bumblebee | ad415a5fe368e89c4b00337b00baf6ed8b77c83d27d8f9e0628f1217a6082740

Analysis

max time kernel
150s
max time network
150s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260513-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260513-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
09/06/2026, 01:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
tmpsouiavz5.msi
Size 9.0MB
Sample260609-bdymqaas2s
SHA256 ad415a5fe368e89c4b00337b00baf6ed8b77c83d27d8f9e0628f1217a6082740
MD5 57402c7319524e6ade02484ab479e395
SHA1 0a8da437f530f0346bdd7709d89577f193170e91
SHA512 624cba4c57728f1ab706982ceda7732235307c0394f38bf4a9f7da56261f198ed13c7086c9742104c29b477ae0fb72b3b562bde701d6459b7c210ba95220ee46
SSDEEP 196608:mqqJN3v5jqYqqCGeboXQfLsCw7m6L6Hh4m7jFd:mqqJNYYqqioILEm6eHiO
TLSH
T1E9963346BEAC964DCD51FDBE2F8D72A44840AE86BC0761E52E0C7333653753A12B9CE4
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

grp666 discovery bumblebee installer loader persistence privilege_escalation ransomware

Malware Config

Extracted

Family

bumblebee

Botnet

grp666

Attributes

dga
ev2sirbd269o5j.org

ijt0l3i8brit6q.org

ewujsfb1dp5ran.org

8doj8uvx604eck.org

kwywztxoo2xdot.org

2rxyt9urhq0bgj.org

ky1d1p1daahe5t.org

ovh1kn1tcqw5kp.org

6cimu4mc085em8.org

5ka8rxp6t6eup2.org

ks50ioz9nm3v05.org

v5rjsdqogstopr.org

epnl524h4k03mu.org

hpzmehtnkk4q22.org

ygvmhd7ll9v2nu.org

oovlcxvht9kupu.org

1074slp8zafyz3.org

vfwlzltibeg7ne.org

wp67lr8ysypurn.org

1ge03xy5vtwn5s.org

958xz3300iu8oe.org

dlbqduy9gjprko.org

tycl4o5dep10cd.org

ui9bex45gw70az.org

trj1qy559ygvx3.org

w823niq7veztr9.org

01t05hb4armbco.org

igl71zhw25qw3d.org

j8ku0xu0dqduxr.org

jy3y61q6hyhf4c.org

s96phai2s1wzen.org

usguzk6xqox3ss.org

vfo2q74c1y0x74.org

tig85m8n7xixaz.org

0jfv3ru6slys8b.org

mh4bjdyhen3d9z.org

v3hm711ignzez6.org

xuixp4uro6pl3z.org

haq82ih59xa38b.org

zs2u14kk7bqbn2.org

zrym1d73kdmimj.org

r2r3qzjb3bp1ar.org

z3vni7gw9q1i8p.org

nlvskzui15vxju.org

13ov5ypehzqx5l.org

2x51hwe9cnidu4.org

gydu03jt8n5e41.org

gd2i9y77jhbjqb.org

9g055w2ak8hd6t.org

x5x2vq5joobqxe.org

acl1omagtzq38v.org

18xsm4245vgytb.org

q008rx2d58h76q.org

cybf5coa1t2xr2.org

tx6jny2iaea186.org

3pvk0zw1k7g28h.org

nrd1qnd4l7tcp9.org

bvt69kywl2s8rg.org

0youdp14i4r4h5.org

r4aadwqq9d2h24.org

l2q3fkrpgyxr8r.org

s6mngnfnj9nrfj.org

2yr46kghd39ise.org

fo1463oipy7oq8.org

gkukvtxlew982a.org

3h98rycjvt3gj5.org

xgcibmd1rd21us.org

kecah03gobzlrt.org

jpgw5b5zv4vdoy.org

hnxkyiagzxlvv0.org

aelovxoinqta4a.org

ae7a1pbhn5ytpe.org

fbixeudnf6vbhh.org

cjlv1576zqgb47.org

j8plhuz7p6052k.org

pk743hnddx0nds.org

3pu8prnkr8v31d.org

2gdaqm18d6p9d8.org

avm2dir92zqv9x.org

54jmh8bnrpha7y.org

y9e05pr4v7lhp9.org

o44e59aio5jk9q.org

u0tkv94vt86y23.org

q2myvg0j1nna57.org

x5b6lm11d90dht.org

invutsz52frzl8.org

t052317kru670j.org

011jn31n05qzpp.org

tqilxwrw5m54pj.org

pkzwaki575nsll.org

z3l0kxd46ulurv.org

z55s2t6ca702es.org

nrej2ipydbg40k.org

15eaytwast9oig.org

560tvzwrobbl2k.org

1v6pqsve9hg3gy.org

7p788ywb3z9fwe.org

vzf1g0it8gpvq7.org

oqu78tlfbxcf50.org

th87nd6s31jke7.org
dga_seed
4792266342353752649
domain_length
14
num_dga_domains
300
port
443
tld
.org

rc4.plain

Signatures

Family: BumbleBee
BumbleBee is a loader malware written in C++.
loader bumblebee

Executes dropped EXE 3 IoCs

pid	Process
3788	consent.exe
4176	netsetman_setup_540.exe
3968	netsetman_setup_540.tmp

Loads dropped DLL 1 IoCs

pid	Process
3788	consent.exe

Badlisted process makes network request 4 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
5	4564	msiexec.exe
7	4564	msiexec.exe
13	4564	msiexec.exe
18	4564	msiexec.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe

Drops file in Windows directory 8 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\e5896ad.msi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{DD475EBC-D961-4AF4-BB8A-BE91FA942757}	msiexec.exe
File created	C:\Windows\Installer\e5896ad.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI98A1.tmp	msiexec.exe
File created	C:\Windows\Installer\e5896af.msi	msiexec.exe

Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs

persistence privilege_escalation

Installer Packages

T1546.016

Msiexec

T1218.007

pid	Process
4564	msiexec.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsetman_setup_540.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsetman_setup_540.tmp

Inno Setup is an open-source installation builder for Windows applications. 3 IoCs

Inno Setup installer

installer

resource	yara_rule
behavioral1/files/0x00070000000286f4-34.dat	innosetup
behavioral1/memory/4176-37-0x0000000000400000-0x00000000004D9000-memory.dmp	innosetup
behavioral1/memory/4176-54-0x0000000000400000-0x00000000004D9000-memory.dmp	innosetup

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000d2a16defc80673fc0000000000000000000000000000000000000000000000000000000000000000000000000000000000001071020000000000c01200000000ffffffff000000002701010000883801d2a16def0000000000001071020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d083020000000000c050dc000000ffffffff000000000700010000e84101d2a16def000000000000d08302000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000090d4de0000000000000005000000ffffffff000000000700010000486a6fd2a16def00000000000090d4de000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000090d4e30000000000000005000000ffffffff00000000070001000048ea71d2a16def00000000000090d4e300000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe

Modifies data under HKEY_USERS 10 IoCs

description	ioc	Process
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000	netsetman_setup_540.tmp
Key created	\REGISTRY\USER\.DEFAULT\Software	netsetman_setup_540.tmp
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager	netsetman_setup_540.tmp
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\Owner = 800f0000db6657b5abf7dc01	netsetman_setup_540.tmp
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	netsetman_setup_540.tmp
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\SessionHash = c70b7566e3cf47d6ff0d408055c6ed368c78996a25c308a8339e1650b1c94240	netsetman_setup_540.tmp
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\Sequence = "1"	netsetman_setup_540.tmp

Modifies registry class 20 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CBE574DD169D4FA4BBA8EB19AF497275\InstanceType = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CBE574DD169D4FA4BBA8EB19AF497275	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CBE574DD169D4FA4BBA8EB19AF497275\Language = "1033"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CBE574DD169D4FA4BBA8EB19AF497275\SourceList\PackageName = "tmpsouiavz5.msi"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CBE574DD169D4FA4BBA8EB19AF497275\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CBE574DD169D4FA4BBA8EB19AF497275\ProductName = "NetSetMan"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CBE574DD169D4FA4BBA8EB19AF497275\AuthorizedLUAApp = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CBE574DD169D4FA4BBA8EB19AF497275\SourceList\Net	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CBE574DD169D4FA4BBA8EB19AF497275\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CBE574DD169D4FA4BBA8EB19AF497275\Clients = 3a0000000000	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CBE574DD169D4FA4BBA8EB19AF497275\AdvertiseFlags = "388"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CBE574DD169D4FA4BBA8EB19AF497275\SourceList	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CBE574DD169D4FA4BBA8EB19AF497275\SourceList\Media	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CBE574DD169D4FA4BBA8EB19AF497275\SourceList\Media\1 = ";"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CBE574DD169D4FA4BBA8EB19AF497275\DeploymentFlags = "3"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\CBE574DD169D4FA4BBA8EB19AF497275	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\CBE574DD169D4FA4BBA8EB19AF497275\AppLicense	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CBE574DD169D4FA4BBA8EB19AF497275\PackageCode = "D290D662CCC40D3479A46BF86BDA858D"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CBE574DD169D4FA4BBA8EB19AF497275\Version = "16777216"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CBE574DD169D4FA4BBA8EB19AF497275\Assignment = "1"	msiexec.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4732	msiexec.exe
4732	msiexec.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4564	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4564	msiexec.exe
Token: SeSecurityPrivilege	4732	msiexec.exe
Token: SeCreateTokenPrivilege	4564	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	4564	msiexec.exe
Token: SeLockMemoryPrivilege	4564	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4564	msiexec.exe
Token: SeMachineAccountPrivilege	4564	msiexec.exe
Token: SeTcbPrivilege	4564	msiexec.exe
Token: SeSecurityPrivilege	4564	msiexec.exe
Token: SeTakeOwnershipPrivilege	4564	msiexec.exe
Token: SeLoadDriverPrivilege	4564	msiexec.exe
Token: SeSystemProfilePrivilege	4564	msiexec.exe
Token: SeSystemtimePrivilege	4564	msiexec.exe
Token: SeProfSingleProcessPrivilege	4564	msiexec.exe
Token: SeIncBasePriorityPrivilege	4564	msiexec.exe
Token: SeCreatePagefilePrivilege	4564	msiexec.exe
Token: SeCreatePermanentPrivilege	4564	msiexec.exe
Token: SeBackupPrivilege	4564	msiexec.exe
Token: SeRestorePrivilege	4564	msiexec.exe
Token: SeShutdownPrivilege	4564	msiexec.exe
Token: SeDebugPrivilege	4564	msiexec.exe
Token: SeAuditPrivilege	4564	msiexec.exe
Token: SeSystemEnvironmentPrivilege	4564	msiexec.exe
Token: SeChangeNotifyPrivilege	4564	msiexec.exe
Token: SeRemoteShutdownPrivilege	4564	msiexec.exe
Token: SeUndockPrivilege	4564	msiexec.exe
Token: SeSyncAgentPrivilege	4564	msiexec.exe
Token: SeEnableDelegationPrivilege	4564	msiexec.exe
Token: SeManageVolumePrivilege	4564	msiexec.exe
Token: SeImpersonatePrivilege	4564	msiexec.exe
Token: SeCreateGlobalPrivilege	4564	msiexec.exe
Token: SeBackupPrivilege	5768	vssvc.exe
Token: SeRestorePrivilege	5768	vssvc.exe
Token: SeAuditPrivilege	5768	vssvc.exe
Token: SeBackupPrivilege	4732	msiexec.exe
Token: SeRestorePrivilege	4732	msiexec.exe
Token: SeRestorePrivilege	4732	msiexec.exe
Token: SeTakeOwnershipPrivilege	4732	msiexec.exe
Token: SeRestorePrivilege	4732	msiexec.exe
Token: SeTakeOwnershipPrivilege	4732	msiexec.exe
Token: SeRestorePrivilege	4732	msiexec.exe
Token: SeTakeOwnershipPrivilege	4732	msiexec.exe
Token: SeRestorePrivilege	4732	msiexec.exe
Token: SeTakeOwnershipPrivilege	4732	msiexec.exe
Token: SeRestorePrivilege	4732	msiexec.exe
Token: SeTakeOwnershipPrivilege	4732	msiexec.exe
Token: SeRestorePrivilege	4732	msiexec.exe
Token: SeTakeOwnershipPrivilege	4732	msiexec.exe
Token: SeRestorePrivilege	4732	msiexec.exe
Token: SeTakeOwnershipPrivilege	4732	msiexec.exe
Token: SeRestorePrivilege	4732	msiexec.exe
Token: SeTakeOwnershipPrivilege	4732	msiexec.exe
Token: SeRestorePrivilege	4732	msiexec.exe
Token: SeTakeOwnershipPrivilege	4732	msiexec.exe
Token: SeRestorePrivilege	4732	msiexec.exe
Token: SeTakeOwnershipPrivilege	4732	msiexec.exe
Token: SeRestorePrivilege	4732	msiexec.exe
Token: SeTakeOwnershipPrivilege	4732	msiexec.exe
Token: SeRestorePrivilege	4732	msiexec.exe
Token: SeTakeOwnershipPrivilege	4732	msiexec.exe
Token: SeRestorePrivilege	4732	msiexec.exe
Token: SeTakeOwnershipPrivilege	4732	msiexec.exe
Token: SeRestorePrivilege	4732	msiexec.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
4564	msiexec.exe
4564	msiexec.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 4732 wrote to memory of 3776	4732	msiexec.exe	93
PID 4732 wrote to memory of 3788	4732	msiexec.exe	96
PID 4732 wrote to memory of 4176	4732	msiexec.exe	97
PID 4176 wrote to memory of 3968	4176	netsetman_setup_540.exe	98

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\tmpsouiavz5.msi
1⤵
- Badlisted process makes network request
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4564

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4732
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:3776
- C:\Users\Admin\AppData\Local\Temp\ApplicationInstallationFolder_11\consent.exe
  "C:\Users\Admin\AppData\Local\Temp\ApplicationInstallationFolder_11\consent.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:3788
- C:\Users\Admin\AppData\Local\Temp\ApplicationInstallationFolder_11\netsetman_setup_540.exe
  "C:\Users\Admin\AppData\Local\Temp\ApplicationInstallationFolder_11\netsetman_setup_540.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4176
- - C:\Users\Admin\AppData\Local\Temp\is-CGSUD.tmp\netsetman_setup_540.tmp
    "C:\Users\Admin\AppData\Local\Temp\is-CGSUD.tmp\netsetman_setup_540.tmp" /SL5="$B0044,6576345,833536,C:\Users\Admin\AppData\Local\Temp\ApplicationInstallationFolder_11\netsetman_setup_540.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Modifies data under HKEY_USERS
    PID:3968

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:5768

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Installer Packages

T1546.016

Privilege Escalation

Event Triggered Execution

T1546

Installer Packages

T1546.016

Defense Evasion

System Binary Proxy Execution

T1218

Msiexec

T1218.007

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e5896ae.rbs

Path C:\Config.Msi\e5896ae.rbs
Size 7KB
SHA256 2e370b1d21dfc25cbde37df29e25cb9ff04256d7347e54e3b6fc75e5737bc265
MD5 6ab14b1d21068d067a52601132de1c76
SHA1 5aadb3eb9867f43d3529117a6eeed650c0ee7e42
SHA512 63d1177dcdc611cb013b1682a5de5a1ea3b18312991ae16db2d2c231e94f943cc3b10184e04040421630bcc7d00cbe5fff58c569abc4e98cc58ac9bf5787c526
SSDEEP 96:EmDJ6JEUHYOYA8ZeSeMaUCrUTCsTlqUCrUTCWd/iTlr0A5UhZWXuL6pwCMprBGjb:BFEB8ZeCtrOIbrOd7kZyp3MpS
TLSH
T17DF13541731181D2ED92573ACF0B27563BB3D3DDD6D0270B09CD92A86E5278A5FE22CA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

357F04AD41BCF5FE18FCB69F60C6680F_634DCA8372C47C6A713B6DF9160CB5C8

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\357F04AD41BCF5FE18FCB69F60C6680F_634DCA8372C47C6A713B6DF9160CB5C8
Size 1KB
SHA256 558e3ddb6e702c3a4182e8a98653a98e68c908694a0b763ed5502a3919fd3b58
MD5 9d041e2812d8554ada8fd43b8cce1a14
SHA1 6b5a3141c2e936a912db1ff65c44e4bfb093fa0f
SHA512 bb6f27a4e5f18fc640fef407b756907f0d517bb6c970b69b76fb5bec8dce8851347a214a30f85782ff6c772926ec24967a71cd83213fa352d308834f610b644f
TLSH
T1BA31FA86151E2CC75BDF8F688DC7D0167D25A0D069ACA136263B81B674003D35FBA03E
MD5 SHA1 SHA512 TLSH

Submit Download

9CB4373A4252DE8D2212929836304EC5_1AB74AA2E3A56E1B8AD8D3FEC287554E

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\9CB4373A4252DE8D2212929836304EC5_1AB74AA2E3A56E1B8AD8D3FEC287554E
Size 1KB
SHA256 0e463db8726b9ec19b1770d5790ea4727af39c85b4d951f56b7cb00b639816d9
MD5 b8ba8f85f7c99fad7c22cd60f641a964
SHA1 1ee69e5d2f0de776851c90a3e2cb4fdaf63fa934
SHA512 5c3f06b145fb795f194e08ca7cc23c3f180757575126e756d843c87b2607d6295c8cb69f457658733efbe509283f57f3cd4f88f7855b3f486e68a01e89881720
TLSH
T13F31D8771F6CB5208E128D8426CDFA725970DAE0989A10797218DB176C80BB38B1559B
MD5 SHA1 SHA512 TLSH

Submit Download

357F04AD41BCF5FE18FCB69F60C6680F_634DCA8372C47C6A713B6DF9160CB5C8

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\357F04AD41BCF5FE18FCB69F60C6680F_634DCA8372C47C6A713B6DF9160CB5C8
Size 536B
SHA256 d4ddb15ce74b04045f6b1d4f0b91588509dad6267bcf898acfd76fce6b88cd38
MD5 ac723eafa068b6d9154993feba75ade9
SHA1 c47ce248102b3cb105e3c8175bb6dfe0666a06b1
SHA512 d84af7dfeb7765bc6b1459df3feb78117595c57dd3975fa66ff1a79f4fb2159f285d4d76bd03e1f1ee8e6c526c58f34e32d3ecfe835463c05783541a184a486a
TLSH
T1EDF02E1050BA501EF476DE781AC2E1996C95EA223C354F54199A474DF920F449D1363E
MD5 SHA1 SHA512 TLSH

Submit Download

9CB4373A4252DE8D2212929836304EC5_1AB74AA2E3A56E1B8AD8D3FEC287554E

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\9CB4373A4252DE8D2212929836304EC5_1AB74AA2E3A56E1B8AD8D3FEC287554E
Size 536B
SHA256 02b803c57fa01db69f10ecb6ce8ef0872930be03a86d1a94c56a9e2a6f7821c0
MD5 f4848aac6dea47ea64d819f3ed06de34
SHA1 369494b38115798f86f3813858549a9db2d42a93
SHA512 f5babb5c0e0c04faea73d93ed1072ea624035c0cb2eaf306978fd6cd6ced59567b4da0a31aa7dff49c5667abb93dedeb4088d931945171fc0b856faa5a56d048
TLSH
T146F05C1419F5831EF8B2DABA1DE95516FA15F9027C259BAD029A4B1E3C30B108D3782D
MD5 SHA1 SHA512 TLSH

Submit Download

consent.exe

Path C:\Users\Admin\AppData\Local\Temp\ApplicationInstallationFolder_11\consent.exe
Size 109KB
SHA256 ccad775decb5aec98118b381eeccc6d540928035cfb955abcb4ad3ded390b79b
MD5 0b5511674394666e9d221f8681b2c2e6
SHA1 6e4e720dfc424a12383f0b8194e4477e3bc346dc
SHA512 00d28a00fd3ceaeae42ba6882ffb42aa4cc8b92b07a10f28df8e1931df4b806aebdcfab1976bf8d5ce0b98c64da19d4ee06a6315734fa5f885ecd1f6e1ff16a7
SSDEEP 1536:HT3RGRM9dooAXR1cMfb5/0ivhWZpzNKD4h:HT3Rj9dotXRPjd0ckzNHh
TLSH
T1C6B3F75292100455F3598B7146A6F6E149A0BD3D1BE4E6CFF138BD3A2E322E35A3760F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msimg32.dll

Path C:\Users\Admin\AppData\Local\Temp\ApplicationInstallationFolder_11\msimg32.dll
Size 2.9MB
SHA256 cb3fbd2300fa14e97d3fb6728014b4821c9018e2422776b62d1d87407edcd0d3
MD5 59ae7778868dc46fa8bba89724c172f4
SHA1 05f3b314f79867574acb4b90b92fabba8e4c6a40
SHA512 3295026d7507caeef956e934da92d06361f2cd5dc6e5be69cbee740eb4b4e0707349cb2691731fa976d2ea23bb9a259d393da4e4c38341c0746dd1058b207c0c
SSDEEP 49152:dyuafJS7C90qXh7mFkOABbcRSHN1WAi1JTYmht0ixY9iitG82J/40:YFJh02rBbc48G
TLSH
T19AE57C0A6B3A4B5AD510C4BE927AD223C999BD3CD018F5748DC08B457F96F60927E3EC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

netsetman_setup_540.exe

Path C:\Users\Admin\AppData\Local\Temp\ApplicationInstallationFolder_11\netsetman_setup_540.exe
Size 7.4MB
SHA256 b5bee6671ad69c41351474510a52e55ba065fcfd2b4909719b9e69bc705f71f1
MD5 8b6c32204cedd7568dd8d861b0d3f832
SHA1 189d9d4c5e4c5b2bfdfcc48aa1a9909038e33fab
SHA512 9a67330f1b2d8011afb9f5cc333237ef096ac8cfed0c620f000a49a39562025765d91270c0499f75b71e0d1e2cf5a1624b594c474a6056116dc42cc3f761e84c
SSDEEP 98304:vwREr/QxtMGIrCp4zAnFLXkz+rUmzcpK/Xzed8OSccLy6soPTHdq6cG7QM3cyhJh:Nr/QzgzAnF74+r5376KOapJcMVw6T
TLSH
T112762223B2CBE03EE49D4B331AB3A15454F77A617423BE569BE8847CCF260601D3E656
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

netsetman_setup_540.tmp

Path C:\Users\Admin\AppData\Local\Temp\is-CGSUD.tmp\netsetman_setup_540.tmp
Size 3.0MB
SHA256 0db00e5003898530aa4db13df01637cf39844eb90c4ca2c564b5d92994d63eb4
MD5 e61207fcd140dbb1afd66a1ff895d9e9
SHA1 216d50c442290c313908ef872af7b694a31fcdcf
SHA512 f6f3af7e9d261235071bab0f647454e3c817b971a368b543b9204b2b859a59f8b21fe8569996d17925a4dcc997c285a824345afd9ed86541d3be6cd4ee4a484b
SSDEEP 49152:zdJYVM+9JtzZWnoS2VC23aun8+f5KuGUOY9IGTiOynqf333k/9q:ZJYVM+LtVt3P/KuGUONGTi34333k/Q
TLSH
T104E56C1BF389613ED05B1A352927C1515937BE707A2A8C579BEC3E0C8F361886E3B746
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5896ad.msi

Path C:\Windows\Installer\e5896ad.msi
Size 9.0MB
SHA256 ad415a5fe368e89c4b00337b00baf6ed8b77c83d27d8f9e0628f1217a6082740
MD5 57402c7319524e6ade02484ab479e395
SHA1 0a8da437f530f0346bdd7709d89577f193170e91
SHA512 624cba4c57728f1ab706982ceda7732235307c0394f38bf4a9f7da56261f198ed13c7086c9742104c29b477ae0fb72b3b562bde701d6459b7c210ba95220ee46
SSDEEP 196608:mqqJN3v5jqYqqCGeboXQfLsCw7m6L6Hh4m7jFd:mqqJNYYqqioILEm6eHiO
TLSH
T1E9963346BEAC964DCD51FDBE2F8D72A44840AE86BC0761E52E0C7333653753A12B9CE4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata-2

Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
Size 24.0MB
SHA256 37a0055b91acbbb120d47e0a4707f4c241dd82eaffe29f4d99467a1ef82fc534
MD5 618695da665fcbb377b9719bac92883e
SHA1 eaf6aef5d99f0eac807dfe21a46aeef1167bf1bf
SHA512 be6be2b35436b79969501b7a68eaeb47b2d26d5e93f743e261dc52eab659a2ecdd0b25ba5955fbcf4cfa285cf7f1dc6a2c9059f367604be0fffc2ed100d86bee
SSDEEP 24576:fEpmg3MYdoO/vvTLzBz+Z5mt7cbBObcFPzINVTfh8maDfW9DYWwm2PxIDw:w0
TLSH
T19247A42936F92100E7F79E3CACF06A2349397D57AC19DE8D45411B8E0D21B71E872F6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{1620cad7-18a4-4178-852a-63ceb13e3f92}_OnDiskSnapshotProp

Path \??\Volume{ef6da1d2-0000-0000-0000-d08302000000}\System Volume Information\SPP\OnlineMetadataCache\{1620cad7-18a4-4178-852a-63ceb13e3f92}_OnDiskSnapshotProp
Size 6KB
SHA256 f172894c94646fb4c78e315ae37077ad7aa4f722eabd01c92d8592364ba58171
MD5 e2884ea08498f13ba26bdbf35e151635
SHA1 e50525fc086b85f85b87d693ffbddd30ba12d4ed
SHA512 6f2b7176990a95c234671f3af13eb174960085835d5a7e12014a31e643c9c456149f2527b4ec961d374ae441ab191a0d1fc132cbe4b7dd8b4502c65690f80986
SSDEEP 96:FSmh77vc8DD84LTHzbOHXOHBlBRQ88Sc9XE56tOSVQpuN:zHb++ZVmN
TLSH
T1ABD178085AE54311E2B3AB7228F14557A877B811EF33CB8E0198238E6670A10F935F6F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3788-53-0x0000000002A50000-0x00000000031BC000-memory.dmp

Download

memory/3788-43-0x0000000002A50000-0x00000000031BC000-memory.dmp

Download

memory/3968-73-0x0000000000400000-0x000000000070D000-memory.dmp

Download

memory/3968-82-0x0000000000400000-0x000000000070D000-memory.dmp

Download

memory/3968-91-0x0000000000400000-0x000000000070D000-memory.dmp

Download

memory/3968-58-0x0000000000400000-0x000000000070D000-memory.dmp

Download

memory/3968-61-0x0000000000400000-0x000000000070D000-memory.dmp

Download

memory/3968-64-0x0000000000400000-0x000000000070D000-memory.dmp

Download

memory/3968-70-0x0000000000400000-0x000000000070D000-memory.dmp

Download

memory/3968-88-0x0000000000400000-0x000000000070D000-memory.dmp

Download

memory/3968-76-0x0000000000400000-0x000000000070D000-memory.dmp

Download

memory/3968-79-0x0000000000400000-0x000000000070D000-memory.dmp

Download

memory/3968-55-0x0000000000400000-0x000000000070D000-memory.dmp

Download

memory/3968-85-0x0000000000400000-0x000000000070D000-memory.dmp

Download

memory/4176-37-0x0000000000400000-0x00000000004D9000-memory.dmp

Download

memory/4176-54-0x0000000000400000-0x00000000004D9000-memory.dmp

Download