a21b719d48905fd06b2281a4a47bfa8605e895e1ad7812963d249f87368c42de

Analysis

max time kernel
150s
max time network
149s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
17/06/2024, 11:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b858bf816d0771d9a76ccd75a6f3df9e_JaffaCakes118.exe
Size

3.2MB
MD5

b858bf816d0771d9a76ccd75a6f3df9e
SHA1

ad3b6ef3e576f7441de1e9f2a45e9e2a6286606f
SHA256

a21b719d48905fd06b2281a4a47bfa8605e895e1ad7812963d249f87368c42de
SHA512

423bf4ec905bf92c9fa8f88ffed4728496046b24302a988684d396b9516c57d49f1d56114342ba051b1905abfc97818af4469f62202422400801634e4aff60dd
SSDEEP

98304:8FK0gqbVSHbSMKHaBAxuAk/tQADDTyRzwd6Q8:81SHvcmAxLpE2zwd6Q8

Score

9^/10

discovery evasion exploit persistence spyware stealer upx

Malware Config

Signatures

Nirsoft 2 IoCs

resource	yara_rule
behavioral1/memory/2936-114-0x0000000000400000-0x000000000041B000-memory.dmp	Nirsoft
behavioral1/memory/2972-130-0x0000000000400000-0x000000000041B000-memory.dmp	Nirsoft

Drops file in Drivers directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\DRIVERS\teamviewervpn.sys	DrvInst.exe
File opened for modification	C:\Windows\system32\DRIVERS\SET6B22.tmp	DrvInst.exe
File created	C:\Windows\system32\DRIVERS\SET6B22.tmp	DrvInst.exe

Modifies Windows Firewall 2 TTPs 3 IoCs

evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
2512	netsh.exe
1696	netsh.exe
616	netsh.exe

Possible privilege escalation attempt 2 IoCs

exploit

pid	Process
1060	icacls.exe
1632	takeown.exe

Sets DLL path for service in the registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\TermService\Parameters\ServiceDll = "%SystemRoot%\\system32\\rdpwrap.dll"	regsvr.exe

Allows Network login with blank passwords 1 TTPs 1 IoCs

Allows local user accounts with blank passwords to access device from the network.

Remote Desktop Protocol

T1021.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Lsa\LimitBlankPasswordUse = "0"	regsvr.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Control Panel\International\Geo\Nation	regsvr.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Control Panel\International\Geo\Nation	regsvr.exe

Executes dropped EXE 7 IoCs

pid	Process
2692	2us6otf8rec
2936	sv0e6tcmn
2972	sv0e6tcmn
3060	regsvr.exe
540	install64.exe
1372	install64.exe
2836	regsvr.exe

Loads dropped DLL 36 IoCs

pid	Process
2332	b858bf816d0771d9a76ccd75a6f3df9e_JaffaCakes118.exe
2332	b858bf816d0771d9a76ccd75a6f3df9e_JaffaCakes118.exe
2332	b858bf816d0771d9a76ccd75a6f3df9e_JaffaCakes118.exe
2332	b858bf816d0771d9a76ccd75a6f3df9e_JaffaCakes118.exe
2332	b858bf816d0771d9a76ccd75a6f3df9e_JaffaCakes118.exe
2332	b858bf816d0771d9a76ccd75a6f3df9e_JaffaCakes118.exe
2332	b858bf816d0771d9a76ccd75a6f3df9e_JaffaCakes118.exe
2332	b858bf816d0771d9a76ccd75a6f3df9e_JaffaCakes118.exe
2332	b858bf816d0771d9a76ccd75a6f3df9e_JaffaCakes118.exe
2332	b858bf816d0771d9a76ccd75a6f3df9e_JaffaCakes118.exe
2332	b858bf816d0771d9a76ccd75a6f3df9e_JaffaCakes118.exe
2332	b858bf816d0771d9a76ccd75a6f3df9e_JaffaCakes118.exe
2332	b858bf816d0771d9a76ccd75a6f3df9e_JaffaCakes118.exe
2332	b858bf816d0771d9a76ccd75a6f3df9e_JaffaCakes118.exe
2332	b858bf816d0771d9a76ccd75a6f3df9e_JaffaCakes118.exe
2972	sv0e6tcmn
3060	regsvr.exe
3060	regsvr.exe
3060	regsvr.exe
3060	regsvr.exe
3060	regsvr.exe
3060	regsvr.exe
3060	regsvr.exe
3060	regsvr.exe
3060	regsvr.exe
3060	regsvr.exe
3060	regsvr.exe
2836	regsvr.exe
2836	regsvr.exe
2836	regsvr.exe
2836	regsvr.exe
2836	regsvr.exe
2836	regsvr.exe
2836	regsvr.exe
2836	regsvr.exe
296	Process not Found

Modifies file permissions 1 TTPs 2 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
1632	takeown.exe
1060	icacls.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x0007000000015cc2-105.dat	upx
behavioral1/memory/2332-107-0x00000000006A0000-0x00000000006BB000-memory.dmp	upx
behavioral1/memory/2936-114-0x0000000000400000-0x000000000041B000-memory.dmp	upx
behavioral1/memory/2332-113-0x00000000006A0000-0x00000000006BB000-memory.dmp	upx
behavioral1/memory/2972-130-0x0000000000400000-0x000000000041B000-memory.dmp	upx
behavioral1/memory/2332-129-0x00000000006A0000-0x00000000006BB000-memory.dmp	upx

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\regsvr = "C:\\Users\\Admin\\AppData\\Roaming\\INT\\regsvr.exe"	regsvr.exe

Modifies WinLogon 2 TTPs 4 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList	regsvr.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts	regsvr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList\sys = "0"	regsvr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\AllowMultipleTSSessions = "1"	regsvr.exe

Drops file in System32 directory 25 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\DriverStore\infpub.dat	install64.exe
File created	C:\Windows\System32\rdpwrap64.dll	regsvr.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{0f362de2-f297-4cda-d4da-9d555a06255e}\SET69CC.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{0f362de2-f297-4cda-d4da-9d555a06255e}\SET69DC.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\infpub.dat	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{0f362de2-f297-4cda-d4da-9d555a06255e}\teamviewervpn.sys	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\infstrng.dat	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\teamviewervpn.inf_amd64_neutral_5e1dcb6f86e23dcd\teamviewervpn.PNF	DrvInst.exe
File created	C:\Windows\System32\DriverStore\INFCACHE.0	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{0f362de2-f297-4cda-d4da-9d555a06255e}	DrvInst.exe
File opened for modification	C:\Windows\System32\CatRoot2\dberr.txt	install64.exe
File opened for modification	C:\Windows\System32\sethc.exe	regsvr.exe
File created	C:\Windows\System32\DriverStore\Temp\{0f362de2-f297-4cda-d4da-9d555a06255e}\SET69CB.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{0f362de2-f297-4cda-d4da-9d555a06255e}\teamviewervpn.cat	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\infstrng.dat	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\infpub.dat	DrvInst.exe
File created	C:\Windows\System32\sethc.exe	regsvr.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{0f362de2-f297-4cda-d4da-9d555a06255e}\SET69CB.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\infstrng.dat	install64.exe
File opened for modification	C:\Windows\System32\DriverStore\infstor.dat	DrvInst.exe
File created	C:\Windows\System32\DriverStore\FileRepository\teamviewervpn.inf_amd64_neutral_5e1dcb6f86e23dcd\teamviewervpn.PNF	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{0f362de2-f297-4cda-d4da-9d555a06255e}\SET69CC.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{0f362de2-f297-4cda-d4da-9d555a06255e}\teamviewervpn.inf	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{0f362de2-f297-4cda-d4da-9d555a06255e}\SET69DC.tmp	DrvInst.exe
File created	C:\Windows\System32\rdpwrap.ini	regsvr.exe

Drops file in Windows directory 11 IoCs

description	ioc	Process
File opened for modification	C:\Windows\INF\setupapi.ev2	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	install64.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File created	C:\Windows\INF\oem2.inf	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.ev1	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File created	C:\Windows\INF\oem2.PNF	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.app.log	install64.exe
File opened for modification	C:\Windows\INF\oem2.inf	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.ev3	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.app.log	install64.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2228	sc.exe
1460	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@netcfgx.dll,-50002 = "Allows your computer to access resources on a Microsoft network."	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@netcfgx.dll,-50003 = "Allows other computers to access resources on your computer using a Microsoft network."	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\lltdres.dll,-3 = "Allows this PC to be discovered and located on the network."	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%systemroot%\system32\rascfg.dll,-32009 = "Allows you to securely connect to a private network using the Internet."	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\lltdres.dll,-4 = "Used to discover and locate other PCs, devices, and network infrastructure components on the network. Also used to determine network bandwidth."	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\System32\drivers\pacer.sys,-100 = "Quality of Service Packet Scheduler. This component provides network traffic control, including rate-of-flow and prioritization services."	DrvInst.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%systemroot%\system32\rascfg.dll,-32010 = "Provides the abilitiy to connect a host to a Remote Access Concentrator that supports RFC2516."	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%systemroot%\system32\rascfg.dll,-32008 = "Allows you to securely connect to a private network using the Internet."	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	DrvInst.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\tcpipcfg.dll,-50001 = "Transmission Control Protocol/Internet Protocol. The default wide area network protocol that provides communication across diverse interconnected networks."	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	DrvInst.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2332	b858bf816d0771d9a76ccd75a6f3df9e_JaffaCakes118.exe
2332	b858bf816d0771d9a76ccd75a6f3df9e_JaffaCakes118.exe
2332	b858bf816d0771d9a76ccd75a6f3df9e_JaffaCakes118.exe
2332	b858bf816d0771d9a76ccd75a6f3df9e_JaffaCakes118.exe
3060	regsvr.exe
3060	regsvr.exe
3060	regsvr.exe
3060	regsvr.exe
3060	regsvr.exe
3060	regsvr.exe
3060	regsvr.exe
3060	regsvr.exe
2836	regsvr.exe
2836	regsvr.exe
2836	regsvr.exe
2836	regsvr.exe
2836	regsvr.exe
2836	regsvr.exe
2836	regsvr.exe
2836	regsvr.exe
2836	regsvr.exe
2836	regsvr.exe
2836	regsvr.exe
2836	regsvr.exe
2836	regsvr.exe
2836	regsvr.exe
2836	regsvr.exe
2836	regsvr.exe
2836	regsvr.exe
2836	regsvr.exe
2836	regsvr.exe
2836	regsvr.exe
2836	regsvr.exe
2836	regsvr.exe
2836	regsvr.exe
2836	regsvr.exe
2836	regsvr.exe
2836	regsvr.exe
2836	regsvr.exe
2836	regsvr.exe
2836	regsvr.exe
2836	regsvr.exe
2836	regsvr.exe
2836	regsvr.exe
2836	regsvr.exe
2836	regsvr.exe
2836	regsvr.exe
2836	regsvr.exe
2836	regsvr.exe
2836	regsvr.exe
2836	regsvr.exe
2836	regsvr.exe
2836	regsvr.exe
2836	regsvr.exe
2836	regsvr.exe
2836	regsvr.exe
2836	regsvr.exe
2836	regsvr.exe
2836	regsvr.exe
2836	regsvr.exe
2836	regsvr.exe
2836	regsvr.exe
2836	regsvr.exe
2836	regsvr.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
296	Process not Found

Suspicious use of AdjustPrivilegeToken 48 IoCs

description	pid	Process
Token: SeRestorePrivilege	2692	2us6otf8rec
Token: 35	2692	2us6otf8rec
Token: SeSecurityPrivilege	2692	2us6otf8rec
Token: SeSecurityPrivilege	2692	2us6otf8rec
Token: SeDebugPrivilege	3060	regsvr.exe
Token: SeRestorePrivilege	540	install64.exe
Token: SeRestorePrivilege	540	install64.exe
Token: SeRestorePrivilege	540	install64.exe
Token: SeRestorePrivilege	540	install64.exe
Token: SeRestorePrivilege	540	install64.exe
Token: SeRestorePrivilege	540	install64.exe
Token: SeRestorePrivilege	540	install64.exe
Token: SeRestorePrivilege	540	install64.exe
Token: SeRestorePrivilege	540	install64.exe
Token: SeRestorePrivilege	540	install64.exe
Token: SeRestorePrivilege	540	install64.exe
Token: SeRestorePrivilege	540	install64.exe
Token: SeRestorePrivilege	540	install64.exe
Token: SeRestorePrivilege	540	install64.exe
Token: SeRestorePrivilege	3036	DrvInst.exe
Token: SeRestorePrivilege	3036	DrvInst.exe
Token: SeRestorePrivilege	3036	DrvInst.exe
Token: SeRestorePrivilege	3036	DrvInst.exe
Token: SeRestorePrivilege	3036	DrvInst.exe
Token: SeRestorePrivilege	3036	DrvInst.exe
Token: SeRestorePrivilege	3036	DrvInst.exe
Token: SeRestorePrivilege	3036	DrvInst.exe
Token: SeRestorePrivilege	3036	DrvInst.exe
Token: SeRestorePrivilege	3036	DrvInst.exe
Token: SeRestorePrivilege	3036	DrvInst.exe
Token: SeRestorePrivilege	3036	DrvInst.exe
Token: SeRestorePrivilege	3036	DrvInst.exe
Token: SeRestorePrivilege	3036	DrvInst.exe
Token: SeRestorePrivilege	540	install64.exe
Token: SeLoadDriverPrivilege	540	install64.exe
Token: SeRestorePrivilege	2384	DrvInst.exe
Token: SeRestorePrivilege	2384	DrvInst.exe
Token: SeRestorePrivilege	2384	DrvInst.exe
Token: SeRestorePrivilege	2384	DrvInst.exe
Token: SeRestorePrivilege	2384	DrvInst.exe
Token: SeRestorePrivilege	2384	DrvInst.exe
Token: SeRestorePrivilege	2384	DrvInst.exe
Token: SeRestorePrivilege	2384	DrvInst.exe
Token: SeLoadDriverPrivilege	2384	DrvInst.exe
Token: SeLoadDriverPrivilege	1372	install64.exe
Token: SeLoadDriverPrivilege	1372	install64.exe
Token: SeDebugPrivilege	2836	regsvr.exe
Token: SeTakeOwnershipPrivilege	1632	takeown.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2332 wrote to memory of 2692	2332	b858bf816d0771d9a76ccd75a6f3df9e_JaffaCakes118.exe	28
PID 2332 wrote to memory of 2692	2332	b858bf816d0771d9a76ccd75a6f3df9e_JaffaCakes118.exe	28
PID 2332 wrote to memory of 2692	2332	b858bf816d0771d9a76ccd75a6f3df9e_JaffaCakes118.exe	28
PID 2332 wrote to memory of 2692	2332	b858bf816d0771d9a76ccd75a6f3df9e_JaffaCakes118.exe	28
PID 2332 wrote to memory of 2936	2332	b858bf816d0771d9a76ccd75a6f3df9e_JaffaCakes118.exe	30
PID 2332 wrote to memory of 2936	2332	b858bf816d0771d9a76ccd75a6f3df9e_JaffaCakes118.exe	30
PID 2332 wrote to memory of 2936	2332	b858bf816d0771d9a76ccd75a6f3df9e_JaffaCakes118.exe	30
PID 2332 wrote to memory of 2936	2332	b858bf816d0771d9a76ccd75a6f3df9e_JaffaCakes118.exe	30
PID 2332 wrote to memory of 2972	2332	b858bf816d0771d9a76ccd75a6f3df9e_JaffaCakes118.exe	31
PID 2332 wrote to memory of 2972	2332	b858bf816d0771d9a76ccd75a6f3df9e_JaffaCakes118.exe	31
PID 2332 wrote to memory of 2972	2332	b858bf816d0771d9a76ccd75a6f3df9e_JaffaCakes118.exe	31
PID 2332 wrote to memory of 2972	2332	b858bf816d0771d9a76ccd75a6f3df9e_JaffaCakes118.exe	31
PID 2972 wrote to memory of 3060	2972	sv0e6tcmn	32
PID 2972 wrote to memory of 3060	2972	sv0e6tcmn	32
PID 2972 wrote to memory of 3060	2972	sv0e6tcmn	32
PID 2972 wrote to memory of 3060	2972	sv0e6tcmn	32
PID 3060 wrote to memory of 540	3060	regsvr.exe	33
PID 3060 wrote to memory of 540	3060	regsvr.exe	33
PID 3060 wrote to memory of 540	3060	regsvr.exe	33
PID 3060 wrote to memory of 540	3060	regsvr.exe	33
PID 3060 wrote to memory of 1372	3060	regsvr.exe	38
PID 3060 wrote to memory of 1372	3060	regsvr.exe	38
PID 3060 wrote to memory of 1372	3060	regsvr.exe	38
PID 3060 wrote to memory of 1372	3060	regsvr.exe	38
PID 3060 wrote to memory of 2836	3060	regsvr.exe	41
PID 3060 wrote to memory of 2836	3060	regsvr.exe	41
PID 3060 wrote to memory of 2836	3060	regsvr.exe	41
PID 3060 wrote to memory of 2836	3060	regsvr.exe	41
PID 2836 wrote to memory of 580	2836	regsvr.exe	45
PID 2836 wrote to memory of 580	2836	regsvr.exe	45
PID 2836 wrote to memory of 580	2836	regsvr.exe	45
PID 2836 wrote to memory of 580	2836	regsvr.exe	45
PID 580 wrote to memory of 444	580	net.exe	47
PID 580 wrote to memory of 444	580	net.exe	47
PID 580 wrote to memory of 444	580	net.exe	47
PID 2836 wrote to memory of 2512	2836	regsvr.exe	48
PID 2836 wrote to memory of 2512	2836	regsvr.exe	48
PID 2836 wrote to memory of 2512	2836	regsvr.exe	48
PID 2836 wrote to memory of 2512	2836	regsvr.exe	48
PID 2836 wrote to memory of 2228	2836	regsvr.exe	50
PID 2836 wrote to memory of 2228	2836	regsvr.exe	50
PID 2836 wrote to memory of 2228	2836	regsvr.exe	50
PID 2836 wrote to memory of 2228	2836	regsvr.exe	50
PID 2836 wrote to memory of 1460	2836	regsvr.exe	52
PID 2836 wrote to memory of 1460	2836	regsvr.exe	52
PID 2836 wrote to memory of 1460	2836	regsvr.exe	52
PID 2836 wrote to memory of 1460	2836	regsvr.exe	52
PID 2836 wrote to memory of 1820	2836	regsvr.exe	54
PID 2836 wrote to memory of 1820	2836	regsvr.exe	54
PID 2836 wrote to memory of 1820	2836	regsvr.exe	54
PID 2836 wrote to memory of 1820	2836	regsvr.exe	54
PID 1820 wrote to memory of 1300	1820	net.exe	56
PID 1820 wrote to memory of 1300	1820	net.exe	56
PID 1820 wrote to memory of 1300	1820	net.exe	56
PID 2836 wrote to memory of 1632	2836	regsvr.exe	57
PID 2836 wrote to memory of 1632	2836	regsvr.exe	57
PID 2836 wrote to memory of 1632	2836	regsvr.exe	57
PID 2836 wrote to memory of 1632	2836	regsvr.exe	57
PID 2836 wrote to memory of 1060	2836	regsvr.exe	59
PID 2836 wrote to memory of 1060	2836	regsvr.exe	59
PID 2836 wrote to memory of 1060	2836	regsvr.exe	59
PID 2836 wrote to memory of 1060	2836	regsvr.exe	59
PID 2836 wrote to memory of 1696	2836	regsvr.exe	61
PID 2836 wrote to memory of 1696	2836	regsvr.exe	61

C:\Users\Admin\AppData\Local\Temp\b858bf816d0771d9a76ccd75a6f3df9e_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\b858bf816d0771d9a76ccd75a6f3df9e_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2332
- C:\Users\Admin\AppData\Local\Temp\nsy1180.tmp\2us6otf8rec
  "C:\Users\Admin\AppData\Local\Temp\nsy1180.tmp\2us6otf8rec" x -p6882ED8CBCB8B4F40D87E7AD947AB99E "C:\Users\Admin\AppData\Local\Temp\xhzrnnqqwhhdmt8cm99didtx.jpg" "-oC:\Users\Admin\AppData\Roaming"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:2692
- C:\Users\Admin\AppData\Local\Temp\sv0e6tcmn
  "C:\Users\Admin\AppData\Local\Temp\sv0e6tcmn" wait 20000
  2⤵
  - Executes dropped EXE
  PID:2936
- C:\Users\Admin\AppData\Local\Temp\sv0e6tcmn
  "C:\Users\Admin\AppData\Local\Temp\sv0e6tcmn" shexec "" "C:\Users\Admin\AppData\Roaming\INT\regsvr.lnk"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:2972
- - C:\Users\Admin\AppData\Roaming\INT\regsvr.exe
    "C:\Users\Admin\AppData\Roaming\INT\regsvr.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Loads dropped DLL
    - Adds Run key to start application
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:3060
  - - C:\Users\Admin\AppData\Roaming\INT\x64\install64.exe
      C:\Users\Admin\AppData\Roaming\INT\x64\install64.exe -r install C:\Users\Admin\AppData\Roaming\INT\x64\TeamViewerVPN.inf teamviewervpn
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      Drops file in Windows directory
      Suspicious use of AdjustPrivilegeToken
      PID:540
  - - C:\Users\Admin\AppData\Roaming\INT\x64\install64.exe
      C:\Users\Admin\AppData\Roaming\INT\x64\install64.exe restart teamviewervpn
      4⤵
      Executes dropped EXE
      Drops file in Windows directory
      Suspicious use of AdjustPrivilegeToken
      PID:1372
  - - C:\Users\Admin\AppData\Roaming\INT\regsvr.exe
      C:\Users\Admin\AppData\Roaming\INT\regsvr.exe
      4⤵
      Sets DLL path for service in the registry
      Allows Network login with blank passwords
      Checks computer location settings
      Executes dropped EXE
      Loads dropped DLL
      Modifies WinLogon
      Drops file in System32 directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2836
    - - C:\Windows\System32\net.exe
        
        C:\Windows\System32\net.exe stop TermService /y
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:580
      - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 stop TermService /y
        6⤵
        
        PID:444
    - - C:\Windows\System32\netsh.exe
        
        C:\Windows\System32\netsh.exe advfirewall firewall add rule name="Remote Desktop" dir=in protocol=tcp localport=3389 profile=any action=allow
        5⤵
        Modifies Windows Firewall
        
        PID:2512
    - - C:\Windows\System32\sc.exe
        
        C:\Windows\System32\sc.exe config TermService start= auto
        5⤵
        Launches sc.exe
        
        PID:2228
    - - C:\Windows\System32\sc.exe
        
        C:\Windows\System32\sc.exe config DcomLauch start= auto
        5⤵
        Launches sc.exe
        
        PID:1460
    - - C:\Windows\System32\net.exe
        
        C:\Windows\System32\net.exe start TermService /y
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:1820
      - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 start TermService /y
        6⤵
        
        PID:1300
    - - C:\Windows\System32\takeown.exe
        
        C:\Windows\System32\takeown.exe /f C:\Windows\System32\sethc.exe
        5⤵
        Possible privilege escalation attempt
        Modifies file permissions
        Suspicious use of AdjustPrivilegeToken
        
        PID:1632
    - - C:\Windows\System32\icacls.exe
        
        C:\Windows\System32\icacls.exe C:\Windows\System32\sethc.exe /grant *S-1-5-32-544:F
        5⤵
        Possible privilege escalation attempt
        Modifies file permissions
        
        PID:1060
    - - C:\Windows\System32\netsh.exe
        
        C:\Windows\System32\netsh.exe firewall set service type=ALL scope=ALL profile=CURRENT
        5⤵
        Modifies Windows Firewall
        
        PID:1696
    - - C:\Windows\System32\netsh.exe
        
        C:\Windows\System32\netsh.exe firewall set service type=ALL scope=ALL profile=DOMAIN
        5⤵
        Modifies Windows Firewall
        
        PID:616

C:\Windows\system32\DrvInst.exe
DrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{43a23f89-a467-5d93-89e9-23211d864a0c}\teamviewervpn.inf" "9" "6b0706d3f" "000000000000049C" "WinSta0\Default" "00000000000004A4" "208" "c:\users\admin\appdata\roaming\int\x64"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:3036

C:\Windows\system32\DrvInst.exe
DrvInst.exe "2" "211" "ROOT\NET\0000" "C:\Windows\INF\oem2.inf" "teamviewervpn.inf:teamviewervpn.NTamd64:teamviewervpn.ndi:2.10.0.0:teamviewervpn" "6b0706d3f" "000000000000049C" "00000000000005BC" "00000000000003A8"
1⤵
- Drops file in Drivers directory
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2384

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {995C996E-D918-4a8c-A302-45719A6F4EA7} -Embedding
1⤵
PID:2744

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

File and Directory Permissions Modification

T1222

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Remote Services

T1021

Remote Desktop Protocol

T1021.001

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\f1m2fsqizv9lb

Filesize
320B

MD5
e8912822fc1e9efa844af889919fdcca

SHA1
79ea8febf0103cf8a05f62b1f1455519aded75a6

SHA256
abb006b464385a32220725b4ce67341c62204bf7d83aae8f9ebdc03a7d4b3697

SHA512
f80925f477e8eb53415581e6ceae2924d84adcd82a20b9acb0d76da4e2ad6e25dfc99bd30338379712ae1f0c135d99f2bf6320c7498cabfdaf7d8a761f7dd66f

Download Submit
C:\Users\Admin\AppData\Local\Temp\xhzrnnqqwhhdmt8cm99didtx.jpg

Filesize
2.7MB

MD5
ab84da981e287e44d11648d29cdbb882

SHA1
df014a3743b9a2e24a4cec5b010a42228226e7fc

SHA256
b081c56d67dcf29c0edf5623756a58a1bb8ad834b42e0c79390db5336db86280

SHA512
03205afed55dc7f771bae1b1d4eaf76f508f45433f8480a655d5667b4a30eb1a49bfbc33e6263915fd6d141a4e6338313f1c9219a11ad3c46a9c6c79f4f07109

Download Submit
C:\Users\Admin\AppData\Roaming\INT\TeamViewer_Desktop.exe

Filesize
2.1MB

MD5
95b5331ae88259d3a9dda90f2a29905c

SHA1
3df3d52c6fc9e1811954a0b66c0e29f52f844a8e

SHA256
9fe4685f1d76b3c0ff80e2b9348d5f1b5a7856d472ae4be4b0fe9d9c08d32669

SHA512
e9e67334758f2261131310b1ecf9dd9f6d70a123b3519110ec781d3dd26b7832734cee45c6643809b741d74b0c9d9f3b3abddefb427a4d691a31a9cef81848db

Download Submit
C:\Users\Admin\AppData\Roaming\INT\TeamViewer_Resource_en.dll

Filesize
1.2MB

MD5
97878dceaf0632f49b75601e998c53e1

SHA1
ee60be147721e2c4ef5d7d6860fce8645b2088e6

SHA256
a40088e36440f9de74bbd2d6e5cf969ab42ff629cea6d685cc9d8300b91b5028

SHA512
9691057e6f0aefeac2c4275c278ac8cbe5ac95d820bd92b2e65c0d8aee6768241b4832b31db7df2e0b203c77b2c486662bdd31c66892b84bb2a49edabda9abf7

Download Submit
C:\Users\Admin\AppData\Roaming\INT\h7we97gmledmz9.jpg

Filesize
13KB

MD5
351cf626f899fbf851ed9bc15bcfe4e3

SHA1
c108746906bd01f5b6a1a22d41184528c91d6c99

SHA256
3d4820e1178605a257851fc7ddd33f12e9b9d49a134e5c1abbc2b624e5859c3a

SHA512
c4aa0855ca081ad38499e22c10e9854b63e8e98eae84d92a11c2c4efcd74c73118b1e544c8d780490aa2c58f6b89834ac60adea23c8d362ceae9bd33ffb46218

Download Submit
C:\Users\Admin\AppData\Roaming\INT\installvpn.pg

Filesize
3KB

MD5
1dbcbc0aeefbef5a941ecee7568bb7d1

SHA1
9061ff9830499ccd2df0d20afd73373f766659de

SHA256
36c60f63fb12f9df18afb3e255b44d96ead54c9d48dcb4638e12b1a54475d0c2

SHA512
3b0adc6e7adac47e217f5a77bdbb35e2f633b47e661598163f6b1832e05ce064c8b7bff10710f13fd771673aff3cf7da804508fb5a72e28a8b50d28a43e54e91

Download Submit
C:\Users\Admin\AppData\Roaming\INT\pqb3w3

Filesize
49KB

MD5
54b108d7a3882812e5f9cb5d3275ce5c

SHA1
44a9ea2494b3e8ad2dfa7d9f4d2fe7748b978974

SHA256
b74e873f8604997e444b01a97a024bd56d005f136dfdae9e060b981cd7d0b571

SHA512
e1159a636d10a86f5d2fddd2b4b05a63f4bd10d8dd782e060287c97af597061aa3782429ed43d0023c31498fd800d6ed66eb5daee28455a8d0393263b9821774

Download Submit
C:\Users\Admin\AppData\Roaming\INT\rdw.pg

Filesize
406KB

MD5
1b8ca0bc04d94d0bf2fbc128d49a3c44

SHA1
34512c7376ac65ace1693b8fe5833c9f6672eb1b

SHA256
d9a301684e39a64c68f8a17374bf67acdc98fd17e7be79b610eda0ac09446e2e

SHA512
c23334942a5d1ea5ef6575a77d6bd8e813d1ef165ffdb246a1970cbb6f42bb6b80851c40ffa4d00093a5470e74b0555c458c5f209a6987fae7a632e6d653a475

Download Submit
C:\Users\Admin\AppData\Roaming\INT\regsvr.exe

Filesize
7.0MB

MD5
28c4c35aed7949277a9c68a04a113114

SHA1
2a845df5253b3f5becb9c83527c9bfd3113be092

SHA256
5c80b0ced982b868d7e2ba6269509f597a05704fa6d86a30e8d51bf5687c3361

SHA512
ed4ca23c7efd4fbf39ae50dc14020aead7d515e27b002aa2dd7a5417ba63c550d19120f84ef7058147035dfbc55f937debbde61bcd1af2e2070ae6b04b786618

Download Submit
C:\Users\Admin\AppData\Roaming\INT\regsvr.lnk

Filesize
805B

MD5
a19c1d63b980479ac7627e268582fea2

SHA1
db5f026fed805f4989c3717005f34bf125b31b4b

SHA256
3ecf9efb2f28e92694a731b42a8390e6408849ad845a382ed851b2cb1a887590

SHA512
afc0fa8d19f0a768fdb8b871504fd42ef233334464acea107933cbb7bd813e0b0082ac20c0c24ca43cdd8309a3960a45f69f151c64d811ae0dab7c667a000b28

Download Submit
C:\Users\Admin\AppData\Roaming\INT\scankey.pg

Filesize
2KB

MD5
b65ee713a834f3e0712cc5d0f494f8cc

SHA1
231ce0ffd58502dca27eaa5653d07b7cfda76b36

SHA256
7fd3d650ffea9a2c4bb43770985a39d393d100c01569fd06fa67ff45f6403566

SHA512
bd60aa037901fe5b721d3637037b7aa5a01522912683c0274a16665c66f99cae01ed59cdc7f8a78b1674a1fd08f759f9c6edec3bc4b61b3ea6bf2f9f3e5e4be7

Download Submit
C:\Users\Admin\AppData\Roaming\INT\tv.cfg

Filesize
914B

MD5
60f9c16fa34611bbe39715b43855e17c

SHA1
25ee87d27f47f6b10ce1ed3b2839dfbd612ee6c5

SHA256
dd0731cea712f02d17e2f69a5963d37c8dc8ab539a2ca83469f0402cd8642314

SHA512
27176d4d6d4e6ec55e3052b52bf270f9e610d0a6a82573adb331731f6a61dfdc99511ff21a2003973a070941cd36e90498a9363109e55596864d46be80226db5

Download Submit
C:\Users\Admin\AppData\Roaming\INT\tv_w32.exe

Filesize
106KB

MD5
7d90bdf0f9c2d9224d8b4d5d2f195506

SHA1
aa1bef60878b8c43c6fd763a0bf83b65a488ba81

SHA256
c96ed3b60727973d746834eaec3df520447a039dc447f717f6cd32335e2dc1d0

SHA512
4b08e6b4da089d46ce806baa1c3896d46bf9aa3598141502c3dd62683d97a50e560e48c1060bde0e959b3e33f05b1fc43056cf99b2252a9a1a0099294bd6a5b6

Download Submit
C:\Users\Admin\AppData\Roaming\INT\tv_x64.dll

Filesize
52KB

MD5
dcd8cda46bb20ff09c8c8be8be2f3098

SHA1
f39483343c5f95011131048cc0326ab1d034ef29

SHA256
a21dafab3d25f88d7001de9437f0a01c72d66db0c1a190dd5acdb2cc38ea9513

SHA512
9d28691f3532f8126429940623872503560c3244d111b64d3e598e08d961f8bb05efc87247d5f78b288506d8e77e08a9ce20c76cc8ac14b28a84d26f2d8f8565

Download Submit
C:\Users\Admin\AppData\Roaming\INT\tv_x64.exe

Filesize
141KB

MD5
e0331b54a56e7aa48f97b4956bcef769

SHA1
2907cf777d6cf92656c8de211093751e12ddf9c4

SHA256
7a487c2cba93e7d6963930c5734f14d6cf17e85fc2316d6aeccd617100a1ff9f

SHA512
dc423898519ac48ca0b12e72076e7e9441e35f0fbc409af95b90288f3fefe23a2cd4a4b9c83e1a3dc123b0fcd2ea4f8ca981bb667be56be2cdcf8ad4df047aaf

Download Submit
C:\Users\Admin\AppData\Roaming\INT\x64\TeamViewerVPN.inf

Filesize
5KB

MD5
447fc733747db11cd4492ae01c5652fe

SHA1
2a70dcd391464cb8d3736322e07e966e105d396e

SHA256
a817b0e8a669d5acaf2ddfbc95acf2a1213b092b44dc896a0ee4a5301d06ebc3

SHA512
238099db072af55445d421e941944abe8a6f52a124a26cae84c1dd52fffafc4dac5586d0c7407b461cd0db8e771e1dbb6ca34aee84581b24347f401410b2afe5

Download Submit
C:\Windows\System32\DriverStore\FileRepository\teamviewervpn.inf_amd64_neutral_5e1dcb6f86e23dcd\teamviewervpn.PNF

Filesize
8KB

MD5
cf5ea1f06d58896f989a2003dd7cb45e

SHA1
66b1e1d46570fd735d0dc8f564804c1d60160ce1

SHA256
858f9da1de162078439d2f73df81030898bc2e3a9ac7b418b46431065e696d52

SHA512
bc0cd98080350d0cae27a3d5f0eaf84a0031cd31db78bb91aec2c7090abd2c9144e621eebce02444717c17039c69e9f0d281b8afade650125439f75826926bae

Download Submit
C:\Windows\System32\DriverStore\INFCACHE.1

Filesize
1.4MB

MD5
c0b0fa1f35f7819ba89abe79e89b9832

SHA1
549f4e3f5f066124af8a9e8f2c7797b4397228d0

SHA256
4b7b793428797559c5d8510f885f90931162790f7c78bd7775811824221966ce

SHA512
ff9f5457000432272ae360c9f254cca577dd1b319798fb411ee936a8da9598e045170b7430d46c02703085ade6707cf749a35e058af642541e316fbfc7c6e130

Download Submit
C:\Windows\inf\oem2.PNF

Filesize
8KB

MD5
c409f2efad3f2ef98f28cd874112c69e

SHA1
6cffd5d877affd5b16a3123d21661de78a86c7c2

SHA256
3f4cf336daae1a144c130fa578423edfbf48094cb1ec7c33fc7793635688ad09

SHA512
344d1ef456fea9f33044629c31685bd8b88f71446b5692907db12937e2d2ad75e782c969261cea7c424c3aaf11d88f6ea9547eec299b98ebf2b15b9fbb6cfebc

Download Submit
\??\c:\users\admin\appdata\roaming\int\x64\teamviewervpn.cat

Filesize
10KB

MD5
5cffe65f36b60bc151486c90382f1627

SHA1
f2a66eae89b4b19d4cab2ac630536af5eeeef121

SHA256
aa7c09a817eb54e3cc5c342454608364a679e231824f83ba5a2d0278edcc1851

SHA512
1bd48ef66f8714e7e9591043d03bd69a30881ed3d0f2463b15750a3282df667ffb076b3a92358eecedae0e54485b07d702667e8fe0af64c52be04db47145920b

Download Submit
\??\c:\users\admin\appdata\roaming\int\x64\teamviewervpn.sys

Filesize
34KB

MD5
f5520dbb47c60ee83024b38720abda24

SHA1
bc355c14a2b22712b91ff43cd4e046489a91cae5

SHA256
b8e555d92440bf93e3b55a66e27cef936477ef7528f870d3b78bd3b294a05cc0

SHA512
3c5bb212467d932f5eaa17a2346ef8f401a49760c9c6c89c6318a1313fcbabb1d43b1054692c01738ea6a3648cc57e06845b81becb3069f478d5b1a7cbcb0e66

Download Submit
\Users\Admin\AppData\Local\Temp\nsy1180.tmp\2us6otf8rec

Filesize
637KB

MD5
e3c061fa0450056e30285fd44a74cd2a

SHA1
8c7659e6ee9fe5ead17cae2969d3148730be509b

SHA256
e0e2c7d0f740fe2a4e8658ce54dfb6eb3c47c37fe90a44a839e560c685f1f1fa

SHA512
fe7796b4c5aa07c40aa2511a987fed59366d3c27bf7343f126f06cb937bfe7a7d8bd6cd785a7e3dc9087b99973e8542b6da7be6eed4585bd3cee13164aed79b4

Download Submit
\Users\Admin\AppData\Local\Temp\nsy1180.tmp\Crypto.dll

Filesize
3KB

MD5
5fc727c579f3c3b69ce0eb7f2ec7d48a

SHA1
4686ade71a45feb36f5f5f48e78bd673f60e45b5

SHA256
b7b819dcf3aaed2774cecfa507f9baee47660b18758f7cb718bb5cb2d77947fa

SHA512
b407eb19db8967fc7eeea8d5576cbb909c89195a0ae2f2382b79ecc13f04d984ec46d014b7f8e2124c8fe6088097cdc8203e4258cdd36a38db94c7cb4a929fd0

Download Submit
\Users\Admin\AppData\Local\Temp\nsy1180.tmp\ShellLink.dll

Filesize
4KB

MD5
aad75be0bdd1f1bac758b521c9f1d022

SHA1
5d444b8432c8834f5b5cd29225101856cebb8ecf

SHA256
d1d1642f3e70386af125ec32f41734896427811770d617729d8d5ebdf18f8aa7

SHA512
4c6e155cdf62cc8b65f3d0699c73c9032accefaa0f51e8b9a5c2f340ec8c6f5fab0ea02aad0abed476b3537292ba22d898589812850968e105ac83680d2f87d0

Download Submit
\Users\Admin\AppData\Local\Temp\nsy1180.tmp\System.dll

Filesize
11KB

MD5
b0c77267f13b2f87c084fd86ef51ccfc

SHA1
f7543f9e9b4f04386dfbf33c38cbed1bf205afb3

SHA256
a0cac4cf4852895619bc7743ebeb89f9e4927ccdb9e66b1bcd92a4136d0f9c77

SHA512
f2b57a2eea00f52a3c7080f4b5f2bb85a7a9b9f16d12da8f8ff673824556c62a0f742b72be0fd82a2612a4b6dbd7e0fdc27065212da703c2f7e28d199696f66e

Download Submit
\Users\Admin\AppData\Local\Temp\nsy1180.tmp\blowfish.dll

Filesize
26KB

MD5
a0a4fc162c9876660aae6d06008aa0a2

SHA1
c2bb69b4960660ebf8b8bafcad20a5eeb859a17b

SHA256
52b8e1f958fd0a352b7a9192d73a72d1c32711ff1740ded3e80009eb44d48575

SHA512
426f2c1cd52b1f0619f85c476f790b30ced912e31740fe7450dab9ed189d840b635e67ab05310269b1534d02be4afd885f952d4a231df6c232bae4313503c4ea

Download Submit
\Users\Admin\AppData\Local\Temp\nsy1180.tmp\nsExec.dll

Filesize
6KB

MD5
1f49d8af9be9e915d54b2441c4a79adf

SHA1
1ee4f809c693e31f34bc6d8153664a6dc2c3e499

SHA256
b22c8f676dec58be8d25fbad1a37835ffc4029f29aaf79f4dc0337ca73a38782

SHA512
c60827e322e3168a79795ffd4beb0b0039842128255100d6b005d261402d2ff570f3866f441f3d3c063097c71d44bc5ae80d177fa91ef4e46fc8c2d97de27aa4

Download Submit
\Users\Admin\AppData\Local\Temp\sv0e6tcmn

Filesize
43KB

MD5
84d499f558570c32f4cb100a9124890b

SHA1
9adfc7ab66348d84ebdd9c1e8093cad4cc8485ef

SHA256
31b3b228382dc359f22ae97b2602eee81dc743fb21196061eacc6619533881f5

SHA512
560aaadebcbd425d35fc3a567c987a5f15a5f091962328f0479c1ec2378c732cca892eb3252179c8895413b0f3d08f44fbcf8c9d2375877c81622f42e6549c86

Download Submit
\Users\Admin\AppData\Roaming\INT\tv_w32.dll

Filesize
49KB

MD5
d1cae98656bc6703e21f4580b8830dfc

SHA1
d0c1f9219380ae73c5b151e5c7afa9e11c07bd97

SHA256
d2b39bcf9ca3888887fb84a0897fcb80dccacc5ccfb5a66357e3dbdcafee3904

SHA512
1270c00a01be2d8e27dc31a3e355eee8e5f56330674ec9776e2a5c6ba7990c3a4d4eccc501675e83e4baed977ea94dde2c857f63400564b85a27a94910d07cae

Download Submit
\Users\Admin\AppData\Roaming\INT\x64\install64.exe

Filesize
79KB

MD5
112b0c8b6b0c0a6c24f90081cc8a77d0

SHA1
1776a73316baeeb818884196a54f49d1385c06c8

SHA256
f627380e9de14af3eb5331bb9a4d559b2c970abacff038ea464044ca1ef62163

SHA512
1552b267931004d8936058f5cac49dc618eae2224ea3b082f1d899cd1b2c1cb7eaa98ac7653740fd07b2df40abbdd2d6318a9bed8794bb7a8872e379a50ef585

Download Submit
memory/2332-129-0x00000000006A0000-0x00000000006BB000-memory.dmp

Filesize
108KB

Download
memory/2332-113-0x00000000006A0000-0x00000000006BB000-memory.dmp

Filesize
108KB

Download
memory/2332-128-0x00000000006A0000-0x00000000006BB000-memory.dmp

Filesize
108KB

Download
memory/2332-107-0x00000000006A0000-0x00000000006BB000-memory.dmp

Filesize
108KB

Download
memory/2384-263-0x00000000004B0000-0x00000000004D6000-memory.dmp

Filesize
152KB

Download
memory/2836-275-0x00000000064D0000-0x00000000064D3000-memory.dmp

Filesize
12KB

Download
memory/2836-285-0x0000000007000000-0x0000000007011000-memory.dmp

Filesize
68KB

Download
memory/2836-277-0x0000000006030000-0x000000000609B000-memory.dmp

Filesize
428KB

Download
memory/2836-282-0x0000000005FD0000-0x0000000005FD3000-memory.dmp

Filesize
12KB

Download
memory/2836-284-0x0000000005FD0000-0x0000000005FD3000-memory.dmp

Filesize
12KB

Download
memory/2836-273-0x0000000007000000-0x0000000007011000-memory.dmp

Filesize
68KB

Download
memory/2936-114-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/2972-130-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/3060-175-0x0000000006150000-0x0000000006153000-memory.dmp

Filesize
12KB

Download
memory/3060-271-0x0000000007000000-0x0000000007011000-memory.dmp

Filesize
68KB

Download
memory/3060-171-0x0000000006790000-0x0000000006793000-memory.dmp

Filesize
12KB

Download
memory/3060-138-0x0000000007000000-0x0000000007011000-memory.dmp

Filesize
68KB

Download
memory/3060-177-0x00000000061A0000-0x000000000620B000-memory.dmp

Filesize
428KB

Download
memory/3060-173-0x0000000006150000-0x0000000006153000-memory.dmp

Filesize
12KB

Download