Analysis
- max time kernel
149s - max time network
148s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
09/06/2026, 01:03
Static task
static1
Behavioral task
behavioral1
Sample
tmpk4_lhtc1.msi
Resource
win10ltsc2021-20260513-en
windows10-ltsc_2021-x64
17 signatures
150 seconds
Behavioral task
behavioral2
Sample
tmpk4_lhtc1.msi
Resource
win10v2004-20260513-en
windows10-2004-x64
17 signatures
150 seconds
Behavioral task
behavioral3
Sample
tmpk4_lhtc1.msi
Resource
win11-20260513-en
windows11-21h2-x64
17 signatures
150 seconds
General
- Target tmpk4_lhtc1.msi
- Size 8.9MB
- Sample260609-bepffaas3s
- SHA256 29e1bc115d78c7e98e6dbc3577d24a75effda6d25f191cf32503f65922e3c281
- MD5 6d40dcda90325d5016fbf617a68de4eb
- SHA1 fec676fe9c1d0e268259765342065693dcc1050b
- SHA512 cbbb305e46a0359af76ecc81c8f1e19ef37c9895aaa4e97c03d8773d45d277850de598264257a5c484524e267eeb667fe5eccb548808abbbb0dfb0e96fd4aded
- SSDEEP 196608:0qqJN3v5jqYqqCGeboXQfLsCw7mfbvadiXW1srx:0qqJNYYqqioILEmfJv
- TLSH T1DA963323BD989F29CD81BBB82B0F632409802C87F81266E66E4D7737653755792FD4E0
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Extracted
Family
-
bumblebee
Botnet
-
grp005
Attributes
-
dga
ev2sirbd269o5j.org
ijt0l3i8brit6q.org
ewujsfb1dp5ran.org
8doj8uvx604eck.org
kwywztxoo2xdot.org
2rxyt9urhq0bgj.org
ky1d1p1daahe5t.org
ovh1kn1tcqw5kp.org
6cimu4mc085em8.org
5ka8rxp6t6eup2.org
ks50ioz9nm3v05.org
v5rjsdqogstopr.org
epnl524h4k03mu.org
hpzmehtnkk4q22.org
ygvmhd7ll9v2nu.org
oovlcxvht9kupu.org
1074slp8zafyz3.org
vfwlzltibeg7ne.org
wp67lr8ysypurn.org
1ge03xy5vtwn5s.org
958xz3300iu8oe.org
dlbqduy9gjprko.org
tycl4o5dep10cd.org
ui9bex45gw70az.org
trj1qy559ygvx3.org
w823niq7veztr9.org
01t05hb4armbco.org
igl71zhw25qw3d.org
j8ku0xu0dqduxr.org
jy3y61q6hyhf4c.org
s96phai2s1wzen.org
usguzk6xqox3ss.org
vfo2q74c1y0x74.org
tig85m8n7xixaz.org
0jfv3ru6slys8b.org
mh4bjdyhen3d9z.org
v3hm711ignzez6.org
xuixp4uro6pl3z.org
haq82ih59xa38b.org
zs2u14kk7bqbn2.org
zrym1d73kdmimj.org
r2r3qzjb3bp1ar.org
z3vni7gw9q1i8p.org
nlvskzui15vxju.org
13ov5ypehzqx5l.org
2x51hwe9cnidu4.org
gydu03jt8n5e41.org
gd2i9y77jhbjqb.org
9g055w2ak8hd6t.org
x5x2vq5joobqxe.org
acl1omagtzq38v.org
18xsm4245vgytb.org
q008rx2d58h76q.org
cybf5coa1t2xr2.org
tx6jny2iaea186.org
3pvk0zw1k7g28h.org
nrd1qnd4l7tcp9.org
bvt69kywl2s8rg.org
0youdp14i4r4h5.org
r4aadwqq9d2h24.org
l2q3fkrpgyxr8r.org
s6mngnfnj9nrfj.org
2yr46kghd39ise.org
fo1463oipy7oq8.org
gkukvtxlew982a.org
3h98rycjvt3gj5.org
xgcibmd1rd21us.org
kecah03gobzlrt.org
jpgw5b5zv4vdoy.org
hnxkyiagzxlvv0.org
aelovxoinqta4a.org
ae7a1pbhn5ytpe.org
fbixeudnf6vbhh.org
cjlv1576zqgb47.org
j8plhuz7p6052k.org
pk743hnddx0nds.org
3pu8prnkr8v31d.org
2gdaqm18d6p9d8.org
avm2dir92zqv9x.org
54jmh8bnrpha7y.org
y9e05pr4v7lhp9.org
o44e59aio5jk9q.org
u0tkv94vt86y23.org
q2myvg0j1nna57.org
x5b6lm11d90dht.org
invutsz52frzl8.org
t052317kru670j.org
011jn31n05qzpp.org
tqilxwrw5m54pj.org
pkzwaki575nsll.org
z3l0kxd46ulurv.org
z55s2t6ca702es.org
nrej2ipydbg40k.org
15eaytwast9oig.org
560tvzwrobbl2k.org
1v6pqsve9hg3gy.org
7p788ywb3z9fwe.org
vzf1g0it8gpvq7.org
oqu78tlfbxcf50.org
th87nd6s31jke7.org
-
dga_seed
4792266342353752649
-
domain_length
14
-
num_dga_domains
300
-
port
443
-
tld
.org
rc4.plain
Signatures
- Executes dropped EXE 3 IoCs
pid Process 1288 consent.exe 1104 netsetman_setup_540.exe 2708 netsetman_setup_540.tmp - Loads dropped DLL 1 IoCs
pid Process 1288 consent.exe - Badlisted process makes network request 3 IoCs
Network request originating from process or tool commonly abused by malware.
flow pid Process 4 4316 msiexec.exe 23 4316 msiexec.exe 27 4316 msiexec.exe - Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\A: msiexec.exe - Drops file in Windows directory 8 IoCs
description ioc Process File created C:\Windows\Installer\e58ad71.msi msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File created C:\Windows\Installer\SourceHash{DD475EBC-D961-4AF4-BB8A-BE91FA942757} msiexec.exe File opened for modification C:\Windows\Installer\MSIAE8B.tmp msiexec.exe File opened for modification C:\Windows\Installer\e58ad71.msi msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\Installer\e58ad73.msi msiexec.exe - Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
pid Process 4316 msiexec.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language netsetman_setup_540.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language netsetman_setup_540.exe - Inno Setup is an open-source installation builder for Windows applications. 3 IoCs
Inno Setup installer
resource yara_rule behavioral2/files/0x00070000000245c2-32.dat innosetup behavioral2/memory/1104-40-0x0000000000400000-0x00000000004D9000-memory.dmp innosetup behavioral2/memory/1104-54-0x0000000000400000-0x00000000004D9000-memory.dmp innosetup - Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000306421734df6c2060000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000306421730000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed35000000ffffffff00000000070001000068090030642173000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff350000000000000005000000ffffffff000000000700010000f8ff1a30642173000000000000f0ff350000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d30642173000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe - Modifies data under HKEY_USERS 10 IoCs
description ioc Process Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\Sequence = "1" netsetman_setup_540.tmp Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000 netsetman_setup_540.tmp Key created \REGISTRY\USER\.DEFAULT\Software netsetman_setup_540.tmp Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager netsetman_setup_540.tmp Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\SessionHash = 80f9d49c274f697ec6690bbc822af906ffdeeafd2f1c75ad8cf2b2c810047ce6 netsetman_setup_540.tmp Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft netsetman_setup_540.tmp Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\Owner = 940a0000eae81cdcabf7dc01 netsetman_setup_540.tmp - Modifies registry class 20 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CBE574DD169D4FA4BBA8EB19AF497275\AdvertiseFlags = "388" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CBE574DD169D4FA4BBA8EB19AF497275\SourceList\Net msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CBE574DD169D4FA4BBA8EB19AF497275\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CBE574DD169D4FA4BBA8EB19AF497275\Version = "16777216" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CBE574DD169D4FA4BBA8EB19AF497275\AuthorizedLUAApp = "0" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CBE574DD169D4FA4BBA8EB19AF497275\SourceList\PackageName = "tmpk4_lhtc1.msi" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CBE574DD169D4FA4BBA8EB19AF497275\SourceList\Media msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CBE574DD169D4FA4BBA8EB19AF497275\Clients = 3a0000000000 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\CBE574DD169D4FA4BBA8EB19AF497275\AppLicense msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CBE574DD169D4FA4BBA8EB19AF497275 msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CBE574DD169D4FA4BBA8EB19AF497275\Assignment = "1" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CBE574DD169D4FA4BBA8EB19AF497275\InstanceType = "0" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CBE574DD169D4FA4BBA8EB19AF497275\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CBE574DD169D4FA4BBA8EB19AF497275\SourceList\Media\1 = ";" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CBE574DD169D4FA4BBA8EB19AF497275\ProductName = "NetSetMan" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CBE574DD169D4FA4BBA8EB19AF497275\PackageCode = "FF0E7F6A6A6AC53419A82AE7EB5EFEC4" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CBE574DD169D4FA4BBA8EB19AF497275\DeploymentFlags = "3" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CBE574DD169D4FA4BBA8EB19AF497275\SourceList msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\CBE574DD169D4FA4BBA8EB19AF497275 msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CBE574DD169D4FA4BBA8EB19AF497275\Language = "1033" msiexec.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2640 msiexec.exe 2640 msiexec.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 4316 msiexec.exe Token: SeIncreaseQuotaPrivilege 4316 msiexec.exe Token: SeSecurityPrivilege 2640 msiexec.exe Token: SeCreateTokenPrivilege 4316 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 4316 msiexec.exe Token: SeLockMemoryPrivilege 4316 msiexec.exe Token: SeIncreaseQuotaPrivilege 4316 msiexec.exe Token: SeMachineAccountPrivilege 4316 msiexec.exe Token: SeTcbPrivilege 4316 msiexec.exe Token: SeSecurityPrivilege 4316 msiexec.exe Token: SeTakeOwnershipPrivilege 4316 msiexec.exe Token: SeLoadDriverPrivilege 4316 msiexec.exe Token: SeSystemProfilePrivilege 4316 msiexec.exe Token: SeSystemtimePrivilege 4316 msiexec.exe Token: SeProfSingleProcessPrivilege 4316 msiexec.exe Token: SeIncBasePriorityPrivilege 4316 msiexec.exe Token: SeCreatePagefilePrivilege 4316 msiexec.exe Token: SeCreatePermanentPrivilege 4316 msiexec.exe Token: SeBackupPrivilege 4316 msiexec.exe Token: SeRestorePrivilege 4316 msiexec.exe Token: SeShutdownPrivilege 4316 msiexec.exe Token: SeDebugPrivilege 4316 msiexec.exe Token: SeAuditPrivilege 4316 msiexec.exe Token: SeSystemEnvironmentPrivilege 4316 msiexec.exe Token: SeChangeNotifyPrivilege 4316 msiexec.exe Token: SeRemoteShutdownPrivilege 4316 msiexec.exe Token: SeUndockPrivilege 4316 msiexec.exe Token: SeSyncAgentPrivilege 4316 msiexec.exe Token: SeEnableDelegationPrivilege 4316 msiexec.exe Token: SeManageVolumePrivilege 4316 msiexec.exe Token: SeImpersonatePrivilege 4316 msiexec.exe Token: SeCreateGlobalPrivilege 4316 msiexec.exe Token: SeBackupPrivilege 4336 vssvc.exe Token: SeRestorePrivilege 4336 vssvc.exe Token: SeAuditPrivilege 4336 vssvc.exe Token: SeBackupPrivilege 2640 msiexec.exe Token: SeRestorePrivilege 2640 msiexec.exe Token: SeRestorePrivilege 2640 msiexec.exe Token: SeTakeOwnershipPrivilege 2640 msiexec.exe Token: SeRestorePrivilege 2640 msiexec.exe Token: SeTakeOwnershipPrivilege 2640 msiexec.exe Token: SeRestorePrivilege 2640 msiexec.exe Token: SeTakeOwnershipPrivilege 2640 msiexec.exe Token: SeRestorePrivilege 2640 msiexec.exe Token: SeTakeOwnershipPrivilege 2640 msiexec.exe Token: SeRestorePrivilege 2640 msiexec.exe Token: SeTakeOwnershipPrivilege 2640 msiexec.exe Token: SeRestorePrivilege 2640 msiexec.exe Token: SeTakeOwnershipPrivilege 2640 msiexec.exe Token: SeRestorePrivilege 2640 msiexec.exe Token: SeTakeOwnershipPrivilege 2640 msiexec.exe Token: SeRestorePrivilege 2640 msiexec.exe Token: SeTakeOwnershipPrivilege 2640 msiexec.exe Token: SeRestorePrivilege 2640 msiexec.exe Token: SeTakeOwnershipPrivilege 2640 msiexec.exe Token: SeRestorePrivilege 2640 msiexec.exe Token: SeTakeOwnershipPrivilege 2640 msiexec.exe Token: SeRestorePrivilege 2640 msiexec.exe Token: SeTakeOwnershipPrivilege 2640 msiexec.exe Token: SeRestorePrivilege 2640 msiexec.exe Token: SeTakeOwnershipPrivilege 2640 msiexec.exe Token: SeRestorePrivilege 2640 msiexec.exe Token: SeTakeOwnershipPrivilege 2640 msiexec.exe Token: SeRestorePrivilege 2640 msiexec.exe - Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 4316 msiexec.exe 4316 msiexec.exe - Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2640 wrote to memory of 4864 2640 msiexec.exe 97 PID 2640 wrote to memory of 1288 2640 msiexec.exe 99 PID 2640 wrote to memory of 1104 2640 msiexec.exe 100 PID 1104 wrote to memory of 2708 1104 netsetman_setup_540.exe 101 - Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\tmpk4_lhtc1.msi1⤵
- Badlisted process makes network request
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4316
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2640 -
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵PID:4864
-
-
C:\Users\Admin\AppData\Local\Temp\ApplicationInstallationFolder_11\consent.exe"C:\Users\Admin\AppData\Local\Temp\ApplicationInstallationFolder_11\consent.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1288
-
-
C:\Users\Admin\AppData\Local\Temp\ApplicationInstallationFolder_11\netsetman_setup_540.exe"C:\Users\Admin\AppData\Local\Temp\ApplicationInstallationFolder_11\netsetman_setup_540.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1104 -
C:\Users\Admin\AppData\Local\Temp\is-O7JDT.tmp\netsetman_setup_540.tmp"C:\Users\Admin\AppData\Local\Temp\is-O7JDT.tmp\netsetman_setup_540.tmp" /SL5="$150176,6576345,833536,C:\Users\Admin\AppData\Local\Temp\ApplicationInstallationFolder_11\netsetman_setup_540.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
PID:2708
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:4336
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Config.Msi\e58ad72.rbs
- Size 7KB
- SHA256 a0a63a71b8dab05e7e7f7b3170ac3c3124bb61b7438b24bec779ba4864434741
- MD5 f51f8050a706f6f8ab791802def19460
- SHA1 049eb42c9c3edd40ebafa3a3bce38cecdde852c9
- SHA512 35a775099d58cc8fa0918e718736d6466be6360f2bc78bc49081dbc2c2dd5e482ed420efe29bd8511393f7577dc0761db7c0bb7c96d2c894ea99a45acc59f3b1
- SSDEEP 96:wm0J6JEUHYOYA8ZeWlMaUCrZTCsTlqUCrZTCWd/iTlr0A5UhZWXuLw1CMplBGjBx:FOEB8ZevtKOIbKOd7kZYIMp4
- TLSH T11CF14341B31181E2ED52573ACB0B17563BB3D3DDD6D0270B09CD92A85E527CA5FE22CA
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\357F04AD41BCF5FE18FCB69F60C6680F_600B4ACE67EC2EA0B24B2E65E16AE631
- Size 1KB
- SHA256 946cd6a6f6ce9282ca1b4698fe910ad918a06a044d1ac01e1bc256e255ac1cd7
- MD5 d8b645dc8ee0fcb55e11d079c82d474f
- SHA1 7ef1422f423ca351431b4de16a4ff08dcd2813c3
- SHA512 bf5f967e9405feb4909c1f8b533f1ff61bdf449c25a5066902ed90aafedaaae1e28abd1d2cb06563b9e2d87ad8add2bd3c2550b2d32e9a6015cdb4b3da9e2bea
- TLSH T144311A6B061C2D9658DECF18ACC591086D7C60E01D7D99111137C37966003D35FBA01D
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\9CB4373A4252DE8D2212929836304EC5_1AB74AA2E3A56E1B8AD8D3FEC287554E
- Size 1KB
- SHA256 0e463db8726b9ec19b1770d5790ea4727af39c85b4d951f56b7cb00b639816d9
- MD5 b8ba8f85f7c99fad7c22cd60f641a964
- SHA1 1ee69e5d2f0de776851c90a3e2cb4fdaf63fa934
- SHA512 5c3f06b145fb795f194e08ca7cc23c3f180757575126e756d843c87b2607d6295c8cb69f457658733efbe509283f57f3cd4f88f7855b3f486e68a01e89881720
- TLSH T13F31D8771F6CB5208E128D8426CDFA725970DAE0989A10797218DB176C80BB38B1559B
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\357F04AD41BCF5FE18FCB69F60C6680F_600B4ACE67EC2EA0B24B2E65E16AE631
- Size 536B
- SHA256 3b9837f5de31162ad1815ee77179e68b796204c3412f1039f0f857ef2d6a7189
- MD5 425819e3adbd16e30e33e4c8344e0035
- SHA1 6e8b7c50aef3cb4c933a7e119ab6b5c3da9c107f
- SHA512 1639f1e7b03e3fbf396d54a73bb62081c5f449dd8252bf19d8271fe2c3d103484b988b9766c936dedb6e2db814b1527da30e84ece9a2f3fd38a0ddd2801aceba
- TLSH T1E2F05C3850FA210FF076DA7817C1E6995CA6FA2728359FE528EA43097C11E407C93E7D
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\9CB4373A4252DE8D2212929836304EC5_1AB74AA2E3A56E1B8AD8D3FEC287554E
- Size 536B
- SHA256 c3075e808d3e304f2f104c6158d899be6b515959d0b77902d811947de8989646
- MD5 6b4f7984f6eef0274dc490a7d90cc700
- SHA1 7279cc48e469ed1f102c32cd724b2538213c40bb
- SHA512 bd34ec2e19addafce5ee05f8b7fdee8a5ec2afd2c494aeee1e47e036944ab395627a86e4fc7d1fda3aa0c3bdd124722f283d51af72e848a64f6ea7bd021dc47a
- TLSH T13BF0DC0419F5431EF8B2CABA0DE9541AEA15F8027C219BEC025A4B0E3C20F008D3382D
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\ApplicationInstallationFolder_11\consent.exe
- Size 109KB
- SHA256 ccad775decb5aec98118b381eeccc6d540928035cfb955abcb4ad3ded390b79b
- MD5 0b5511674394666e9d221f8681b2c2e6
- SHA1 6e4e720dfc424a12383f0b8194e4477e3bc346dc
- SHA512 00d28a00fd3ceaeae42ba6882ffb42aa4cc8b92b07a10f28df8e1931df4b806aebdcfab1976bf8d5ce0b98c64da19d4ee06a6315734fa5f885ecd1f6e1ff16a7
- SSDEEP 1536:HT3RGRM9dooAXR1cMfb5/0ivhWZpzNKD4h:HT3Rj9dotXRPjd0ckzNHh
- TLSH T1C6B3F75292100455F3598B7146A6F6E149A0BD3D1BE4E6CFF138BD3A2E322E35A3760F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\ApplicationInstallationFolder_11\msimg32.dll
- Size 2.8MB
- SHA256 6ba5d96e52734cbb9246bcc3decf127f780d48fa11587a1a44880c1f04404d23
- MD5 bcee0ab10b23f5999bcdb56c0b4a631a
- SHA1 f352cec89a56e23dae20cdd62df4d40bc7f22b5e
- SHA512 243bf6a33e762cefd72f54ed8189d9c2018a7bb557bf067b03d35182c6894e06154bf9c5e6f87e4efc102860aa7d4ae489d00309aa1174efe88aa998e6f8c3d8
- SSDEEP 49152:g7Kvt428oBpDMOLZ3o3ZLZn2SFvtnd0X70GxDCgd/l:FpDzZAznjtnd0X7NxDCU/l
- TLSH T126D58D0A6B3B0B6AD614C4FE967B1263C9997D0CD028B5B48DC04B457F96F60927E3EC
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\ApplicationInstallationFolder_11\netsetman_setup_540.exe
- Size 7.4MB
- SHA256 b5bee6671ad69c41351474510a52e55ba065fcfd2b4909719b9e69bc705f71f1
- MD5 8b6c32204cedd7568dd8d861b0d3f832
- SHA1 189d9d4c5e4c5b2bfdfcc48aa1a9909038e33fab
- SHA512 9a67330f1b2d8011afb9f5cc333237ef096ac8cfed0c620f000a49a39562025765d91270c0499f75b71e0d1e2cf5a1624b594c474a6056116dc42cc3f761e84c
- SSDEEP 98304:vwREr/QxtMGIrCp4zAnFLXkz+rUmzcpK/Xzed8OSccLy6soPTHdq6cG7QM3cyhJh:Nr/QzgzAnF74+r5376KOapJcMVw6T
- TLSH T112762223B2CBE03EE49D4B331AB3A15454F77A617423BE569BE8847CCF260601D3E656
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\is-O7JDT.tmp\netsetman_setup_540.tmp
- Size 3.0MB
- SHA256 0db00e5003898530aa4db13df01637cf39844eb90c4ca2c564b5d92994d63eb4
- MD5 e61207fcd140dbb1afd66a1ff895d9e9
- SHA1 216d50c442290c313908ef872af7b694a31fcdcf
- SHA512 f6f3af7e9d261235071bab0f647454e3c817b971a368b543b9204b2b859a59f8b21fe8569996d17925a4dcc997c285a824345afd9ed86541d3be6cd4ee4a484b
- SSDEEP 49152:zdJYVM+9JtzZWnoS2VC23aun8+f5KuGUOY9IGTiOynqf333k/9q:ZJYVM+LtVt3P/KuGUONGTi34333k/Q
- TLSH T104E56C1BF389613ED05B1A352927C1515937BE707A2A8C579BEC3E0C8F361886E3B746
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\e58ad71.msi
- Size 8.9MB
- SHA256 29e1bc115d78c7e98e6dbc3577d24a75effda6d25f191cf32503f65922e3c281
- MD5 6d40dcda90325d5016fbf617a68de4eb
- SHA1 fec676fe9c1d0e268259765342065693dcc1050b
- SHA512 cbbb305e46a0359af76ecc81c8f1e19ef37c9895aaa4e97c03d8773d45d277850de598264257a5c484524e267eeb667fe5eccb548808abbbb0dfb0e96fd4aded
- SSDEEP 196608:0qqJN3v5jqYqqCGeboXQfLsCw7mfbvadiXW1srx:0qqJNYYqqioILEmfJv
- TLSH T1DA963323BD989F29CD81BBB82B0F632409802C87F81266E66E4D7737653755792FD4E0
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
- Size 24.1MB
- SHA256 4e21220ee8cd4f6245b92fb767e0bcb0afe515f053f5e5f5f025a86d8fe81e7a
- MD5 429c5e59b62daeeb4c8b6a6158c359a7
- SHA1 2b02cea693ba122aceccdf8f82c52a971d3cb88d
- SHA512 ee4586dcb54938f49c4bc344ba6af71c7a1b197d8587d7edede2dd16d03634104fd565abf4d9a2d3794c784ceb876f7f7c93dbd93f1092508da324f0195381cd
- SSDEEP 24576:Zu8m+1zBdoO/vvTLbWzuGWKHiakzLlzi/FW9R8iF7kaiu0qOIPlqr1YRG:b
- TLSH T18747D42832F92210E7F79F3C68F0AA2749397D579C19DE8D45411F4E0921BB1E8B2F5A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\Volume{73216430-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{4704621b-0c7b-4bed-87c1-6336430075a0}_OnDiskSnapshotProp
- Size 6KB
- SHA256 eb36acfa99b8bd9bd732bbf81ca9ec0ac552d60e688c47eb9fcda73cbff24eec
- MD5 becf4be3070dc3143983dd10256e90e7
- SHA1 2f5ab19e64ba71c631fa31c7e0740063aa64457e
- SHA512 a58399f472e7fbcfb9370623bc8a806d4f5c2dd05c7f081b39a251663d239f819e24db3e40487a22467f23b25418ec2989cb220bb71729c4e7236a0158bc252a
- SSDEEP 96:FNjhhdkyvc8DD84LTHzbOHXOHBlBRQ88Sc9XE56tOSVQpuN:zj3SIb++ZVmN
- TLSH T192D189185AF54711E2B3AB3228F18557A877B911EF33CB8E0198238E6670910F976F5F
- MD5 SHA1 SHA512 SSDEEP TLSH