Analysis
- max time kernel
149s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
09/06/2026, 01:02
Static task
static1
Behavioral task
behavioral1
Sample
tmpsouiavz5.msi
Resource
win10ltsc2021-20260513-en
windows10-ltsc_2021-x64
17 signatures
150 seconds
Behavioral task
behavioral2
Sample
tmpsouiavz5.msi
Resource
win10v2004-20260513-en
windows10-2004-x64
17 signatures
150 seconds
Behavioral task
behavioral3
Sample
tmpsouiavz5.msi
Resource
win11-20260513-en
windows11-21h2-x64
17 signatures
150 seconds
General
- Target tmpsouiavz5.msi
- Size 9.0MB
- Sample260609-bdymqaas2s
- SHA256 ad415a5fe368e89c4b00337b00baf6ed8b77c83d27d8f9e0628f1217a6082740
- MD5 57402c7319524e6ade02484ab479e395
- SHA1 0a8da437f530f0346bdd7709d89577f193170e91
- SHA512 624cba4c57728f1ab706982ceda7732235307c0394f38bf4a9f7da56261f198ed13c7086c9742104c29b477ae0fb72b3b562bde701d6459b7c210ba95220ee46
- SSDEEP 196608:mqqJN3v5jqYqqCGeboXQfLsCw7m6L6Hh4m7jFd:mqqJNYYqqioILEm6eHiO
- TLSH T1E9963346BEAC964DCD51FDBE2F8D72A44840AE86BC0761E52E0C7333653753A12B9CE4
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Extracted
Family
-
bumblebee
Botnet
-
grp666
Attributes
-
dga
ev2sirbd269o5j.org
ijt0l3i8brit6q.org
ewujsfb1dp5ran.org
8doj8uvx604eck.org
kwywztxoo2xdot.org
2rxyt9urhq0bgj.org
ky1d1p1daahe5t.org
ovh1kn1tcqw5kp.org
6cimu4mc085em8.org
5ka8rxp6t6eup2.org
ks50ioz9nm3v05.org
v5rjsdqogstopr.org
epnl524h4k03mu.org
hpzmehtnkk4q22.org
ygvmhd7ll9v2nu.org
oovlcxvht9kupu.org
1074slp8zafyz3.org
vfwlzltibeg7ne.org
wp67lr8ysypurn.org
1ge03xy5vtwn5s.org
958xz3300iu8oe.org
dlbqduy9gjprko.org
tycl4o5dep10cd.org
ui9bex45gw70az.org
trj1qy559ygvx3.org
w823niq7veztr9.org
01t05hb4armbco.org
igl71zhw25qw3d.org
j8ku0xu0dqduxr.org
jy3y61q6hyhf4c.org
s96phai2s1wzen.org
usguzk6xqox3ss.org
vfo2q74c1y0x74.org
tig85m8n7xixaz.org
0jfv3ru6slys8b.org
mh4bjdyhen3d9z.org
v3hm711ignzez6.org
xuixp4uro6pl3z.org
haq82ih59xa38b.org
zs2u14kk7bqbn2.org
zrym1d73kdmimj.org
r2r3qzjb3bp1ar.org
z3vni7gw9q1i8p.org
nlvskzui15vxju.org
13ov5ypehzqx5l.org
2x51hwe9cnidu4.org
gydu03jt8n5e41.org
gd2i9y77jhbjqb.org
9g055w2ak8hd6t.org
x5x2vq5joobqxe.org
acl1omagtzq38v.org
18xsm4245vgytb.org
q008rx2d58h76q.org
cybf5coa1t2xr2.org
tx6jny2iaea186.org
3pvk0zw1k7g28h.org
nrd1qnd4l7tcp9.org
bvt69kywl2s8rg.org
0youdp14i4r4h5.org
r4aadwqq9d2h24.org
l2q3fkrpgyxr8r.org
s6mngnfnj9nrfj.org
2yr46kghd39ise.org
fo1463oipy7oq8.org
gkukvtxlew982a.org
3h98rycjvt3gj5.org
xgcibmd1rd21us.org
kecah03gobzlrt.org
jpgw5b5zv4vdoy.org
hnxkyiagzxlvv0.org
aelovxoinqta4a.org
ae7a1pbhn5ytpe.org
fbixeudnf6vbhh.org
cjlv1576zqgb47.org
j8plhuz7p6052k.org
pk743hnddx0nds.org
3pu8prnkr8v31d.org
2gdaqm18d6p9d8.org
avm2dir92zqv9x.org
54jmh8bnrpha7y.org
y9e05pr4v7lhp9.org
o44e59aio5jk9q.org
u0tkv94vt86y23.org
q2myvg0j1nna57.org
x5b6lm11d90dht.org
invutsz52frzl8.org
t052317kru670j.org
011jn31n05qzpp.org
tqilxwrw5m54pj.org
pkzwaki575nsll.org
z3l0kxd46ulurv.org
z55s2t6ca702es.org
nrej2ipydbg40k.org
15eaytwast9oig.org
560tvzwrobbl2k.org
1v6pqsve9hg3gy.org
7p788ywb3z9fwe.org
vzf1g0it8gpvq7.org
oqu78tlfbxcf50.org
th87nd6s31jke7.org
-
dga_seed
4792266342353752649
-
domain_length
14
-
num_dga_domains
300
-
port
443
-
tld
.org
rc4.plain
Signatures
- Executes dropped EXE 3 IoCs
pid Process 3832 consent.exe 3276 netsetman_setup_540.exe 3912 netsetman_setup_540.tmp - Loads dropped DLL 1 IoCs
pid Process 3832 consent.exe - Badlisted process makes network request 3 IoCs
Network request originating from process or tool commonly abused by malware.
flow pid Process 4 2264 msiexec.exe 6 2264 msiexec.exe 8 2264 msiexec.exe - Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\I: msiexec.exe - Drops file in Windows directory 8 IoCs
description ioc Process File created C:\Windows\Installer\e58822b.msi msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File created C:\Windows\Installer\SourceHash{DD475EBC-D961-4AF4-BB8A-BE91FA942757} msiexec.exe File opened for modification C:\Windows\Installer\MSI8393.tmp msiexec.exe File created C:\Windows\Installer\e58822d.msi msiexec.exe File opened for modification C:\Windows\Installer\e58822b.msi msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe - Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
pid Process 2264 msiexec.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language netsetman_setup_540.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language netsetman_setup_540.tmp - Inno Setup is an open-source installation builder for Windows applications. 3 IoCs
Inno Setup installer
resource yara_rule behavioral2/files/0x0002000000022ce0-31.dat innosetup behavioral2/memory/3276-37-0x0000000000400000-0x00000000004D9000-memory.dmp innosetup behavioral2/memory/3276-56-0x0000000000400000-0x00000000004D9000-memory.dmp innosetup - Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000ee0681d78f5363a20000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000ee0681d70000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed35000000ffffffff000000000700010000680900ee0681d7000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff350000000000000005000000ffffffff000000000700010000f8ff1aee0681d7000000000000f0ff350000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1dee0681d7000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe - Modifies data under HKEY_USERS 10 IoCs
description ioc Process Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software netsetman_setup_540.tmp Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft netsetman_setup_540.tmp Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\Owner = 480f0000071859aeabf7dc01 netsetman_setup_540.tmp Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\SessionHash = f06a2df95b8ff96edb1c69dae4b3907a218eee88188fd28d296ad17ace5043b8 netsetman_setup_540.tmp Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000 netsetman_setup_540.tmp Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager netsetman_setup_540.tmp Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\Sequence = "1" netsetman_setup_540.tmp Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E msiexec.exe - Modifies registry class 20 IoCs
description ioc Process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CBE574DD169D4FA4BBA8EB19AF497275\Clients = 3a0000000000 msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CBE574DD169D4FA4BBA8EB19AF497275\Language = "1033" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CBE574DD169D4FA4BBA8EB19AF497275\InstanceType = "0" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CBE574DD169D4FA4BBA8EB19AF497275\AuthorizedLUAApp = "0" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CBE574DD169D4FA4BBA8EB19AF497275\SourceList\Net msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CBE574DD169D4FA4BBA8EB19AF497275\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CBE574DD169D4FA4BBA8EB19AF497275\PackageCode = "D290D662CCC40D3479A46BF86BDA858D" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CBE574DD169D4FA4BBA8EB19AF497275\AdvertiseFlags = "388" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CBE574DD169D4FA4BBA8EB19AF497275\SourceList msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CBE574DD169D4FA4BBA8EB19AF497275\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\CBE574DD169D4FA4BBA8EB19AF497275 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CBE574DD169D4FA4BBA8EB19AF497275\ProductName = "NetSetMan" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CBE574DD169D4FA4BBA8EB19AF497275\Assignment = "1" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CBE574DD169D4FA4BBA8EB19AF497275\SourceList\PackageName = "tmpsouiavz5.msi" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CBE574DD169D4FA4BBA8EB19AF497275\SourceList\Media msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CBE574DD169D4FA4BBA8EB19AF497275\SourceList\Media\1 = ";" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\CBE574DD169D4FA4BBA8EB19AF497275\AppLicense msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CBE574DD169D4FA4BBA8EB19AF497275 msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CBE574DD169D4FA4BBA8EB19AF497275\Version = "16777216" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CBE574DD169D4FA4BBA8EB19AF497275\DeploymentFlags = "3" msiexec.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1832 msiexec.exe 1832 msiexec.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 2264 msiexec.exe Token: SeIncreaseQuotaPrivilege 2264 msiexec.exe Token: SeSecurityPrivilege 1832 msiexec.exe Token: SeCreateTokenPrivilege 2264 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 2264 msiexec.exe Token: SeLockMemoryPrivilege 2264 msiexec.exe Token: SeIncreaseQuotaPrivilege 2264 msiexec.exe Token: SeMachineAccountPrivilege 2264 msiexec.exe Token: SeTcbPrivilege 2264 msiexec.exe Token: SeSecurityPrivilege 2264 msiexec.exe Token: SeTakeOwnershipPrivilege 2264 msiexec.exe Token: SeLoadDriverPrivilege 2264 msiexec.exe Token: SeSystemProfilePrivilege 2264 msiexec.exe Token: SeSystemtimePrivilege 2264 msiexec.exe Token: SeProfSingleProcessPrivilege 2264 msiexec.exe Token: SeIncBasePriorityPrivilege 2264 msiexec.exe Token: SeCreatePagefilePrivilege 2264 msiexec.exe Token: SeCreatePermanentPrivilege 2264 msiexec.exe Token: SeBackupPrivilege 2264 msiexec.exe Token: SeRestorePrivilege 2264 msiexec.exe Token: SeShutdownPrivilege 2264 msiexec.exe Token: SeDebugPrivilege 2264 msiexec.exe Token: SeAuditPrivilege 2264 msiexec.exe Token: SeSystemEnvironmentPrivilege 2264 msiexec.exe Token: SeChangeNotifyPrivilege 2264 msiexec.exe Token: SeRemoteShutdownPrivilege 2264 msiexec.exe Token: SeUndockPrivilege 2264 msiexec.exe Token: SeSyncAgentPrivilege 2264 msiexec.exe Token: SeEnableDelegationPrivilege 2264 msiexec.exe Token: SeManageVolumePrivilege 2264 msiexec.exe Token: SeImpersonatePrivilege 2264 msiexec.exe Token: SeCreateGlobalPrivilege 2264 msiexec.exe Token: SeBackupPrivilege 4996 vssvc.exe Token: SeRestorePrivilege 4996 vssvc.exe Token: SeAuditPrivilege 4996 vssvc.exe Token: SeBackupPrivilege 1832 msiexec.exe Token: SeRestorePrivilege 1832 msiexec.exe Token: SeRestorePrivilege 1832 msiexec.exe Token: SeTakeOwnershipPrivilege 1832 msiexec.exe Token: SeRestorePrivilege 1832 msiexec.exe Token: SeTakeOwnershipPrivilege 1832 msiexec.exe Token: SeRestorePrivilege 1832 msiexec.exe Token: SeTakeOwnershipPrivilege 1832 msiexec.exe Token: SeRestorePrivilege 1832 msiexec.exe Token: SeTakeOwnershipPrivilege 1832 msiexec.exe Token: SeRestorePrivilege 1832 msiexec.exe Token: SeTakeOwnershipPrivilege 1832 msiexec.exe Token: SeRestorePrivilege 1832 msiexec.exe Token: SeTakeOwnershipPrivilege 1832 msiexec.exe Token: SeRestorePrivilege 1832 msiexec.exe Token: SeTakeOwnershipPrivilege 1832 msiexec.exe Token: SeRestorePrivilege 1832 msiexec.exe Token: SeTakeOwnershipPrivilege 1832 msiexec.exe Token: SeRestorePrivilege 1832 msiexec.exe Token: SeTakeOwnershipPrivilege 1832 msiexec.exe Token: SeRestorePrivilege 1832 msiexec.exe Token: SeTakeOwnershipPrivilege 1832 msiexec.exe Token: SeRestorePrivilege 1832 msiexec.exe Token: SeTakeOwnershipPrivilege 1832 msiexec.exe Token: SeRestorePrivilege 1832 msiexec.exe Token: SeTakeOwnershipPrivilege 1832 msiexec.exe Token: SeRestorePrivilege 1832 msiexec.exe Token: SeTakeOwnershipPrivilege 1832 msiexec.exe Token: SeRestorePrivilege 1832 msiexec.exe - Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 2264 msiexec.exe 2264 msiexec.exe - Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1832 wrote to memory of 2712 1832 msiexec.exe 97 PID 1832 wrote to memory of 3832 1832 msiexec.exe 99 PID 1832 wrote to memory of 3276 1832 msiexec.exe 100 PID 3276 wrote to memory of 3912 3276 netsetman_setup_540.exe 101 - Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\tmpsouiavz5.msi1⤵
- Badlisted process makes network request
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2264
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1832 -
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵PID:2712
-
-
C:\Users\Admin\AppData\Local\Temp\ApplicationInstallationFolder_11\consent.exe"C:\Users\Admin\AppData\Local\Temp\ApplicationInstallationFolder_11\consent.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3832
-
-
C:\Users\Admin\AppData\Local\Temp\ApplicationInstallationFolder_11\netsetman_setup_540.exe"C:\Users\Admin\AppData\Local\Temp\ApplicationInstallationFolder_11\netsetman_setup_540.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3276 -
C:\Users\Admin\AppData\Local\Temp\is-E6TVQ.tmp\netsetman_setup_540.tmp"C:\Users\Admin\AppData\Local\Temp\is-E6TVQ.tmp\netsetman_setup_540.tmp" /SL5="$40026C,6576345,833536,C:\Users\Admin\AppData\Local\Temp\ApplicationInstallationFolder_11\netsetman_setup_540.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
PID:3912
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:4996
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Config.Msi\e58822c.rbs
- Size 7KB
- SHA256 07ad768c2888915a8b156fed937ede5c069e9fe4416c57f73ed296c09a7e4369
- MD5 9759e4efc544bccba5927568b726ba52
- SHA1 04cb55c00ca2427644c2148afc42c1d924ed97f3
- SHA512 4a55d93aed5dfde4ab1aec2f9a66f585cf2bae6e9c58bf181970c7ae28a71da27ddfb752606f978d9d6f0b9206eb6865a5d41ead91ce0da51b5e90865bbbbbb2
- SSDEEP 96:KmDJ6JEUHYOYA8ZeWeMaUCrUTCsTlqUCrUTCWd/iTlr0A5UhZWXuL6pwCMprBGjb:LFEB8ZeytrOIbrOd7kZyp3MpS
- TLSH T182F14541731181D2ED52473ACF0B27563BB7D3DDD6D0230B09CD92A86E5238A5FE22CA
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\357F04AD41BCF5FE18FCB69F60C6680F_634DCA8372C47C6A713B6DF9160CB5C8
- Size 1KB
- SHA256 558e3ddb6e702c3a4182e8a98653a98e68c908694a0b763ed5502a3919fd3b58
- MD5 9d041e2812d8554ada8fd43b8cce1a14
- SHA1 6b5a3141c2e936a912db1ff65c44e4bfb093fa0f
- SHA512 bb6f27a4e5f18fc640fef407b756907f0d517bb6c970b69b76fb5bec8dce8851347a214a30f85782ff6c772926ec24967a71cd83213fa352d308834f610b644f
- TLSH T1BA31FA86151E2CC75BDF8F688DC7D0167D25A0D069ACA136263B81B674003D35FBA03E
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\9CB4373A4252DE8D2212929836304EC5_1AB74AA2E3A56E1B8AD8D3FEC287554E
- Size 1KB
- SHA256 0e463db8726b9ec19b1770d5790ea4727af39c85b4d951f56b7cb00b639816d9
- MD5 b8ba8f85f7c99fad7c22cd60f641a964
- SHA1 1ee69e5d2f0de776851c90a3e2cb4fdaf63fa934
- SHA512 5c3f06b145fb795f194e08ca7cc23c3f180757575126e756d843c87b2607d6295c8cb69f457658733efbe509283f57f3cd4f88f7855b3f486e68a01e89881720
- TLSH T13F31D8771F6CB5208E128D8426CDFA725970DAE0989A10797218DB176C80BB38B1559B
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\357F04AD41BCF5FE18FCB69F60C6680F_634DCA8372C47C6A713B6DF9160CB5C8
- Size 536B
- SHA256 cf009667d695cb166c3d7c1ecfa52388c784e2b4a4531698f2f622df2f47c8df
- MD5 ee9a6abd2c7e0657e5b75e9390467a5c
- SHA1 1e872330d276e98daa8c5e562120c6a23349a672
- SHA512 12053a1d3b86c2beafe553a8b33483f3f7955a735ef2444aadf03317493e7bcfad2fd6c697250115da956a6a0b70f61c39ad2015feec9c3e0f96c8d80d4bb139
- TLSH T196F02E1050BA501EF476DE781AC2E1D96C95EA133C354F54199A474EE910F409D1363E
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\9CB4373A4252DE8D2212929836304EC5_1AB74AA2E3A56E1B8AD8D3FEC287554E
- Size 536B
- SHA256 834879eb5b28ec49d7142c56172e6f9efd7d17ec001d8dfd8f53ffb0db70f952
- MD5 e8171f5c799a635c5236418641923364
- SHA1 13615e4320a00469c5d2998ea0d363e31fad1cba
- SHA512 9f80da385a7ac90f3d92383a39790a3454d740ff25e23b89c0c3c2ca519e81e41afbe1ed6894639d76b4ad5fcc1d04790c478b9e5477aa9e69c689c3851dd3d1
- TLSH T10AF0DC0419F5431EF8B2CA790DE95516EA15F8027C218FAD025A4B1E3C20B108D3382D
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\ApplicationInstallationFolder_11\MSIMG32.dll
- Size 2.9MB
- SHA256 cb3fbd2300fa14e97d3fb6728014b4821c9018e2422776b62d1d87407edcd0d3
- MD5 59ae7778868dc46fa8bba89724c172f4
- SHA1 05f3b314f79867574acb4b90b92fabba8e4c6a40
- SHA512 3295026d7507caeef956e934da92d06361f2cd5dc6e5be69cbee740eb4b4e0707349cb2691731fa976d2ea23bb9a259d393da4e4c38341c0746dd1058b207c0c
- SSDEEP 49152:dyuafJS7C90qXh7mFkOABbcRSHN1WAi1JTYmht0ixY9iitG82J/40:YFJh02rBbc48G
- TLSH T19AE57C0A6B3A4B5AD510C4BE927AD223C999BD3CD018F5748DC08B457F96F60927E3EC
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\ApplicationInstallationFolder_11\consent.exe
- Size 109KB
- SHA256 ccad775decb5aec98118b381eeccc6d540928035cfb955abcb4ad3ded390b79b
- MD5 0b5511674394666e9d221f8681b2c2e6
- SHA1 6e4e720dfc424a12383f0b8194e4477e3bc346dc
- SHA512 00d28a00fd3ceaeae42ba6882ffb42aa4cc8b92b07a10f28df8e1931df4b806aebdcfab1976bf8d5ce0b98c64da19d4ee06a6315734fa5f885ecd1f6e1ff16a7
- SSDEEP 1536:HT3RGRM9dooAXR1cMfb5/0ivhWZpzNKD4h:HT3Rj9dotXRPjd0ckzNHh
- TLSH T1C6B3F75292100455F3598B7146A6F6E149A0BD3D1BE4E6CFF138BD3A2E322E35A3760F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\ApplicationInstallationFolder_11\netsetman_setup_540.exe
- Size 7.4MB
- SHA256 b5bee6671ad69c41351474510a52e55ba065fcfd2b4909719b9e69bc705f71f1
- MD5 8b6c32204cedd7568dd8d861b0d3f832
- SHA1 189d9d4c5e4c5b2bfdfcc48aa1a9909038e33fab
- SHA512 9a67330f1b2d8011afb9f5cc333237ef096ac8cfed0c620f000a49a39562025765d91270c0499f75b71e0d1e2cf5a1624b594c474a6056116dc42cc3f761e84c
- SSDEEP 98304:vwREr/QxtMGIrCp4zAnFLXkz+rUmzcpK/Xzed8OSccLy6soPTHdq6cG7QM3cyhJh:Nr/QzgzAnF74+r5376KOapJcMVw6T
- TLSH T112762223B2CBE03EE49D4B331AB3A15454F77A617423BE569BE8847CCF260601D3E656
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\is-E6TVQ.tmp\netsetman_setup_540.tmp
- Size 3.0MB
- SHA256 0db00e5003898530aa4db13df01637cf39844eb90c4ca2c564b5d92994d63eb4
- MD5 e61207fcd140dbb1afd66a1ff895d9e9
- SHA1 216d50c442290c313908ef872af7b694a31fcdcf
- SHA512 f6f3af7e9d261235071bab0f647454e3c817b971a368b543b9204b2b859a59f8b21fe8569996d17925a4dcc997c285a824345afd9ed86541d3be6cd4ee4a484b
- SSDEEP 49152:zdJYVM+9JtzZWnoS2VC23aun8+f5KuGUOY9IGTiOynqf333k/9q:ZJYVM+LtVt3P/KuGUONGTi34333k/Q
- TLSH T104E56C1BF389613ED05B1A352927C1515937BE707A2A8C579BEC3E0C8F361886E3B746
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\e58822b.msi
- Size 9.0MB
- SHA256 ad415a5fe368e89c4b00337b00baf6ed8b77c83d27d8f9e0628f1217a6082740
- MD5 57402c7319524e6ade02484ab479e395
- SHA1 0a8da437f530f0346bdd7709d89577f193170e91
- SHA512 624cba4c57728f1ab706982ceda7732235307c0394f38bf4a9f7da56261f198ed13c7086c9742104c29b477ae0fb72b3b562bde701d6459b7c210ba95220ee46
- SSDEEP 196608:mqqJN3v5jqYqqCGeboXQfLsCw7m6L6Hh4m7jFd:mqqJNYYqqioILEm6eHiO
- TLSH T1E9963346BEAC964DCD51FDBE2F8D72A44840AE86BC0761E52E0C7333653753A12B9CE4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
- Size 24.1MB
- SHA256 7977cca4c0da931dcb1fd3c3a0eb84039b8d9f5b15117b8b920d5efcde3b69da
- MD5 e07b37d88570b1c00af3345cda6b5c40
- SHA1 700949d5d3ff6bf4a4feb74831184ffb8fb1cc11
- SHA512 a590d884c5aca5a8769078b336a8b47e576d7c544dbdead08c5d0f8d3d4873929fb3ffd583aa50437158c5385cea240ff2a1b5a5322329ed0ac284664e20426e
- SSDEEP 24576:Nu8m+1z3doO/vvTLbWhuEGalg4kzZ1hSdnGdT+AVpUqwu2YMo/F4ZHaRk:R
- TLSH T1BF47D32437F92200E7F79F3DACF06A23493A7D5B9C159E8D45411B4E0921BB1E872F6A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\Volume{d78106ee-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{1df0a24e-be2f-4ba2-8412-7bac615f1896}_OnDiskSnapshotProp
- Size 6KB
- SHA256 1fefc2e1b2816ececd40646350a2a31659c1750c808322381253180b8663d0f4
- MD5 4add6db3468901a2e9b2dd98b5166032
- SHA1 699b42c2b31350cf90ab3158e78c94e1b02d4f36
- SHA512 7a0dc177d8af837cf32e20953067e61c63e71057ff416bb98bdda241a3b778e8eadb4fe0ad877d2a567ed237739aab8d46bcbda4e68be7751b92836a64f482d4
- SSDEEP 96:F+hV+vc8DD84LTHzbOHXOHBlBRQ88Sc9XE56tOSVQpuN:0Yb++ZVmN
- TLSH T1DDD19B185AE54311E2B3AB7229F14557A877B911EF33CB8E0198238E6670910F836F5F
- MD5 SHA1 SHA512 SSDEEP TLSH