ef5de221dc34684fa2a5746b54d8cdc373cba9486cfd9e496c930088713b8875759fe6027b4c827be8f8a11fc3d97d31d8519f62eb31244dea00ddb7ee
- SSDEEP 98304:uU8uEL5HQ++zzvBXzSnmw5KxYXyuDB7KR5:uU87Qt1iCOBA5
- TLSH T13706338236458F03D5D7A53B02E56DCA4A2EFC20EF6F910A12A67F4D07317472BB86D9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
- Size 24.6MB
- SHA256 5d5288b58a6122d75b7ca49524a9f25dffb523e2c18ee89ebd6d0bd1e1e8c3d8
- MD5 893c53150c243e084182fb3430e082c9
- SHA1 324d7cad5a7ac6fb6c6a86e08eadc5efb0eb2b22
- SHA512 86541ba48f3b52036d88f82f0e4ae02c97c08945555190277c174bce82b32760045bc33789e88976ab5e00fcdc2980c9156ebe8ef4516136e4a5e8072e88bb9e
- SSDEEP 24576:F2gmSp1udoO/vvTL4WzOR0X6PqZoQ4nZGWANHJkzq4KYkv3244i0LeZEh:C
- TLSH T13047F32437F92200E7F39E7CA8F46A23493A7D5B9C15DE8D45411B8E0921FB1E872F5A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\Volume{681e74ae-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{3abaf490-5b57-4afb-9b24-f412b59e4f92}_OnDiskSnapshotProp
- Size 6KB
- SHA256 78d0d602f176310893363ae36b843b60153a970f806825468846a4c8cdc070fd
- MD5 99ecc51b8ff48d8e02a2d63b83146a1d
- SHA1 f8fd049d03deaf379a7dea960f4bc598578a897b
- SHA512 a45cc06ecc761c18674d2ab986bb64e1482bfc407d788ba2f13bfd9a0c8fe8b16f245873d9c1265137054ee3540f76b37932d0e955dd1663e0eb20eb9e527f4a
- SSDEEP 96:FZNIrvc8DD84LTHzbOHXOHBlBRQ88Sc9XE56tOSVQpu:3yb++ZVm
- TLSH T10AD188085AF54311E2B3AB7228F18557A477B911EF33CB8E0298238E2670A10F875F5F
- MD5 SHA1 SHA512 SSDEEP TLSH