ardamax | 7bfb50d5f82d0f807e5e179d0cf44d65068451d95e217b8b68fc3c4372995236

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20250129-en
resource tags

arch:x64arch:x86image:win10v2004-20250129-enlocale:en-usos:windows10-2004-x64system
submitted
04-02-2025 00:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_8e00e54479d218e50a55e497c2600948.exe
Size

2.4MB
MD5

8e00e54479d218e50a55e497c2600948
SHA1

01f2b7b68083770c037110ec4fd19dc84d03ef75
SHA256

7bfb50d5f82d0f807e5e179d0cf44d65068451d95e217b8b68fc3c4372995236
SHA512

e55ea16c60955ca20acef6da518fa428d2dd804f975c8bf3a63fc610cba5a37ac437135ce496e8889982d2584cfee38c6d705b9498cc9a80b3d13f4a0ab5459e
SSDEEP

49152:BiwHJXlGV+KUipeLzAFSirQAQK828oy4/w7OdYVhh78MTMeHn:BiCJ6NFrFSiroK828o07cYRKin

Score

10^/10

ardamax discovery keylogger persistence stealer

Malware Config

Signatures

Ardamax
A keylogger first seen in 2013.
keylogger stealer ardamax
Ardamax family
ardamax

Ardamax main executable 1 IoCs

resource	yara_rule
behavioral2/files/0x0007000000023cb4-12.dat	family_ardamax

Drops file in Drivers directory 3 IoCs

description	ioc	Process
File created	C:\Windows\System32\drivers\SETEBB8.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\drivers\tap0901.sys	DrvInst.exe
File opened for modification	C:\Windows\System32\drivers\SETEBB8.tmp	DrvInst.exe

Manipulates Digital Signatures 1 TTPs 1 IoCs

Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to obtain their binary as valid.

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\4706CF05D7F46FFB2BFF9CDB085211381B608114\Blob = 0300000001000000140000004706cf05d7f46ffb2bff9cdb085211381b60811404000000010000001000000068ccf3b0e296dffebf025d60b8df4720140000000100000014000000d76eb5c32dd2ddd486d7ded16e59f2c6fa9783f3190000000100000010000000f20c6b3d7605140fae1f5c8b560d2b8b0f00000001000000140000000a032c8388e9dd80742d2294efdbbbfd795a42ac2000000001000000220400003082041e30820306a003020102020b0100000000012750891a64300d06092a864886f70d01010505003063310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d736131163014060355040b130d4f626a6563745369676e2043413121301f06035504031318476c6f62616c5369676e204f626a6563745369676e204341301e170d3130303331323033313635375a170d3131303331333033313635315a3078310b3009060355040613025553311630140603550408130d464c202f2053656d696e6f6c65311730150603550407130e57696e74657220537072696e6773311b3019060355040a131270726f58504e204469726563742c204c4c43311b30190603550403131270726f58504e204469726563742c204c4c4330819f300d06092a864886f70d010101050003818d00308189028181009b2df6065dd9f6be33157b4cf0d8b0bfc171568ba05dcbb1c44d0acee367c2130d7d320c4cfeb481947b63617decb4be4e7edc4942ca7c4dd4c024cd90a06bbc74a409a8dfe75a5417087fe2ee7cd53ca25666d37519aad97c510c0dfad0150abb0affe0e3dea0ec1d6a937ada2c3f8bd901ebb7d1c463eb394c286a59fbafd90203010001a38201403082013c301f0603551d23041830168014d25bf34b264ba5b0e75dfd567ff6f12e384e53a0304e06082b0601050507010104423040303e06082b060105050730028632687474703a2f2f7365637572652e676c6f62616c7369676e2e6e65742f6361636572742f4f626a6563745369676e2e63727430390603551d1f04323030302ea02ca02a8628687474703a2f2f63726c2e676c6f62616c7369676e2e6e65742f4f626a6563745369676e2e63726c30090603551d1304023000300e0603551d0f0101ff04040302078030130603551d25040c300a06082b06010505070303304b0603551d2004443042304006092b06010401a03201323033303106082b060105050702011625687474703a2f2f7777772e676c6f62616c7369676e2e6e65742f7265706f7369746f72792f301106096086480186f8420101040403020410300d06092a864886f70d010105050003820101004c65c7f1e03077763746ee2800bc4ee4cd986700749584f5a95114617ecfa2358d37af42fdaa492615a8b8c0c26525df41ef3d4752336e1059862b040a25677e1182710dcf8986386d0ae3f1a8e1898b1414a656595bd215e90d72d2002bac5e4245f310f2117352a1dd7544ef0fec4326a174e91fe1c341fba70f2236092d720e2e4046ba5eb8d79fcd1909a0f86edb478f855692ee7c799bf34196f8226ccae6a30f501a274cc428aad9b8eb210aacfae0b9d96cc820e4b05b1c020f5fcdb9aca79e6661d0da4666b6bb4a47d7e7a7f34df081545a22a602a6b5703a149997d1ce3b4fce4ede9dbe423390cd082c5bbac2d8b817c328da29a929a068e4b5f0	DrvInst.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1412605595-2147700071-3468511006-1000\Control Panel\International\Geo\Nation	JaffaCakes118_8e00e54479d218e50a55e497c2600948.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1412605595-2147700071-3468511006-1000\Control Panel\International\Geo\Nation	installproXPN.exe

Executes dropped EXE 9 IoCs

pid	Process
372	FECN.exe
2136	installproXPN.exe
3092	tapinstall.exe
3952	tapinstall.exe
2728	tapinstall.exe
4816	btnClick.exe
2420	openvpnserv.exe
3084	proxpn.exe
2576	openvpn.exe

Loads dropped DLL 36 IoCs

pid	Process
3188	JaffaCakes118_8e00e54479d218e50a55e497c2600948.exe
372	FECN.exe
3188	JaffaCakes118_8e00e54479d218e50a55e497c2600948.exe
3188	JaffaCakes118_8e00e54479d218e50a55e497c2600948.exe
372	FECN.exe
372	FECN.exe
2136	installproXPN.exe
2136	installproXPN.exe
2136	installproXPN.exe
2136	installproXPN.exe
2136	installproXPN.exe
2136	installproXPN.exe
2136	installproXPN.exe
2136	installproXPN.exe
2136	installproXPN.exe
2136	installproXPN.exe
2136	installproXPN.exe
2136	installproXPN.exe
2136	installproXPN.exe
2136	installproXPN.exe
2136	installproXPN.exe
2136	installproXPN.exe
2136	installproXPN.exe
2136	installproXPN.exe
2136	installproXPN.exe
2136	installproXPN.exe
2136	installproXPN.exe
2136	installproXPN.exe
2136	installproXPN.exe
2136	installproXPN.exe
2136	installproXPN.exe
3084	proxpn.exe
3084	proxpn.exe
3084	proxpn.exe
2576	openvpn.exe
2576	openvpn.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\FECN Agent = "C:\\Windows\\SysWOW64\\28463\\FECN.exe"	FECN.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1412605595-2147700071-3468511006-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\proXPN = "C:\\Program Files (x86)\\proXPN\\bin\\proxpn.exe"	proxpn.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in System32 directory 22 IoCs

description	ioc	Process
File created	C:\Windows\System32\DriverStore\Temp\{2799633f-2d4a-cd4d-bfcf-6cb65d0f0dbe}\SETE8BA.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{2799633f-2d4a-cd4d-bfcf-6cb65d0f0dbe}\SETE8BB.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\FileRepository\oemwin2k.inf_amd64_513bc5d60aa7ffa7\oemwin2k.PNF	tapinstall.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\oemwin2k.inf_amd64_513bc5d60aa7ffa7\tap0901.cat	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\oemwin2k.inf_amd64_513bc5d60aa7ffa7\oemwin2k.inf	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{2799633f-2d4a-cd4d-bfcf-6cb65d0f0dbe}	DrvInst.exe
File created	C:\Windows\SysWOW64\28463\FECN.001	JaffaCakes118_8e00e54479d218e50a55e497c2600948.exe
File created	C:\Windows\SysWOW64\28463\FECN.exe	JaffaCakes118_8e00e54479d218e50a55e497c2600948.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{2799633f-2d4a-cd4d-bfcf-6cb65d0f0dbe}\oemwin2k.inf	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{2799633f-2d4a-cd4d-bfcf-6cb65d0f0dbe}\SETE8BB.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\drvstore.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\oemwin2k.inf_amd64_513bc5d60aa7ffa7\tap0901.sys	DrvInst.exe
File opened for modification	C:\Windows\System32\CatRoot2\dberr.txt	DrvInst.exe
File created	C:\Windows\SysWOW64\28463\AKV.exe	JaffaCakes118_8e00e54479d218e50a55e497c2600948.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{2799633f-2d4a-cd4d-bfcf-6cb65d0f0dbe}\SETE8BA.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{2799633f-2d4a-cd4d-bfcf-6cb65d0f0dbe}\SETE8BC.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{2799633f-2d4a-cd4d-bfcf-6cb65d0f0dbe}\SETE8BC.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{2799633f-2d4a-cd4d-bfcf-6cb65d0f0dbe}\tap0901.sys	DrvInst.exe
File created	C:\Windows\SysWOW64\28463\FECN.006	JaffaCakes118_8e00e54479d218e50a55e497c2600948.exe
File created	C:\Windows\SysWOW64\28463\FECN.007	JaffaCakes118_8e00e54479d218e50a55e497c2600948.exe
File opened for modification	C:\Windows\SysWOW64\28463	FECN.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{2799633f-2d4a-cd4d-bfcf-6cb65d0f0dbe}\tap0901.cat	DrvInst.exe

Drops file in Program Files directory 25 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\proXPN\bin\libpkcs11-helper-1.dll	installproXPN.exe
File created	C:\Program Files (x86)\proXPN\bin\addtap.bat	installproXPN.exe
File created	C:\Program Files (x86)\proXPN\driver\OemWin2k.inf	installproXPN.exe
File created	C:\Program Files (x86)\proXPN\driver\tap0901.cat	installproXPN.exe
File created	C:\Program Files (x86)\proXPN\driver\tap0901.sys	installproXPN.exe
File created	C:\Program Files (x86)\proXPN\license.txt	installproXPN.exe
File created	C:\Program Files (x86)\proXPN\bin\btnClick.exe	installproXPN.exe
File created	C:\Program Files (x86)\proXPN\log\README.txt	installproXPN.exe
File created	C:\Program Files (x86)\proXPN\padlock.ico	installproXPN.exe
File opened for modification	C:\Program Files (x86)\proXPN\bin\btnClick.exe	installproXPN.exe
File created	C:\Program Files (x86)\proXPN\config\README.txt	installproXPN.exe
File created	C:\Program Files (x86)\proXPN\bin\libeay32.dll	installproXPN.exe
File created	C:\Program Files (x86)\proXPN\bin\openssl.exe	installproXPN.exe
File created	C:\Program Files (x86)\proXPN\bin\openvpn.exe	installproXPN.exe
File created	C:\Program Files (x86)\proXPN\config\ssl\client.key	installproXPN.exe
File created	C:\Program Files (x86)\proXPN\bin\libssl32.dll	installproXPN.exe
File created	C:\Program Files (x86)\proXPN\INSTALL-win32.txt	installproXPN.exe
File created	C:\Program Files (x86)\proXPN\Uninstall.exe	installproXPN.exe
File created	C:\Program Files (x86)\proXPN\config\ssl\ca.crt	installproXPN.exe
File created	C:\Program Files (x86)\proXPN\config\ssl\client.crt	installproXPN.exe
File created	C:\Program Files (x86)\proXPN\bin\openvpnserv.exe	installproXPN.exe
File created	C:\Program Files (x86)\proXPN\bin\deltapall.bat	installproXPN.exe
File created	C:\Program Files (x86)\proXPN\bin\tapinstall.exe	installproXPN.exe
File created	C:\Program Files (x86)\proXPN\bin\proxpn.exe	installproXPN.exe
File created	C:\Program Files (x86)\proXPN\config\ProXPN.ovpn	installproXPN.exe

Drops file in Windows directory 6 IoCs

description	ioc	Process
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File opened for modification	C:\Windows\inf\oem3.inf	DrvInst.exe
File created	C:\Windows\inf\oem3.inf	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	tapinstall.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	svchost.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	openvpn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_8e00e54479d218e50a55e497c2600948.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FECN.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	installproXPN.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	btnClick.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	openvpnserv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	proxpn.exe

NSIS installer 2 IoCs

installer

resource	yara_rule
behavioral2/files/0x0007000000023cb6-21.dat	nsis_installer_1
behavioral2/files/0x0007000000023cb6-21.dat	nsis_installer_2

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	tapinstall.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\UpperFilters	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs	tapinstall.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\CompatibleIDs	tapinstall.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\CompatibleIDs	tapinstall.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\CompatibleIDs	tapinstall.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	tapinstall.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\LowerFilters	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	tapinstall.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\CompatibleIDs	tapinstall.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	tapinstall.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Phantom	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Filters	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	tapinstall.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	tapinstall.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	tapinstall.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\LowerFilters	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	tapinstall.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom	tapinstall.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	tapinstall.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\CompatibleIDs	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	tapinstall.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Phantom	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Filters	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\LowerFilters	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	tapinstall.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Service	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\LowerFilters	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	tapinstall.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Filters	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Service	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	tapinstall.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	tapinstall.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Service	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	tapinstall.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	tapinstall.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	tapinstall.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\CompatibleIDs	tapinstall.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom	tapinstall.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\UpperFilters	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	tapinstall.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	DrvInst.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 42 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe

Modifies registry class 15 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\proXPNFile\DefaultIcon\ = "C:\\Program Files (x86)\\proXPN\\padlock.ico,0"	installproXPN.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\proXPNFile\shell\run\command	installproXPN.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\proXPNFile	installproXPN.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\proXPNFile\shell	installproXPN.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\proXPNFile\shell\ = "open"	installproXPN.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.ovpn\ = "proXPNFile"	installproXPN.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\proXPNFile\ = "proXPN Config File"	installproXPN.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\proXPNFile\DefaultIcon	installproXPN.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\proXPNFile\shell\open\command\ = "notepad.exe \"%1\""	installproXPN.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\proXPNFile\shell\run\ = "Start proXPN on this config file"	installproXPN.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\proXPNFile\shell\run\command\ = "\"C:\\Program Files (x86)\\proXPN\\bin\\openvpn.exe\" --pause-exit --config \"%1\""	installproXPN.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\proXPNFile\shell\run	installproXPN.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.ovpn	installproXPN.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\proXPNFile\shell\open\command	installproXPN.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\proXPNFile\shell\open	installproXPN.exe

Modifies system certificate store 2 TTPs 3 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1BC968BD4F49D622AA89A81F2150152A41D829C	tapinstall.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1BC968BD4F49D622AA89A81F2150152A41D829C\Blob = 0400000001000000100000003e455215095192e1b75d379fb187298a0f00000001000000140000005a6d07b6371d966a2fb6ba92828ce5512a49513d090000000100000068000000306606082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050508020206082b0601050507030606082b0601050507030706082b0601050507030906082b0601050507030106082b06010505070308530000000100000040000000303e301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00b000000010000003000000047006c006f00620061006c005300690067006e00200052006f006f00740020004300410020002d002000520031000000620000000100000020000000ebd41040e4bb3ec742c9e381d31ef2a41a48b6685c96e7cef3c1df6cd4331c99140000000100000014000000607b661a450d97ca89502f7d04cd34a8fffcfd4b1d00000001000000100000006ee7f3b060d10e90a31ba3471b9992367f000000010000000c000000300a06082b060105050703097a000000010000000c000000300a06082b060105050703097e00000001000000080000000000042beb77d501030000000100000014000000b1bc968bd4f49d622aa89a81f2150152a41d829c190000000100000010000000a823b4a20180beb460cab955c24d7e21200000000100000079030000308203753082025da003020102020b040000000001154b5ac394300d06092a864886f70d01010505003057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f74204341301e170d3938303930313132303030305a170d3238303132383132303030305a3057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100da0ee6998dcea3e34f8a7efbf18b83256bea481ff12ab0b9951104bdf063d1e26766cf1cddcf1b482bee8d898e9aaf298065abe9c72d12cbab1c4c7007a13d0a30cd158d4ff8ddd48c50151cef50eec42ef7fce952f2917de06dd535308e5e4373f241e9d56ae3b2893a5639386f063c88695b2a4dc5a754b86c89cc9bf93ccae5fd89f5123c927896d6dc746e934461d18dc746b2750e86e8198ad56d6cd5781695a2e9c80a38ebf224134f73549313853a1bbc1e34b58b058cb9778bb1db1f2091ab09536e90ce7b3774b97047912251631679aeb1ae412608c8192bd146aa48d6642ad78334ff2c2ac16c19434a0785e7d37cf62168efeaf2529f7f9390cf0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e04160414607b661a450d97ca89502f7d04cd34a8fffcfd4b300d06092a864886f70d01010505000382010100d673e77c4f76d08dbfecbaa2be34c52832b57cfc6c9c2c2bbd099e53bf6b5eaa1148b6e508a3b3ca3d614dd34609b33ec3a0e363551bf2baefad39e143b938a3e62f8a263befa05056f9c60afd38cdc40b705194979804dfc35f94d515c914419cc45d7564150dff5530ec868fff0def2cb96346f6aafcdfbc69fd2e1248649ae095f0a6ef298f01b115b50c1da5fe692c6924781eb3a71c7162eecac897ac175d8ac2f847866e2ac4563195d06789852bf96ca65d469d0caa82e49951dd70b7db563d61e46ae15cd6f6fe3dde41cc07ae6352bf5353f42be9c7fdb6f7825f85d24118db81b3041cc51fa4806f1520c9de0c880a1dd66655e2fc48c9292669e0	tapinstall.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1BC968BD4F49D622AA89A81F2150152A41D829C\Blob = 5c000000010000000400000000080000190000000100000010000000a823b4a20180beb460cab955c24d7e21030000000100000014000000b1bc968bd4f49d622aa89a81f2150152a41d829c7e00000001000000080000000000042beb77d5017a000000010000000c000000300a06082b060105050703097f000000010000000c000000300a06082b060105050703091d00000001000000100000006ee7f3b060d10e90a31ba3471b999236140000000100000014000000607b661a450d97ca89502f7d04cd34a8fffcfd4b620000000100000020000000ebd41040e4bb3ec742c9e381d31ef2a41a48b6685c96e7cef3c1df6cd4331c990b000000010000003000000047006c006f00620061006c005300690067006e00200052006f006f00740020004300410020002d002000520031000000530000000100000040000000303e301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000068000000306606082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050508020206082b0601050507030606082b0601050507030706082b0601050507030906082b0601050507030106082b060105050703080f00000001000000140000005a6d07b6371d966a2fb6ba92828ce5512a49513d0400000001000000100000003e455215095192e1b75d379fb187298a200000000100000079030000308203753082025da003020102020b040000000001154b5ac394300d06092a864886f70d01010505003057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f74204341301e170d3938303930313132303030305a170d3238303132383132303030305a3057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100da0ee6998dcea3e34f8a7efbf18b83256bea481ff12ab0b9951104bdf063d1e26766cf1cddcf1b482bee8d898e9aaf298065abe9c72d12cbab1c4c7007a13d0a30cd158d4ff8ddd48c50151cef50eec42ef7fce952f2917de06dd535308e5e4373f241e9d56ae3b2893a5639386f063c88695b2a4dc5a754b86c89cc9bf93ccae5fd89f5123c927896d6dc746e934461d18dc746b2750e86e8198ad56d6cd5781695a2e9c80a38ebf224134f73549313853a1bbc1e34b58b058cb9778bb1db1f2091ab09536e90ce7b3774b97047912251631679aeb1ae412608c8192bd146aa48d6642ad78334ff2c2ac16c19434a0785e7d37cf62168efeaf2529f7f9390cf0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e04160414607b661a450d97ca89502f7d04cd34a8fffcfd4b300d06092a864886f70d01010505000382010100d673e77c4f76d08dbfecbaa2be34c52832b57cfc6c9c2c2bbd099e53bf6b5eaa1148b6e508a3b3ca3d614dd34609b33ec3a0e363551bf2baefad39e143b938a3e62f8a263befa05056f9c60afd38cdc40b705194979804dfc35f94d515c914419cc45d7564150dff5530ec868fff0def2cb96346f6aafcdfbc69fd2e1248649ae095f0a6ef298f01b115b50c1da5fe692c6924781eb3a71c7162eecac897ac175d8ac2f847866e2ac4563195d06789852bf96ca65d469d0caa82e49951dd70b7db563d61e46ae15cd6f6fe3dde41cc07ae6352bf5353f42be9c7fdb6f7825f85d24118db81b3041cc51fa4806f1520c9de0c880a1dd66655e2fc48c9292669e0	tapinstall.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
2136	installproXPN.exe
2136	installproXPN.exe
2480	msedge.exe
2480	msedge.exe
4404	msedge.exe
4404	msedge.exe
4404	msedge.exe
2292	identity_helper.exe
2292	identity_helper.exe
5196	msedge.exe
5196	msedge.exe
5196	msedge.exe
5196	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
4404	msedge.exe
4404	msedge.exe
4404	msedge.exe
4404	msedge.exe
4404	msedge.exe
4404	msedge.exe
4404	msedge.exe

Suspicious use of AdjustPrivilegeToken 10 IoCs

description	pid	Process
Token: 33	372	FECN.exe
Token: SeIncBasePriorityPrivilege	372	FECN.exe
Token: SeAuditPrivilege	1252	svchost.exe
Token: SeSecurityPrivilege	1252	svchost.exe
Token: SeLoadDriverPrivilege	2728	tapinstall.exe
Token: SeRestorePrivilege	2432	DrvInst.exe
Token: SeBackupPrivilege	2432	DrvInst.exe
Token: SeLoadDriverPrivilege	2432	DrvInst.exe
Token: SeLoadDriverPrivilege	2432	DrvInst.exe
Token: SeLoadDriverPrivilege	2432	DrvInst.exe

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
3084	proxpn.exe
4404	msedge.exe
4404	msedge.exe
4404	msedge.exe
4404	msedge.exe
4404	msedge.exe
4404	msedge.exe
4404	msedge.exe
4404	msedge.exe
4404	msedge.exe
4404	msedge.exe
4404	msedge.exe
4404	msedge.exe
4404	msedge.exe
4404	msedge.exe
4404	msedge.exe
4404	msedge.exe
4404	msedge.exe
4404	msedge.exe
4404	msedge.exe
4404	msedge.exe
4404	msedge.exe
4404	msedge.exe
4404	msedge.exe
4404	msedge.exe
4404	msedge.exe

Suspicious use of SendNotifyMessage 25 IoCs

pid	Process
3084	proxpn.exe
4404	msedge.exe
4404	msedge.exe
4404	msedge.exe
4404	msedge.exe
4404	msedge.exe
4404	msedge.exe
4404	msedge.exe
4404	msedge.exe
4404	msedge.exe
4404	msedge.exe
4404	msedge.exe
4404	msedge.exe
4404	msedge.exe
4404	msedge.exe
4404	msedge.exe
4404	msedge.exe
4404	msedge.exe
4404	msedge.exe
4404	msedge.exe
4404	msedge.exe
4404	msedge.exe
4404	msedge.exe
4404	msedge.exe
4404	msedge.exe

Suspicious use of SetWindowsHookEx 7 IoCs

pid	Process
372	FECN.exe
372	FECN.exe
372	FECN.exe
372	FECN.exe
372	FECN.exe
3084	proxpn.exe
3084	proxpn.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3188 wrote to memory of 372	3188	JaffaCakes118_8e00e54479d218e50a55e497c2600948.exe	85
PID 3188 wrote to memory of 372	3188	JaffaCakes118_8e00e54479d218e50a55e497c2600948.exe	85
PID 3188 wrote to memory of 372	3188	JaffaCakes118_8e00e54479d218e50a55e497c2600948.exe	85
PID 3188 wrote to memory of 2136	3188	JaffaCakes118_8e00e54479d218e50a55e497c2600948.exe	87
PID 3188 wrote to memory of 2136	3188	JaffaCakes118_8e00e54479d218e50a55e497c2600948.exe	87
PID 3188 wrote to memory of 2136	3188	JaffaCakes118_8e00e54479d218e50a55e497c2600948.exe	87
PID 2136 wrote to memory of 3092	2136	installproXPN.exe	92
PID 2136 wrote to memory of 3092	2136	installproXPN.exe	92
PID 2136 wrote to memory of 3952	2136	installproXPN.exe	94
PID 2136 wrote to memory of 3952	2136	installproXPN.exe	94
PID 2136 wrote to memory of 3380	2136	installproXPN.exe	96
PID 2136 wrote to memory of 3380	2136	installproXPN.exe	96
PID 2136 wrote to memory of 3380	2136	installproXPN.exe	96
PID 2136 wrote to memory of 2728	2136	installproXPN.exe	97
PID 2136 wrote to memory of 2728	2136	installproXPN.exe	97
PID 3380 wrote to memory of 4816	3380	cmd.exe	100
PID 3380 wrote to memory of 4816	3380	cmd.exe	100
PID 3380 wrote to memory of 4816	3380	cmd.exe	100
PID 1252 wrote to memory of 1276	1252	svchost.exe	102
PID 1252 wrote to memory of 1276	1252	svchost.exe	102
PID 1276 wrote to memory of 3376	1276	DrvInst.exe	104
PID 1276 wrote to memory of 3376	1276	DrvInst.exe	104
PID 1252 wrote to memory of 2432	1252	svchost.exe	105
PID 1252 wrote to memory of 2432	1252	svchost.exe	105
PID 2136 wrote to memory of 2420	2136	installproXPN.exe	109
PID 2136 wrote to memory of 2420	2136	installproXPN.exe	109
PID 2136 wrote to memory of 2420	2136	installproXPN.exe	109
PID 2136 wrote to memory of 3084	2136	installproXPN.exe	111
PID 2136 wrote to memory of 3084	2136	installproXPN.exe	111
PID 2136 wrote to memory of 3084	2136	installproXPN.exe	111
PID 2136 wrote to memory of 4404	2136	installproXPN.exe	113
PID 2136 wrote to memory of 4404	2136	installproXPN.exe	113
PID 4404 wrote to memory of 5028	4404	msedge.exe	114
PID 4404 wrote to memory of 5028	4404	msedge.exe	114
PID 3084 wrote to memory of 2576	3084	proxpn.exe	115
PID 3084 wrote to memory of 2576	3084	proxpn.exe	115
PID 3084 wrote to memory of 2576	3084	proxpn.exe	115
PID 4404 wrote to memory of 3652	4404	msedge.exe	117
PID 4404 wrote to memory of 3652	4404	msedge.exe	117
PID 4404 wrote to memory of 3652	4404	msedge.exe	117
PID 4404 wrote to memory of 3652	4404	msedge.exe	117
PID 4404 wrote to memory of 3652	4404	msedge.exe	117
PID 4404 wrote to memory of 3652	4404	msedge.exe	117
PID 4404 wrote to memory of 3652	4404	msedge.exe	117
PID 4404 wrote to memory of 3652	4404	msedge.exe	117
PID 4404 wrote to memory of 3652	4404	msedge.exe	117
PID 4404 wrote to memory of 3652	4404	msedge.exe	117
PID 4404 wrote to memory of 3652	4404	msedge.exe	117
PID 4404 wrote to memory of 3652	4404	msedge.exe	117
PID 4404 wrote to memory of 3652	4404	msedge.exe	117
PID 4404 wrote to memory of 3652	4404	msedge.exe	117
PID 4404 wrote to memory of 3652	4404	msedge.exe	117
PID 4404 wrote to memory of 3652	4404	msedge.exe	117
PID 4404 wrote to memory of 3652	4404	msedge.exe	117
PID 4404 wrote to memory of 3652	4404	msedge.exe	117
PID 4404 wrote to memory of 3652	4404	msedge.exe	117
PID 4404 wrote to memory of 3652	4404	msedge.exe	117
PID 4404 wrote to memory of 3652	4404	msedge.exe	117
PID 4404 wrote to memory of 3652	4404	msedge.exe	117
PID 4404 wrote to memory of 3652	4404	msedge.exe	117
PID 4404 wrote to memory of 3652	4404	msedge.exe	117
PID 4404 wrote to memory of 3652	4404	msedge.exe	117
PID 4404 wrote to memory of 3652	4404	msedge.exe	117
PID 4404 wrote to memory of 3652	4404	msedge.exe	117

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_8e00e54479d218e50a55e497c2600948.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_8e00e54479d218e50a55e497c2600948.exe"
1⤵
- Checks computer location settings
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3188
- C:\Windows\SysWOW64\28463\FECN.exe
  "C:\Windows\system32\28463\FECN.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:372
- C:\Users\Admin\AppData\Local\Temp\installproXPN.exe
  "C:\Users\Admin\AppData\Local\Temp\installproXPN.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2136
- - C:\Program Files (x86)\proXPN\bin\tapinstall.exe
    "C:\Program Files (x86)\proXPN\bin\tapinstall.exe" hwids tap0901
    3⤵
    - Executes dropped EXE
    - Checks SCSI registry key(s)
    PID:3092
- - C:\Program Files (x86)\proXPN\bin\tapinstall.exe
    "C:\Program Files (x86)\proXPN\bin\tapinstall.exe" remove TAP0801
    3⤵
    - Executes dropped EXE
    - Checks SCSI registry key(s)
    PID:3952
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /C "C:\Program Files (x86)\proXPN\bin\btnClick.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3380
  - - C:\Program Files (x86)\proXPN\bin\btnClick.exe
      "C:\Program Files (x86)\proXPN\bin\btnClick.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:4816
- - C:\Program Files (x86)\proXPN\bin\tapinstall.exe
    "C:\Program Files (x86)\proXPN\bin\tapinstall.exe" install "C:\Program Files (x86)\proXPN\driver\OemWin2k.inf" tap0901
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - Drops file in Windows directory
    - Checks SCSI registry key(s)
    - Modifies system certificate store
    - Suspicious use of AdjustPrivilegeToken
    PID:2728
- - C:\Program Files (x86)\proXPN\bin\openvpnserv.exe
    "C:\Program Files (x86)\proXPN\bin\openvpnserv.exe" -install
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2420
- - C:\Program Files (x86)\proXPN\bin\proxpn.exe
    "C:\Program Files (x86)\proXPN\bin\proxpn.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3084
  - - C:\Program Files (x86)\proXPN\bin\openvpn.exe
      openvpn --version
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      PID:2576
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.proxpn.com/welcome.php
    3⤵
    - Enumerates system info in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:4404
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffbd7e146f8,0x7ffbd7e14708,0x7ffbd7e14718
      4⤵
      PID:5028
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2008,12245907718354151992,12198797491090208724,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2104 /prefetch:2
      4⤵
      PID:3652
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2008,12245907718354151992,12198797491090208724,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2256 /prefetch:3
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:2480
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2008,12245907718354151992,12198797491090208724,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2800 /prefetch:8
      4⤵
      PID:3564
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,12245907718354151992,12198797491090208724,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:1
      4⤵
      PID:1808
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,12245907718354151992,12198797491090208724,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:1
      4⤵
      PID:3464
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,12245907718354151992,12198797491090208724,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4176 /prefetch:1
      4⤵
      PID:3332
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2008,12245907718354151992,12198797491090208724,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3536 /prefetch:8
      4⤵
      PID:552
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2008,12245907718354151992,12198797491090208724,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3536 /prefetch:8
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:2292
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,12245907718354151992,12198797491090208724,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5340 /prefetch:1
      4⤵
      PID:3448
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,12245907718354151992,12198797491090208724,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5376 /prefetch:1
      4⤵
      PID:3492
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,12245907718354151992,12198797491090208724,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5612 /prefetch:1
      4⤵
      PID:3188
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,12245907718354151992,12198797491090208724,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5564 /prefetch:1
      4⤵
      PID:3472
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2008,12245907718354151992,12198797491090208724,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2240 /prefetch:2
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:5196

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall
1⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1252
- C:\Windows\system32\DrvInst.exe
  DrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{e1fbdd5c-f751-4c4f-a95c-2d16422d2f66}\oemwin2k.inf" "9" "4d14a44ff" "00000000000000E8" "WinSta0\Default" "0000000000000158" "208" "c:\program files (x86)\proxpn\driver"
  2⤵
  - Manipulates Digital Signatures
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Checks SCSI registry key(s)
  - Modifies data under HKEY_USERS
  - Suspicious use of WriteProcessMemory
  PID:1276
- - C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Windows\system32\pnpui.dll,InstallSecurityPromptRunDllW 20 Global\{81932737-2ac4-f940-a012-ae8d286570f3} Global\{91711536-bd22-1b40-a895-f96591482b39} C:\Windows\System32\DriverStore\Temp\{2799633f-2d4a-cd4d-bfcf-6cb65d0f0dbe}\oemwin2k.inf C:\Windows\System32\DriverStore\Temp\{2799633f-2d4a-cd4d-bfcf-6cb65d0f0dbe}\tap0901.cat
    3⤵
    PID:3376
- C:\Windows\system32\DrvInst.exe
  DrvInst.exe "2" "211" "ROOT\NET\0000" "C:\Windows\INF\oem3.inf" "oem3.inf:3beb73aff103cc24:tap0901.ndi:9.0.0.6:tap0901," "4d14a44ff" "00000000000000E8"
  2⤵
  - Drops file in Drivers directory
  - Drops file in Windows directory
  - Checks SCSI registry key(s)
  - Suspicious use of AdjustPrivilegeToken
  PID:2432

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2888

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2852

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\proXPN\bin\btnClick.exe

Filesize
54KB

MD5
bdbce667e0e2c0fc6ee8527a8b9067f1

SHA1
53d7f8bb0f879a5a585f35286a1f704629187834

SHA256
92538581fefce7e7dd87b03ca5450838a80c4d4698f36d7a66005014a49dcd65

SHA512
d9367c3949c9bd390210d35b3b0e9a9a6d016233d27d9f41dcaf3373b1c9a0297a9158c6a36405d058363c833dc7880593e036c871ba17eb050c6f0ffcb1d3d4

Download Submit
C:\Program Files (x86)\proXPN\bin\openvpn.exe

Filesize
549KB

MD5
0675e33d9f2cacb709c0a9af9e7e5bcc

SHA1
03e3095862e4939dda84ca3b50a2e74d7b8e423a

SHA256
362882c367059c5c661b939eb8e7966ae39c0308c47e9b4ac25cb62983a9f45e

SHA512
7a440e2fca560329e61a7e8f4d8a65a1876f90a8062e7801bf98b290292abe8f33cc8f96a2c87ab2e5034caa2fa19c6c27c1a11f284131b99331294364f3d0f5

Download Submit
C:\Program Files (x86)\proXPN\bin\openvpnserv.exe

Filesize
37KB

MD5
2f5e931dd8a7b59489ff88728038fdf7

SHA1
d66bcf3fbc99223e0d5708494a4b53cb29391740

SHA256
743f8313c4d555eea132b1723293c6b13bb8334c73cc67332a0de10fbef3ea01

SHA512
bf783492e3f6fce106ea83ae521c4521e34d95eae51fb842502251a7ac97ee5620ed0870c173bd5a95b0e46ae5e8857e1b285045c20a558610261758741f1ce8

Download Submit
C:\Program Files (x86)\proXPN\bin\proxpn.exe

Filesize
362KB

MD5
7a27f934d89e8bca8b7351ad5aeac2e4

SHA1
a8e8d5150ce6dc7feb8c34686aa8369d28eca249

SHA256
96e55bdd301179b41a45fe6daa3c4364efb30aaacaca34e72f6f3cf25492d29d

SHA512
b57c8227f86462ebb906afa256c312671721d38bbc946f6ab72509c54a8d8f77bfb9b2bcb356f087755211e2815df8ff2c628d89247d3c677fb2c786432ea553

Download Submit
C:\Program Files (x86)\proXPN\bin\tapinstall.exe

Filesize
79KB

MD5
71b58b474574001931ad5d6544509c71

SHA1
972396bdd1d146ad2cf688c5c0970bcd66fbb3ae

SHA256
cfa31dd6804a494485a5c77b62165bc6f6449725ca33c1f7900aa7cbfcfabadd

SHA512
3decbf576eb39cd8ba891d3049a893ffb9ad516e3b7aafbaa592af87bb88854a136e9ec09bd7754b9f8e1f3401aeee2d4d40a018859eea1d8b3093c0c621a4a6

Download Submit
C:\Program Files (x86)\proXPN\driver\OemWin2k.inf

Filesize
7KB

MD5
d953442fee4713903dc02555e1e7fb86

SHA1
999ab309c9e376cbb83c50742f055e6242faf917

SHA256
34ce83af313815de5a8cc2464d89ad214628a42bd20cfee3ce9bec4e3cef0f3e

SHA512
c234b886b2c4106916ba5247177f717c3b6cfaa8a3117700d424fd988801673d0e89ac5ff6ea034529112aa669d3dce5cc1cddfa266ead2d11436d8055ae93a6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
8ea156392347ae1e43bf6f4c7b7bc6ec

SHA1
7e1230dd6103043d1c5d9984384f93dab02500a6

SHA256
40b28bf59b3e2026ad3ebe2fecf464a03d7094fd9b26292477ad264d4efc1c75

SHA512
2479b86a9a31aa2f260ff6a1c963691994242ced728a27ffa2ee4e224945446a191bdb49ce399ec5a7d5d362499716133072e97d4253b5b4f09582d58b25144f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a7b5a5433fe76697fec05973806a648c

SHA1
786027abe836d4d8ff674c463e5bb02c4a957b70

SHA256
c8d623536ebdf5ffbefb84013d1c8ff5f853b59f1b09c80364c32b8ed5e4a735

SHA512
27be4c82e26468bbb9ce698ef305320f6cac46c953f88c714a0372fa524d098b9af2a87a88b14a134ff0f5f4b3d671902908622d2c7ec48e2c7bc458d7f5cc16

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
672B

MD5
90ba35139dd68fa10de27221b81c4064

SHA1
677ec44dcb62bda90dd62fbaa12330a5223fa3e1

SHA256
65b887f47cd1b48b23014cfd4363c8275963e481f5aa03b63cafb081e41f94e5

SHA512
19dee2751daeaefd675b4618b7c4497472e57b21986295f580bb087c76f6f6e003bfe3ea8b54be5a5844b4ce5f4e2482e7a38de040861dbf91c681c639839034

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
fa507aa43f7f9599218a63e2eedda735

SHA1
2dd9b877f5903222f0f0c640b257f9ef9c5e91f9

SHA256
3df48bef6c4e2723a126091434f68ddbc1de4aacdceb159bf9e8d4471a21bc16

SHA512
809e8a7d4457ca704c0fc8915996a79d639d7db7e3b677d421cea116b9d1b4a4d2bbc2ba88356217345c1024c446e5b77535b182acc2fdfa9436c577336f4a3c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
86558afb5def577f48dd321e5fd6a83a

SHA1
108cc4d1f1287857f1e2d1be8950389981e137f9

SHA256
5a9cc43486895fb443c3dcefa726af8cc9409aa8de493f08088b74cc011b2096

SHA512
a96e3e1ef8465a887dabd34ecb831fd5ce79dcd71ba58135197e6fae4a0a583307183fdf5de76ac5a40870be2bdd16296a33bb3b71d51fe2cebfe3edfb95830b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
e840656f9c4b3238379cfa8753dbbb96

SHA1
706a029dffe51c854462643f24303d5a23a6ae43

SHA256
a0aab170479cbaeb7fa037c5520f6ba7295ee6711ab00d23e32a8589d77e61df

SHA512
37ede6e8f8eb3c016cbaa410d9d63d2da7415ee19a4602922f5907a739a2d97e1325696111269de7d428c547a1a3d5e3efeee9546d0af74d34b0d6eea2928a41

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
355255563d32597724ff607b354448f7

SHA1
ec94409ecf755d179a24a410d96979d2ea48e1be

SHA256
9e5d180b7326d2a2b81659faadc0feccf23c09492b3ea2664a0e7b643c7d6d25

SHA512
80db4c109773f68c8d9398f00f80ea6a2a9439b275ea3f3ec8c0286912d148fc3c7d9dc66b0c6764ebfbc0c420c07c80c872ed30951febca61b4bb85baed9d01

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
e33a7799a7f7a06115d29532f875d390

SHA1
85834d452683165c3215be0b9503a5ed809f0232

SHA256
230d284ef9552456db2c8f525e5ec204c9bcf5a94f0ccf5e70dd94b419a65be6

SHA512
4e04ec14007e6f9efbbdaf54ca99c700c058c9fa54b604df96fa4e774999c00246760714384b971ba70531917a4f5e6a42f2055657403ceac012136660e83e17

Download Submit
C:\Users\Admin\AppData\Local\Temp\@A4DB.tmp

Filesize
4KB

MD5
c3679c3ff636d1a6b8c65323540da371

SHA1
d184758721a426467b687bec2a4acc80fe44c6f8

SHA256
d4eba51c616b439a8819218bddf9a6fa257d55c9f04cf81441cc99cc945ad3eb

SHA512
494a0a32eef4392ecb54df6e1da7d93183473c4e45f4ac4bd6ec3b0ed8c85c58303a0d36edec41420d05ff624195f08791b6b7e018419a3251b7e71ec9b730e7

Download Submit
C:\Users\Admin\AppData\Local\Temp\installproXPN.exe

Filesize
1.9MB

MD5
127d0e5d0b52e29ada64dc643e2777a4

SHA1
0390594cb90184d481fc40aa1dfb4918d400d3ad

SHA256
ce18741a4a107f19e060bf1a3bf3b3e76af98e021d9ed7181e39dd1a6989118a

SHA512
2699ce34ced284604c577d145c76da357d1c9e665d8e932921b1f75677ad11981a84cd546465dcd0a368d44fbd2b71d4bae3834d840159ee43853460afa84b33

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsiA79B.tmp\ExecCmd.dll

Filesize
4KB

MD5
b9380b0bea8854fd9f93cc1fda0dfeac

SHA1
edb8d58074e098f7b5f0d158abedc7fc53638618

SHA256
1f4bd9c9376fe1b6913baeca7fb6df6467126f27c9c2fe038206567232a0e244

SHA512
45c3ab0f2bce53b75e72e43bac747dc0618342a3f498be8e2eb62a6db0b137fcdb1735da83051b14824996b5287109aa831e5859d6f21f0ed21b76b3d335418c

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsiA79B.tmp\InstallOptions.dll

Filesize
14KB

MD5
325b008aec81e5aaa57096f05d4212b5

SHA1
27a2d89747a20305b6518438eff5b9f57f7df5c3

SHA256
c9cd5c9609e70005926ae5171726a4142ffbcccc771d307efcd195dafc1e6b4b

SHA512
18362b3aee529a27e85cc087627ecf6e2d21196d725f499c4a185cb3a380999f43ff1833a8ebec3f5ba1d3a113ef83185770e663854121f2d8b885790115afdf

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsiA79B.tmp\System.dll

Filesize
11KB

MD5
c17103ae9072a06da581dec998343fc1

SHA1
b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d

SHA256
dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f

SHA512
d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsiA79B.tmp\UserInfo.dll

Filesize
4KB

MD5
7579ade7ae1747a31960a228ce02e666

SHA1
8ec8571a296737e819dcf86353a43fcf8ec63351

SHA256
564c80dec62d76c53497c40094db360ff8a36e0dc1bda8383d0f9583138997f5

SHA512
a88bc56e938374c333b0e33cb72951635b5d5a98b9cb2d6785073cbcad23bf4c0f9f69d3b7e87b46c76eb03ced9bb786844ce87656a9e3df4ca24acf43d7a05b

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsiA79B.tmp\ioSpecial.ini

Filesize
756B

MD5
1f1f5a67ae9b2c37f57c69ccc770ef65

SHA1
fde1d534854719ca89bcc1a084e88882c7e6af6b

SHA256
afc284d4e2aa858eac4515a9bda74b5a8b4897260b36fb8d0486e920db3ec9a2

SHA512
0b0a9e48d6bfdb8987d74555e7663f610f7d5578aa69fc0165c29452f91326fd36bd329ccfb08792a71fbc84160814d6e165494b97e47839a0e93573f929d449

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsiA79B.tmp\ioSpecial.ini

Filesize
782B

MD5
462cad5432cc551b5d4eb9d4a1c30aa0

SHA1
9c5d6cee13f604908df0abfda1e01ec36485271a

SHA256
df66bdfe228aef31fcaec098754d1798ef010b05a2d5758fd4574390e5d1893a

SHA512
0b3cdadfc945079c61074e59b15eddb1fc781b69b5a358017028159424a5646377ea36e9150d4d08ca0b33c8e735ffa5ac7cba2fa20869f5ce960ffca75bbf87

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsiA79B.tmp\ioSpecial.ini

Filesize
596B

MD5
bfab1017aea36e1b732e3e6d2335ff9e

SHA1
b16375d9e7b3dd124bfe693e072152006708e92c

SHA256
aacead04217cf470e232d7211fc8c177aaf044135a2da1e81db0188fbcc5fa83

SHA512
530fe2d798720b3f6c9b16ce7b0b8a3371cd65f293793cd267e1e1892f0c4d895447f5185e4b2f21d34c6cdde72189cd70e79008a65cf65faafb5ecad233b893

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsiA79B.tmp\nsExec.dll

Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsiA79B.tmp\processwork.dll

Filesize
231KB

MD5
0a4fa7a9ba969a805eb0603c7cfe3378

SHA1
0f018a8d5b42c6ce8bf34b4a6422861c327af88c

SHA256
27329ea7002d9ce81c8e28e97a5c761922097b33cedeada4db30d2b9d505007c

SHA512
e13e29712457d5e6351bfd69cba6320795d8b2fd1a047923814f8699f7188ec730ec7f0d946fdff66c8b430fef011415ed045b6ea56e4cc0b1d010171ab88178

Download Submit
C:\Windows\SysWOW64\28463\AKV.exe

Filesize
395KB

MD5
b8fa30233794772b8b76b4b1d91c7321

SHA1
0cf9561be2528944285e536f41d502be24c3aa87

SHA256
14116fa79ccc105fabd312b4dff74933f8684c6b27db37e5e3a79d159092d29a

SHA512
10ce8b18e7afb8c7e30bb90b0a1f199ef0b77873fa7a9efc596606e151be6b516c0ec6222a9032bdcc527e80964f53d20a28fa1881a08b4df303b2e28204549d

Download Submit
C:\Windows\SysWOW64\28463\FECN.001

Filesize
608B

MD5
7a2259671d52f20636e5e256e102ad25

SHA1
a58bf4d2e2af1cb9ddae72872a112121afbf7956

SHA256
9fe90b4d93ebda05b769bdbb1b42d33c69e6c7539660a3da55ad0f8b630cb144

SHA512
e521f1c157afe0302ae47538afe6e7fa3cc53fd5cace36e64fb55f4fe5cc7cb12afee14c43611e5eae32785a9ede7b0eb9ee3e6a376758c4efaff04eaba52920

Download Submit
C:\Windows\SysWOW64\28463\FECN.006

Filesize
8KB

MD5
43f02e9974b1477c1e6388882f233db0

SHA1
f3e27b231193f8d5b2e1b09d05ae3a62795cf339

SHA256
3c9e56e51d5a7a1b9aefe853c12a98bf246039aa46db94227ea128f6331782ba

SHA512
e22d14735606fe75ee5e55204807c3f5531d3e0c4f63aa4a3b2d4bb6abda6128c7e2816753f2e64400ac6dae8f8ef1e013a7a464dff2a79ad9937c48821a067f

Download Submit
C:\Windows\SysWOW64\28463\FECN.007

Filesize
5KB

MD5
b5a87d630436f958c6e1d82d15f98f96

SHA1
d3ff5e92198d4df0f98a918071aca53550bf1cff

SHA256
a895ad4d23e8b2c2dc552092f645ca309e62c36d4721ebfe7afd2eee7765d4b2

SHA512
fd7bae85a86bdaa12fec826d1d38728a90e2037cb3182ad7652d8a9f54c4b322734c587b62221e6f907fce24fcf2e0ae4cce1f5e3d8861661064b4da24bd87ce

Download Submit
C:\Windows\SysWOW64\28463\FECN.exe

Filesize
473KB

MD5
17535dddecf8cb1efdba1f1952126547

SHA1
a862a9a3eb6c201751be1038537522a5281ea6cb

SHA256
1a3d28ac6359e58aa656f4734f9f36b6c09badadcf9fb900b9b118d90c38a9dd

SHA512
b4f31b552ab3bb3dafa365aa7a31f58674ae7ee82ce1d23457f2e7047431430b00abb3b5498491725639daf583b526b278a737168cfdc4e9ec796dfbc14a53d8

Download Submit
\??\c:\PROGRA~2\proxpn\driver\tap0901.sys

Filesize
30KB

MD5
bcd6a90d6fd757ce9c29ddc850f7f231

SHA1
cc9efa6bf9a2771171adf811cc2baebe840f5f30

SHA256
8e736a42b28be11ec524c40dfa1c7a88bbe10cbc97320f128bcbe44051bbcc81

SHA512
31de1268442df3fb4f989493b2ffc0353a90365ed60518fabd09015535233b657602030688859a8c7e686930e6e72be6dda02df9f94a5b7618803d92873485dc

Download Submit
\??\c:\program files (x86)\proxpn\driver\tap0901.cat

Filesize
8KB

MD5
b412ed92dec74dc0d024b7b5890b1511

SHA1
6320565f77672cf60681fe470dd3893c0679827f

SHA256
969bcc92ab18061648735d3202ccfc68cba240547abdf41c834a0ab1d12e79d3

SHA512
4ddcc6973f1fba1258d5c85a6517d2f3122307a5a2613bda22a1c2791cc1f686773034905a0bacbacc00e49e9c11a2d3fd6868f721879edb4d88ea3e575e4cc9

Download Submit
memory/372-135-0x0000000000A70000-0x0000000000A71000-memory.dmp

Filesize
4KB

Download
memory/372-26-0x0000000000A70000-0x0000000000A71000-memory.dmp

Filesize
4KB

Download
memory/2136-283-0x00000000031D0000-0x0000000003211000-memory.dmp

Filesize
260KB

Download
memory/2420-270-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download
memory/2576-444-0x0000000000400000-0x000000000048E000-memory.dmp

Filesize
568KB

Download
memory/2576-446-0x000000006B080000-0x000000006B0BD000-memory.dmp

Filesize
244KB

Download
memory/2576-445-0x0000000061D80000-0x0000000061EAD000-memory.dmp

Filesize
1.2MB

Download