bumblebee | 76ea5c5bd76941aae78a9212929db83a8975260265c58dea38ddf20e3c35ce10

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
09/06/2026, 01:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
tmp6l7z57zu.msi
Size 21.6MB
Sample260609-bdgn7sav8n
SHA256 76ea5c5bd76941aae78a9212929db83a8975260265c58dea38ddf20e3c35ce10
MD5 44f646d04b844b751f2a041d28ae896e
SHA1 98fbf6c69ed1673d64596f1db27df2315b1de396
SHA512 eb4d72143823f12d8885a5c0c5afab84916f28598475d088fd2fcb0e25826c5df3eb0be7e5fd1bf38baa6dfb4caf67d716c4711b649fc0051bb0b4d170c3264c
SSDEEP 393216:/FbgvkXDSlnAH4LnIg2xWzQ6jwqOfvo7FZJeWLIYX45sVzMwObRb9q7+jklofNoS:9svJnK4KxqmvaXJeWLs2VKkzGiS5p3Ue
TLSH
T1713733EBE12D8F3DEC4A5079C4D933CA67006D59710A8633E60DB2F627B7667027A790
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

grp0001 discovery bumblebee installer loader persistence privilege_escalation ransomware

Malware Config

Extracted

Family

bumblebee

Botnet

grp0001

Attributes

dga
ev2sirbd269o5j.org

ijt0l3i8brit6q.org

ewujsfb1dp5ran.org

8doj8uvx604eck.org

kwywztxoo2xdot.org

2rxyt9urhq0bgj.org

ky1d1p1daahe5t.org

ovh1kn1tcqw5kp.org

6cimu4mc085em8.org

5ka8rxp6t6eup2.org

ks50ioz9nm3v05.org

v5rjsdqogstopr.org

epnl524h4k03mu.org

hpzmehtnkk4q22.org

ygvmhd7ll9v2nu.org

oovlcxvht9kupu.org

1074slp8zafyz3.org

vfwlzltibeg7ne.org

wp67lr8ysypurn.org

1ge03xy5vtwn5s.org

958xz3300iu8oe.org

dlbqduy9gjprko.org

tycl4o5dep10cd.org

ui9bex45gw70az.org

trj1qy559ygvx3.org

w823niq7veztr9.org

01t05hb4armbco.org

igl71zhw25qw3d.org

j8ku0xu0dqduxr.org

jy3y61q6hyhf4c.org

s96phai2s1wzen.org

usguzk6xqox3ss.org

vfo2q74c1y0x74.org

tig85m8n7xixaz.org

0jfv3ru6slys8b.org

mh4bjdyhen3d9z.org

v3hm711ignzez6.org

xuixp4uro6pl3z.org

haq82ih59xa38b.org

zs2u14kk7bqbn2.org

zrym1d73kdmimj.org

r2r3qzjb3bp1ar.org

z3vni7gw9q1i8p.org

nlvskzui15vxju.org

13ov5ypehzqx5l.org

2x51hwe9cnidu4.org

gydu03jt8n5e41.org

gd2i9y77jhbjqb.org

9g055w2ak8hd6t.org

x5x2vq5joobqxe.org

acl1omagtzq38v.org

18xsm4245vgytb.org

q008rx2d58h76q.org

cybf5coa1t2xr2.org

tx6jny2iaea186.org

3pvk0zw1k7g28h.org

nrd1qnd4l7tcp9.org

bvt69kywl2s8rg.org

0youdp14i4r4h5.org

r4aadwqq9d2h24.org

l2q3fkrpgyxr8r.org

s6mngnfnj9nrfj.org

2yr46kghd39ise.org

fo1463oipy7oq8.org

gkukvtxlew982a.org

3h98rycjvt3gj5.org

xgcibmd1rd21us.org

kecah03gobzlrt.org

jpgw5b5zv4vdoy.org

hnxkyiagzxlvv0.org

aelovxoinqta4a.org

ae7a1pbhn5ytpe.org

fbixeudnf6vbhh.org

cjlv1576zqgb47.org

j8plhuz7p6052k.org

pk743hnddx0nds.org

3pu8prnkr8v31d.org

2gdaqm18d6p9d8.org

avm2dir92zqv9x.org

54jmh8bnrpha7y.org

y9e05pr4v7lhp9.org

o44e59aio5jk9q.org

u0tkv94vt86y23.org

q2myvg0j1nna57.org

x5b6lm11d90dht.org

invutsz52frzl8.org

t052317kru670j.org

011jn31n05qzpp.org

tqilxwrw5m54pj.org

pkzwaki575nsll.org

z3l0kxd46ulurv.org

z55s2t6ca702es.org

nrej2ipydbg40k.org

15eaytwast9oig.org

560tvzwrobbl2k.org

1v6pqsve9hg3gy.org

7p788ywb3z9fwe.org

vzf1g0it8gpvq7.org

oqu78tlfbxcf50.org

th87nd6s31jke7.org
dga_seed
4792266342353752649
domain_length
14
num_dga_domains
300
port
443
tld
.org

rc4.plain

Signatures

Family: BumbleBee
BumbleBee is a loader malware written in C++.
loader bumblebee

Executes dropped EXE 3 IoCs

pid	Process
4716	winmtr.exe
4440	Advanced_IP_Scanner_2.5.4594.1.exe
2104	Advanced_IP_Scanner_2.5.4594.1.tmp

Loads dropped DLL 2 IoCs

pid	Process
4716	winmtr.exe
2104	Advanced_IP_Scanner_2.5.4594.1.tmp

Badlisted process makes network request 3 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
4	976	msiexec.exe
6	976	msiexec.exe
9	976	msiexec.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe

Drops file in Windows directory 8 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\SourceHash{DD475EBC-D961-4AF4-BB8A-BE91FA942757}	msiexec.exe
File created	C:\Windows\Installer\e58c977.msi	msiexec.exe
File created	C:\Windows\Installer\e58c975.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e58c975.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSICADD.tmp	msiexec.exe

Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs

persistence privilege_escalation

Installer Packages

T1546.016

Msiexec

T1218.007

pid	Process
976	msiexec.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Advanced_IP_Scanner_2.5.4594.1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Advanced_IP_Scanner_2.5.4594.1.tmp

Inno Setup is an open-source installation builder for Windows applications. 3 IoCs

Inno Setup installer

installer

resource	yara_rule
behavioral2/files/0x0002000000022c7b-37.dat	innosetup
behavioral2/memory/4440-42-0x0000000000400000-0x000000000042D000-memory.dmp	innosetup
behavioral2/memory/4440-64-0x0000000000400000-0x000000000042D000-memory.dmp	innosetup

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000f94cc820840d1c590000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000f94cc8200000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed35000000ffffffff000000000700010000680900f94cc820000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff350000000000000005000000ffffffff000000000700010000f8ff1af94cc820000000000000f0ff350000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1df94cc820000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe

Modifies data under HKEY_USERS 10 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	Advanced_IP_Scanner_2.5.4594.1.tmp
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	Advanced_IP_Scanner_2.5.4594.1.tmp
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager	Advanced_IP_Scanner_2.5.4594.1.tmp
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\Sequence = "1"	Advanced_IP_Scanner_2.5.4594.1.tmp
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000	Advanced_IP_Scanner_2.5.4594.1.tmp
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\Owner = 38080000fd580a92abf7dc01	Advanced_IP_Scanner_2.5.4594.1.tmp
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\SessionHash = aeff46326dcbcd573c4f04e1ee34f1ed8f77cfcaeb0558ecebd5746a2c5415fc	Advanced_IP_Scanner_2.5.4594.1.tmp

Modifies registry class 20 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CBE574DD169D4FA4BBA8EB19AF497275\Language = "1033"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CBE574DD169D4FA4BBA8EB19AF497275\Version = "16777216"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CBE574DD169D4FA4BBA8EB19AF497275\SourceList	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CBE574DD169D4FA4BBA8EB19AF497275\SourceList\Media	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\CBE574DD169D4FA4BBA8EB19AF497275	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CBE574DD169D4FA4BBA8EB19AF497275\ProductName = "Advanced_IP_Scanner"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CBE574DD169D4FA4BBA8EB19AF497275\AdvertiseFlags = "388"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CBE574DD169D4FA4BBA8EB19AF497275\SourceList\PackageName = "tmp6l7z57zu.msi"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CBE574DD169D4FA4BBA8EB19AF497275\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CBE574DD169D4FA4BBA8EB19AF497275\SourceList\Media\1 = ";"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CBE574DD169D4FA4BBA8EB19AF497275\Assignment = "1"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CBE574DD169D4FA4BBA8EB19AF497275\InstanceType = "0"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CBE574DD169D4FA4BBA8EB19AF497275\DeploymentFlags = "3"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CBE574DD169D4FA4BBA8EB19AF497275\SourceList\Net	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CBE574DD169D4FA4BBA8EB19AF497275\Clients = 3a0000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\CBE574DD169D4FA4BBA8EB19AF497275\AppLicense	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CBE574DD169D4FA4BBA8EB19AF497275	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CBE574DD169D4FA4BBA8EB19AF497275\PackageCode = "D23BF1A2BF728A441B8BC213C0B4C876"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CBE574DD169D4FA4BBA8EB19AF497275\AuthorizedLUAApp = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CBE574DD169D4FA4BBA8EB19AF497275\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2860	msiexec.exe
2860	msiexec.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	976	msiexec.exe
Token: SeIncreaseQuotaPrivilege	976	msiexec.exe
Token: SeSecurityPrivilege	2860	msiexec.exe
Token: SeCreateTokenPrivilege	976	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	976	msiexec.exe
Token: SeLockMemoryPrivilege	976	msiexec.exe
Token: SeIncreaseQuotaPrivilege	976	msiexec.exe
Token: SeMachineAccountPrivilege	976	msiexec.exe
Token: SeTcbPrivilege	976	msiexec.exe
Token: SeSecurityPrivilege	976	msiexec.exe
Token: SeTakeOwnershipPrivilege	976	msiexec.exe
Token: SeLoadDriverPrivilege	976	msiexec.exe
Token: SeSystemProfilePrivilege	976	msiexec.exe
Token: SeSystemtimePrivilege	976	msiexec.exe
Token: SeProfSingleProcessPrivilege	976	msiexec.exe
Token: SeIncBasePriorityPrivilege	976	msiexec.exe
Token: SeCreatePagefilePrivilege	976	msiexec.exe
Token: SeCreatePermanentPrivilege	976	msiexec.exe
Token: SeBackupPrivilege	976	msiexec.exe
Token: SeRestorePrivilege	976	msiexec.exe
Token: SeShutdownPrivilege	976	msiexec.exe
Token: SeDebugPrivilege	976	msiexec.exe
Token: SeAuditPrivilege	976	msiexec.exe
Token: SeSystemEnvironmentPrivilege	976	msiexec.exe
Token: SeChangeNotifyPrivilege	976	msiexec.exe
Token: SeRemoteShutdownPrivilege	976	msiexec.exe
Token: SeUndockPrivilege	976	msiexec.exe
Token: SeSyncAgentPrivilege	976	msiexec.exe
Token: SeEnableDelegationPrivilege	976	msiexec.exe
Token: SeManageVolumePrivilege	976	msiexec.exe
Token: SeImpersonatePrivilege	976	msiexec.exe
Token: SeCreateGlobalPrivilege	976	msiexec.exe
Token: SeBackupPrivilege	2728	vssvc.exe
Token: SeRestorePrivilege	2728	vssvc.exe
Token: SeAuditPrivilege	2728	vssvc.exe
Token: SeBackupPrivilege	2860	msiexec.exe
Token: SeRestorePrivilege	2860	msiexec.exe
Token: SeRestorePrivilege	2860	msiexec.exe
Token: SeTakeOwnershipPrivilege	2860	msiexec.exe
Token: SeRestorePrivilege	2860	msiexec.exe
Token: SeTakeOwnershipPrivilege	2860	msiexec.exe
Token: SeRestorePrivilege	2860	msiexec.exe
Token: SeTakeOwnershipPrivilege	2860	msiexec.exe
Token: SeRestorePrivilege	2860	msiexec.exe
Token: SeTakeOwnershipPrivilege	2860	msiexec.exe
Token: SeRestorePrivilege	2860	msiexec.exe
Token: SeTakeOwnershipPrivilege	2860	msiexec.exe
Token: SeRestorePrivilege	2860	msiexec.exe
Token: SeTakeOwnershipPrivilege	2860	msiexec.exe
Token: SeRestorePrivilege	2860	msiexec.exe
Token: SeTakeOwnershipPrivilege	2860	msiexec.exe
Token: SeRestorePrivilege	2860	msiexec.exe
Token: SeTakeOwnershipPrivilege	2860	msiexec.exe
Token: SeRestorePrivilege	2860	msiexec.exe
Token: SeTakeOwnershipPrivilege	2860	msiexec.exe
Token: SeRestorePrivilege	2860	msiexec.exe
Token: SeTakeOwnershipPrivilege	2860	msiexec.exe
Token: SeRestorePrivilege	2860	msiexec.exe
Token: SeTakeOwnershipPrivilege	2860	msiexec.exe
Token: SeRestorePrivilege	2860	msiexec.exe
Token: SeTakeOwnershipPrivilege	2860	msiexec.exe
Token: SeRestorePrivilege	2860	msiexec.exe
Token: SeTakeOwnershipPrivilege	2860	msiexec.exe
Token: SeRestorePrivilege	2860	msiexec.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
976	msiexec.exe
976	msiexec.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2860 wrote to memory of 4876	2860	msiexec.exe	105
PID 2860 wrote to memory of 4716	2860	msiexec.exe	107
PID 2860 wrote to memory of 4440	2860	msiexec.exe	108
PID 4440 wrote to memory of 2104	4440	Advanced_IP_Scanner_2.5.4594.1.exe	109

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\tmp6l7z57zu.msi
1⤵
- Badlisted process makes network request
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:976

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2860
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:4876
- C:\Users\Admin\AppData\Local\Temp\ApplicationInstallationFolder_11\winmtr.exe
  "C:\Users\Admin\AppData\Local\Temp\ApplicationInstallationFolder_11\winmtr.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:4716
- C:\Users\Admin\AppData\Local\Temp\ApplicationInstallationFolder_11\Advanced_IP_Scanner_2.5.4594.1.exe
  "C:\Users\Admin\AppData\Local\Temp\ApplicationInstallationFolder_11\Advanced_IP_Scanner_2.5.4594.1.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4440
- - C:\Users\Admin\AppData\Local\Temp\is-KQGKQ.tmp\Advanced_IP_Scanner_2.5.4594.1.tmp
    "C:\Users\Admin\AppData\Local\Temp\is-KQGKQ.tmp\Advanced_IP_Scanner_2.5.4594.1.tmp" /SL5="$E0260,20439558,139776,C:\Users\Admin\AppData\Local\Temp\ApplicationInstallationFolder_11\Advanced_IP_Scanner_2.5.4594.1.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Modifies data under HKEY_USERS
    PID:2104

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:2728

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Installer Packages

T1546.016

Privilege Escalation

Event Triggered Execution

T1546

Installer Packages

T1546.016

Defense Evasion

System Binary Proxy Execution

T1218

Msiexec

T1218.007

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e58c976.rbs

Path C:\Config.Msi\e58c976.rbs
Size 7KB
SHA256 75dee95f353ebd4774a7d57b80354225f4cb32ea280355048249d53abefc48a4
MD5 c5a57f3c87c8f50bcd05a7edd3619d6b
SHA1 b8768235a4ac747c37fb56a650d22b434d2d5fbf
SHA512 a9ffa55a22c5386181cf930b38b252ae2aed30a214556965581f22c9f6453a0e6aacf4ddf48e6bad19bfbe564870b576009de4fe1f811665c21a7fea8e550e19
SSDEEP 96:km60J6JEUCVst8ZeukMaUCrtEQTCsTlqUCrtEQTCWd/8TlriA5UhZWXuLJCMpnBU:hhE/8ZeUtZQOIbZQOb5kZEMpW
TLSH
T173F15241B31181E2EC52573ACB0B276637B3D3DDD7D0270B09CD92A85E5278A5FE228A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

357F04AD41BCF5FE18FCB69F60C6680F_D1C51BA358EBA5378FCED4E3967B0097

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\357F04AD41BCF5FE18FCB69F60C6680F_D1C51BA358EBA5378FCED4E3967B0097
Size 1KB
SHA256 ac31a41fd3522a9c498d2ff783962961aacc7c8de02e1f205afff8069d727e9c
MD5 ecdef40edc4e6467825ffcd162f0dde7
SHA1 16c925be433afc1f76f5b5c44ead202b87fc337f
SHA512 119c1a278559de67816ef74b57e52c85d02464c65bc0766d8759312d7c1f3c6f52cb070b572fd734b857ba7c7933b1c72e16a013df403a41c21e24c944da4efd
TLSH
T10B31D69A0E2D1CD7AE8E8E685CC7A1087D6DA0E16DA9B521213AC135BA403D36F7041A
MD5 SHA1 SHA512 TLSH

Submit Download

9CB4373A4252DE8D2212929836304EC5_1AB74AA2E3A56E1B8AD8D3FEC287554E

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\9CB4373A4252DE8D2212929836304EC5_1AB74AA2E3A56E1B8AD8D3FEC287554E
Size 1KB
SHA256 0e463db8726b9ec19b1770d5790ea4727af39c85b4d951f56b7cb00b639816d9
MD5 b8ba8f85f7c99fad7c22cd60f641a964
SHA1 1ee69e5d2f0de776851c90a3e2cb4fdaf63fa934
SHA512 5c3f06b145fb795f194e08ca7cc23c3f180757575126e756d843c87b2607d6295c8cb69f457658733efbe509283f57f3cd4f88f7855b3f486e68a01e89881720
TLSH
T13F31D8771F6CB5208E128D8426CDFA725970DAE0989A10797218DB176C80BB38B1559B
MD5 SHA1 SHA512 TLSH

Submit Download

357F04AD41BCF5FE18FCB69F60C6680F_D1C51BA358EBA5378FCED4E3967B0097

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\357F04AD41BCF5FE18FCB69F60C6680F_D1C51BA358EBA5378FCED4E3967B0097
Size 540B
SHA256 41d14d7d1fb12f74ac308eaf7743ff6ae88b73d8a2fece309d25db5a669c9b14
MD5 becf1d7d3451911b63d73619b65c9a80
SHA1 d41e75ab3b13b94b91aaba33045d1a18396dc6b1
SHA512 89064f3db5aa44b41a74ed7cb5b78beedfccd52d749609b464be4e2d229bb005e6d827a6d6e4ea301fea353092150209699f7f729962828b1c4ca5ebd2e681cd
TLSH
T195F02E3850FE110FF172DAF807D2A5419E55FB2334275A6924DA47197930D006C42B3E
MD5 SHA1 SHA512 TLSH

Submit Download

9CB4373A4252DE8D2212929836304EC5_1AB74AA2E3A56E1B8AD8D3FEC287554E

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\9CB4373A4252DE8D2212929836304EC5_1AB74AA2E3A56E1B8AD8D3FEC287554E
Size 536B
SHA256 acc7641683737610f3f5afe4b8b270b1854a7af321aa0606086d73d63a39b639
MD5 59b266a1d92091a76ad18f3e0caac85c
SHA1 82b25d0716131801899c1d4aaffd44a8d645051a
SHA512 63467fca97418d47f90ee649c7a5f561d11bcdd666ea0a0b449bb0cc1fae190a1183d026b338e6c4bd99959a6be08deeb9f6cca9c4aedd889194baff98dcabf3
TLSH
T1ADF0DC0409F5831EF8B2DA790DE95416EA55F8027C218BAD025A4B0E3C20B008D3382D
MD5 SHA1 SHA512 TLSH

Submit Download

Advanced_IP_Scanner_2.5.4594.1.exe

Path C:\Users\Admin\AppData\Local\Temp\ApplicationInstallationFolder_11\Advanced_IP_Scanner_2.5.4594.1.exe
Size 20.1MB
SHA256 26d5748ffe6bd95e3fee6ce184d388a1a681006dc23a0f08d53c083c593c193b
MD5 5537c708edb9a2c21f88e34e8a0f1744
SHA1 86233a285363c2a6863bf642deab7e20f062b8eb
SHA512 35f44c0df4635a1020f52743d7cf3e4346d1bdf9010161326e572250ac93e0285b202532a07d2db8dbc67f6f0ced864083769e904bd5d82611244339ca8d31a1
SSDEEP 393216:Plu7Txs0NDmNh9D4HaSYz2Kj0Cz1gEVmWdQOjM/y3tFfs5IRRViGmMQZ+Bw5i:A7Th9mT97S7CzNwWCJK05IRTX+Fi
TLSH
T1B0273382B79A8A32FC5E2438496652E54F00FC547BD54127BE35F39E4F723A08DBA391
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSIMG32.dll

Path C:\Users\Admin\AppData\Local\Temp\ApplicationInstallationFolder_11\MSIMG32.dll
Size 2.6MB
SHA256 0dd6fabb987f0a58550c4b2ef599239947f3f5b5dc9ff496ce52c9f67671c689
MD5 08835e514e1ce81a3613475eb1099fb9
SHA1 62204d9b20a402fa31231ce89cc50de3a57a5417
SHA512 54440de1bca25f573cb967edc2caf6a2e4a7ce16b57781a8f874796ac755571a7d9d868b1d8305e2c7414e4977e4d0f1760a38bff8dd61c719fe35da904e445a
SSDEEP 49152:ekHqgFIVYqs+fwxwHctirjhEExZsDOTgrTJ5jMSQGple0O:WlQsjhEOsDUgLjM2jO
TLSH
T13CD5AE0A2B3B4A9ED510C4BE967B1263D95D7D0CE018B9B58DC04B417FA6F60927E3EC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

winmtr.exe

Path C:\Users\Admin\AppData\Local\Temp\ApplicationInstallationFolder_11\winmtr.exe
Size 109KB
SHA256 ccad775decb5aec98118b381eeccc6d540928035cfb955abcb4ad3ded390b79b
MD5 0b5511674394666e9d221f8681b2c2e6
SHA1 6e4e720dfc424a12383f0b8194e4477e3bc346dc
SHA512 00d28a00fd3ceaeae42ba6882ffb42aa4cc8b92b07a10f28df8e1931df4b806aebdcfab1976bf8d5ce0b98c64da19d4ee06a6315734fa5f885ecd1f6e1ff16a7
SSDEEP 1536:HT3RGRM9dooAXR1cMfb5/0ivhWZpzNKD4h:HT3Rj9dotXRPjd0ckzNHh
TLSH
T1C6B3F75292100455F3598B7146A6F6E149A0BD3D1BE4E6CFF138BD3A2E322E35A3760F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

aips_is_install_dll.dll

Path C:\Users\Admin\AppData\Local\Temp\is-01REH.tmp\aips_is_install_dll.dll
Size 149KB
SHA256 3a7a8aa906c65124c4ee82aacb81d723ce69864ccaf041f631b8131de59e4a88
MD5 57e73855fad786a59893d6581e9fb5b9
SHA1 630e52b9e88a05add68401bd62790ed8e2c3282a
SHA512 be0cf0925535dd667488175f2eac660d1ebf8429ce6725252c59fb70b00fc2f21b1e0b7ce632eaa53337ae25e44c641e13a3df0b415724498d30daf00b296f4d
SSDEEP 3072:RMmLlzH5vVOS6vHZM+70gxvlou/xq+1f2auYpLAbPTxTTtFBImEQ3F65D:dZ/OSO7gK5q+N2ahjOF65D
TLSH
T181E37D117580C432E6BF19385878D6765B3E7930DF6089CB63981ABA5E30AC1DF34B7A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Advanced_IP_Scanner_2.5.4594.1.tmp

Path C:\Users\Admin\AppData\Local\Temp\is-KQGKQ.tmp\Advanced_IP_Scanner_2.5.4594.1.tmp
Size 1.1MB
SHA256 ec8252a333f68865160e26dc95607f2c49af00f78c657f7f8417ab9d86e90bf7
MD5 b87639f9a6cf5ba8c9e1f297c5745a67
SHA1 ce4758849b53af582d2d8a1bc0db20683e139fcc
SHA512 9626fc4aa4604eee7ededa62b9dc78a3f6fe388eaf1fa6c916a3715b0dff65c417eede156d82398c2400977a36457122565e15e0ed0e435b28cb9f796005c1c0
SSDEEP 24576:Z4VN4kkKF3hDXq8xeidJLvkU99kkkkJE58dlX3IiAtp3Nq3E/HoQYx96BxYx9v1:iT90guMXEdqwHkUBK3
TLSH
T1CE454A22A3924437E5732F759D6BC6946C36BE202EB4D54A7EF89E0C0E38B417D35392
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e58c975.msi

Path C:\Windows\Installer\e58c975.msi
Size 21.6MB
SHA256 76ea5c5bd76941aae78a9212929db83a8975260265c58dea38ddf20e3c35ce10
MD5 44f646d04b844b751f2a041d28ae896e
SHA1 98fbf6c69ed1673d64596f1db27df2315b1de396
SHA512 eb4d72143823f12d8885a5c0c5afab84916f28598475d088fd2fcb0e25826c5df3eb0be7e5fd1bf38baa6dfb4caf67d716c4711b649fc0051bb0b4d170c3264c
SSDEEP 393216:/FbgvkXDSlnAH4LnIg2xWzQ6jwqOfvo7FZJeWLIYX45sVzMwObRb9q7+jklofNoS:9svJnK4KxqmvaXJeWLs2VKkzGiS5p3Ue
TLSH
T1713733EBE12D8F3DEC4A5079C4D933CA67006D59710A8633E60DB2F627B7667027A790
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata-2

Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
Size 24.1MB
SHA256 cee568b6797c0a2cebe8821b732b5798077d654e97680562f0ab368116c66d74
MD5 b2651d9696bac98fcd939f2dad6b7b4b
SHA1 d2c549bda2ac849e8eeb7df28d85a2e9bcb6ab8d
SHA512 92bfdccb7296ba67988e346c91726eaeac52752c90dcff858fcd693ab3483673f8b30ae01bd1821f90ae9fc767c41dafc761c63f9bb24135c027764790e93dc0
SSDEEP 24576:nu8m+1zodoO/vvTLrWceJG64dl0zEVMiwKmNeTtlU06tuLlBovVFk6XRp:M
TLSH
T14F47E42436F92110E7F79E3CA8F16A234D3A7D5B8C159E8D05411B4E0962FB1E872F6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{61c4c2b8-b51c-4b88-95af-f9f7fdeebb98}_OnDiskSnapshotProp

Path \??\Volume{20c84cf9-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{61c4c2b8-b51c-4b88-95af-f9f7fdeebb98}_OnDiskSnapshotProp
Size 6KB
SHA256 98447a51d20a61c16462bf0a9e68107f1ac817ad06a3fded1f90df355a80fe1f
MD5 a5ee14a3b7227848e3ccafa1154db95c
SHA1 ad4feedc9945820fa2a4c30dc883d528d5dd31b6
SHA512 7450f48260ca078c13a4d87d4f59edee4ac32bb0e5dabe5dd75aad83515a28f0e553433bf779b5c28db0cc1f022c7c96ffc4c340922cd891a03cba1616bcd5c6
SSDEEP 96:Fh3naCcA0vc8DD84LTHzbOHXOHBlBRQ88Sc9XE56tOSVQpu:T3naBb++ZVm
TLSH
T1B7D179085AF54311E2B3AB3129F18557A877B911EF33CB8E0298238E6671910F975F6F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2104-65-0x0000000000400000-0x0000000000530000-memory.dmp

Download

memory/2104-104-0x0000000000400000-0x0000000000530000-memory.dmp

Download

memory/2104-101-0x0000000000400000-0x0000000000530000-memory.dmp

Download

memory/2104-98-0x0000000000400000-0x0000000000530000-memory.dmp

Download

memory/2104-92-0x0000000000400000-0x0000000000530000-memory.dmp

Download

memory/2104-68-0x0000000000400000-0x0000000000530000-memory.dmp

Download

memory/2104-95-0x0000000000400000-0x0000000000530000-memory.dmp

Download

memory/2104-71-0x0000000000400000-0x0000000000530000-memory.dmp

Download

memory/2104-74-0x0000000000400000-0x0000000000530000-memory.dmp

Download

memory/2104-80-0x0000000000400000-0x0000000000530000-memory.dmp

Download

memory/2104-83-0x0000000000400000-0x0000000000530000-memory.dmp

Download

memory/2104-86-0x0000000000400000-0x0000000000530000-memory.dmp

Download

memory/2104-89-0x0000000000400000-0x0000000000530000-memory.dmp

Download

memory/4440-42-0x0000000000400000-0x000000000042D000-memory.dmp

Download

memory/4440-64-0x0000000000400000-0x000000000042D000-memory.dmp

Download

memory/4716-66-0x0000000003760000-0x0000000003E9F000-memory.dmp

Download

memory/4716-63-0x0000000003760000-0x0000000003E9F000-memory.dmp

Download

memory/4716-52-0x0000000003760000-0x0000000003E9F000-memory.dmp

Download