bumblebee | ad415a5fe368e89c4b00337b00baf6ed8b77c83d27d8f9e0628f1217a6082740

Analysis

max time kernel
149s
max time network
151s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
09/06/2026, 01:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
tmpsouiavz5.msi
Size 9.0MB
Sample260609-bdymqaas2s
SHA256 ad415a5fe368e89c4b00337b00baf6ed8b77c83d27d8f9e0628f1217a6082740
MD5 57402c7319524e6ade02484ab479e395
SHA1 0a8da437f530f0346bdd7709d89577f193170e91
SHA512 624cba4c57728f1ab706982ceda7732235307c0394f38bf4a9f7da56261f198ed13c7086c9742104c29b477ae0fb72b3b562bde701d6459b7c210ba95220ee46
SSDEEP 196608:mqqJN3v5jqYqqCGeboXQfLsCw7m6L6Hh4m7jFd:mqqJNYYqqioILEm6eHiO
TLSH
T1E9963346BEAC964DCD51FDBE2F8D72A44840AE86BC0761E52E0C7333653753A12B9CE4
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

grp666 discovery bumblebee installer loader persistence privilege_escalation ransomware

Malware Config

Extracted

Family

bumblebee

Botnet

grp666

Attributes

dga
ev2sirbd269o5j.org

ijt0l3i8brit6q.org

ewujsfb1dp5ran.org

8doj8uvx604eck.org

kwywztxoo2xdot.org

2rxyt9urhq0bgj.org

ky1d1p1daahe5t.org

ovh1kn1tcqw5kp.org

6cimu4mc085em8.org

5ka8rxp6t6eup2.org

ks50ioz9nm3v05.org

v5rjsdqogstopr.org

epnl524h4k03mu.org

hpzmehtnkk4q22.org

ygvmhd7ll9v2nu.org

oovlcxvht9kupu.org

1074slp8zafyz3.org

vfwlzltibeg7ne.org

wp67lr8ysypurn.org

1ge03xy5vtwn5s.org

958xz3300iu8oe.org

dlbqduy9gjprko.org

tycl4o5dep10cd.org

ui9bex45gw70az.org

trj1qy559ygvx3.org

w823niq7veztr9.org

01t05hb4armbco.org

igl71zhw25qw3d.org

j8ku0xu0dqduxr.org

jy3y61q6hyhf4c.org

s96phai2s1wzen.org

usguzk6xqox3ss.org

vfo2q74c1y0x74.org

tig85m8n7xixaz.org

0jfv3ru6slys8b.org

mh4bjdyhen3d9z.org

v3hm711ignzez6.org

xuixp4uro6pl3z.org

haq82ih59xa38b.org

zs2u14kk7bqbn2.org

zrym1d73kdmimj.org

r2r3qzjb3bp1ar.org

z3vni7gw9q1i8p.org

nlvskzui15vxju.org

13ov5ypehzqx5l.org

2x51hwe9cnidu4.org

gydu03jt8n5e41.org

gd2i9y77jhbjqb.org

9g055w2ak8hd6t.org

x5x2vq5joobqxe.org

acl1omagtzq38v.org

18xsm4245vgytb.org

q008rx2d58h76q.org

cybf5coa1t2xr2.org

tx6jny2iaea186.org

3pvk0zw1k7g28h.org

nrd1qnd4l7tcp9.org

bvt69kywl2s8rg.org

0youdp14i4r4h5.org

r4aadwqq9d2h24.org

l2q3fkrpgyxr8r.org

s6mngnfnj9nrfj.org

2yr46kghd39ise.org

fo1463oipy7oq8.org

gkukvtxlew982a.org

3h98rycjvt3gj5.org

xgcibmd1rd21us.org

kecah03gobzlrt.org

jpgw5b5zv4vdoy.org

hnxkyiagzxlvv0.org

aelovxoinqta4a.org

ae7a1pbhn5ytpe.org

fbixeudnf6vbhh.org

cjlv1576zqgb47.org

j8plhuz7p6052k.org

pk743hnddx0nds.org

3pu8prnkr8v31d.org

2gdaqm18d6p9d8.org

avm2dir92zqv9x.org

54jmh8bnrpha7y.org

y9e05pr4v7lhp9.org

o44e59aio5jk9q.org

u0tkv94vt86y23.org

q2myvg0j1nna57.org

x5b6lm11d90dht.org

invutsz52frzl8.org

t052317kru670j.org

011jn31n05qzpp.org

tqilxwrw5m54pj.org

pkzwaki575nsll.org

z3l0kxd46ulurv.org

z55s2t6ca702es.org

nrej2ipydbg40k.org

15eaytwast9oig.org

560tvzwrobbl2k.org

1v6pqsve9hg3gy.org

7p788ywb3z9fwe.org

vzf1g0it8gpvq7.org

oqu78tlfbxcf50.org

th87nd6s31jke7.org
dga_seed
4792266342353752649
domain_length
14
num_dga_domains
300
port
443
tld
.org

rc4.plain

Signatures

Family: BumbleBee
BumbleBee is a loader malware written in C++.
loader bumblebee

Executes dropped EXE 3 IoCs

pid	Process
1240	consent.exe
4104	netsetman_setup_540.exe
236	netsetman_setup_540.tmp

Loads dropped DLL 1 IoCs

pid	Process
1240	consent.exe

Badlisted process makes network request 7 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
2	2784	msiexec.exe
3	2784	msiexec.exe
4	2784	msiexec.exe
5	2784	msiexec.exe
6	2784	msiexec.exe
7	3612	msiexec.exe
10	3612	msiexec.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe

Drops file in Windows directory 12 IoCs

description	ioc	Process
File created	C:\Windows\Installer\e58f3f0.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e58f3f0.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{DD475EBC-D961-4AF4-BB8A-BE91FA942757}	msiexec.exe
File created	C:\Windows\SystemTemp\~DFFFADD76E4B4AF322.TMP	msiexec.exe
File created	C:\Windows\Installer\e58f3f2.msi	msiexec.exe
File created	C:\Windows\SystemTemp\~DFD899D8A3FDF2BA1F.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\SystemTemp\~DFEB9243CC40B5A507.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI2FD0.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DFEE592605718B8887.TMP	msiexec.exe

Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs

persistence privilege_escalation

Installer Packages

T1546.016

Msiexec

T1218.007

pid	Process
2784	msiexec.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsetman_setup_540.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsetman_setup_540.tmp

Inno Setup is an open-source installation builder for Windows applications. 3 IoCs

Inno Setup installer

installer

resource	yara_rule
behavioral3/files/0x001900000002b4d9-36.dat	innosetup
behavioral3/memory/4104-38-0x0000000000400000-0x00000000004D9000-memory.dmp	innosetup
behavioral3/memory/4104-63-0x0000000000400000-0x00000000004D9000-memory.dmp	innosetup

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 000000000400000027a96ea556b175d40000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff00000000270101000008000027a96ea50000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed35000000ffffffff00000000070001000068090027a96ea5000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff350000000000000005000000ffffffff000000000700010000f8ff1a27a96ea5000000000000f0ff350000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d27a96ea5000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe

Modifies data under HKEY_USERS 10 IoCs

description	ioc	Process
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	netsetman_setup_540.tmp
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager	netsetman_setup_540.tmp
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\Owner = ec000000966f3ebeabf7dc01	netsetman_setup_540.tmp
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\Sequence = "1"	netsetman_setup_540.tmp
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000	netsetman_setup_540.tmp
Key created	\REGISTRY\USER\.DEFAULT\Software	netsetman_setup_540.tmp
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\SessionHash = 77d66213bb57b065544f365315097a07f6b654acaf1bbaafa7ecb23ae3343a2e	netsetman_setup_540.tmp

Modifies registry class 20 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CBE574DD169D4FA4BBA8EB19AF497275\SourceList	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CBE574DD169D4FA4BBA8EB19AF497275\SourceList\Net	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CBE574DD169D4FA4BBA8EB19AF497275\SourceList\Media\1 = ";"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CBE574DD169D4FA4BBA8EB19AF497275\Clients = 3a0000000000	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CBE574DD169D4FA4BBA8EB19AF497275\SourceList\Media	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CBE574DD169D4FA4BBA8EB19AF497275\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\CBE574DD169D4FA4BBA8EB19AF497275	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CBE574DD169D4FA4BBA8EB19AF497275\PackageCode = "D290D662CCC40D3479A46BF86BDA858D"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CBE574DD169D4FA4BBA8EB19AF497275\Language = "1033"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CBE574DD169D4FA4BBA8EB19AF497275\Assignment = "1"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CBE574DD169D4FA4BBA8EB19AF497275\AdvertiseFlags = "388"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CBE574DD169D4FA4BBA8EB19AF497275\AuthorizedLUAApp = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CBE574DD169D4FA4BBA8EB19AF497275\SourceList\PackageName = "tmpsouiavz5.msi"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\CBE574DD169D4FA4BBA8EB19AF497275\AppLicense	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CBE574DD169D4FA4BBA8EB19AF497275\InstanceType = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CBE574DD169D4FA4BBA8EB19AF497275\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CBE574DD169D4FA4BBA8EB19AF497275	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CBE574DD169D4FA4BBA8EB19AF497275\ProductName = "NetSetMan"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CBE574DD169D4FA4BBA8EB19AF497275\Version = "16777216"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CBE574DD169D4FA4BBA8EB19AF497275\DeploymentFlags = "3"	msiexec.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3612	msiexec.exe
3612	msiexec.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2784	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2784	msiexec.exe
Token: SeSecurityPrivilege	3612	msiexec.exe
Token: SeCreateTokenPrivilege	2784	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	2784	msiexec.exe
Token: SeLockMemoryPrivilege	2784	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2784	msiexec.exe
Token: SeMachineAccountPrivilege	2784	msiexec.exe
Token: SeTcbPrivilege	2784	msiexec.exe
Token: SeSecurityPrivilege	2784	msiexec.exe
Token: SeTakeOwnershipPrivilege	2784	msiexec.exe
Token: SeLoadDriverPrivilege	2784	msiexec.exe
Token: SeSystemProfilePrivilege	2784	msiexec.exe
Token: SeSystemtimePrivilege	2784	msiexec.exe
Token: SeProfSingleProcessPrivilege	2784	msiexec.exe
Token: SeIncBasePriorityPrivilege	2784	msiexec.exe
Token: SeCreatePagefilePrivilege	2784	msiexec.exe
Token: SeCreatePermanentPrivilege	2784	msiexec.exe
Token: SeBackupPrivilege	2784	msiexec.exe
Token: SeRestorePrivilege	2784	msiexec.exe
Token: SeShutdownPrivilege	2784	msiexec.exe
Token: SeDebugPrivilege	2784	msiexec.exe
Token: SeAuditPrivilege	2784	msiexec.exe
Token: SeSystemEnvironmentPrivilege	2784	msiexec.exe
Token: SeChangeNotifyPrivilege	2784	msiexec.exe
Token: SeRemoteShutdownPrivilege	2784	msiexec.exe
Token: SeUndockPrivilege	2784	msiexec.exe
Token: SeSyncAgentPrivilege	2784	msiexec.exe
Token: SeEnableDelegationPrivilege	2784	msiexec.exe
Token: SeManageVolumePrivilege	2784	msiexec.exe
Token: SeImpersonatePrivilege	2784	msiexec.exe
Token: SeCreateGlobalPrivilege	2784	msiexec.exe
Token: SeBackupPrivilege	3532	vssvc.exe
Token: SeRestorePrivilege	3532	vssvc.exe
Token: SeAuditPrivilege	3532	vssvc.exe
Token: SeBackupPrivilege	3612	msiexec.exe
Token: SeRestorePrivilege	3612	msiexec.exe
Token: SeRestorePrivilege	3612	msiexec.exe
Token: SeTakeOwnershipPrivilege	3612	msiexec.exe
Token: SeBackupPrivilege	1728	srtasks.exe
Token: SeRestorePrivilege	1728	srtasks.exe
Token: SeSecurityPrivilege	1728	srtasks.exe
Token: SeTakeOwnershipPrivilege	1728	srtasks.exe
Token: SeBackupPrivilege	1728	srtasks.exe
Token: SeRestorePrivilege	1728	srtasks.exe
Token: SeSecurityPrivilege	1728	srtasks.exe
Token: SeTakeOwnershipPrivilege	1728	srtasks.exe
Token: SeRestorePrivilege	3612	msiexec.exe
Token: SeTakeOwnershipPrivilege	3612	msiexec.exe
Token: SeRestorePrivilege	3612	msiexec.exe
Token: SeTakeOwnershipPrivilege	3612	msiexec.exe
Token: SeRestorePrivilege	3612	msiexec.exe
Token: SeTakeOwnershipPrivilege	3612	msiexec.exe
Token: SeRestorePrivilege	3612	msiexec.exe
Token: SeTakeOwnershipPrivilege	3612	msiexec.exe
Token: SeRestorePrivilege	3612	msiexec.exe
Token: SeTakeOwnershipPrivilege	3612	msiexec.exe
Token: SeRestorePrivilege	3612	msiexec.exe
Token: SeTakeOwnershipPrivilege	3612	msiexec.exe
Token: SeRestorePrivilege	3612	msiexec.exe
Token: SeTakeOwnershipPrivilege	3612	msiexec.exe
Token: SeRestorePrivilege	3612	msiexec.exe
Token: SeTakeOwnershipPrivilege	3612	msiexec.exe
Token: SeRestorePrivilege	3612	msiexec.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
2784	msiexec.exe
2784	msiexec.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3612 wrote to memory of 1728	3612	msiexec.exe	84
PID 3612 wrote to memory of 1240	3612	msiexec.exe	86
PID 3612 wrote to memory of 4104	3612	msiexec.exe	87
PID 4104 wrote to memory of 236	4104	netsetman_setup_540.exe	88

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\tmpsouiavz5.msi
1⤵
- Badlisted process makes network request
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2784

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Badlisted process makes network request
- Enumerates connected drives
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3612
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1728
- C:\Users\Admin\AppData\Local\Temp\ApplicationInstallationFolder_11\consent.exe
  "C:\Users\Admin\AppData\Local\Temp\ApplicationInstallationFolder_11\consent.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:1240
- C:\Users\Admin\AppData\Local\Temp\ApplicationInstallationFolder_11\netsetman_setup_540.exe
  "C:\Users\Admin\AppData\Local\Temp\ApplicationInstallationFolder_11\netsetman_setup_540.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4104
- - C:\Users\Admin\AppData\Local\Temp\is-9S1VJ.tmp\netsetman_setup_540.tmp
    "C:\Users\Admin\AppData\Local\Temp\is-9S1VJ.tmp\netsetman_setup_540.tmp" /SL5="$C003C,6576345,833536,C:\Users\Admin\AppData\Local\Temp\ApplicationInstallationFolder_11\netsetman_setup_540.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Modifies data under HKEY_USERS
    PID:236

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:3532

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Installer Packages

T1546.016

Privilege Escalation

Event Triggered Execution

T1546

Installer Packages

T1546.016

Defense Evasion

System Binary Proxy Execution

T1218

Msiexec

T1218.007

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e58f3f1.rbs

Path C:\Config.Msi\e58f3f1.rbs
Size 7KB
SHA256 2c2b7f00ee4832f0122dbab136eec50b597076f2bd384adbd8412a28d8aff9e7
MD5 7937747a6a8eb6d6850f18dfc60a254c
SHA1 41091903b6ebc144294b52887b5a7ee4606a1a82
SHA512 35ed36daf96dcae87af584b0d37fde56879666635583de08bf9ba22292875eebfd4f29f0a4e2b5a85e2979a57b06f83ce0759146414a5ebfcd59469a41fd18d5
SSDEEP 96:FmwJ6JCyHYOYA8oCz5MaUCrUTCsTlqUCrUTCWd/iTlrGA5UhZWXuL6pwCMprBGjb:IqE/8oC6trOIbrOdVkZyp3MpS
TLSH
T186F12241B31181D2ED52573ACB0B27563BB7D3DDD6D0230B09CD92A86E5278A5FE22CA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

357F04AD41BCF5FE18FCB69F60C6680F_634DCA8372C47C6A713B6DF9160CB5C8

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\357F04AD41BCF5FE18FCB69F60C6680F_634DCA8372C47C6A713B6DF9160CB5C8
Size 1KB
SHA256 558e3ddb6e702c3a4182e8a98653a98e68c908694a0b763ed5502a3919fd3b58
MD5 9d041e2812d8554ada8fd43b8cce1a14
SHA1 6b5a3141c2e936a912db1ff65c44e4bfb093fa0f
SHA512 bb6f27a4e5f18fc640fef407b756907f0d517bb6c970b69b76fb5bec8dce8851347a214a30f85782ff6c772926ec24967a71cd83213fa352d308834f610b644f
TLSH
T1BA31FA86151E2CC75BDF8F688DC7D0167D25A0D069ACA136263B81B674003D35FBA03E
MD5 SHA1 SHA512 TLSH

Submit Download

57C8EDB95DF3F0AD4EE2DC2B8CFD4157

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157
Size 4KB
SHA256 0300e9ddb527990e8b59d06e9ccf3ec2bd92d3bbd0ef4fba69d6336e4195e82d
MD5 5f036f91e86e30f749961506951d51eb
SHA1 acb87b59117c6e2db86f98c4c8bac52eade97cd4
SHA512 341f250cf3764207b5328a12b31016c0750daddcd16722b4bcef502bcbef7ef379abb601649ee6c3fdf121f3d3cd6890c8a80e5dae3169fe56ef82af20631944
SSDEEP 96:Dbonzjs6o1BXl7EV4/sClywa3UHimRkISatmQFjm:Dbsns6KXxUrClywawinLatvFjm
TLSH
T100A19E44A75AEB61C331EBB6829B7B51033B6D20178468FAEFDAA1E1695B44C143C3C2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9CB4373A4252DE8D2212929836304EC5_1AB74AA2E3A56E1B8AD8D3FEC287554E

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\9CB4373A4252DE8D2212929836304EC5_1AB74AA2E3A56E1B8AD8D3FEC287554E
Size 1KB
SHA256 0e463db8726b9ec19b1770d5790ea4727af39c85b4d951f56b7cb00b639816d9
MD5 b8ba8f85f7c99fad7c22cd60f641a964
SHA1 1ee69e5d2f0de776851c90a3e2cb4fdaf63fa934
SHA512 5c3f06b145fb795f194e08ca7cc23c3f180757575126e756d843c87b2607d6295c8cb69f457658733efbe509283f57f3cd4f88f7855b3f486e68a01e89881720
TLSH
T13F31D8771F6CB5208E128D8426CDFA725970DAE0989A10797218DB176C80BB38B1559B
MD5 SHA1 SHA512 TLSH

Submit Download

357F04AD41BCF5FE18FCB69F60C6680F_634DCA8372C47C6A713B6DF9160CB5C8

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\357F04AD41BCF5FE18FCB69F60C6680F_634DCA8372C47C6A713B6DF9160CB5C8
Size 536B
SHA256 205db22b2ede7713f7760293f42c3ef9ef77497eddc0359ed5d1621adc2b88d7
MD5 75ef6c6bf5795ac3e681ad086757b780
SHA1 fb70b1856061a5bbcbc32323373b4e5cde897991
SHA512 9255dfe4f9f5f9df8c4c43df3f6b27b006400f4724ba09554d3e5db50aafdd1611ef03d77043a2cdad391a84e1db3e05fc9dd5c7eb0260b69b1b66e03114aa15
TLSH
T1E0F02E1050BA501EF476DE781AC2E1D96C95E9123D754F54195A474DE910F409D1363E
MD5 SHA1 SHA512 TLSH

Submit Download

57C8EDB95DF3F0AD4EE2DC2B8CFD4157

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157
Size 342B
SHA256 86640ee0fc28b01c1c2afe0cd438236bbe966dfab264b5404d0240db40382752
MD5 9535dafb66c6ebcea0711d881a02b665
SHA1 79747f6d5afa64986bd837a3191d4f09d8f3f35d
SHA512 8830f9354b248f2a08c183b62666345d437b82fbe9decbc288ec0efaed0693a81193277b3bc57f7dce34bf6ca35c49c7b9b8aa0c08b496114efe5afd58dba411
TLSH
T1C4E05E112BE80208F5770A3CAC73B549AD77B77B6A51CADD0276008D5D22F62CD3271D
MD5 SHA1 SHA512 TLSH

Submit Download

9CB4373A4252DE8D2212929836304EC5_1AB74AA2E3A56E1B8AD8D3FEC287554E

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\9CB4373A4252DE8D2212929836304EC5_1AB74AA2E3A56E1B8AD8D3FEC287554E
Size 536B
SHA256 8aa1477ca59c108e98258a3b937e1502223ca9ba59e131162e012f7f9e063c25
MD5 d085ff8d5be8b5ac853817178664e5f5
SHA1 96281b438569acf647e47c8cb8d2f250d1d89b40
SHA512 55a92a8c2d55e7d48eb66a1c75e3bbd83f8548c2a100303b949d23a82d37447ab4de01e220837126caaa9d1baed08c5dec4b50e7484bfd9250b616e6e0eb631e
TLSH
T133F05C1419F5431EF8B2DA791DE99556EA25FD037C259BAD025A4B1E3C20B108D3782D
MD5 SHA1 SHA512 TLSH

Submit Download

MSIMG32.dll

Path C:\Users\Admin\AppData\Local\Temp\ApplicationInstallationFolder_11\MSIMG32.dll
Size 2.9MB
SHA256 cb3fbd2300fa14e97d3fb6728014b4821c9018e2422776b62d1d87407edcd0d3
MD5 59ae7778868dc46fa8bba89724c172f4
SHA1 05f3b314f79867574acb4b90b92fabba8e4c6a40
SHA512 3295026d7507caeef956e934da92d06361f2cd5dc6e5be69cbee740eb4b4e0707349cb2691731fa976d2ea23bb9a259d393da4e4c38341c0746dd1058b207c0c
SSDEEP 49152:dyuafJS7C90qXh7mFkOABbcRSHN1WAi1JTYmht0ixY9iitG82J/40:YFJh02rBbc48G
TLSH
T19AE57C0A6B3A4B5AD510C4BE927AD223C999BD3CD018F5748DC08B457F96F60927E3EC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

consent.exe

Path C:\Users\Admin\AppData\Local\Temp\ApplicationInstallationFolder_11\consent.exe
Size 109KB
SHA256 ccad775decb5aec98118b381eeccc6d540928035cfb955abcb4ad3ded390b79b
MD5 0b5511674394666e9d221f8681b2c2e6
SHA1 6e4e720dfc424a12383f0b8194e4477e3bc346dc
SHA512 00d28a00fd3ceaeae42ba6882ffb42aa4cc8b92b07a10f28df8e1931df4b806aebdcfab1976bf8d5ce0b98c64da19d4ee06a6315734fa5f885ecd1f6e1ff16a7
SSDEEP 1536:HT3RGRM9dooAXR1cMfb5/0ivhWZpzNKD4h:HT3Rj9dotXRPjd0ckzNHh
TLSH
T1C6B3F75292100455F3598B7146A6F6E149A0BD3D1BE4E6CFF138BD3A2E322E35A3760F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

netsetman_setup_540.exe

Path C:\Users\Admin\AppData\Local\Temp\ApplicationInstallationFolder_11\netsetman_setup_540.exe
Size 7.4MB
SHA256 b5bee6671ad69c41351474510a52e55ba065fcfd2b4909719b9e69bc705f71f1
MD5 8b6c32204cedd7568dd8d861b0d3f832
SHA1 189d9d4c5e4c5b2bfdfcc48aa1a9909038e33fab
SHA512 9a67330f1b2d8011afb9f5cc333237ef096ac8cfed0c620f000a49a39562025765d91270c0499f75b71e0d1e2cf5a1624b594c474a6056116dc42cc3f761e84c
SSDEEP 98304:vwREr/QxtMGIrCp4zAnFLXkz+rUmzcpK/Xzed8OSccLy6soPTHdq6cG7QM3cyhJh:Nr/QzgzAnF74+r5376KOapJcMVw6T
TLSH
T112762223B2CBE03EE49D4B331AB3A15454F77A617423BE569BE8847CCF260601D3E656
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

netsetman_setup_540.tmp

Path C:\Users\Admin\AppData\Local\Temp\is-9S1VJ.tmp\netsetman_setup_540.tmp
Size 3.0MB
SHA256 0db00e5003898530aa4db13df01637cf39844eb90c4ca2c564b5d92994d63eb4
MD5 e61207fcd140dbb1afd66a1ff895d9e9
SHA1 216d50c442290c313908ef872af7b694a31fcdcf
SHA512 f6f3af7e9d261235071bab0f647454e3c817b971a368b543b9204b2b859a59f8b21fe8569996d17925a4dcc997c285a824345afd9ed86541d3be6cd4ee4a484b
SSDEEP 49152:zdJYVM+9JtzZWnoS2VC23aun8+f5KuGUOY9IGTiOynqf333k/9q:ZJYVM+LtVt3P/KuGUONGTi34333k/Q
TLSH
T104E56C1BF389613ED05B1A352927C1515937BE707A2A8C579BEC3E0C8F361886E3B746
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e58f3f0.msi

Path C:\Windows\Installer\e58f3f0.msi
Size 9.0MB
SHA256 ad415a5fe368e89c4b00337b00baf6ed8b77c83d27d8f9e0628f1217a6082740
MD5 57402c7319524e6ade02484ab479e395
SHA1 0a8da437f530f0346bdd7709d89577f193170e91
SHA512 624cba4c57728f1ab706982ceda7732235307c0394f38bf4a9f7da56261f198ed13c7086c9742104c29b477ae0fb72b3b562bde701d6459b7c210ba95220ee46
SSDEEP 196608:mqqJN3v5jqYqqCGeboXQfLsCw7m6L6Hh4m7jFd:mqqJNYYqqioILEm6eHiO
TLSH
T1E9963346BEAC964DCD51FDBE2F8D72A44840AE86BC0761E52E0C7333653753A12B9CE4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata-2

Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
Size 24.6MB
SHA256 01fae35b07c14aaf99663b42f1e171952cb7e8e9e64468ef1b4222129c279df8
MD5 0ba9118246ad780d2f6370dafec37fdc
SHA1 6f2b8fe872fd1f3ed11ffb2d1a0e3d5df1b7bca6
SHA512 8c5d6a66c87506ba4302a3c45eba0ba5636ef05b7902c720b09e5c5fc325295bbe774e217d7a1b057b4fef2da403f4b71d44cc20a0b9eba4f01dd7e95f33ca59
SSDEEP 24576:Z2gmSp1pdoO/vvTL3WcexEH6f653QIY222/t3pksV3aY0g4JoXt77Bm7B:J
TLSH
T1CF47062436F92150E7F39E3CA8F4AA235A397D579C19DE8D05811B8D0921FB0E872F5B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{1275a4f9-9887-417e-b040-2f40fa01408c}_OnDiskSnapshotProp

Path \??\Volume{a56ea927-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{1275a4f9-9887-417e-b040-2f40fa01408c}_OnDiskSnapshotProp
Size 6KB
SHA256 0e4b515eb3a899c08192628c625ef709cdebbf858473a6fe1ada01d68113a70b
MD5 982e0565dca2edb17f08c0b7924f7e5f
SHA1 e97f389403db8b14781582d49f1e079a80c7b3e7
SHA512 691ada875a960b0b9b2d39e4306d0f7fe1a37c0ea4df4b80a60f8d373f3ea7880c17cd7f44330b55de5304a714640e6032f8b42b804d2dfa6b34e5822e541619
SSDEEP 96:FHNyh1Jvc8DD84LTHzbOHXOHBlBRQ88Sc9XE56tOSVQpuN:dkfb++ZVmN
TLSH
T1F0D188085AE54711E2F3AB3229F58557A877B811EF33CB8E0198638E6670910F936F5F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/236-74-0x0000000000400000-0x000000000070D000-memory.dmp

Download

memory/236-86-0x0000000000400000-0x000000000070D000-memory.dmp

Download

memory/236-101-0x0000000000400000-0x000000000070D000-memory.dmp

Download

memory/236-97-0x0000000000400000-0x000000000070D000-memory.dmp

Download

memory/236-93-0x0000000000400000-0x000000000070D000-memory.dmp

Download

memory/236-64-0x0000000000400000-0x000000000070D000-memory.dmp

Download

memory/236-68-0x0000000000400000-0x000000000070D000-memory.dmp

Download

memory/236-90-0x0000000000400000-0x000000000070D000-memory.dmp

Download

memory/236-78-0x0000000000400000-0x000000000070D000-memory.dmp

Download

memory/236-82-0x0000000000400000-0x000000000070D000-memory.dmp

Download

memory/1240-62-0x00000000038D0000-0x000000000407E000-memory.dmp

Download

memory/1240-52-0x00000000038D0000-0x000000000407E000-memory.dmp

Download

memory/3612-57-0x00000246260E0000-0x0000024626BA2000-memory.dmp

Download

memory/4104-38-0x0000000000400000-0x00000000004D9000-memory.dmp

Download

memory/4104-63-0x0000000000400000-0x00000000004D9000-memory.dmp

Download