Overview
overview
8Static
static
3BubbleUPnP...er.exe
windows10-2004-x64
8BubbleUPnP...er.exe
windows11-ltsc_2024-x64
7$PLUGINSDI...ns.dll
windows10-2004-x64
3$PLUGINSDI...ns.dll
windows11-ltsc_2024-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows11-ltsc_2024-x64
3$PLUGINSDI...ec.dll
windows10-2004-x64
3$PLUGINSDI...ec.dll
windows11-ltsc_2024-x64
3$PLUGINSDI...nz.dll
windows10-2004-x64
3$PLUGINSDI...nz.dll
windows11-ltsc_2024-x64
3$TEMP/wget.exe
windows10-2004-x64
3$TEMP/wget.exe
windows11-ltsc_2024-x64
3uninstall.exe
windows10-2004-x64
8uninstall.exe
windows11-ltsc_2024-x64
8$PLUGINSDI...ns.dll
windows10-2004-x64
3$PLUGINSDI...ns.dll
windows11-ltsc_2024-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows11-ltsc_2024-x64
3Analysis
- max time kernel
150s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
24/07/2026, 06:16
Behavioral task
behavioral1
Sample
BubbleUPnPServer-installer-user.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral2
Sample
BubbleUPnPServer-installer-user.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral3
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral4
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral5
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral6
Sample
$PLUGINSDIR/System.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral7
Sample
$PLUGINSDIR/nsExec.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral8
Sample
$PLUGINSDIR/nsExec.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral9
Sample
$PLUGINSDIR/nsisunz.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral10
Sample
$PLUGINSDIR/nsisunz.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral11
Sample
$TEMP/wget.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral12
Sample
$TEMP/wget.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral13
Sample
uninstall.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral14
Sample
uninstall.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral15
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral16
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral17
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral18
Sample
$PLUGINSDIR/System.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
General
- Target uninstall.exe
- Size 70KB
- Sample260724-g1symstdlh
- SHA256 30e633d2913d4f3a8f3afb0beddb38cc9d7aaea02b9d91d72f9cd9e28ffb9505
- MD5 13bd84999d2f967a6638e6ba800467ad
- SHA1 e86d2db9edce31162b377244065963d4606fe5e3
- SHA512 9af94e07a646aece244af0fb6e359b9d7e392258aa03e2cd4800c6da01dc7e616d1baa48c15774e2fe8491ce22c3fc3f5cb2432f4f0e5a8b64289c3124ad3a01
- SSDEEP 1536:MKJAES3bS2L6KbuVfmMk0DCwcjgdLeAyNLcHRIB6c8CkC5w8TKw76:vJ2S2L6KbqDCwcjceAZio2kCfWu6
- TLSH T19C63CF0777C188F7D5E646B00EBBABBAFB77D50042119B438B945F7F292024B9E19253
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Modifies Windows Firewall 2 TTPs 1 IoCs
pid Process 6108 netsh.exe - Deletes itself 1 IoCs
pid Process 4856 Au_.exe - Executes dropped EXE 1 IoCs
pid Process 4856 Au_.exe - Loads dropped DLL 3 IoCs
pid Process 4856 Au_.exe 4856 Au_.exe 4856 Au_.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe - System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language uninstall.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Au_.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmic.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language netsh.exe - NSIS installer 2 IoCs
resource yara_rule behavioral14/files/0x000c00000001c528-0.dat nsis_installer_1 behavioral14/files/0x000c00000001c528-0.dat nsis_installer_2 - Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 2976 wmic.exe 2976 wmic.exe 2976 wmic.exe 2976 wmic.exe - Suspicious use of AdjustPrivilegeToken 42 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 2976 wmic.exe Token: SeSecurityPrivilege 2976 wmic.exe Token: SeTakeOwnershipPrivilege 2976 wmic.exe Token: SeLoadDriverPrivilege 2976 wmic.exe Token: SeSystemProfilePrivilege 2976 wmic.exe Token: SeSystemtimePrivilege 2976 wmic.exe Token: SeProfSingleProcessPrivilege 2976 wmic.exe Token: SeIncBasePriorityPrivilege 2976 wmic.exe Token: SeCreatePagefilePrivilege 2976 wmic.exe Token: SeBackupPrivilege 2976 wmic.exe Token: SeRestorePrivilege 2976 wmic.exe Token: SeShutdownPrivilege 2976 wmic.exe Token: SeDebugPrivilege 2976 wmic.exe Token: SeSystemEnvironmentPrivilege 2976 wmic.exe Token: SeRemoteShutdownPrivilege 2976 wmic.exe Token: SeUndockPrivilege 2976 wmic.exe Token: SeManageVolumePrivilege 2976 wmic.exe Token: 33 2976 wmic.exe Token: 34 2976 wmic.exe Token: 35 2976 wmic.exe Token: 36 2976 wmic.exe Token: SeIncreaseQuotaPrivilege 2976 wmic.exe Token: SeSecurityPrivilege 2976 wmic.exe Token: SeTakeOwnershipPrivilege 2976 wmic.exe Token: SeLoadDriverPrivilege 2976 wmic.exe Token: SeSystemProfilePrivilege 2976 wmic.exe Token: SeSystemtimePrivilege 2976 wmic.exe Token: SeProfSingleProcessPrivilege 2976 wmic.exe Token: SeIncBasePriorityPrivilege 2976 wmic.exe Token: SeCreatePagefilePrivilege 2976 wmic.exe Token: SeBackupPrivilege 2976 wmic.exe Token: SeRestorePrivilege 2976 wmic.exe Token: SeShutdownPrivilege 2976 wmic.exe Token: SeDebugPrivilege 2976 wmic.exe Token: SeSystemEnvironmentPrivilege 2976 wmic.exe Token: SeRemoteShutdownPrivilege 2976 wmic.exe Token: SeUndockPrivilege 2976 wmic.exe Token: SeManageVolumePrivilege 2976 wmic.exe Token: 33 2976 wmic.exe Token: 34 2976 wmic.exe Token: 35 2976 wmic.exe Token: 36 2976 wmic.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 6068 wrote to memory of 4856 6068 uninstall.exe 89 PID 4856 wrote to memory of 2976 4856 Au_.exe 90 PID 4856 wrote to memory of 6108 4856 Au_.exe 93
Processes
-
C:\Users\Admin\AppData\Local\Temp\uninstall.exe"C:\Users\Admin\AppData\Local\Temp\uninstall.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:6068 -
C:\Users\Admin\AppData\Local\Temp\~nsuA.tmp\Au_.exe"C:\Users\Admin\AppData\Local\Temp\~nsuA.tmp\Au_.exe" _?=C:\Users\Admin\AppData\Local\Temp\2⤵
- Deletes itself
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4856 -
C:\Windows\SysWOW64\Wbem\wmic.exewmic Path win32_process Where "name like 'javaw.exe' and CommandLine Like '%BubbleUPnPServerLauncher.jar%'" Call Terminate3⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2976
-
-
C:\Windows\SysWOW64\netsh.exenetsh advfirewall firewall delete rule name="BubbleUPnP Server"3⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
PID:6108
-
-
Network
MITRE ATT&CK Enterprise v16
Persistence
Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Privilege Escalation
Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\nsx3B2C.tmp\InstallOptions.dll
- Size 14KB
- SHA256 8f24c6cf0b06d18f3c07e7bfca4e92afce71834663746cfaa9ddf52a25d5c586
- MD5 d753362649aecd60ff434adf171a4e7f
- SHA1 3b752ad064e06e21822c8958ae22e9a6bb8cf3d0
- SHA512 41bf41add275867553fa3bd8835cd7e2a2a362a2d5670ccbfad23700448bad9fe0f577fb6ee9d4eb81dfc10d463b325b8a873fe5912eb580936d4ad96587aa6d
- SSDEEP 192:3Gs+dH4+oQOTgDbzuNfrigyULWsXXZF/01JJijnK72dwF7dBEnbok:3GvdH4qMebzPY2Vijn+BEnbo
- TLSH T1F0623B51638888F3DBD6013EB4523707AB595126B4925DE2CB271FCA6D3B18E3EB2346
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nsx3B2C.tmp\System.dll
- Size 10KB
- SHA256 bb6df93369b498eaa638b0bcdc4bb89f45e9b02ca12d28bcedf4629ea7f5e0f1
- MD5 56a321bd011112ec5d8a32b2f6fd3231
- SHA1 df20e3a35a1636de64df5290ae5e4e7572447f78
- SHA512 5354890cbc53ce51081a78c64ba9c4c8c4dc9e01141798c1e916e19c5776dac7c82989fad0f08c73e81aaba332dad81205f90d0663119af45550b97b338b9cc3
- SSDEEP 192:uv+cJZE61KRWJQO6tFiUdK7ckK4k7l1XRBm0w+NiHi1GSJ:uf6rtFRduQ1W+fG8
- TLSH T127225C5893E0C1F3D6A0853C18A73A772729712445A18FE3CFA35841AE196D7BC7E336
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nsx3B2C.tmp\ioSpecial.ini
- Size 610B
- SHA256 9dbf645d87b574abd5b4091f365497d3625f64937b4528f968bb1259dda48e48
- MD5 4b202ad9f1c8d733397da76a51993564
- SHA1 3bde7e57eb9c5bdb87d2d341cafbe2feb46ce05a
- SHA512 f6c94be93efcff9f048733dfe6750703afa78b27658c98e52a18440207485e3dca2aed1a4de86a25edbc0c15b4081711cdd75b1e9b8f07e40f455c35a7e8b2bf
- TLSH T113F0ACC9D02FA37D1D10412660EA3B9563D02E245B1279F0F8628843DBCECD34BEBAC2
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nsx3B2C.tmp\ioSpecial.ini
- Size 650B
- SHA256 e522ac6b289a7456be306eac258d9827856602623406f9f7802edb65476fbec2
- MD5 88262135054458df7f5d4fc430c8e5ef
- SHA1 744f1e67137c66f9944d6966efa983c8c4dd5692
- SHA512 b39754f2ca42b681ec032562276771d1e7a6db061d38d8be89a81c26ed99a6e3e8549a2bca4b6bf0a3a699b2cbb56ac8187e575bc45be5b31aaacb91c5d7b83d
- TLSH T138F073C9902F93BD5D10456650EA379573D01E24561675B0F462C843D7CDCD387EAA93
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\~nsuA.tmp\Au_.exe
- Size 70KB
- SHA256 30e633d2913d4f3a8f3afb0beddb38cc9d7aaea02b9d91d72f9cd9e28ffb9505
- MD5 13bd84999d2f967a6638e6ba800467ad
- SHA1 e86d2db9edce31162b377244065963d4606fe5e3
- SHA512 9af94e07a646aece244af0fb6e359b9d7e392258aa03e2cd4800c6da01dc7e616d1baa48c15774e2fe8491ce22c3fc3f5cb2432f4f0e5a8b64289c3124ad3a01
- SSDEEP 1536:MKJAES3bS2L6KbuVfmMk0DCwcjgdLeAyNLcHRIB6c8CkC5w8TKw76:vJ2S2L6KbqDCwcjceAZio2kCfWu6
- TLSH T19C63CF0777C188F7D5E646B00EBBABBAFB77D50042119B438B945F7F292024B9E19253
- MD5 SHA1 SHA512 SSDEEP TLSH