6ee98db32852a2ff31a969d918bb7c730950bb15f24ea1baf996697cebc8b9fa

Analysis

max time kernel
147s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
26/08/2024, 02:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

hamachi.msi
Size

13.7MB
MD5

909db4061c32f798e94d746717782444
SHA1

10f5ffff17d2dd4476686a941a7bcc5f9b83b1b8
SHA256

6ee98db32852a2ff31a969d918bb7c730950bb15f24ea1baf996697cebc8b9fa
SHA512

44e7f97b27aef2e4cb62a6a0ebab5033b99e1ec940f231eda416f3b68d83df81d10950a8ced2ca528024adecd1dea7e1d4427e78b111edbc0124d7ffd6c1232d
SSDEEP

196608:cp/8gF8Li2aauOgsgJ9RSfD3G43O+WFoy1jNDVxJBQHhIO4E46uVwOXsHoHybhLf:O/382agT9RK73O+kN3JSHuy46inqUMC

Score

8^/10

discovery persistence privilege_escalation

Malware Config

Signatures

Drops file in Drivers directory 4 IoCs

description	ioc	Process
File created	C:\Windows\system32\DRIVERS\SET64C0.tmp	hamachi-2.exe
File opened for modification	C:\Windows\system32\DRIVERS\Hamdrv.sys	hamachi-2.exe
File opened for modification	C:\Windows\System32\drivers\Hamdrv.sys	DrvInst.exe
File opened for modification	C:\Windows\system32\DRIVERS\SET64C0.tmp	hamachi-2.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\LogMeIn Hamachi Ui = "\"C:\\Program Files (x86)\\LogMeIn Hamachi\\hamachi-2-ui.exe\" --auto-start"	msiexec.exe

Blocklisted process makes network request 4 IoCs

flow	pid	Process
4	2304	msiexec.exe
6	2304	msiexec.exe
6	2304	msiexec.exe
4	2304	msiexec.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe

Drops file in System32 directory 16 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\hamdrv.inf_amd64_c59072ec40c0c372\Hamdrv.sys	DrvInst.exe
File created	C:\Windows\System32\DriverStore\FileRepository\hamdrv.inf_amd64_c59072ec40c0c372\hamdrv.PNF	hamachi-2.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{03de6bf1-55af-e644-b119-728bd5fba23d}\SET658B.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{03de6bf1-55af-e644-b119-728bd5fba23d}\SET659C.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{03de6bf1-55af-e644-b119-728bd5fba23d}\SET659D.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{03de6bf1-55af-e644-b119-728bd5fba23d}\hamdrv.inf	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{03de6bf1-55af-e644-b119-728bd5fba23d}\Hamdrv.sys	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{03de6bf1-55af-e644-b119-728bd5fba23d}\SET659C.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\hamdrv.inf_amd64_c59072ec40c0c372\hamdrv.cat	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\hamdrv.inf_amd64_c59072ec40c0c372\hamdrv.inf	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{03de6bf1-55af-e644-b119-728bd5fba23d}\SET658B.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{03de6bf1-55af-e644-b119-728bd5fba23d}\SET659D.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\drvstore.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{03de6bf1-55af-e644-b119-728bd5fba23d}\hamdrv.cat	DrvInst.exe
File opened for modification	C:\Windows\System32\CatRoot2\dberr.txt	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{03de6bf1-55af-e644-b119-728bd5fba23d}	DrvInst.exe

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Drops file in Program Files directory 16 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\LogMeIn Hamachi\x64\LMIGuardianSvc.exe	msiexec.exe
File created	C:\Program Files (x86)\LogMeIn Hamachi\x64\hamachi.sys	msiexec.exe
File created	C:\Program Files (x86)\LogMeIn Hamachi\x64\hamachi.inf	msiexec.exe
File created	C:\Program Files (x86)\LogMeIn Hamachi\x64\hamdrv.inf	msiexec.exe
File created	C:\Program Files (x86)\LogMeIn Hamachi\LMIGuardianSvc.exe	msiexec.exe
File created	C:\Program Files (x86)\LogMeIn Hamachi\LMIGuardianEvt.Dll	msiexec.exe
File created	C:\Program Files (x86)\LogMeIn Hamachi\ReleaseNotes.rtf	msiexec.exe
File created	C:\Program Files (x86)\LogMeIn Hamachi\x64\hamdrv.sys	msiexec.exe
File created	C:\Program Files (x86)\LogMeIn Hamachi\x64\LMIGuardianDll.dll	msiexec.exe
File created	C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2-ui.exe	msiexec.exe
File created	C:\Program Files (x86)\LogMeIn Hamachi\x64\hamachi-2.exe	msiexec.exe
File created	C:\Program Files (x86)\LogMeIn Hamachi\x64\LMIGuardianEvt.Dll	msiexec.exe
File created	C:\Program Files (x86)\LogMeIn Hamachi\hamachi.lng	msiexec.exe
File created	C:\Program Files (x86)\LogMeIn Hamachi\LMIGuardianDll.dll	msiexec.exe
File created	C:\Program Files (x86)\LogMeIn Hamachi\x64\hamachi.cat	msiexec.exe
File created	C:\Program Files (x86)\LogMeIn Hamachi\x64\hamdrv.cat	msiexec.exe

Drops file in Windows directory 51 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\MSI583D.tmp	msiexec.exe
File opened for modification	C:\Windows\ServiceProfiles\LocalService\AppData\Local\LogMeIn Hamachi\h2-engine.cfg.updating	hamachi-2.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	svchost.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File opened for modification	C:\Windows\ServiceProfiles\LocalService\AppData\Local\LogMeIn Hamachi\h2-engine.log	hamachi-2.exe
File opened for modification	C:\Windows\ServiceProfiles\LocalService\AppData\Local\LogMeIn Hamachi\h2-engine.cfg.bak	hamachi-2.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\{C00E2143-38F2-49BA-AB8A-03F22F02F0A4}\UninstallIcon.ico	msiexec.exe
File opened for modification	C:\Windows\ServiceProfiles\LocalService\AppData\Local\LogMeIn Hamachi\h2-engine.id.updating	hamachi-2.exe
File created	C:\Windows\ServiceProfiles\LocalService\AppData\Local\LogMeIn Hamachi\h2-engine.cfg.updating	hamachi-2.exe
File created	C:\Windows\ServiceProfiles\LocalService\AppData\Local\LogMeIn Hamachi\h2-engine.cfg.bak	hamachi-2.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File opened for modification	C:\Windows\inf\oem3.inf	DrvInst.exe
File opened for modification	C:\Windows\Installer\MSI61BC.tmp	msiexec.exe
File created	C:\Windows\inf\oem3.inf	DrvInst.exe
File created	C:\Windows\ServiceProfiles\LocalService\AppData\Local\LogMeIn Hamachi\h2-engine.ini.bak	hamachi-2.exe
File opened for modification	C:\Windows\ServiceProfiles\LocalService\AppData\Local\LogMeIn Hamachi\h2-engine.ini	hamachi-2.exe
File opened for modification	C:\Windows\Installer\MSI611E.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI8DB0.tmp	msiexec.exe
File opened for modification	C:\Windows\ServiceProfiles\LocalService\AppData\Local\LogMeIn Hamachi\h2-engine.ini.updating	hamachi-2.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	hamachi-2.exe
File opened for modification	C:\Windows\Installer\MSI8C86.tmp	msiexec.exe
File opened for modification	C:\Windows\ServiceProfiles\LocalService\AppData\Local\LogMeIn Hamachi\h2-engine.id	hamachi-2.exe
File opened for modification	C:\Windows\Installer\e585781.msi	msiexec.exe
File created	C:\Windows\ServiceProfiles\LocalService\AppData\Local\LogMeIn Hamachi\h2-engine.ini	hamachi-2.exe
File created	C:\Windows\Installer\SourceHash{C00E2143-38F2-49BA-AB8A-03F22F02F0A4}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI5D14.tmp	msiexec.exe
File created	C:\Windows\ServiceProfiles\LocalService\AppData\Local\LogMeIn Hamachi\h2-engine.ini.updating	hamachi-2.exe
File opened for modification	C:\Windows\Installer\MSI5A62.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\ServiceProfiles\LocalService\AppData\Local\LogMeIn Hamachi\h2-engine.cfg	hamachi-2.exe
File opened for modification	C:\Windows\Installer\MSI5AA2.tmp	msiexec.exe
File created	C:\Windows\ServiceProfiles\LocalService\AppData\Local\LogMeIn Hamachi\h2-engine.id.bak	hamachi-2.exe
File created	C:\Windows\ServiceProfiles\LocalService\AppData\Local\LogMeIn Hamachi\h2-engine.id	hamachi-2.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	hamachi-2.exe
File created	C:\Windows\Installer\e585783.msi	msiexec.exe
File created	C:\Windows\Installer\e585781.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI9737.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI59A5.tmp	msiexec.exe
File opened for modification	C:\Windows\ServiceProfiles\LocalService\AppData\Local\LogMeIn Hamachi\h2-engine.ini.bak	hamachi-2.exe
File created	C:\Windows\Installer\{C00E2143-38F2-49BA-AB8A-03F22F02F0A4}\UninstallIcon.ico	msiexec.exe
File created	C:\Windows\ServiceProfiles\LocalService\AppData\Local\LogMeIn Hamachi\h2-client.key	hamachi-2.exe
File opened for modification	C:\Windows\Installer\MSI5A82.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI5D54.tmp	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI5F29.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI9727.tmp	msiexec.exe
File opened for modification	C:\Windows\ServiceProfiles\LocalService\AppData\Local\LogMeIn Hamachi\h2-engine.id.bak	hamachi-2.exe
File opened for modification	C:\Windows\ServiceProfiles\LocalService\AppData\Local\LogMeIn Hamachi\h2-engine.cfg	hamachi-2.exe
File created	C:\Windows\ServiceProfiles\LocalService\AppData\Local\LogMeIn Hamachi\h2-engine.id.updating	hamachi-2.exe
File created	C:\Windows\ServiceProfiles\LocalService\AppData\Local\LogMeIn Hamachi\h2-server.key	hamachi-2.exe

Executes dropped EXE 12 IoCs

pid	Process
828	hamachi-2.exe
4844	LMIGuardianSvc.exe
1664	hamachi-2.exe
2084	LMIGuardianSvc.exe
1128	LMIGuardianSvc.exe
1376	hamachi-2.exe
3156	LMIGuardianSvc.exe
1664	LMIGuardianSvc.exe
3184	hamachi-2.exe
1532	LMIGuardianSvc.exe
4512	hamachi-2-ui.exe
2420	LMIGuardianSvc.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2844	sc.exe
2328	sc.exe

Loads dropped DLL 26 IoCs

pid	Process
5012	MsiExec.exe
5012	MsiExec.exe
5012	MsiExec.exe
5012	MsiExec.exe
5012	MsiExec.exe
4512	MsiExec.exe
4512	MsiExec.exe
4512	MsiExec.exe
4512	MsiExec.exe
4512	MsiExec.exe
4512	MsiExec.exe
4768	MsiExec.exe
4768	MsiExec.exe
4768	MsiExec.exe
4844	LMIGuardianSvc.exe
2084	LMIGuardianSvc.exe
4768	MsiExec.exe
1128	LMIGuardianSvc.exe
4768	MsiExec.exe
3156	LMIGuardianSvc.exe
1664	LMIGuardianSvc.exe
4768	MsiExec.exe
4768	MsiExec.exe
1532	LMIGuardianSvc.exe
5012	MsiExec.exe
2420	LMIGuardianSvc.exe

Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs

persistence privilege_escalation

Installer Packages

T1546.016

Msiexec

T1218.007

pid	Process
2304	msiexec.exe

Event Triggered Execution: Netsh Helper DLL 1 TTPs 15 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	LMIGuardianSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hamachi-2-ui.exe

Checks SCSI registry key(s) 3 TTPs 51 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\LowerFilters	hamachi-2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\CompatibleIDs	DrvInst.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\UpperFilters	hamachi-2.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Service	hamachi-2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000	hamachi-2.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\CompatibleIDs	DrvInst.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\LowerFilters	hamachi-2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Phantom	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	hamachi-2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Filters	hamachi-2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	hamachi-2.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\LowerFilters	hamachi-2.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Service	hamachi-2.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	hamachi-2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Filters	hamachi-2.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Service	hamachi-2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\UpperFilters	hamachi-2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Phantom	DrvInst.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000e7a671f193ce7b7c0000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000e7a671f10000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff000000000700010000680900e7a671f1000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1de7a671f1000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000e7a671f100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Filters	hamachi-2.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\UpperFilters	hamachi-2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Filters	hamachi-2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	hamachi-2.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\LowerFilters	hamachi-2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Service	hamachi-2.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	DrvInst.exe

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	MsiExec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\hamachi-2-ui.exe = "11000"	MsiExec.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	hamachi-2.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	hamachi-2.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	DrvInst.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@%SystemRoot%\system32\hnetcfgclient.dll,-201 = "HNetCfg Client"	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	hamachi-2.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	hamachi-2.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	hamachi-2.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	hamachi-2.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	hamachi-2.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	hamachi-2.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	hamachi-2.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	hamachi-2.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	hamachi-2.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	hamachi-2.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	hamachi-2.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	hamachi-2.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	hamachi-2.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	hamachi-2.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\RAS AutoDial\Default	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	hamachi-2.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	hamachi-2.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	hamachi-2.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	hamachi-2.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	hamachi-2.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	hamachi-2.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	hamachi-2.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	hamachi-2.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	hamachi-2.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	hamachi-2.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	hamachi-2.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	hamachi-2.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	hamachi-2.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	hamachi-2.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\3412E00C2F83AB94BAA8302FF2200F4A\LanguageRU = "\x06Ui"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3412E00C2F83AB94BAA8302FF2200F4A\SourceList\Media\1 = ";"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{67E4A0D8-8675-4FBB-BC62-F10EC894327E}	LMIGuardianSvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D4258A22-CF85-489D-83AE-49FCD0DFAD29}\TypeLib\ = "{FAC58A4E-76CC-418B-8829-6DE882474472}"	LMIGuardianSvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\3412E00C2F83AB94BAA8302FF2200F4A\LanguageFI = "\x06Ui"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\3412E00C2F83AB94BAA8302FF2200F4A\LanguageHU = "\x06Ui"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\3412E00C2F83AB94BAA8302FF2200F4A\LanguageJA = "\x06Ui"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{FAC58A4E-76CC-418B-8829-6DE882474472}\1.0\ = "LMIGuardianSvc 1.0 Type Library"	LMIGuardianSvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\3412E00C2F83AB94BAA8302FF2200F4A\LanguageDA = "\x06Ui"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\3412E00C2F83AB94BAA8302FF2200F4A\LanguageES = "\x06Ui"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{4615B7A3-8EF2-40C0-83F0-63BCD479C791}\ProxyStubClsid32	LMIGuardianSvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\3412E00C2F83AB94BAA8302FF2200F4A\LanguageIT = "\x06Ui"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3412E00C2F83AB94BAA8302FF2200F4A\InstanceType = "0"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3412E00C2F83AB94BAA8302FF2200F4A\DeploymentFlags = "3"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{FAC58A4E-76CC-418B-8829-6DE882474472}\1.0	LMIGuardianSvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{FAC58A4E-76CC-418B-8829-6DE882474472}\1.0\HELPDIR\ = "C:\\Program Files (x86)\\LogMeIn Hamachi\\x64"	LMIGuardianSvc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4615B7A3-8EF2-40C0-83F0-63BCD479C791}\ProxyStubClsid32	LMIGuardianSvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4615B7A3-8EF2-40C0-83F0-63BCD479C791}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	LMIGuardianSvc.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{67E4A0D8-8675-4FBB-BC62-F10EC894327E}\AccessPermission = 010014807400000084000000140000003000000002001c000100000011001400010000000101000000000010001000000200440003000000000014000b000000010100000000000504000000000014000b00000001010000000000050b000000000014000b0000000101000000000005120000000102000000000005200000002002000001020000000000052000000020020000	LMIGuardianSvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\LMIGuardianSvc.EXE\AppID = "{67E4A0D8-8675-4FBB-BC62-F10EC894327E}"	LMIGuardianSvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D4258A22-CF85-489D-83AE-49FCD0DFAD29}\ProgID\ = "LMIGuardianSvc.GuardianSvc.1"	LMIGuardianSvc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{4615B7A3-8EF2-40C0-83F0-63BCD479C791}	LMIGuardianSvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{4615B7A3-8EF2-40C0-83F0-63BCD479C791}\TypeLib\Version = "1.0"	LMIGuardianSvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\3412E00C2F83AB94BAA8302FF2200F4A\LanguageZH = "\x06Ui"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3412E00C2F83AB94BAA8302FF2200F4A	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\LMIGuardianSvc.GuardianSvc\ = "GuardianSvc Class"	LMIGuardianSvc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\LMIGuardianSvc.GuardianSvc\CurVer	LMIGuardianSvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D4258A22-CF85-489D-83AE-49FCD0DFAD29}\ = "GuardianSvc Class"	LMIGuardianSvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4615B7A3-8EF2-40C0-83F0-63BCD479C791}\ = "IGuardianSvc"	LMIGuardianSvc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D4258A22-CF85-489D-83AE-49FCD0DFAD29}\VersionIndependentProgID	LMIGuardianSvc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4615B7A3-8EF2-40C0-83F0-63BCD479C791}	LMIGuardianSvc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3412E00C2F83AB94BAA8302FF2200F4A\Version = "33751040"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\0E80E241A66716B4F9A16046F5141A90\3412E00C2F83AB94BAA8302FF2200F4A	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3412E00C2F83AB94BAA8302FF2200F4A\Clients = 3a0000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\LMIGuardianSvc.GuardianSvc\CLSID\ = "{D4258A22-CF85-489D-83AE-49FCD0DFAD29}"	LMIGuardianSvc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D4258A22-CF85-489D-83AE-49FCD0DFAD29}	LMIGuardianSvc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4615B7A3-8EF2-40C0-83F0-63BCD479C791}\TypeLib	LMIGuardianSvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{4615B7A3-8EF2-40C0-83F0-63BCD479C791}\ = "IGuardianSvc"	LMIGuardianSvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\3412E00C2F83AB94BAA8302FF2200F4A\LanguageHE = "\x06Ui"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{67E4A0D8-8675-4FBB-BC62-F10EC894327E}\ = "LMIGuardianSvc"	LMIGuardianSvc.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{67E4A0D8-8675-4FBB-BC62-F10EC894327E}\LaunchPermission = 010014807400000084000000140000003000000002001c000100000011001400010000000101000000000010001000000200440003000000000014000b000000010100000000000504000000000014000b00000001010000000000050b000000000014000b0000000101000000000005120000000102000000000005200000002002000001020000000000052000000020020000	LMIGuardianSvc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\LMIGuardianSvc.GuardianSvc\CLSID	LMIGuardianSvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\3412E00C2F83AB94BAA8302FF2200F4A\LanguageDE = "\x06Ui"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3412E00C2F83AB94BAA8302FF2200F4A\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\3412E00C2F83AB94BAA8302FF2200F4A\LanguagePL = "\x06Ui"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3412E00C2F83AB94BAA8302FF2200F4A\ProductName = "Hamachi"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3412E00C2F83AB94BAA8302FF2200F4A\PackageCode = "BD8AE51CFD1484C47840D7F4BAD7E9BB"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{FAC58A4E-76CC-418B-8829-6DE882474472}\1.0\FLAGS\ = "0"	LMIGuardianSvc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{4615B7A3-8EF2-40C0-83F0-63BCD479C791}\TypeLib	LMIGuardianSvc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3412E00C2F83AB94BAA8302FF2200F4A\Assignment = "1"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\LMIGuardianSvc.GuardianSvc	LMIGuardianSvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D4258A22-CF85-489D-83AE-49FCD0DFAD29}\AppID = "{67E4A0D8-8675-4FBB-BC62-F10EC894327E}"	LMIGuardianSvc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{FAC58A4E-76CC-418B-8829-6DE882474472}	LMIGuardianSvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4615B7A3-8EF2-40C0-83F0-63BCD479C791}\TypeLib\Version = "1.0"	LMIGuardianSvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{4615B7A3-8EF2-40C0-83F0-63BCD479C791}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	LMIGuardianSvc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3412E00C2F83AB94BAA8302FF2200F4A\SourceList\Net	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{FAC58A4E-76CC-418B-8829-6DE882474472}\1.0\HELPDIR	LMIGuardianSvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\3412E00C2F83AB94BAA8302FF2200F4A\LanguageSV = "\x06Ui"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{67E4A0D8-8675-4FBB-BC62-F10EC894327E}\LocalService = "LMIGuardianSvc"	LMIGuardianSvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\LMIGuardianSvc.GuardianSvc.1\ = "GuardianSvc Class"	LMIGuardianSvc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D4258A22-CF85-489D-83AE-49FCD0DFAD29}\TypeLib	LMIGuardianSvc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{FAC58A4E-76CC-418B-8829-6DE882474472}\1.0\0	LMIGuardianSvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{FAC58A4E-76CC-418B-8829-6DE882474472}\1.0\0\win64\ = "C:\\Program Files (x86)\\LogMeIn Hamachi\\x64\\LMIGuardianSvc.exe\\1"	LMIGuardianSvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\3412E00C2F83AB94BAA8302FF2200F4A\LanguageZHTW = "\x06Ui"	msiexec.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2304	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2304	msiexec.exe
Token: SeSecurityPrivilege	3476	msiexec.exe
Token: SeCreateTokenPrivilege	2304	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	2304	msiexec.exe
Token: SeLockMemoryPrivilege	2304	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2304	msiexec.exe
Token: SeMachineAccountPrivilege	2304	msiexec.exe
Token: SeTcbPrivilege	2304	msiexec.exe
Token: SeSecurityPrivilege	2304	msiexec.exe
Token: SeTakeOwnershipPrivilege	2304	msiexec.exe
Token: SeLoadDriverPrivilege	2304	msiexec.exe
Token: SeSystemProfilePrivilege	2304	msiexec.exe
Token: SeSystemtimePrivilege	2304	msiexec.exe
Token: SeProfSingleProcessPrivilege	2304	msiexec.exe
Token: SeIncBasePriorityPrivilege	2304	msiexec.exe
Token: SeCreatePagefilePrivilege	2304	msiexec.exe
Token: SeCreatePermanentPrivilege	2304	msiexec.exe
Token: SeBackupPrivilege	2304	msiexec.exe
Token: SeRestorePrivilege	2304	msiexec.exe
Token: SeShutdownPrivilege	2304	msiexec.exe
Token: SeDebugPrivilege	2304	msiexec.exe
Token: SeAuditPrivilege	2304	msiexec.exe
Token: SeSystemEnvironmentPrivilege	2304	msiexec.exe
Token: SeChangeNotifyPrivilege	2304	msiexec.exe
Token: SeRemoteShutdownPrivilege	2304	msiexec.exe
Token: SeUndockPrivilege	2304	msiexec.exe
Token: SeSyncAgentPrivilege	2304	msiexec.exe
Token: SeEnableDelegationPrivilege	2304	msiexec.exe
Token: SeManageVolumePrivilege	2304	msiexec.exe
Token: SeImpersonatePrivilege	2304	msiexec.exe
Token: SeCreateGlobalPrivilege	2304	msiexec.exe
Token: SeCreateTokenPrivilege	2304	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	2304	msiexec.exe
Token: SeLockMemoryPrivilege	2304	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2304	msiexec.exe
Token: SeMachineAccountPrivilege	2304	msiexec.exe
Token: SeTcbPrivilege	2304	msiexec.exe
Token: SeSecurityPrivilege	2304	msiexec.exe
Token: SeTakeOwnershipPrivilege	2304	msiexec.exe
Token: SeLoadDriverPrivilege	2304	msiexec.exe
Token: SeSystemProfilePrivilege	2304	msiexec.exe
Token: SeSystemtimePrivilege	2304	msiexec.exe
Token: SeProfSingleProcessPrivilege	2304	msiexec.exe
Token: SeIncBasePriorityPrivilege	2304	msiexec.exe
Token: SeCreatePagefilePrivilege	2304	msiexec.exe
Token: SeCreatePermanentPrivilege	2304	msiexec.exe
Token: SeBackupPrivilege	2304	msiexec.exe
Token: SeRestorePrivilege	2304	msiexec.exe
Token: SeShutdownPrivilege	2304	msiexec.exe
Token: SeDebugPrivilege	2304	msiexec.exe
Token: SeAuditPrivilege	2304	msiexec.exe
Token: SeSystemEnvironmentPrivilege	2304	msiexec.exe
Token: SeChangeNotifyPrivilege	2304	msiexec.exe
Token: SeRemoteShutdownPrivilege	2304	msiexec.exe
Token: SeUndockPrivilege	2304	msiexec.exe
Token: SeSyncAgentPrivilege	2304	msiexec.exe
Token: SeEnableDelegationPrivilege	2304	msiexec.exe
Token: SeManageVolumePrivilege	2304	msiexec.exe
Token: SeImpersonatePrivilege	2304	msiexec.exe
Token: SeCreateGlobalPrivilege	2304	msiexec.exe
Token: SeCreateTokenPrivilege	2304	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	2304	msiexec.exe
Token: SeLockMemoryPrivilege	2304	msiexec.exe

Suspicious use of FindShellTrayWindow 11 IoCs

pid	Process
2304	msiexec.exe
2304	msiexec.exe
4512	hamachi-2-ui.exe
4512	hamachi-2-ui.exe
4512	hamachi-2-ui.exe
4512	hamachi-2-ui.exe
4512	hamachi-2-ui.exe
4512	hamachi-2-ui.exe
4512	hamachi-2-ui.exe
4512	hamachi-2-ui.exe
4512	hamachi-2-ui.exe

Suspicious use of SendNotifyMessage 9 IoCs

pid	Process
4512	hamachi-2-ui.exe
4512	hamachi-2-ui.exe
4512	hamachi-2-ui.exe
4512	hamachi-2-ui.exe
4512	hamachi-2-ui.exe
4512	hamachi-2-ui.exe
4512	hamachi-2-ui.exe
4512	hamachi-2-ui.exe
4512	hamachi-2-ui.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
4512	hamachi-2-ui.exe
4512	hamachi-2-ui.exe
4512	hamachi-2-ui.exe
4512	hamachi-2-ui.exe

Suspicious use of WriteProcessMemory 55 IoCs

description	pid	Process	procid_target
PID 3476 wrote to memory of 5012	3476	msiexec.exe	89
PID 3476 wrote to memory of 5012	3476	msiexec.exe	89
PID 3476 wrote to memory of 5012	3476	msiexec.exe	89
PID 3476 wrote to memory of 2972	3476	msiexec.exe	104
PID 3476 wrote to memory of 2972	3476	msiexec.exe	104
PID 3476 wrote to memory of 4512	3476	msiexec.exe	106
PID 3476 wrote to memory of 4512	3476	msiexec.exe	106
PID 3476 wrote to memory of 4512	3476	msiexec.exe	106
PID 3476 wrote to memory of 4768	3476	msiexec.exe	107
PID 3476 wrote to memory of 4768	3476	msiexec.exe	107
PID 3476 wrote to memory of 4768	3476	msiexec.exe	107
PID 4768 wrote to memory of 828	4768	MsiExec.exe	108
PID 4768 wrote to memory of 828	4768	MsiExec.exe	108
PID 828 wrote to memory of 4844	828	hamachi-2.exe	110
PID 828 wrote to memory of 4844	828	hamachi-2.exe	110
PID 3708 wrote to memory of 3228	3708	svchost.exe	113
PID 3708 wrote to memory of 3228	3708	svchost.exe	113
PID 3708 wrote to memory of 4412	3708	svchost.exe	114
PID 3708 wrote to memory of 4412	3708	svchost.exe	114
PID 828 wrote to memory of 4824	828	hamachi-2.exe	116
PID 828 wrote to memory of 4824	828	hamachi-2.exe	116
PID 828 wrote to memory of 4824	828	hamachi-2.exe	116
PID 828 wrote to memory of 2544	828	hamachi-2.exe	118
PID 828 wrote to memory of 2544	828	hamachi-2.exe	118
PID 828 wrote to memory of 2544	828	hamachi-2.exe	118
PID 828 wrote to memory of 3016	828	hamachi-2.exe	122
PID 828 wrote to memory of 3016	828	hamachi-2.exe	122
PID 828 wrote to memory of 3016	828	hamachi-2.exe	122
PID 828 wrote to memory of 4092	828	hamachi-2.exe	124
PID 828 wrote to memory of 4092	828	hamachi-2.exe	124
PID 828 wrote to memory of 4092	828	hamachi-2.exe	124
PID 4768 wrote to memory of 1664	4768	MsiExec.exe	126
PID 4768 wrote to memory of 1664	4768	MsiExec.exe	126
PID 1664 wrote to memory of 2084	1664	hamachi-2.exe	128
PID 1664 wrote to memory of 2084	1664	hamachi-2.exe	128
PID 4768 wrote to memory of 2328	4768	MsiExec.exe	129
PID 4768 wrote to memory of 2328	4768	MsiExec.exe	129
PID 4768 wrote to memory of 2328	4768	MsiExec.exe	129
PID 4768 wrote to memory of 1128	4768	MsiExec.exe	131
PID 4768 wrote to memory of 1128	4768	MsiExec.exe	131
PID 1376 wrote to memory of 3156	1376	hamachi-2.exe	133
PID 1376 wrote to memory of 3156	1376	hamachi-2.exe	133
PID 4768 wrote to memory of 2844	4768	MsiExec.exe	135
PID 4768 wrote to memory of 2844	4768	MsiExec.exe	135
PID 4768 wrote to memory of 2844	4768	MsiExec.exe	135
PID 3184 wrote to memory of 1532	3184	hamachi-2.exe	138
PID 3184 wrote to memory of 1532	3184	hamachi-2.exe	138
PID 3184 wrote to memory of 636	3184	hamachi-2.exe	139
PID 3184 wrote to memory of 636	3184	hamachi-2.exe	139
PID 5012 wrote to memory of 4512	5012	MsiExec.exe	143
PID 5012 wrote to memory of 4512	5012	MsiExec.exe	143
PID 5012 wrote to memory of 4512	5012	MsiExec.exe	143
PID 4512 wrote to memory of 2420	4512	hamachi-2-ui.exe	144
PID 4512 wrote to memory of 2420	4512	hamachi-2-ui.exe	144
PID 4512 wrote to memory of 2420	4512	hamachi-2-ui.exe	144

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\hamachi.msi
1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2304

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Adds Run key to start application
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3476
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding DFBE64AA334C03302E47ED199ACA659C C
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5012
- - C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2-ui.exe
    "C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2-ui.exe" --ipc-timeout 30
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4512
  - - C:\Program Files (x86)\LogMeIn Hamachi\LMIGuardianSvc.exe
      "C:\Program Files (x86)\LogMeIn Hamachi\LMIGuardianSvc.exe" /escort 4512 /CUSTOM Hamachi
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      PID:2420
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:2972
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding B77755C3FB668960DA1C51CAB9012D13
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:4512
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 50E1C9D690ED14068154D3BC84674C7A E Global\MSI0000
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:4768
- - C:\Program Files (x86)\LogMeIn Hamachi\x64\hamachi-2.exe
    "C:\Program Files (x86)\LogMeIn Hamachi\x64\hamachi-2.exe" --add-tap-at-install Hamachi
    3⤵
    - Drops file in Drivers directory
    - Drops file in System32 directory
    - Drops file in Windows directory
    - Executes dropped EXE
    - Checks SCSI registry key(s)
    - Modifies data under HKEY_USERS
    - Suspicious use of WriteProcessMemory
    PID:828
  - - C:\Program Files (x86)\LogMeIn Hamachi\x64\LMIGuardianSvc.exe
      "C:\Program Files (x86)\LogMeIn Hamachi\x64\LMIGuardianSvc.exe" /escort 828 /CUSTOM Hamachi
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:4844
  - - C:\Windows\SysWOW64\netsh.exe
      netsh interface ipv4 set subinterface "Ethernet 2" mtu=1404 store=persistent
      4⤵
      Event Triggered Execution: Netsh Helper DLL
      System Location Discovery: System Language Discovery
      PID:4824
  - - C:\Windows\SysWOW64\netsh.exe
      netsh.exe interface set interface name="Ethernet 2" newname="Hamachi"
      4⤵
      Event Triggered Execution: Netsh Helper DLL
      System Location Discovery: System Language Discovery
      PID:2544
  - - C:\Windows\SysWOW64\netsh.exe
      netsh interface tcp set global autotuninglevel=normal
      4⤵
      Event Triggered Execution: Netsh Helper DLL
      System Location Discovery: System Language Discovery
      PID:3016
  - - C:\Windows\SysWOW64\netsh.exe
      netsh interface tcp set global rss=enabled
      4⤵
      Event Triggered Execution: Netsh Helper DLL
      System Location Discovery: System Language Discovery
      PID:4092
- - C:\Program Files (x86)\LogMeIn Hamachi\x64\hamachi-2.exe
    "C:\Program Files (x86)\LogMeIn Hamachi\x64\hamachi-2.exe" --config Hamachi 25.0.0.1
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:1664
  - - C:\Program Files (x86)\LogMeIn Hamachi\x64\LMIGuardianSvc.exe
      "C:\Program Files (x86)\LogMeIn Hamachi\x64\LMIGuardianSvc.exe" /escort 1664 /CUSTOM Hamachi
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:2084
- - C:\Windows\SysWOW64\sc.exe
    sc config Hamachi2Svc depend= winmgmt
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2328
- - C:\Program Files (x86)\LogMeIn Hamachi\x64\LMIGuardianSvc.exe
    "C:\Program Files (x86)\LogMeIn Hamachi\x64\LMIGuardianSvc.exe" -Service
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Modifies registry class
    PID:1128
- - C:\Windows\SysWOW64\sc.exe
    sc config Hamachi2Svc depend= winmgmt
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2844

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
PID:3236

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall
1⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious use of WriteProcessMemory
PID:3708
- C:\Windows\system32\DrvInst.exe
  DrvInst.exe "4" "1" "c:\program files (x86)\logmein hamachi\x64\hamdrv.inf" "9" "42b53aaff" "0000000000000138" "WinSta0\Default" "0000000000000158" "208" "c:\program files (x86)\logmein hamachi\x64"
  2⤵
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Checks SCSI registry key(s)
  - Modifies data under HKEY_USERS
  PID:3228
- C:\Windows\system32\DrvInst.exe
  DrvInst.exe "2" "211" "ROOT\NET\0000" "C:\Windows\INF\oem3.inf" "oem3.inf:db04a16c4ff220c2:Hamachi.ndi:15.28.40.464:hamachi," "42b53aaff" "0000000000000138"
  2⤵
  - Drops file in Drivers directory
  - Drops file in Windows directory
  PID:4412

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s Netman
1⤵
- Modifies data under HKEY_USERS
PID:1524

C:\Program Files (x86)\LogMeIn Hamachi\x64\hamachi-2.exe
"C:\Program Files (x86)\LogMeIn Hamachi\x64\hamachi-2.exe" -s --get-config
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1376
- C:\Program Files (x86)\LogMeIn Hamachi\x64\LMIGuardianSvc.exe
  "C:\Program Files (x86)\LogMeIn Hamachi\x64\LMIGuardianSvc.exe" /escort 1376 /CUSTOM Hamachi
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:3156

C:\Program Files (x86)\LogMeIn Hamachi\x64\LMIGuardianSvc.exe
"C:\Program Files (x86)\LogMeIn Hamachi\x64\LMIGuardianSvc.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1664

C:\Program Files (x86)\LogMeIn Hamachi\x64\hamachi-2.exe
"C:\Program Files (x86)\LogMeIn Hamachi\x64\hamachi-2.exe" -s
1⤵
- Drops file in Windows directory
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3184
- C:\Program Files (x86)\LogMeIn Hamachi\x64\LMIGuardianSvc.exe
  "C:\Program Files (x86)\LogMeIn Hamachi\x64\LMIGuardianSvc.exe" /escort 3184 /CUSTOM Hamachi
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:1532
- C:\Windows\system32\netsh.exe
  netsh interface ipv4 set subinterface "Hamachi" mtu=1404 store=persistent
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:636

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Installer Packages

T1546.016

Netsh Helper DLL

T1546.007

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Installer Packages

T1546.016

Netsh Helper DLL

T1546.007

Defense Evasion

Modify Registry

T1112

System Binary Proxy Execution

T1218

Msiexec

T1218.007

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\e585782.rbs

Filesize
23KB

MD5
5738edb6758df14d56b35d4f6a1e6f4d

SHA1
dd870b82cc26adc71ad811e746dc5e3174c9bb06

SHA256
c23523a4ce0b3ab89b5ae7a4c73a9c56e9408d2979aad73c266a999cd56e94f0

SHA512
4b61b1dcd7a67ed85cb5561a49fd88df8daffa535aaf5eb83bed78407ae8667380a2aa102335d5118c01d5dfb7cc117e19da32709897cc2fe3db829aed172ecc

Download Submit
C:\Program Files (x86)\LogMeIn Hamachi\x64\LMIGuardianDll.dll

Filesize
2.0MB

MD5
df7051274b6080da5298c61decad2fdf

SHA1
33168489e0704cba116af5417f66f99e5c184abe

SHA256
bfec06ad20dddb565fea958c273dea14cd510f24be57e8f56d35168632a81875

SHA512
506ca6cef3bd7fd8f56e934c97d4e791e330fff492d89575ce40f0123fbffaf3010f9637af3fed997bc0d642b3027d767bd93efe6c37a06b40ba0dc354a994b6

Download Submit
C:\Program Files (x86)\LogMeIn Hamachi\x64\LMIGuardianSvc.exe

Filesize
409KB

MD5
0554f3b69d39d175dd110d765c11347a

SHA1
131bc6ca3960476e16fbaad091d26e92f2093437

SHA256
a57d5ce0cba04806eb0c6d8943d85c5ab63119a99fa8f8000bdf54cccd1c1bf9

SHA512
0ebbcec7337387cb7b59a86f80269925f369112d3a9cd817fc9de5d7c978a52665ad3bd6967a8f2b36765974f808e51d8dd59fd1e80149fd5a5de4d987833f06

Download Submit
C:\Program Files (x86)\LogMeIn Hamachi\x64\hamachi-2.exe

Filesize
4.7MB

MD5
493510f5eb2c49efea54e58a83677e13

SHA1
14ec94b796cd426c001840421c4ce43750cefd2a

SHA256
199febb05fff1cca01f7f7672be99d9d0ee73b0371bd63513635dde133f3e2cc

SHA512
85b92ca63797ae5303557dc1d6771acb4bc09ddd2f3391614a3f40b2a3604b6c63566b44beb8c65da3436edad44c90b401f8b220f5fb921f287970e50438fe87

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB

Filesize
471B

MD5
05e09672f1501e375a96b88dda7b6b48

SHA1
f1dfb5fb92579d5c284a40753c559cfc42ee0e86

SHA256
c182560cb22ce28d66ca0eb1aec81b5faba7e63d18a7e628adf6188454e17d92

SHA512
a618db8bebc9f647884f7a367b588cb147e79bec6c0c107c5b6901bc6c0644956e69420f8a75e57c1d80ca45175508faf7efe365fa416f78aa8c2793f3726f49

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_325DC716E4289E0AE281439314ED4BFA

Filesize
727B

MD5
6be649a8fffef54e5e4691678352cc20

SHA1
94d3606949747e79fc948b1e2d13c578083a20ba

SHA256
fe1a4e470281414cb298a98baa81745e2ee1908b5060d4918b0c66bf4dcdcf11

SHA512
3b1867f2f1524143538392ebfdbda183b67ed35c5b2d6779325e9ae5028b7f4ca78d76bfbe03bdb070e98cd1d24a503863a9fac5db7137f67478c998afb50a09

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141

Filesize
727B

MD5
3468cf54113d2a5a5c0523352c196c6d

SHA1
f9630b1f9d9b75e06be51d2be05560e776767a2f

SHA256
3e61fc0bec02f7c57ab683f5d2fb1acf951f379e947a8b2a27c389070cfdb063

SHA512
4534a82bb8b3cff2a3dc0846e2426e8f89fdddddac10eedf5e3b28acf1c4403f5aa4c0c557a7c0ae33c49536a0b67178e8e2e004719d7812650d19046757a6db

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB

Filesize
400B

MD5
9d37117a1186ade29b9283c57a405b03

SHA1
fc0d358260ba74c3da18cdc33175510a6a222174

SHA256
540047263b55b5249d88f925cda3f9b640fc492244e622e39bd3e252a2d786b8

SHA512
d699e6699e27aa95184580d9ad872b73c54581224db1c44ee49c7fef2a2f0e8a260ce294d087c8eebef6ccfa1bc51d59241ab160b6247099f28098c453781ca8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_325DC716E4289E0AE281439314ED4BFA

Filesize
408B

MD5
297d61cdc8a2f7855fbbd983894a0585

SHA1
78cef8b53fea22c9a16760945eb554f0189b8373

SHA256
aef88d954141e5db00291fbeb16027ad294bdf6c52d5e21887a8ac8f17ef5c37

SHA512
006eac3264a177c2b4d688768c5f60e3fe4f9e5c85fafd2c9ef43668d1b703feffadf183b33f75f67267422be743cfcfd11f6d50bbf26b297119f6e11584c8e0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141

Filesize
412B

MD5
03eb180e754d6d117b9cd158b2f6dc20

SHA1
ae853da2bb73719cfab606f4fd3a331ee0727e73

SHA256
e6cf6742c5398da4eacd878522702e7997c82eb85e821b317d85f3fb87edfb27

SHA512
5dff443cd36327b989357e4898b0b4a208c8f166d9cf1a58e8d20669920fd258e6bda00f1d2bb4e1cf5f245b29b611f76502a99bd639cf9572b3f03380f37103

Download Submit
C:\Users\Admin\AppData\Local\LogMeIn Hamachi\h2-ui-peers.ini

Filesize
4B

MD5
f1d3ff8443297732862df21dc4e57262

SHA1
9069ca78e7450a285173431b3e52c5c25299e473

SHA256
df3f619804a92fdb4057192dc43dd748ea778adc52bc498ce80524c014b81119

SHA512
ec2d57691d9b2d40182ac565032054b7d784ba96b18bcb5be0bb4e70e3fb041eff582c8af66ee50256539f2181d7f9e53627c0189da7e75a4d5ef10ea93b20b3

Download Submit
C:\Users\Admin\AppData\Local\LogMeIn Hamachi\h2-ui.ini

Filesize
265B

MD5
46c4c35c0773f111440150e1a1606b4c

SHA1
ebe48bc62f325f383a37f34534ed9b979f8f78fd

SHA256
e8a62e41dc1eae52371c277d9d1488bc72707176a297182222af93eebd8d31a1

SHA512
312924a63842bcc912a270b926b606bc692b326e76bd4c1a8150e853ec1a61d747526f65cf2ba21a51f9c57d07aeeaca56a439c9d0a832eaa6eb7d8228629d9f

Download Submit
C:\Users\Admin\AppData\Local\LogMeIn Hamachi\h2-ui.log

Filesize
723B

MD5
7d7fa6591a806cd9c01d12b71680d419

SHA1
5a6ee19fbb4a82111007123a52e4decdf94c2b84

SHA256
4052f5ad63300d4966bd072261e44029e7be00ae2dbbece3ff5a7e69b32805d6

SHA512
a1d671be007b4213b2ebf6a15388ca604269cbb35f47420332d5271891f334c1d4f435759ef343296d71aad909b0c9fcb6d5d68928a22937a2380036beee6ebc

Download Submit
C:\Users\Admin\AppData\Local\LogMeIn Hamachi\h2-ui.log

Filesize
881B

MD5
2bbab1c5138d1c5e7d05a9471ac7546c

SHA1
68007ada55e1f5a1be8141bdbc86d1cf0decd115

SHA256
46da3e1af5ddcd3faa693d935f9dafdc5a2ff306a9fb7e83cde1d43752dc3807

SHA512
e6ca838ae667eb8363081c4aaa6191f38fe757f1003578a215d87c3bdc4a1899d92f7e19d1801886816e3e14155100ee631385bd3dc79f1ce02381f768059aba

Download Submit
C:\Users\Admin\AppData\Local\Temp\HamachiSetup.log

Filesize
1KB

MD5
37bb70ed3b81d6e864f648d5a78f4a1a

SHA1
1e4ea05954170a7daa35d098232fbd007173bd7d

SHA256
d17cc6458ac2b35334b42cca80c89e4107a0a796f87f5e05885eac8b42c279e7

SHA512
f198d42ab83fd3c570d9ded4417aee8b4b5e7c193020703494ad040c2ce301e6892e8c1f85ecd7d59d65e78f07b7d336d6bde5c0c3bc5aa990d90e64a51ab2ed

Download Submit
C:\Users\Admin\AppData\Local\Temp\HamachiSetup.log

Filesize
2KB

MD5
22e5b8f9cc20c3a73ef825b7b4b18066

SHA1
14b2aa4ce75230cc154d995971d2a0e90695d030

SHA256
baf83327b24429ed3ae3f8d9aea980fe86a56b10e934ffc814997adeb456e039

SHA512
cf1256347b64076158458f0c784e9d97e6c7fff26785f9621cd4f2c92f0b9676a13c88df0ed20d8655fcc89531300d656b1eaecfaf61ffd3ed0717f85755d5be

Download Submit
C:\Users\Admin\AppData\Local\Temp\HamachiSetup.log

Filesize
2KB

MD5
615ef45ec2680d4e9fc1ce9e2b0a7043

SHA1
d964bfa4373e974860828bb184ccefa2813f8c2d

SHA256
7f40595ceab76fca64b65cac57a0e5b6acdf45a5df310b022ee44965da54ca82

SHA512
49fbf77e32d84a4df580d7fd14a82de58bf33764681f7547e18cb5d09be03b9a387a05806de3c89af79409752dbf9bdd5f218a899d3fbbbb86bb6d50207a1ae6

Download Submit
C:\Users\Admin\AppData\Local\Temp\HamachiSetup.log

Filesize
3KB

MD5
378c7f6980b137507ff4f3cf421d3bcc

SHA1
80bfb436bcb4d4121d05cd20a50ba46ae5e66398

SHA256
0ead5920c4151f5164ff1fc79582c6c396217ce8cbe0c991418a6a193216ee8a

SHA512
4948d6c0f336b5f7f30fee17ad46949e58b0f696149b0fa56f44a38509cfdcc957292559881a868829f543614be9fd4bd7076e6a44f08bd8e89c9a104e9d6db6

Download Submit
C:\Users\Admin\AppData\Local\Temp\HamachiSetup.log

Filesize
387B

MD5
591d71b2fd2047a9a5ab23d912a9d242

SHA1
f341a5a026efa11adcc282ef454c6f0bbdbfd415

SHA256
cdc018db6296e71ab34d66b02a4d9551ebcb8dfb0e35f4203eb854274c053cde

SHA512
ba4e6547d7d81c8c0982d05e7ba9705a74e12d7b21651ad24f7b3b8ea91b67ac493a1236d31f60dcbd02d15f76f41bd44d71aa468a91d9a2eec18ea05d658773

Download Submit
C:\Users\Admin\AppData\Local\Temp\HamachiSetup.log

Filesize
3KB

MD5
49febaa0bbdec2430ff0ceb569948937

SHA1
4ac908bd6f99ad79ac9ebeb9b008acedb58bd38e

SHA256
c4d7cd31e1b9c0976b2ac701d61532787f6f3c7098ccda00268341a92e819ba2

SHA512
53e54f4b96fa0ca37e198251df2bd8dc024fd0d429e020f1feb4052d39e0d7b8e765794c3ab133f20475df9f1378a88a4800f646653ec8fe8ca88af03544822c

Download Submit
C:\Users\Admin\AppData\Local\Temp\HamachiSetup.log

Filesize
3KB

MD5
dadb2abd6a8e39ccbbcbb3ec8202758d

SHA1
1658c5afe10aeccdfc5ee38380ff4feecfbaaa92

SHA256
78a90ade37b88a7c24412ea2c5b8f004db4600af83687fc59fd8628797151227

SHA512
7904cde5945f5656811303d5693d949bcc81aa52ff6fa84c72279321077ff5f0a58aff321160dd2b20813a1fa72d58f3882eb4463e5978af9ada155599ec95b2

Download Submit
C:\Users\Admin\AppData\Local\Temp\HamachiSetup.log

Filesize
3KB

MD5
8f2ca50fce820cff3d2de8c288e083dd

SHA1
5cbd62dbdb58aa1cb678fac34f09008d7f9f72c6

SHA256
bb0019e26e34d8ead08b16b118a323414e261ecd4fcebc8327f5bd44be092f21

SHA512
82822afa13ca0a880f6610cc25ae513269e851a93be2fd11e99b42c18044eb707d7d5dcc4a47c28b32aa4c754e71966340df98c35e8d151d1d028b8872a61d7b

Download Submit
C:\Users\Admin\AppData\Local\Temp\HamachiSetup.log

Filesize
4KB

MD5
187ca63e00f0427510fe0ca0b1f1d482

SHA1
4bb5d9e69942dde730f76a094f9a68a767b9dad8

SHA256
ded0482df4310ce6745af83edb2169a70af504252162547657d8e1221467fd0a

SHA512
5b35fa3a36aad689434f9bda37697dcb705c7e750fb6668b0a5873f1e95f73c6f5f8d81a41a4a04a07dae66f5bf9b28cec0d091133ccfb0b04d3e051a1dfa7ea

Download Submit
C:\Users\Admin\AppData\Local\Temp\HamachiSetup.log

Filesize
584B

MD5
b532e9f5c3c74050f2def36d0aa04eaf

SHA1
4696fd09a161245ab0dca03a44ec61a264ea0277

SHA256
170770e14d4d7337e050a33fb84fc176a9ca1886b16fe59e9a3d5da6f80d18ec

SHA512
854027a20f0b174b11e4326b4559af2b2880707b03c787e7a0950e63529910424f39c49e1a6041a4424405ce6fe347676141e17cf4a2ca2ce2a56ccc18575307

Download Submit
C:\Users\Admin\AppData\Local\Temp\HamachiSetup.log

Filesize
7KB

MD5
e17beb3efb5e9dbfcb56e0025732c776

SHA1
14f3d88f9f35579d64bfb86da967e1be83126766

SHA256
e3ab7d937fe266ba576ccdf2536a82b6282a64adc7d7417e3d4573add292d1a2

SHA512
b058d7c3eb6511ad394c7c79cdd0ad7548d308b5bbd8d9fed38fb495e9faa3538be97bb0106ed148d11b784927eadd781164747a03206d487812e48fc3c3a3ce

Download Submit
C:\Users\Admin\AppData\Local\Temp\HamachiSetup.log

Filesize
7KB

MD5
3c291249aa528d585de2a30834e16984

SHA1
4111e9aa730f27094593c2c88950f8677cdbe620

SHA256
c4e109e893b0de87438a333c1476eace02229b8ccbc6a9ce52a98ded6cba9ac0

SHA512
58b0de69f9ffbbccbaba03ba8bf2293ada464b0a1885eca1af665e4bd2e7342acdaa946bc40bcecb6871d1bd34df5e44048e3608b55e1ccd9574f1614a1a22cf

Download Submit
C:\Users\Admin\AppData\Local\Temp\HamachiSetup.log

Filesize
8KB

MD5
0f742809e3cdec311392800ebd14abed

SHA1
fede9d17ae99f6f2244d14dff8a0a0aeada38cf6

SHA256
15f29947bf6bc2503683252e90eee2c2fa836d6e4575434b6d2e9974b92a1f16

SHA512
936d2f7c672f89c0dc0b545504baf49597f9132e88f6ad60468fd37d123161c2c72c3bad3b58b1ba06ea25bbb7b2e963a5de16a33e3885bc12549e51ecbbe856

Download Submit
C:\Users\Admin\AppData\Local\Temp\HamachiSetup.log

Filesize
1KB

MD5
81dc214d3751e209015ec7df85c9243a

SHA1
1bf2d650cee6638bb11df94ef277c90d1ec8988a

SHA256
59c7c4e50f17cb214c89aa1ab5249dfacad59e28cff9d7e6869c5ba36337d3c4

SHA512
f8ccff4a27ac2744e59fdf2e0e82f2a686df85643dd2899985e7246d35c7e7388d88cd2da257459974b9192a24a1f4dc09f8109914721a1e531c327e1a345db2

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSIA4DB.tmp

Filesize
2.3MB

MD5
3bc82080d6356dae779eed5135fabf66

SHA1
022c84f9cc59ec45315d78979497cd061658aba3

SHA256
b076c9b888b130fb2fb5a74542c9a73322e78ed1f3f8476be7a8209a20e56f7b

SHA512
041cd3945a22dcec792f45abc7f95b9fb7e68254948f0bfeb49de6b3501a0e13525454aa222dc4b903b3c9bafd4e0ffc2e5a99bd140238e845d3fcb7c496afbd

Download Submit
C:\Windows\Installer\e585781.msi

Filesize
13.7MB

MD5
909db4061c32f798e94d746717782444

SHA1
10f5ffff17d2dd4476686a941a7bcc5f9b83b1b8

SHA256
6ee98db32852a2ff31a969d918bb7c730950bb15f24ea1baf996697cebc8b9fa

SHA512
44e7f97b27aef2e4cb62a6a0ebab5033b99e1ec940f231eda416f3b68d83df81d10950a8ced2ca528024adecd1dea7e1d4427e78b111edbc0124d7ffd6c1232d

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\LogMeIn Hamachi\h2-engine.cfg.bak

Filesize
1KB

MD5
5919a4242a1fb169c68317d18adf2746

SHA1
4bc5e0bbba80f43fc5bda2d45eacab772fe8a302

SHA256
7e5adb2f62eb88481057a6e469ed552b15beea681c3cc4ab37c96b458d1969ba

SHA512
e2b7cdd9831e3e07887b9fce9b940845158be0c0e632705f318d12d21d785af7ec6e7c45cbd5675a024188bb7fcbb0adc28f317767aadb7ae4fb3d9f0c29ce48

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\LogMeIn Hamachi\h2-engine.ini

Filesize
474B

MD5
ade722a4487730c4a812aed9306d4a45

SHA1
903db592b3a64c6cdc9a12b8d17cb4b06e0467ed

SHA256
a6befb399f691e7cd07e2ffbf1e7573f4e0ca61a0d0e591b0c3af7a98c91e4e1

SHA512
06d1bf2fa20143d52cdc0dae1932f0c99ed8e84b19896979481482ee59ab039142e3f33eeccf53202320d2543b09e1bda56f67fb7f381298a62a40a084042cd8

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\LogMeIn Hamachi\h2-engine.ini

Filesize
474B

MD5
8cffeec178a536a92777e0ca7c5babfe

SHA1
8f08c2a0ee50f611af322a7daba8766b78896a66

SHA256
f45bd458ecdf3c847e5b7a858becc7a5916cbbcd3cc7d5a355ea29813643aecc

SHA512
0ae8230497357ddf61de95cea0e3d2397838892f4558c00df98ddee16ce0775355c305d38be4193c21810c709913c2e82fd5669b27887c330fb21c928f0011b2

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\LogMeIn Hamachi\h2-engine.ini

Filesize
490B

MD5
b2b847daa1041b506567e63045c889fe

SHA1
a1c18cd13e3fd54e89325d9b34e8f83f94c216e3

SHA256
ac74363cec9ad3947ab954aa59c5c17b2ce7c1cf4a553bf308124277a8558ec4

SHA512
be20b602853443b799ebc4ee47c5bd34aec3466befc57d1bd3b65367919ad2b69109ffcad54d6d38dc663426811439088fc2a5ce37e0ba80ed6ec3a330bf3f58

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\LogMeIn Hamachi\h2-engine.ini

Filesize
474B

MD5
af32645d7d08e465889b33eeeb5d2143

SHA1
39207de571480be4607af29dce2f66cdc6783946

SHA256
19617643f90f5fe60d4fbd9a8bfaa0f1763105a6a8f44997a4e703d269581647

SHA512
a3a152e3a7431501d08db93d43a385c8d4ccdb748bf01d9f0d359170c3a51686fafb910e9c6aec82885bcee30aa8e1232afa9ab3558bdb0f209fb075eeb00cfa

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\LogMeIn Hamachi\h2-engine.ini.bak

Filesize
474B

MD5
d9e8188fff0a4d27bc91f128db8f9762

SHA1
5e57392a6eb4e8e867eb1952e797280e39690437

SHA256
39d29f5f710e53ad71f81414a5cda3a3e68d1e3634b8efbfe8bc2aa1f472f292

SHA512
4e255da2118c7e22784a9f431b822405faddfe99d8c96778944068cca668f9af4d20e0b20189d66af36761948958c6cfac66d2cfba25782218fe51c7d8f238be

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\LogMeIn Hamachi\h2-engine.ini.updating

Filesize
7B

MD5
0f81d52e06caaa4860887488d18271c7

SHA1
13a1891af75c642306a6b695377d16e4a91f0e1b

SHA256
27eb5e51506c911f6fc4bb345c0d9db6f60415fceab7c18e1e9b862637415777

SHA512
7ccef1661d9bae2a1a219de1d53fea0e2441354e4e4c3e111f75bf926fb12c5b0e6e7824200cf65dfa5686216b9e67436038bdc69c7ea7621f3c67b481510cd7

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\LogMeIn Hamachi\h2-engine.log

Filesize
359B

MD5
58aa79ba3bce2a4e7820e577bcca5ba3

SHA1
cea508a5779c35bc1c6d1e0f3f8a956c3eb27905

SHA256
6ed9492a4032b15c684a895d747b7a522a4b1e2837f4be327851af586962839d

SHA512
d9a0179905c64005e603ed5385eb964aa8fd59b3fac78429a7983ef9a3ffbf43a84cccb8fdd51eda24f31747e749564d6e1e85141e34019f92e93d9e215ca9ea

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\LogMeIn Hamachi\h2-engine.log

Filesize
1KB

MD5
be3f28c3976d34c06b3250960bac82ed

SHA1
ae2c6b0a29f876657e42c1e88321952e5fa3eac5

SHA256
42c2a2e43f18eb0f8dfb9a91d6e41e062939cc887cb71e99135480753440b5f0

SHA512
4c896974ceb3a5f7f072e0de499bcd1317ad19718ed57e3d24a873acfd356cc8b7bf22e4701499a2c663af64fe0461a80897559750689dc17d4bfcbccd4c0006

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\LogMeIn Hamachi\h2-engine.log

Filesize
2KB

MD5
88844fc005db34b619f6517dff8e409a

SHA1
dec27f98469cd33b48a717bb37ba34664cf7a038

SHA256
a007b4dd5795a3b80a353588aa5bede932a8f9b17add8bbcfc1b7b3fff233f76

SHA512
baaa8b6569592fce97f78081ccba7ed0a8d9a871db0b9a79c5d1c4f028c580d414ce32ae5917a61c27f802af154ef57431bd8f3084af397fb3d27a9021b0cc53

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\LogMeIn Hamachi\h2-engine.log

Filesize
3KB

MD5
af7d3973855654a9b41a005a0c2543b3

SHA1
c38eb85c9f838074040a858dabc28c468d635d20

SHA256
4fe90f57924a783434ebad1a17c5898c711b4de3168401ab6416fa927e3b9c13

SHA512
d2c6cdfb65f0692917742e0084f247f583b6d737c5d2fc9741171776bca0107853c9dd83b6d3675e7ab5569670f79b3001973dd197994e8aeba3f48bbacca736

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\LogMeIn Hamachi\h2-engine.log

Filesize
3KB

MD5
07f7a30dcbf4b1b4cf81f6b377cd36ef

SHA1
5efde6516f9410cf36e4393a991475e86f0b77af

SHA256
462c0c79d979352191387dd2aa87961b73193aeb6fb456b4c6d753038d7fcf03

SHA512
4179b2dfd072395c3d8432221bac95ff72df25d2f50e9310769d195a2c08e380bf77cfd60a028ed80bf3af47d1865b19818da78ed49aa85668d80d89065bec70

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\LogMeIn Hamachi\h2-engine.log

Filesize
3KB

MD5
a04ad59294059b782fdedc0f9b90e4a9

SHA1
672ae5fd4354b93b21861a782f080e8aa70a7b84

SHA256
044e54b6d9ab047fd1ff69e27a54a2d9af832ff91e334fead9699e807109b733

SHA512
19d558a33f2a61fad1434126d98031f312f01decd950a903c4c5389a3c1936124c32fb6cfc8f5bb61213c2331d7123f12c73afcd016be0a49a2cb902e8a08e65

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\LogMeIn Hamachi\h2-engine.log

Filesize
4KB

MD5
abf2290643de581d9133dae6b044c366

SHA1
0b405ea4888abd67793e2cd07685b6143c46bb88

SHA256
eaf3ea433378bba2ff35e98fe78b14125eace7526da066f3b23cb0a4dd4d67e5

SHA512
4aaa63cfca16e3531f28ac377d089bcaefe247e8b0dba68fa6f8194449861807c5d3e18656337f2e927a77a5dd70502eb2156cd10e4697f5aa9509865cdc5ac8

Download Submit
C:\Windows\Temp\HamachiSetup.log

Filesize
208B

MD5
11d5dd3035f69e016252ac4022490690

SHA1
725d393c7087a5e3405583172ea7110a3f584f90

SHA256
b064789558b270db4dd4a114875924dbc14471328949f4a2f34beb72a7c04986

SHA512
d018f72ef67dd11417eaae624600e1693b5e509d2c73fc23401ecc89fe019b75fedb4d36120e57c064c94436d23e62a9eea372bb110882a80833c531b5e22394

Download Submit
C:\Windows\Temp\HamachiSetup.log

Filesize
969B

MD5
193cfa4aa415db76de057b02f2317b7b

SHA1
ee3efbad5377028260dcc1b4582d545f08551ce9

SHA256
d71e5a601482b5050da66f79fbd0cd29b94a17050b7523ba9ed434ece276b837

SHA512
4f0db25d0d6dcd3613ec36813c41cf301b283801e08df31aadf726a8012da170621ff36f7d96eb8fd6db2006a01a4296e0f5937e2b0ce3e6ba5db82aeb509aae

Download Submit
C:\Windows\Temp\HamachiSetup.log

Filesize
1KB

MD5
abce7cded7b6a0d76e80bbb8da0e115f

SHA1
b5d177d267ed5c4ab4dffd43202c63979e34e153

SHA256
0fbd2510802fe25b79ad28599771d6b1bf2d66e9ded02e8d42cb61904c412780

SHA512
41ef48dbb9156602457424be10585170afd16bac82d47119ac3ae3a3cf60d0040a4cf93449eebd504e93cc7b21c2d0d4019ddfff887e9d66a521f31ebe43bd96

Download Submit
\??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2

Filesize
23.7MB

MD5
72a8b96100e4b4a207119ff265a044d0

SHA1
4ef8de3ec251b4d336eb6a8a78fd6edadf1e9f89

SHA256
d56eec28b37e2662ae10241110439a6bb59b504332af56810850c15b4d41de04

SHA512
997fea9a3c8378abfeb3fb0839ead4c681aa19bf18edbb294dd39c1c1cb515dd6a3271e11bce2f28a0056db3a36cb3136b0b5e5e58cd098e6d862aef2fd3a0a4

Download Submit
\??\Volume{f171a6e7-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{a6d68593-5987-4aa2-a89c-e64938f61176}_OnDiskSnapshotProp

Filesize
6KB

MD5
89c1bb2cf999da4b3b3dc33cb6f9a46a

SHA1
f94677ba265fb6ed2b554dcb85881ce22f2c275d

SHA256
6fe054d5d20304ba24caff12a8ceccb61162958709d130b09f8c36fd4965d858

SHA512
73e51d3902df5972f8a0aeae8d180ef4314cf578b37366b04003ee4e27558cb62ef82cb62410018a625a60934378a379c3c846c9a407018d9928b3aeafb5a681

Download Submit
\??\c:\PROGRA~2\LOGMEI~1\x64\Hamdrv.sys

Filesize
44KB

MD5
7f79205b4efa98f0767309479c8c01c6

SHA1
9d546dda7536a85a3f4228e065967be1648ad901

SHA256
4b576903a83f33a8cf31d3887144a3d51c56d1187115c83ac99c0e9f6b4bf128

SHA512
418ac89f3c5996de50c846693995145e314d0cd7edee59f0cdc212720d84be1351827c7ab02e870d1940288f5c4838d39c77fbc9847b69ab5fce5d74400c19ca

Download Submit
\??\c:\program files (x86)\logmein hamachi\x64\hamdrv.cat

Filesize
10KB

MD5
f49c69fcca067884f38e9cab20ba8920

SHA1
bbe2113cfeb8b9a2234d97849c05c4a72b368a7d

SHA256
e436ceef0126e703fe48bd669e3748e468b6f8027a8b6c2ae779f2911e65331c

SHA512
e233dc261ea650d0cc01834591ba5c7e113daa23da7ada913c589ddff13c7d5b946da5f3f649e81de9afa664d0c4bf5b6fc921e359c252dee5132c8f584c60d3

Download Submit
\??\c:\program files (x86)\logmein hamachi\x64\hamdrv.inf

Filesize
6KB

MD5
da79247b2ba817d655c2db44bdebff1c

SHA1
fb62be8194096675dace18cd1217217ec2f85777

SHA256
35e3427711eb7e0645d3f4ffbc3dd73b16e96ef1dc4c210db1f67229283f414a

SHA512
e124e5bce81d09713b959a54da96ca7679b9880e69952faef360c7f0311a6d85a97d377281edbae22e61f7e3204847fb4eafd64a15aa97079bf9cda2cf1f0328

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads