Analysis
- max time kernel
149s - max time network
152s - platform
windows10-ltsc_2021_x64 - resource
win10ltsc2021-20260513-en - resource tags
arch:x64arch:x86image:win10ltsc2021-20260513-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows - submitted
09/06/2026, 01:03
Static task
static1
Behavioral task
behavioral1
Sample
tmpk4_lhtc1.msi
Resource
win10ltsc2021-20260513-en
windows10-ltsc_2021-x64
17 signatures
150 seconds
Behavioral task
behavioral2
Sample
tmpk4_lhtc1.msi
Resource
win10v2004-20260513-en
windows10-2004-x64
17 signatures
150 seconds
Behavioral task
behavioral3
Sample
tmpk4_lhtc1.msi
Resource
win11-20260513-en
windows11-21h2-x64
17 signatures
150 seconds
General
- Target tmpk4_lhtc1.msi
- Size 8.9MB
- Sample260609-bepffaas3s
- SHA256 29e1bc115d78c7e98e6dbc3577d24a75effda6d25f191cf32503f65922e3c281
- MD5 6d40dcda90325d5016fbf617a68de4eb
- SHA1 fec676fe9c1d0e268259765342065693dcc1050b
- SHA512 cbbb305e46a0359af76ecc81c8f1e19ef37c9895aaa4e97c03d8773d45d277850de598264257a5c484524e267eeb667fe5eccb548808abbbb0dfb0e96fd4aded
- SSDEEP 196608:0qqJN3v5jqYqqCGeboXQfLsCw7mfbvadiXW1srx:0qqJNYYqqioILEmfJv
- TLSH T1DA963323BD989F29CD81BBB82B0F632409802C87F81266E66E4D7737653755792FD4E0
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Extracted
Family
-
bumblebee
Botnet
-
grp005
Attributes
-
dga
ev2sirbd269o5j.org
ijt0l3i8brit6q.org
ewujsfb1dp5ran.org
8doj8uvx604eck.org
kwywztxoo2xdot.org
2rxyt9urhq0bgj.org
ky1d1p1daahe5t.org
ovh1kn1tcqw5kp.org
6cimu4mc085em8.org
5ka8rxp6t6eup2.org
ks50ioz9nm3v05.org
v5rjsdqogstopr.org
epnl524h4k03mu.org
hpzmehtnkk4q22.org
ygvmhd7ll9v2nu.org
oovlcxvht9kupu.org
1074slp8zafyz3.org
vfwlzltibeg7ne.org
wp67lr8ysypurn.org
1ge03xy5vtwn5s.org
958xz3300iu8oe.org
dlbqduy9gjprko.org
tycl4o5dep10cd.org
ui9bex45gw70az.org
trj1qy559ygvx3.org
w823niq7veztr9.org
01t05hb4armbco.org
igl71zhw25qw3d.org
j8ku0xu0dqduxr.org
jy3y61q6hyhf4c.org
s96phai2s1wzen.org
usguzk6xqox3ss.org
vfo2q74c1y0x74.org
tig85m8n7xixaz.org
0jfv3ru6slys8b.org
mh4bjdyhen3d9z.org
v3hm711ignzez6.org
xuixp4uro6pl3z.org
haq82ih59xa38b.org
zs2u14kk7bqbn2.org
zrym1d73kdmimj.org
r2r3qzjb3bp1ar.org
z3vni7gw9q1i8p.org
nlvskzui15vxju.org
13ov5ypehzqx5l.org
2x51hwe9cnidu4.org
gydu03jt8n5e41.org
gd2i9y77jhbjqb.org
9g055w2ak8hd6t.org
x5x2vq5joobqxe.org
acl1omagtzq38v.org
18xsm4245vgytb.org
q008rx2d58h76q.org
cybf5coa1t2xr2.org
tx6jny2iaea186.org
3pvk0zw1k7g28h.org
nrd1qnd4l7tcp9.org
bvt69kywl2s8rg.org
0youdp14i4r4h5.org
r4aadwqq9d2h24.org
l2q3fkrpgyxr8r.org
s6mngnfnj9nrfj.org
2yr46kghd39ise.org
fo1463oipy7oq8.org
gkukvtxlew982a.org
3h98rycjvt3gj5.org
xgcibmd1rd21us.org
kecah03gobzlrt.org
jpgw5b5zv4vdoy.org
hnxkyiagzxlvv0.org
aelovxoinqta4a.org
ae7a1pbhn5ytpe.org
fbixeudnf6vbhh.org
cjlv1576zqgb47.org
j8plhuz7p6052k.org
pk743hnddx0nds.org
3pu8prnkr8v31d.org
2gdaqm18d6p9d8.org
avm2dir92zqv9x.org
54jmh8bnrpha7y.org
y9e05pr4v7lhp9.org
o44e59aio5jk9q.org
u0tkv94vt86y23.org
q2myvg0j1nna57.org
x5b6lm11d90dht.org
invutsz52frzl8.org
t052317kru670j.org
011jn31n05qzpp.org
tqilxwrw5m54pj.org
pkzwaki575nsll.org
z3l0kxd46ulurv.org
z55s2t6ca702es.org
nrej2ipydbg40k.org
15eaytwast9oig.org
560tvzwrobbl2k.org
1v6pqsve9hg3gy.org
7p788ywb3z9fwe.org
vzf1g0it8gpvq7.org
oqu78tlfbxcf50.org
th87nd6s31jke7.org
-
dga_seed
4792266342353752649
-
domain_length
14
-
num_dga_domains
300
-
port
443
-
tld
.org
rc4.plain
Signatures
- Executes dropped EXE 3 IoCs
pid Process 2800 consent.exe 1796 netsetman_setup_540.exe 1988 netsetman_setup_540.tmp - Loads dropped DLL 1 IoCs
pid Process 2800 consent.exe - Badlisted process makes network request 7 IoCs
Network request originating from process or tool commonly abused by malware.
flow pid Process 7 2092 msiexec.exe 11 2092 msiexec.exe 13 2092 msiexec.exe 16 2092 msiexec.exe 17 2092 msiexec.exe 20 2092 msiexec.exe 34 2092 msiexec.exe - Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\D: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\D: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\P: msiexec.exe - Drops file in Windows directory 8 IoCs
description ioc Process File created C:\Windows\Installer\e58d25e.msi msiexec.exe File opened for modification C:\Windows\Installer\e58d25e.msi msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\Installer\SourceHash{DD475EBC-D961-4AF4-BB8A-BE91FA942757} msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File opened for modification C:\Windows\Installer\MSID424.tmp msiexec.exe File created C:\Windows\Installer\e58d260.msi msiexec.exe - Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
pid Process 2092 msiexec.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language netsetman_setup_540.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language netsetman_setup_540.tmp - Inno Setup is an open-source installation builder for Windows applications. 3 IoCs
Inno Setup installer
resource yara_rule behavioral1/files/0x0007000000028520-47.dat innosetup behavioral1/memory/1796-45-0x0000000000400000-0x00000000004D9000-memory.dmp innosetup behavioral1/memory/1796-64-0x0000000000400000-0x00000000004D9000-memory.dmp innosetup - Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000b8895c73e21e84780000000000000000000000000000000000000000000000000000000000000000000000000000000000001071020000000000c01200000000ffffffff000000002701010000883801b8895c730000000000001071020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d083020000000000c050dc000000ffffffff000000000700010000e84101b8895c73000000000000d08302000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000090d4de0000000000000005000000ffffffff000000000700010000486a6fb8895c7300000000000090d4de000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000090d4e30000000000000005000000ffffffff00000000070001000048ea71b8895c7300000000000090d4e300000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe - Modifies data under HKEY_USERS 10 IoCs
description ioc Process Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\Owner = c407000047771fe6abf7dc01 netsetman_setup_540.tmp Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\SessionHash = 1992baf28e13c6d4f006b0096f246b622569454141abb676cec48625a2fa2d45 netsetman_setup_540.tmp Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\Sequence = "1" netsetman_setup_540.tmp Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28 msiexec.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000 netsetman_setup_540.tmp Key created \REGISTRY\USER\.DEFAULT\Software netsetman_setup_540.tmp Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft netsetman_setup_540.tmp Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager netsetman_setup_540.tmp - Modifies registry class 20 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CBE574DD169D4FA4BBA8EB19AF497275\SourceList\Media msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CBE574DD169D4FA4BBA8EB19AF497275\Language = "1033" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CBE574DD169D4FA4BBA8EB19AF497275\Version = "16777216" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CBE574DD169D4FA4BBA8EB19AF497275\AuthorizedLUAApp = "0" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CBE574DD169D4FA4BBA8EB19AF497275\SourceList\Net msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CBE574DD169D4FA4BBA8EB19AF497275\PackageCode = "FF0E7F6A6A6AC53419A82AE7EB5EFEC4" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CBE574DD169D4FA4BBA8EB19AF497275\Assignment = "1" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CBE574DD169D4FA4BBA8EB19AF497275\SourceList msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\CBE574DD169D4FA4BBA8EB19AF497275 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\CBE574DD169D4FA4BBA8EB19AF497275\AppLicense msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CBE574DD169D4FA4BBA8EB19AF497275 msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CBE574DD169D4FA4BBA8EB19AF497275\AdvertiseFlags = "388" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CBE574DD169D4FA4BBA8EB19AF497275\SourceList\PackageName = "tmpk4_lhtc1.msi" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CBE574DD169D4FA4BBA8EB19AF497275\SourceList\Media\1 = ";" msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CBE574DD169D4FA4BBA8EB19AF497275\Clients = 3a0000000000 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CBE574DD169D4FA4BBA8EB19AF497275\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CBE574DD169D4FA4BBA8EB19AF497275\ProductName = "NetSetMan" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CBE574DD169D4FA4BBA8EB19AF497275\InstanceType = "0" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CBE574DD169D4FA4BBA8EB19AF497275\DeploymentFlags = "3" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CBE574DD169D4FA4BBA8EB19AF497275\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\" msiexec.exe - Suspicious behavior: EnumeratesProcesses 3 IoCs
pid Process 3548 msiexec.exe 3548 msiexec.exe 3548 msiexec.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 2092 msiexec.exe Token: SeIncreaseQuotaPrivilege 2092 msiexec.exe Token: SeSecurityPrivilege 3548 msiexec.exe Token: SeCreateTokenPrivilege 2092 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 2092 msiexec.exe Token: SeLockMemoryPrivilege 2092 msiexec.exe Token: SeIncreaseQuotaPrivilege 2092 msiexec.exe Token: SeMachineAccountPrivilege 2092 msiexec.exe Token: SeTcbPrivilege 2092 msiexec.exe Token: SeSecurityPrivilege 2092 msiexec.exe Token: SeTakeOwnershipPrivilege 2092 msiexec.exe Token: SeLoadDriverPrivilege 2092 msiexec.exe Token: SeSystemProfilePrivilege 2092 msiexec.exe Token: SeSystemtimePrivilege 2092 msiexec.exe Token: SeProfSingleProcessPrivilege 2092 msiexec.exe Token: SeIncBasePriorityPrivilege 2092 msiexec.exe Token: SeCreatePagefilePrivilege 2092 msiexec.exe Token: SeCreatePermanentPrivilege 2092 msiexec.exe Token: SeBackupPrivilege 2092 msiexec.exe Token: SeRestorePrivilege 2092 msiexec.exe Token: SeShutdownPrivilege 2092 msiexec.exe Token: SeDebugPrivilege 2092 msiexec.exe Token: SeAuditPrivilege 2092 msiexec.exe Token: SeSystemEnvironmentPrivilege 2092 msiexec.exe Token: SeChangeNotifyPrivilege 2092 msiexec.exe Token: SeRemoteShutdownPrivilege 2092 msiexec.exe Token: SeUndockPrivilege 2092 msiexec.exe Token: SeSyncAgentPrivilege 2092 msiexec.exe Token: SeEnableDelegationPrivilege 2092 msiexec.exe Token: SeManageVolumePrivilege 2092 msiexec.exe Token: SeImpersonatePrivilege 2092 msiexec.exe Token: SeCreateGlobalPrivilege 2092 msiexec.exe Token: SeBackupPrivilege 3720 vssvc.exe Token: SeRestorePrivilege 3720 vssvc.exe Token: SeAuditPrivilege 3720 vssvc.exe Token: SeBackupPrivilege 3548 msiexec.exe Token: SeRestorePrivilege 3548 msiexec.exe Token: SeRestorePrivilege 3548 msiexec.exe Token: SeTakeOwnershipPrivilege 3548 msiexec.exe Token: SeRestorePrivilege 3548 msiexec.exe Token: SeTakeOwnershipPrivilege 3548 msiexec.exe Token: SeRestorePrivilege 3548 msiexec.exe Token: SeTakeOwnershipPrivilege 3548 msiexec.exe Token: SeRestorePrivilege 3548 msiexec.exe Token: SeTakeOwnershipPrivilege 3548 msiexec.exe Token: SeRestorePrivilege 3548 msiexec.exe Token: SeTakeOwnershipPrivilege 3548 msiexec.exe Token: SeRestorePrivilege 3548 msiexec.exe Token: SeTakeOwnershipPrivilege 3548 msiexec.exe Token: SeRestorePrivilege 3548 msiexec.exe Token: SeTakeOwnershipPrivilege 3548 msiexec.exe Token: SeRestorePrivilege 3548 msiexec.exe Token: SeTakeOwnershipPrivilege 3548 msiexec.exe Token: SeRestorePrivilege 3548 msiexec.exe Token: SeTakeOwnershipPrivilege 3548 msiexec.exe Token: SeRestorePrivilege 3548 msiexec.exe Token: SeTakeOwnershipPrivilege 3548 msiexec.exe Token: SeRestorePrivilege 3548 msiexec.exe Token: SeTakeOwnershipPrivilege 3548 msiexec.exe Token: SeRestorePrivilege 3548 msiexec.exe Token: SeTakeOwnershipPrivilege 3548 msiexec.exe Token: SeRestorePrivilege 3548 msiexec.exe Token: SeTakeOwnershipPrivilege 3548 msiexec.exe Token: SeRestorePrivilege 3548 msiexec.exe - Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 2092 msiexec.exe 2092 msiexec.exe - Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 3548 wrote to memory of 2936 3548 msiexec.exe 96 PID 3548 wrote to memory of 2800 3548 msiexec.exe 98 PID 3548 wrote to memory of 1796 3548 msiexec.exe 99 PID 1796 wrote to memory of 1988 1796 netsetman_setup_540.exe 100 - Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\tmpk4_lhtc1.msi1⤵
- Badlisted process makes network request
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2092
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3548 -
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵PID:2936
-
-
C:\Users\Admin\AppData\Local\Temp\ApplicationInstallationFolder_11\consent.exe"C:\Users\Admin\AppData\Local\Temp\ApplicationInstallationFolder_11\consent.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2800
-
-
C:\Users\Admin\AppData\Local\Temp\ApplicationInstallationFolder_11\netsetman_setup_540.exe"C:\Users\Admin\AppData\Local\Temp\ApplicationInstallationFolder_11\netsetman_setup_540.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1796 -
C:\Users\Admin\AppData\Local\Temp\is-6E3QR.tmp\netsetman_setup_540.tmp"C:\Users\Admin\AppData\Local\Temp\is-6E3QR.tmp\netsetman_setup_540.tmp" /SL5="$801DC,6576345,833536,C:\Users\Admin\AppData\Local\Temp\ApplicationInstallationFolder_11\netsetman_setup_540.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
PID:1988
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:3720
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Config.Msi\e58d25f.rbs
- Size 7KB
- SHA256 5edec60043defbe1e270b715b06077d3d934c192c5dd4e2c4f0453605dc3c0e7
- MD5 5d12375574c348a14001cda3c27c934c
- SHA1 665a37b36b755ca0bfc7227ebc4889e57000d27e
- SHA512 38c52f85cf2d17a71a525060655d70bcc75fac11974eabb42db236bb7c097d11ef359e8e272fd2581f25ca9f8e4fe132712562efe7553aadc9b5de19b1e30b3a
- SSDEEP 96:Bm0J6JEUHYOYA8Ze2yMaUCrZTCsTlqUCrZTCWd/iTlr0A5UhZWXuLw1CMplBGjBx:8OEB8ZeutKOIbKOd7kZYIMp4
- TLSH T177F14441B31181E2ED52573ACF0B17563BB7D3DDD6D0230B09CD92A85E5278A5FE22CA
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\357F04AD41BCF5FE18FCB69F60C6680F_600B4ACE67EC2EA0B24B2E65E16AE631
- Size 1KB
- SHA256 946cd6a6f6ce9282ca1b4698fe910ad918a06a044d1ac01e1bc256e255ac1cd7
- MD5 d8b645dc8ee0fcb55e11d079c82d474f
- SHA1 7ef1422f423ca351431b4de16a4ff08dcd2813c3
- SHA512 bf5f967e9405feb4909c1f8b533f1ff61bdf449c25a5066902ed90aafedaaae1e28abd1d2cb06563b9e2d87ad8add2bd3c2550b2d32e9a6015cdb4b3da9e2bea
- TLSH T144311A6B061C2D9658DECF18ACC591086D7C60E01D7D99111137C37966003D35FBA01D
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\9CB4373A4252DE8D2212929836304EC5_1AB74AA2E3A56E1B8AD8D3FEC287554E
- Size 1KB
- SHA256 0e463db8726b9ec19b1770d5790ea4727af39c85b4d951f56b7cb00b639816d9
- MD5 b8ba8f85f7c99fad7c22cd60f641a964
- SHA1 1ee69e5d2f0de776851c90a3e2cb4fdaf63fa934
- SHA512 5c3f06b145fb795f194e08ca7cc23c3f180757575126e756d843c87b2607d6295c8cb69f457658733efbe509283f57f3cd4f88f7855b3f486e68a01e89881720
- TLSH T13F31D8771F6CB5208E128D8426CDFA725970DAE0989A10797218DB176C80BB38B1559B
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\357F04AD41BCF5FE18FCB69F60C6680F_600B4ACE67EC2EA0B24B2E65E16AE631
- Size 536B
- SHA256 9935e433c66337e705a1803851d9c96f4cdc47ea9873892c8d55dd680ace7eaa
- MD5 70afc862842302ec09b0b856e18e8e09
- SHA1 d9ea1af1001f18f14f461aa369f074597939f49e
- SHA512 a58d9151a8281837aedd14f71cf7dc55cf21a723625feae556f3368fd98bf2dd01501d2650a8bcf274b046947a0577d64ccff58c39b6f550f76d460065658bbb
- TLSH T192F0DC3850FA210FF076DA3807C1E6995CA6FA2328349FE528EA43097C12E406C93E3D
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\9CB4373A4252DE8D2212929836304EC5_1AB74AA2E3A56E1B8AD8D3FEC287554E
- Size 536B
- SHA256 c2368bfe993c6ae89fd04f912f18f1bd20dcc194298e8d13b1b7d636554c3e0e
- MD5 908a94ae784cc17d173973e0a45c5e79
- SHA1 c73b5c934875fb4ff0748aae4ead497bdf1a2c3a
- SHA512 037c9332b8a174538215daa884cc57f1c8748c31ee34fdd0c8cc622ae23ec7e25aada3dde6385d2a09444c732bb6b31b72d6a1db2da55a96f50db5b9b7df494b
- TLSH T133F0DC0409F5831EF8B2CA790DE95416EA16F9027C618BAC025A4B0E3C20F008D3782D
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\ApplicationInstallationFolder_11\consent.exe
- Size 109KB
- SHA256 ccad775decb5aec98118b381eeccc6d540928035cfb955abcb4ad3ded390b79b
- MD5 0b5511674394666e9d221f8681b2c2e6
- SHA1 6e4e720dfc424a12383f0b8194e4477e3bc346dc
- SHA512 00d28a00fd3ceaeae42ba6882ffb42aa4cc8b92b07a10f28df8e1931df4b806aebdcfab1976bf8d5ce0b98c64da19d4ee06a6315734fa5f885ecd1f6e1ff16a7
- SSDEEP 1536:HT3RGRM9dooAXR1cMfb5/0ivhWZpzNKD4h:HT3Rj9dotXRPjd0ckzNHh
- TLSH T1C6B3F75292100455F3598B7146A6F6E149A0BD3D1BE4E6CFF138BD3A2E322E35A3760F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\ApplicationInstallationFolder_11\msimg32.dll
- Size 2.8MB
- SHA256 6ba5d96e52734cbb9246bcc3decf127f780d48fa11587a1a44880c1f04404d23
- MD5 bcee0ab10b23f5999bcdb56c0b4a631a
- SHA1 f352cec89a56e23dae20cdd62df4d40bc7f22b5e
- SHA512 243bf6a33e762cefd72f54ed8189d9c2018a7bb557bf067b03d35182c6894e06154bf9c5e6f87e4efc102860aa7d4ae489d00309aa1174efe88aa998e6f8c3d8
- SSDEEP 49152:g7Kvt428oBpDMOLZ3o3ZLZn2SFvtnd0X70GxDCgd/l:FpDzZAznjtnd0X7NxDCU/l
- TLSH T126D58D0A6B3B0B6AD614C4FE967B1263C9997D0CD028B5B48DC04B457F96F60927E3EC
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\ApplicationInstallationFolder_11\netsetman_setup_540.exe
- Size 7.4MB
- SHA256 b5bee6671ad69c41351474510a52e55ba065fcfd2b4909719b9e69bc705f71f1
- MD5 8b6c32204cedd7568dd8d861b0d3f832
- SHA1 189d9d4c5e4c5b2bfdfcc48aa1a9909038e33fab
- SHA512 9a67330f1b2d8011afb9f5cc333237ef096ac8cfed0c620f000a49a39562025765d91270c0499f75b71e0d1e2cf5a1624b594c474a6056116dc42cc3f761e84c
- SSDEEP 98304:vwREr/QxtMGIrCp4zAnFLXkz+rUmzcpK/Xzed8OSccLy6soPTHdq6cG7QM3cyhJh:Nr/QzgzAnF74+r5376KOapJcMVw6T
- TLSH T112762223B2CBE03EE49D4B331AB3A15454F77A617423BE569BE8847CCF260601D3E656
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\is-6E3QR.tmp\netsetman_setup_540.tmp
- Size 3.0MB
- SHA256 0db00e5003898530aa4db13df01637cf39844eb90c4ca2c564b5d92994d63eb4
- MD5 e61207fcd140dbb1afd66a1ff895d9e9
- SHA1 216d50c442290c313908ef872af7b694a31fcdcf
- SHA512 f6f3af7e9d261235071bab0f647454e3c817b971a368b543b9204b2b859a59f8b21fe8569996d17925a4dcc997c285a824345afd9ed86541d3be6cd4ee4a484b
- SSDEEP 49152:zdJYVM+9JtzZWnoS2VC23aun8+f5KuGUOY9IGTiOynqf333k/9q:ZJYVM+LtVt3P/KuGUONGTi34333k/Q
- TLSH T104E56C1BF389613ED05B1A352927C1515937BE707A2A8C579BEC3E0C8F361886E3B746
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\e58d25e.msi
- Size 8.9MB
- SHA256 29e1bc115d78c7e98e6dbc3577d24a75effda6d25f191cf32503f65922e3c281
- MD5 6d40dcda90325d5016fbf617a68de4eb
- SHA1 fec676fe9c1d0e268259765342065693dcc1050b
- SHA512 cbbb305e46a0359af76ecc81c8f1e19ef37c9895aaa4e97c03d8773d45d277850de598264257a5c484524e267eeb667fe5eccb548808abbbb0dfb0e96fd4aded
- SSDEEP 196608:0qqJN3v5jqYqqCGeboXQfLsCw7mfbvadiXW1srx:0qqJNYYqqioILEmfJv
- TLSH T1DA963323BD989F29CD81BBB82B0F632409802C87F81266E66E4D7737653755792FD4E0
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
- Size 24.0MB
- SHA256 f6177228a6a66f8e0ecbcbb121a2571c01ffe75e5baddd30b0f07129849fb86b
- MD5 90e5dba6c8c9fa17e646c21dabfc0e9f
- SHA1 c10ad3ae488028bc8729501671396954b6536ebb
- SHA512 7ec88246253fbaf3e3f9342867759e58d235d52ff190c97e05fb8211afe9bb1a5e087fae3e4e8f40a203ed0aaf9edb063fd714d66b77e3873601371425b65863
- SSDEEP 24576:mEpmg3MxdoO/vvTLzvN+XpmT187hAlCbRN4tLjxfc46DRmjdIoe2ohhGDa:Uc
- TLSH T16D47D12436FD2210E7F39E3CA8F16A23493A7D5B9C15DE8D45411B4E0862F71E872F6A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\Volume{735c89b8-0000-0000-0000-d08302000000}\System Volume Information\SPP\OnlineMetadataCache\{ba135ab7-0bfc-4024-b269-bf643a79fef8}_OnDiskSnapshotProp
- Size 6KB
- SHA256 a5b65890a3b52547ff1b0a3f652aa17a65bcd3d3d49ecdb8dc8255a44123a374
- MD5 4b54c65ceccdf7b1a0e1af7b5274a568
- SHA1 f4e7256da4b8cad139c08dbbbdfa8f3c2d690f11
- SHA512 fd08d2f8fd875fc2df24f6a209357db62e256ef2a41f78139516036bbcf4412ad103a9ccffcaaa10ff58eb8402952b83e15e676d8ed39a19b6fa2b675a120f4b
- SSDEEP 96:F7QhMxvc8DD84LTHzbOHXOHBlBRQ88Sc9XE56tOSVQpuN:BQcb++ZVmN
- TLSH T156D1AB085AF54311E2B3AB3168F14557A477B911EF33CB8E0198238E6671910F935F6F
- MD5 SHA1 SHA512 SSDEEP TLSH