6ee98db32852a2ff31a969d918bb7c730950bb15f24ea1baf996697cebc8b9fa

Analysis

max time kernel
50s
max time network
52s
platform
windows11-21h2_x64
resource
win11-20240802-en
resource tags

arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
submitted
06/08/2024, 12:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

hamachi.msi
Size

13.7MB
MD5

909db4061c32f798e94d746717782444
SHA1

10f5ffff17d2dd4476686a941a7bcc5f9b83b1b8
SHA256

6ee98db32852a2ff31a969d918bb7c730950bb15f24ea1baf996697cebc8b9fa
SHA512

44e7f97b27aef2e4cb62a6a0ebab5033b99e1ec940f231eda416f3b68d83df81d10950a8ced2ca528024adecd1dea7e1d4427e78b111edbc0124d7ffd6c1232d
SSDEEP

196608:cp/8gF8Li2aauOgsgJ9RSfD3G43O+WFoy1jNDVxJBQHhIO4E46uVwOXsHoHybhLf:O/382agT9RK73O+kN3JSHuy46inqUMC

Score

8^/10

discovery persistence privilege_escalation

Malware Config

Signatures

Drops file in Drivers directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\DRIVERS\SETDE98.tmp	hamachi-2.exe
File created	C:\Windows\system32\DRIVERS\SETDE98.tmp	hamachi-2.exe
File opened for modification	C:\Windows\system32\DRIVERS\Hamdrv.sys	hamachi-2.exe
File opened for modification	C:\Windows\System32\drivers\Hamdrv.sys	DrvInst.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\LogMeIn Hamachi Ui = "\"C:\\Program Files (x86)\\LogMeIn Hamachi\\hamachi-2-ui.exe\" --auto-start"	msiexec.exe

Blocklisted process makes network request 4 IoCs

flow	pid	Process
2	2348	msiexec.exe
3	2348	msiexec.exe
2	2348	msiexec.exe
3	2348	msiexec.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe

Drops file in System32 directory 16 IoCs

description	ioc	Process
File created	C:\Windows\System32\DriverStore\Temp\{fa119552-27ef-7b42-b47e-92fe3a2b572f}\SETDF34.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{fa119552-27ef-7b42-b47e-92fe3a2b572f}\SETDF35.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{fa119552-27ef-7b42-b47e-92fe3a2b572f}\hamdrv.inf	DrvInst.exe
File created	C:\Windows\System32\DriverStore\drvstore.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\hamdrv.inf_amd64_c59072ec40c0c372\hamdrv.cat	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{fa119552-27ef-7b42-b47e-92fe3a2b572f}\SETDF36.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\hamdrv.inf_amd64_c59072ec40c0c372\Hamdrv.sys	DrvInst.exe
File created	C:\Windows\System32\DriverStore\FileRepository\hamdrv.inf_amd64_c59072ec40c0c372\hamdrv.PNF	hamachi-2.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{fa119552-27ef-7b42-b47e-92fe3a2b572f}\hamdrv.cat	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\hamdrv.inf_amd64_c59072ec40c0c372\hamdrv.inf	DrvInst.exe
File opened for modification	C:\Windows\System32\CatRoot2\dberr.txt	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{fa119552-27ef-7b42-b47e-92fe3a2b572f}\SETDF34.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{fa119552-27ef-7b42-b47e-92fe3a2b572f}\Hamdrv.sys	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{fa119552-27ef-7b42-b47e-92fe3a2b572f}\SETDF35.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{fa119552-27ef-7b42-b47e-92fe3a2b572f}\SETDF36.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{fa119552-27ef-7b42-b47e-92fe3a2b572f}	DrvInst.exe

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Drops file in Program Files directory 16 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\LogMeIn Hamachi\ReleaseNotes.rtf	msiexec.exe
File created	C:\Program Files (x86)\LogMeIn Hamachi\hamachi.lng	msiexec.exe
File created	C:\Program Files (x86)\LogMeIn Hamachi\x64\hamachi-2.exe	msiexec.exe
File created	C:\Program Files (x86)\LogMeIn Hamachi\x64\LMIGuardianSvc.exe	msiexec.exe
File created	C:\Program Files (x86)\LogMeIn Hamachi\x64\LMIGuardianDll.dll	msiexec.exe
File created	C:\Program Files (x86)\LogMeIn Hamachi\LMIGuardianSvc.exe	msiexec.exe
File created	C:\Program Files (x86)\LogMeIn Hamachi\LMIGuardianEvt.Dll	msiexec.exe
File created	C:\Program Files (x86)\LogMeIn Hamachi\x64\hamachi.inf	msiexec.exe
File created	C:\Program Files (x86)\LogMeIn Hamachi\x64\hamachi.cat	msiexec.exe
File created	C:\Program Files (x86)\LogMeIn Hamachi\x64\hamdrv.cat	msiexec.exe
File created	C:\Program Files (x86)\LogMeIn Hamachi\x64\LMIGuardianEvt.Dll	msiexec.exe
File created	C:\Program Files (x86)\LogMeIn Hamachi\LMIGuardianDll.dll	msiexec.exe
File created	C:\Program Files (x86)\LogMeIn Hamachi\x64\hamachi.sys	msiexec.exe
File created	C:\Program Files (x86)\LogMeIn Hamachi\x64\hamdrv.sys	msiexec.exe
File created	C:\Program Files (x86)\LogMeIn Hamachi\x64\hamdrv.inf	msiexec.exe
File created	C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2-ui.exe	msiexec.exe

Drops file in Windows directory 55 IoCs

description	ioc	Process
File opened for modification	C:\Windows\INF\setupapi.dev.log	hamachi-2.exe
File opened for modification	C:\Windows\ServiceProfiles\LocalService\AppData\Local\LogMeIn Hamachi\h2-engine.id	hamachi-2.exe
File created	C:\Windows\inf\oem3.inf	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File created	C:\Windows\ServiceProfiles\LocalService\AppData\Local\LogMeIn Hamachi\h2-client.key	hamachi-2.exe
File opened for modification	C:\Windows\ServiceProfiles\LocalService\AppData\Local\LogMeIn Hamachi\h2-engine.cfg	hamachi-2.exe
File opened for modification	C:\Windows\ServiceProfiles\LocalService\AppData\Local\LogMeIn Hamachi\h2-engine.cfg.bak	hamachi-2.exe
File opened for modification	C:\Windows\Installer\MSID708.tmp	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\ServiceProfiles\LocalService\AppData\Local\LogMeIn Hamachi\h2-engine.id	hamachi-2.exe
File created	C:\Windows\Installer\SourceHash{C00E2143-38F2-49BA-AB8A-03F22F02F0A4}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSID8D1.tmp	msiexec.exe
File created	C:\Windows\Installer\e57d61e.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSID747.tmp	msiexec.exe
File created	C:\Windows\ServiceProfiles\LocalService\AppData\Local\LogMeIn Hamachi\h2-engine.ini.updating	hamachi-2.exe
File created	C:\Windows\ServiceProfiles\LocalService\AppData\Local\LogMeIn Hamachi\h2-engine.cfg.bak	hamachi-2.exe
File created	C:\Windows\SystemTemp\~DF3FA17AD8F8D33EF5.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\e57d61c.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\MSID37.tmp	msiexec.exe
File opened for modification	C:\Windows\ServiceProfiles\LocalService\AppData\Local\LogMeIn Hamachi\h2-engine.log	hamachi-2.exe
File opened for modification	C:\Windows\Installer\MSIDA98.tmp	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	hamachi-2.exe
File opened for modification	C:\Windows\ServiceProfiles\LocalService\AppData\Local\LogMeIn Hamachi\h2-engine.ini.updating	hamachi-2.exe
File opened for modification	C:\Windows\Installer\MSID7B7.tmp	msiexec.exe
File opened for modification	C:\Windows\ServiceProfiles\LocalService\AppData\Local\LogMeIn Hamachi\h2-engine.ini	hamachi-2.exe
File opened for modification	C:\Windows\ServiceProfiles\LocalService\AppData\Local\LogMeIn Hamachi\h2-engine.ini.bak	hamachi-2.exe
File created	C:\Windows\Installer\e57d61c.msi	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	svchost.exe
File opened for modification	C:\Windows\Installer\MSID26.tmp	msiexec.exe
File created	C:\Windows\ServiceProfiles\LocalService\AppData\Local\LogMeIn Hamachi\h2-engine.id.bak	hamachi-2.exe
File created	C:\Windows\Installer\{C00E2143-38F2-49BA-AB8A-03F22F02F0A4}\UninstallIcon.ico	msiexec.exe
File opened for modification	C:\Windows\Installer\{C00E2143-38F2-49BA-AB8A-03F22F02F0A4}\UninstallIcon.ico	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI304.tmp	msiexec.exe
File created	C:\Windows\ServiceProfiles\LocalService\AppData\Local\LogMeIn Hamachi\h2-engine.ini.bak	hamachi-2.exe
File opened for modification	C:\Windows\ServiceProfiles\LocalService\AppData\Local\LogMeIn Hamachi\h2-engine.id.bak	hamachi-2.exe
File opened for modification	C:\Windows\Installer\MSID6B9.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\Installer\MSID8E1.tmp	msiexec.exe
File created	C:\Windows\ServiceProfiles\LocalService\AppData\Local\LogMeIn Hamachi\h2-engine.cfg.updating	hamachi-2.exe
File created	C:\Windows\SystemTemp\~DF5319579ED8590A4C.TMP	msiexec.exe
File opened for modification	C:\Windows\inf\oem3.inf	DrvInst.exe
File created	C:\Windows\ServiceProfiles\LocalService\AppData\Local\LogMeIn Hamachi\h2-engine.cfg	hamachi-2.exe
File created	C:\Windows\SystemTemp\~DF25C2B8E7DCACCAA0.TMP	msiexec.exe
File created	C:\Windows\ServiceProfiles\LocalService\AppData\Local\LogMeIn Hamachi\h2-engine.id.updating	hamachi-2.exe
File opened for modification	C:\Windows\ServiceProfiles\LocalService\AppData\Local\LogMeIn Hamachi\h2-engine.id.updating	hamachi-2.exe
File created	C:\Windows\ServiceProfiles\LocalService\AppData\Local\LogMeIn Hamachi\h2-server.key	hamachi-2.exe
File opened for modification	C:\Windows\Installer\MSIDC40.tmp	msiexec.exe
File opened for modification	C:\Windows\ServiceProfiles\LocalService\AppData\Local\LogMeIn Hamachi\h2-engine.cfg.updating	hamachi-2.exe
File opened for modification	C:\Windows\Installer\MSIDC2F.tmp	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File created	C:\Windows\ServiceProfiles\LocalService\AppData\Local\LogMeIn Hamachi\h2-engine.ini	hamachi-2.exe
File created	C:\Windows\SystemTemp\~DF346587F6C11250A1.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSID767.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI228.tmp	msiexec.exe

Executes dropped EXE 12 IoCs

pid	Process
1780	hamachi-2.exe
3788	LMIGuardianSvc.exe
3000	hamachi-2.exe
5084	LMIGuardianSvc.exe
228	LMIGuardianSvc.exe
2892	hamachi-2.exe
1468	LMIGuardianSvc.exe
1472	LMIGuardianSvc.exe
3000	hamachi-2.exe
4568	LMIGuardianSvc.exe
4628	hamachi-2-ui.exe
3096	LMIGuardianSvc.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2108	sc.exe
2024	sc.exe

Loads dropped DLL 26 IoCs

pid	Process
4760	MsiExec.exe
4760	MsiExec.exe
4760	MsiExec.exe
4760	MsiExec.exe
4760	MsiExec.exe
1916	MsiExec.exe
1916	MsiExec.exe
1916	MsiExec.exe
1916	MsiExec.exe
1916	MsiExec.exe
1916	MsiExec.exe
1788	MsiExec.exe
1788	MsiExec.exe
1788	MsiExec.exe
3788	LMIGuardianSvc.exe
5084	LMIGuardianSvc.exe
1788	MsiExec.exe
228	LMIGuardianSvc.exe
1788	MsiExec.exe
1468	LMIGuardianSvc.exe
1472	LMIGuardianSvc.exe
1788	MsiExec.exe
1788	MsiExec.exe
4568	LMIGuardianSvc.exe
4760	MsiExec.exe
3096	LMIGuardianSvc.exe

Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs

persistence privilege_escalation

Installer Packages

T1546.016

Msiexec

T1218.007

pid	Process
2348	msiexec.exe

Event Triggered Execution: Netsh Helper DLL 1 TTPs 15 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3888	4628	WerFault.exe	127

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hamachi-2-ui.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	LMIGuardianSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe

Checks SCSI registry key(s) 3 TTPs 51 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Service	hamachi-2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	svchost.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 00000000040000009a5c3185e018bce80000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff0000000027010100000800009a5c31850000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff0000000007000100006809009a5c3185000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d9a5c3185000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000009a5c318500000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\UpperFilters	hamachi-2.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\LowerFilters	hamachi-2.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Service	hamachi-2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom	DrvInst.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000	hamachi-2.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\CompatibleIDs	DrvInst.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\LowerFilters	hamachi-2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\LowerFilters	hamachi-2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\CompatibleIDs	DrvInst.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Filters	hamachi-2.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\UpperFilters	hamachi-2.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\UpperFilters	hamachi-2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Phantom	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Filters	hamachi-2.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	hamachi-2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	hamachi-2.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Service	hamachi-2.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Service	hamachi-2.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Filters	hamachi-2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	hamachi-2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Filters	hamachi-2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	hamachi-2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Phantom	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\LowerFilters	hamachi-2.exe

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	MsiExec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\hamachi-2-ui.exe = "11000"	MsiExec.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	hamachi-2.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	hamachi-2.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	hamachi-2.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	hamachi-2.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	hamachi-2.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	hamachi-2.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	hamachi-2.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	hamachi-2.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	hamachi-2.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	hamachi-2.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	hamachi-2.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	hamachi-2.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	hamachi-2.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	hamachi-2.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	hamachi-2.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	hamachi-2.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	hamachi-2.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	hamachi-2.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	hamachi-2.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\RAS AutoDial\Default	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	hamachi-2.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	hamachi-2.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	hamachi-2.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	hamachi-2.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	hamachi-2.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	hamachi-2.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	hamachi-2.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	hamachi-2.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	hamachi-2.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	hamachi-2.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	hamachi-2.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@%SystemRoot%\system32\hnetcfgclient.dll,-201 = "HNetCfg Client"	svchost.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\LMIGuardianSvc.GuardianSvc\CLSID\ = "{D4258A22-CF85-489D-83AE-49FCD0DFAD29}"	LMIGuardianSvc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3412E00C2F83AB94BAA8302FF2200F4A\DeploymentFlags = "3"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{67E4A0D8-8675-4FBB-BC62-F10EC894327E}\LocalService = "LMIGuardianSvc"	LMIGuardianSvc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\LMIGuardianSvc.GuardianSvc\CurVer	LMIGuardianSvc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D4258A22-CF85-489D-83AE-49FCD0DFAD29}\LocalServer32	LMIGuardianSvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3412E00C2F83AB94BAA8302FF2200F4A\ProductName = "Hamachi"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{67E4A0D8-8675-4FBB-BC62-F10EC894327E}\LaunchPermission = 010014807400000084000000140000003000000002001c000100000011001400010000000101000000000010001000000200440003000000000014000b000000010100000000000504000000000014000b00000001010000000000050b000000000014000b0000000101000000000005120000000102000000000005200000002002000001020000000000052000000020020000	LMIGuardianSvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{4615B7A3-8EF2-40C0-83F0-63BCD479C791}\TypeLib\ = "{FAC58A4E-76CC-418B-8829-6DE882474472}"	LMIGuardianSvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\3412E00C2F83AB94BAA8302FF2200F4A\LanguageHU = "\x06Ui"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\3412E00C2F83AB94BAA8302FF2200F4A\LanguageSV = "\x06Ui"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\3412E00C2F83AB94BAA8302FF2200F4A\LanguageZH = "\x06Ui"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{4615B7A3-8EF2-40C0-83F0-63BCD479C791}\ = "IGuardianSvc"	LMIGuardianSvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\3412E00C2F83AB94BAA8302FF2200F4A\Complete	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\3412E00C2F83AB94BAA8302FF2200F4A\LanguagePL = "\x06Ui"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3412E00C2F83AB94BAA8302FF2200F4A\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3412E00C2F83AB94BAA8302FF2200F4A\SourceList\Media	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\LMIGuardianSvc.EXE	LMIGuardianSvc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{FAC58A4E-76CC-418B-8829-6DE882474472}\1.0\HELPDIR	LMIGuardianSvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D4258A22-CF85-489D-83AE-49FCD0DFAD29}\ = "GuardianSvc Class"	LMIGuardianSvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D4258A22-CF85-489D-83AE-49FCD0DFAD29}\TypeLib\ = "{FAC58A4E-76CC-418B-8829-6DE882474472}"	LMIGuardianSvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\3412E00C2F83AB94BAA8302FF2200F4A\LanguageFI = "\x06Ui"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\3412E00C2F83AB94BAA8302FF2200F4A	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\3412E00C2F83AB94BAA8302FF2200F4A\LanguageDE = "\x06Ui"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\3412E00C2F83AB94BAA8302FF2200F4A\LanguageZHTW = "\x06Ui"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3412E00C2F83AB94BAA8302FF2200F4A\AdvertiseFlags = "388"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{4615B7A3-8EF2-40C0-83F0-63BCD479C791}\ProxyStubClsid32	LMIGuardianSvc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{FAC58A4E-76CC-418B-8829-6DE882474472}\1.0\0	LMIGuardianSvc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4615B7A3-8EF2-40C0-83F0-63BCD479C791}	LMIGuardianSvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\3412E00C2F83AB94BAA8302FF2200F4A\LanguageIT = "\x06Ui"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3412E00C2F83AB94BAA8302FF2200F4A\Assignment = "1"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D4258A22-CF85-489D-83AE-49FCD0DFAD29}	LMIGuardianSvc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D4258A22-CF85-489D-83AE-49FCD0DFAD29}\ProgID	LMIGuardianSvc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3412E00C2F83AB94BAA8302FF2200F4A\InstanceType = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3412E00C2F83AB94BAA8302FF2200F4A\SourceList\Net	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{FAC58A4E-76CC-418B-8829-6DE882474472}\1.0\HELPDIR\ = "C:\\Program Files (x86)\\LogMeIn Hamachi\\x64"	LMIGuardianSvc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{4615B7A3-8EF2-40C0-83F0-63BCD479C791}	LMIGuardianSvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{4615B7A3-8EF2-40C0-83F0-63BCD479C791}\TypeLib\Version = "1.0"	LMIGuardianSvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\3412E00C2F83AB94BAA8302FF2200F4A\LanguageEN = "Ui"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3412E00C2F83AB94BAA8302FF2200F4A\PackageCode = "BD8AE51CFD1484C47840D7F4BAD7E9BB"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\LMIGuardianSvc.GuardianSvc.1\ = "GuardianSvc Class"	LMIGuardianSvc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{FAC58A4E-76CC-418B-8829-6DE882474472}\1.0\FLAGS	LMIGuardianSvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\3412E00C2F83AB94BAA8302FF2200F4A\LanguageKO = "\x06Ui"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{67E4A0D8-8675-4FBB-BC62-F10EC894327E}\AccessPermission = 010014807400000084000000140000003000000002001c000100000011001400010000000101000000000010001000000200440003000000000014000b000000010100000000000504000000000014000b00000001010000000000050b000000000014000b0000000101000000000005120000000102000000000005200000002002000001020000000000052000000020020000	LMIGuardianSvc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\LMIGuardianSvc.GuardianSvc	LMIGuardianSvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\3412E00C2F83AB94BAA8302FF2200F4A\LanguageNL = "\x06Ui"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3412E00C2F83AB94BAA8302FF2200F4A\Version = "33751040"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3412E00C2F83AB94BAA8302FF2200F4A\SourceList\Media\1 = ";"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\LMIGuardianSvc.GuardianSvc.1\CLSID	LMIGuardianSvc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D4258A22-CF85-489D-83AE-49FCD0DFAD29}\TypeLib	LMIGuardianSvc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{FAC58A4E-76CC-418B-8829-6DE882474472}\1.0	LMIGuardianSvc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4615B7A3-8EF2-40C0-83F0-63BCD479C791}\TypeLib	LMIGuardianSvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{FAC58A4E-76CC-418B-8829-6DE882474472}\1.0\FLAGS\ = "0"	LMIGuardianSvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\3412E00C2F83AB94BAA8302FF2200F4A\Ui = "Complete"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\LMIGuardianSvc.GuardianSvc.1	LMIGuardianSvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D4258A22-CF85-489D-83AE-49FCD0DFAD29}\ProgID\ = "LMIGuardianSvc.GuardianSvc.1"	LMIGuardianSvc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D4258A22-CF85-489D-83AE-49FCD0DFAD29}\Programmable	LMIGuardianSvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\3412E00C2F83AB94BAA8302FF2200F4A\LanguagePT = "\x06Ui"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{FAC58A4E-76CC-418B-8829-6DE882474472}\1.0\ = "LMIGuardianSvc 1.0 Type Library"	LMIGuardianSvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\3412E00C2F83AB94BAA8302FF2200F4A\LanguageES = "\x06Ui"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3412E00C2F83AB94BAA8302FF2200F4A\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4615B7A3-8EF2-40C0-83F0-63BCD479C791}\ = "IGuardianSvc"	LMIGuardianSvc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{4615B7A3-8EF2-40C0-83F0-63BCD479C791}\TypeLib	LMIGuardianSvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\3412E00C2F83AB94BAA8302FF2200F4A\LanguageNO = "\x06Ui"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3412E00C2F83AB94BAA8302FF2200F4A\Clients = 3a0000000000	msiexec.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4628	hamachi-2-ui.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2348	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2348	msiexec.exe
Token: SeSecurityPrivilege	1596	msiexec.exe
Token: SeCreateTokenPrivilege	2348	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	2348	msiexec.exe
Token: SeLockMemoryPrivilege	2348	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2348	msiexec.exe
Token: SeMachineAccountPrivilege	2348	msiexec.exe
Token: SeTcbPrivilege	2348	msiexec.exe
Token: SeSecurityPrivilege	2348	msiexec.exe
Token: SeTakeOwnershipPrivilege	2348	msiexec.exe
Token: SeLoadDriverPrivilege	2348	msiexec.exe
Token: SeSystemProfilePrivilege	2348	msiexec.exe
Token: SeSystemtimePrivilege	2348	msiexec.exe
Token: SeProfSingleProcessPrivilege	2348	msiexec.exe
Token: SeIncBasePriorityPrivilege	2348	msiexec.exe
Token: SeCreatePagefilePrivilege	2348	msiexec.exe
Token: SeCreatePermanentPrivilege	2348	msiexec.exe
Token: SeBackupPrivilege	2348	msiexec.exe
Token: SeRestorePrivilege	2348	msiexec.exe
Token: SeShutdownPrivilege	2348	msiexec.exe
Token: SeDebugPrivilege	2348	msiexec.exe
Token: SeAuditPrivilege	2348	msiexec.exe
Token: SeSystemEnvironmentPrivilege	2348	msiexec.exe
Token: SeChangeNotifyPrivilege	2348	msiexec.exe
Token: SeRemoteShutdownPrivilege	2348	msiexec.exe
Token: SeUndockPrivilege	2348	msiexec.exe
Token: SeSyncAgentPrivilege	2348	msiexec.exe
Token: SeEnableDelegationPrivilege	2348	msiexec.exe
Token: SeManageVolumePrivilege	2348	msiexec.exe
Token: SeImpersonatePrivilege	2348	msiexec.exe
Token: SeCreateGlobalPrivilege	2348	msiexec.exe
Token: SeCreateTokenPrivilege	2348	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	2348	msiexec.exe
Token: SeLockMemoryPrivilege	2348	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2348	msiexec.exe
Token: SeMachineAccountPrivilege	2348	msiexec.exe
Token: SeTcbPrivilege	2348	msiexec.exe
Token: SeSecurityPrivilege	2348	msiexec.exe
Token: SeTakeOwnershipPrivilege	2348	msiexec.exe
Token: SeLoadDriverPrivilege	2348	msiexec.exe
Token: SeSystemProfilePrivilege	2348	msiexec.exe
Token: SeSystemtimePrivilege	2348	msiexec.exe
Token: SeProfSingleProcessPrivilege	2348	msiexec.exe
Token: SeIncBasePriorityPrivilege	2348	msiexec.exe
Token: SeCreatePagefilePrivilege	2348	msiexec.exe
Token: SeCreatePermanentPrivilege	2348	msiexec.exe
Token: SeBackupPrivilege	2348	msiexec.exe
Token: SeRestorePrivilege	2348	msiexec.exe
Token: SeShutdownPrivilege	2348	msiexec.exe
Token: SeDebugPrivilege	2348	msiexec.exe
Token: SeAuditPrivilege	2348	msiexec.exe
Token: SeSystemEnvironmentPrivilege	2348	msiexec.exe
Token: SeChangeNotifyPrivilege	2348	msiexec.exe
Token: SeRemoteShutdownPrivilege	2348	msiexec.exe
Token: SeUndockPrivilege	2348	msiexec.exe
Token: SeSyncAgentPrivilege	2348	msiexec.exe
Token: SeEnableDelegationPrivilege	2348	msiexec.exe
Token: SeManageVolumePrivilege	2348	msiexec.exe
Token: SeImpersonatePrivilege	2348	msiexec.exe
Token: SeCreateGlobalPrivilege	2348	msiexec.exe
Token: SeCreateTokenPrivilege	2348	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	2348	msiexec.exe
Token: SeLockMemoryPrivilege	2348	msiexec.exe

Suspicious use of FindShellTrayWindow 11 IoCs

pid	Process
2348	msiexec.exe
2348	msiexec.exe
4628	hamachi-2-ui.exe
4628	hamachi-2-ui.exe
4628	hamachi-2-ui.exe
4628	hamachi-2-ui.exe
4628	hamachi-2-ui.exe
4628	hamachi-2-ui.exe
4628	hamachi-2-ui.exe
4628	hamachi-2-ui.exe
4628	hamachi-2-ui.exe

Suspicious use of SendNotifyMessage 9 IoCs

pid	Process
4628	hamachi-2-ui.exe
4628	hamachi-2-ui.exe
4628	hamachi-2-ui.exe
4628	hamachi-2-ui.exe
4628	hamachi-2-ui.exe
4628	hamachi-2-ui.exe
4628	hamachi-2-ui.exe
4628	hamachi-2-ui.exe
4628	hamachi-2-ui.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
4628	hamachi-2-ui.exe
4628	hamachi-2-ui.exe
4628	hamachi-2-ui.exe
4628	hamachi-2-ui.exe
4628	hamachi-2-ui.exe
4628	hamachi-2-ui.exe

Suspicious use of WriteProcessMemory 55 IoCs

description	pid	Process	procid_target
PID 1596 wrote to memory of 4760	1596	msiexec.exe	85
PID 1596 wrote to memory of 4760	1596	msiexec.exe	85
PID 1596 wrote to memory of 4760	1596	msiexec.exe	85
PID 1596 wrote to memory of 4772	1596	msiexec.exe	89
PID 1596 wrote to memory of 4772	1596	msiexec.exe	89
PID 1596 wrote to memory of 1916	1596	msiexec.exe	91
PID 1596 wrote to memory of 1916	1596	msiexec.exe	91
PID 1596 wrote to memory of 1916	1596	msiexec.exe	91
PID 1596 wrote to memory of 1788	1596	msiexec.exe	92
PID 1596 wrote to memory of 1788	1596	msiexec.exe	92
PID 1596 wrote to memory of 1788	1596	msiexec.exe	92
PID 1788 wrote to memory of 1780	1788	MsiExec.exe	93
PID 1788 wrote to memory of 1780	1788	MsiExec.exe	93
PID 1780 wrote to memory of 3788	1780	hamachi-2.exe	95
PID 1780 wrote to memory of 3788	1780	hamachi-2.exe	95
PID 1000 wrote to memory of 4528	1000	svchost.exe	98
PID 1000 wrote to memory of 4528	1000	svchost.exe	98
PID 1000 wrote to memory of 1364	1000	svchost.exe	99
PID 1000 wrote to memory of 1364	1000	svchost.exe	99
PID 1780 wrote to memory of 2552	1780	hamachi-2.exe	100
PID 1780 wrote to memory of 2552	1780	hamachi-2.exe	100
PID 1780 wrote to memory of 2552	1780	hamachi-2.exe	100
PID 1780 wrote to memory of 1328	1780	hamachi-2.exe	102
PID 1780 wrote to memory of 1328	1780	hamachi-2.exe	102
PID 1780 wrote to memory of 1328	1780	hamachi-2.exe	102
PID 1780 wrote to memory of 4836	1780	hamachi-2.exe	107
PID 1780 wrote to memory of 4836	1780	hamachi-2.exe	107
PID 1780 wrote to memory of 4836	1780	hamachi-2.exe	107
PID 1780 wrote to memory of 3300	1780	hamachi-2.exe	109
PID 1780 wrote to memory of 3300	1780	hamachi-2.exe	109
PID 1780 wrote to memory of 3300	1780	hamachi-2.exe	109
PID 1788 wrote to memory of 3000	1788	MsiExec.exe	111
PID 1788 wrote to memory of 3000	1788	MsiExec.exe	111
PID 3000 wrote to memory of 5084	3000	hamachi-2.exe	113
PID 3000 wrote to memory of 5084	3000	hamachi-2.exe	113
PID 1788 wrote to memory of 2024	1788	MsiExec.exe	114
PID 1788 wrote to memory of 2024	1788	MsiExec.exe	114
PID 1788 wrote to memory of 2024	1788	MsiExec.exe	114
PID 1788 wrote to memory of 228	1788	MsiExec.exe	116
PID 1788 wrote to memory of 228	1788	MsiExec.exe	116
PID 2892 wrote to memory of 1468	2892	hamachi-2.exe	118
PID 2892 wrote to memory of 1468	2892	hamachi-2.exe	118
PID 1788 wrote to memory of 2108	1788	MsiExec.exe	120
PID 1788 wrote to memory of 2108	1788	MsiExec.exe	120
PID 1788 wrote to memory of 2108	1788	MsiExec.exe	120
PID 3000 wrote to memory of 4568	3000	hamachi-2.exe	123
PID 3000 wrote to memory of 4568	3000	hamachi-2.exe	123
PID 3000 wrote to memory of 2352	3000	hamachi-2.exe	125
PID 3000 wrote to memory of 2352	3000	hamachi-2.exe	125
PID 4760 wrote to memory of 4628	4760	MsiExec.exe	127
PID 4760 wrote to memory of 4628	4760	MsiExec.exe	127
PID 4760 wrote to memory of 4628	4760	MsiExec.exe	127
PID 4628 wrote to memory of 3096	4628	hamachi-2-ui.exe	128
PID 4628 wrote to memory of 3096	4628	hamachi-2-ui.exe	128
PID 4628 wrote to memory of 3096	4628	hamachi-2-ui.exe	128

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\hamachi.msi
1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2348

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Adds Run key to start application
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1596
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 5CBE39CC702741DA114CE3715DDAB996 C
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4760
- - C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2-ui.exe
    "C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2-ui.exe" --ipc-timeout 30
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4628
  - - C:\Program Files (x86)\LogMeIn Hamachi\LMIGuardianSvc.exe
      "C:\Program Files (x86)\LogMeIn Hamachi\LMIGuardianSvc.exe" /escort 4628 /CUSTOM Hamachi
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      PID:3096
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4628 -s 1380
      4⤵
      Program crash
      PID:3888
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:4772
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 667957F241D6ED2FA9B8EF70BE967EE9
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:1916
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding E8BC039C9E0796563347C155638FB02B E Global\MSI0000
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:1788
- - C:\Program Files (x86)\LogMeIn Hamachi\x64\hamachi-2.exe
    "C:\Program Files (x86)\LogMeIn Hamachi\x64\hamachi-2.exe" --add-tap-at-install Hamachi
    3⤵
    - Drops file in Drivers directory
    - Drops file in System32 directory
    - Drops file in Windows directory
    - Executes dropped EXE
    - Checks SCSI registry key(s)
    - Modifies data under HKEY_USERS
    - Suspicious use of WriteProcessMemory
    PID:1780
  - - C:\Program Files (x86)\LogMeIn Hamachi\x64\LMIGuardianSvc.exe
      "C:\Program Files (x86)\LogMeIn Hamachi\x64\LMIGuardianSvc.exe" /escort 1780 /CUSTOM Hamachi
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:3788
  - - C:\Windows\SysWOW64\netsh.exe
      netsh interface ipv4 set subinterface "Ethernet 2" mtu=1404 store=persistent
      4⤵
      Event Triggered Execution: Netsh Helper DLL
      System Location Discovery: System Language Discovery
      PID:2552
  - - C:\Windows\SysWOW64\netsh.exe
      netsh.exe interface set interface name="Ethernet 2" newname="Hamachi"
      4⤵
      Event Triggered Execution: Netsh Helper DLL
      System Location Discovery: System Language Discovery
      PID:1328
  - - C:\Windows\SysWOW64\netsh.exe
      netsh interface tcp set global autotuninglevel=normal
      4⤵
      Event Triggered Execution: Netsh Helper DLL
      System Location Discovery: System Language Discovery
      PID:4836
  - - C:\Windows\SysWOW64\netsh.exe
      netsh interface tcp set global rss=enabled
      4⤵
      Event Triggered Execution: Netsh Helper DLL
      System Location Discovery: System Language Discovery
      PID:3300
- - C:\Program Files (x86)\LogMeIn Hamachi\x64\hamachi-2.exe
    "C:\Program Files (x86)\LogMeIn Hamachi\x64\hamachi-2.exe" --config Hamachi 25.0.0.1
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:3000
  - - C:\Program Files (x86)\LogMeIn Hamachi\x64\LMIGuardianSvc.exe
      "C:\Program Files (x86)\LogMeIn Hamachi\x64\LMIGuardianSvc.exe" /escort 3000 /CUSTOM Hamachi
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:5084
- - C:\Windows\SysWOW64\sc.exe
    sc config Hamachi2Svc depend= winmgmt
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2024
- - C:\Program Files (x86)\LogMeIn Hamachi\x64\LMIGuardianSvc.exe
    "C:\Program Files (x86)\LogMeIn Hamachi\x64\LMIGuardianSvc.exe" -Service
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Modifies registry class
    PID:228
- - C:\Windows\SysWOW64\sc.exe
    sc config Hamachi2Svc depend= winmgmt
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2108

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
PID:1444

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall
1⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious use of WriteProcessMemory
PID:1000
- C:\Windows\system32\DrvInst.exe
  DrvInst.exe "4" "1" "c:\program files (x86)\logmein hamachi\x64\hamdrv.inf" "9" "42b53aaff" "0000000000000154" "WinSta0\Default" "0000000000000164" "208" "c:\program files (x86)\logmein hamachi\x64"
  2⤵
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Checks SCSI registry key(s)
  - Modifies data under HKEY_USERS
  PID:4528
- C:\Windows\system32\DrvInst.exe
  DrvInst.exe "2" "211" "ROOT\NET\0000" "C:\Windows\INF\oem3.inf" "oem3.inf:db04a16c4ff220c2:Hamachi.ndi:15.28.40.464:hamachi," "42b53aaff" "000000000000010C" "96f3"
  2⤵
  - Drops file in Drivers directory
  - Drops file in Windows directory
  PID:1364

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s Netman
1⤵
- Modifies data under HKEY_USERS
PID:4396

C:\Program Files (x86)\LogMeIn Hamachi\x64\hamachi-2.exe
"C:\Program Files (x86)\LogMeIn Hamachi\x64\hamachi-2.exe" -s --get-config
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2892
- C:\Program Files (x86)\LogMeIn Hamachi\x64\LMIGuardianSvc.exe
  "C:\Program Files (x86)\LogMeIn Hamachi\x64\LMIGuardianSvc.exe" /escort 2892 /CUSTOM Hamachi
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:1468

C:\Program Files (x86)\LogMeIn Hamachi\x64\LMIGuardianSvc.exe
"C:\Program Files (x86)\LogMeIn Hamachi\x64\LMIGuardianSvc.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1472

C:\Program Files (x86)\LogMeIn Hamachi\x64\hamachi-2.exe
"C:\Program Files (x86)\LogMeIn Hamachi\x64\hamachi-2.exe" -s
1⤵
- Drops file in Windows directory
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3000
- C:\Program Files (x86)\LogMeIn Hamachi\x64\LMIGuardianSvc.exe
  "C:\Program Files (x86)\LogMeIn Hamachi\x64\LMIGuardianSvc.exe" /escort 3000 /CUSTOM Hamachi
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:4568
- C:\Windows\system32\netsh.exe
  netsh interface ipv4 set subinterface "Hamachi" mtu=1404 store=persistent
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:2352

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 4628 -ip 4628
1⤵
PID:4836

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Installer Packages

T1546.016

Netsh Helper DLL

T1546.007

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Installer Packages

T1546.016

Netsh Helper DLL

T1546.007

Defense Evasion

Modify Registry

T1112

System Binary Proxy Execution

T1218

Msiexec

T1218.007

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\e57d61d.rbs

Filesize
23KB

MD5
0564cdfdf531ce8e936cdce54ebf4d03

SHA1
c343621c1b98eb68d0884ad2ac92064d23744ebd

SHA256
7b1e91c9e1414dca577a88b7e61fe102389c925834c0ec0a1bfbffc03113aa88

SHA512
5f726a44d9558ac54a9e52998076020fa76a5ca96c0af2fb07dec971f51585bf050508b29bbe9ac160c74e94f7d337979cd19231f935b914f51e5b9a4ef9d519

Download Submit
C:\Program Files (x86)\LogMeIn Hamachi\x64\LMIGuardianDll.dll

Filesize
2.0MB

MD5
df7051274b6080da5298c61decad2fdf

SHA1
33168489e0704cba116af5417f66f99e5c184abe

SHA256
bfec06ad20dddb565fea958c273dea14cd510f24be57e8f56d35168632a81875

SHA512
506ca6cef3bd7fd8f56e934c97d4e791e330fff492d89575ce40f0123fbffaf3010f9637af3fed997bc0d642b3027d767bd93efe6c37a06b40ba0dc354a994b6

Download Submit
C:\Program Files (x86)\LogMeIn Hamachi\x64\LMIGuardianSvc.exe

Filesize
409KB

MD5
0554f3b69d39d175dd110d765c11347a

SHA1
131bc6ca3960476e16fbaad091d26e92f2093437

SHA256
a57d5ce0cba04806eb0c6d8943d85c5ab63119a99fa8f8000bdf54cccd1c1bf9

SHA512
0ebbcec7337387cb7b59a86f80269925f369112d3a9cd817fc9de5d7c978a52665ad3bd6967a8f2b36765974f808e51d8dd59fd1e80149fd5a5de4d987833f06

Download Submit
C:\Program Files (x86)\LogMeIn Hamachi\x64\hamachi-2.exe

Filesize
4.7MB

MD5
493510f5eb2c49efea54e58a83677e13

SHA1
14ec94b796cd426c001840421c4ce43750cefd2a

SHA256
199febb05fff1cca01f7f7672be99d9d0ee73b0371bd63513635dde133f3e2cc

SHA512
85b92ca63797ae5303557dc1d6771acb4bc09ddd2f3391614a3f40b2a3604b6c63566b44beb8c65da3436edad44c90b401f8b220f5fb921f287970e50438fe87

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_325DC716E4289E0AE281439314ED4BFA

Filesize
727B

MD5
f61160f66cc6dbacb3ee92e70557aea6

SHA1
1f873e04daf372232471aafb3b6772796c86d46c

SHA256
bf7ab78a5d88c5af5af9f69ac2f823022d0fa6189f188ab89ac9e4926276684d

SHA512
b4b0b5d8d2d90312af918d2f35e108614e6e7aed2a5a4377b000d772aef1bf029dc73ad4f9af22ef9b0aa80888afc45746d8745e136c5d35b1595fb58642b6f8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_325DC716E4289E0AE281439314ED4BFA

Filesize
408B

MD5
67ef0138ce58f3625350bf109da8842d

SHA1
a91c3b7d65189b8a897906dddd2bf99fd1c5b6e8

SHA256
9071a90b1e11c3ef4fabdb5ac22534ff89e64ce9223ebb421e6972457f677d9b

SHA512
e95632c586f27b00e206a4eccb709a4147211f94c8d539def040fa86ff3345a68d97e3b8f31b1eee0520c9e4223bbf874baa01d819be84f1dc5a59c000b20be3

Download Submit
C:\Users\Admin\AppData\Local\LogMeIn Hamachi\h2-ui-peers.ini

Filesize
4B

MD5
f1d3ff8443297732862df21dc4e57262

SHA1
9069ca78e7450a285173431b3e52c5c25299e473

SHA256
df3f619804a92fdb4057192dc43dd748ea778adc52bc498ce80524c014b81119

SHA512
ec2d57691d9b2d40182ac565032054b7d784ba96b18bcb5be0bb4e70e3fb041eff582c8af66ee50256539f2181d7f9e53627c0189da7e75a4d5ef10ea93b20b3

Download Submit
C:\Users\Admin\AppData\Local\LogMeIn Hamachi\h2-ui.log

Filesize
1KB

MD5
ff53141be883176aac6c5ea421170a34

SHA1
af1bdd6490497e00e8436168c331ef802b7db520

SHA256
aa4eec9952759a29854fb30757f6f042dbcfc8aeadefef4472bb098a868557dc

SHA512
2fad181656fc3dd72757943b1edd7a8db2b76904c6f0dbaf366212f33372ec4c98487fa9d0d6c7b1826f94ced8e74287b06a41c599f1ceac0538486ee6f817da

Download Submit
C:\Users\Admin\AppData\Local\LogMeIn Hamachi\h2-ui.log

Filesize
1KB

MD5
a04883c5646306c4805864fe4b86f09a

SHA1
2a14817875313c868e8e8d6c47adf5f74291f7d1

SHA256
7b36374efdc0f6f4b0ed16311672511781a914b143c8f0fdacb48cb179bad23b

SHA512
ce0e625f7d00c2d742781092b15895457a72110261084a1c1a547f965ec16bddbc54a5a79a698c1afabeb37847c6440c36422248f1c85be40fdcae7bd9cfa735

Download Submit
C:\Users\Admin\AppData\Local\LogMeIn Hamachi\h2-ui.log

Filesize
1KB

MD5
48cc382d11f166e014742b9ca4c5000b

SHA1
c89c3921e6dc6707ddfb3416a0c94ca6af202be1

SHA256
2c0e5d954783a88b9b9c95c732f835cb15b13ac3d733a0c24790db1c3c8f1e67

SHA512
fe0ea07fa95b385bf4115b94b820e6583b7f20c1158ca76bc4efb2dc41623ddeda91ed79be9c2a0bd3b5bb82648c42e0ad2cb91524d7ce2781dd9c4e675ca6f7

Download Submit
C:\Users\Admin\AppData\Local\LogMeIn Hamachi\h2-ui.log

Filesize
1KB

MD5
b1982552ccf7ee195e85cf2dc3eaf114

SHA1
7247a292481b5e18c450650a62a45267ec13882e

SHA256
e501713b91370129c3005c39b1fbcc388011e86e432919c591093d57ee430da0

SHA512
6293b5bc7939a13267db7bf9b7d452a0efb35033f7a3b4026c9256b147a12d4517ee0775a09f7520d20fe12523f0600e7e0ddfb43e8a9a07948248c8136b80e1

Download Submit
C:\Users\Admin\AppData\Local\LogMeIn Hamachi\h2-ui.log

Filesize
178B

MD5
7588ee2f0eec0ad41d38e1bc3f5d5f23

SHA1
515b3e657c54e0bf8eed6ef24d47c77e1f9ff7ca

SHA256
a2ade98fc6f9acb547d1aac58d21dee582db454eeeb36243f01b89223d310628

SHA512
5a64392be400db48de6cec7f9bc7985c553388180e40ce16c5f3436894f085cf271be1a6cab126a14e5b9867779f03fbf3f3a607db92df39c47ad9cb165dd945

Download Submit
C:\Users\Admin\AppData\Local\LogMeIn Hamachi\h2-ui.log

Filesize
723B

MD5
f6c135bbe540bade3633ceb4fb8c0e07

SHA1
edcd99d29d5a3bd09ed37efee4e49e0313a0cda9

SHA256
773a6e383891ba832d4b66b4109fdd47f695e82537c9e4ce43f182fe20b5621c

SHA512
de286fb70f125b5e0940f9e77c3c68962f7f5806d19a082e1a0a4792a06167cd23a1cd3c0e99cf4639e4ab4aa21dc4caf8a44b5ef1b8d0e4addf32ee7a4f81d2

Download Submit
C:\Users\Admin\AppData\Local\LogMeIn Hamachi\h2-ui.log

Filesize
881B

MD5
ce35687243d1388bac328b8ceedd57a7

SHA1
26bcf914c04389f4ae50c004d49f4d9aa64b503a

SHA256
5cfcbda9c7415700ec1f39c3446e77c7955cf53f774d0013095b1eaa8fa4e421

SHA512
d24739f059052b4e314ee19531f34b5e31af1259d2b4fe51df0bc1e7ff4627ad0e516fd17e486f5adc58e980093576212829726730f25756fd8541519baf9e53

Download Submit
C:\Users\Admin\AppData\Local\Temp\HamachiSetup.log

Filesize
2KB

MD5
5fe93113f5d79c189e0484cf9d7bf3aa

SHA1
48f77af799f38d867338c6f10e3a558b3a1064f3

SHA256
fab36f7717394fae435e317b55723895286a52a96fc39ef489ea6c42fd2f54e5

SHA512
15d05bbaba6a8d01a421a8ba7d27e8c7c250bfc280e0f2eb7703e865d38afffd41acafed9121f9a1d75b9c074ec5d934dc359faf3b475f740ff6d2f0fd48ae07

Download Submit
C:\Users\Admin\AppData\Local\Temp\HamachiSetup.log

Filesize
3KB

MD5
4f852a00c697f93fe71922cba8a25e66

SHA1
5e1c2f0991ab99b5e1b948836b7af7af2f7d76ef

SHA256
36a77e976c2200fdb6337aae87adc617e2ba65f6a9f2434115b5b314d7212eb8

SHA512
05eda008fc9471009c92f4f9e778694ff8c1ca717151a995e0960165f5990f24c262d2c752b5f85369d155df13d6c017399d3af8ae8cfb0d21a8ee02760748fc

Download Submit
C:\Users\Admin\AppData\Local\Temp\HamachiSetup.log

Filesize
387B

MD5
72cd59f552c651ba1cdd0e69e836c37c

SHA1
5870f139dfc79c7c12bd25438d5202ccd7fbc1c4

SHA256
9c62dae93474ba4a80dffe48390eb359749b7ec556f28b15fc7e5bab23bc2b7b

SHA512
e45b6e4e66e5fb32ca7f7dde06e886cc67d3c28d52f5372cd8e5363fbeb2ee180e29cf85783c600774eac2933cb88226cd00ad4bd53a9720fdd84407775d1989

Download Submit
C:\Users\Admin\AppData\Local\Temp\HamachiSetup.log

Filesize
3KB

MD5
67f8c774b18ac0e896f2d1ddc13eaf66

SHA1
6c2a53bdf2c4947e512c3f821a9d08316b1bb4d9

SHA256
cc5c71b45ebc6a5bfea4cd1869542f7395c0eb2348673a7279b588b5f8d03d7d

SHA512
f9053d546f640be06c382cdfe3de6f4344243103dc7a36b834a2e5648e602faa29cec916dfb810b20f3cb92e904553426798a8167fa60ba1eef02c57329597e7

Download Submit
C:\Users\Admin\AppData\Local\Temp\HamachiSetup.log

Filesize
3KB

MD5
92e5a241e11267443749e919444db8b1

SHA1
6a257d8848a8b9d10f4b89ae00e153ffaa74a287

SHA256
427c8d787c22c6356e0fb853079048f8f88ae75ea6a7a2cee64f117bb50a9bd4

SHA512
9fc8af715931a0d86bc6d3aa6c7031300bab02b89cda576e80708851bffe3d0c0f9f719ccc82aafa88cf972182aae2a62f45e7b536f686bcc0fdc442991ce540

Download Submit
C:\Users\Admin\AppData\Local\Temp\HamachiSetup.log

Filesize
3KB

MD5
4dd0fd24c5441f106bca4c7dd7b41492

SHA1
e0ed868755643eb978e5d4cf6b42224ba8f21cea

SHA256
57a70b6346f37457f78b94f2056e367890ae56bc5cab4b1fd91eb709f4ee51a1

SHA512
19def410ea3874d1fedc692ae9a031515a6fc19f9c315fcecdd0154a4d82d118e0d74d80e37e9a24c5dd7f82a5b462b9f5c9fcaf67ae75ec2bf43bef2fb230d2

Download Submit
C:\Users\Admin\AppData\Local\Temp\HamachiSetup.log

Filesize
584B

MD5
449b519e8c682f4aaaa5ab8bf2ca8ac5

SHA1
bfb9137a6c6c8fd11e2662966bc34911d48cbe1d

SHA256
c0fb28831c1bd5bfc0154a23c56a03e0b85f2cffcb330e967a3f61aba1300932

SHA512
32e70e7789c74bf2c91f7c5faebf40ae7b8e6d393b5073bf32da0456b0ec65d719988cc53541720bb85f2ce046fae94722500a48ffa2beba1a4bfa4f5122e195

Download Submit
C:\Users\Admin\AppData\Local\Temp\HamachiSetup.log

Filesize
4KB

MD5
4dbbe7bd7fd09e3cc51343d1644ab0d9

SHA1
188c85ac9104092d25b8c4e5bf587a538aa97e63

SHA256
017f8900822faae5fbbcfd007729b4cadd4a2e01c9ecc443b71d6ad80e781579

SHA512
74f2f607f6f96fe6a430b1b3a5f989ac48cbee5923e79e03c6d90d8e92a8d2f3dee6c8abf00baca7e4f15b2848b3d059af5b4da06fbe0919cb4adb35fa86f941

Download Submit
C:\Users\Admin\AppData\Local\Temp\HamachiSetup.log

Filesize
7KB

MD5
a206e7e5522daeba98c318a361d46035

SHA1
6b00fbb440fe7ad298530189cb06f2e9068aee81

SHA256
20323c20f356fa98894984ade8a8c15540da536d5e14147431ed202043bb2afc

SHA512
715fdf79398f27448425f6f69ccb5f2d139f736061bc02081f4b01dbf61e516a4c7d359251925c4e490e8568d0d213026eb05a12c98206c096d50db8fd838b4f

Download Submit
C:\Users\Admin\AppData\Local\Temp\HamachiSetup.log

Filesize
7KB

MD5
93410fc55b544a6dd16257d629f7bc80

SHA1
84800a8c460353ba91b1991e877628b5f95822e9

SHA256
8664b1493e6af294529e0ddbd8c528d2cc15b26d71a8a803aebbcfd0fc5c2a6b

SHA512
e04f02f275f0af7467030494fc0f096760bade3a1c560a87d7acb9bc617fbadf582a0917a9f282210d9e1e83b1b3a4e97958f7088a21cd88ccd68f5a7538b5c3

Download Submit
C:\Users\Admin\AppData\Local\Temp\HamachiSetup.log

Filesize
884B

MD5
80b48d48cc5bf9580f65eeec80b98e07

SHA1
416e6769971556697e933e9c68d34be80c4ebec3

SHA256
bea1b5d0ede0729e97523725552399ee314fd15d70b05302fa682382afc51503

SHA512
d24a0d1d1c2d7886e583877d019a62112a9e5511087016dafd684c7f6f59658c2dda880915337b1dde8b6be4cd3ae8e94b1884b4548aa69851d98861f5a8c9ef

Download Submit
C:\Users\Admin\AppData\Local\Temp\HamachiSetup.log

Filesize
8KB

MD5
2357abb2588de9ffdba84507cd2e6b77

SHA1
d8402c0abce64e08aad6491218c8f7a12026da66

SHA256
52ab1a267fe00aaafea9940281c3fb0ff7160d771875370d76c312466780546f

SHA512
e4af0df0dcfd82ec3943b700b1579edcea050fdca0562b7e1ef1691aefece5b24591d2b945eadfc006e2c7d34c26f7a060b032e784c9cdad6324713d31234369

Download Submit
C:\Users\Admin\AppData\Local\Temp\HamachiSetup.log

Filesize
1KB

MD5
1adf1068e9f0dc374805a64af156b1ab

SHA1
2d2570cdf3a123b983555ab42ec94c9d0050066b

SHA256
53212adcbdfecd6cb53354a8fb83dc8873e2af073933ea6244801cd8a771ff5c

SHA512
b0ef89c108a8c3f644ef26f49de5264e7cd388171b0323b4f1ed2476341ccc49f2e7896bee50baf0f5e69bfbfafc7e6c4a4257c5ef76a63eafdd61fb0fb98a33

Download Submit
C:\Users\Admin\AppData\Local\Temp\HamachiSetup.log

Filesize
2KB

MD5
bb744a7634a880b22c575c950c57f119

SHA1
a93a8712d9955065e15e3cbcede44b5a5a12fea2

SHA256
adfb2158cd66b15e9acfef4e599e7b4f1465c23dbce223360fb6030eb85788e1

SHA512
8e9e79ca5adca2067bc762a00d361d21c637fa3934881aff1ea1e1aca1caf68851655b98c210b616f2a8a7b741299de6e563444cc5a7dbc4e6f39f5cb946759a

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI9182.tmp

Filesize
2.3MB

MD5
3bc82080d6356dae779eed5135fabf66

SHA1
022c84f9cc59ec45315d78979497cd061658aba3

SHA256
b076c9b888b130fb2fb5a74542c9a73322e78ed1f3f8476be7a8209a20e56f7b

SHA512
041cd3945a22dcec792f45abc7f95b9fb7e68254948f0bfeb49de6b3501a0e13525454aa222dc4b903b3c9bafd4e0ffc2e5a99bd140238e845d3fcb7c496afbd

Download Submit
C:\Windows\Installer\e57d61c.msi

Filesize
13.7MB

MD5
909db4061c32f798e94d746717782444

SHA1
10f5ffff17d2dd4476686a941a7bcc5f9b83b1b8

SHA256
6ee98db32852a2ff31a969d918bb7c730950bb15f24ea1baf996697cebc8b9fa

SHA512
44e7f97b27aef2e4cb62a6a0ebab5033b99e1ec940f231eda416f3b68d83df81d10950a8ced2ca528024adecd1dea7e1d4427e78b111edbc0124d7ffd6c1232d

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\LogMeIn Hamachi\h2-engine.cfg.bak

Filesize
1KB

MD5
5919a4242a1fb169c68317d18adf2746

SHA1
4bc5e0bbba80f43fc5bda2d45eacab772fe8a302

SHA256
7e5adb2f62eb88481057a6e469ed552b15beea681c3cc4ab37c96b458d1969ba

SHA512
e2b7cdd9831e3e07887b9fce9b940845158be0c0e632705f318d12d21d785af7ec6e7c45cbd5675a024188bb7fcbb0adc28f317767aadb7ae4fb3d9f0c29ce48

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\LogMeIn Hamachi\h2-engine.ini

Filesize
474B

MD5
c0cb4e2be2d62eb3c5cb5fae436d05fd

SHA1
79a85bfd6429a89a230ba05dc7803f9eea42c73b

SHA256
52ca5c9618993a146d13b917833f4836976d569ba2c9034c9d8dbd47322dd915

SHA512
609a381c082b9ef57281f9bbe841b7907e7a0127539781c81c43e938d546e168e03a6ff7165521cb534e8366cecffdfadd07164972926c39b2faf47ac5aa933c

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\LogMeIn Hamachi\h2-engine.ini

Filesize
474B

MD5
30991227ac8dd440260c1dfb42866c82

SHA1
4f689e12d2e603ab4961afe6b733791388c8aab8

SHA256
6298dec2ced0bfb3a3973f4b149ea8726dbb35a3c8b1b2969488fb4ed1de553f

SHA512
c5d6e3088b816340214cd9663b2bb423df40b30e93961ed33722cea9ccb1a5cd624c0d83009aed5cd4f641498830afb1821461ffc24f4b94b4de1fe426522a93

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\LogMeIn Hamachi\h2-engine.ini

Filesize
474B

MD5
021fe647977de76c774a91ae5498ae1b

SHA1
5efebdda4abd483b0c8b9a4c5f509a65e658aa51

SHA256
baa7a15f7f6f1e432a41911ba6bd02275f590f8c867a474151ee5baaa7b10d01

SHA512
82ca59676f68d23cba150c2e3ea7be0e982d4bbeba94e394094ff4f01fad1af6eaff84beee8d0d633bbf3ef4578fd1bd8c7aeb3a15253cc69cc6f7b355c29e49

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\LogMeIn Hamachi\h2-engine.ini.updating

Filesize
7B

MD5
0f81d52e06caaa4860887488d18271c7

SHA1
13a1891af75c642306a6b695377d16e4a91f0e1b

SHA256
27eb5e51506c911f6fc4bb345c0d9db6f60415fceab7c18e1e9b862637415777

SHA512
7ccef1661d9bae2a1a219de1d53fea0e2441354e4e4c3e111f75bf926fb12c5b0e6e7824200cf65dfa5686216b9e67436038bdc69c7ea7621f3c67b481510cd7

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\LogMeIn Hamachi\h2-engine.log

Filesize
359B

MD5
a8856e8027216057d9fc773985e4eee1

SHA1
a2d9ff1df4ec85a0a3b7456f4db165fa37f85048

SHA256
f8677b87aeee9b287cd74d9045e68a303323360bd446a49ca0b587be422707b1

SHA512
4cacd29c38def5856017deecb7b305e155f0fe6f457ddea3f914fc1b7a20383bcfe5634aa5a92fe4ba1383544810daeead9bdff6ba2e320f959e2fa4ec614a50

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\LogMeIn Hamachi\h2-engine.log

Filesize
605B

MD5
0c0c7297c58840c30cca65d9aa01ab9d

SHA1
a6b222fcbcbb0d1f7502d5e7685cbd38b975c72f

SHA256
2241c9f37fff5056d400bd2a88963c1b3bb4ddc13e903cb6e11c863716a7a6a5

SHA512
ff74aa2f3925e689a9b7a8365bec30804b7ce3390796c4ee6ed333adbced0427c9719c1b12cc923e65ac7a93242dd861f25bdecacc473488f9c283019ba9083d

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\LogMeIn Hamachi\h2-engine.log

Filesize
1KB

MD5
f2be6b418424bec1069d486c74ac5e09

SHA1
3f8f5f49fb56b6f2393f6d4335a119dd7107bc9f

SHA256
920433b3a655a6d7bd6ff1069371884866e9196ce02f149eda4ac0abe273bcf7

SHA512
55b54a626e0aabb7db437342ce760e5d46f1ca8b3e17a1aa29d97304960dd419e2ca4911c7161cff6958c39672b6aaf4e83f665da8a7fc168112ba05f9202e8e

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\LogMeIn Hamachi\h2-engine.log

Filesize
2KB

MD5
feb16d474fdab55ff5687a5c121d265b

SHA1
729b5d76e7dbea460cb46ba87f813b7af6eceb94

SHA256
a8c63d412544962723ce0fe6f1487ef25f398e96dfe7dfa2bdce3fa24c61e035

SHA512
ecb7349314d113437cff857d74ef4cec1297f20b719c55aa1c9e93283214a28338eeac36f4b3046ac78450759a14c72eb2d3c81a57cc45ce01841ab7d3fb3569

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\LogMeIn Hamachi\h2-engine.log

Filesize
3KB

MD5
2084a3faeeca75ac93b151d0ac898744

SHA1
282ed33e044aa361eff6f7e730d03853e028d5e5

SHA256
41345830679d8b224068f2b3813184333ff45a52a27491f186c11ff3a25f8734

SHA512
73c732182524e472e2360bb9773a6a7f45f94a635c345bbdd58ddbc5c79ea9963809038e1733558f284ca18d740b9b63fe56855b547e318ab6da19603b8a9ee5

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\LogMeIn Hamachi\h2-engine.log

Filesize
3KB

MD5
9063c1433f942e92d7b8702b79fc617d

SHA1
1ca86088dac9b22f53bd5834e712e06873a98559

SHA256
e6a2a864899bd254a76c818b8c078ba30d701ce137b68bf0ecc7b9b495930e4c

SHA512
0eea7f333d14d6d4062e493c9622f3ec811984b662afb634cffbfe4fbf5ba335f713a76ea7a3e4c3fc92c7d9619838202554884f5b08ceafc455a6b28c2afc02

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\LogMeIn Hamachi\h2-engine.log

Filesize
4KB

MD5
75773c025b876657faa7a5657f31f826

SHA1
545c2a99351f2d1c1489e0f33b4b5366e96eecb4

SHA256
8bf9475f00fd08813b3c6a374f18e6cf042d7bc4e9c718b7854415fc3fd0e690

SHA512
3689bb60bee9e29fda8ec2db554c4bd69495d309e96cc3d5f2893b8230d244fbb53eedf5ec2f0e993dd78c3833ae6dc314435383e8863702a6eb1d1a36842037

Download Submit
C:\Windows\System32\drivers\Hamdrv.sys

Filesize
44KB

MD5
7f79205b4efa98f0767309479c8c01c6

SHA1
9d546dda7536a85a3f4228e065967be1648ad901

SHA256
4b576903a83f33a8cf31d3887144a3d51c56d1187115c83ac99c0e9f6b4bf128

SHA512
418ac89f3c5996de50c846693995145e314d0cd7edee59f0cdc212720d84be1351827c7ab02e870d1940288f5c4838d39c77fbc9847b69ab5fce5d74400c19ca

Download Submit
C:\Windows\Temp\HamachiSetup.log

Filesize
208B

MD5
3efa3c0dfac5c5da9f78fcec4fc4dc15

SHA1
590be6a1b09090adab9b09b48f0eadc15377590a

SHA256
45cb643d971aeb90f5129237c8e9bc7ce3a0a45691bf0fb220f613874d608c8f

SHA512
647f9e575908131ca4df33157a229097883c9d051db39dfc95c2b7382ef9530a2149ba844ac27d82e2ee5a9c3a1f018c3dadc427de8411eac13c843325043766

Download Submit
C:\Windows\Temp\HamachiSetup.log

Filesize
835B

MD5
41a59f5075dc3dc853f5e9bc659e297c

SHA1
f44450c67bf84f3266bfceeaa0e07ee1c3ecbdfb

SHA256
bc6a5f07beec497c294a94192c4da0c179beed602a970c1ca3999c53c5b631c9

SHA512
6d3a21c207da3a36d7f947a3f9229deae8ef5bbe40ce3d775139c71ce43adfbebfc329b80cf90acc7d7aa82297cdbb4fa0c10f62284fe6925ad9f475be73d7f0

Download Submit
C:\Windows\Temp\HamachiSetup.log

Filesize
968B

MD5
a1670aed5d51ea485660d2369e71c90e

SHA1
bde396a8e5a2ea01b74c9956e460565e7ec49bb4

SHA256
98cc33106c2f134fc4cd7b54feb724d5888719e5c45da9538eac215722ef3524

SHA512
2c4e4de0a2518e0530378ba9cfd6168664aca8b8c93f763e9eaf114bd899bff8ef8bf3c26bd903bf57c57151d475b7ec7b25731aaf486ec003e7cf26ee6a14e8

Download Submit
C:\Windows\Temp\HamachiSetup.log

Filesize
1KB

MD5
6335706b2786a800a4716800e6d37340

SHA1
2d4d0af39949595550adbef6c14aebbe0b18a1f7

SHA256
b79fd4bfa6d432403e8101a01bda6c3adf8058948ce7fe2499ff69af334c4fd4

SHA512
701f0eb769f7055a46563f6bc70da4745b42bedcf58568761adadd3b35dc9b6c04d396d1a0ed4a9b4a7a90a85fe203c4bd707690c57c76e901ce98be2a5bd19e

Download Submit
\??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2

Filesize
12.8MB

MD5
752c2d68763d7e6231d8fba5c045c34e

SHA1
4fe8fff64f159f9e42bf814094e01eef5a55c094

SHA256
f527231764e30b23417c5cdf6f02834806c592480c8572b0770c00e5b63088e6

SHA512
58068b0c1246b148d3c0072c2965d487dba3accb0175071ded9deb85fa2174ea34f0be3ca5204a63f2cd88949f848322e1f3e223d576d1d00f700df8407d693d

Download Submit
\??\Volume{85315c9a-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{e8a48f6b-37f6-4834-832c-2f4a5f016418}_OnDiskSnapshotProp

Filesize
6KB

MD5
9a82a3d94de2c0d91a54fff8db45ae68

SHA1
a69a12bb270664ba29b096459acc6bdfa348a095

SHA256
476c21aa32a7e48a37f305a94025ab21981df93642e5a71dd2c44aac6da32016

SHA512
6fadb8523868e0429cb5f32d55fce4216a2f0cba50fe7bcd72dc3e9f17124892485c74ce66006f874c8220ba86cf1a1d134e1fa64128218ddf91336b4637f42f

Download Submit
\??\c:\program files (x86)\logmein hamachi\x64\hamdrv.cat

Filesize
10KB

MD5
f49c69fcca067884f38e9cab20ba8920

SHA1
bbe2113cfeb8b9a2234d97849c05c4a72b368a7d

SHA256
e436ceef0126e703fe48bd669e3748e468b6f8027a8b6c2ae779f2911e65331c

SHA512
e233dc261ea650d0cc01834591ba5c7e113daa23da7ada913c589ddff13c7d5b946da5f3f649e81de9afa664d0c4bf5b6fc921e359c252dee5132c8f584c60d3

Download Submit
\??\c:\program files (x86)\logmein hamachi\x64\hamdrv.inf

Filesize
6KB

MD5
da79247b2ba817d655c2db44bdebff1c

SHA1
fb62be8194096675dace18cd1217217ec2f85777

SHA256
35e3427711eb7e0645d3f4ffbc3dd73b16e96ef1dc4c210db1f67229283f414a

SHA512
e124e5bce81d09713b959a54da96ca7679b9880e69952faef360c7f0311a6d85a97d377281edbae22e61f7e3204847fb4eafd64a15aa97079bf9cda2cf1f0328

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads