Overview
overview
8Static
static
1AMASS 2.0/...es.rtf
windows7-x64
4AMASS 2.0/...es.rtf
windows10-2004-x64
1AMASS 2.0/...es.rtf
windows7-x64
4AMASS 2.0/...es.rtf
windows10-2004-x64
1AMASS 2.0/...up.exe
windows7-x64
6AMASS 2.0/...up.exe
windows10-2004-x64
6AMASS 2.0/...up.exe
windows7-x64
8AMASS 2.0/...up.exe
windows10-2004-x64
8AMASS 2.0/...on.pdf
windows7-x64
1AMASS 2.0/...on.pdf
windows10-2004-x64
1AMASS 2.0/...60.dll
windows7-x64
1AMASS 2.0/...60.dll
windows10-2004-x64
1AMASS 2.0/setup.exe
windows7-x64
1AMASS 2.0/setup.exe
windows10-2004-x64
1Analysis
- max time kernel
118s - max time network
134s - platform
windows7_x64 - resource
win7-20240221-en - resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system - submitted
09/03/2024, 00:06
Static task
static1
Behavioral task
behavioral1
Sample
AMASS 2.0/AMASS/InstallationNotes.rtf
Resource
win7-20240221-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
AMASS 2.0/AMASS/InstallationNotes.rtf
Resource
win10v2004-20240226-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral3
Sample
AMASS 2.0/AMASS/ReleaseNotes.rtf
Resource
win7-20231129-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral4
Sample
AMASS 2.0/AMASS/ReleaseNotes.rtf
Resource
win10v2004-20240226-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral5
Sample
AMASS 2.0/AMASS/setup.exe
Resource
win7-20240221-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral6
Sample
AMASS 2.0/AMASS/setup.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
6 signatures
150 seconds
Behavioral task
behavioral7
Sample
AMASS 2.0/LicenseManager/LicenseManagerSetup.exe
Resource
win7-20240221-en
windows7-x64
16 signatures
150 seconds
Behavioral task
behavioral8
Sample
AMASS 2.0/LicenseManager/LicenseManagerSetup.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
17 signatures
150 seconds
Behavioral task
behavioral9
Sample
AMASS 2.0/Virus Scan Declaration.pdf
Resource
win7-20240215-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral10
Sample
AMASS 2.0/Virus Scan Declaration.pdf
Resource
win10v2004-20231215-en
windows10-2004-x64
6 signatures
150 seconds
Behavioral task
behavioral11
Sample
AMASS 2.0/msvbvm60.dll
Resource
win7-20240221-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral12
Sample
AMASS 2.0/msvbvm60.dll
Resource
win10v2004-20240226-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral13
Sample
AMASS 2.0/setup.exe
Resource
win7-20240221-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral14
Sample
AMASS 2.0/setup.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
1 signatures
150 seconds
General
- Target AMASS 2.0/LicenseManager/LicenseManagerSetup.exe
- Size 40.8MB
- Sample240309-adr99sac64
- SHA256 c5e754131691a1362d9f28ba77e6ab2aec76b3834796c54a63b44d2a66916774
- MD5 0b8af7b445e5eecf1674e198dcf422c6
- SHA1 d8c0025cf41f2e313b6382001a45594e65896cd4
- SHA512 d47617f496a7864260e94aacc7ff0c1b95b3ecb22981e09409da2bc4433a61a3ecb097053589fe58abc66eeb3c07f6f7b8d22f68aed5b2c5a94ecdc4fd1283da
- SSDEEP 786432:ZIxZMrefY33o5l6QHaiWdWL22938+uNqMkyH1pK1oHEgBN:YiegHo5psdWx8+uNnH1p2opN
- MD5 SHA1 SHA512 SSDEEP
Score
8/10
Malware Config
Signatures
- Drops file in Drivers directory 2 IoCs
description ioc Process File created C:\Windows\system32\drivers\hardlock.sys haspdinst_x64.exe File opened for modification C:\Windows\system32\drivers\hardlock.sys haspdinst_x64.exe - Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\U: MSIEXEC.EXE File opened (read-only) \??\Z: MSIEXEC.EXE File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\Q: MSIEXEC.EXE File opened (read-only) \??\L: MSIEXEC.EXE File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\A: MSIEXEC.EXE File opened (read-only) \??\J: MSIEXEC.EXE File opened (read-only) \??\W: MSIEXEC.EXE File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\E: MSIEXEC.EXE File opened (read-only) \??\O: MSIEXEC.EXE File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\M: MSIEXEC.EXE File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\S: MSIEXEC.EXE File opened (read-only) \??\I: MSIEXEC.EXE File opened (read-only) \??\N: MSIEXEC.EXE File opened (read-only) \??\X: MSIEXEC.EXE File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\H: MSIEXEC.EXE File opened (read-only) \??\R: MSIEXEC.EXE File opened (read-only) \??\B: MSIEXEC.EXE File opened (read-only) \??\K: MSIEXEC.EXE File opened (read-only) \??\P: MSIEXEC.EXE File opened (read-only) \??\T: MSIEXEC.EXE File opened (read-only) \??\V: MSIEXEC.EXE File opened (read-only) \??\Y: MSIEXEC.EXE File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\G: MSIEXEC.EXE File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\T: msiexec.exe - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\System32\DriverStore\Temp\{4bf0dffc-3c6d-7572-857e-fa05cb20837e}\SETA094.tmp DrvInst.exe File created C:\Windows\system32\setup\aladdin\hasphl\hasplms.exe haspdinst_x64.exe File created C:\Windows\System32\DriverStore\Temp\{6311d86d-dd87-2e2d-119d-1013b0e35418}\SET9149.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\akspccard.inf_amd64_neutral_9f93197096fa4fb3\akspccard.PNF DrvInst.exe File created C:\Windows\System32\DriverStore\Temp\{72fe96d2-9138-7fcc-8429-481b6ffe3903}\SET9C6F.tmp DrvInst.exe File created C:\Windows\System32\DriverStore\Temp\{4bf0dffc-3c6d-7572-857e-fa05cb20837e}\SETA093.tmp DrvInst.exe File created C:\Windows\system32\setup\aladdin\hasphl\hardlock.cat haspdinst_x64.exe File created C:\Windows\System32\DriverStore\FileRepository\akspccard.inf_amd64_neutral_9f93197096fa4fb3\akspccard.PNF DrvInst.exe File created C:\Windows\System32\DriverStore\FileRepository\akshhl.inf_amd64_neutral_69874431ab9bf72c\akshhl.PNF DrvInst.exe File created C:\Windows\System32\DriverStore\INFCACHE.0 DrvInst.exe File created C:\Windows\system32\setup\aladdin\hasphl\aksusb.inf haspdinst_x64.exe File created C:\Windows\system32\setup\aladdin\akspccard.inf haspdinst_x64.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{4bf0dffc-3c6d-7572-857e-fa05cb20837e}\SETA0E6.tmp DrvInst.exe File created C:\Windows\system32\setup\aladdin\hasphl\akshhl.sys haspdinst_x64.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{217132f6-c6e4-3dd1-ac4a-cb0122e50137}\SET9762.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{72fe96d2-9138-7fcc-8429-481b6ffe3903}\SET9C20.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{4bf0dffc-3c6d-7572-857e-fa05cb20837e}\aksusb.sys DrvInst.exe File created C:\Windows\system32\setup\aladdin\hasphl\aksusb5.dll haspdinst_x64.exe File opened for modification C:\Windows\syswow64\hlvdd.dll haspdinst_x64.exe File created C:\Windows\System32\DriverStore\Temp\{4bf0dffc-3c6d-7572-857e-fa05cb20837e}\SETA0B5.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\infstrng.dat DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\infstrng.dat DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{4bf0dffc-3c6d-7572-857e-fa05cb20837e}\SETA094.tmp DrvInst.exe File created C:\Windows\System32\DriverStore\Temp\{217132f6-c6e4-3dd1-ac4a-cb0122e50137}\SET9761.tmp DrvInst.exe File created C:\Windows\System32\DriverStore\INFCACHE.0 DrvInst.exe File created C:\Windows\System32\DriverStore\Temp\{4bf0dffc-3c6d-7572-857e-fa05cb20837e}\SETA0E6.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{72fe96d2-9138-7fcc-8429-481b6ffe3903}\akshhl.cat DrvInst.exe File created C:\Windows\system32\setup\aladdin\hasphl\akshsp53.dll haspdinst_x64.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{6311d86d-dd87-2e2d-119d-1013b0e35418}\akspccard.sys DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\infpub.dat DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{217132f6-c6e4-3dd1-ac4a-cb0122e50137}\akshasp.sys DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{217132f6-c6e4-3dd1-ac4a-cb0122e50137} DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{4bf0dffc-3c6d-7572-857e-fa05cb20837e}\SETA093.tmp DrvInst.exe File created C:\Windows\system32\setup\aladdin\hasphl\aksusb.sys haspdinst_x64.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{6311d86d-dd87-2e2d-119d-1013b0e35418}\SET9149.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\infstor.dat DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{217132f6-c6e4-3dd1-ac4a-cb0122e50137}\SET9740.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\infstor.dat DrvInst.exe File created C:\Windows\system32\setup\aladdin\hasphl\akshhl33.dll haspdinst_x64.exe File created C:\Windows\system32\setup\aladdin\hasphl\hardlock.sys haspdinst_x64.exe File created C:\Windows\system32\setup\aladdin\akspccard.cat haspdinst_x64.exe File opened for modification C:\Windows\System32\DriverStore\infpub.dat DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{4bf0dffc-3c6d-7572-857e-fa05cb20837e}\SETA127.tmp DrvInst.exe File created C:\Windows\system32\setup\aladdin\hasphl\aksdf.sys haspdinst_x64.exe File created C:\Windows\System32\DriverStore\Temp\{217132f6-c6e4-3dd1-ac4a-cb0122e50137}\SET9740.tmp DrvInst.exe File created C:\Windows\system32\setup\aladdin\hasphl\hasplmv.exe haspdinst_x64.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{217132f6-c6e4-3dd1-ac4a-cb0122e50137}\SET9751.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{4bf0dffc-3c6d-7572-857e-fa05cb20837e}\SETA0E7.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\aksusb.inf_amd64_neutral_b496304d4eb1ff2c\aksusb.PNF DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{72fe96d2-9138-7fcc-8429-481b6ffe3903}\SET9C70.tmp DrvInst.exe File created C:\Windows\System32\DriverStore\Temp\{4bf0dffc-3c6d-7572-857e-fa05cb20837e}\SETA0C6.tmp DrvInst.exe File created C:\Windows\system32\setup\aladdin\hasphl\akshasp.inf haspdinst_x64.exe File opened for modification C:\Windows\System32\DriverStore\infstrng.dat DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{6311d86d-dd87-2e2d-119d-1013b0e35418}\akspccard.cat DrvInst.exe File created C:\Windows\System32\DriverStore\INFCACHE.0 DrvInst.exe File created C:\Windows\System32\DriverStore\FileRepository\aksusb.inf_amd64_neutral_b496304d4eb1ff2c\aksusb.PNF DrvInst.exe File created C:\Windows\syswow64\hlvdd.dll haspdinst_x64.exe File created C:\Windows\System32\DriverStore\Temp\{6311d86d-dd87-2e2d-119d-1013b0e35418}\SET9128.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{6311d86d-dd87-2e2d-119d-1013b0e35418}\SET9139.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{72fe96d2-9138-7fcc-8429-481b6ffe3903} DrvInst.exe File created C:\Windows\System32\DriverStore\Temp\{4bf0dffc-3c6d-7572-857e-fa05cb20837e}\SETA0A5.tmp DrvInst.exe File created C:\Windows\system32\setup\aladdin\hasphl\aksclass.sys haspdinst_x64.exe File created C:\Windows\system32\setup\aladdin\hasphl\akshasp.cat haspdinst_x64.exe File created C:\Windows\system32\setup\aladdin\hasphl\akshhl.cat haspdinst_x64.exe - Drops file in Program Files directory 24 IoCs
description ioc Process File created C:\Program Files (x86)\PANalytical\LicenseManager\EULA.rtf msiexec.exe File created C:\Program Files (x86)\PANalytical\LicenseManager\haspdnert.dll msiexec.exe File created C:\Program Files (x86)\PANalytical\LicenseManager\LicenseManagerApplication_splash.png msiexec.exe File created C:\Program Files (x86)\PANalytical\LicenseManager\ReleaseAndInstallationNotes.rtf msiexec.exe File created C:\Program Files (x86)\Common Files\Aladdin Shared\HASP\templates\fr.15.1.alp haspdinst_x64.exe File created C:\Program Files (x86)\PANalytical\LicenseManager\PANalytical.XRX.LicenseManager.chm msiexec.exe File created C:\Program Files (x86)\Common Files\Aladdin Shared\HASP\vendors\97093.xml msiexec.exe File created C:\Program Files (x86)\PANalytical\LicenseManager\haspdinst.exe msiexec.exe File created C:\Program Files (x86)\Common Files\Aladdin Shared\HASP\haspvlib_97093.dll msiexec.exe File created C:\Program Files (x86)\Common Files\Aladdin Shared\HASP\templates\ja.15.1.alp haspdinst_x64.exe File created C:\Program Files (x86)\PANalytical\LicenseManager\Application.container msiexec.exe File created C:\Program Files (x86)\PANalytical\LicenseManager\hasp_windows_97093.dll msiexec.exe File created C:\Program Files (x86)\PANalytical\LicenseManager\PANalytical.SecureLoading.dll msiexec.exe File created C:\Program Files (x86)\PANalytical\LicenseManager\PANalytical.XRX.Licensing.Core_x86.dll msiexec.exe File created C:\Program Files (x86)\PANalytical\LicenseManager\PanEnvCrypt.v2c msiexec.exe File created C:\Program Files (x86)\Common Files\Aladdin Shared\HASP\templates\de.15.1.alp haspdinst_x64.exe File created C:\Program Files (x86)\Common Files\Aladdin Shared\HASP\templates\es.15.1.alp haspdinst_x64.exe File created C:\Program Files (x86)\Common Files\Aladdin Shared\HASP\templates\ru.15.1.alp haspdinst_x64.exe File created C:\Program Files (x86)\Common Files\Aladdin Shared\HASP\templates\zh-CN.15.1.alp haspdinst_x64.exe File created C:\Program Files (x86)\PANalytical\LicenseManager\ApplyV2C.exe msiexec.exe File created C:\Program Files (x86)\PANalytical\LicenseManager\LicenseManagerApplication.exe msiexec.exe File created C:\Program Files (x86)\PANalytical\LicenseManager\hasp_rt.exe msiexec.exe File created C:\Program Files (x86)\PANalytical\LicenseManager\Virus Scan Declaration.pdf msiexec.exe File created C:\Program Files (x86)\Common Files\Aladdin Shared\HASP\templates\it.15.1.alp haspdinst_x64.exe - Drops file in Windows directory 30 IoCs
description ioc Process File created C:\Windows\Installer\{49D650A8-F245-46A6-B41E-F68E5FB52B81}\ARPPRODUCTICON.exe msiexec.exe File opened for modification C:\Windows\Installer\{49D650A8-F245-46A6-B41E-F68E5FB52B81}\ARPPRODUCTICON.exe msiexec.exe File created C:\Windows\INF\oem2.inf DrvInst.exe File created C:\Windows\INF\oem4.inf DrvInst.exe File opened for modification C:\Windows\aksdrvsetup.log haspdinst.exe File opened for modification C:\Windows\INF\setupapi.dev.log DrvInst.exe File opened for modification C:\Windows\Installer\ msiexec.exe File opened for modification C:\Windows\INF\setupapi.dev.log DrvInst.exe File opened for modification C:\Windows\INF\oem3.inf DrvInst.exe File created C:\Windows\INF\oem5.inf DrvInst.exe File opened for modification C:\Windows\Installer\{49D650A8-F245-46A6-B41E-F68E5FB52B81}\ShortcutLicenseMan_B3A5EFFDDD314312A2CF874488528003.exe msiexec.exe File opened for modification C:\Windows\INF\setupapi.dev.log DrvInst.exe File created C:\Windows\Installer\f776884.ipi msiexec.exe File created C:\Windows\Installer\f776886.msi msiexec.exe File created C:\Windows\INF\oem3.inf DrvInst.exe File created C:\Windows\Installer\f776883.msi msiexec.exe File opened for modification C:\Windows\Installer\f776883.msi msiexec.exe File opened for modification C:\Windows\Installer\{49D650A8-F245-46A6-B41E-F68E5FB52B81}\ShortcutLicenseMan_ECCD81C95621472699D3D3C3C6F24B09.exe msiexec.exe File opened for modification C:\Windows\INF\setupapi.dev.log DrvInst.exe File opened for modification C:\Windows\INF\oem2.inf DrvInst.exe File opened for modification C:\Windows\INF\setupapi.dev.log DrvInst.exe File opened for modification C:\Windows\INF\oem5.inf DrvInst.exe File opened for modification C:\Windows\INF\setupapi.ev3 DrvInst.exe File opened for modification C:\Windows\INF\setupapi.ev1 DrvInst.exe File created C:\Windows\Installer\{49D650A8-F245-46A6-B41E-F68E5FB52B81}\ShortcutLicenseMan_ECCD81C95621472699D3D3C3C6F24B09.exe msiexec.exe File opened for modification C:\Windows\INF\setupapi.dev.log haspdinst_x64.exe File opened for modification C:\Windows\INF\oem4.inf DrvInst.exe File opened for modification C:\Windows\Installer\MSI732D.tmp msiexec.exe File created C:\Windows\Installer\{49D650A8-F245-46A6-B41E-F68E5FB52B81}\ShortcutLicenseMan_B3A5EFFDDD314312A2CF874488528003.exe msiexec.exe File opened for modification C:\Windows\aksdrvsetup.log haspdinst_x64.exe - Executes dropped EXE 3 IoCs
pid Process 2316 LicenseManagerSetup.exe 1996 haspdinst.exe 1684 haspdinst_x64.exe - Loads dropped DLL 5 IoCs
pid Process 2004 LicenseManagerSetup.exe 2624 MsiExec.exe 1996 haspdinst.exe 1996 haspdinst.exe 1684 haspdinst_x64.exe - Modifies data under HKEY_USERS 64 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs DrvInst.exe - Modifies registry class 24 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8A056D94542F6A644BE16FE8F55BB218\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\{B895E070-08F4-4BD0-8F67-28BA222FC013}\\" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8A056D94542F6A644BE16FE8F55BB218 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8A056D94542F6A644BE16FE8F55BB218\PackageCode = "9819A9F9D930DFE40A59A5B6DCD7CB82" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8A056D94542F6A644BE16FE8F55BB218\Language = "1033" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8A056D94542F6A644BE16FE8F55BB218\Version = "16973826" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8A056D94542F6A644BE16FE8F55BB218\AdvertiseFlags = "388" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8A056D94542F6A644BE16FE8F55BB218\AuthorizedLUAApp = "0" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8A056D94542F6A644BE16FE8F55BB218\SourceList\PackageName = "License Manager.msi" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8A056D94542F6A644BE16FE8F55BB218\SourceList\Media msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8A056D94542F6A644BE16FE8F55BB218\SourceList\Media\DiskPrompt = "[1]" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8A056D94542F6A644BE16FE8F55BB218\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\{B895E070-08F4-4BD0-8F67-28BA222FC013}\\" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\8A056D94542F6A644BE16FE8F55BB218 msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8A056D94542F6A644BE16FE8F55BB218\Assignment = "1" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8A056D94542F6A644BE16FE8F55BB218\ProductIcon = "C:\\Windows\\Installer\\{49D650A8-F245-46A6-B41E-F68E5FB52B81}\\ARPPRODUCTICON.exe" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8A056D94542F6A644BE16FE8F55BB218\InstanceType = "0" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\74559A0FED301D642BF03C3ACB81D5D9\8A056D94542F6A644BE16FE8F55BB218 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8A056D94542F6A644BE16FE8F55BB218\SourceList\Net msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8A056D94542F6A644BE16FE8F55BB218\ProductName = "License Manager" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8A056D94542F6A644BE16FE8F55BB218\DeploymentFlags = "3" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\74559A0FED301D642BF03C3ACB81D5D9 msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8A056D94542F6A644BE16FE8F55BB218\Clients = 3a0000000000 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\8A056D94542F6A644BE16FE8F55BB218\LicenseManager msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8A056D94542F6A644BE16FE8F55BB218\SourceList msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8A056D94542F6A644BE16FE8F55BB218\SourceList\Media\1 = "DISK1;1" msiexec.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2088 msiexec.exe 2088 msiexec.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2508 MSIEXEC.EXE - Suspicious behavior: LoadsDriver 1 IoCs
pid Process 468 Process not Found - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 2508 MSIEXEC.EXE Token: SeIncreaseQuotaPrivilege 2508 MSIEXEC.EXE Token: SeRestorePrivilege 2088 msiexec.exe Token: SeTakeOwnershipPrivilege 2088 msiexec.exe Token: SeSecurityPrivilege 2088 msiexec.exe Token: SeCreateTokenPrivilege 2508 MSIEXEC.EXE Token: SeAssignPrimaryTokenPrivilege 2508 MSIEXEC.EXE Token: SeLockMemoryPrivilege 2508 MSIEXEC.EXE Token: SeIncreaseQuotaPrivilege 2508 MSIEXEC.EXE Token: SeMachineAccountPrivilege 2508 MSIEXEC.EXE Token: SeTcbPrivilege 2508 MSIEXEC.EXE Token: SeSecurityPrivilege 2508 MSIEXEC.EXE Token: SeTakeOwnershipPrivilege 2508 MSIEXEC.EXE Token: SeLoadDriverPrivilege 2508 MSIEXEC.EXE Token: SeSystemProfilePrivilege 2508 MSIEXEC.EXE Token: SeSystemtimePrivilege 2508 MSIEXEC.EXE Token: SeProfSingleProcessPrivilege 2508 MSIEXEC.EXE Token: SeIncBasePriorityPrivilege 2508 MSIEXEC.EXE Token: SeCreatePagefilePrivilege 2508 MSIEXEC.EXE Token: SeCreatePermanentPrivilege 2508 MSIEXEC.EXE Token: SeBackupPrivilege 2508 MSIEXEC.EXE Token: SeRestorePrivilege 2508 MSIEXEC.EXE Token: SeShutdownPrivilege 2508 MSIEXEC.EXE Token: SeDebugPrivilege 2508 MSIEXEC.EXE Token: SeAuditPrivilege 2508 MSIEXEC.EXE Token: SeSystemEnvironmentPrivilege 2508 MSIEXEC.EXE Token: SeChangeNotifyPrivilege 2508 MSIEXEC.EXE Token: SeRemoteShutdownPrivilege 2508 MSIEXEC.EXE Token: SeUndockPrivilege 2508 MSIEXEC.EXE Token: SeSyncAgentPrivilege 2508 MSIEXEC.EXE Token: SeEnableDelegationPrivilege 2508 MSIEXEC.EXE Token: SeManageVolumePrivilege 2508 MSIEXEC.EXE Token: SeImpersonatePrivilege 2508 MSIEXEC.EXE Token: SeCreateGlobalPrivilege 2508 MSIEXEC.EXE Token: SeCreateTokenPrivilege 2508 MSIEXEC.EXE Token: SeAssignPrimaryTokenPrivilege 2508 MSIEXEC.EXE Token: SeLockMemoryPrivilege 2508 MSIEXEC.EXE Token: SeIncreaseQuotaPrivilege 2508 MSIEXEC.EXE Token: SeMachineAccountPrivilege 2508 MSIEXEC.EXE Token: SeTcbPrivilege 2508 MSIEXEC.EXE Token: SeSecurityPrivilege 2508 MSIEXEC.EXE Token: SeTakeOwnershipPrivilege 2508 MSIEXEC.EXE Token: SeLoadDriverPrivilege 2508 MSIEXEC.EXE Token: SeSystemProfilePrivilege 2508 MSIEXEC.EXE Token: SeSystemtimePrivilege 2508 MSIEXEC.EXE Token: SeProfSingleProcessPrivilege 2508 MSIEXEC.EXE Token: SeIncBasePriorityPrivilege 2508 MSIEXEC.EXE Token: SeCreatePagefilePrivilege 2508 MSIEXEC.EXE Token: SeCreatePermanentPrivilege 2508 MSIEXEC.EXE Token: SeBackupPrivilege 2508 MSIEXEC.EXE Token: SeRestorePrivilege 2508 MSIEXEC.EXE Token: SeShutdownPrivilege 2508 MSIEXEC.EXE Token: SeDebugPrivilege 2508 MSIEXEC.EXE Token: SeAuditPrivilege 2508 MSIEXEC.EXE Token: SeSystemEnvironmentPrivilege 2508 MSIEXEC.EXE Token: SeChangeNotifyPrivilege 2508 MSIEXEC.EXE Token: SeRemoteShutdownPrivilege 2508 MSIEXEC.EXE Token: SeUndockPrivilege 2508 MSIEXEC.EXE Token: SeSyncAgentPrivilege 2508 MSIEXEC.EXE Token: SeEnableDelegationPrivilege 2508 MSIEXEC.EXE Token: SeManageVolumePrivilege 2508 MSIEXEC.EXE Token: SeImpersonatePrivilege 2508 MSIEXEC.EXE Token: SeCreateGlobalPrivilege 2508 MSIEXEC.EXE Token: SeCreateTokenPrivilege 2508 MSIEXEC.EXE - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2508 MSIEXEC.EXE - Suspicious use of WriteProcessMemory 39 IoCs
description pid Process procid_target PID 2004 wrote to memory of 2316 2004 LicenseManagerSetup.exe 28 PID 2004 wrote to memory of 2316 2004 LicenseManagerSetup.exe 28 PID 2004 wrote to memory of 2316 2004 LicenseManagerSetup.exe 28 PID 2004 wrote to memory of 2316 2004 LicenseManagerSetup.exe 28 PID 2004 wrote to memory of 2316 2004 LicenseManagerSetup.exe 28 PID 2004 wrote to memory of 2316 2004 LicenseManagerSetup.exe 28 PID 2004 wrote to memory of 2316 2004 LicenseManagerSetup.exe 28 PID 2316 wrote to memory of 2508 2316 LicenseManagerSetup.exe 29 PID 2316 wrote to memory of 2508 2316 LicenseManagerSetup.exe 29 PID 2316 wrote to memory of 2508 2316 LicenseManagerSetup.exe 29 PID 2316 wrote to memory of 2508 2316 LicenseManagerSetup.exe 29 PID 2316 wrote to memory of 2508 2316 LicenseManagerSetup.exe 29 PID 2316 wrote to memory of 2508 2316 LicenseManagerSetup.exe 29 PID 2316 wrote to memory of 2508 2316 LicenseManagerSetup.exe 29 PID 2088 wrote to memory of 2624 2088 msiexec.exe 31 PID 2088 wrote to memory of 2624 2088 msiexec.exe 31 PID 2088 wrote to memory of 2624 2088 msiexec.exe 31 PID 2088 wrote to memory of 2624 2088 msiexec.exe 31 PID 2088 wrote to memory of 2624 2088 msiexec.exe 31 PID 2088 wrote to memory of 2624 2088 msiexec.exe 31 PID 2088 wrote to memory of 2624 2088 msiexec.exe 31 PID 2088 wrote to memory of 1552 2088 msiexec.exe 37 PID 2088 wrote to memory of 1552 2088 msiexec.exe 37 PID 2088 wrote to memory of 1552 2088 msiexec.exe 37 PID 2088 wrote to memory of 1552 2088 msiexec.exe 37 PID 2088 wrote to memory of 1552 2088 msiexec.exe 37 PID 2088 wrote to memory of 1552 2088 msiexec.exe 37 PID 2088 wrote to memory of 1552 2088 msiexec.exe 37 PID 2088 wrote to memory of 1996 2088 msiexec.exe 39 PID 2088 wrote to memory of 1996 2088 msiexec.exe 39 PID 2088 wrote to memory of 1996 2088 msiexec.exe 39 PID 2088 wrote to memory of 1996 2088 msiexec.exe 39 PID 2088 wrote to memory of 1996 2088 msiexec.exe 39 PID 2088 wrote to memory of 1996 2088 msiexec.exe 39 PID 2088 wrote to memory of 1996 2088 msiexec.exe 39 PID 1996 wrote to memory of 1684 1996 haspdinst.exe 41 PID 1996 wrote to memory of 1684 1996 haspdinst.exe 41 PID 1996 wrote to memory of 1684 1996 haspdinst.exe 41 PID 1996 wrote to memory of 1684 1996 haspdinst.exe 41 - Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\AMASS 2.0\LicenseManager\LicenseManagerSetup.exe"C:\Users\Admin\AppData\Local\Temp\AMASS 2.0\LicenseManager\LicenseManagerSetup.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2004 -
C:\Users\Admin\AppData\Local\Temp\{B895E070-08F4-4BD0-8F67-28BA222FC013}\LicenseManagerSetup.exeC:\Users\Admin\AppData\Local\Temp\{B895E070-08F4-4BD0-8F67-28BA222FC013}\LicenseManagerSetup.exe /q"C:\Users\Admin\AppData\Local\Temp\AMASS 2.0\LicenseManager\LicenseManagerSetup.exe" /tempdisk1folder"C:\Users\Admin\AppData\Local\Temp\{B895E070-08F4-4BD0-8F67-28BA222FC013}" /IS_temp2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2316 -
C:\Windows\SysWOW64\MSIEXEC.EXE"C:\Windows\system32\MSIEXEC.EXE" /i "C:\Users\Admin\AppData\Local\Temp\{B895E070-08F4-4BD0-8F67-28BA222FC013}\License Manager.msi" /log C:\Users\Admin\AppData\Local\Temp\LicenseManagerSetup.log SETUPEXEDIR="C:\Users\Admin\AppData\Local\Temp\AMASS 2.0\LicenseManager" SETUPEXENAME="LicenseManagerSetup.exe"3⤵
- Enumerates connected drives
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2508
-
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2088 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding DB3C81868D05DEF5DCDDFC17A51C5ED0 C2⤵
- Loads dropped DLL
PID:2624
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 9198C7A3DF43762453A7B649E9C0A0132⤵PID:1552
-
-
C:\Program Files (x86)\PANalytical\LicenseManager\haspdinst.exe"C:\Program Files (x86)\PANalytical\LicenseManager\haspdinst.exe" -i -cm2⤵
- Drops file in Windows directory
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1996 -
C:\Users\Admin\AppData\Local\Temp\haspdinst_x64.exeC:\Users\Admin\AppData\Local\Temp\haspdinst_x64.exe -i -nomsg -32to643⤵
- Drops file in Drivers directory
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Executes dropped EXE
- Loads dropped DLL
PID:1684
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵PID:364
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "1" "200" "STORAGE\VolumeSnapshot\HarddiskVolumeSnapshot19" "" "" "61530dda3" "0000000000000000" "0000000000000570" "000000000000057C"1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
PID:1108
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{184e38c0-aee3-61a0-e84a-7b4174d4da05}\akspccard.inf" "9" "62250386f" "00000000000004AC" "WinSta0\Default" "0000000000000574" "208" "C:\Windows\system32\setup\aladdin"1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
PID:2612
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{0cdf35b9-bcb0-75af-0cea-39534bf27b74}\akshasp.inf" "9" "6d1770e3f" "0000000000000534" "WinSta0\Default" "00000000000005C4" "208" "C:\Windows\system32\setup\aladdin\hasphl"1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
PID:2040
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{57054b9a-8eea-4d3d-5383-6f6be8d89f0a}\akshhl.inf" "9" "68e7fedb7" "00000000000005C4" "WinSta0\Default" "00000000000005CC" "208" "C:\Windows\system32\setup\aladdin\hasphl"1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
PID:2436
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{22d727ab-80aa-556f-72bf-c240173a2279}\aksusb.inf" "9" "686f4dfd7" "00000000000005CC" "WinSta0\Default" "0000000000000570" "208" "C:\Windows\system32\setup\aladdin\hasphl"1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
PID:1820
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\PANalytical\LicenseManager\LicenseManagerApplication.exe
- Size 20KB
- SHA256 416e8afc3ed2e11972ce1cec17b9edee3106e38a7e4710b615facd2bfc6bb395
- MD5 68373dea49681bf1d7eb22b18f6e484e
- SHA1 5fc48022539d444fb76ee91aef6c78fef134dbe9
- SHA512 4063f9de49b89a5537390bda15b91466cb10a5c74c2693c7a6827778e3fcfa18ebe4c3df9a4ce606870273290b57022506fe4343eae17b707d5fb47babe50be0
- SSDEEP 384:9VdmlCxx5ylCIoKAiKrB3e+YNy2BRP0Uixs55JNNzFwhhi:XdTVLyQDKxzsS3wh
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files (x86)\PANalytical\LicenseManager\haspdinst.exe
- Size 2.5MB
- SHA256 770ce7f461643ef5b45f0906c041837f910f86742bbe9c5aad320be8ecc947d5
- MD5 afcf12ce9913c0b6ed08bef743a09ba3
- SHA1 016845893d70c61193f7a6152e97212b99e5f5eb
- SHA512 f1085c2c30e0c4a1068b072c68dd421e635bcaca84f4f07f0ff81790b4aa52c71de97d8a60abbc4f007c5e67569ec5900894e117c932f20c134514306ce3da29
- SSDEEP 49152:Bw6tL+1Ta6kPwmxdT2hXfIL4/VKuSmP4YKHc77f1fkI5d:Bw6OTWImxR2tIL4dVcc7RVz
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files (x86)\PANalytical\LicenseManager\haspdinst.exe
- Size 1.9MB
- SHA256 67af2bd33348410a77c5586b7558825e8d3541ef71b300e66d05494707aea641
- MD5 8d8252b33a3826894c5efada84bde781
- SHA1 b64fcb04962d62ed08e914fb5d1a0f13db7a864a
- SHA512 142e49b039a3f4b0db93d5de2630ac725aeb7bfae0619c57f44bfdd999b835a53c44ab1de69b6a313a601e75c78dba3c38af579f80ad0a9c46f9eb9737afe72c
- SSDEEP 49152:Bw6tL+1Ta6kPwmxdT2hXfIL4/VKuSmP4YKHca:Bw6OTWImxR2tIL4dVcca
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\0pdc.txt
- Size 4KB
- SHA256 aa9223ed8ab7ab3e555242dcc62cd25c63f129522150f56425da7740bb24e529
- MD5 175c58d6c736ddd3cec0d3fe8e29b115
- SHA1 2a0ddc74ab6d53931a66643c9d9d5de7865d5338
- SHA512 32eb8af3bdba3251b70c03b2f402fc41e47178eb2c754fc9c408d7badd06af9d21e063f2673a022ca7c9bcc26eb6616ea205c601787ab0b75d1c59e70aef8e58
- SSDEEP 96:ZMbE5znzKzqzbPMBpBrBawC0sBxByazPzRzCWRtMl+yDzMz6kzIzXQkAkvRQ1tkx:ZMmz6abNbdCWRtMl+ynU6MogjMAto
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\LicenseManagerSetup.log
- Size 7KB
- SHA256 f0376ff3916cf912d120442b0ce2a8adcec42e01ba993549bf24734f8ba5f3b8
- MD5 b802dab750d9993ca74b8834f2fd1214
- SHA1 f1b100677c28c0e4511408da56332f9eaebd1ebc
- SHA512 f03e9c0d3d114353d9cafac592ecb232f8759b2cd31f3eb253139e11ac8c716c5552f52aef81549b3c081a9e3ada14d4dba9bbbe02fa779a17adb0b8d2e5b6f5
- SSDEEP 96:WjOR8mz8QujnUS/G+v/wkBSgMVYVsk6MV4MVi6kmQgHgFrnkYwkGknMuX8Wi0KVk:iOGm4Qujf/GU/yCRpiFBrIbVZW
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\MSIDBED.tmp
- Size 165KB
- SHA256 1f6f0d9f136bc170cfbc48a1015113947087ac27aed1e3e91673ffc91b9f390b
- MD5 b5adf92090930e725510e2aafe97434f
- SHA1 eb9aff632e16fcb0459554979d3562dcf5652e21
- SHA512 1076165011e20c2686fb6f84a47c31da939fa445d9334be44bdaa515c9269499bd70f83eb5fcfa6f34cf7a707a828ff1b192ec21245ee61817f06a66e74ff509
- SSDEEP 3072:jqSoP/44Yvge5XKhpKJJdu+ew+BZPHbN2e9n2p+:j5g/ve5XKhMVJSIun6+
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\haspdinst_x64.exe
- Size 232KB
- SHA256 3ee76fb632db4cfe47985af0ca6cd97c89d2dd2bd78ee58582e0e32c76ef658c
- MD5 063cc80dffcc966e678688abed0c170e
- SHA1 70fb018244d6142572c7f791744ec963b92fd0db
- SHA512 1cc777228e756e8739a95bc01f27109c10ae213976a61563db221771bbb2b16d0275527ea2b0f8776b5b8de28ea52d9a1ca536aaf1a3d12b32b8b78fc084b429
- SSDEEP 3072:CGglkgpASD/qhaih3ycxHcF3sis5c4Zn6yKsqP4OIDJbLPNDlT/+IkgneWedv66c:FgpvbqlhCs8BsDnVXvNkBgeWm8mJA5
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\haspdinst_x64.exe
- Size 99KB
- SHA256 2656d42089afa58ebaba43afa4e556e49f86b0484e1140398d3b70ba361f414c
- MD5 956a0f78a57e486bee0e3c002dc7fff9
- SHA1 a6f9faa7a4eeb4d42df6380c4aa6d809102e8c21
- SHA512 3734e8dd25866ac1145793f75b3a9e82629808512ccf0ad9c843e1f1cd7fbf8dfed7da8d49ab374f631c7d4046c6e04589967c94d336d12f226079dd0b94318e
- SSDEEP 1536:CeUmgy/T4kgkZqASD5kXMX6haih3ycddOpanHcC6TjRKCJs/:CGglkgpASD/qhaih3ycxHcF3sis/
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\haspds_windows.dll
- Size 3.8MB
- SHA256 28037eb983b014ead2877ec39f1785ba054af5226cbe51c2287576dbb532d0b8
- MD5 a6d9a030a2ab087745fe521e0988a4a6
- SHA1 a6c6e1e9423769220e2409669d0ace96d0165b67
- SHA512 4b0bc37969f2946137aa6f4043bbc06c75415d1a1b13ab141645e088c06bedd20d187fc7a9eb2732686638617e26f7a20bce8065fa28f2e9877af6f31f396ea7
- SSDEEP 98304:j6OTWImxR2tIL4dVcc7RVyklj3mTxqY9ZkyE:gImcVcEnPhmTxtWyE
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\hhl01.cab
- Size 1.6MB
- SHA256 8cd678296a9ad8816e554e835f82443c3961ab34b8b7e7e911395f01afa680ce
- MD5 3ee3970eef722f7df4ccb4160fd83f4f
- SHA1 6a939f4b2ba17502b8c407a7ecc3b21f66afa956
- SHA512 dfa14c4658d12fb78241e1cd5a43ea6bb6719fbc3c93e2c6ed0dbf7edb965a26a1a5a4d74ea499d4c82b01903b4aa5c3aec547a57f1955f27b4cb5ded2df9989
- SSDEEP 49152:GoxCu2cfNID6pSmeWnCuOjZHWrsBqEwzoJf:mcNnp+yC7j9WrDEwg
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\hhl01.cab
- Size 1.2MB
- SHA256 a8c30015987f5ef405c4b67995bcf7eaf3b26d2271b94ac03b517ff5cb5221d2
- MD5 8bd65f8c333a47c195f25e2bea69e391
- SHA1 c6145596914288ddd9066a49931dba12182857d8
- SHA512 f007afeec54769cd5dc89ab83fbde3ed949736007777814b390ab75b0abf63ff07f3291f13118bde2e2d22674245d185b762dfabf35b242bf42ef85152cdbbe8
- SSDEEP 24576:/OK7x+z10yDu2cfNID6LVS9AeXrJkDsuj2uOjoAHjaorSFJSCvA+:GoxCu2cfNID6pSmeWnCuOjZHWrs+
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\{0cdf35b9-bcb0-75af-0cea-39534bf27b74}\akshasp.cat
- Size 9KB
- SHA256 f4739fca522e29627af4ae3eb8149fb89ddea18631cd1f9ba29deb2e845f353a
- MD5 db676cf7da13308a53380addcf2d273c
- SHA1 b61190e5ca0569d092ff0470daebec584814931e
- SHA512 7a41bbbfa7b1ae01792c043e7c677902cca398c98b77e781f49ccdc8a8cd86ada70809c49fe36b9adc925369251c78968289e9c04460d267debdf0675c5d9766
- SSDEEP 192:ay7b2zIg5n6SJxMWEhV0+3Ef5KYpBjSILw+:m5n6FTu+3Ef5dpBjJc+
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\{0cdf35b9-bcb0-75af-0cea-39534bf27b74}\akshasp.inf
- Size 2KB
- SHA256 2083bca634feb5c9faf3eb2a4488ac1faec2bd36f6c6de53277be528509a3e7c
- MD5 34f5a5f56ddea6ef57022046d5c03e8f
- SHA1 62de609029398186648359815e68ca9e3fdcc2cc
- SHA512 9ff5390f9ffd73df2f7963d252ea5d09590bdfe2be3c340535c9cc2d845abe15d2a3a37781a9466bb6cd34c5749625ab86a01624be4a7cf32ef861cc3b6f8dd9
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\{22D72~1\akshhl33.dll
- Size 97KB
- SHA256 de4fc9061f041da384beca71a635a3a8354a7712d6de9570b47701e4ccbf8152
- MD5 e386d261d205cc3347158a2735712205
- SHA1 4a1d8b960625a6180c841a957976d1b69b6abf16
- SHA512 da3d144fc1bab90adbc96045ab54ab3d3a709856e7c5f347bc5c10f8eef21b69de55099367ff9f8693b4edddf76653831670c7fa061fdc43874ea8cee34d7892
- SSDEEP 3072:GgJZjKXXMokHtMwmvgKKyizohiJXaIYDn:GgJowHtMDIW7G4T
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\{22D72~1\aksusb.sys
- Size 126KB
- SHA256 8d5c450cad28370b16a5b6e6947f696d3ce8e52dcd5755f237c02693171c46ce
- MD5 4e43b78ceb34ad96cd6064d3669e7100
- SHA1 b95424a00bfb035ee79f17bd0ba1190111701ffc
- SHA512 8a15ae44d176d5a6ced38a16ad5e73b5edce8b6afa8a42a398b4f718864bcc4e7109ac6c2bab2cd908381a3f63c2e9b2eed77d076a5cd0ca782e3c70837a066f
- SSDEEP 3072:fpslGpeborFBE5G6Leg2tNUgvPuCudmXgh5SdXS2HLA:fpslGpebuFS5Og23VPuHsXK5SdK
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\{22D72~1\aksusb5.dll
- Size 83KB
- SHA256 4b08d0175a95be1f690f61f670beb4df09753687c11a63cf1cc2721914f28b98
- MD5 e50384bf37447f1ff7cf8119445db156
- SHA1 75838665599fe70fa5a486ddd6d1a6a61622e47c
- SHA512 455cf5172b0e39e407f1b121be8b8c3cf8f191f33c2eaacab839f6caf21cf9e46b97b168a6385bdf5fadde2900443b8fadedc60f1b06194b27ada318695c57f6
- SSDEEP 1536:4cICgAFwhtXcKTstLJdawIPt1KIF8mZen9CWLJjTdILpb1cV:4eaMKYtld0rKIF8mCCWLJjTdILIV
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\{B895E070-08F4-4BD0-8F67-28BA222FC013}\0x0409.ini
- Size 21KB
- SHA256 8b76df0ffc9a226b532b60936765b852b89780c6e475c152f7c320e085e43948
- MD5 a108f0030a2cda00405281014f897241
- SHA1 d112325fa45664272b08ef5e8ff8c85382ebb991
- SHA512 d83894b039316c38915a789920758664257680dcb549a9b740cf5361addbee4d4a96a3ff2999b5d8acfb1d9336da055ec20012d29a9f83ee5459f103fbeec298
- SSDEEP 384:CTmyuV//BiTbh/YgAwC2WrP2DBWa/Oa0Mhs+XVgv:CT6V//BiXh/t/lWr0aa0Mhs+XVgv
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\{B895E070-08F4-4BD0-8F67-28BA222FC013}\License Manager.msi
- Size 1.0MB
- SHA256 d78f526b44c9fef94aaedc50ddc1080f94e988aa445d35208b3cd60530097c43
- MD5 8ebedb0454dbb684de6d994e8bd96196
- SHA1 43e249a827374bec3ed0d37fcd3d632c26b51e70
- SHA512 2a56cddee9800154549e8748912ea7b9ef83719bb513195740151a6e2fab30e71cd0ce3c27caa546ff935b35c690d5f95e954e8d92f67af879fa94b9fed69427
- SSDEEP 12288:kBPApBmDvqA6BPd06y2paiWdmt1ifKYy6V1kMQJmnz/:kBPCSvqq6yy17Yy8Qsz
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\{B895E070-08F4-4BD0-8F67-28BA222FC013}\LicenseManagerSetup.exe
- Size 582KB
- SHA256 621231af077227ecfec82a549ea1ada09a082cbf470c132f543146332f93dfe7
- MD5 98b5c039e2a71650c8e14213f6ad0e99
- SHA1 b34ce065c2028f65dac58c5fc069165ffbcdf6e2
- SHA512 78a8b6fcca06c24bf580ab4fb9fd9e11b4cf1f6da1172318bef197e4e333ca73f098e988a25636078eb25d903206e640bee097c26fed21d01561487b02f3fda8
- SSDEEP 12288:peZXdu97w0dDVfYGTV1LKH7beciYqpLqvz1jhOh4oeA1KYCMY1xGEaDn5ndU2Vbu:peZXdu97w0dDVfYGTfMeciYOLqvhM4oM
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\{B895E070-08F4-4BD0-8F67-28BA222FC013}\LicenseManagerSetup.exe
- Size 542KB
- SHA256 de7df224adfd6ae47d7f5c500e19473a476de54abfd50b54a329e582840c8ff5
- MD5 eb0c60a079f2ac672f65377a22d22195
- SHA1 14745fbdabc350efcd76433d778fc3876a03a900
- SHA512 1124fabe62cd7b57aad5daf4fc5638c517735c0112d5d2947cb507c3bdb738b4938ee31ad5916a281e3ba3d6b582e5181d797a48b3ff5207eef7c25755ec584f
- SSDEEP 12288:peZXdu97w0dDVfYGTV1LKH7beciYqpLqvz1jhOh4oeA1KYCMY1xGEaDn5ndU2VbQ:peZXdu97w0dDVfYGTfMeciYOLqvhM4oy
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\{B895E070-08F4-4BD0-8F67-28BA222FC013}\_ISMSIDEL.INI
- Size 648B
- SHA256 1ded0b798723858168e08d345a0ca40c0b6f51ab2148427c69e82ab50d933d4a
- MD5 7b1c65d183bce6ec90163f887bec552c
- SHA1 7724ccd8adeefdb52182028126fbf0505767478d
- SHA512 86ccb9c390b2202148db7abfbea74edf9e2d286268d8f24c649af63803fe24c79a516ab4996f69e35df8688ce0374485312a702bb7836cd7d95e43f2c68af8f8
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\~C2E4.tmp
- Size 5KB
- SHA256 f5d115bd6743167068e550f5b5a81d915762b3ca6b052e322defd64ac69ed070
- MD5 1315aa99778e319357eaa30728fb3369
- SHA1 0c3610795869eabba7bf113e6b64434caf049148
- SHA512 47d3ae5200941b4211e6cef2977f4b0ed3f2b12cd514134041c6cda9d9c6f89a31ee0c7907611977d2c1df7623681d2373fc21f4396cffe10be5c608b6171d71
- SSDEEP 96:rEhkMgVE8Sj7qJBE8fON/XsEbFWaEPRhS+gWPQPgWRGTwQbPrvnp6kY05w7tCYOC:Yh28QicuQaEZhdxoIWRGcQbPr/p0050D
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Installer\f776883.msi
- Size 3.1MB
- SHA256 fb47c92f7578e7cdbde1909f511a0ba83599e337d7363120e90d3bfa3b5051c6
- MD5 b09894803074aa0a298b6ef2994092d9
- SHA1 88d929dac425f470f4c78701fdc6086e43c2e65b
- SHA512 7638651013fb4d9b46fbb1a52f8f11abc8c7ccc86c82836a6b6a36546fa42571ee3e663ff03f0fb97aa48543ca2d72bac403a6249442c455a7670d600974d23e
- SSDEEP 49152:kBPCaqJZ17Yy8QscwLQ9iusJaJGT7Bg2PlY+9C8k3ZJfJKpcbi8O7lc:xaq9Yy8sv9in1dY+fQvmvlc
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\System32\DriverStore\INFCACHE.1
- Size 754KB
- SHA256 c061ae5c3bdc9467a22508640564507e63104b3f5cfb4a9a57d2737fc1252edb
- MD5 9c5ac229b41dcc10ab9f6e8ff140e1be
- SHA1 e1f3008a9dbe60f8ac76cd672f58f8674971b977
- SHA512 d1582f09f8588af683783d41211c44095ae4444e89bdc7df3c23d1468f31a9b3cac00351ea67a4e658e5019fa5b715516e0d51af41bbeef8dce4501b94ada0c3
- SSDEEP 3072:xyygDu1MIuyhDhOxRQwkBWWDaLSFowKAxaoZTMGKYPHXwznAOEXkErBNndiEHFCl:xyxIuyhDhoAhMGxPHgu4Z3oi
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\System32\DriverStore\INFCACHE.1
- Size 1.4MB
- SHA256 41d5e0fe1e8529c64ce9e42f98cc634faa881edb79c515d175453871c1cb82bb
- MD5 e61c827657f00bc92aabc242fb68812b
- SHA1 20624e2af1a40153bb2db79b1224ea5c637407e5
- SHA512 1b4dfb342f12e9b81265935b9c529908aea22cc97910bc368c2cc575c965049355e2fa2e94af8e3a7d4f944399625b39ae551db8df431a1f5cb434988018fc11
- SSDEEP 6144:Fyx0uyhDhoAhMGxPHgF4Z3oLbj8KNVlKi9ai0oQgq/U5UwDsVBGkrnCsH0lyIN:FyvyhDl5e2GN39zzdq/UyVskrnhoN
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\System32\DriverStore\INFCACHE.1
- Size 174KB
- SHA256 fc34a88f8cf3d02a65d2f346bd1e4a75732d422c89ca9d58a808d38969a1a8df
- MD5 472b56c0bf7e64b6be17ecc9a6c1784e
- SHA1 6433a74749116ea3d58eee9ad39300fe975f3a06
- SHA512 d8d2657369d16405b3b75d1b854f348d28b623a5c1daac54555056804674066b41fe9bae89fa23af1b7fe1f7f9eaae1ffbd7c1415ad4e96a62056d2a3a5f4319
- SSDEEP 1536:5XyFWhqUhtlLhSY6EDVsu1WdRSmKOu7ayhDhOxyD:ByygDu1MEuyhDhOx+
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\System32\Setup\aladdin\akspccard.cat
- Size 8KB
- SHA256 287479577e22d62d5ba7e683a856ba87c73826a98db19c6603de2403d1668c89
- MD5 c8556048ba9510f2059f9bb72a85d4ae
- SHA1 5dc717acf2924248aaa08565579ecb2793352c87
- SHA512 06fa5f01adc9d0d86c87c80b682f8d049d83920491a59bc2a539f2a8b8b76de8be36cbe245ff384945e0b21a849dc31214357b4c05a3c524cf41b41f12f35ef7
- SSDEEP 96:0jcPymHDWzygOzQMLy+Cgzdew5mog+MSNWDPDaxDPDaFOgkHDPDab3vADPDaiuDj:0jcPdjWzygEL/CldolMGogivcMPuw
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\System32\Setup\aladdin\akspccard.inf
- Size 2KB
- SHA256 c3bf22bb08752a8c732049c64060669c80d6d6539db16f701f4ba9b09d828325
- MD5 1c5e9dea337306dea633ac711ef94e6f
- SHA1 ddd3e218df64b9279944a0fc027f568bca680217
- SHA512 b34d1d3e2976adf1c70490023511ce3d93dd0bae90053e6acd452c2e40045f9ac96eac1760776aa8d94b031b0e4d10fd61bd91f2fa4de878de5f1d03a406ea17
- MD5 SHA1 SHA512
- Path C:\Windows\System32\Setup\aladdin\akspccard.sys
- Size 20KB
- SHA256 50eb9b01cbc8d1263ba39a8f9410abe76342516ce1cd01abaebe784abe1a39eb
- MD5 30d81e838a6494a57be79467076b0d7a
- SHA1 29d7e2bd588591e89cb33d7d4788f4fa64871423
- SHA512 5cd7de34b5dbd87513e1a2fca6174fb5c103785e97d93bff7c5c04e81c0ada0c6632559ecb7191b177408976c173a865e39c03ebb60ef9bfa18e8feec113f0e7
- SSDEEP 384:qnukNA9zgL5N27eqPV75FTXdgG0m1wgHIVD7hj8JffeJ2jp:koeK7r1XuG31voB7aJf
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\System32\Setup\aladdin\hasphl\aksclass.sys
- Size 30KB
- SHA256 740bffacf2f383c9e5180203adc7fcb8476df876a1097791b97cea8d7689c11a
- MD5 c9fe36d2bb921a06a0e6b247273734ab
- SHA1 4c552e3097d238455668b2e0173d19e942254431
- SHA512 703568c05193c1289469bc59d9596d42439f433e6e67e37f7135df232abf5766b51407016f691cb6dd5be1beb97324c73caa9df9ab5c3844dceb982a9d046bfb
- SSDEEP 384:qavn4Os0m1by7h1CYCR+tX08E+dtP21QvWuZsHL7y0FREKPp1x09l5Pq4S:qav4131byl1CYMA09tF3Ppqq4S
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\System32\Setup\aladdin\hasphl\akshasp.sys
- Size 67KB
- SHA256 3c635791b9b514a152ff9b3a853458864acdf668ba72d4a8b2840619ad93055b
- MD5 f1adc7ded5184045a47e02a85bf2917c
- SHA1 2f3711aeb6e50d1c35040acaecbdc6aa930719dd
- SHA512 40161eb931c3fe7a2af2060e5f7ed3cd608bd61377112e73a6a0d7c114ea9cfd60ab01a609628f4c1d70a68d097113efd78cd26a5ed127c517c74cc56ea9e17f
- SSDEEP 768:1SGvt4KR8imLJyaD4t/+pLbc6TAhVx9X9hnMiMFgleQL9WXLNbhxGWe3IuYx6jo5:iD4iTu9X9hnMixpL9cbHaIbFJVVHeM
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\System32\Setup\aladdin\hasphl\akshhl.cat
- Size 9KB
- SHA256 e097b13d615ed6874e95954393017ca2b357f05ee164d5588d02545d842b5ae2
- MD5 545a0bf637f55a48972780dbf58c8d55
- SHA1 1f5369492f34aa3088b6e1433a81e1faff1d32ce
- SHA512 7f2c122653f74e1e166488d0ca44827e5ec3cfb19b36c38550c36f956155e02e2f73364b814219492703943f2ab139c3758ee63eb3b9ad8a86ff3431028584c1
- SSDEEP 192:pRXcbb2zIg5F+45WEhV0+3Ef5KYpBjSIVsuq:pRB5Q45Tu+3Ef5dpBjJquq
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\System32\Setup\aladdin\hasphl\akshhl.inf
- Size 2KB
- SHA256 758192f976302955fa8130ff85a0b459ac7a5df2ff05cf258c7255a5d4697dd5
- MD5 c46095c8fbad763043c03e7333cedbcc
- SHA1 1e854d5a5ad0e4f8c77d60b08aa9f2732bbf0e02
- SHA512 a93442a716dd58eeb710270f4a0f4d3175f3cbd0b6121ea60b1233a792a59548e7ab0417d0409c49064e649aec423c4ac9583632284792ff31d5b68d67f3bb29
- MD5 SHA1 SHA512
- Path C:\Windows\System32\Setup\aladdin\hasphl\akshhl.sys
- Size 66KB
- SHA256 4a80438e8c8aa89b9e356fb9320b57d7c01c9b1ff66e7b8fdf69d4022024750c
- MD5 d885a9cd59ef699df92d163a365119ec
- SHA1 0080abf2536cbf47f2c656483f41debaa99ab996
- SHA512 4bbaba4f3b7aa570855e20352293523cfbfcbf8d615fd1593e032841ae5e41ad05c981efdbe2fe3cc34f813b27e6e6e523b34abb32bd3606472d5c441eb5ac23
- SSDEEP 768:nS2ceBUGPclKGt3hwu4mUhoibbb+S4AJKqBz8MZE2HYXVUiPGpc6pq9:qeBUORGtS8ibbb+S4A3+2Q3GpcR9
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\System32\Setup\aladdin\hasphl\akshhl33.dll
- Size 273KB
- SHA256 046b84032596cf064c28cfb40ab839f484304a9e8e8c05c32c09cf875b5a922b
- MD5 6b7146812b4d8d282a55bb58aebe1106
- SHA1 4ea6cd560bdc5c2a0a9703267b5aa05997a7c32d
- SHA512 17c4a91ba9d4addca449696579bed70074c4a9ec559bae5879aea71fb616450a33867d60154bb262fcd8dc29c829dbbd86361892295c2f75e0736af9f8283af2
- SSDEEP 6144:GgJowHtMDIW7G4mAlsgXx+yMagAumU6suMYNH:GgJowyIyUagpr6d
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\System32\Setup\aladdin\hasphl\akshsp53.dll
- Size 72KB
- SHA256 488a800297c3357e855937730a51ac61fce86ef42d34c467c1109789f1fab385
- MD5 a462556de56256e4e27a92e84f16e0b6
- SHA1 b333a7df15d813ca3a4ee7caa897be7657322946
- SHA512 b3876d96b36ff89e1e1b6ea5a340086b98f1ff2f0de8f86b221372198d3f4820ae3c168b1332b5292672390757ed13b6df47099023d7502a2de639c6b80a558c
- SSDEEP 1536:L2zn+h9Vfx1DeOW6jks947wBGUTXGB7OrJ1TNI4tJuNoZ+lA:LjBfx1Pjd47wBGmeOrJ1TNI4tJ2NlA
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\System32\Setup\aladdin\hasphl\aksusb.cat
- Size 11KB
- SHA256 a71d9d4ce4ed79325fb708502c8e3e3adf3dd6b36e0acd878150cbd32396a5cf
- MD5 0dc3fd5d19ebd6c1525c547fbf5a9d0d
- SHA1 2f50b13a9380b85096bbe42b26a2cba8f6607daf
- SHA512 894b578fb0195b1336c69a953fa3fc5db89b63b68cfdcda8a4498fe30518fe5df2ac9326f5b81324ce23b5c68892bfb1c49c3d32b1d1cab03e70e94d71b967c9
- SSDEEP 192:5NZYtcv4Tfb7b2zIg5R1rYZWEhV0+3Ef5KYpBjSIDTY:5q85RxYTu+3Ef5dpBjJHY
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\System32\Setup\aladdin\hasphl\aksusb.inf
- Size 2KB
- SHA256 10a13e9a15a18016a8bdbc2b235dffb819e4229a7f5a7c352d3fb0923a569b7f
- MD5 086aa6a5eac4bdebb28aef6e4a63ce41
- SHA1 cd475bc06cd13d105f92ce92fbd2f69b39f6e15f
- SHA512 a06a2c1e32c95d16cc401c137c5cc63b8ae37ec92df0043ad10f6f348ebf2240d1108e0e3f3b42f139270d0dfe20d4242f765dee829b6e4e49f86c1d16b9b7e0
- MD5 SHA1 SHA512
- Path C:\Windows\System32\Setup\aladdin\hasphl\aksusb.sys
- Size 276KB
- SHA256 36fcaeb117bf05f463792b14f286567965c69bf25b6b29c0fc2a0a095d0ce6e0
- MD5 376a65120416835af230582a5a293a8d
- SHA1 0047ca5e47460fb9764f6144595e0ad4cc65f05d
- SHA512 909f432de72fe6282720059958a88ddcad593f012e590987a2eaad90cb836596b0c97c4f38579e2c9459f819a770a3f9c55a8e2d114a889652d6a31d3e21c2ac
- SSDEEP 6144:fpslGpebuFS5Og23VPuHsXK5SdNcHSBBlJeSRQfvE10+WVrSWgwAc:6YebuFSk3VPuoqyHlNQfvEgVrSWJH
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\System32\Setup\aladdin\hasphl\aksusb5.dll
- Size 83KB
- SHA256 514972afcd1d1f3792cba8434e7b1ac0a2bb04752597d2372882726d725e9b1d
- MD5 ad417d60cfbe9c46507852273a8cbdc1
- SHA1 c5e590667cd0b4b6e1acfa378952f794afe533a6
- SHA512 261106b9c76f3387fc61a5a22ae4f5a99233e636ca56051d4d278e55736a36f5d3e2177637440d3c3798a476c011b0de357356d0411da95f1d5a3cea26b01424
- SSDEEP 1536:4cICgAFwhtXcKTstLJdawIPt1KIF8mZen9CWLJjTdILpb1c5:4eaMKYtld0rKIF8mCCWLJjTdILI5
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\System32\catroot2\dberr.txt
- Size 192KB
- SHA256 fe3739ec436dd5b7c822ba6ead9e376b84e57ec635932a770e34089977965bf6
- MD5 88f27ed3e89febaf0c91d86eefedf3e0
- SHA1 d94549df30c33e6de90bd2f2676f6645fc586f10
- SHA512 aa8e16cc48ec637ee6c02ab3cf913b0fcd6046899d14928eb628b6f4f12153b7ed17ef6d21e663c9ef59c57b573a6508e7f1f2d4de2c991153132073017e24de
- SSDEEP 1536:S675B3vVfJXdkm/ppY8GuWeJ3iiy4orIq181FKaIE6qM4DVTFM4x1x4TbsYWu2+T:Q
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\System32\drivers\hardlock.sys
- Size 1.4MB
- SHA256 7e3f5010c0d622fe15fa5843c9e7e42a15e9c46c896dc634be25893e9f155197
- MD5 536a7c451122b2777aee28e468c91883
- SHA1 47621472d3c2b0ac18cbe696ac065cf7d63b5de1
- SHA512 50af1edb805b88be89524e6b38f97157c2df96b404068afbfa0aa4dd5c7f2bcac6589405dc7d221e2bed030a297ae39b01f69930d07a8db908df8631f71245f2
- SSDEEP 12288:XxHyon3UO1iSlMWqxDwTEi+a8xzBTkemobzOXQeUjSH0yfMUJBtTNhACtGpbWG3:XZ3UO1tpeDwpUkHobchfLP59Gpbd3
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\aksdrvsetup.log
- Size 973B
- SHA256 e478d52b166e7c963eb8c2ae45b39659d6c1dcd0016663f02705c4eae78acc53
- MD5 40eafd0967fb4777af85b7f247e71b8c
- SHA1 d861a27ca80be5998d4d953445248869b07dfa28
- SHA512 d6e02c5af553b6f8b4fa84eb81a435bc402e011bfd739b971b9edaa4770c1aaebc2b1891a6fc444a985203f0da4aa2807e51531710671f578a63c22d0a9dda0f
- MD5 SHA1 SHA512
- Path \Users\Admin\AppData\Local\Temp\haspdinst_x64.exe
- Size 415KB
- SHA256 9157314c5f1de991cb6aae6c73085af8dbb3d69f93f13ae455cc42c9a03b9d41
- MD5 2b6db16df50302cb47e4a6179e0b9ac4
- SHA1 9994c777f34aca747ca0de20d1ab5c004ef4fd15
- SHA512 7fac6df97d7beb9d78e43d4c9521c1974389438be0bfaa9f5f6981533117cb9356ae7c24d49d7908f22b85dfc1cee2c64fe80a6dca95a7a57620fc85c14d3395
- SSDEEP 6144:FgpvbqlhCs8BsDnVXvNkBgeWm8mJAV7gTYILhy0BcFtCXIcSif:FgpjqlhVfVNkBgfQ2VxILhXBf
- MD5 SHA1 SHA512 SSDEEP
- Path \Users\Admin\AppData\Local\Temp\haspds_windows.dll
- Size 35KB
- SHA256 d9318fdc697c10beea1e57c1ca0b3f026069435904f5a7e901cf21454675a3b9
- MD5 1ccbf685e6dcb3a6f70a917f72f56049
- SHA1 67716d7eed8573d03a824e74974f377ed7752054
- SHA512 902436365e252208929e582b32c9abdbd6c76392df652db55760671d2f82336d1f03d9eadd505bc162d9853d0dcb684181a57308ad9a06b28abff3f469b00f7f
- SSDEEP 384:u553px4n1C+adjmO1xbL7gG2jJdIRiNa/L5VO9zOlkpGecwhtD/iJrMVQmneKYPQ:C5ZW1Cq+kjk3UzpouhVIrM/LYzQURbG
- MD5 SHA1 SHA512 SSDEEP
- Path \Users\Admin\AppData\Local\Temp\haspds_windows_x64.dll
- Size 2.3MB
- SHA256 d1dc83b55267c42e2f2d0693ab538fd327f55f2e3b79b23cd6a526bb53c58289
- MD5 7a7d7a02b801b894f8b8a6fbb899f51b
- SHA1 058c32c008dc713dbf79dec1afa00389daafdef3
- SHA512 6ebc9327e7e271fc4ee10fd8c191ce918996e528a63fa14fd4c1b210050023d3c476f5987e95611705d85c61ee3608fcc4d743b0c2fc1eaf75bb2f5fd9cda5eb
- SSDEEP 49152:7gPsnxcromTYZcyvDB7r/VuoxCu2cfNID6pSmeWnCuOjZHWrsi:OAmufnAcNnp+yC7j9Wrz
- MD5 SHA1 SHA512 SSDEEP
- Path \Users\Admin\AppData\Local\Temp\{B895E070-08F4-4BD0-8F67-28BA222FC013}\LicenseManagerSetup.exe
- Size 989KB
- SHA256 4db5c3db2a9360102c00e4ccf54e72ba1e1ac37d3a67bc52a6e139305124a22b
- MD5 2d1d9dd75c6dacfca8849adca48ad06a
- SHA1 091bb0ba354bc25a84c232459cc4267288a6d2ed
- SHA512 7a648d35c657c3f68f9236f2f60053534e20defbcc0462b2ce5fd3340f1943284571ac1c1ad85793de8902565e2a6fc37dd2e4c07d00caf226ddefc713ad7620
- SSDEEP 24576:peZXdu97w0dDVfYGTfMeciYOLqvhM4obXtAxmB/TY37M0CAflO:zaOLqZMLAxmB/Tv8lO
- MD5 SHA1 SHA512 SSDEEP