6ee98db32852a2ff31a969d918bb7c730950bb15f24ea1baf996697cebc8b9fa

Analysis

max time kernel
145s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
15/05/2024, 11:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

hamachi.msi
Size

13.7MB
MD5

909db4061c32f798e94d746717782444
SHA1

10f5ffff17d2dd4476686a941a7bcc5f9b83b1b8
SHA256

6ee98db32852a2ff31a969d918bb7c730950bb15f24ea1baf996697cebc8b9fa
SHA512

44e7f97b27aef2e4cb62a6a0ebab5033b99e1ec940f231eda416f3b68d83df81d10950a8ced2ca528024adecd1dea7e1d4427e78b111edbc0124d7ffd6c1232d
SSDEEP

196608:cp/8gF8Li2aauOgsgJ9RSfD3G43O+WFoy1jNDVxJBQHhIO4E46uVwOXsHoHybhLf:O/382agT9RK73O+kN3JSHuy46inqUMC

Score

8^/10

persistence

Malware Config

Signatures

Drops file in Drivers directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\DRIVERS\SET1B00.tmp	hamachi-2.exe
File created	C:\Windows\system32\DRIVERS\SET1B00.tmp	hamachi-2.exe
File opened for modification	C:\Windows\system32\DRIVERS\Hamdrv.sys	hamachi-2.exe
File opened for modification	C:\Windows\System32\drivers\Hamdrv.sys	DrvInst.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\LogMeIn Hamachi Ui = "\"C:\\Program Files (x86)\\LogMeIn Hamachi\\hamachi-2-ui.exe\" --auto-start"	msiexec.exe

Blocklisted process makes network request 2 IoCs

flow	pid	Process
4	4336	msiexec.exe
6	4336	msiexec.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe

Drops file in System32 directory 16 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\DriverStore\Temp\{f2c654ea-400c-9e44-9bc6-fcbb652405d7}\hamdrv.cat	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\hamdrv.inf_amd64_c59072ec40c0c372\Hamdrv.sys	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\hamdrv.inf_amd64_c59072ec40c0c372\hamdrv.cat	DrvInst.exe
File created	C:\Windows\System32\DriverStore\FileRepository\hamdrv.inf_amd64_c59072ec40c0c372\hamdrv.PNF	hamachi-2.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{f2c654ea-400c-9e44-9bc6-fcbb652405d7}\SET1B8D.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{f2c654ea-400c-9e44-9bc6-fcbb652405d7}\SET1B8E.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{f2c654ea-400c-9e44-9bc6-fcbb652405d7}\SET1B8E.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{f2c654ea-400c-9e44-9bc6-fcbb652405d7}\SET1B8F.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\CatRoot2\dberr.txt	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{f2c654ea-400c-9e44-9bc6-fcbb652405d7}	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{f2c654ea-400c-9e44-9bc6-fcbb652405d7}\SET1B8D.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{f2c654ea-400c-9e44-9bc6-fcbb652405d7}\Hamdrv.sys	DrvInst.exe
File created	C:\Windows\System32\DriverStore\drvstore.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\hamdrv.inf_amd64_c59072ec40c0c372\hamdrv.inf	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{f2c654ea-400c-9e44-9bc6-fcbb652405d7}\SET1B8F.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{f2c654ea-400c-9e44-9bc6-fcbb652405d7}\hamdrv.inf	DrvInst.exe

Drops file in Program Files directory 16 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\LogMeIn Hamachi\x64\LMIGuardianEvt.Dll	msiexec.exe
File created	C:\Program Files (x86)\LogMeIn Hamachi\LMIGuardianDll.dll	msiexec.exe
File created	C:\Program Files (x86)\LogMeIn Hamachi\LMIGuardianEvt.Dll	msiexec.exe
File created	C:\Program Files (x86)\LogMeIn Hamachi\x64\hamachi.cat	msiexec.exe
File created	C:\Program Files (x86)\LogMeIn Hamachi\x64\LMIGuardianSvc.exe	msiexec.exe
File created	C:\Program Files (x86)\LogMeIn Hamachi\x64\LMIGuardianDll.dll	msiexec.exe
File created	C:\Program Files (x86)\LogMeIn Hamachi\ReleaseNotes.rtf	msiexec.exe
File created	C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2-ui.exe	msiexec.exe
File created	C:\Program Files (x86)\LogMeIn Hamachi\LMIGuardianSvc.exe	msiexec.exe
File created	C:\Program Files (x86)\LogMeIn Hamachi\x64\hamdrv.inf	msiexec.exe
File created	C:\Program Files (x86)\LogMeIn Hamachi\x64\hamachi-2.exe	msiexec.exe
File created	C:\Program Files (x86)\LogMeIn Hamachi\x64\hamdrv.cat	msiexec.exe
File created	C:\Program Files (x86)\LogMeIn Hamachi\hamachi.lng	msiexec.exe
File created	C:\Program Files (x86)\LogMeIn Hamachi\x64\hamachi.sys	msiexec.exe
File created	C:\Program Files (x86)\LogMeIn Hamachi\x64\hamachi.inf	msiexec.exe
File created	C:\Program Files (x86)\LogMeIn Hamachi\x64\hamdrv.sys	msiexec.exe

Drops file in Windows directory 47 IoCs

description	ioc	Process
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File opened for modification	C:\Windows\Installer\MSI47F9.tmp	msiexec.exe
File created	C:\Windows\ServiceProfiles\LocalService\AppData\Local\LogMeIn Hamachi\h2-engine.id.updating	hamachi-2.exe
File opened for modification	C:\Windows\ServiceProfiles\LocalService\AppData\Local\LogMeIn Hamachi\h2-engine.cfg.updating	hamachi-2.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	svchost.exe
File opened for modification	C:\Windows\inf\oem3.inf	DrvInst.exe
File opened for modification	C:\Windows\Installer\MSI3E23.tmp	msiexec.exe
File created	C:\Windows\ServiceProfiles\LocalService\AppData\Local\LogMeIn Hamachi\h2-engine.ini	hamachi-2.exe
File created	C:\Windows\Installer\SourceHash{C00E2143-38F2-49BA-AB8A-03F22F02F0A4}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI14AC.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI150B.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI1888.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\{C00E2143-38F2-49BA-AB8A-03F22F02F0A4}\UninstallIcon.ico	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI47E9.tmp	msiexec.exe
File opened for modification	C:\Windows\ServiceProfiles\LocalService\AppData\Local\LogMeIn Hamachi\h2-engine.log	hamachi-2.exe
File created	C:\Windows\ServiceProfiles\LocalService\AppData\Local\LogMeIn Hamachi\h2-engine.cfg.updating	hamachi-2.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI115B.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI1392.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI1700.tmp	msiexec.exe
File created	C:\Windows\ServiceProfiles\LocalService\AppData\Local\LogMeIn Hamachi\h2-engine.ini.bak	hamachi-2.exe
File opened for modification	C:\Windows\Installer\MSI3EA1.tmp	msiexec.exe
File opened for modification	C:\Windows\ServiceProfiles\LocalService\AppData\Local\LogMeIn Hamachi\h2-engine.id.updating	hamachi-2.exe
File opened for modification	C:\Windows\ServiceProfiles\LocalService\AppData\Local\LogMeIn Hamachi\h2-engine.ini.updating	hamachi-2.exe
File opened for modification	C:\Windows\ServiceProfiles\LocalService\AppData\Local\LogMeIn Hamachi\h2-engine.cfg	hamachi-2.exe
File created	C:\Windows\Installer\e5910cf.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI1256.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	hamachi-2.exe
File opened for modification	C:\Windows\Installer\e5910cf.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI1287.tmp	msiexec.exe
File created	C:\Windows\ServiceProfiles\LocalService\AppData\Local\LogMeIn Hamachi\h2-server.key	hamachi-2.exe
File opened for modification	C:\Windows\ServiceProfiles\LocalService\AppData\Local\LogMeIn Hamachi\h2-engine.cfg.bak	hamachi-2.exe
File created	C:\Windows\ServiceProfiles\LocalService\AppData\Local\LogMeIn Hamachi\h2-engine.id.bak	hamachi-2.exe
File created	C:\Windows\ServiceProfiles\LocalService\AppData\Local\LogMeIn Hamachi\h2-client.key	hamachi-2.exe
File created	C:\Windows\ServiceProfiles\LocalService\AppData\Local\LogMeIn Hamachi\h2-engine.ini.updating	hamachi-2.exe
File created	C:\Windows\Installer\e5910d1.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI1267.tmp	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	hamachi-2.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File created	C:\Windows\ServiceProfiles\LocalService\AppData\Local\LogMeIn Hamachi\h2-engine.id	hamachi-2.exe
File opened for modification	C:\Windows\Installer\MSI18B7.tmp	msiexec.exe
File created	C:\Windows\ServiceProfiles\LocalService\AppData\Local\LogMeIn Hamachi\h2-engine.cfg	hamachi-2.exe
File created	C:\Windows\Installer\{C00E2143-38F2-49BA-AB8A-03F22F02F0A4}\UninstallIcon.ico	msiexec.exe
File created	C:\Windows\inf\oem3.inf	DrvInst.exe
File created	C:\Windows\ServiceProfiles\LocalService\AppData\Local\LogMeIn Hamachi\h2-engine.cfg.bak	hamachi-2.exe

Executes dropped EXE 10 IoCs

pid	Process
1456	hamachi-2.exe
1932	LMIGuardianSvc.exe
1380	hamachi-2.exe
804	LMIGuardianSvc.exe
3740	LMIGuardianSvc.exe
2296	hamachi-2.exe
2056	LMIGuardianSvc.exe
4080	LMIGuardianSvc.exe
1480	hamachi-2.exe
3984	LMIGuardianSvc.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3972	sc.exe
4564	sc.exe

Loads dropped DLL 26 IoCs

pid	Process
2236	MsiExec.exe
2236	MsiExec.exe
2236	MsiExec.exe
2236	MsiExec.exe
2236	MsiExec.exe
2236	MsiExec.exe
2236	MsiExec.exe
1440	MsiExec.exe
1440	MsiExec.exe
1440	MsiExec.exe
1440	MsiExec.exe
1440	MsiExec.exe
1440	MsiExec.exe
232	MsiExec.exe
232	MsiExec.exe
232	MsiExec.exe
1932	LMIGuardianSvc.exe
804	LMIGuardianSvc.exe
232	MsiExec.exe
3740	LMIGuardianSvc.exe
232	MsiExec.exe
2056	LMIGuardianSvc.exe
4080	LMIGuardianSvc.exe
232	MsiExec.exe
232	MsiExec.exe
3984	LMIGuardianSvc.exe

Registers COM server for autorun 1 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D4258A22-CF85-489D-83AE-49FCD0DFAD29}\LocalServer32	LMIGuardianSvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D4258A22-CF85-489D-83AE-49FCD0DFAD29}\LocalServer32\ = "\"C:\\Program Files (x86)\\LogMeIn Hamachi\\x64\\LMIGuardianSvc.exe\""	LMIGuardianSvc.exe

Checks SCSI registry key(s) 3 TTPs 51 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Phantom	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\LowerFilters	hamachi-2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	hamachi-2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009	svchost.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Filters	hamachi-2.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Service	hamachi-2.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\CompatibleIDs	DrvInst.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Service	hamachi-2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000	hamachi-2.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Service	hamachi-2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Filters	hamachi-2.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\LowerFilters	hamachi-2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Phantom	DrvInst.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 000000000400000081a0e6b9f9d406b40000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff00000000270101000008000081a0e6b90000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff00000000070001000068090081a0e6b9000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d81a0e6b9000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff00000000000000000000000081a0e6b900000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Filters	hamachi-2.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\UpperFilters	hamachi-2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\UpperFilters	hamachi-2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Service	hamachi-2.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\UpperFilters	hamachi-2.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\LowerFilters	hamachi-2.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\CompatibleIDs	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	hamachi-2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Filters	hamachi-2.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\UpperFilters	hamachi-2.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\LowerFilters	hamachi-2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	hamachi-2.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom	DrvInst.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom	DrvInst.exe

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	MsiExec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\hamachi-2-ui.exe = "11000"	MsiExec.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	hamachi-2.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	hamachi-2.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	hamachi-2.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	hamachi-2.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	hamachi-2.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	hamachi-2.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	hamachi-2.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	DrvInst.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2A\52C64B7E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	hamachi-2.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	hamachi-2.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	hamachi-2.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	hamachi-2.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	hamachi-2.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	hamachi-2.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	hamachi-2.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	hamachi-2.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	hamachi-2.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	hamachi-2.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	hamachi-2.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	hamachi-2.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	hamachi-2.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@%SystemRoot%\system32\hnetcfgclient.dll,-201 = "HNetCfg Client"	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	hamachi-2.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	hamachi-2.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	hamachi-2.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\RAS AutoDial	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\RAS AutoDial\Default	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2b	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	hamachi-2.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	hamachi-2.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	hamachi-2.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	hamachi-2.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	hamachi-2.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	hamachi-2.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	hamachi-2.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\3412E00C2F83AB94BAA8302FF2200F4A\LanguageHU = "\x06Ui"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{FAC58A4E-76CC-418B-8829-6DE882474472}\1.0\FLAGS	LMIGuardianSvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\3412E00C2F83AB94BAA8302FF2200F4A\LanguageEN = "Ui"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D4258A22-CF85-489D-83AE-49FCD0DFAD29}\VersionIndependentProgID	LMIGuardianSvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D4258A22-CF85-489D-83AE-49FCD0DFAD29}\VersionIndependentProgID\ = "LMIGuardianSvc.GuardianSvc"	LMIGuardianSvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\3412E00C2F83AB94BAA8302FF2200F4A\LanguageKO = "\x06Ui"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3412E00C2F83AB94BAA8302FF2200F4A\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\LMIGuardianSvc.GuardianSvc\CurVer	LMIGuardianSvc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D4258A22-CF85-489D-83AE-49FCD0DFAD29}\TypeLib	LMIGuardianSvc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4615B7A3-8EF2-40C0-83F0-63BCD479C791}\ProxyStubClsid32	LMIGuardianSvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\3412E00C2F83AB94BAA8302FF2200F4A\LanguageAR = "\x06Ui"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{67E4A0D8-8675-4FBB-BC62-F10EC894327E}\LocalService = "LMIGuardianSvc"	LMIGuardianSvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D4258A22-CF85-489D-83AE-49FCD0DFAD29}\LocalServer32\ = "\"C:\\Program Files (x86)\\LogMeIn Hamachi\\x64\\LMIGuardianSvc.exe\""	LMIGuardianSvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{FAC58A4E-76CC-418B-8829-6DE882474472}\1.0\HELPDIR\ = "C:\\Program Files (x86)\\LogMeIn Hamachi\\x64"	LMIGuardianSvc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D4258A22-CF85-489D-83AE-49FCD0DFAD29}\Programmable	LMIGuardianSvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D4258A22-CF85-489D-83AE-49FCD0DFAD29}\AppID = "{67E4A0D8-8675-4FBB-BC62-F10EC894327E}"	LMIGuardianSvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\3412E00C2F83AB94BAA8302FF2200F4A\LanguagePTBR = "\x06Ui"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4615B7A3-8EF2-40C0-83F0-63BCD479C791}	LMIGuardianSvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\3412E00C2F83AB94BAA8302FF2200F4A\LanguageES = "\x06Ui"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\3412E00C2F83AB94BAA8302FF2200F4A\LanguagePT = "\x06Ui"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\3412E00C2F83AB94BAA8302FF2200F4A\LanguageZH = "\x06Ui"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3412E00C2F83AB94BAA8302FF2200F4A\Version = "33751040"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{FAC58A4E-76CC-418B-8829-6DE882474472}	LMIGuardianSvc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D4258A22-CF85-489D-83AE-49FCD0DFAD29}\ProgID	LMIGuardianSvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\3412E00C2F83AB94BAA8302FF2200F4A\Ui = "Complete"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\3412E00C2F83AB94BAA8302FF2200F4A\LanguageFI = "\x06Ui"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\LMIGuardianSvc.GuardianSvc\CLSID\ = "{D4258A22-CF85-489D-83AE-49FCD0DFAD29}"	LMIGuardianSvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3412E00C2F83AB94BAA8302FF2200F4A\SourceList\Media\1 = ";"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{FAC58A4E-76CC-418B-8829-6DE882474472}\1.0\0\win64	LMIGuardianSvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\3412E00C2F83AB94BAA8302FF2200F4A\Engine = "Complete"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\3412E00C2F83AB94BAA8302FF2200F4A\LanguageIT = "\x06Ui"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{4615B7A3-8EF2-40C0-83F0-63BCD479C791}\TypeLib	LMIGuardianSvc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3412E00C2F83AB94BAA8302FF2200F4A\Language = "1033"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4615B7A3-8EF2-40C0-83F0-63BCD479C791}\TypeLib\Version = "1.0"	LMIGuardianSvc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{4615B7A3-8EF2-40C0-83F0-63BCD479C791}	LMIGuardianSvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{4615B7A3-8EF2-40C0-83F0-63BCD479C791}\TypeLib\ = "{FAC58A4E-76CC-418B-8829-6DE882474472}"	LMIGuardianSvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{4615B7A3-8EF2-40C0-83F0-63BCD479C791}\TypeLib\Version = "1.0"	LMIGuardianSvc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4615B7A3-8EF2-40C0-83F0-63BCD479C791}\TypeLib	LMIGuardianSvc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D4258A22-CF85-489D-83AE-49FCD0DFAD29}\LocalServer32	LMIGuardianSvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{4615B7A3-8EF2-40C0-83F0-63BCD479C791}\ = "IGuardianSvc"	LMIGuardianSvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\LMIGuardianSvc.GuardianSvc\CurVer\ = "LMIGuardianSvc.GuardianSvc.1"	LMIGuardianSvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4615B7A3-8EF2-40C0-83F0-63BCD479C791}\TypeLib\ = "{FAC58A4E-76CC-418B-8829-6DE882474472}"	LMIGuardianSvc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3412E00C2F83AB94BAA8302FF2200F4A\AdvertiseFlags = "388"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\LMIGuardianSvc.EXE	LMIGuardianSvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\3412E00C2F83AB94BAA8302FF2200F4A\LanguageDE = "\x06Ui"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\3412E00C2F83AB94BAA8302FF2200F4A\LanguageFR = "\x06Ui"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\3412E00C2F83AB94BAA8302FF2200F4A\LanguageTR = "\x06Ui"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\LMIGuardianSvc.GuardianSvc.1	LMIGuardianSvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\3412E00C2F83AB94BAA8302FF2200F4A\LanguageSV = "\x06Ui"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\0E80E241A66716B4F9A16046F5141A90	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\3412E00C2F83AB94BAA8302FF2200F4A\LanguageJA = "\x06Ui"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3412E00C2F83AB94BAA8302FF2200F4A\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{FAC58A4E-76CC-418B-8829-6DE882474472}\1.0\0\win64\ = "C:\\Program Files (x86)\\LogMeIn Hamachi\\x64\\LMIGuardianSvc.exe\\1"	LMIGuardianSvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3412E00C2F83AB94BAA8302FF2200F4A\PackageCode = "BD8AE51CFD1484C47840D7F4BAD7E9BB"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3412E00C2F83AB94BAA8302FF2200F4A\InstanceType = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{67E4A0D8-8675-4FBB-BC62-F10EC894327E}	LMIGuardianSvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D4258A22-CF85-489D-83AE-49FCD0DFAD29}\ProgID\ = "LMIGuardianSvc.GuardianSvc.1"	LMIGuardianSvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D4258A22-CF85-489D-83AE-49FCD0DFAD29}\TypeLib\ = "{FAC58A4E-76CC-418B-8829-6DE882474472}"	LMIGuardianSvc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\3412E00C2F83AB94BAA8302FF2200F4A	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\LMIGuardianSvc.GuardianSvc\CLSID	LMIGuardianSvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3412E00C2F83AB94BAA8302FF2200F4A\ProductName = "Hamachi"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\3412E00C2F83AB94BAA8302FF2200F4A\LanguagePL = "\x06Ui"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{4615B7A3-8EF2-40C0-83F0-63BCD479C791}\ProxyStubClsid32	LMIGuardianSvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{67E4A0D8-8675-4FBB-BC62-F10EC894327E}\ = "LMIGuardianSvc"	LMIGuardianSvc.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4336	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4336	msiexec.exe
Token: SeSecurityPrivilege	728	msiexec.exe
Token: SeCreateTokenPrivilege	4336	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	4336	msiexec.exe
Token: SeLockMemoryPrivilege	4336	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4336	msiexec.exe
Token: SeMachineAccountPrivilege	4336	msiexec.exe
Token: SeTcbPrivilege	4336	msiexec.exe
Token: SeSecurityPrivilege	4336	msiexec.exe
Token: SeTakeOwnershipPrivilege	4336	msiexec.exe
Token: SeLoadDriverPrivilege	4336	msiexec.exe
Token: SeSystemProfilePrivilege	4336	msiexec.exe
Token: SeSystemtimePrivilege	4336	msiexec.exe
Token: SeProfSingleProcessPrivilege	4336	msiexec.exe
Token: SeIncBasePriorityPrivilege	4336	msiexec.exe
Token: SeCreatePagefilePrivilege	4336	msiexec.exe
Token: SeCreatePermanentPrivilege	4336	msiexec.exe
Token: SeBackupPrivilege	4336	msiexec.exe
Token: SeRestorePrivilege	4336	msiexec.exe
Token: SeShutdownPrivilege	4336	msiexec.exe
Token: SeDebugPrivilege	4336	msiexec.exe
Token: SeAuditPrivilege	4336	msiexec.exe
Token: SeSystemEnvironmentPrivilege	4336	msiexec.exe
Token: SeChangeNotifyPrivilege	4336	msiexec.exe
Token: SeRemoteShutdownPrivilege	4336	msiexec.exe
Token: SeUndockPrivilege	4336	msiexec.exe
Token: SeSyncAgentPrivilege	4336	msiexec.exe
Token: SeEnableDelegationPrivilege	4336	msiexec.exe
Token: SeManageVolumePrivilege	4336	msiexec.exe
Token: SeImpersonatePrivilege	4336	msiexec.exe
Token: SeCreateGlobalPrivilege	4336	msiexec.exe
Token: SeCreateTokenPrivilege	4336	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	4336	msiexec.exe
Token: SeLockMemoryPrivilege	4336	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4336	msiexec.exe
Token: SeMachineAccountPrivilege	4336	msiexec.exe
Token: SeTcbPrivilege	4336	msiexec.exe
Token: SeSecurityPrivilege	4336	msiexec.exe
Token: SeTakeOwnershipPrivilege	4336	msiexec.exe
Token: SeLoadDriverPrivilege	4336	msiexec.exe
Token: SeSystemProfilePrivilege	4336	msiexec.exe
Token: SeSystemtimePrivilege	4336	msiexec.exe
Token: SeProfSingleProcessPrivilege	4336	msiexec.exe
Token: SeIncBasePriorityPrivilege	4336	msiexec.exe
Token: SeCreatePagefilePrivilege	4336	msiexec.exe
Token: SeCreatePermanentPrivilege	4336	msiexec.exe
Token: SeBackupPrivilege	4336	msiexec.exe
Token: SeRestorePrivilege	4336	msiexec.exe
Token: SeShutdownPrivilege	4336	msiexec.exe
Token: SeDebugPrivilege	4336	msiexec.exe
Token: SeAuditPrivilege	4336	msiexec.exe
Token: SeSystemEnvironmentPrivilege	4336	msiexec.exe
Token: SeChangeNotifyPrivilege	4336	msiexec.exe
Token: SeRemoteShutdownPrivilege	4336	msiexec.exe
Token: SeUndockPrivilege	4336	msiexec.exe
Token: SeSyncAgentPrivilege	4336	msiexec.exe
Token: SeEnableDelegationPrivilege	4336	msiexec.exe
Token: SeManageVolumePrivilege	4336	msiexec.exe
Token: SeImpersonatePrivilege	4336	msiexec.exe
Token: SeCreateGlobalPrivilege	4336	msiexec.exe
Token: SeCreateTokenPrivilege	4336	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	4336	msiexec.exe
Token: SeLockMemoryPrivilege	4336	msiexec.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4336	msiexec.exe

Suspicious use of WriteProcessMemory 37 IoCs

description	pid	Process	procid_target
PID 728 wrote to memory of 2236	728	msiexec.exe	88
PID 728 wrote to memory of 2236	728	msiexec.exe	88
PID 728 wrote to memory of 2236	728	msiexec.exe	88
PID 728 wrote to memory of 2180	728	msiexec.exe	112
PID 728 wrote to memory of 2180	728	msiexec.exe	112
PID 728 wrote to memory of 1440	728	msiexec.exe	114
PID 728 wrote to memory of 1440	728	msiexec.exe	114
PID 728 wrote to memory of 1440	728	msiexec.exe	114
PID 728 wrote to memory of 232	728	msiexec.exe	115
PID 728 wrote to memory of 232	728	msiexec.exe	115
PID 728 wrote to memory of 232	728	msiexec.exe	115
PID 1456 wrote to memory of 1932	1456	hamachi-2.exe	118
PID 1456 wrote to memory of 1932	1456	hamachi-2.exe	118
PID 404 wrote to memory of 4196	404	svchost.exe	121
PID 404 wrote to memory of 4196	404	svchost.exe	121
PID 404 wrote to memory of 4848	404	svchost.exe	122
PID 404 wrote to memory of 4848	404	svchost.exe	122
PID 1456 wrote to memory of 1180	1456	hamachi-2.exe	124
PID 1456 wrote to memory of 1180	1456	hamachi-2.exe	124
PID 1456 wrote to memory of 1180	1456	hamachi-2.exe	124
PID 1456 wrote to memory of 5112	1456	hamachi-2.exe	126
PID 1456 wrote to memory of 5112	1456	hamachi-2.exe	126
PID 1456 wrote to memory of 5112	1456	hamachi-2.exe	126
PID 1456 wrote to memory of 1632	1456	hamachi-2.exe	131
PID 1456 wrote to memory of 1632	1456	hamachi-2.exe	131
PID 1456 wrote to memory of 1632	1456	hamachi-2.exe	131
PID 1456 wrote to memory of 1892	1456	hamachi-2.exe	133
PID 1456 wrote to memory of 1892	1456	hamachi-2.exe	133
PID 1456 wrote to memory of 1892	1456	hamachi-2.exe	133
PID 1380 wrote to memory of 804	1380	hamachi-2.exe	137
PID 1380 wrote to memory of 804	1380	hamachi-2.exe	137
PID 2296 wrote to memory of 2056	2296	hamachi-2.exe	142
PID 2296 wrote to memory of 2056	2296	hamachi-2.exe	142
PID 1480 wrote to memory of 3984	1480	hamachi-2.exe	150
PID 1480 wrote to memory of 3984	1480	hamachi-2.exe	150
PID 1480 wrote to memory of 228	1480	hamachi-2.exe	152
PID 1480 wrote to memory of 228	1480	hamachi-2.exe	152

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\hamachi.msi
1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4336

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Adds Run key to start application
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:728
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 354C225F31D45ED38B4FD61F5A1785B5 C
  2⤵
  - Loads dropped DLL
  PID:2236
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:2180
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding E69A55E1B94195F69FB16DC35D1ECFC4
  2⤵
  - Loads dropped DLL
  PID:1440
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding F81980D8282257B0262AAD2B62F8F304 E Global\MSI0000
  2⤵
  - Loads dropped DLL
  - Modifies Internet Explorer settings
  PID:232
- - C:\Program Files (x86)\LogMeIn Hamachi\x64\hamachi-2.exe
    "C:\Program Files (x86)\LogMeIn Hamachi\x64\hamachi-2.exe" --add-tap-at-install Hamachi
    3⤵
    - Drops file in Drivers directory
    - Drops file in System32 directory
    - Drops file in Windows directory
    - Executes dropped EXE
    - Checks SCSI registry key(s)
    - Modifies data under HKEY_USERS
    - Suspicious use of WriteProcessMemory
    PID:1456
  - - C:\Program Files (x86)\LogMeIn Hamachi\x64\LMIGuardianSvc.exe
      "C:\Program Files (x86)\LogMeIn Hamachi\x64\LMIGuardianSvc.exe" /escort 1456 /CUSTOM Hamachi
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:1932
  - - C:\Windows\SysWOW64\netsh.exe
      netsh interface ipv4 set subinterface "Ethernet 2" mtu=1404 store=persistent
      4⤵
      PID:1180
  - - C:\Windows\SysWOW64\netsh.exe
      netsh.exe interface set interface name="Ethernet 2" newname="Hamachi"
      4⤵
      PID:5112
  - - C:\Windows\SysWOW64\netsh.exe
      netsh interface tcp set global autotuninglevel=normal
      4⤵
      PID:1632
  - - C:\Windows\SysWOW64\netsh.exe
      netsh interface tcp set global rss=enabled
      4⤵
      PID:1892
- - C:\Program Files (x86)\LogMeIn Hamachi\x64\hamachi-2.exe
    "C:\Program Files (x86)\LogMeIn Hamachi\x64\hamachi-2.exe" --config Hamachi 25.0.0.1
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:1380
  - - C:\Program Files (x86)\LogMeIn Hamachi\x64\LMIGuardianSvc.exe
      "C:\Program Files (x86)\LogMeIn Hamachi\x64\LMIGuardianSvc.exe" /escort 1380 /CUSTOM Hamachi
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:804
- - C:\Windows\SysWOW64\sc.exe
    sc config Hamachi2Svc depend= winmgmt
    3⤵
    - Launches sc.exe
    PID:3972
- - C:\Program Files (x86)\LogMeIn Hamachi\x64\LMIGuardianSvc.exe
    "C:\Program Files (x86)\LogMeIn Hamachi\x64\LMIGuardianSvc.exe" -Service
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Registers COM server for autorun
    - Modifies registry class
    PID:3740
- - C:\Windows\SysWOW64\sc.exe
    sc config Hamachi2Svc depend= winmgmt
    3⤵
    - Launches sc.exe
    PID:4564

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
PID:1548

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall
1⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious use of WriteProcessMemory
PID:404
- C:\Windows\system32\DrvInst.exe
  DrvInst.exe "4" "1" "c:\program files (x86)\logmein hamachi\x64\hamdrv.inf" "9" "42b53aaff" "0000000000000148" "WinSta0\Default" "0000000000000160" "208" "c:\program files (x86)\logmein hamachi\x64"
  2⤵
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Checks SCSI registry key(s)
  - Modifies data under HKEY_USERS
  PID:4196
- C:\Windows\system32\DrvInst.exe
  DrvInst.exe "2" "211" "ROOT\NET\0000" "C:\Windows\INF\oem3.inf" "oem3.inf:db04a16c4ff220c2:Hamachi.ndi:15.28.40.464:hamachi," "42b53aaff" "000000000000015C"
  2⤵
  - Drops file in Drivers directory
  - Drops file in Windows directory
  PID:4848

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s Netman
1⤵
- Modifies data under HKEY_USERS
PID:4388

C:\Program Files (x86)\LogMeIn Hamachi\x64\hamachi-2.exe
"C:\Program Files (x86)\LogMeIn Hamachi\x64\hamachi-2.exe" -s --get-config
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2296
- C:\Program Files (x86)\LogMeIn Hamachi\x64\LMIGuardianSvc.exe
  "C:\Program Files (x86)\LogMeIn Hamachi\x64\LMIGuardianSvc.exe" /escort 2296 /CUSTOM Hamachi
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:2056

C:\Program Files (x86)\LogMeIn Hamachi\x64\LMIGuardianSvc.exe
"C:\Program Files (x86)\LogMeIn Hamachi\x64\LMIGuardianSvc.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:4080

C:\Program Files (x86)\LogMeIn Hamachi\x64\hamachi-2.exe
"C:\Program Files (x86)\LogMeIn Hamachi\x64\hamachi-2.exe" -s
1⤵
- Drops file in Windows directory
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1480
- C:\Program Files (x86)\LogMeIn Hamachi\x64\LMIGuardianSvc.exe
  "C:\Program Files (x86)\LogMeIn Hamachi\x64\LMIGuardianSvc.exe" /escort 1480 /CUSTOM Hamachi
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:3984
- C:\Windows\system32\netsh.exe
  netsh interface ipv4 set subinterface "Hamachi" mtu=1404 store=persistent
  2⤵
  PID:228

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\e5910d0.rbs

Filesize
23KB

MD5
6cfd3f2933148cf7e16ab3fd3ee60904

SHA1
4dd9db410534433f1bfb3c52ebbd3837b1bb9596

SHA256
1193fccf22e0da73c136eb0e62d751c03214b73bcace0cfd8654f7111414fb25

SHA512
90e4bfdec5f7145ed1d1d506c9c3f1af9419619a22fb8e6bc9ddd70b5a4df1fc1b82bca6cd12a2b56f415d8d953526a7ff895fccf655e592c7bd2acab10626a4

Download Submit
C:\Program Files (x86)\LogMeIn Hamachi\x64\LMIGuardianDll.dll

Filesize
2.0MB

MD5
df7051274b6080da5298c61decad2fdf

SHA1
33168489e0704cba116af5417f66f99e5c184abe

SHA256
bfec06ad20dddb565fea958c273dea14cd510f24be57e8f56d35168632a81875

SHA512
506ca6cef3bd7fd8f56e934c97d4e791e330fff492d89575ce40f0123fbffaf3010f9637af3fed997bc0d642b3027d767bd93efe6c37a06b40ba0dc354a994b6

Download Submit
C:\Program Files (x86)\LogMeIn Hamachi\x64\LMIGuardianSvc.exe

Filesize
409KB

MD5
0554f3b69d39d175dd110d765c11347a

SHA1
131bc6ca3960476e16fbaad091d26e92f2093437

SHA256
a57d5ce0cba04806eb0c6d8943d85c5ab63119a99fa8f8000bdf54cccd1c1bf9

SHA512
0ebbcec7337387cb7b59a86f80269925f369112d3a9cd817fc9de5d7c978a52665ad3bd6967a8f2b36765974f808e51d8dd59fd1e80149fd5a5de4d987833f06

Download Submit
C:\Program Files (x86)\LogMeIn Hamachi\x64\hamachi-2.exe

Filesize
4.7MB

MD5
493510f5eb2c49efea54e58a83677e13

SHA1
14ec94b796cd426c001840421c4ce43750cefd2a

SHA256
199febb05fff1cca01f7f7672be99d9d0ee73b0371bd63513635dde133f3e2cc

SHA512
85b92ca63797ae5303557dc1d6771acb4bc09ddd2f3391614a3f40b2a3604b6c63566b44beb8c65da3436edad44c90b401f8b220f5fb921f287970e50438fe87

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB

Filesize
471B

MD5
baac74b3023638ba6bce990035e6f467

SHA1
d8831aea8c6f5c509599de45d95a050487758efe

SHA256
9e8175147a97e437c8f6368805ab04be725a1ec579f15fa824ecfc2741de73a6

SHA512
c34f2ce5891afb42e2001d08439f92a83c443b57c9a341c1fb78f83795c8b2b5f5758e2a35fad924cf96fa16e299a3a6db30e12b51998f1499e769712d0a9ed0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_325DC716E4289E0AE281439314ED4BFA

Filesize
727B

MD5
4b59f1af68cb2264b203940c530ac562

SHA1
22cb5c96ac8a93870ea3bbf92cabf19e7efc0bf5

SHA256
9811d346c3e05b060ff4226dfa835d5339306b82e0c94b0c5119a585150f8593

SHA512
3aae64c68fbad696fb1f4e3f7b73e1ca5ac1bccb9e356c5b8fd8a567b5213d060cd9ddf5f3c6033617b77a3cc2679b2ae11d4044258efb346f36b129ce5b07c7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141

Filesize
727B

MD5
62af5c9799d1414a7c65acdf6314317d

SHA1
e771b110bcf62cb5a1109859bb5f12187f76293c

SHA256
b5a2c4e070f26aa983c09e89c571c2635bffb45a0f03d4472090f722ea78bc92

SHA512
cc1081876b37831293ef96562a1ce7f088bb23f53db86c867aa127e8c3a8710131f7f3b8a2c9512e35a5d54e565c346394edafe1dbbcbc64a8b409ab56201cfa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB

Filesize
400B

MD5
a4aa735c04fb3402dabe1c7223c8f350

SHA1
4472a32242ea372cca0da92b04e99fae1743a3b9

SHA256
874c1b28ff9b42b336196a17ec9fedad45e8cf2532d866d70f92fb0810fa472b

SHA512
779496c1fe9566ac2effe0723c9c26d24bc230c4fbb77592506e99b5f7dfa0d7ebb0c0e2bef50d140ccc31d4153c727fec69d4d495c401e89329f0c6fd1fec0d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_325DC716E4289E0AE281439314ED4BFA

Filesize
408B

MD5
0e1d441fdfa29ed8ec2f16726fea22eb

SHA1
32ecda09d50f6c5e041b7a6045771c0dfd6f5128

SHA256
55d5068996f156c7b43e14b70fb5b87c3debd9b35e221839705ffe5e0cd14f46

SHA512
48afb9ccd33bf284e95c6d197c21d35a01daac2d60a6dab0071b4c1418819fe6adf0ac205acdf4e162ff2a13bddcb35a78fc07b4cf402629a12730e9b5f8b548

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141

Filesize
412B

MD5
b7e87554c07d477570467c1985e88705

SHA1
1f93df3f4ea244301ff44ebe9fa9c67ee2fc3d0b

SHA256
5ca0d7a034af7f83bad95b34fa6cfd915e1db32c4de13b08b66db42ca8a3b0db

SHA512
f2451fe18dc13e15d36cc1884f3efe2d5ee5e14011ac177a6914962230eb26c96b67cffe0a7b4ab273b0f235982d91f26e358569b7b561bb87cb5ca85ca3b73a

Download Submit
C:\Users\Admin\AppData\Local\Temp\HamachiSetup.log

Filesize
2KB

MD5
b88e4744ea470a8f0f9ac64f09e35e98

SHA1
9a6dcf45930793673c9886eb83755e5b48fbbde4

SHA256
53c686c207084301a725facf3afaf33d3bcd98eccb9ef77e9a45be400f3563af

SHA512
15f1b87f834de71e02eda8d260da8b16d32bd5907084268900321195a6b1fa79a7b8ada2fe59becb14d47b500101f115d828982df1a1941e709c6bf120b2c27a

Download Submit
C:\Users\Admin\AppData\Local\Temp\HamachiSetup.log

Filesize
2KB

MD5
7b8527acaae3e4c4ae8d19f8e78e811a

SHA1
f6e09a8df743ffe6d2c703acd5a6777cfca2c1a8

SHA256
ca9bad4417bd278de3109ad0f3da577d82d3b580393c638c5d626c79a6fadd3e

SHA512
0448a6439bf45c0d36244c4d01ab71674cc264a8e0b10423e55059213ed391663c358bc2079ff9e685e99717051fa7ae5e4ef15eb5489fc5016763b6ad38b24c

Download Submit
C:\Users\Admin\AppData\Local\Temp\HamachiSetup.log

Filesize
2KB

MD5
f951f613be5aa6708cd7cc81bca5b501

SHA1
680aa042c8f5180e98f4aa11da84d21fecd581eb

SHA256
d5fb7dbe67c89ae9386d65e7890c4fb73d92da3aaf288082d3230daacb474602

SHA512
105089c3433b387f5077619754e047184534755db034afecc72132536e7cf539579966e501b0019fa885d0d18de8b1384b1e96ff83bb597998a6e9267dc72f78

Download Submit
C:\Users\Admin\AppData\Local\Temp\HamachiSetup.log

Filesize
2KB

MD5
21dc49313527480d1089bca088ff34ad

SHA1
b00b82c824f55185fe3fb248a3a14985bc783cf0

SHA256
65d9d9030ccc8e1dd355176a9fde4aaf3b213d627e123d59e8a9ebc24177d80c

SHA512
1b5f2cf7bd10d4321fa36b72abbf8ca37be00042b34a102a928ad94fde2f7b225c0b9b153db0f2680abe91014819a5f220be23653ae05efb02478ac866973bfd

Download Submit
C:\Users\Admin\AppData\Local\Temp\HamachiSetup.log

Filesize
3KB

MD5
efc2a7246d49041ecd64d18fe042fe60

SHA1
fe7a516f992b23b8e65720eaa74225e5a812f324

SHA256
33ea4f653813e45677c9056ff63ae5f2a751d75d536bd0afd297b4c44c0c66f1

SHA512
ee73138f82b994a8d8b8fe34a57449f4d9b3a23a8b46c8809c95901e420cd6e9f19dbf9b54f06d164838e460aa0a964ce56e03ad719d286a2a5a791f6bbbddd3

Download Submit
C:\Users\Admin\AppData\Local\Temp\HamachiSetup.log

Filesize
584B

MD5
271f99c1ebb9891430ed236d03fa674d

SHA1
332099445c581274a16e2ee2031dde5122c431e1

SHA256
451d885f16ff18f32429ef4b9bb82ad26a414251eebd20844c7a0305599bca05

SHA512
0ca868fae42db4a68cec03781af53b02e4a0fbeb0d7bb1399d7f1ebf43cefa6ea79d56fb762811a5d90f645359ea6bf721f948713027fb2775f230d7584e627a

Download Submit
C:\Users\Admin\AppData\Local\Temp\HamachiSetup.log

Filesize
3KB

MD5
ba518e7d69440a39087911eaa85cd7c6

SHA1
df329b872095c195c2f4509d946d27a9e112ed9e

SHA256
d2da490720f50785e633d902203535545eb2f723b019b091a06729ba630f4e8c

SHA512
2a17f2120b8637feb09a98a08b0009f8c279688337f2a663f812e1465f5499e68bbb88f105903efad6d9ba4d21061be0e7dad6fb60682c41196620f57ccb29c2

Download Submit
C:\Users\Admin\AppData\Local\Temp\HamachiSetup.log

Filesize
4KB

MD5
0593d8d7303049ad28588ff3e19cd736

SHA1
7631a6c11c88f43255d5062353e115d7a8272b78

SHA256
0b71401de07d8f6f1cf28dfa889510b011634efb1e39a71b1da7b83aabb2d207

SHA512
25df081289c0ad7259c7abb4ef9c735a49d98a7db9376f41d2a9e7c45a5f8c214f74123cecbf49752f1fce79d1220edadb7382da42c26fe309b4acb8354f1fc1

Download Submit
C:\Users\Admin\AppData\Local\Temp\HamachiSetup.log

Filesize
7KB

MD5
8e9a3c1a491a72315a75cd942cefbd67

SHA1
f6c443cd555af4c61bf4954378b22c67a64375e4

SHA256
78d0c91cf23e1cebfe3aa2c3af2759b291cc143cc9428606ac949ffeb3950391

SHA512
4690296704b4aa595e1f95acd61828f36ee9b049942dbe517eac9b441d06e2959fcf84ec9d41da231533d90c6bcbd953cc2f5322ec4ade020692ce21a9605070

Download Submit
C:\Users\Admin\AppData\Local\Temp\HamachiSetup.log

Filesize
1KB

MD5
896b5e7340b10b588c784a736721dda1

SHA1
0990fc09f1f0c80692465171f7595ea6807b2fd5

SHA256
de524442df9725752bf1f9eeb7b86d76476e40714f5a2c36943465f6440cd0cf

SHA512
a262e4699f783ee229536699891ef1eff482460a30ee01c7f7e5064c703b9e4c655d8b0f9083f9cbde3b1e9fa6ec89dc1bcbe01c70d2793a3b7585e3ac63396f

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI3A69.tmp

Filesize
2.3MB

MD5
3bc82080d6356dae779eed5135fabf66

SHA1
022c84f9cc59ec45315d78979497cd061658aba3

SHA256
b076c9b888b130fb2fb5a74542c9a73322e78ed1f3f8476be7a8209a20e56f7b

SHA512
041cd3945a22dcec792f45abc7f95b9fb7e68254948f0bfeb49de6b3501a0e13525454aa222dc4b903b3c9bafd4e0ffc2e5a99bd140238e845d3fcb7c496afbd

Download Submit
C:\Windows\Installer\e5910cf.msi

Filesize
13.7MB

MD5
909db4061c32f798e94d746717782444

SHA1
10f5ffff17d2dd4476686a941a7bcc5f9b83b1b8

SHA256
6ee98db32852a2ff31a969d918bb7c730950bb15f24ea1baf996697cebc8b9fa

SHA512
44e7f97b27aef2e4cb62a6a0ebab5033b99e1ec940f231eda416f3b68d83df81d10950a8ced2ca528024adecd1dea7e1d4427e78b111edbc0124d7ffd6c1232d

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\LogMeIn Hamachi\h2-engine.cfg.bak

Filesize
1KB

MD5
5919a4242a1fb169c68317d18adf2746

SHA1
4bc5e0bbba80f43fc5bda2d45eacab772fe8a302

SHA256
7e5adb2f62eb88481057a6e469ed552b15beea681c3cc4ab37c96b458d1969ba

SHA512
e2b7cdd9831e3e07887b9fce9b940845158be0c0e632705f318d12d21d785af7ec6e7c45cbd5675a024188bb7fcbb0adc28f317767aadb7ae4fb3d9f0c29ce48

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\LogMeIn Hamachi\h2-engine.ini.updating

Filesize
7B

MD5
0f81d52e06caaa4860887488d18271c7

SHA1
13a1891af75c642306a6b695377d16e4a91f0e1b

SHA256
27eb5e51506c911f6fc4bb345c0d9db6f60415fceab7c18e1e9b862637415777

SHA512
7ccef1661d9bae2a1a219de1d53fea0e2441354e4e4c3e111f75bf926fb12c5b0e6e7824200cf65dfa5686216b9e67436038bdc69c7ea7621f3c67b481510cd7

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\LogMeIn Hamachi\h2-engine.log

Filesize
359B

MD5
ec5b0f91ce79ca9aac2a1e25be89a9a9

SHA1
93895e7ced550258cd21141bb28321ee7a4dcb4f

SHA256
04b5dfd94debb816032eaddf74526789d9c8b5935c2d57ca11ff89bb114aff04

SHA512
d2eb7b1a6a546112dd3e434a50bea362add085943dfb41d3712e6740967d2653758f584e21dd78aeddb7c3d7c890a8f91bf76b729ea3a092bf18bc6fe7825c0d

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\LogMeIn Hamachi\h2-engine.log

Filesize
605B

MD5
47d742ead76629cc03273df90990d659

SHA1
b516c32c2708018d06a5f5c39db76337c7a91c9a

SHA256
93599b59ff652c4ed868d15b6000615c1851628e21a923ea6f9ab6b41ccea926

SHA512
9dd15ac2e25e9a64e5acab7849d2cd962b34af61cd28b78ce451daf928d9aa12a58f0d660de65c1b16a28188a7e57af5622ccad1d8da4316686b32d06dcf8b65

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\LogMeIn Hamachi\h2-engine.log

Filesize
1KB

MD5
e76df8f8d15580665aae440abf88e1a2

SHA1
bff4cb01c486c8be8c7cd992d8a7f286fa1a066b

SHA256
79659f04c7c00cfb957a442a994e14437143744c1450aa685a3eaa1f80716374

SHA512
104fc6fe3cdf58cb754dad4b3eb1081635aa476c11567941e2b46a5f81d10b426eadb0507dd37437577e93bc03027d9645ee11eac2ff94886993d3f4251f93d6

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\LogMeIn Hamachi\h2-engine.log

Filesize
2KB

MD5
8f5223c6391fa82d8c1170516ea9ab24

SHA1
c60f9e1710bdc1cd89f1aa0b652ebd955b415669

SHA256
c4357341ab28522ed6403b145f9eae063ecf2ec54761b4a874ecef86371fdc50

SHA512
8233e3b56112b9d5baeea1aca496ae1c3383f1e5abc74a742e130705fb20a6a139c2983a0e4690fb0437e5f42cbab310287a20f9b49b754c488dd8545be3327b

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\LogMeIn Hamachi\h2-engine.log

Filesize
3KB

MD5
ba664edf7a5463f981cfe5b1b53822d8

SHA1
d6e856606c00cc1fc5eea7ab91666308fd912325

SHA256
c16d75ae1df4b68fecc1b4572186a165d73abdc51a34f8ba7baa95212bb2ced2

SHA512
51931c56fdfdc64d46ab4fa771134b2a4baec7c49ccbd50fa1cc57710198f350ea343d707471fcb9c18b65b35a538510e41c4d75056900510bc41292fd550b3c

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\LogMeIn Hamachi\h2-engine.log

Filesize
3KB

MD5
2bf26513317f3c5d9201c5c54e1fa518

SHA1
9808af9e4f910cef9c43c8f5db4e6514f25ad2d5

SHA256
86940bf6607f069c41393ef2bd6e2b68665b9e34a2ef838419a1254ff55cc0de

SHA512
5ada3fd07d6fabd2099e56fed26d135307516f78ba26f652646c18e8f51b3887172794eff85d04def7006d9c26fac10361925723f58eb999a5a8beb329deca2a

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\LogMeIn Hamachi\h2-engine.log

Filesize
3KB

MD5
993cc11d9170cb0f38af496c4ca9db85

SHA1
a7403adb9b187e520c53eee263ab5805c0e0f199

SHA256
0bda1284abbda7d474f858d9efef689942ffc31548b9881126f52d41ad3bbbe6

SHA512
5bbce197ce1b559fca68469561054d44221c75f51cd65574376967969ce1d1f4808c782c2d8f9186c7bae068ceab5160edf0e8175d617ae6c9ee9893a81392b6

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\LogMeIn Hamachi\h2-engine.log

Filesize
4KB

MD5
22e7b50468c777bb92644c9e4b9c559f

SHA1
d7dfc5b832afbe0c6e54dc35a4c0eaf66df8745c

SHA256
fbbb0650cecfb13907ee640778560b8c3edaa1b811a445d01a74ac38b088ed47

SHA512
9d003dcb72ada361c1a41d3ad611319d3c3347d362984bb66daf47c1bffa804f5faf2fbaf6907b933b6c2c29c42913a660998d2819d48197423333fcc84cf4c0

Download Submit
C:\Windows\Temp\HamachiSetup.log

Filesize
968B

MD5
439f662a3ecd2c9f75d0f72c6dde111e

SHA1
14b13c25ffa44b9ed1ef123551991834e30a153c

SHA256
e83b4d3463d2a29c7708dafa4adbfe4a0247407f97e4ee4038f647387d2140bd

SHA512
44d25335f01eea0358e84e6399ccf38eff465a9c22fffa64c093eede52d19ddd6717a9c092b4a1707fa080155d4dccee9e7255158e3569e3e191199c258cadfe

Download Submit
C:\Windows\Temp\HamachiSetup.log

Filesize
1KB

MD5
adc25400519db387fb65d4b6672c2c1e

SHA1
05ec13e758f853bbea32ed7c361903aecd5e4a77

SHA256
2daa6655bcca71baf29b984a278fe6a67f1113cea34e577ed6f1a390347ed6be

SHA512
ff0de1413c0a09fefa3674cbdb9db0cbfd1479ef133edcc1c705d97cfaf6b3e5e85f3027f9e8f44e8ab98de5e9b7a6e4a98d8a7fcc58b5d8b248766018abcdfd

Download Submit
\??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2

Filesize
23.7MB

MD5
375a22c535258bde520ab148b4ce3ecf

SHA1
4468f729baaea0c3d3afb43de4de3f1e16c464bf

SHA256
9095b680b1c1ca6a9cca78ccbc09235598b45f4ad37899efdc89f859e06c8a75

SHA512
b2c7805f66ed378b6707ae1e8772e1666156f9e90e86d8089511005f09500561c69c0b993f2f93e6bbcf6e8577ccef72a25dde4db05f97ca33beabe5d17f0aca

Download Submit
\??\Volume{b9e6a081-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{3f00b7be-85d3-4e0a-9fff-ee75bad2f6cc}_OnDiskSnapshotProp

Filesize
6KB

MD5
445890bc085935a100c8bb6c628aba05

SHA1
11c3671dc47cb90bde17adff77d5db59fb20a1ed

SHA256
2bf14cf8f9ae574c48fb5fa6facdaa28384bc159229d3b2472a4861ef248dab4

SHA512
34c60ccd4e5d20057dc42ffd1a44cd8852a0b0e3943176f6b8aa725460fa9880614501a9fd993ad8a979118de7efaabbd5116546829ed717559de8d6cf81e40d

Download Submit
\??\c:\PROGRA~2\LOGMEI~1\x64\Hamdrv.sys

Filesize
44KB

MD5
7f79205b4efa98f0767309479c8c01c6

SHA1
9d546dda7536a85a3f4228e065967be1648ad901

SHA256
4b576903a83f33a8cf31d3887144a3d51c56d1187115c83ac99c0e9f6b4bf128

SHA512
418ac89f3c5996de50c846693995145e314d0cd7edee59f0cdc212720d84be1351827c7ab02e870d1940288f5c4838d39c77fbc9847b69ab5fce5d74400c19ca

Download Submit
\??\c:\program files (x86)\logmein hamachi\x64\hamdrv.cat

Filesize
10KB

MD5
f49c69fcca067884f38e9cab20ba8920

SHA1
bbe2113cfeb8b9a2234d97849c05c4a72b368a7d

SHA256
e436ceef0126e703fe48bd669e3748e468b6f8027a8b6c2ae779f2911e65331c

SHA512
e233dc261ea650d0cc01834591ba5c7e113daa23da7ada913c589ddff13c7d5b946da5f3f649e81de9afa664d0c4bf5b6fc921e359c252dee5132c8f584c60d3

Download Submit
\??\c:\program files (x86)\logmein hamachi\x64\hamdrv.inf

Filesize
6KB

MD5
da79247b2ba817d655c2db44bdebff1c

SHA1
fb62be8194096675dace18cd1217217ec2f85777

SHA256
35e3427711eb7e0645d3f4ffbc3dd73b16e96ef1dc4c210db1f67229283f414a

SHA512
e124e5bce81d09713b959a54da96ca7679b9880e69952faef360c7f0311a6d85a97d377281edbae22e61f7e3204847fb4eafd64a15aa97079bf9cda2cf1f0328

Download Submit
memory/232-480-0x0000000074A70000-0x0000000074CC8000-memory.dmp

Filesize
2.3MB

Download
memory/232-481-0x0000000074A60000-0x0000000074A6E000-memory.dmp

Filesize
56KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads