5a1dc565eea53fe57433dd5e76e093ab20e67cccd0d9fc2ba7a71d2a8f896bb9

Analysis

max time kernel
144s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
12-10-2023 10:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Kerio-Vpnlike-32Bit.exe
Size

9.6MB
MD5

7f4f3492feef2acde222975aa6006f99
SHA1

24e4bc0d49b3b89b4910778d6642052e80ca32ec
SHA256

5a1dc565eea53fe57433dd5e76e093ab20e67cccd0d9fc2ba7a71d2a8f896bb9
SHA512

3e98da1f0654a916dee493c9aacdb293f562f7a7adc18b07662fb4267cb2deb953d9abde608cc9041bf9bd062fd330cc116f0e1910fc298e932bbf71b82b3621
SSDEEP

196608:Mlq+1NKOV3HbOVYt3wHpe0t/jev/cXeEzi7DQPjJf9s:Y7Hd3UeM7e8XeM8UPNfi

Score

6^/10

persistence

Malware Config

Signatures

Blocklisted process makes network request 4 IoCs

Processes:

MSIEXEC.EXEmsiexec.exe

flow pid process

17 444 MSIEXEC.EXE
19 444 MSIEXEC.EXE
30 4552 msiexec.exe
32 4552 msiexec.exe

flow	pid	process
17	444	MSIEXEC.EXE
19	444	MSIEXEC.EXE
30	4552	msiexec.exe
32	4552	msiexec.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

MSIEXEC.EXEmsiexec.exe

description	ioc	process
File opened (read-only)	\??\J:	MSIEXEC.EXE
File opened (read-only)	\??\Z:	MSIEXEC.EXE
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\G:	MSIEXEC.EXE
File opened (read-only)	\??\K:	MSIEXEC.EXE
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\A:	MSIEXEC.EXE
File opened (read-only)	\??\S:	MSIEXEC.EXE
File opened (read-only)	\??\T:	MSIEXEC.EXE
File opened (read-only)	\??\W:	MSIEXEC.EXE
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\I:	MSIEXEC.EXE
File opened (read-only)	\??\P:	MSIEXEC.EXE
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\O:	MSIEXEC.EXE
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\V:	MSIEXEC.EXE
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\B:	MSIEXEC.EXE
File opened (read-only)	\??\Y:	MSIEXEC.EXE
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\E:	MSIEXEC.EXE
File opened (read-only)	\??\L:	MSIEXEC.EXE
File opened (read-only)	\??\M:	MSIEXEC.EXE
File opened (read-only)	\??\N:	MSIEXEC.EXE
File opened (read-only)	\??\Q:	MSIEXEC.EXE
File opened (read-only)	\??\R:	MSIEXEC.EXE
File opened (read-only)	\??\U:	MSIEXEC.EXE
File opened (read-only)	\??\X:	MSIEXEC.EXE
File opened (read-only)	\??\H:	MSIEXEC.EXE
File opened (read-only)	\??\O:	msiexec.exe

Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.

Query Registry
T1012

System Information Discovery
T1082

Processes:

MSI1B3.tmp

description ioc process

Key value queried \REGISTRY\USER\S-1-5-21-1574508946-349927670-1185736483-1000\Control Panel\International\Geo\Nation MSI1B3.tmp

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-1574508946-349927670-1185736483-1000\Control Panel\International\Geo\Nation	MSI1B3.tmp

Drops file in Windows directory 9 IoCs

Processes:

msiexec.exe

description	ioc	process
File created	C:\Windows\Installer\e581fc8.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File created	C:\Windows\Installer\SourceHash{C093AC5E-7F55-4D75-8499-0384F1C0A2E9}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI2B9F.tmp	msiexec.exe
File created	C:\Windows\Installer\{C093AC5E-7F55-4D75-8499-0384F1C0A2E9}\ARPPRODUCTICON.exe	msiexec.exe
File opened for modification	C:\Windows\Installer\{C093AC5E-7F55-4D75-8499-0384F1C0A2E9}\ARPPRODUCTICON.exe	msiexec.exe
File opened for modification	C:\Windows\Installer\e581fc8.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe

Executes dropped EXE 1 IoCs

Processes:

MSI1B3.tmp

pid process

4596 MSI1B3.tmp
Loads dropped DLL 6 IoCs

Processes:

MsiExec.exe

pid process

772 MsiExec.exe
772 MsiExec.exe
772 MsiExec.exe
772 MsiExec.exe
772 MsiExec.exe
772 MsiExec.exe

pid	process
4596	MSI1B3.tmp

pid	process
772	MsiExec.exe
772	MsiExec.exe
772	MsiExec.exe
772	MsiExec.exe
772	MsiExec.exe
772	MsiExec.exe

Registers COM server for autorun 1 TTPs 50 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Processes:

regsvr32.exeregsvr32.exeregsvr32.exeregsvr32.exeregsvr32.exeregsvr32.exeregsvr32.exeregsvr32.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32\ = "C:\\Windows\\system32\\jscript.dll"	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\CLSID\{F414C261-6AC0-11CF-B6D1-00AA00BBBB58}\INPROCSERVER32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{f414c262-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32\ThreadingModel = "Both"	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{f414c262-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{f414c262-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32\ = "C:\\Windows\\system32\\jscript.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{32DA2B15-CFED-11D1-B747-00C04FC2B085}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{cc5bbec3-db4a-4bed-828d-08d78ee3e1ed}\InprocServer32\ThreadingModel = "Both"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{f414c261-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32\ThreadingModel = "Both"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{f414c261-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32\ThreadingModel = "Both"	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\CLSID\{CC5BBEC3-DB4A-4BED-828D-08D78EE3E1ED}\INPROCSERVER32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{85131631-480C-11D2-B1F9-00C04F86C324}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{10E2414A-EC59-49D2-BC51-5ADD2C36FEBC}\InProcServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0D43FE01-F093-11CF-8940-00A0C9054228}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0CF774D0-F077-11D1-B1BC-00C04F86C324}\InprocServer32	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{f414c261-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{cc5bbec3-db4a-4bed-828d-08d78ee3e1ed}\InprocServer32\ = "C:\\Windows\\system32\\jscript.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{cc5bbec3-db4a-4bed-828d-08d78ee3e1ed}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{cc5bbec3-db4a-4bed-828d-08d78ee3e1ed}\InprocServer32\ = "C:\\Windows\\system32\\jscript.dll"	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32\ThreadingModel = "Both"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{32DA2B15-CFED-11D1-B747-00C04FC2B085}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{f414c261-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{85131631-480C-11D2-B1F9-00C04F86C324}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{85131630-480C-11D2-B1F9-00C04F86C324}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{f414c262-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32\ThreadingModel = "Both"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{10E2414A-EC59-49D2-BC51-5ADD2C36FEBC}\InProcServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{f414c262-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{cc5bbec3-db4a-4bed-828d-08d78ee3e1ed}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0CF774D1-F077-11D1-B1BC-00C04F86C324}\InprocServer32	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\CLSID\{F414C260-6AC0-11CF-B6D1-00AA00BBBB58}\INPROCSERVER32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0D43FE01-F093-11CF-8940-00A0C9054228}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{7E48C5CF-72F6-4C84-9F43-B04B87B31243}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{f414c261-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32\ThreadingModel = "Both"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EE09B103-97E0-11CF-978F-00A02463E06F}\InprocServer32	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\CLSID\{F414C262-6AC0-11CF-B6D1-00AA00BBBB58}\INPROCSERVER32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{f414c262-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{cc5bbec3-db4a-4bed-828d-08d78ee3e1ed}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{f414c261-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32\ = "C:\\Windows\\system32\\jscript.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{cc5bbec3-db4a-4bed-828d-08d78ee3e1ed}\InprocServer32\ThreadingModel = "Both"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0CF774D1-F077-11D1-B1BC-00C04F86C324}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{7E48C5CF-72F6-4C84-9F43-B04B87B31243}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EE09B103-97E0-11CF-978F-00A02463E06F}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{85131630-480C-11D2-B1F9-00C04F86C324}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{f414c262-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32\ = "C:\\Windows\\system32\\jscript.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32\ = "C:\\Windows\\system32\\jscript.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{f414c261-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32\ = "C:\\Windows\\system32\\jscript.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0CF774D0-F077-11D1-B1BC-00C04F86C324}\InprocServer32	regsvr32.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

MsiExec.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\HardwareID	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	MsiExec.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_DADY_DVD-ROM\4&215468A5&0&010000	MsiExec.exe

Modifies data under HKEY_USERS 3 IoCs

Processes:

msiexec.exe

description	ioc	process
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\1E\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1f	msiexec.exe

Modifies registry class 64 IoCs

Processes:

regsvr32.exeregsvr32.exeregsvr32.exeregsvr32.exeregsvr32.exeregsvr32.exeregsvr32.exeregsvr32.exeregsvr32.exeregsvr32.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile.HostEncode	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EE09B103-97E0-11CF-978F-00A02463E06F}\Implemented Categories\{7DD95801-9882-11CF-9FA9-00AA006C42C4}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{f414c261-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32\ = "C:\\Windows\\SysWow64\\jscript.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{32DA2B15-CFED-11D1-B747-00C04FC2B085}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{85131631-480C-11D2-B1F9-00C04F86C324}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{85131630-480C-11D2-B1F9-00C04F86C324}\ProgID	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\JScript	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\JavaScript1.2\CLSID\ = "{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\JavaScript1.2\OLEScript	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{cc5bbec3-db4a-4bed-828d-08d78ee3e1ed}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\LiveScript Author\ = "JScript Language Authoring"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0CF774D0-F077-11D1-B1BC-00C04F86C324}\ProgID	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\CLSID\{CC5BBEC3-DB4A-4BED-828D-08D78EE3E1ED}\IMPLEMENTED CATEGORIES\{F0B7A1A1-9847-11CF-8F20-00805F2CD064}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.vbs	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0CF774D1-F077-11D1-B1BC-00C04F86C324}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Scripting.Signer	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7E48C5CF-72F6-4C84-9F43-B04B87B31243}\Version	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{420B2830-E718-11CF-893D-00A0C9054228}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{f414c261-6ac0-11cf-b6d1-00aa00bbbb58}\OLEScript	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Scripting.Dictionary	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\JavaScript1.2	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\JavaScript1.3\CLSID\ = "{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\LiveScript\OLEScript	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\JSFile.HostEncode\CLSID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\JavaScript\CLSID\ = "{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{cc5bbec3-db4a-4bed-828d-08d78ee3e1ed}\InprocServer32\ = "C:\\Windows\\system32\\jscript.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F414C260-6AC0-11CF-B6D1-00AA00BBBB58}	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{f414c261-6ac0-11cf-b6d1-00aa00bbbb58}\Implemented Categories\{0AEE2A92-BCBB-11D0-8C72-00C04FC2B085}	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\CLSID\{F414C261-6AC0-11CF-B6D1-00AA00BBBB58}\OLESCRIPT	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{f414c262-6ac0-11cf-b6d1-00aa00bbbb58}\ = "JScript Language Encoding"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Scripting.Signer\CLSID	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\LIVESCRIPT\OLESCRIPT	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{f414c261-6ac0-11cf-b6d1-00aa00bbbb58}\ProgID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{7E48C5CF-72F6-4C84-9F43-B04B87B31243}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{f414c261-6ac0-11cf-b6d1-00aa00bbbb58}\OLEScript	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\JScript.Encode	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\JavaScript1.1 Author\ = "JScript Language Authoring"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Scripting.FileSystemObject\CLSID	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\JavaScript Author\CLSID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\JScript Author\ = "JScript Language Authoring"	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\JScript.Compact Author\CLSID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\JScript\CLSID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\JScript.Compact Author	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EE09B103-97E0-11CF-978F-00A02463E06F}\ProgID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F414C261-6AC0-11CF-B6D1-00AA00BBBB58}\Implemented Categories\{0AEE2A92-BCBB-11D0-8C72-00C04FC2B085}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{cc5bbec3-db4a-4bed-828d-08d78ee3e1ed}\ProgID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ECMAScript Author\CLSID	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\JScript.Compact	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\JScript\CLSID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Scripting.Encoder\CLSID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F414C262-6AC0-11CF-B6D1-00AA00BBBB58}\Implemented Categories	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0D43FE01-F093-11CF-8940-00A0C9054228}\Version	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{F414C260-6AC0-11CF-B6D1-00AA00BBBB58}\OLESCRIPT	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\JavaScript1.2 AuthorJavaScript1.3 Author	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\JavaScript1.1 Author\CLSID	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\JScript.Compact	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{f414c262-6ac0-11cf-b6d1-00aa00bbbb58}\ProgID\ = "JScript.Encode"	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\ScriptHostEncode	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{cc5bbec3-db4a-4bed-828d-08d78ee3e1ed}\ = "JScript Compact Profile (ECMA 327)"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{32DA2B15-CFED-11D1-B747-00C04FC2B085}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\JScript\CLSID	regsvr32.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

msiexec.exe

pid process

4552 msiexec.exe
4552 msiexec.exe

pid	process
4552	msiexec.exe
4552	msiexec.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

MSIEXEC.EXEmsiexec.exe

description	pid	process
Token: SeShutdownPrivilege	444	MSIEXEC.EXE
Token: SeIncreaseQuotaPrivilege	444	MSIEXEC.EXE
Token: SeSecurityPrivilege	4552	msiexec.exe
Token: SeCreateTokenPrivilege	444	MSIEXEC.EXE
Token: SeAssignPrimaryTokenPrivilege	444	MSIEXEC.EXE
Token: SeLockMemoryPrivilege	444	MSIEXEC.EXE
Token: SeIncreaseQuotaPrivilege	444	MSIEXEC.EXE
Token: SeMachineAccountPrivilege	444	MSIEXEC.EXE
Token: SeTcbPrivilege	444	MSIEXEC.EXE
Token: SeSecurityPrivilege	444	MSIEXEC.EXE
Token: SeTakeOwnershipPrivilege	444	MSIEXEC.EXE
Token: SeLoadDriverPrivilege	444	MSIEXEC.EXE
Token: SeSystemProfilePrivilege	444	MSIEXEC.EXE
Token: SeSystemtimePrivilege	444	MSIEXEC.EXE
Token: SeProfSingleProcessPrivilege	444	MSIEXEC.EXE
Token: SeIncBasePriorityPrivilege	444	MSIEXEC.EXE
Token: SeCreatePagefilePrivilege	444	MSIEXEC.EXE
Token: SeCreatePermanentPrivilege	444	MSIEXEC.EXE
Token: SeBackupPrivilege	444	MSIEXEC.EXE
Token: SeRestorePrivilege	444	MSIEXEC.EXE
Token: SeShutdownPrivilege	444	MSIEXEC.EXE
Token: SeDebugPrivilege	444	MSIEXEC.EXE
Token: SeAuditPrivilege	444	MSIEXEC.EXE
Token: SeSystemEnvironmentPrivilege	444	MSIEXEC.EXE
Token: SeChangeNotifyPrivilege	444	MSIEXEC.EXE
Token: SeRemoteShutdownPrivilege	444	MSIEXEC.EXE
Token: SeUndockPrivilege	444	MSIEXEC.EXE
Token: SeSyncAgentPrivilege	444	MSIEXEC.EXE
Token: SeEnableDelegationPrivilege	444	MSIEXEC.EXE
Token: SeManageVolumePrivilege	444	MSIEXEC.EXE
Token: SeImpersonatePrivilege	444	MSIEXEC.EXE
Token: SeCreateGlobalPrivilege	444	MSIEXEC.EXE
Token: SeCreateTokenPrivilege	444	MSIEXEC.EXE
Token: SeAssignPrimaryTokenPrivilege	444	MSIEXEC.EXE
Token: SeLockMemoryPrivilege	444	MSIEXEC.EXE
Token: SeIncreaseQuotaPrivilege	444	MSIEXEC.EXE
Token: SeMachineAccountPrivilege	444	MSIEXEC.EXE
Token: SeTcbPrivilege	444	MSIEXEC.EXE
Token: SeSecurityPrivilege	444	MSIEXEC.EXE
Token: SeTakeOwnershipPrivilege	444	MSIEXEC.EXE
Token: SeLoadDriverPrivilege	444	MSIEXEC.EXE
Token: SeSystemProfilePrivilege	444	MSIEXEC.EXE
Token: SeSystemtimePrivilege	444	MSIEXEC.EXE
Token: SeProfSingleProcessPrivilege	444	MSIEXEC.EXE
Token: SeIncBasePriorityPrivilege	444	MSIEXEC.EXE
Token: SeCreatePagefilePrivilege	444	MSIEXEC.EXE
Token: SeCreatePermanentPrivilege	444	MSIEXEC.EXE
Token: SeBackupPrivilege	444	MSIEXEC.EXE
Token: SeRestorePrivilege	444	MSIEXEC.EXE
Token: SeShutdownPrivilege	444	MSIEXEC.EXE
Token: SeDebugPrivilege	444	MSIEXEC.EXE
Token: SeAuditPrivilege	444	MSIEXEC.EXE
Token: SeSystemEnvironmentPrivilege	444	MSIEXEC.EXE
Token: SeChangeNotifyPrivilege	444	MSIEXEC.EXE
Token: SeRemoteShutdownPrivilege	444	MSIEXEC.EXE
Token: SeUndockPrivilege	444	MSIEXEC.EXE
Token: SeSyncAgentPrivilege	444	MSIEXEC.EXE
Token: SeEnableDelegationPrivilege	444	MSIEXEC.EXE
Token: SeManageVolumePrivilege	444	MSIEXEC.EXE
Token: SeImpersonatePrivilege	444	MSIEXEC.EXE
Token: SeCreateGlobalPrivilege	444	MSIEXEC.EXE
Token: SeCreateTokenPrivilege	444	MSIEXEC.EXE
Token: SeAssignPrimaryTokenPrivilege	444	MSIEXEC.EXE
Token: SeLockMemoryPrivilege	444	MSIEXEC.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

MSIEXEC.EXE

pid process

444 MSIEXEC.EXE

pid	process
444	MSIEXEC.EXE

Suspicious use of WriteProcessMemory 61 IoCs

Processes:

Kerio-Vpnlike-32Bit.exemsiexec.exeMSIEXEC.EXEMSI1B3.tmp

description	pid	process	target process
PID 4900 wrote to memory of 444	4900	Kerio-Vpnlike-32Bit.exe	MSIEXEC.EXE
PID 4900 wrote to memory of 444	4900	Kerio-Vpnlike-32Bit.exe	MSIEXEC.EXE
PID 4900 wrote to memory of 444	4900	Kerio-Vpnlike-32Bit.exe	MSIEXEC.EXE
PID 4552 wrote to memory of 772	4552	msiexec.exe	MsiExec.exe
PID 4552 wrote to memory of 772	4552	msiexec.exe	MsiExec.exe
PID 4552 wrote to memory of 772	4552	msiexec.exe	MsiExec.exe
PID 444 wrote to memory of 4596	444	MSIEXEC.EXE	MSI1B3.tmp
PID 444 wrote to memory of 4596	444	MSIEXEC.EXE	MSI1B3.tmp
PID 444 wrote to memory of 4596	444	MSIEXEC.EXE	MSI1B3.tmp
PID 4596 wrote to memory of 3900	4596	MSI1B3.tmp	regsvr32.exe
PID 4596 wrote to memory of 3900	4596	MSI1B3.tmp	regsvr32.exe
PID 4596 wrote to memory of 3124	4596	MSI1B3.tmp	regsvr32.exe
PID 4596 wrote to memory of 3124	4596	MSI1B3.tmp	regsvr32.exe
PID 4596 wrote to memory of 1832	4596	MSI1B3.tmp	regsvr32.exe
PID 4596 wrote to memory of 1832	4596	MSI1B3.tmp	regsvr32.exe
PID 4596 wrote to memory of 4092	4596	MSI1B3.tmp	regsvr32.exe
PID 4596 wrote to memory of 4092	4596	MSI1B3.tmp	regsvr32.exe
PID 4596 wrote to memory of 1292	4596	MSI1B3.tmp	regsvr32.exe
PID 4596 wrote to memory of 1292	4596	MSI1B3.tmp	regsvr32.exe
PID 4596 wrote to memory of 1884	4596	MSI1B3.tmp	regsvr32.exe
PID 4596 wrote to memory of 1884	4596	MSI1B3.tmp	regsvr32.exe
PID 4596 wrote to memory of 2740	4596	MSI1B3.tmp	regsvr32.exe
PID 4596 wrote to memory of 2740	4596	MSI1B3.tmp	regsvr32.exe
PID 4596 wrote to memory of 1308	4596	MSI1B3.tmp	regsvr32.exe
PID 4596 wrote to memory of 1308	4596	MSI1B3.tmp	regsvr32.exe
PID 4596 wrote to memory of 1308	4596	MSI1B3.tmp	regsvr32.exe
PID 4596 wrote to memory of 2180	4596	MSI1B3.tmp	regsvr32.exe
PID 4596 wrote to memory of 2180	4596	MSI1B3.tmp	regsvr32.exe
PID 4596 wrote to memory of 2180	4596	MSI1B3.tmp	regsvr32.exe
PID 4596 wrote to memory of 2248	4596	MSI1B3.tmp	regsvr32.exe
PID 4596 wrote to memory of 2248	4596	MSI1B3.tmp	regsvr32.exe
PID 4596 wrote to memory of 2248	4596	MSI1B3.tmp	regsvr32.exe
PID 4596 wrote to memory of 3360	4596	MSI1B3.tmp	regsvr32.exe
PID 4596 wrote to memory of 3360	4596	MSI1B3.tmp	regsvr32.exe
PID 4596 wrote to memory of 3360	4596	MSI1B3.tmp	regsvr32.exe
PID 4596 wrote to memory of 1384	4596	MSI1B3.tmp	regsvr32.exe
PID 4596 wrote to memory of 1384	4596	MSI1B3.tmp	regsvr32.exe
PID 4596 wrote to memory of 1384	4596	MSI1B3.tmp	regsvr32.exe
PID 4596 wrote to memory of 4548	4596	MSI1B3.tmp	regsvr32.exe
PID 4596 wrote to memory of 4548	4596	MSI1B3.tmp	regsvr32.exe
PID 4596 wrote to memory of 4548	4596	MSI1B3.tmp	regsvr32.exe
PID 4596 wrote to memory of 2640	4596	MSI1B3.tmp	regsvr32.exe
PID 4596 wrote to memory of 2640	4596	MSI1B3.tmp	regsvr32.exe
PID 4596 wrote to memory of 2640	4596	MSI1B3.tmp	regsvr32.exe
PID 444 wrote to memory of 5000	444	MSIEXEC.EXE	msiexec.exe
PID 444 wrote to memory of 5000	444	MSIEXEC.EXE	msiexec.exe
PID 444 wrote to memory of 5000	444	MSIEXEC.EXE	msiexec.exe
PID 4552 wrote to memory of 3312	4552	msiexec.exe	regsvr32.exe
PID 4552 wrote to memory of 3312	4552	msiexec.exe	regsvr32.exe
PID 4552 wrote to memory of 3424	4552	msiexec.exe	regsvr32.exe
PID 4552 wrote to memory of 3424	4552	msiexec.exe	regsvr32.exe
PID 4552 wrote to memory of 4648	4552	msiexec.exe	regsvr32.exe
PID 4552 wrote to memory of 4648	4552	msiexec.exe	regsvr32.exe
PID 4552 wrote to memory of 3864	4552	msiexec.exe	regsvr32.exe
PID 4552 wrote to memory of 3864	4552	msiexec.exe	regsvr32.exe
PID 4552 wrote to memory of 4556	4552	msiexec.exe	regsvr32.exe
PID 4552 wrote to memory of 4556	4552	msiexec.exe	regsvr32.exe
PID 4552 wrote to memory of 4664	4552	msiexec.exe	regsvr32.exe
PID 4552 wrote to memory of 4664	4552	msiexec.exe	regsvr32.exe
PID 4552 wrote to memory of 4860	4552	msiexec.exe	regsvr32.exe
PID 4552 wrote to memory of 4860	4552	msiexec.exe	regsvr32.exe

C:\Users\Admin\AppData\Local\Temp\Kerio-Vpnlike-32Bit.exe
"C:\Users\Admin\AppData\Local\Temp\Kerio-Vpnlike-32Bit.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4900

C:\Windows\SysWOW64\MSIEXEC.EXE
MSIEXEC.EXE /i "C:\Users\Admin\AppData\Local\Temp\{ABDF551A-3A76-4EE8-834D-7B3B52CE6B99}\kerio-control-vpnclient-9.2.2-2172-win32.msi" /Lmaeip "C:\Users\Admin\AppData\Local\Temp\kerio-kvc.setup.log" TRANSFORMS="C:\Users\Admin\AppData\Local\Temp\{ABDF551A-3A76-4EE8-834D-7B3B52CE6B99}\1033.MST" SETUPEXEDIR="C:\Users\Admin\AppData\Local\Temp" SETUPEXENAME="Kerio-Vpnlike-32Bit.exe"
2⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:444

C:\Users\Admin\AppData\Local\Temp\MSI1B3.tmp
"C:\Users\Admin\AppData\Local\Temp\MSI1B3.tmp"
3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4596

C:\Windows\system32\regsvr32.exe
"C:\Windows\system32\regsvr32.exe" C:\Windows\system32\vbscript.dll /s
4⤵
PID:3900

C:\Windows\system32\regsvr32.exe
"C:\Windows\system32\regsvr32.exe" C:\Windows\system32\dispex.dll /s
4⤵
- Registers COM server for autorun
- Modifies registry class
PID:3124

C:\Windows\system32\regsvr32.exe
"C:\Windows\system32\regsvr32.exe" C:\Windows\system32\scrobj.dll /s
4⤵
PID:1832

C:\Windows\system32\regsvr32.exe
"C:\Windows\system32\regsvr32.exe" C:\Windows\system32\scrrun.dll /s
4⤵
- Registers COM server for autorun
- Modifies registry class
PID:4092

C:\Windows\system32\regsvr32.exe
"C:\Windows\system32\regsvr32.exe" C:\Windows\system32\wshext.dll /s
4⤵
- Registers COM server for autorun
- Modifies registry class
PID:1292

C:\Windows\system32\regsvr32.exe
"C:\Windows\system32\regsvr32.exe" C:\Windows\system32\wshom.ocx /s
4⤵
PID:1884

C:\Windows\system32\regsvr32.exe
"C:\Windows\system32\regsvr32.exe" C:\Windows\system32\jscript.dll /s
4⤵
- Registers COM server for autorun
- Modifies registry class
PID:2740

C:\Windows\SysWOW64\regsvr32.exe
"C:\Windows\system32\regsvr32.exe" C:\Windows\system32\vbscript.dll /s
4⤵
PID:1308

C:\Windows\SysWOW64\regsvr32.exe
"C:\Windows\system32\regsvr32.exe" C:\Windows\system32\dispex.dll /s
4⤵
PID:2180

C:\Windows\SysWOW64\regsvr32.exe
"C:\Windows\system32\regsvr32.exe" C:\Windows\system32\scrobj.dll /s
4⤵
PID:2248

C:\Windows\SysWOW64\regsvr32.exe
"C:\Windows\system32\regsvr32.exe" C:\Windows\system32\scrrun.dll /s
4⤵
- Modifies registry class
PID:3360

C:\Windows\SysWOW64\regsvr32.exe
"C:\Windows\system32\regsvr32.exe" C:\Windows\system32\wshext.dll /s
4⤵
- Modifies registry class
PID:1384

C:\Windows\SysWOW64\regsvr32.exe
"C:\Windows\system32\regsvr32.exe" C:\Windows\system32\wshom.ocx /s
4⤵
PID:4548

C:\Windows\SysWOW64\regsvr32.exe
"C:\Windows\system32\regsvr32.exe" C:\Windows\system32\jscript.dll /s
4⤵
- Modifies registry class
PID:2640

C:\Windows\SysWOW64\msiexec.exe
"msiexec.exe" /i C:\Users\Admin\AppData\Local\Temp\{42132246-13E8-4264-86AB-38F4465A8FE4}\ScriptRegistrator.msi /qn
3⤵
PID:5000

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4552

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding C243AEB29E19F2BC88ED3AC97425DE17 C
2⤵
- Loads dropped DLL
- Checks SCSI registry key(s)
PID:772

C:\Windows\system32\regsvr32.exe
"regsvr32.exe" /s C:\Windows\\system32\vbscript.dll
2⤵
PID:3312

C:\Windows\system32\regsvr32.exe
"regsvr32.exe" /s C:\Windows\\system32\jscript.dll
2⤵
- Registers COM server for autorun
- Modifies registry class
PID:3424

C:\Windows\system32\regsvr32.exe
"regsvr32.exe" /s C:\Windows\\system32\dispex.dll
2⤵
- Registers COM server for autorun
PID:4648

C:\Windows\system32\regsvr32.exe
"regsvr32.exe" /s C:\Windows\\system32\scrobj.dll
2⤵
PID:3864

C:\Windows\system32\regsvr32.exe
"regsvr32.exe" /s C:\Windows\\system32\scrrun.dll
2⤵
- Registers COM server for autorun
- Modifies registry class
PID:4556

C:\Windows\system32\regsvr32.exe
"regsvr32.exe" /s C:\Windows\\system32\wshext.dll
2⤵
- Registers COM server for autorun
- Modifies registry class
PID:4664

C:\Windows\system32\regsvr32.exe
"regsvr32.exe" /s C:\Windows\\system32\wshom.ocx
2⤵
PID:4860

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\e581fcb.rbs

Filesize
1KB

MD5
ce2e4dd15ffdd64337b0b77058bab6a8

SHA1
bbd948a2ec5d989e3c1af51118fdd9e714ed3021

SHA256
27fd57000f033455e123f2a3d57f371acac9bd603e711feccbb01b455f807a83

SHA512
914012c4468402582bf994d092e89fb449f500dfef9eed55804974a7176705577e42467d410c22fe3c7fff0f393a1eb2ddcc320cd8703665660b150211c1f90b

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI106.tmp

Filesize
67KB

MD5
c57cd3678f1474e48022fedeba9d79b5

SHA1
2be5a313631900ce304964c007e0f51fc61899fb

SHA256
0e0d27421281af176a5bd2d45fce129536af43b14df521d476288749d29a526f

SHA512
67a422e3cec7fd4211165dd8a05e2191ae015a7580a934e7bb9d360de1d28d7196126beea15fdf54456bce18768f1cd7875908990e46028eb23b25e2efc2abd9

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI106.tmp

Filesize
67KB

MD5
c57cd3678f1474e48022fedeba9d79b5

SHA1
2be5a313631900ce304964c007e0f51fc61899fb

SHA256
0e0d27421281af176a5bd2d45fce129536af43b14df521d476288749d29a526f

SHA512
67a422e3cec7fd4211165dd8a05e2191ae015a7580a934e7bb9d360de1d28d7196126beea15fdf54456bce18768f1cd7875908990e46028eb23b25e2efc2abd9

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI1B3.tmp

Filesize
51KB

MD5
ef391367a7595d71e238a8a50cacc0dd

SHA1
95d877715a9e7c44cb9053857488d80dfe60eddf

SHA256
84026dc80fae91ca55d93814fcdcd34861670a15e9fad92a8656318aa6caa483

SHA512
7f74d1113d588e9ad557bd70cf1f8d5ea5546598e4c25b2ffdee5819791f8b81d3d5f046064ed127412f1b1641ba190ae34187241ae77767d3a94342a8a02ee4

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI1B3.tmp

Filesize
51KB

MD5
ef391367a7595d71e238a8a50cacc0dd

SHA1
95d877715a9e7c44cb9053857488d80dfe60eddf

SHA256
84026dc80fae91ca55d93814fcdcd34861670a15e9fad92a8656318aa6caa483

SHA512
7f74d1113d588e9ad557bd70cf1f8d5ea5546598e4c25b2ffdee5819791f8b81d3d5f046064ed127412f1b1641ba190ae34187241ae77767d3a94342a8a02ee4

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI30E2.tmp

Filesize
153KB

MD5
ecbc19c2eb3da66c6fa30a915cb62e35

SHA1
b9a415c2bbae73a42a885a5fdb58d17280e0a058

SHA256
7ee4d2137a9336aa6d137f3a7cc4f94ce0fbf2facac01901e57fc3fd94c36239

SHA512
603715f6409211c6d1f7e73f6ff0893fb22185dce2a990c47e9d450626bc15ee1dd26b820dedbe6b7bc1b6bffb358cfb9c55e54882cfceae254edad3d43fbaa7

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI30E2.tmp

Filesize
153KB

MD5
ecbc19c2eb3da66c6fa30a915cb62e35

SHA1
b9a415c2bbae73a42a885a5fdb58d17280e0a058

SHA256
7ee4d2137a9336aa6d137f3a7cc4f94ce0fbf2facac01901e57fc3fd94c36239

SHA512
603715f6409211c6d1f7e73f6ff0893fb22185dce2a990c47e9d450626bc15ee1dd26b820dedbe6b7bc1b6bffb358cfb9c55e54882cfceae254edad3d43fbaa7

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI31EC.tmp

Filesize
84KB

MD5
f22359af37a8dda48f2bb8d26a6d52cd

SHA1
a97e8178b7be2e6f940fa6b6335c21adb2502bdd

SHA256
ccf0a175142f15985082e3e7bc846010668d3980ecb2a0cffaacc651f51b46e6

SHA512
e2b72d5b98961329d123e5570afc4ffe7ba7b1db7cb3a840ee0a9eb703a2b6ac98055bc215df99d00aeb08441a1a907fb7041638fd736be255040a4e0fd38839

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI31EC.tmp

Filesize
84KB

MD5
f22359af37a8dda48f2bb8d26a6d52cd

SHA1
a97e8178b7be2e6f940fa6b6335c21adb2502bdd

SHA256
ccf0a175142f15985082e3e7bc846010668d3980ecb2a0cffaacc651f51b46e6

SHA512
e2b72d5b98961329d123e5570afc4ffe7ba7b1db7cb3a840ee0a9eb703a2b6ac98055bc215df99d00aeb08441a1a907fb7041638fd736be255040a4e0fd38839

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI31FD.tmp

Filesize
84KB

MD5
f22359af37a8dda48f2bb8d26a6d52cd

SHA1
a97e8178b7be2e6f940fa6b6335c21adb2502bdd

SHA256
ccf0a175142f15985082e3e7bc846010668d3980ecb2a0cffaacc651f51b46e6

SHA512
e2b72d5b98961329d123e5570afc4ffe7ba7b1db7cb3a840ee0a9eb703a2b6ac98055bc215df99d00aeb08441a1a907fb7041638fd736be255040a4e0fd38839

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI31FD.tmp

Filesize
84KB

MD5
f22359af37a8dda48f2bb8d26a6d52cd

SHA1
a97e8178b7be2e6f940fa6b6335c21adb2502bdd

SHA256
ccf0a175142f15985082e3e7bc846010668d3980ecb2a0cffaacc651f51b46e6

SHA512
e2b72d5b98961329d123e5570afc4ffe7ba7b1db7cb3a840ee0a9eb703a2b6ac98055bc215df99d00aeb08441a1a907fb7041638fd736be255040a4e0fd38839

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI322D.tmp

Filesize
281KB

MD5
6e25e03bc7ae8f808ebc6010c8d2954e

SHA1
f1f7f1cb7519ef64faaa1f96d0abe428640936a5

SHA256
33bddefa8769fc3fd4dab20118b627c775c7f8f9d24ded3f31925afa33da7268

SHA512
30022f795454f02b2872bbf20afb8b4a609a2a9aab1d1f42472b692aca132c9857b3c5eb6f0ea0a848d83d7cfe75e1e349d82284be00a551e3a4503b181b5884

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI322D.tmp

Filesize
281KB

MD5
6e25e03bc7ae8f808ebc6010c8d2954e

SHA1
f1f7f1cb7519ef64faaa1f96d0abe428640936a5

SHA256
33bddefa8769fc3fd4dab20118b627c775c7f8f9d24ded3f31925afa33da7268

SHA512
30022f795454f02b2872bbf20afb8b4a609a2a9aab1d1f42472b692aca132c9857b3c5eb6f0ea0a848d83d7cfe75e1e349d82284be00a551e3a4503b181b5884

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSIFFDC.tmp

Filesize
171KB

MD5
480ed917d4711aa9e3feb9ef3c1c468f

SHA1
fa71b59f35f0ee44d27f74917ef5a0da2797e80b

SHA256
482ffc4f87b78c3c7073983cf65b593d9f13f0a3d6dc54b4a3f616f79838f3ce

SHA512
b705cc06b1bb3d31354e2071e83eb5f034d219c984438768870c08f42acff82e335e19ccea0bcc2ad5c586f1c6183c439707ce9314ab11aa438c66a245ab2f64

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSIFFDC.tmp

Filesize
171KB

MD5
480ed917d4711aa9e3feb9ef3c1c468f

SHA1
fa71b59f35f0ee44d27f74917ef5a0da2797e80b

SHA256
482ffc4f87b78c3c7073983cf65b593d9f13f0a3d6dc54b4a3f616f79838f3ce

SHA512
b705cc06b1bb3d31354e2071e83eb5f034d219c984438768870c08f42acff82e335e19ccea0bcc2ad5c586f1c6183c439707ce9314ab11aa438c66a245ab2f64

Download Submit
C:\Users\Admin\AppData\Local\Temp\{42132246-13E8-4264-86AB-38F4465A8FE4}\ScriptRegistrator.msi

Filesize
301KB

MD5
0b2c849eb78e28b94cc62dd0773f8b7f

SHA1
d8508a88fa1b04b1c3e8ab5d0bb078cbbb3d2d7e

SHA256
0267473d1f2aa56ff9973745d17fcc43d2646ad03b86edbffc57ed900bf0c374

SHA512
e145313e3d2a60db130931d07f90b87a63e64777cf6ec08d65e6c70b4aa6c70499783404b49db0001dce69ccfa982340deefd2de4c73ca35ebad2d8a6f8b280b

Download Submit
C:\Users\Admin\AppData\Local\Temp\{ABDF551A-3A76-4EE8-834D-7B3B52CE6B99}\0x0409.ini

Filesize
21KB

MD5
8586214463bd73e1c2716113e5bd3e13

SHA1
f02e3a76fd177964a846d4aa0a23f738178db2be

SHA256
089d3068e42958dd2c0aec668e5b7e57b7584aca5c77132b1bcbe3a1da33ef54

SHA512
309200f38d0e29c9aaa99bb6d95f4347f8a8c320eb65742e7c539246ad9b759608bd5151d1c5d1d05888979daa38f2b6c3bf492588b212b583b8adbe81fa161b

Download Submit
C:\Users\Admin\AppData\Local\Temp\{ABDF551A-3A76-4EE8-834D-7B3B52CE6B99}\1033.MST

Filesize
28KB

MD5
1bd92aa0c14dc2f6f959d1046bd7fd6f

SHA1
b2b21a7108726c26791b8b0fbe569ea0b3893622

SHA256
0392fc540a1f2cfbec36c1460466ef435c8f82c4b161ad04f9710cd3e8206fee

SHA512
24aa9e1cc3e75a4cf21b1f67063d171ce2521dc4cf3d6bfc9cde89c062719111051742c0b9407e9162f2d8a5d175e7566b57e2caa5ca8aeb8beabbbb5bf7a792

Download Submit
C:\Users\Admin\AppData\Local\Temp\{ABDF551A-3A76-4EE8-834D-7B3B52CE6B99}\kerio-control-vpnclient-9.2.2-2172-win32.msi

Filesize
9.6MB

MD5
6febb0f20ae146d1c36253421f6e8d31

SHA1
43a4e9143a1c0594b4883ba78fd9daabe0ec3be2

SHA256
d5c0a5e45d2cd3c68d1f74cd77c9eea88404f11eb2a1b8bbc83c065274bf0145

SHA512
ee7029043ae96867635e5a5360ee439930e5490bc5b313d6fc48c506fa14306a6fed82399179281e3909b1190980cdb70afd5bcb32c0972e81fa24bf65e0c537

Download Submit
C:\Users\Admin\AppData\Local\Temp\~DC75.tmp

Filesize
5KB

MD5
14feb5199b4d7245804273422e8e73f5

SHA1
4f6f236aee0ead97659ac156ac29f0bafcdc51e9

SHA256
0795d9e731a218b3a67a5cd7efafc8e2473fdee0984dca9fc2602beb2dcb5672

SHA512
91dea0adbaa1f40745211356482bbf405f3b875db990d76b8ef778c70e31e73b1c4900029c7f4ab5930baddaf9c8af544fe917be4acb7c1177c492e4df7fbaf0

Download Submit