Overview
overview
8Static
static
3BubbleUPnP...er.exe
windows10-2004-x64
8BubbleUPnP...er.exe
windows11-ltsc_2024-x64
7$PLUGINSDI...ns.dll
windows10-2004-x64
3$PLUGINSDI...ns.dll
windows11-ltsc_2024-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows11-ltsc_2024-x64
3$PLUGINSDI...ec.dll
windows10-2004-x64
3$PLUGINSDI...ec.dll
windows11-ltsc_2024-x64
3$PLUGINSDI...nz.dll
windows10-2004-x64
3$PLUGINSDI...nz.dll
windows11-ltsc_2024-x64
3$TEMP/wget.exe
windows10-2004-x64
3$TEMP/wget.exe
windows11-ltsc_2024-x64
3uninstall.exe
windows10-2004-x64
8uninstall.exe
windows11-ltsc_2024-x64
8$PLUGINSDI...ns.dll
windows10-2004-x64
3$PLUGINSDI...ns.dll
windows11-ltsc_2024-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows11-ltsc_2024-x64
3Analysis
- max time kernel
150s - max time network
151s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
24/07/2026, 06:16
Behavioral task
behavioral1
Sample
BubbleUPnPServer-installer-user.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
23 signatures
150 seconds
Behavioral task
behavioral2
Sample
BubbleUPnPServer-installer-user.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
8 signatures
150 seconds
Behavioral task
behavioral3
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral4
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
Behavioral task
behavioral5
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral6
Sample
$PLUGINSDIR/System.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
Behavioral task
behavioral7
Sample
$PLUGINSDIR/nsExec.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral8
Sample
$PLUGINSDIR/nsExec.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
Behavioral task
behavioral9
Sample
$PLUGINSDIR/nsisunz.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral10
Sample
$PLUGINSDIR/nsisunz.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
Behavioral task
behavioral11
Sample
$TEMP/wget.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral12
Sample
$TEMP/wget.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral13
Sample
uninstall.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral14
Sample
uninstall.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
Behavioral task
behavioral15
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral16
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
Behavioral task
behavioral17
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral18
Sample
$PLUGINSDIR/System.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
General
- Target BubbleUPnPServer-installer-user.exe
- Size 2.1MB
- Sample260724-g1symstdlh
- SHA256 1c6abf57b91409becdd64cf7e95b60659b379ca943aaffa81830b9336ce4373f
- MD5 5a782e8bc273ab1935d0f557b08ddb9d
- SHA1 69f5715a285039a052878a92dd228a3ae60aabf7
- SHA512 52852c4cb533902262747f9f59a148ae172a21297fd11cf40a2f92ba4948f3774e2913b9de199c36956b53eaac3af01ebfb151e67a83ce288c339c7bc5ae2d8e
- SSDEEP 49152:wwhogrxKrdT/Dt4WEpox/E2HHEMEkOg+LOQVX4GG:nhog9KNt4NoJp9bF3YXA
- TLSH T160A533B2B2E10B7AC3DECE7D4941D26A8D94199C400513070BAE7CB75DBEB4BB88D758
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 5 IoCs
pid Process 3240 wget.exe 3180 wget.exe 4452 wget.exe 1140 wget.exe 2836 wget.exe - Loads dropped DLL 19 IoCs
pid Process 1620 BubbleUPnPServer-installer-user.exe 1620 BubbleUPnPServer-installer-user.exe 1620 BubbleUPnPServer-installer-user.exe 1620 BubbleUPnPServer-installer-user.exe 1620 BubbleUPnPServer-installer-user.exe 1620 BubbleUPnPServer-installer-user.exe 1620 BubbleUPnPServer-installer-user.exe 1620 BubbleUPnPServer-installer-user.exe 1620 BubbleUPnPServer-installer-user.exe 1620 BubbleUPnPServer-installer-user.exe 1620 BubbleUPnPServer-installer-user.exe 1620 BubbleUPnPServer-installer-user.exe 1620 BubbleUPnPServer-installer-user.exe 1620 BubbleUPnPServer-installer-user.exe 1620 BubbleUPnPServer-installer-user.exe 1620 BubbleUPnPServer-installer-user.exe 1620 BubbleUPnPServer-installer-user.exe 1620 BubbleUPnPServer-installer-user.exe 1620 BubbleUPnPServer-installer-user.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 7 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wget.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BubbleUPnPServer-installer-user.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmic.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wget.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wget.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wget.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wget.exe - Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 4224 wmic.exe 4224 wmic.exe 4224 wmic.exe 4224 wmic.exe - Suspicious use of AdjustPrivilegeToken 42 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 4224 wmic.exe Token: SeSecurityPrivilege 4224 wmic.exe Token: SeTakeOwnershipPrivilege 4224 wmic.exe Token: SeLoadDriverPrivilege 4224 wmic.exe Token: SeSystemProfilePrivilege 4224 wmic.exe Token: SeSystemtimePrivilege 4224 wmic.exe Token: SeProfSingleProcessPrivilege 4224 wmic.exe Token: SeIncBasePriorityPrivilege 4224 wmic.exe Token: SeCreatePagefilePrivilege 4224 wmic.exe Token: SeBackupPrivilege 4224 wmic.exe Token: SeRestorePrivilege 4224 wmic.exe Token: SeShutdownPrivilege 4224 wmic.exe Token: SeDebugPrivilege 4224 wmic.exe Token: SeSystemEnvironmentPrivilege 4224 wmic.exe Token: SeRemoteShutdownPrivilege 4224 wmic.exe Token: SeUndockPrivilege 4224 wmic.exe Token: SeManageVolumePrivilege 4224 wmic.exe Token: 33 4224 wmic.exe Token: 34 4224 wmic.exe Token: 35 4224 wmic.exe Token: 36 4224 wmic.exe Token: SeIncreaseQuotaPrivilege 4224 wmic.exe Token: SeSecurityPrivilege 4224 wmic.exe Token: SeTakeOwnershipPrivilege 4224 wmic.exe Token: SeLoadDriverPrivilege 4224 wmic.exe Token: SeSystemProfilePrivilege 4224 wmic.exe Token: SeSystemtimePrivilege 4224 wmic.exe Token: SeProfSingleProcessPrivilege 4224 wmic.exe Token: SeIncBasePriorityPrivilege 4224 wmic.exe Token: SeCreatePagefilePrivilege 4224 wmic.exe Token: SeBackupPrivilege 4224 wmic.exe Token: SeRestorePrivilege 4224 wmic.exe Token: SeShutdownPrivilege 4224 wmic.exe Token: SeDebugPrivilege 4224 wmic.exe Token: SeSystemEnvironmentPrivilege 4224 wmic.exe Token: SeRemoteShutdownPrivilege 4224 wmic.exe Token: SeUndockPrivilege 4224 wmic.exe Token: SeManageVolumePrivilege 4224 wmic.exe Token: 33 4224 wmic.exe Token: 34 4224 wmic.exe Token: 35 4224 wmic.exe Token: 36 4224 wmic.exe - Suspicious use of FindShellTrayWindow 4 IoCs
pid Process 3240 wget.exe 3180 wget.exe 4452 wget.exe 1140 wget.exe - Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 1620 wrote to memory of 4224 1620 BubbleUPnPServer-installer-user.exe 89 PID 1620 wrote to memory of 3240 1620 BubbleUPnPServer-installer-user.exe 93 PID 1620 wrote to memory of 3180 1620 BubbleUPnPServer-installer-user.exe 95 PID 1620 wrote to memory of 4452 1620 BubbleUPnPServer-installer-user.exe 97 PID 1620 wrote to memory of 1140 1620 BubbleUPnPServer-installer-user.exe 99 PID 1620 wrote to memory of 2836 1620 BubbleUPnPServer-installer-user.exe 101
Processes
-
C:\Users\Admin\AppData\Local\Temp\BubbleUPnPServer-installer-user.exe"C:\Users\Admin\AppData\Local\Temp\BubbleUPnPServer-installer-user.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1620 -
C:\Windows\SysWOW64\Wbem\wmic.exewmic Path win32_process Where "name like 'javaw.exe' and CommandLine Like '%BubbleUPnPServerLauncher.jar%'" Call Terminate2⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4224
-
-
C:\Users\Admin\AppData\Local\Temp\wget.exe"C:\Users\Admin\AppData\Local\Temp\wget.exe" https://bubblesoftapps.com/bubbleupnpserver/jre_binaries/windows/x64/jre.zip -O "C:\Users\Admin\AppData\Local\Temp\nsu27C3.tmp\jre.zip"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
PID:3240
-
-
C:\Users\Admin\AppData\Local\Temp\wget.exe"C:\Users\Admin\AppData\Local\Temp\wget.exe" https://bubblesoftapps.com/bubbleupnpserver/ffmpeg_binaries_v7/windows/x64/ffmpeg.zip -O "C:\Users\Admin\AppData\Local\Temp\nsu27C3.tmp\ffmpeg.zip"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
PID:3180
-
-
C:\Users\Admin\AppData\Local\Temp\wget.exe"C:\Users\Admin\AppData\Local\Temp\wget.exe" https://bubblesoftapps.com/bubbleupnpserver/ffmpeg_binaries_v7/windows/x64/ffprobe.zip -O "C:\Users\Admin\AppData\Local\Temp\nsu27C3.tmp\ffprobe.zip"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
PID:4452
-
-
C:\Users\Admin\AppData\Local\Temp\wget.exe"C:\Users\Admin\AppData\Local\Temp\wget.exe" "https://bubblesoftapps.com/bubbleupnpserver/core/bcprov-jdk16-146.jar" -O "C:\Users\Admin\AppData\Roaming\BubbleUPnP Server/bcprov-jdk16-146.jar"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
PID:1140
-
-
C:\Users\Admin\AppData\Local\Temp\wget.exe"C:\Users\Admin\AppData\Local\Temp\wget.exe" "https://bubblesoftapps.com/bubbleupnpserver/core/BubbleUPnPServerLauncher.jar" -O "C:\Users\Admin\AppData\Roaming\BubbleUPnP Server/BubbleUPnPServerLauncher.jar"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2836
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\nsu27C3.tmp\InstallOptions.dll
- Size 14KB
- SHA256 8f24c6cf0b06d18f3c07e7bfca4e92afce71834663746cfaa9ddf52a25d5c586
- MD5 d753362649aecd60ff434adf171a4e7f
- SHA1 3b752ad064e06e21822c8958ae22e9a6bb8cf3d0
- SHA512 41bf41add275867553fa3bd8835cd7e2a2a362a2d5670ccbfad23700448bad9fe0f577fb6ee9d4eb81dfc10d463b325b8a873fe5912eb580936d4ad96587aa6d
- SSDEEP 192:3Gs+dH4+oQOTgDbzuNfrigyULWsXXZF/01JJijnK72dwF7dBEnbok:3GvdH4qMebzPY2Vijn+BEnbo
- TLSH T1F0623B51638888F3DBD6013EB4523707AB595126B4925DE2CB271FCA6D3B18E3EB2346
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nsu27C3.tmp\System.dll
- Size 10KB
- SHA256 bb6df93369b498eaa638b0bcdc4bb89f45e9b02ca12d28bcedf4629ea7f5e0f1
- MD5 56a321bd011112ec5d8a32b2f6fd3231
- SHA1 df20e3a35a1636de64df5290ae5e4e7572447f78
- SHA512 5354890cbc53ce51081a78c64ba9c4c8c4dc9e01141798c1e916e19c5776dac7c82989fad0f08c73e81aaba332dad81205f90d0663119af45550b97b338b9cc3
- SSDEEP 192:uv+cJZE61KRWJQO6tFiUdK7ckK4k7l1XRBm0w+NiHi1GSJ:uf6rtFRduQ1W+fG8
- TLSH T127225C5893E0C1F3D6A0853C18A73A772729712445A18FE3CFA35841AE196D7BC7E336
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nsu27C3.tmp\ioSpecial.ini
- Size 702B
- SHA256 a9ab61087ab279b0398e23a994a9411ba3b6b41f9a31a9f265921980efe4a320
- MD5 db470e337a9d05564f95f1cad0f19800
- SHA1 64591c317a5f8f90173764a5662893610ded952c
- SHA512 da4f3771b477ddfb23b2ad7ee276f0f79ccb3c79ce7d90e4869302bfe90a4f189090907289dcc2c80d3005e5bd6ad9873323840bd061f997756ac7ebf581654a
- TLSH T1B1019EC9941FB36D142010A664F93B9197E02D2C47223CF6F0528887A7CDDD38BE9ED2
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nsu27C3.tmp\ioSpecial.ini
- Size 741B
- SHA256 09ff3d87516b339337eab3abed7ba9f714051364ca5ac8a190e1a5fa7761bf19
- MD5 f847f0fa5157fa7ba732437c4231b1fb
- SHA1 047b2d2a4356cca3e78cd33b7db3c072a1a721e7
- SHA512 1f871224aefa25b2439f9d16598dac249fdfc0f8133637fbe7b9c68a91708c34dbeb20c83ff599857dd4197413ff7dbc5c4d7f84ecd85b691ca62293b14da33c
- TLSH T17E0190C9941FA3A81420109660E93B9157E01D2C87163CB1F0528887978DDD386EDAD2
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nsu27C3.tmp\jre.zip
- Size 42.0MB
- SHA256 fd11ddf4e1cc89d39ec387cd248331db7d14cbf20561f3dd5f1f06d5c8908f9b
- MD5 8d43ca5ea4e9c9e59df627c27f456023
- SHA1 0e6af95e4f41b9fb16becf2ecaf67618395ef26d
- SHA512 447b50cd27297a0f69fa141d290e96f2644c1b391f8c1fe1748fe60ebaa9437dc25db512d590748ca474542485f0927f773258825cc752120a70505a23fa7c57
- SSDEEP 786432:QrQN9hgDY9AVQBONUCiuEKDsJOB+hYMQECVIdQxU40ttS+Z/3n:CgiDkAyMRpKOB+TXxtthvn
- TLSH T18DA73339C66D2B31FB6AD2761620877E2472E3C931872C3F6B422B9517016E197E4C7E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nsu27C3.tmp\nsExec.dll
- Size 6KB
- SHA256 3b15c6e4ca42036d7424f93ea0806a2d35220d65faaf2bd2479a54258f631b55
- MD5 428c3a07fba184367a5085e46e4a790b
- SHA1 f2de6cd4ec99ab784d18914a21de9d919a450089
- SHA512 b34e1266e949d7cc5cdb7a809c3ca42652a1bb1ec72d83218604cb01b3118bbb42bfcaebc6134c4e6eb43fb566539414a49c1a0cd23a6c84da7c1c4b56ba2ab6
- SSDEEP 96:L7GUeYNrwgcrEzyKwZxW4JxNABWweYkZleOe4I9d0qqyVgNr32E:XGgrwgcrEzylQBHkZwd0qJVgNy
- TLSH T1E1D1E93D76C33DB3C54ACA753C65292F0FB8D8261B540211AB5716C279D5AE3FE29382
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nsu27C3.tmp\nsisunz.dll
- Size 40KB
- SHA256 6e87ecb7f62039fbb6e7676422d1a5e75a32b90dde6865dcb68ee658ba8df61d
- MD5 5f13dbc378792f23e598079fc1e4422b
- SHA1 5813c05802f15930aa860b8363af2b58426c8adf
- SHA512 9270635a5294482f49e0292e26d45dd103b85fe27dc163d44531b095c5f9dbde6b904adaf1a888ba3c112a094380394713c796f5195b2566a20f00b42b6578e5
- SSDEEP 384:KExN66Yf2xL5Q4IsjuUjUZfqRDpImexpf88FwHxXvjX3hwlHt6oIfESxSHoOO8n9:O2x64GcVpI3xC8ynToIf1SIOhW4
- TLSH T188038EA392C146FBC5F8843931DA6E1D6A9EFC301BC16103CB2DBDA52D153967A642CF
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\wget.exe
- Size 4.2MB
- SHA256 1908c52cc8b3f573c719451874b0cce62c89d965d733f403fc0e8f67480434fd
- MD5 f8247397ae65792524d949c825969391
- SHA1 18a870960334be784abd9e3aab9329040b49fbea
- SHA512 8b15bf18410afd05fb96f5b3bdb5ec8cc9852cced051e39568d5ed268ff65766bfb8ce01dc03a1bf0027a9b0c104dfd3c259a9e51f82c8667b9dea828aa936a0
- SSDEEP 98304:DcKXMEGWw52DblQteLTTzQs6MGsdgOYrqX4SP+J4jTnSPCPv1EDaZgHlHuj2Dtg6:gmMEGWw52D+teLTTzQs6MGsdgOYrqX4p
- TLSH T1F3264884EACB80F6EE1B08B19487F37F0B316E12D870CDA7EA847909F973A51951935D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\BubbleUPnP Server\jre\legal\java.logging\ADDITIONAL_LICENSE_INFO
- Size 49B
- SHA256 ebf9777bd307ed789ceabf282a9aca168c391c7f48e15a60939352efb3ea33f9
- MD5 19c9d1d2aad61ce9cb8fb7f20ef1ca98
- SHA1 2db86ab706d9b73feeb51a904be03b63bee92baf
- SHA512 7ec63b59d8f87a42689f544c2e8e7700da5d8720b37b41216cbd1372c47b1bc3b892020f0dd3a44a05f2a7c07471ff484e4165427f1a9cad0d2393840cd94e5b
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\BubbleUPnP Server\jre\legal\java.logging\ASSEMBLY_EXCEPTION
- Size 44B
- SHA256 b998cda101e5a1ebcfb5ff9cddd76ed43a2f2169676592d428b7c0d780665f2a
- MD5 7caf4cdbb99569deb047c20f1aad47c4
- SHA1 24e7497426d27fe3c17774242883ccbed8f54b4d
- SHA512 a1435e6f1e4e9285476a0e7bc3b4f645bbafb01b41798a2450390e16b18b242531f346373e01d568f6cc052932a3256e491a65e8b94b118069853f2b0c8cd619
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\BubbleUPnP Server\jre\legal\java.logging\LICENSE
- Size 33B
- SHA256 86e0516b888276a492b19f9a84f5a866ed36925fae1510b3a94a0b6213e69192
- MD5 16989bab922811e28b64ac30449a5d05
- SHA1 51ab20e8c19ee570bf6c496ec7346b7cf17bd04a
- SHA512 86571f127a6755a7339a9ed06e458c8dc5898e528de89e369a13c183711831af0646474986bae6573bc5155058d5f38348d6bfdeb3fd9318e98e0bf7916e6608
- MD5 SHA1 SHA512