Analysis
- max time kernel
149s - max time network
149s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
09/06/2026, 01:03
Static task
static1
Behavioral task
behavioral1
Sample
tmpk4_lhtc1.msi
Resource
win10ltsc2021-20260513-en
windows10-ltsc_2021-x64
17 signatures
150 seconds
Behavioral task
behavioral2
Sample
tmpk4_lhtc1.msi
Resource
win10v2004-20260513-en
windows10-2004-x64
17 signatures
150 seconds
Behavioral task
behavioral3
Sample
tmpk4_lhtc1.msi
Resource
win11-20260513-en
windows11-21h2-x64
17 signatures
150 seconds
General
- Target tmpk4_lhtc1.msi
- Size 8.9MB
- Sample260609-bepffaas3s
- SHA256 29e1bc115d78c7e98e6dbc3577d24a75effda6d25f191cf32503f65922e3c281
- MD5 6d40dcda90325d5016fbf617a68de4eb
- SHA1 fec676fe9c1d0e268259765342065693dcc1050b
- SHA512 cbbb305e46a0359af76ecc81c8f1e19ef37c9895aaa4e97c03d8773d45d277850de598264257a5c484524e267eeb667fe5eccb548808abbbb0dfb0e96fd4aded
- SSDEEP 196608:0qqJN3v5jqYqqCGeboXQfLsCw7mfbvadiXW1srx:0qqJNYYqqioILEmfJv
- TLSH T1DA963323BD989F29CD81BBB82B0F632409802C87F81266E66E4D7737653755792FD4E0
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Extracted
Family
-
bumblebee
Botnet
-
grp005
Attributes
-
dga
ev2sirbd269o5j.org
ijt0l3i8brit6q.org
ewujsfb1dp5ran.org
8doj8uvx604eck.org
kwywztxoo2xdot.org
2rxyt9urhq0bgj.org
ky1d1p1daahe5t.org
ovh1kn1tcqw5kp.org
6cimu4mc085em8.org
5ka8rxp6t6eup2.org
ks50ioz9nm3v05.org
v5rjsdqogstopr.org
epnl524h4k03mu.org
hpzmehtnkk4q22.org
ygvmhd7ll9v2nu.org
oovlcxvht9kupu.org
1074slp8zafyz3.org
vfwlzltibeg7ne.org
wp67lr8ysypurn.org
1ge03xy5vtwn5s.org
958xz3300iu8oe.org
dlbqduy9gjprko.org
tycl4o5dep10cd.org
ui9bex45gw70az.org
trj1qy559ygvx3.org
w823niq7veztr9.org
01t05hb4armbco.org
igl71zhw25qw3d.org
j8ku0xu0dqduxr.org
jy3y61q6hyhf4c.org
s96phai2s1wzen.org
usguzk6xqox3ss.org
vfo2q74c1y0x74.org
tig85m8n7xixaz.org
0jfv3ru6slys8b.org
mh4bjdyhen3d9z.org
v3hm711ignzez6.org
xuixp4uro6pl3z.org
haq82ih59xa38b.org
zs2u14kk7bqbn2.org
zrym1d73kdmimj.org
r2r3qzjb3bp1ar.org
z3vni7gw9q1i8p.org
nlvskzui15vxju.org
13ov5ypehzqx5l.org
2x51hwe9cnidu4.org
gydu03jt8n5e41.org
gd2i9y77jhbjqb.org
9g055w2ak8hd6t.org
x5x2vq5joobqxe.org
acl1omagtzq38v.org
18xsm4245vgytb.org
q008rx2d58h76q.org
cybf5coa1t2xr2.org
tx6jny2iaea186.org
3pvk0zw1k7g28h.org
nrd1qnd4l7tcp9.org
bvt69kywl2s8rg.org
0youdp14i4r4h5.org
r4aadwqq9d2h24.org
l2q3fkrpgyxr8r.org
s6mngnfnj9nrfj.org
2yr46kghd39ise.org
fo1463oipy7oq8.org
gkukvtxlew982a.org
3h98rycjvt3gj5.org
xgcibmd1rd21us.org
kecah03gobzlrt.org
jpgw5b5zv4vdoy.org
hnxkyiagzxlvv0.org
aelovxoinqta4a.org
ae7a1pbhn5ytpe.org
fbixeudnf6vbhh.org
cjlv1576zqgb47.org
j8plhuz7p6052k.org
pk743hnddx0nds.org
3pu8prnkr8v31d.org
2gdaqm18d6p9d8.org
avm2dir92zqv9x.org
54jmh8bnrpha7y.org
y9e05pr4v7lhp9.org
o44e59aio5jk9q.org
u0tkv94vt86y23.org
q2myvg0j1nna57.org
x5b6lm11d90dht.org
invutsz52frzl8.org
t052317kru670j.org
011jn31n05qzpp.org
tqilxwrw5m54pj.org
pkzwaki575nsll.org
z3l0kxd46ulurv.org
z55s2t6ca702es.org
nrej2ipydbg40k.org
15eaytwast9oig.org
560tvzwrobbl2k.org
1v6pqsve9hg3gy.org
7p788ywb3z9fwe.org
vzf1g0it8gpvq7.org
oqu78tlfbxcf50.org
th87nd6s31jke7.org
-
dga_seed
4792266342353752649
-
domain_length
14
-
num_dga_domains
300
-
port
443
-
tld
.org
rc4.plain
Signatures
- Executes dropped EXE 3 IoCs
pid Process 5964 consent.exe 2280 netsetman_setup_540.exe 4976 netsetman_setup_540.tmp - Loads dropped DLL 1 IoCs
pid Process 5964 consent.exe - Badlisted process makes network request 3 IoCs
Network request originating from process or tool commonly abused by malware.
flow pid Process 2 6044 msiexec.exe 3 6044 msiexec.exe 4 6044 msiexec.exe - Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\E: msiexec.exe - Drops file in Windows directory 12 IoCs
description ioc Process File opened for modification C:\Windows\Installer\e58650e.msi msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File created C:\Windows\SystemTemp\~DF4E777381328C526C.TMP msiexec.exe File opened for modification C:\Windows\Installer\MSI66A4.tmp msiexec.exe File created C:\Windows\SystemTemp\~DFD58C22AE0EA4C30E.TMP msiexec.exe File created C:\Windows\Installer\e58650e.msi msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File created C:\Windows\SystemTemp\~DF403A0703164FB2F9.TMP msiexec.exe File created C:\Windows\Installer\SourceHash{DD475EBC-D961-4AF4-BB8A-BE91FA942757} msiexec.exe File created C:\Windows\Installer\e586510.msi msiexec.exe File created C:\Windows\SystemTemp\~DF159A333A697262CD.TMP msiexec.exe - Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
pid Process 6044 msiexec.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language netsetman_setup_540.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language netsetman_setup_540.exe - Inno Setup is an open-source installation builder for Windows applications. 3 IoCs
Inno Setup installer
resource yara_rule behavioral3/files/0x001700000002b7b9-34.dat innosetup behavioral3/memory/2280-42-0x0000000000400000-0x00000000004D9000-memory.dmp innosetup behavioral3/memory/2280-56-0x0000000000400000-0x00000000004D9000-memory.dmp innosetup - Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000b7671573c6f2ce060000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000b76715730000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed35000000ffffffff000000000700010000680900b7671573000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff350000000000000005000000ffffffff000000000700010000f8ff1ab7671573000000000000f0ff350000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1db7671573000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe - Modifies data under HKEY_USERS 10 IoCs
description ioc Process Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\Owner = 7013000076e6fcdaabf7dc01 netsetman_setup_540.tmp Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\SessionHash = 7277625945b015b6e5771babd03bc7160cb22b09b1db2795a8e85b674b693b6e netsetman_setup_540.tmp Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\Sequence = "1" netsetman_setup_540.tmp Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E msiexec.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000 netsetman_setup_540.tmp Key created \REGISTRY\USER\.DEFAULT\Software netsetman_setup_540.tmp Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft netsetman_setup_540.tmp Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager netsetman_setup_540.tmp - Modifies registry class 20 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\CBE574DD169D4FA4BBA8EB19AF497275\AppLicense msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CBE574DD169D4FA4BBA8EB19AF497275\ProductName = "NetSetMan" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CBE574DD169D4FA4BBA8EB19AF497275\Language = "1033" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CBE574DD169D4FA4BBA8EB19AF497275\AdvertiseFlags = "388" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CBE574DD169D4FA4BBA8EB19AF497275\InstanceType = "0" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CBE574DD169D4FA4BBA8EB19AF497275\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CBE574DD169D4FA4BBA8EB19AF497275\SourceList\Media msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\CBE574DD169D4FA4BBA8EB19AF497275 msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CBE574DD169D4FA4BBA8EB19AF497275\AuthorizedLUAApp = "0" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CBE574DD169D4FA4BBA8EB19AF497275\SourceList\Media\1 = ";" msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CBE574DD169D4FA4BBA8EB19AF497275\Clients = 3a0000000000 msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CBE574DD169D4FA4BBA8EB19AF497275\DeploymentFlags = "3" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CBE574DD169D4FA4BBA8EB19AF497275\SourceList msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CBE574DD169D4FA4BBA8EB19AF497275\SourceList\PackageName = "tmpk4_lhtc1.msi" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CBE574DD169D4FA4BBA8EB19AF497275 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CBE574DD169D4FA4BBA8EB19AF497275\PackageCode = "FF0E7F6A6A6AC53419A82AE7EB5EFEC4" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CBE574DD169D4FA4BBA8EB19AF497275\Version = "16777216" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CBE574DD169D4FA4BBA8EB19AF497275\SourceList\Net msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CBE574DD169D4FA4BBA8EB19AF497275\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CBE574DD169D4FA4BBA8EB19AF497275\Assignment = "1" msiexec.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 980 msiexec.exe 980 msiexec.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 6044 msiexec.exe Token: SeIncreaseQuotaPrivilege 6044 msiexec.exe Token: SeSecurityPrivilege 980 msiexec.exe Token: SeCreateTokenPrivilege 6044 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 6044 msiexec.exe Token: SeLockMemoryPrivilege 6044 msiexec.exe Token: SeIncreaseQuotaPrivilege 6044 msiexec.exe Token: SeMachineAccountPrivilege 6044 msiexec.exe Token: SeTcbPrivilege 6044 msiexec.exe Token: SeSecurityPrivilege 6044 msiexec.exe Token: SeTakeOwnershipPrivilege 6044 msiexec.exe Token: SeLoadDriverPrivilege 6044 msiexec.exe Token: SeSystemProfilePrivilege 6044 msiexec.exe Token: SeSystemtimePrivilege 6044 msiexec.exe Token: SeProfSingleProcessPrivilege 6044 msiexec.exe Token: SeIncBasePriorityPrivilege 6044 msiexec.exe Token: SeCreatePagefilePrivilege 6044 msiexec.exe Token: SeCreatePermanentPrivilege 6044 msiexec.exe Token: SeBackupPrivilege 6044 msiexec.exe Token: SeRestorePrivilege 6044 msiexec.exe Token: SeShutdownPrivilege 6044 msiexec.exe Token: SeDebugPrivilege 6044 msiexec.exe Token: SeAuditPrivilege 6044 msiexec.exe Token: SeSystemEnvironmentPrivilege 6044 msiexec.exe Token: SeChangeNotifyPrivilege 6044 msiexec.exe Token: SeRemoteShutdownPrivilege 6044 msiexec.exe Token: SeUndockPrivilege 6044 msiexec.exe Token: SeSyncAgentPrivilege 6044 msiexec.exe Token: SeEnableDelegationPrivilege 6044 msiexec.exe Token: SeManageVolumePrivilege 6044 msiexec.exe Token: SeImpersonatePrivilege 6044 msiexec.exe Token: SeCreateGlobalPrivilege 6044 msiexec.exe Token: SeBackupPrivilege 4144 vssvc.exe Token: SeRestorePrivilege 4144 vssvc.exe Token: SeAuditPrivilege 4144 vssvc.exe Token: SeBackupPrivilege 980 msiexec.exe Token: SeRestorePrivilege 980 msiexec.exe Token: SeRestorePrivilege 980 msiexec.exe Token: SeTakeOwnershipPrivilege 980 msiexec.exe Token: SeRestorePrivilege 980 msiexec.exe Token: SeTakeOwnershipPrivilege 980 msiexec.exe Token: SeRestorePrivilege 980 msiexec.exe Token: SeTakeOwnershipPrivilege 980 msiexec.exe Token: SeRestorePrivilege 980 msiexec.exe Token: SeTakeOwnershipPrivilege 980 msiexec.exe Token: SeRestorePrivilege 980 msiexec.exe Token: SeTakeOwnershipPrivilege 980 msiexec.exe Token: SeRestorePrivilege 980 msiexec.exe Token: SeTakeOwnershipPrivilege 980 msiexec.exe Token: SeRestorePrivilege 980 msiexec.exe Token: SeTakeOwnershipPrivilege 980 msiexec.exe Token: SeRestorePrivilege 980 msiexec.exe Token: SeTakeOwnershipPrivilege 980 msiexec.exe Token: SeRestorePrivilege 980 msiexec.exe Token: SeTakeOwnershipPrivilege 980 msiexec.exe Token: SeRestorePrivilege 980 msiexec.exe Token: SeTakeOwnershipPrivilege 980 msiexec.exe Token: SeRestorePrivilege 980 msiexec.exe Token: SeTakeOwnershipPrivilege 980 msiexec.exe Token: SeRestorePrivilege 980 msiexec.exe Token: SeTakeOwnershipPrivilege 980 msiexec.exe Token: SeRestorePrivilege 980 msiexec.exe Token: SeTakeOwnershipPrivilege 980 msiexec.exe Token: SeRestorePrivilege 980 msiexec.exe - Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 6044 msiexec.exe 6044 msiexec.exe - Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 980 wrote to memory of 5676 980 msiexec.exe 84 PID 980 wrote to memory of 5964 980 msiexec.exe 86 PID 980 wrote to memory of 2280 980 msiexec.exe 87 PID 2280 wrote to memory of 4976 2280 netsetman_setup_540.exe 88 - Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\tmpk4_lhtc1.msi1⤵
- Badlisted process makes network request
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:6044
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:980 -
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵PID:5676
-
-
C:\Users\Admin\AppData\Local\Temp\ApplicationInstallationFolder_11\consent.exe"C:\Users\Admin\AppData\Local\Temp\ApplicationInstallationFolder_11\consent.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:5964
-
-
C:\Users\Admin\AppData\Local\Temp\ApplicationInstallationFolder_11\netsetman_setup_540.exe"C:\Users\Admin\AppData\Local\Temp\ApplicationInstallationFolder_11\netsetman_setup_540.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2280 -
C:\Users\Admin\AppData\Local\Temp\is-H1AAO.tmp\netsetman_setup_540.tmp"C:\Users\Admin\AppData\Local\Temp\is-H1AAO.tmp\netsetman_setup_540.tmp" /SL5="$E002E,6576345,833536,C:\Users\Admin\AppData\Local\Temp\ApplicationInstallationFolder_11\netsetman_setup_540.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
PID:4976
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:4144
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Config.Msi\e58650f.rbs
- Size 7KB
- SHA256 7d335f67ac4f6ff1cda3c6379ba53a4c91df1a07cdd335e71ea6796d67efbb14
- MD5 8cc38fec94f0371dcb43d0f4e94dc97c
- SHA1 b18fe2dd11aa2b30d0a49526f8ab32ec07f18292
- SHA512 988baf76291d255cdc91f3a35dcb07a2646ac839544578871978354d47515bd328ac2270b0462dabab475d65d60bb693ff06032b87ee29b78abb892433d02464
- SSDEEP 96:bmnJ6JCyHYOYA8oCjyMaUCrZTCsTlqUCrZTCWd/iTlrGA5UhZWXuLw1CMplBGjBx:SJE/8oCPtKOIbKOdVkZYIMp4
- TLSH T131F14341B31181E2ED52173ACF0717563BB3D3DDD6D0230B09CD92A86E5678A5FE62CA
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\357F04AD41BCF5FE18FCB69F60C6680F_600B4ACE67EC2EA0B24B2E65E16AE631
- Size 1KB
- SHA256 946cd6a6f6ce9282ca1b4698fe910ad918a06a044d1ac01e1bc256e255ac1cd7
- MD5 d8b645dc8ee0fcb55e11d079c82d474f
- SHA1 7ef1422f423ca351431b4de16a4ff08dcd2813c3
- SHA512 bf5f967e9405feb4909c1f8b533f1ff61bdf449c25a5066902ed90aafedaaae1e28abd1d2cb06563b9e2d87ad8add2bd3c2550b2d32e9a6015cdb4b3da9e2bea
- TLSH T144311A6B061C2D9658DECF18ACC591086D7C60E01D7D99111137C37966003D35FBA01D
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\9CB4373A4252DE8D2212929836304EC5_1AB74AA2E3A56E1B8AD8D3FEC287554E
- Size 1KB
- SHA256 0e463db8726b9ec19b1770d5790ea4727af39c85b4d951f56b7cb00b639816d9
- MD5 b8ba8f85f7c99fad7c22cd60f641a964
- SHA1 1ee69e5d2f0de776851c90a3e2cb4fdaf63fa934
- SHA512 5c3f06b145fb795f194e08ca7cc23c3f180757575126e756d843c87b2607d6295c8cb69f457658733efbe509283f57f3cd4f88f7855b3f486e68a01e89881720
- TLSH T13F31D8771F6CB5208E128D8426CDFA725970DAE0989A10797218DB176C80BB38B1559B
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\357F04AD41BCF5FE18FCB69F60C6680F_600B4ACE67EC2EA0B24B2E65E16AE631
- Size 536B
- SHA256 dd42c93f9e29b017c46b1f7ba7652aaf6f8eac44d1cf6734d75ca6151499c255
- MD5 99e265f3ceb3d0a64cd07bde77e06b8d
- SHA1 21b55ce835ac92c1452440f5ea0b4b41858347cd
- SHA512 73c5881427b397d3479d348745c59da401d0353d0958b3056ec7ff9f3cf5e83e2cf3ea57b71657dafc1d7c698917b06dd7ac388587567ff11d059ed974c95bc8
- TLSH T1B7F02E3450B9210FF076D97816C1A6995C55F51324359F9525AA43097C11E407C93E79
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\9CB4373A4252DE8D2212929836304EC5_1AB74AA2E3A56E1B8AD8D3FEC287554E
- Size 536B
- SHA256 79f2e3d7a87bf60253b3db071d15b160d09082f33ea4701554f17bbf3cb6f5c8
- MD5 239b390f0f2714c98d557bd97e7bcb43
- SHA1 3322230e432afcb33bc1e56416a67e1a5d0d6a55
- SHA512 cd42d492c99de6ee6f57c0e54ec8ce2b26da2f3f7eb293a0fff5e3d12b62d413f8c48215932b9b42526329fe356292d9e0a6fd03455b3d8fc0bee45dfe85ccd6
- TLSH T170F0DC080DF5431EF8B2DE791DE95416EA15F9027C218BEC025B4B0E3C20F008D3382D
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\ApplicationInstallationFolder_11\MSIMG32.dll
- Size 2.8MB
- SHA256 6ba5d96e52734cbb9246bcc3decf127f780d48fa11587a1a44880c1f04404d23
- MD5 bcee0ab10b23f5999bcdb56c0b4a631a
- SHA1 f352cec89a56e23dae20cdd62df4d40bc7f22b5e
- SHA512 243bf6a33e762cefd72f54ed8189d9c2018a7bb557bf067b03d35182c6894e06154bf9c5e6f87e4efc102860aa7d4ae489d00309aa1174efe88aa998e6f8c3d8
- SSDEEP 49152:g7Kvt428oBpDMOLZ3o3ZLZn2SFvtnd0X70GxDCgd/l:FpDzZAznjtnd0X7NxDCU/l
- TLSH T126D58D0A6B3B0B6AD614C4FE967B1263C9997D0CD028B5B48DC04B457F96F60927E3EC
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\ApplicationInstallationFolder_11\consent.exe
- Size 109KB
- SHA256 ccad775decb5aec98118b381eeccc6d540928035cfb955abcb4ad3ded390b79b
- MD5 0b5511674394666e9d221f8681b2c2e6
- SHA1 6e4e720dfc424a12383f0b8194e4477e3bc346dc
- SHA512 00d28a00fd3ceaeae42ba6882ffb42aa4cc8b92b07a10f28df8e1931df4b806aebdcfab1976bf8d5ce0b98c64da19d4ee06a6315734fa5f885ecd1f6e1ff16a7
- SSDEEP 1536:HT3RGRM9dooAXR1cMfb5/0ivhWZpzNKD4h:HT3Rj9dotXRPjd0ckzNHh
- TLSH T1C6B3F75292100455F3598B7146A6F6E149A0BD3D1BE4E6CFF138BD3A2E322E35A3760F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\ApplicationInstallationFolder_11\netsetman_setup_540.exe
- Size 7.4MB
- SHA256 b5bee6671ad69c41351474510a52e55ba065fcfd2b4909719b9e69bc705f71f1
- MD5 8b6c32204cedd7568dd8d861b0d3f832
- SHA1 189d9d4c5e4c5b2bfdfcc48aa1a9909038e33fab
- SHA512 9a67330f1b2d8011afb9f5cc333237ef096ac8cfed0c620f000a49a39562025765d91270c0499f75b71e0d1e2cf5a1624b594c474a6056116dc42cc3f761e84c
- SSDEEP 98304:vwREr/QxtMGIrCp4zAnFLXkz+rUmzcpK/Xzed8OSccLy6soPTHdq6cG7QM3cyhJh:Nr/QzgzAnF74+r5376KOapJcMVw6T
- TLSH T112762223B2CBE03EE49D4B331AB3A15454F77A617423BE569BE8847CCF260601D3E656
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\is-H1AAO.tmp\netsetman_setup_540.tmp
- Size 3.0MB
- SHA256 0db00e5003898530aa4db13df01637cf39844eb90c4ca2c564b5d92994d63eb4
- MD5 e61207fcd140dbb1afd66a1ff895d9e9
- SHA1 216d50c442290c313908ef872af7b694a31fcdcf
- SHA512 f6f3af7e9d261235071bab0f647454e3c817b971a368b543b9204b2b859a59f8b21fe8569996d17925a4dcc997c285a824345afd9ed86541d3be6cd4ee4a484b
- SSDEEP 49152:zdJYVM+9JtzZWnoS2VC23aun8+f5KuGUOY9IGTiOynqf333k/9q:ZJYVM+LtVt3P/KuGUONGTi34333k/Q
- TLSH T104E56C1BF389613ED05B1A352927C1515937BE707A2A8C579BEC3E0C8F361886E3B746
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\e58650e.msi
- Size 8.9MB
- SHA256 29e1bc115d78c7e98e6dbc3577d24a75effda6d25f191cf32503f65922e3c281
- MD5 6d40dcda90325d5016fbf617a68de4eb
- SHA1 fec676fe9c1d0e268259765342065693dcc1050b
- SHA512 cbbb305e46a0359af76ecc81c8f1e19ef37c9895aaa4e97c03d8773d45d277850de598264257a5c484524e267eeb667fe5eccb548808abbbb0dfb0e96fd4aded
- SSDEEP 196608:0qqJN3v5jqYqqCGeboXQfLsCw7mfbvadiXW1srx:0qqJNYYqqioILEmfJv
- TLSH T1DA963323BD989F29CD81BBB82B0F632409802C87F81266E66E4D7737653755792FD4E0
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
- Size 24.6MB
- SHA256 0cf45d1cc09185dca6b2263ab34a980ce840290ae153d3d01d92b1366f1d5742
- MD5 b50aaeae12ef4aef75e1d83f96e6f24c
- SHA1 1bff56ada63705be4fc4374bae0cdd9191ccc3fa
- SHA512 64bc3eff779f18a31162bd04d7add737385b1fd7d8ff3973130dafd33a2243daf32084b2f06719b87e07508b07731284194cf599089607c3cc4898fbf05fef80
- SSDEEP 24576:m2gmSp1GdoO/vvTL5GSOh0nq/6p5Q4242WhdXJkC7J6oEeGHI5TVrPI1h:J
- TLSH T11747A42436F92100E7F79E3D78F06A27493A7D5B9C15DE8D45411B8E0921BB0E8B2F6B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\Volume{731567b7-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{8d13e844-0500-454a-98c2-29f99914fe14}_OnDiskSnapshotProp
- Size 6KB
- SHA256 107251981cbc4f1723033b1ec4c352b94b6c3985ddd4c44f626881ee932584c3
- MD5 0d3b6d5ecbb4d47d73918af9deef2fee
- SHA1 7082edca59ec805719d42de90e55491c999a209c
- SHA512 8df6a62c4c1be140ca96521fb202da90a190e1f69ceb72cc22dfa4fbd8fdfe67fb9f21f5ef14c8cf85015a742de15f05f6843ac6e238815182f17337697747a7
- SSDEEP 96:FAddhHNvc8DD84LTHzbOHXOHBlBRQ88Sc9XE56tOSVQpuN:YFb++ZVmN
- TLSH T1BAD189185AE54711E2F3AB3229F14557A877B811EF33CB8E0198638E2670910F975F6F
- MD5 SHA1 SHA512 SSDEEP TLSH