Analysis
- max time kernel
150s - max time network
152s - platform
windows10-2004_x64 - resource
win10v2004-20241007-en - resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system - submitted
09/12/2024, 17:50
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
33C2ADEBFE2C3ACEDFB34FFFF8151B7D.exe
Resource
win7-20240903-en
windows7-x64
26 signatures
150 seconds
Behavioral task
behavioral2
Sample
33C2ADEBFE2C3ACEDFB34FFFF8151B7D.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
30 signatures
150 seconds
General
- Target 33C2ADEBFE2C3ACEDFB34FFFF8151B7D.exe
- Size 72.2MB
- Sample241209-weld1a1jer
- SHA256 773e13fffd0842e717ce55e2a678da37123c55186f9c92460c671261b1654ffd
- MD5 33c2adebfe2c3acedfb34ffff8151b7d
- SHA1 8e93f7ecafa92017a7d528423574ab5cfeec754a
- SHA512 6f545b4da55412ec78de6d1c3bddbcc6bb857b7d13b15fe4bb832259dbe1842d44a02b46395233c23ca57abd34239226a60c9f7ee26fcf82ba383a836f8d61ad
- SSDEEP 1572864:yIWs/6+mI5n17YTIytz8ATFiQiFGaaoE13gIFxXtzM/zMfCOA6Z:ssJmIBiTvR8UFiQYGvoq35FVEeCOr
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Extracted
Family
-
quasar
Version
-
1.4.1
Botnet
-
Office04
C2
-
167.71.56.116:22269
Mutex
-
3470ac31-30aa-4cf6-ab0a-1ed0dd64656f
Attributes
-
encryption_key
33E08519CDBEF59C54E93052681A76D1969C659E
-
install_name
Client.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
Quasar Client Startup
-
subdirectory
SubDir
Signatures
- Quasar family
- Quasar payload 2 IoCs
resource yara_rule behavioral2/files/0x0007000000023c9f-1335.dat family_quasar behavioral2/memory/2756-1343-0x0000000000010000-0x0000000000334000-memory.dmp family_quasar - Downloads MZ/PE file
- Event Triggered Execution: Image File Execution Options Injection 1 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MicrosoftEdgeUpdate.exe MicrosoftEdgeUpdate.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MicrosoftEdgeUpdate.exe\DisableExceptionChainValidation = "0" MicrosoftEdgeUpdate.exe - ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
resource yara_rule behavioral2/files/0x0007000000023cc2-1668.dat acprotect - Checks computer location settings 2 TTPs 3 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation 33C2ADEBFE2C3ACEDFB34FFFF8151B7D.exe Key value queried \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation setup.exe - Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
- Executes dropped EXE 20 IoCs
pid Process 2756 Client-built.exe 4076 TeamViewer_Setup_x64.exe 1128 TeamViewer_.exe 1920 TeamViewer_Service.exe 3560 tv_x64.exe 4380 tv_x64.exe 3336 MicrosoftEdgeWebview2Setup.exe 4544 MicrosoftEdgeUpdate.exe 1944 MicrosoftEdgeUpdate.exe 5112 MicrosoftEdgeUpdate.exe 3748 MicrosoftEdgeUpdateComRegisterShell64.exe 3236 MicrosoftEdgeUpdateComRegisterShell64.exe 212 MicrosoftEdgeUpdateComRegisterShell64.exe 1216 MicrosoftEdgeUpdate.exe 3284 MicrosoftEdgeUpdate.exe 4472 MicrosoftEdgeUpdate.exe 4516 MicrosoftEdgeUpdate.exe 4828 MicrosoftEdge_X64_131.0.2903.86.exe 736 setup.exe 4940 setup.exe - Loads dropped DLL 64 IoCs
pid Process 4076 TeamViewer_Setup_x64.exe 1128 TeamViewer_.exe 1128 TeamViewer_.exe 1128 TeamViewer_.exe 1128 TeamViewer_.exe 1128 TeamViewer_.exe 1128 TeamViewer_.exe 1128 TeamViewer_.exe 1128 TeamViewer_.exe 1128 TeamViewer_.exe 1128 TeamViewer_.exe 1128 TeamViewer_.exe 1128 TeamViewer_.exe 1128 TeamViewer_.exe 1128 TeamViewer_.exe 1128 TeamViewer_.exe 1128 TeamViewer_.exe 1128 TeamViewer_.exe 1128 TeamViewer_.exe 1128 TeamViewer_.exe 1128 TeamViewer_.exe 1128 TeamViewer_.exe 1128 TeamViewer_.exe 1128 TeamViewer_.exe 1128 TeamViewer_.exe 1128 TeamViewer_.exe 1128 TeamViewer_.exe 1128 TeamViewer_.exe 1128 TeamViewer_.exe 1128 TeamViewer_.exe 1128 TeamViewer_.exe 1128 TeamViewer_.exe 1128 TeamViewer_.exe 1128 TeamViewer_.exe 1128 TeamViewer_.exe 1128 TeamViewer_.exe 1128 TeamViewer_.exe 1128 TeamViewer_.exe 1128 TeamViewer_.exe 1128 TeamViewer_.exe 1128 TeamViewer_.exe 1128 TeamViewer_.exe 1128 TeamViewer_.exe 1128 TeamViewer_.exe 1128 TeamViewer_.exe 1128 TeamViewer_.exe 1128 TeamViewer_.exe 1128 TeamViewer_.exe 1128 TeamViewer_.exe 1128 TeamViewer_.exe 1128 TeamViewer_.exe 1128 TeamViewer_.exe 1128 TeamViewer_.exe 1128 TeamViewer_.exe 1128 TeamViewer_.exe 1128 TeamViewer_.exe 1128 TeamViewer_.exe 1128 TeamViewer_.exe 1128 TeamViewer_.exe 1128 TeamViewer_.exe 1128 TeamViewer_.exe 1128 TeamViewer_.exe 1128 TeamViewer_.exe 1128 TeamViewer_.exe - Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Drops desktop.ini file(s) 2 IoCs
description ioc Process File created C:\Windows\assembly\Desktop.ini 33C2ADEBFE2C3ACEDFB34FFFF8151B7D.exe File opened for modification C:\Windows\assembly\Desktop.ini 33C2ADEBFE2C3ACEDFB34FFFF8151B7D.exe - Checks system information in the registry 2 TTPs 8 IoCs
System information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer MicrosoftEdgeUpdate.exe - Drops file in System32 directory 15 IoCs
description ioc Process File created C:\Windows\System32\DriverStore\Temp\{e15b52fd-b867-0945-aa6f-a1adcbd4a3be}\SET5F81.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\tvvirtualmonitordriver.inf_amd64_b8a4eb13af8975aa\TVVirtualMonitorDriver.cat DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{e15b52fd-b867-0945-aa6f-a1adcbd4a3be}\SET5F71.tmp DrvInst.exe File created C:\Windows\System32\DriverStore\Temp\{e15b52fd-b867-0945-aa6f-a1adcbd4a3be}\SET5F71.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{e15b52fd-b867-0945-aa6f-a1adcbd4a3be}\SET5F82.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{e15b52fd-b867-0945-aa6f-a1adcbd4a3be}\SET5F81.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{e15b52fd-b867-0945-aa6f-a1adcbd4a3be}\TVVirtualMonitorDriver.dll DrvInst.exe File created C:\Windows\System32\DriverStore\Temp\{e15b52fd-b867-0945-aa6f-a1adcbd4a3be}\SET5F82.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{e15b52fd-b867-0945-aa6f-a1adcbd4a3be}\TVVirtualMonitorDriver.inf DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{e15b52fd-b867-0945-aa6f-a1adcbd4a3be} DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{e15b52fd-b867-0945-aa6f-a1adcbd4a3be}\TVVirtualMonitorDriver.cat DrvInst.exe File created C:\Windows\System32\DriverStore\drvstore.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\tvvirtualmonitordriver.inf_amd64_b8a4eb13af8975aa\TVVirtualMonitorDriver.dll DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\tvvirtualmonitordriver.inf_amd64_b8a4eb13af8975aa\TVVirtualMonitorDriver.inf DrvInst.exe File opened for modification C:\Windows\System32\CatRoot2\dberr.txt DrvInst.exe -
resource yara_rule behavioral2/memory/1128-1670-0x0000000075220000-0x000000007522A000-memory.dmp upx behavioral2/files/0x0007000000023cc2-1668.dat upx behavioral2/memory/1128-1750-0x0000000075220000-0x000000007522A000-memory.dmp upx - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\131.0.2903.86\Locales\en-US.pak setup.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\131.0.2903.86\Locales\lo.pak setup.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\131.0.2903.86\Locales\mr.pak setup.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\131.0.2903.86\Locales\ta.pak setup.exe File created C:\Program Files\TeamViewer\RollbackTemp\TeamViewer_.exe TeamViewer_.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\131.0.2903.86\Locales\kok.pak setup.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\131.0.2903.86\Locales\pa.pak setup.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\131.0.2903.86\Locales\vi.pak setup.exe File opened for modification C:\Program Files\TeamViewer\TeamViewer15_Hooks.log tv_x64.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\131.0.2903.86\Locales\hr.pak setup.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\131.0.2903.86\Locales\nn.pak setup.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\131.0.2903.86\Locales\it.pak setup.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\131.0.2903.86\Locales\bs.pak setup.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\131.0.2903.86\Locales\gu.pak setup.exe File created C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_tr.dll TeamViewer_.exe File created C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_uk.dll TeamViewer_.exe File created C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_vi.dll TeamViewer_.exe File created C:\Program Files (x86)\Microsoft\Temp\EU61B3.tmp\MicrosoftEdgeComRegisterShellARM64.exe MicrosoftEdgeWebview2Setup.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\131.0.2903.86\identity_helper.exe setup.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\131.0.2903.86\Installer\setup.exe setup.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\131.0.2903.86\Locales\ka.pak setup.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\131.0.2903.86\Locales\ga.pak setup.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\131.0.2903.86\Locales\kn.pak setup.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\131.0.2903.86\Locales\qu.pak setup.exe File created C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_he.dll TeamViewer_.exe File opened for modification C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_ko.dll TeamViewer_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\131.0.2903.86\Locales\ta.pak setup.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\131.0.2903.86\libEGL.dll setup.exe File created C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_ru.dll TeamViewer_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\131.0.2903.86\VisualElements\SmallLogo.png setup.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\131.0.2903.86\edge_feedback\mf_trace.wprp setup.exe File created C:\Program Files (x86)\Microsoft\Temp\EU61B3.tmp\msedgeupdateres_id.dll MicrosoftEdgeWebview2Setup.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\131.0.2903.86\msedge.dll setup.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\131.0.2903.86\Locales\es.pak setup.exe File created C:\Program Files\TeamViewer\TVExtractTemp\x64\TVVirtualMonitorDriver.dll TeamViewer_.exe File opened for modification C:\Program Files\TeamViewer\TVExtractTemp\Printer\ TeamViewer_.exe File created C:\Program Files (x86)\Microsoft\Temp\EU61B3.tmp\msedgeupdateres_am.dll MicrosoftEdgeWebview2Setup.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\131.0.2903.86\Locales\es.pak setup.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\131.0.2903.86\Locales\nn.pak setup.exe File created C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Desktop.exe TeamViewer_.exe File created C:\Program Files (x86)\Microsoft\Temp\EU61B3.tmp\msedgeupdateres_fil.dll MicrosoftEdgeWebview2Setup.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\131.0.2903.86\Locales\de.pak setup.exe File created C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_bg.dll TeamViewer_.exe File created C:\Program Files (x86)\Microsoft\Temp\EU61B3.tmp\msedgeupdateres_mi.dll MicrosoftEdgeWebview2Setup.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe MicrosoftEdgeUpdate.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\131.0.2903.86\Locales\ms.pak setup.exe File opened for modification C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Desktop.exe TeamViewer_.exe File created C:\Program Files\TeamViewer\TVExtractTemp\outlook\ManagedAggregator.dll TeamViewer_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\131.0.2903.86\Locales\ka.pak setup.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\131.0.2903.86\Locales\mt.pak setup.exe File opened for modification C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_no.dll TeamViewer_.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\131.0.2903.86\Locales\fi.pak setup.exe File opened for modification C:\Program Files\TeamViewer\TVExtractTemp\x64 TeamViewer_.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\131.0.2903.86\Locales\bg.pak setup.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\131.0.2903.86\Locales\kn.pak setup.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\131.0.2903.86\Locales\sr-Cyrl-BA.pak setup.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\131.0.2903.86\VisualElements\SmallLogoBeta.png setup.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\131.0.2903.86\Locales\sl.pak setup.exe File opened for modification C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Note.exe TeamViewer_.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\131.0.2903.86\Locales\qu.pak setup.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\131.0.2903.86\icudtl.dat setup.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\131.0.2903.86\mip_core.dll setup.exe File created C:\Program Files\TeamViewer\TVExtractTemp\CopyrightFULL.txt TeamViewer_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\131.0.2903.86\Trust Protection Lists\Mu\Analytics setup.exe - Drops file in Windows directory 9 IoCs
description ioc Process File opened for modification C:\Windows\assembly 33C2ADEBFE2C3ACEDFB34FFFF8151B7D.exe File opened for modification C:\Windows\INF\setupapi.dev.log tv_x64.exe File opened for modification C:\Windows\INF\setupapi.dev.log DrvInst.exe File opened for modification C:\Windows\inf\oem3.inf DrvInst.exe File created C:\Windows\inf\oem3.inf DrvInst.exe File created C:\Windows\assembly\Desktop.ini 33C2ADEBFE2C3ACEDFB34FFFF8151B7D.exe File opened for modification C:\Windows\assembly\Desktop.ini 33C2ADEBFE2C3ACEDFB34FFFF8151B7D.exe File opened for modification C:\Windows\INF\setupapi.dev.log tv_x64.exe File opened for modification C:\Windows\INF\setupapi.dev.log svchost.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 13 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MicrosoftEdgeUpdate.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MicrosoftEdgeUpdate.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MicrosoftEdgeUpdate.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MicrosoftEdgeUpdate.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MicrosoftEdgeUpdate.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 33C2ADEBFE2C3ACEDFB34FFFF8151B7D.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MicrosoftEdgeUpdate.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MicrosoftEdgeWebview2Setup.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MicrosoftEdgeUpdate.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TeamViewer_Setup_x64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TeamViewer_.exe - System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs
Adversaries may check for Internet connectivity on compromised systems.
pid Process 1216 MicrosoftEdgeUpdate.exe 4516 MicrosoftEdgeUpdate.exe - Checks SCSI registry key(s) 3 TTPs 42 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001 DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 tv_x64.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID tv_x64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Phantom DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID tv_x64.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs tv_x64.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID tv_x64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000 tv_x64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\CompatibleIDs DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001 tv_x64.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom tv_x64.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs tv_x64.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Phantom tv_x64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Phantom DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000 DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\CompatibleIDs DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom tv_x64.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\CompatibleIDs tv_x64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID tv_x64.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\CompatibleIDs tv_x64.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002 DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002 tv_x64.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Phantom tv_x64.exe - Modifies data under HKEY_USERS 64 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs MicrosoftEdgeUpdate.exe - Modifies registry class 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TeamViewerPilotSessionReporting TeamViewer_.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\tvcontrol1\shell\open\command TeamViewer_.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\tvvpn1 TeamViewer_.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{177CAE89-4AD6-42F4-A458-00EC3389E3FE}\NumMethods MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1B9063E4-3882-485E-8797-F28A0240782F}\NumMethods MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{1B9063E4-3882-485E-8797-F28A0240782F}\ProxyStubClsid32 MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C853632E-36CA-4999-B992-EC0D408CF5AB}\NumMethods\ = "10" MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3A49F783-1C7D-4D35-8F63-5C1C206B9B6E}\ = "IAppWeb" MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.OnDemandCOMClassMachineFallback\CurVer\ = "MicrosoftEdgeUpdate.OnDemandCOMClassMachineFallback.1.0" MicrosoftEdgeUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\tvsqsupport1 TeamViewer_.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\blizzv1\ = "URL:blizzv1 Protocol" TeamViewer_.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.PolicyStatusSvc.1.0\ = "Google Update Policy Status Class" MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{7584D24A-E056-4EB1-8E7B-632F2B0ADC69}\ProxyStubClsid32\ = "{BE43CF28-943E-4BA2-9B74-00CC57E7B1FC}" MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.Update3WebMachine\CLSID\ = "{492E1C30-A1A2-4695-87C8-7A8CAD6F936F}" MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.CoreMachineClass\CLSID\ = "{2E1DD7EF-C12D-4F8E-8AD8-CF8CC265BAD0}" MicrosoftEdgeUpdate.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E421557C-0628-43FB-BF2B-7C9F8A4D067C} MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\teamviewer10\URL Protocol = "\"\"" TeamViewer_.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\tvsqsupport1\shell\open TeamViewer_.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\teamviewerapi\shell\open\command\ = "\"C:\\Program Files\\TeamViewer\\TeamViewer.exe\" \"%1\"" TeamViewer_.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\MicrosoftEdgeUpdate.exe MicrosoftEdgeUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C06EE550-7248-488E-971E-B60C0AB3A6E4} MicrosoftEdgeUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{837E40DA-EB1B-440C-8623-0F14DF158DC0}\NumMethods MicrosoftEdgeUpdateComRegisterShell64.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{FF419FF9-90BE-4D9F-B410-A789F90E5A7C}\VERSIONINDEPENDENTPROGID MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FF419FF9-90BE-4D9F-B410-A789F90E5A7C}\ProgID\ = "MicrosoftEdgeUpdate.OnDemandCOMClassMachineFallback.1.0" MicrosoftEdgeUpdate.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{E421557C-0628-43FB-BF2B-7C9F8A4D067C}\LOCALSERVER32 MicrosoftEdgeUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9F3F5F5D-721A-4B19-9B5D-69F664C1A591}\VersionIndependentProgID MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{3A49F783-1C7D-4D35-8F63-5C1C206B9B6E}\ProxyStubClsid32\ = "{BE43CF28-943E-4BA2-9B74-00CC57E7B1FC}" MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{3E102DC6-1EDB-46A1-8488-61F71B35ED5F}\ProxyStubClsid32\ = "{BE43CF28-943E-4BA2-9B74-00CC57E7B1FC}" MicrosoftEdgeUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{195A2EB3-21EE-43CA-9F23-93C2C9934E2E} MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3A49F783-1C7D-4D35-8F63-5C1C206B9B6E} MicrosoftEdgeUpdateComRegisterShell64.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{FF419FF9-90BE-4D9F-B410-A789F90E5A7C}\LOCALSERVER32 MicrosoftEdgeUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TeamViewerConfiguration\shell\open\command TeamViewer_.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\tvjoinv8\shell\open\command TeamViewer_.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{9F3F5F5D-721A-4B19-9B5D-69F664C1A591}\VERSIONINDEPENDENTPROGID MicrosoftEdgeUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AB4F4A7E-977C-4E23-AD8F-626A491715DF}\ProxyStubClsid32 MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C853632E-36CA-4999-B992-EC0D408CF5AB}\ProxyStubClsid32 MicrosoftEdgeUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{FCE48F77-C677-4012-8A1A-54D2E2BC07BD}\NumMethods MicrosoftEdgeUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3A49F783-1C7D-4D35-8F63-5C1C206B9B6E}\NumMethods MicrosoftEdgeUpdateComRegisterShell64.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{BDAE441E-F0FD-4C2A-8BF7-1451FCDFAE16}\InprocHandler32 MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{08D832B9-D2FD-481F-98CF-904D00DF63CC}\LocalServer32 MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.CoreMachineClass\ = "Microsoft Edge Update Core Class" MicrosoftEdgeUpdate.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{2E1DD7EF-C12D-4F8E-8AD8-CF8CC265BAD0}\PROGID MicrosoftEdgeUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\tvvideocall1\shell\open\command TeamViewer_.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\tvsendfile1\shell\open\command\ = "\"C:\\Program Files\\TeamViewer\\TeamViewer.exe\" \"%1\"" TeamViewer_.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A5135E58-384F-4244-9A5F-30FA9259413C}\ProxyStubClsid32\ = "{BE43CF28-943E-4BA2-9B74-00CC57E7B1FC}" MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AB4F4A7E-977C-4E23-AD8F-626A491715DF}\ = "IAppBundle" MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A6556DFF-AB15-4DC3-A890-AB54120BEAEC}\ = "IProcessLauncher2" MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2EC826CB-5478-4533-9015-7580B3B5E03A}\ProxyStubClsid32 MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TeamViewerConfiguration\shell\open TeamViewer_.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\teamviewer10\shell\open TeamViewer_.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\tvoneweblogin\shell TeamViewer_.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface MicrosoftEdgeUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{9A6B447A-35E2-4F6B-A87B-5DEEBBFDAD17} MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{450CF5FF-95C4-4679-BECA-22680389ECB9}\ProxyStubClsid32\ = "{BE43CF28-943E-4BA2-9B74-00CC57E7B1FC}" MicrosoftEdgeUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7584D24A-E056-4EB1-8E7B-632F2B0ADC69}\NumMethods MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B5977F34-9264-4AC3-9B31-1224827FF6E8}\LocalizedString = "@C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.173.45\\msedgeupdate.dll,-3000" MicrosoftEdgeUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A6556DFF-AB15-4DC3-A890-AB54120BEAEC}\NumMethods MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.ProcessLauncher\CurVer\ = "MicrosoftEdgeUpdate.ProcessLauncher.1.0" MicrosoftEdgeUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5F6A18BB-6231-424B-8242-19E5BB94F8ED}\ProgID MicrosoftEdgeUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\tvsendfile1\shell\open\command TeamViewer_.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{79E0C401-B7BC-4DE5-8104-71350F3A9B67}\NumMethods MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7584D24A-E056-4EB1-8E7B-632F2B0ADC69}\ProxyStubClsid32 MicrosoftEdgeUpdateComRegisterShell64.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32 MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{77857D02-7A25-4B67-9266-3E122A8F39E4}\ = "Google Update Policy Status Class" MicrosoftEdgeUpdate.exe -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25 TeamViewer_Service.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 040000000100000010000000d474de575c39b2d39c8583c5c065498a0f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a8530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703086200000001000000200000007431e5f4c3c1ce4690774f0b61e05440883ba9a01ed00ba6abd7806ed3b118cf140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc30b00000001000000120000004400690067006900430065007200740000001d00000001000000100000008f76b981d528ad4770088245e2031b630300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc25190000000100000010000000ba4f3972e7aed9dccdc210db59da13c92000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a TeamViewer_Service.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 5c000000010000000400000000080000190000000100000010000000ba4f3972e7aed9dccdc210db59da13c90300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc251d00000001000000100000008f76b981d528ad4770088245e2031b630b0000000100000012000000440069006700690043006500720074000000140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc36200000001000000200000007431e5f4c3c1ce4690774f0b61e05440883ba9a01ed00ba6abd7806ed3b118cf090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a8040000000100000010000000d474de575c39b2d39c8583c5c065498a2000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a TeamViewer_Service.exe - Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2212 schtasks.exe - Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 1128 TeamViewer_.exe 1128 TeamViewer_.exe 1128 TeamViewer_.exe 1128 TeamViewer_.exe 1128 TeamViewer_.exe 1128 TeamViewer_.exe 1128 TeamViewer_.exe 1128 TeamViewer_.exe 4544 MicrosoftEdgeUpdate.exe 4544 MicrosoftEdgeUpdate.exe - Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeDebugPrivilege 696 33C2ADEBFE2C3ACEDFB34FFFF8151B7D.exe Token: SeDebugPrivilege 2756 Client-built.exe Token: SeRestorePrivilege 1128 TeamViewer_.exe Token: SeAuditPrivilege 4832 svchost.exe Token: SeSecurityPrivilege 4832 svchost.exe Token: SeDebugPrivilege 4544 MicrosoftEdgeUpdate.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2756 Client-built.exe - Suspicious use of SendNotifyMessage 1 IoCs
pid Process 2756 Client-built.exe - Suspicious use of WriteProcessMemory 49 IoCs
description pid Process procid_target PID 696 wrote to memory of 2756 696 33C2ADEBFE2C3ACEDFB34FFFF8151B7D.exe 82 PID 696 wrote to memory of 2756 696 33C2ADEBFE2C3ACEDFB34FFFF8151B7D.exe 82 PID 696 wrote to memory of 4076 696 33C2ADEBFE2C3ACEDFB34FFFF8151B7D.exe 83 PID 696 wrote to memory of 4076 696 33C2ADEBFE2C3ACEDFB34FFFF8151B7D.exe 83 PID 696 wrote to memory of 4076 696 33C2ADEBFE2C3ACEDFB34FFFF8151B7D.exe 83 PID 4076 wrote to memory of 1128 4076 TeamViewer_Setup_x64.exe 87 PID 4076 wrote to memory of 1128 4076 TeamViewer_Setup_x64.exe 87 PID 4076 wrote to memory of 1128 4076 TeamViewer_Setup_x64.exe 87 PID 1128 wrote to memory of 2212 1128 TeamViewer_.exe 92 PID 1128 wrote to memory of 2212 1128 TeamViewer_.exe 92 PID 1128 wrote to memory of 2212 1128 TeamViewer_.exe 92 PID 1128 wrote to memory of 1920 1128 TeamViewer_.exe 96 PID 1128 wrote to memory of 1920 1128 TeamViewer_.exe 96 PID 1128 wrote to memory of 3560 1128 TeamViewer_.exe 98 PID 1128 wrote to memory of 3560 1128 TeamViewer_.exe 98 PID 1128 wrote to memory of 4380 1128 TeamViewer_.exe 100 PID 1128 wrote to memory of 4380 1128 TeamViewer_.exe 100 PID 4832 wrote to memory of 4828 4832 svchost.exe 102 PID 4832 wrote to memory of 4828 4832 svchost.exe 102 PID 1128 wrote to memory of 3200 1128 TeamViewer_.exe 103 PID 1128 wrote to memory of 3200 1128 TeamViewer_.exe 103 PID 1128 wrote to memory of 3200 1128 TeamViewer_.exe 103 PID 1128 wrote to memory of 3336 1128 TeamViewer_.exe 105 PID 1128 wrote to memory of 3336 1128 TeamViewer_.exe 105 PID 1128 wrote to memory of 3336 1128 TeamViewer_.exe 105 PID 3336 wrote to memory of 4544 3336 MicrosoftEdgeWebview2Setup.exe 106 PID 3336 wrote to memory of 4544 3336 MicrosoftEdgeWebview2Setup.exe 106 PID 3336 wrote to memory of 4544 3336 MicrosoftEdgeWebview2Setup.exe 106 PID 4544 wrote to memory of 1944 4544 MicrosoftEdgeUpdate.exe 107 PID 4544 wrote to memory of 1944 4544 MicrosoftEdgeUpdate.exe 107 PID 4544 wrote to memory of 1944 4544 MicrosoftEdgeUpdate.exe 107 PID 4544 wrote to memory of 5112 4544 MicrosoftEdgeUpdate.exe 108 PID 4544 wrote to memory of 5112 4544 MicrosoftEdgeUpdate.exe 108 PID 4544 wrote to memory of 5112 4544 MicrosoftEdgeUpdate.exe 108 PID 4544 wrote to memory of 1216 4544 MicrosoftEdgeUpdate.exe 112 PID 4544 wrote to memory of 1216 4544 MicrosoftEdgeUpdate.exe 112 PID 4544 wrote to memory of 1216 4544 MicrosoftEdgeUpdate.exe 112 PID 4544 wrote to memory of 3284 4544 MicrosoftEdgeUpdate.exe 113 PID 4544 wrote to memory of 3284 4544 MicrosoftEdgeUpdate.exe 113 PID 4544 wrote to memory of 3284 4544 MicrosoftEdgeUpdate.exe 113 PID 4472 wrote to memory of 4516 4472 MicrosoftEdgeUpdate.exe 115 PID 4472 wrote to memory of 4516 4472 MicrosoftEdgeUpdate.exe 115 PID 4472 wrote to memory of 4516 4472 MicrosoftEdgeUpdate.exe 115 PID 4472 wrote to memory of 4828 4472 MicrosoftEdgeUpdate.exe 117 PID 4472 wrote to memory of 4828 4472 MicrosoftEdgeUpdate.exe 117 PID 4828 wrote to memory of 736 4828 MicrosoftEdge_X64_131.0.2903.86.exe 118 PID 4828 wrote to memory of 736 4828 MicrosoftEdge_X64_131.0.2903.86.exe 118 PID 736 wrote to memory of 4940 736 setup.exe 119 PID 736 wrote to memory of 4940 736 setup.exe 119
Processes
-
C:\Users\Admin\AppData\Local\Temp\33C2ADEBFE2C3ACEDFB34FFFF8151B7D.exe"C:\Users\Admin\AppData\Local\Temp\33C2ADEBFE2C3ACEDFB34FFFF8151B7D.exe"1⤵
- Checks computer location settings
- Drops desktop.ini file(s)
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:696 -
C:\Users\Admin\AppData\Local\Temp\Client-built.exe"C:\Users\Admin\AppData\Local\Temp\Client-built.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2756
-
-
C:\Users\Admin\AppData\Local\Temp\TeamViewer_Setup_x64.exe"C:\Users\Admin\AppData\Local\Temp\TeamViewer_Setup_x64.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4076 -
C:\Users\Admin\AppData\Local\Temp\nsdC70.tmp\nsdCBF\TeamViewer_.exe"C:\Users\Admin\AppData\Local\Temp\nsdC70.tmp\nsdCBF\TeamViewer_.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1128 -
C:\Windows\SysWOW64\schtasks.exeC:\Windows\system32\schtasks /Create /TN TVInstallRestore /TR "\"C:\Program Files\TeamViewer\RollbackTemp\TeamViewer_.exe\" /RESTORE" /RU SYSTEM /SC ONLOGON /F4⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:2212
-
-
C:\Program Files\TeamViewer\TeamViewer_Service.exe"C:\Program Files\TeamViewer\TeamViewer_Service.exe" -install4⤵
- Executes dropped EXE
- Modifies system certificate store
PID:1920
-
-
C:\Program Files\TeamViewer\tv_x64.exe"C:\Program Files\TeamViewer\tv_x64.exe" --action uninstallpnpdriver --inf "C:\Program Files\TeamViewer\x64\TVVirtualMonitorDriver.inf" --log "C:\Program Files\TeamViewer\TeamViewer15_Hooks.log"4⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3560
-
-
C:\Program Files\TeamViewer\tv_x64.exe"C:\Program Files\TeamViewer\tv_x64.exe" --action installpnpdriver --inf "C:\Program Files\TeamViewer\x64\TVVirtualMonitorDriver.inf" --log "C:\Program Files\TeamViewer\TeamViewer15_Hooks.log"4⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
PID:4380
-
-
C:\Windows\SysWOW64\schtasks.exeC:\Windows\system32\schtasks /Delete /TN TVInstallRestore /F4⤵
- System Location Discovery: System Language Discovery
PID:3200
-
-
C:\Program Files\TeamViewer\utils\MicrosoftEdgeWebview2Setup.exe"C:\Program Files\TeamViewer\utils\MicrosoftEdgeWebview2Setup.exe" /install4⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3336 -
C:\Program Files (x86)\Microsoft\Temp\EU61B3.tmp\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\Temp\EU61B3.tmp\MicrosoftEdgeUpdate.exe" /install "appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}&appname=Microsoft%20Edge%20Webview2%20Runtime&needsadmin=prefers"5⤵
- Event Triggered Execution: Image File Execution Options Injection
- Checks computer location settings
- Executes dropped EXE
- Checks system information in the registry
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4544 -
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regsvc6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:1944
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regserver6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:5112 -
C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.173.45\MicrosoftEdgeUpdateComRegisterShell64.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.173.45\MicrosoftEdgeUpdateComRegisterShell64.exe"7⤵
- Executes dropped EXE
- Modifies registry class
PID:3748
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.173.45\MicrosoftEdgeUpdateComRegisterShell64.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.173.45\MicrosoftEdgeUpdateComRegisterShell64.exe"7⤵
- Executes dropped EXE
- Modifies registry class
PID:3236
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.173.45\MicrosoftEdgeUpdateComRegisterShell64.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.173.45\MicrosoftEdgeUpdateComRegisterShell64.exe"7⤵
- Executes dropped EXE
- Modifies registry class
PID:212
-
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xNzMuNDUiIHNoZWxsX3ZlcnNpb249IjEuMy4xNzMuNDUiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7Qzg4RUU3ODAtRjBCRi00OUEwLUE0MDItQUY1Mjc1QjJCQThEfSIgdXNlcmlkPSJ7REI1MTNEQTItMEYyNS00Q0E3LUI4QTMtRDNCOUZEQjQ4RTNBfSIgaW5zdGFsbHNvdXJjZT0ib3RoZXJpbnN0YWxsY21kIiByZXF1ZXN0aWQ9InswQjBGRjQ5NC1FNTk4LTRENDMtODQxQy0wMkIxRjQwMTRBNjR9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iOCIgcGh5c21lbW9yeT0iOCIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjE5MDQxLjEyODgiIHNwPSIiIGFyY2g9Ing2NCIgcHJvZHVjdF90eXBlPSI0OCIgaXNfd2lwPSIwIi8-PG9lbSBwcm9kdWN0X21hbnVmYWN0dXJlcj0iIiBwcm9kdWN0X25hbWU9IiIvPjxleHAgZXRhZz0iIi8-PGFwcCBhcHBpZD0ie0YzQzRGRTAwLUVGRDUtNDAzQi05NTY5LTM5OEEyMEYxQkE0QX0iIHZlcnNpb249IjEuMy4xNDcuMzciIG5leHR2ZXJzaW9uPSIxLjMuMTczLjQ1IiBsYW5nPSIiIGJyYW5kPSIiIGNsaWVudD0iIj48ZXZlbnQgZXZlbnR0eXBlPSIyIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI1Mjk5NjE2NTk0IiBpbnN0YWxsX3RpbWVfbXM9IjQ4NCIvPjwvYXBwPjwvcmVxdWVzdD46⤵
- Executes dropped EXE
- Checks system information in the registry
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
PID:1216
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /handoff "appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}&appname=Microsoft%20Edge%20Webview2%20Runtime&needsadmin=prefers" /installsource otherinstallcmd /sessionid "{C88EE780-F0BF-49A0-A402-AF5275B2BA8D}"6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3284
-
-
-
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall1⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4832 -
C:\Windows\system32\DrvInst.exeDrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{818a1fe7-2caa-fc43-9ba1-d8a46c698fba}\TVVirtualMonitorDriver.inf" "9" "4e60e5847" "000000000000014C" "WinSta0\Default" "000000000000015C" "208" "C:\Program Files\TeamViewer\x64"2⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
PID:4828
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /svc1⤵
- Executes dropped EXE
- Checks system information in the registry
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:4472 -
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xNzMuNDUiIHNoZWxsX3ZlcnNpb249IjEuMy4xNzMuNDUiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7Qzg4RUU3ODAtRjBCRi00OUEwLUE0MDItQUY1Mjc1QjJCQThEfSIgdXNlcmlkPSJ7REI1MTNEQTItMEYyNS00Q0E3LUI4QTMtRDNCOUZEQjQ4RTNBfSIgaW5zdGFsbHNvdXJjZT0ib3RoZXJpbnN0YWxsY21kIiByZXF1ZXN0aWQ9Ins2OEZDOTY0OS0yRTY0LTQyRjAtODMzMi02QTAyRDhEODFEQTJ9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iOCIgcGh5c21lbW9yeT0iOCIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjE5MDQxLjEyODgiIHNwPSIiIGFyY2g9Ing2NCIgcHJvZHVjdF90eXBlPSI0OCIgaXNfd2lwPSIwIi8-PG9lbSBwcm9kdWN0X21hbnVmYWN0dXJlcj0iIiBwcm9kdWN0X25hbWU9IiIvPjxleHAgZXRhZz0iIi8-PGFwcCBhcHBpZD0iezhBNjlEMzQ1LUQ1NjQtNDYzYy1BRkYxLUE2OUQ5RTUzMEY5Nn0iIHZlcnNpb249IjEyMy4wLjYzMTIuMTIzIiBuZXh0dmVyc2lvbj0iMTIzLjAuNjMxMi4xMjMiIGxhbmc9ImVuIiBicmFuZD0iR0dMUyIgY2xpZW50PSIiPjxldmVudCBldmVudHR5cGU9IjMxIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSI1IiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI1MzAyMTE2NjQ5Ii8-PC9hcHA-PC9yZXF1ZXN0Pg2⤵
- Executes dropped EXE
- Checks system information in the registry
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
PID:4516
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{B7300BB3-A998-4337-B85E-726FDA069BD7}\MicrosoftEdge_X64_131.0.2903.86.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{B7300BB3-A998-4337-B85E-726FDA069BD7}\MicrosoftEdge_X64_131.0.2903.86.exe" --msedgewebview --verbose-logging --do-not-launch-msedge --system-level2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4828 -
C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{B7300BB3-A998-4337-B85E-726FDA069BD7}\EDGEMITMP_611BF.tmp\setup.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{B7300BB3-A998-4337-B85E-726FDA069BD7}\EDGEMITMP_611BF.tmp\setup.exe" --install-archive="C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{B7300BB3-A998-4337-B85E-726FDA069BD7}\MicrosoftEdge_X64_131.0.2903.86.exe" --msedgewebview --verbose-logging --do-not-launch-msedge --system-level3⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:736 -
C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{B7300BB3-A998-4337-B85E-726FDA069BD7}\EDGEMITMP_611BF.tmp\setup.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{B7300BB3-A998-4337-B85E-726FDA069BD7}\EDGEMITMP_611BF.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\MsEdgeCrashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=131.0.6778.109 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{B7300BB3-A998-4337-B85E-726FDA069BD7}\EDGEMITMP_611BF.tmp\setup.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=131.0.2903.86 --initial-client-data=0x21c,0x220,0x224,0x1f8,0x228,0x7ff6ee7c2918,0x7ff6ee7c2924,0x7ff6ee7c29304⤵
- Executes dropped EXE
PID:4940
-
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Event Triggered Execution
2Component Object Model Hijacking
1Image File Execution Options Injection
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Event Triggered Execution
2Component Object Model Hijacking
1Image File Execution Options Injection
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Modify Registry
1Subvert Trust Controls
1Install Root Certificate
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\Microsoft\EdgeCore\131.0.2903.86\Installer\setup.exe
- Size 6.6MB
- SHA256 ad14d7268ee8a9c3c89e7cf62a8a9b713c9f37069fe85b3f8fe525dcda8cdfc9
- MD5 69221ee7ef83d7eb340857b5833eea14
- SHA1 d7f27c64b62eefe2c204a323cc812fa56f58ce1e
- SHA512 8df73f03d7438082b9e8793f5346a7385c91139d879703dd8c32acfdacb200c18231a5a9cedd7836c892ebb7a8888857c68653728b9027ca1f483a1751fbe2e3
- SSDEEP 98304:5zEiGraP9+W4SX5K0azlsX+wvfGIU4dlCU9K+K0SUU:tEiGraJX5oG5f5NlCU3F2
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
- Size 201KB
- SHA256 4d9f16b00bda1db65b68cb486f7ae1bf5b32aedf7fd335e4a8ef2fa087870986
- MD5 ae0bd70d0d7e467457b9e39b29f78410
- SHA1 b4a549508cbc9f975a191434d4d20ad3c28d5028
- SHA512 cbe2b5ffe647f5318edd9825ea6536d6d14dab66920def0323fb5b4dc03a4f8b6781b9209e5a557ab4d270b3f2b170797e6bd807195c93869367c0a245a3168e
- SSDEEP 3072:xHrfzYuc6X/YoW4l/DReos0gXf+EvC6C36eCWdMuoB+veHNG4S95ZbGkfhzrA+IO:FAel/DRfkTC3dM7B+2Cz
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files (x86)\Microsoft\Temp\EU61B3.tmp\MicrosoftEdgeUpdateSetup.exe
- Size 1.5MB
- SHA256 65f6efdf6df4095971a95f4bf387590ae63109388344632a22458265ab7dd289
- MD5 b32d72daeee036e2b8f1c57e4a40e87a
- SHA1 564caa330d077a3d26691338b3e38ee4879a929d
- SHA512 b5d62ce1462d786c01d38e13d030ad6236ce63321819cf860cc6169f50f6309e627bc7709b305422851779e37dbae9fb358008aad8d6c124cd33cdec730288d5
- SSDEEP 24576:Uwyf3Su4a/KnwYtDXl42hxt3q7lR3hVtTcKaBQ7SdBZpeUY:Zyf3L4aGweXl1h/C3Jc9BQ7SdPMh
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\MsEdgeCrashpad\settings.dat
- Size 280B
- SHA256 13bfc8e167b9a4f923cb3f6ff02d33633f18a6780b5f8fe5c083dbe7b00fee2b
- MD5 11d46731abdc00088874e63787150873
- SHA1 c4e6e79abb090cea74c0e475487fee6f2b6f40fd
- SHA512 c1fb96a7fd9997b87cceb93e713d48aaf034950d0adb02f1cf96bea07e9e72c168acac35eab630f28920c55ca231bdb16af0ad1850bd0b51052cbe1e3c0644b7
- MD5 SHA1 SHA512
- Path C:\Program Files\TeamViewer\TeamViewer_Service.exe
- Size 21.6MB
- SHA256 4e40c3381fb5a99bcc4adf2e3b6f3ecd1e224c4cc22b39648552ef4514ea933b
- MD5 e901c556a63e8738affa2d2f1c82da4c
- SHA1 87092e6c7a60c8e8595a7c034dadfaa55dff417d
- SHA512 314bed464671b2b5e9a94b3ea2e3bb2e3899a5b5cafad146691b5a6a009d50414de2a84b518e2f7b253f55cd7393eecf7f5c3d73a9d443164689174069ff21b2
- SSDEEP 393216:KcTW/8hgQcbLqItw/cIqiQwxhWt24zvIR:KqQcOs
- MD5 SHA1 SHA512 SSDEEP
- Path C:\ProgramData\Microsoft\EdgeUpdate\Log\MicrosoftEdgeUpdate.log
- Size 104KB
- SHA256 733bd6531820e9988627370b65e5c6460baf9044bd09c34751ed5e9d7e9ef2bc
- MD5 cf41f1f18d60a54836ddc5a77a970d4c
- SHA1 768436e7116082f4756d4758cf4594e32d69371d
- SHA512 4c6db1630b2591537ad65357907bb6b29070a1fe3c49ec6cc198a7ff5319d03b015665ecd88669810e8a548ef3e618989a18ed83dfba7a132550ab23e1dd75a3
- SSDEEP 3072:QhpjWILmmC4QGxouw25CHnWR5CHZIS5CHEPA5CHzgpyPkvTv5K/tq:EL08x7w9W8IKPPgpyPOstq
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\Client-built.exe
- Size 3.1MB
- SHA256 03a4b081b4966130cbe615ff249954e7e9a0d62a79faf8e56ac3830929748e43
- MD5 181719b653c83d0463d89a625a7f5c3e
- SHA1 1173005be27979dc74779e60dc790299e4f2b0a4
- SHA512 d05e6fc586a8731903df4cffe3bdcb92f99e2cdbe15e40706e87ecc038e4e9b1ef1fc9a39f8adeda4341e3507f2f8f81ae50d590ff9f4233cd7694b26fb3fa04
- SSDEEP 98304:bvk22SsaNYfdPBldt6+dBcjHwKRJ6JQa:TJ7jjM
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\nsdC70.tmp\TvGetVersion.dll
- Size 686KB
- SHA256 75cf60d72a2cb6a748db6f69e2bfa065422df7bb6636d3c214f5435341574a66
- MD5 878c644c12c3d96438c2909fbb7375cd
- SHA1 4fb206e213bd088e28a1c10ab815d1bfd1b522f1
- SHA512 df0d1903901ffaf7ca1ee22cc5b8bac37cb554f78ed07a8ccaf84a2cd6fb7f9ac5599caad83d92079e170190701a9391468331ec8aa562bfdf32376703e05bd8
- SSDEEP 12288:H9bt5E1nHSqUSCX0UD0GgUGLt9jkqvaStOIkWk5Yu5yclFQxq8p0:H9btgnHSqUSCXnD0GgUGLt9jkm3Ask5v
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\nsdC70.tmp\nsdCBF\TV15Install.log
- Size 4KB
- SHA256 4dd5a9d3945969b33b7055a7aa0b37fbb8af6bce77cf09cf098a1718aa74d25d
- MD5 a2ae58be95ad63529af19680bc702e1e
- SHA1 e3c3161681ae362b693f4c255c18b97d0b45b048
- SHA512 1e7c737c3f31dbcab0085e0d023df39beea567f8b3ce2591a74cae230b6a0261018dcc84cace098fe837dfa54d83dcc61af5370a6a83e23996f5f0a0e4f88ea4
- SSDEEP 96:yL0+DojVEV33LM+aVGC3uLE9WLRL+ALMqYYqw/bhux:yL99LdaVSLHLRL+ALMqYYqw/k
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\nsdC70.tmp\nsdCBF\install.ini
- Size 78B
- SHA256 1c5231379c3025a42d51f956f649c445ebc550f9ad9b9f5cc4ae5e627ef456b3
- MD5 a3c26dd25fc88922e9297e2a9d04ac53
- SHA1 807b0ca16c4080b6ce7ae8b09e7dcce7e52d5c19
- SHA512 1d36ee7b43d82b72000520c0b0c37585576363fcd506aeab362c544000b0bf9702a357e118b2ae3499d8f8c9a7529f56169cc14e5281a5246ae9efd342c4fa59
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\nsdC70.tmp\nsdCBF\tvinfo.ini
- Size 50B
- SHA256 72935bcb05a31b405a0e4a13eb0babd1640bbe03fad52ff85ffa91390d0e8eee
- MD5 a48b05e8e36f7f4e9096ade8950b87e4
- SHA1 c743c68fb5798389435927338d1c8ed1c59496a2
- SHA512 7943a5c44c136347f199a1a3e1aa8af3f4ee9d5024d4588e3faa95f57dcd51292e606a057d567d45c8bc9d62ebfcfebd199654d1f1214b205124418c592f47f7
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\nso100A.tmp\InstallOptions.dll
- Size 27KB
- SHA256 822f75b69dd87332b5995528771923ec74dc5329c65094bf4e372eb8ef42bb8e
- MD5 e87068563fc18e67a78230067cc240e5
- SHA1 37cd2cb5581fc575b8c46383d877926bda85883b
- SHA512 dab6b330d73abadb63f6eb02a5bc87ce9b9d1bc64fcb9289581cfc2e04be0254893945b3bdb762b382bb491388e34bc018f098a489908dfbc9feca2a9ba13d5d
- SSDEEP 384:E4C43tPegZ3eBaRwCPOYY7nNYXCT/YosaiZSf+VIYiWL3LU9Pxh8E9VF0NyzDcHF:ElTgZ3eBTCmrnNAho/YiWk9PxWEZsOe
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\nso100A.tmp\System.dll
- Size 23KB
- SHA256 a91aa7c0ead677fc01b1c864e43e0cace110afb072b76ad47f4b3d1563f4dc20
- MD5 938c37b523d7fc08166e7a5810dd0f8e
- SHA1 47b9663e5873669211655e0010e322f71b5a94be
- SHA512 77afe83fb4e80a775dae0a54a2f0ff9710c135f9f1cf77396bc08a7fe46b016a8c079b4fa612e764eea5d258703f860688e38b443e33b1f980e04831739517c1
- SSDEEP 384:58QIl975eXqlWBrz7YLOlACZSf+VIYiWLbLWQaZdPxh8E9VF0Ny0W3N9:5gPgrfYLOWJ/YiW8PxWE6Y9
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\nso100A.tmp\TvGetVersion.dll
- Size 696KB
- SHA256 e35396c7d7e32a8fe771895ed9ea16bd85c8544410bf4dc70a42ccd2884cfd83
- MD5 41c3a6594060581d3bf1a16ed4ae6a72
- SHA1 62bdf8c2a3fa5f70e8b25e83c946debf80c8fd47
- SHA512 3fee7ea74b4173b2815d631c8e69f5a21f2a170a46ce60424f9b9fb03cf7a35eab6933210497f851816a1a85eb3fdb682781ccb5e2607b7ade6dbc7a098368bd
- SSDEEP 12288:1vN6jZ0SoGsZwrbV22NJPNKwhtFXWKRc/VL5dAXfyud15bMVq03D:1vN6aSoGsZwXV22NNNKwhfmH5abEP
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\nso100A.tmp\UAC.dll
- Size 29KB
- SHA256 b5bb8d301173c4dd2969b1203d2c7d9400ba3f7f2e34ee102905bd2724162430
- MD5 488819f838abfcad73a2220c151292ee
- SHA1 4a0cbd69300694f6dc393436e56a49e27546d0fe
- SHA512 b00d6cf712fe4cefce41479f6e6f4aa5ea006694d10f2837204de5bde1c5a4bef1368f2b0eb4b66d57a66e8ce6dc335fa91e9c8017e8e125c27eb1f5df4de9a0
- SSDEEP 384:QqVibvTh4qnFP+OPEzinclP+RZSf+VIYiWLglLoPxh8E9VF0NyH5TV:QqVavVfPkzhlmg/YiWLPxWEFX
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\nso100A.tmp\UserInfo.dll
- Size 15KB
- SHA256 e1cb80a23786b02cb2c6a2f9e391b63cbf3ad911e42bbdc14cc6879c84b7404e
- MD5 77ff6a927940a0e4b8dc07bdde6ab5db
- SHA1 8d0035242289504d050d237f7e3e548c1ddff077
- SHA512 6a3050dc8e3f4eaaa85a43cdf1ac4f69745c07efe48268103ee7d8927ec574b6866740f95e6b3aff154ba74cd05024223a3ea4957cb773dd065cfd797f8a07e3
- SSDEEP 192:hxvcecjqZSF8VG+VIYiYF8u7a7JV+A0MLyfP+noPOJB3hy2sE9jBF0NyH0lQkzkT:QrWZSf+VIYiWLyLvPxh8E9VF0NyHka
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\nso100A.tmp\linker.dll
- Size 56KB
- SHA256 7817f79bcdf54ef8617f15b5c0b9b92053549d5a51fa280722ee7179311b69a1
- MD5 b05a97bb3f532b7cf57b8eedf198d7af
- SHA1 83c13a90f4a3c1c62e132f5f3bc70c97c2ecfc80
- SHA512 40706c5fc72198148962d24046722fc5e488c0cc4b3374a9f4b652175919e97a8712e882940db8c26479619a26ec4e2d41744627a9ca52ec7cb1ce4f91d7ee8c
- SSDEEP 768:ZmTLl3rmEgLMP/rLqgidfwHJQDEExmE+Ji4RdVt//wf/YiWGoPxWEfQy:ZgLFm8OdfwpJS/fqt//wf/70Pxf
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\nso100A.tmp\nsArray.dll
- Size 18KB
- SHA256 8b8be21fa7bca491c93683c9f84bb49370ca7e1e864bd0658ff9e1d2809b67e4
- MD5 9761d708ea7c49662a21f6690d439e06
- SHA1 b2e757e7eee5c788f16d666fb6cf9d41caccb04b
- SHA512 25990a993373009ccbd9e89cae3fc601928121775d0d5fe326c55a305ce8de51f35a2cb160e9dfbf3be82a53ddf7b9864116e7f5d3325afd7403cd3b7740c652
- SSDEEP 384:nqqedh6EHFRksp7KpFX1ZSf+VIYiWLALiqPxh8E9VF0NymgEy:Ted/FR9mXc/YiWMPxWEspy
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\nso100A.tmp\nsExec.dll
- Size 18KB
- SHA256 4d8c8353641bbb26bf9ea2ab2dbf126be6ef164b1ce80e3ef5030b873be166cd
- MD5 9ea6ec7934495cc757639b5095362ca7
- SHA1 ef2c14142b70689483576cc09083db4a2a363e02
- SHA512 414b08f75bd7febb56784d8534cee028f6420776f07ce5797f66a78748c34b52f443aa35f72c8d7c81dd5366b34998b56d99a9d0d2b4b2b6bfc9775e4ff66531
- SSDEEP 384:BqbGgezxEqoyGgmkN7ZSf+VIYiWLSL/Pxh8E9VF0Ny4LN2:431yGLk8/YiWePxWEOZ2
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\nso100A.tmp\nsis7z.dll
- Size 187KB
- SHA256 5d71aaeefbc81732017e9040c8087e6686a16dd54e6d9bcd5ba7a47af68cc925
- MD5 7fe20cee9277556f4ef137e61d29d9f5
- SHA1 d53c37dbf548914ed20c8ebb21186a95beef1ee3
- SHA512 a90250214c6c5048b098e031fca5a8097854a8667330551d7694740e3bc83f7d77791d314e3ac75617ef1834b75c41e3e3d3c74da9794a207894c13fb2d4bef7
- SSDEEP 3072:OBFxfbJUIW9WGExPYD5JFBJOYWjm8KCmRv1fPIVF2tbRpj/uxe:qxzJSAGEdYD5JcYl78FsLP
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\nso100A.tmp\start_unicode.ini
- Size 1KB
- SHA256 483e0ae06bf051ffd48e0374d6d16454ad7ebc0794bfc4572e4c40155b4b4e2f
- MD5 e1e5f83035cb20fd89b7de415465eb28
- SHA1 9444cf7198dbf73700d19f4725d8d06efec87366
- SHA512 b3aaa4d68a0d79a5ad8471ea8ebe9cea3f2ec202fcec32da1c39555d7e17b77738411f3b6b75a99c904014d2f0dee93644813775fb1c22e3c5694ac2713c31bd
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\nso100A.tmp\start_unicode.ini
- Size 2KB
- SHA256 5e9dc1dcf9e3df87ca8ed455a606c4d49925d2a172737b6d414d83fdf75d7432
- MD5 e5a708a9a39d64fa2cc6aa3132f72179
- SHA1 0328794c52614243b82ffe552495042397c24e7d
- SHA512 fa45b75c3fbdbe8fcc1d62e157ecf33f2c12087dcec232f749e363716ba26cd4c342dc05d76385bcebc5e564164767aa7d56ffe13e86249dd572ef34f809c27d
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\nso100A.tmp\start_unicode.ini
- Size 2KB
- SHA256 5a1bd56d6d7cbd25a40d54a233acff8c0cf89a72da5193e17e9c5ba316b8f0dd
- MD5 31205c22f89772550207ecb86ef3b53e
- SHA1 980848201cb9d9d48b30df53a85b11226ead1302
- SHA512 d6498af4e1a0f4d5c46dca76c48346bcd4ebdff715a909c4acf77ab14953e74ed21880f70b0c884fbff43d0ac2b7420f5f80a3ac1290bb898e9830166a5f0889
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\{818a1fe7-2caa-fc43-9ba1-d8a46c698fba}\SET5F32.tmp
- Size 11KB
- SHA256 2c714a3687424c798b565128c0720322a7ea0fb779d91963048394ea471707aa
- MD5 746441b276b24b7a5b487a429f60d214
- SHA1 657258cbaf47d6faa2ec58c77b948c6398828f96
- SHA512 f734829ec6d6ad84848fa5cd2b866337360481b596a383a49ae3ba5176ffd74850c8dfa345f1dd3bc4644da6fa905ad91644e450da02c413d39849ea3c35753c
- SSDEEP 192:qtxI5sxyQJCxSFBkyKuqwFWQFH5JUoowcLK+X01k9z3A4ZdMXrWp:80GFRdfUo6R9zrvMu
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\{818a1fe7-2caa-fc43-9ba1-d8a46c698fba}\SET5F33.tmp
- Size 70KB
- SHA256 cd858c1a37d9599181285ce55e38bbd7cef8637f8df1d3ba425b78c2670e345e
- MD5 5da3dd0a7761d1c1678d65f22005175a
- SHA1 13edda1695d1080379adf30596f149cfe09e865d
- SHA512 54c14b06f3cf373dd4a6d77030d7908fc6cb42bf151760877ef2ea0c5662b56f2dd09a334bb55602a4f1920cdf91fba140aaea14113da369cd25b89ab8b3ca3a
- SSDEEP 768:Mdq9xYKLIHVgKqnS/OLlGkQctwE/uf95v13d6YHU3/Yic5Hf+AMxkEBsF9zmGW:MUYK7xxacKYS5vBHU3/7IHkxuXznW
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\{818a1fe7-2caa-fc43-9ba1-d8a46c698fba}\SET5F34.tmp
- Size 4KB
- SHA256 f35e1bed01d9efdd2566f6a07560d263ce6cd9494aed03cd3564a7788f6ffa41
- MD5 6ccc14f0f72bb4398f0a15cc96bbbb86
- SHA1 891a0a4069c8ccec4540387a213a445e7a65982f
- SHA512 1ef640fec7f68587e938646ab2771f5bfa8384542e401b097cfce3a0d0b67a3f5a6f756fc9f66c77d7d8ac6daa87d227864e7b44fc81a64bebc42254dee906ee
- SSDEEP 96:Kw/Pg6KAXlFHmk9/BabDIWebYNnitU42S42Lx:s1E
- MD5 SHA1 SHA512 SSDEEP