5bb68633076169fd46824109adfbc6377d121619fdd6ae927e3ed1d87e1eaa22

Analysis

max time kernel
149s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
21/04/2026, 03:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
5bb68633076169fd46824109adfbc6377d121619fdd6ae927e3ed1d87e1eaa22.exe
Size 8.2MB
Sample260421-d77tlabs2y
SHA256 5bb68633076169fd46824109adfbc6377d121619fdd6ae927e3ed1d87e1eaa22
MD5 1907928d631acc677ff6ed74bd7a280d
SHA1 7af0221ddf889c391e27327c7ee2a5099d67f5d3
SHA512 bdd10d21a302a93ca4fef5c4e669dac3cdd632e80218e1edbf4f489fae4a435bece08e8d8bd3455d8b9662a2699acab590054b2151a6ec22fc96e4b07ea1ff7a
SSDEEP 196608:wHgRB7RMewAbCg9IjhYkmWyRtU+BP9JunV:g9ew6jIyU2vuV
TLSH
T11486233FF268613ED56A1B3105738210A97BBE61B81A8C1A17FC344DCF775602E3B65A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery installer

Malware Config

Signatures

Executes dropped EXE 4 IoCs

pid	Process
3852	5bb68633076169fd46824109adfbc6377d121619fdd6ae927e3ed1d87e1eaa22.tmp
3824	WifiAutoInstallSrv.exe
3372	WifiAutoInstallSrv.exe
1964	WifiAutoInstallDriver.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in System32 directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\DriverStore\Temp\{8f5af59e-0617-5548-9028-bc06b3e2b730}\SET6F97.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\netrtwlanu6.inf_amd64_815ff138ae32bbbc\TXPWR_ByRate_Enc.txt	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{fc11ada4-36fe-9a46-ac1e-bb497294f872}\SET75A8.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{fc11ada4-36fe-9a46-ac1e-bb497294f872}\RtkFilter.cat	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{fc11ada4-36fe-9a46-ac1e-bb497294f872}\SET75DC.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{fc11ada4-36fe-9a46-ac1e-bb497294f872}\SET75BB.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{8f5af59e-0617-5548-9028-bc06b3e2b730}\SET6EE9.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{8f5af59e-0617-5548-9028-bc06b3e2b730}\SET6C03.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{8f5af59e-0617-5548-9028-bc06b3e2b730}\SET6CE0.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{8f5af59e-0617-5548-9028-bc06b3e2b730}\SET6E1D.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\netrtwlanu6.inf_amd64_815ff138ae32bbbc\netrtwlanu6.inf	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\rtkfilter.inf_amd64_ae91074d1fb1f511\Rtkfilter.inf	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{8f5af59e-0617-5548-9028-bc06b3e2b730}\SET6E1D.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{8f5af59e-0617-5548-9028-bc06b3e2b730}\SET6F86.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\CatRoot2\dberr.txt	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{fc11ada4-36fe-9a46-ac1e-bb497294f872}\SET75BA.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\rtkfilter.inf_amd64_ae91074d1fb1f511\RtkBtfilter.sys	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{8f5af59e-0617-5548-9028-bc06b3e2b730}\SET6D8F.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{8f5af59e-0617-5548-9028-bc06b3e2b730}\RTUWPUsbSwExt.dll	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{8f5af59e-0617-5548-9028-bc06b3e2b730}\SET6F86.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\netrtwlanu6.inf_amd64_815ff138ae32bbbc\RTUWPWlanExt.dll	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\netrtwlanu6.inf_amd64_815ff138ae32bbbc\TXPWR_LMT_Enc.txt	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{8f5af59e-0617-5548-9028-bc06b3e2b730}\SET6CF2.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{fc11ada4-36fe-9a46-ac1e-bb497294f872}\SET75BC.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{8f5af59e-0617-5548-9028-bc06b3e2b730}\TXPWR_ByRate_Enc.txt	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{8f5af59e-0617-5548-9028-bc06b3e2b730}\rtwlanu6.sys	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{8f5af59e-0617-5548-9028-bc06b3e2b730}\RTUWPSrvcMain.exe	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\netrtwlanu6.inf_amd64_815ff138ae32bbbc\RTUWPSrvcMain.exe	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\netrtwlanu6.inf_amd64_815ff138ae32bbbc\RTUWPUsbSwExt.dll	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{fc11ada4-36fe-9a46-ac1e-bb497294f872}\SET75BA.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\drvstore.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{fc11ada4-36fe-9a46-ac1e-bb497294f872}	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{8f5af59e-0617-5548-9028-bc06b3e2b730}\Rtlihvs.dll	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{8f5af59e-0617-5548-9028-bc06b3e2b730}\SET6CF2.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{8f5af59e-0617-5548-9028-bc06b3e2b730}\SET6EE9.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{8f5af59e-0617-5548-9028-bc06b3e2b730}\SET6C03.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{8f5af59e-0617-5548-9028-bc06b3e2b730}\SET6C04.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{fc11ada4-36fe-9a46-ac1e-bb497294f872}\PidVid_List.dat	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{8f5af59e-0617-5548-9028-bc06b3e2b730}\netrtwlanu6.cat	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{8f5af59e-0617-5548-9028-bc06b3e2b730}\SET6CE0.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{8f5af59e-0617-5548-9028-bc06b3e2b730}\SET6D8F.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\drvstore.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\netrtwlanu6.inf_amd64_815ff138ae32bbbc\RTUWPSrvcLib.dll	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\netrtwlanu6.inf_amd64_815ff138ae32bbbc\netrtwlanu6.cat	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{8f5af59e-0617-5548-9028-bc06b3e2b730}	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{fc11ada4-36fe-9a46-ac1e-bb497294f872}\SET75B9.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{8f5af59e-0617-5548-9028-bc06b3e2b730}\SET6C04.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{8f5af59e-0617-5548-9028-bc06b3e2b730}\RTUWPSrvcLib.dll	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{fc11ada4-36fe-9a46-ac1e-bb497294f872}\RtkBtfilter.sys	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{fc11ada4-36fe-9a46-ac1e-bb497294f872}\SET75BC.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{fc11ada4-36fe-9a46-ac1e-bb497294f872}\Rtkfilter.inf	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\netrtwlanu6.inf_amd64_815ff138ae32bbbc\rtwlanu6.sys	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{fc11ada4-36fe-9a46-ac1e-bb497294f872}\SET75B9.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{fc11ada4-36fe-9a46-ac1e-bb497294f872}\SET75DC.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\rtkfilter.inf_amd64_ae91074d1fb1f511\rtl8851b_bt_fw_rom_patch.dat	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\rtkfilter.inf_amd64_ae91074d1fb1f511\RtkFilter.cat	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{8f5af59e-0617-5548-9028-bc06b3e2b730}\SET6CE1.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{8f5af59e-0617-5548-9028-bc06b3e2b730}\SET6F97.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{fc11ada4-36fe-9a46-ac1e-bb497294f872}\SET75A8.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{fc11ada4-36fe-9a46-ac1e-bb497294f872}\rtl8851b_bt_fw_rom_patch.dat	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\rtkfilter.inf_amd64_ae91074d1fb1f511\RtkBtManServ.exe	DrvInst.exe
File opened for modification	C:\Windows\System32\CatRoot2\dberr.txt	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{8f5af59e-0617-5548-9028-bc06b3e2b730}\SET6CE1.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{8f5af59e-0617-5548-9028-bc06b3e2b730}\TXPWR_LMT_Enc.txt	DrvInst.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\MERCUSYS\MA60XHB\WifiAutoInstall\Driver\Win10X64\RTUWPWlanExt.dll	5bb68633076169fd46824109adfbc6377d121619fdd6ae927e3ed1d87e1eaa22.tmp
File opened for modification	C:\Program Files\MERCUSYS\MA60XHB\WifiAutoInstall\X64\WifiAutoInstallDriver.exe	5bb68633076169fd46824109adfbc6377d121619fdd6ae927e3ed1d87e1eaa22.tmp
File created	C:\Program Files\MERCUSYS\MA60XHB\WifiAutoInstall\is-A25JO.tmp	5bb68633076169fd46824109adfbc6377d121619fdd6ae927e3ed1d87e1eaa22.tmp
File created	C:\Program Files\MERCUSYS\MA60XHB\WifiAutoInstall\Bluetooth\x64\is-J936L.tmp	5bb68633076169fd46824109adfbc6377d121619fdd6ae927e3ed1d87e1eaa22.tmp
File created	C:\Program Files\MERCUSYS\MA60XHB\WifiAutoInstall\Driver\Win11\is-D7V3O.tmp	5bb68633076169fd46824109adfbc6377d121619fdd6ae927e3ed1d87e1eaa22.tmp
File opened for modification	C:\Program Files\MERCUSYS\MA60XHB\WifiAutoInstall\WifiAutoInstallSrv.exe	5bb68633076169fd46824109adfbc6377d121619fdd6ae927e3ed1d87e1eaa22.tmp
File opened for modification	C:\Program Files\MERCUSYS\MA60XHB\WifiAutoInstall\Driver\Win10X86\RTUWPUsbSwExt.dll	5bb68633076169fd46824109adfbc6377d121619fdd6ae927e3ed1d87e1eaa22.tmp
File created	C:\Program Files\MERCUSYS\MA60XHB\WifiAutoInstall\is-445VS.tmp	5bb68633076169fd46824109adfbc6377d121619fdd6ae927e3ed1d87e1eaa22.tmp
File created	C:\Program Files\MERCUSYS\MA60XHB\WifiAutoInstall\Driver\Win10X64\is-9907B.tmp	5bb68633076169fd46824109adfbc6377d121619fdd6ae927e3ed1d87e1eaa22.tmp
File created	C:\Program Files\MERCUSYS\MA60XHB\WifiAutoInstall\Driver\Win10X86\is-8RL6T.tmp	5bb68633076169fd46824109adfbc6377d121619fdd6ae927e3ed1d87e1eaa22.tmp
File created	C:\Program Files\MERCUSYS\MA60XHB\WifiAutoInstall\Driver\Win10X86\is-3C45G.tmp	5bb68633076169fd46824109adfbc6377d121619fdd6ae927e3ed1d87e1eaa22.tmp
File created	C:\Program Files\MERCUSYS\MA60XHB\WifiAutoInstall\is-QQPGD.tmp	5bb68633076169fd46824109adfbc6377d121619fdd6ae927e3ed1d87e1eaa22.tmp
File opened for modification	C:\Program Files\MERCUSYS\MA60XHB\WifiAutoInstall\Driver\Win10X64\Rtlihvs.dll	5bb68633076169fd46824109adfbc6377d121619fdd6ae927e3ed1d87e1eaa22.tmp
File created	C:\Program Files\MERCUSYS\MA60XHB\WifiAutoInstall\Bluetooth\is-K1H99.tmp	5bb68633076169fd46824109adfbc6377d121619fdd6ae927e3ed1d87e1eaa22.tmp
File created	C:\Program Files\MERCUSYS\MA60XHB\WifiAutoInstall\Bluetooth\x64\is-9ESKA.tmp	5bb68633076169fd46824109adfbc6377d121619fdd6ae927e3ed1d87e1eaa22.tmp
File created	C:\Program Files\MERCUSYS\MA60XHB\WifiAutoInstall\Driver\Win10X64\is-CUJL3.tmp	5bb68633076169fd46824109adfbc6377d121619fdd6ae927e3ed1d87e1eaa22.tmp
File created	C:\Program Files\MERCUSYS\MA60XHB\WifiAutoInstall\Driver\Win11\is-FAVHL.tmp	5bb68633076169fd46824109adfbc6377d121619fdd6ae927e3ed1d87e1eaa22.tmp
File opened for modification	C:\Program Files\MERCUSYS\MA60XHB\WifiAutoInstall\Driver\Win10X86\RTUWPSrvcLib.dll	5bb68633076169fd46824109adfbc6377d121619fdd6ae927e3ed1d87e1eaa22.tmp
File opened for modification	C:\Program Files\MERCUSYS\MA60XHB\WifiAutoInstall\Driver\Win11\RTUWPSrvcLib.dll	5bb68633076169fd46824109adfbc6377d121619fdd6ae927e3ed1d87e1eaa22.tmp
File created	C:\Program Files\MERCUSYS\MA60XHB\WifiAutoInstall\Driver\Win10X64\is-GJJVM.tmp	5bb68633076169fd46824109adfbc6377d121619fdd6ae927e3ed1d87e1eaa22.tmp
File created	C:\Program Files\MERCUSYS\MA60XHB\WifiAutoInstall\Driver\Win10X64\is-C5G2D.tmp	5bb68633076169fd46824109adfbc6377d121619fdd6ae927e3ed1d87e1eaa22.tmp
File opened for modification	C:\Program Files\MERCUSYS\MA60XHB\WifiAutoInstall\unins000.dat	5bb68633076169fd46824109adfbc6377d121619fdd6ae927e3ed1d87e1eaa22.tmp
File opened for modification	C:\Program Files (x86)\REALTEK\Realtek Bluetooth\PidVid_List.dat	xcopy.exe
File opened for modification	C:\Program Files (x86)\REALTEK\Realtek Bluetooth\Rtkfilter.inf	xcopy.exe
File created	C:\Program Files\MERCUSYS\MA60XHB\WifiAutoInstall\Driver\Win10X86\is-A7U99.tmp	5bb68633076169fd46824109adfbc6377d121619fdd6ae927e3ed1d87e1eaa22.tmp
File created	C:\Program Files\MERCUSYS\MA60XHB\WifiAutoInstall\Driver\Win11\is-J4CUV.tmp	5bb68633076169fd46824109adfbc6377d121619fdd6ae927e3ed1d87e1eaa22.tmp
File created	C:\Program Files\MERCUSYS\MA60XHB\WifiAutoInstall\Driver\Win11\is-C7HQT.tmp	5bb68633076169fd46824109adfbc6377d121619fdd6ae927e3ed1d87e1eaa22.tmp
File opened for modification	C:\Program Files (x86)\REALTEK\Realtek Bluetooth\DPInst.exe	xcopy.exe
File opened for modification	C:\Program Files (x86)\REALTEK\Realtek Bluetooth\RtkBtfilter.sys	xcopy.exe
File opened for modification	C:\Program Files\MERCUSYS\MA60XHB\WifiAutoInstall\Driver\Win10X86\RTUWPSrvcMain.exe	5bb68633076169fd46824109adfbc6377d121619fdd6ae927e3ed1d87e1eaa22.tmp
File opened for modification	C:\Program Files\MERCUSYS\MA60XHB\WifiAutoInstall\Driver\Win10X64\RTUWPSrvcLib.dll	5bb68633076169fd46824109adfbc6377d121619fdd6ae927e3ed1d87e1eaa22.tmp
File opened for modification	C:\Program Files\MERCUSYS\MA60XHB\WifiAutoInstall\Driver\Win11\RTUWPWlanExt.dll	5bb68633076169fd46824109adfbc6377d121619fdd6ae927e3ed1d87e1eaa22.tmp
File created	C:\Program Files\MERCUSYS\MA60XHB\WifiAutoInstall\is-FN03B.tmp	5bb68633076169fd46824109adfbc6377d121619fdd6ae927e3ed1d87e1eaa22.tmp
File created	C:\Program Files\MERCUSYS\MA60XHB\WifiAutoInstall\Driver\Win10X86\is-UQJAO.tmp	5bb68633076169fd46824109adfbc6377d121619fdd6ae927e3ed1d87e1eaa22.tmp
File created	C:\Program Files\MERCUSYS\MA60XHB\WifiAutoInstall\Driver\Win11\is-UOI11.tmp	5bb68633076169fd46824109adfbc6377d121619fdd6ae927e3ed1d87e1eaa22.tmp
File created	C:\Program Files\MERCUSYS\MA60XHB\WifiAutoInstall\X86\is-DL0EG.tmp	5bb68633076169fd46824109adfbc6377d121619fdd6ae927e3ed1d87e1eaa22.tmp
File opened for modification	C:\Program Files\MERCUSYS\MA60XHB\WifiAutoInstall\Bluetooth\x64\RtkBtManServ.exe	5bb68633076169fd46824109adfbc6377d121619fdd6ae927e3ed1d87e1eaa22.tmp
File opened for modification	C:\Program Files\MERCUSYS\MA60XHB\WifiAutoInstall\Driver\Win10X86\Rtlihvs.dll	5bb68633076169fd46824109adfbc6377d121619fdd6ae927e3ed1d87e1eaa22.tmp
File opened for modification	C:\Program Files\MERCUSYS\MA60XHB\WifiAutoInstall\Driver\Win11\Rtlihvs.dll	5bb68633076169fd46824109adfbc6377d121619fdd6ae927e3ed1d87e1eaa22.tmp
File opened for modification	C:\Program Files\MERCUSYS\MA60XHB\WifiAutoInstall\X86\WifiAutoInstallDriver.exe	5bb68633076169fd46824109adfbc6377d121619fdd6ae927e3ed1d87e1eaa22.tmp
File created	C:\Program Files (x86)\REALTEK\Realtek Bluetooth\pnp.log	cmd.exe
File created	C:\Program Files\MERCUSYS\MA60XHB\WifiAutoInstall\Bluetooth\x64\is-RHIAV.tmp	5bb68633076169fd46824109adfbc6377d121619fdd6ae927e3ed1d87e1eaa22.tmp
File created	C:\Program Files (x86)\REALTEK\Realtek Bluetooth\RtkBtManServ.exe	xcopy.exe
File created	C:\Program Files\MERCUSYS\MA60XHB\WifiAutoInstall\Bluetooth\x64\is-PE8SO.tmp	5bb68633076169fd46824109adfbc6377d121619fdd6ae927e3ed1d87e1eaa22.tmp
File created	C:\Program Files\MERCUSYS\MA60XHB\WifiAutoInstall\Driver\Win10X64\is-UGDCH.tmp	5bb68633076169fd46824109adfbc6377d121619fdd6ae927e3ed1d87e1eaa22.tmp
File created	C:\Program Files\MERCUSYS\MA60XHB\WifiAutoInstall\Driver\Win10X86\is-9GUI9.tmp	5bb68633076169fd46824109adfbc6377d121619fdd6ae927e3ed1d87e1eaa22.tmp
File created	C:\Program Files\MERCUSYS\MA60XHB\WifiAutoInstall\Driver\Win10X86\is-505BR.tmp	5bb68633076169fd46824109adfbc6377d121619fdd6ae927e3ed1d87e1eaa22.tmp
File opened for modification	C:\Program Files\MERCUSYS\MA60XHB\WifiAutoInstall\Driver\Win10X86\RTUWPWlanExt.dll	5bb68633076169fd46824109adfbc6377d121619fdd6ae927e3ed1d87e1eaa22.tmp
File created	C:\Program Files\MERCUSYS\MA60XHB\WifiAutoInstall\Driver\Win10X64\is-MQQLK.tmp	5bb68633076169fd46824109adfbc6377d121619fdd6ae927e3ed1d87e1eaa22.tmp
File created	C:\Program Files\MERCUSYS\MA60XHB\WifiAutoInstall\Driver\Win10X86\is-RURH5.tmp	5bb68633076169fd46824109adfbc6377d121619fdd6ae927e3ed1d87e1eaa22.tmp
File opened for modification	C:\Program Files\MERCUSYS\MA60XHB\WifiAutoInstall\Driver\Win10X64\RTUWPUsbSwExt.dll	5bb68633076169fd46824109adfbc6377d121619fdd6ae927e3ed1d87e1eaa22.tmp
File created	C:\Program Files\MERCUSYS\MA60XHB\WifiAutoInstall\Driver\Win10X64\is-2FDMK.tmp	5bb68633076169fd46824109adfbc6377d121619fdd6ae927e3ed1d87e1eaa22.tmp
File opened for modification	C:\Program Files\MERCUSYS\MA60XHB\WifiAutoInstall\WifiAutoInstall.log	WifiAutoInstallSrv.exe
File created	C:\Program Files (x86)\REALTEK\Realtek Bluetooth\rtl8851b_bt_fw_rom_patch.dat	xcopy.exe
File created	C:\Program Files\MERCUSYS\MA60XHB\WifiAutoInstall\unins000.dat	5bb68633076169fd46824109adfbc6377d121619fdd6ae927e3ed1d87e1eaa22.tmp
File opened for modification	C:\Program Files (x86)\REALTEK\Realtek Bluetooth\RtkBtManServ.exe	xcopy.exe
File opened for modification	C:\Program Files (x86)\REALTEK\Realtek Bluetooth\rtkfilter.cat	xcopy.exe
File opened for modification	C:\Program Files (x86)\REALTEK\Realtek Bluetooth\rtl8851b_bt_fw_rom_patch.dat	xcopy.exe
File created	C:\Program Files\MERCUSYS\MA60XHB\WifiAutoInstall\Driver\Win10X86\is-M8KMR.tmp	5bb68633076169fd46824109adfbc6377d121619fdd6ae927e3ed1d87e1eaa22.tmp
File opened for modification	C:\Program Files\MERCUSYS\MA60XHB\WifiAutoInstall\Driver\Win10X64\RTUWPSrvcMain.exe	5bb68633076169fd46824109adfbc6377d121619fdd6ae927e3ed1d87e1eaa22.tmp
File opened for modification	C:\Program Files\MERCUSYS\MA60XHB\WifiAutoInstall\Driver\Win11\RTUWPUsbSwExt.dll	5bb68633076169fd46824109adfbc6377d121619fdd6ae927e3ed1d87e1eaa22.tmp
File created	C:\Program Files\MERCUSYS\MA60XHB\WifiAutoInstall\Bluetooth\is-2HMHF.tmp	5bb68633076169fd46824109adfbc6377d121619fdd6ae927e3ed1d87e1eaa22.tmp
File created	C:\Program Files\MERCUSYS\MA60XHB\WifiAutoInstall\Bluetooth\x64\is-QE3FQ.tmp	5bb68633076169fd46824109adfbc6377d121619fdd6ae927e3ed1d87e1eaa22.tmp
File created	C:\Program Files\MERCUSYS\MA60XHB\WifiAutoInstall\Bluetooth\x64\is-F1J80.tmp	5bb68633076169fd46824109adfbc6377d121619fdd6ae927e3ed1d87e1eaa22.tmp

Drops file in Windows directory 9 IoCs

description	ioc	Process
File opened for modification	C:\Windows\INF\setupapi.dev.log	pnputil.exe
File opened for modification	C:\Windows\inf\oem4.inf	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	WifiAutoInstallDriver.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File created	C:\Windows\inf\oem4.inf	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	svchost.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File opened for modification	C:\Windows\inf\oem3.inf	DrvInst.exe
File created	C:\Windows\inf\oem3.inf	DrvInst.exe

Launches sc.exe 1 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1340	sc.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5bb68633076169fd46824109adfbc6377d121619fdd6ae927e3ed1d87e1eaa22.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5bb68633076169fd46824109adfbc6377d121619fdd6ae927e3ed1d87e1eaa22.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WifiAutoInstallSrv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WifiAutoInstallSrv.exe

Inno Setup is an open-source installation builder for Windows applications. 3 IoCs

Inno Setup installer

installer

resource	yara_rule
behavioral1/memory/4952-0-0x0000000000400000-0x00000000004D8000-memory.dmp	innosetup
behavioral1/memory/4952-123-0x0000000000400000-0x00000000004D8000-memory.dmp	innosetup
behavioral1/memory/4952-432-0x0000000000400000-0x00000000004D8000-memory.dmp	innosetup

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	pnputil.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID	pnputil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Phantom	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs	WifiAutoInstallDriver.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	WifiAutoInstallDriver.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	WifiAutoInstallDriver.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Phantom	WifiAutoInstallDriver.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	pnputil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom	pnputil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	pnputil.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Phantom	pnputil.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID	WifiAutoInstallDriver.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs	WifiAutoInstallDriver.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	pnputil.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	pnputil.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\CompatibleIDs	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\CompatibleIDs	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	WifiAutoInstallDriver.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\CompatibleIDs	WifiAutoInstallDriver.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Phantom	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\CompatibleIDs	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\CompatibleIDs	pnputil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	WifiAutoInstallDriver.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	WifiAutoInstallDriver.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom	pnputil.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Phantom	pnputil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs	pnputil.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	WifiAutoInstallDriver.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	pnputil.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	WifiAutoInstallDriver.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Phantom	WifiAutoInstallDriver.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\CompatibleIDs	pnputil.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	pnputil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom	WifiAutoInstallDriver.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	DrvInst.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3852	5bb68633076169fd46824109adfbc6377d121619fdd6ae927e3ed1d87e1eaa22.tmp
3852	5bb68633076169fd46824109adfbc6377d121619fdd6ae927e3ed1d87e1eaa22.tmp

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeLoadDriverPrivilege	1964	WifiAutoInstallDriver.exe
Token: SeAuditPrivilege	1036	svchost.exe
Token: SeSecurityPrivilege	1036	svchost.exe
Token: SeLoadDriverPrivilege	1964	WifiAutoInstallDriver.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3852	5bb68633076169fd46824109adfbc6377d121619fdd6ae927e3ed1d87e1eaa22.tmp

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 4952 wrote to memory of 3852	4952	5bb68633076169fd46824109adfbc6377d121619fdd6ae927e3ed1d87e1eaa22.exe	85
PID 3852 wrote to memory of 3824	3852	5bb68633076169fd46824109adfbc6377d121619fdd6ae927e3ed1d87e1eaa22.tmp	91
PID 3852 wrote to memory of 1964	3852	5bb68633076169fd46824109adfbc6377d121619fdd6ae927e3ed1d87e1eaa22.tmp	94
PID 1036 wrote to memory of 2732	1036	svchost.exe	98
PID 3852 wrote to memory of 3668	3852	5bb68633076169fd46824109adfbc6377d121619fdd6ae927e3ed1d87e1eaa22.tmp	100
PID 3668 wrote to memory of 3708	3668	cmd.exe	102
PID 3668 wrote to memory of 4040	3668	cmd.exe	103
PID 3668 wrote to memory of 2440	3668	cmd.exe	104
PID 1036 wrote to memory of 4000	1036	svchost.exe	105
PID 3852 wrote to memory of 1340	3852	5bb68633076169fd46824109adfbc6377d121619fdd6ae927e3ed1d87e1eaa22.tmp	106

C:\Users\Admin\AppData\Local\Temp\5bb68633076169fd46824109adfbc6377d121619fdd6ae927e3ed1d87e1eaa22.exe
"C:\Users\Admin\AppData\Local\Temp\5bb68633076169fd46824109adfbc6377d121619fdd6ae927e3ed1d87e1eaa22.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4952
- C:\Users\Admin\AppData\Local\Temp\is-RVTHB.tmp\5bb68633076169fd46824109adfbc6377d121619fdd6ae927e3ed1d87e1eaa22.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-RVTHB.tmp\5bb68633076169fd46824109adfbc6377d121619fdd6ae927e3ed1d87e1eaa22.tmp" /SL5="$50298,7704015,832512,C:\Users\Admin\AppData\Local\Temp\5bb68633076169fd46824109adfbc6377d121619fdd6ae927e3ed1d87e1eaa22.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:3852
- - C:\Program Files\MERCUSYS\MA60XHB\WifiAutoInstall\WifiAutoInstallSrv.exe
    "C:\Program Files\MERCUSYS\MA60XHB\WifiAutoInstall\WifiAutoInstallSrv.exe" /i
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:3824
- - C:\Program Files\MERCUSYS\MA60XHB\WifiAutoInstall\WifiAutoInstallDriver.exe
    "C:\Program Files\MERCUSYS\MA60XHB\WifiAutoInstall\WifiAutoInstallDriver.exe" /i
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    - Checks SCSI registry key(s)
    - Suspicious use of AdjustPrivilegeToken
    PID:1964
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /C ""C:\Program Files\MERCUSYS\MA60XHB\WifiAutoInstall\Bluetooth\install.bat""
    3⤵
    - Drops file in Program Files directory
    - Suspicious use of WriteProcessMemory
    PID:3668
  - - C:\Windows\system32\cacls.exe
      "C:\Windows\system32\cacls.exe" "C:\Windows\system32\config\system"
      4⤵
      PID:3708
  - - C:\Windows\system32\xcopy.exe
      xcopy /y "C:\Program Files\MERCUSYS\MA60XHB\WifiAutoInstall\Bluetooth\x64\*" "C:\Program Files (x86)\REALTEK\Realtek Bluetooth\" /s /e
      4⤵
      Drops file in Program Files directory
      PID:4040
  - - C:\Windows\system32\pnputil.exe
      pnputil /add-driver "C:\Program Files (x86)\REALTEK\Realtek Bluetooth\*.inf" /install
      4⤵
      Drops file in Windows directory
      Checks SCSI registry key(s)
      PID:2440
- - C:\Windows\system32\sc.exe
    "sc.exe" config WifiAutoInstallSrv binPath="\"C:\Program Files\MERCUSYS\MA60XHB\WifiAutoInstall\WifiAutoInstallSrv.exe\""
    3⤵
    - Launches sc.exe
    PID:1340

C:\Program Files\MERCUSYS\MA60XHB\WifiAutoInstall\WifiAutoInstallSrv.exe
"C:\Program Files\MERCUSYS\MA60XHB\WifiAutoInstall\WifiAutoInstallSrv.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:3372

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall
1⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1036
- C:\Windows\system32\DrvInst.exe
  DrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{43bff533-9214-514c-a158-2c9765a9cd06}\netrtwlanu6.inf" "9" "45d397c27" "0000000000000138" "WinSta0\Default" "0000000000000150" "208" "C:\Program Files\MERCUSYS\MA60XHB\WifiAutoInstall\Driver\Win10X64"
  2⤵
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Checks SCSI registry key(s)
  - Modifies data under HKEY_USERS
  PID:2732
- C:\Windows\system32\DrvInst.exe
  DrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{ba1f9efa-3e9d-5540-92a7-6fc342d715c1}\Rtkfilter.inf" "9" "49663c6d7" "0000000000000154" "WinSta0\Default" "000000000000014C" "208" "C:\Program Files (x86)\REALTEK\Realtek Bluetooth"
  2⤵
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Checks SCSI registry key(s)
  - Modifies data under HKEY_USERS
  PID:4000

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RTUWPSrvcLib.dll

Path C:\PROGRA~1\MERCUSYS\MA60XHB\WIFIAU~1\Driver\Win10X64\RTUWPSrvcLib.dll
Size 1.0MB
SHA256 c90e635394e3be16852ea256e37799c92dca92f7fee1a61b2b4b88fa3457b6ba
MD5 a91d76a41df841b9e2d6a010b9676b5f
SHA1 2d26b861035ab991b04ccfa065bdcd7f7780c459
SHA512 dab598ec077f19eb476fd8c360da9f45ca6045cb8a61e135626064cc57a87982547cde682a53ce305e6bbd584692757fc266f77922180c4bacaa9176b6fbac12
SSDEEP 12288:qV5TJ0zx3O34ojErC0tnOaZH70+9uYiD1xs431kfWTjrjfQZk5sF1/mWjCaxTDkn:QJKwq1/NCaIgPVrJKLUvmD0K
TLSH
T176258F56739801A4E577E078CA5BCF46EAB1784A0321A7CB07F096AA1F237E05E7F315
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RTUWPUsbSwExt.dll

Path C:\PROGRA~1\MERCUSYS\MA60XHB\WIFIAU~1\Driver\Win10X64\RTUWPUsbSwExt.dll
Size 1.0MB
SHA256 129bcb481e33dcec4d88985e567c8890f4fa4eca0fea6fd8c9c7c11fac85a66a
MD5 c8ccda2230a1a0112fc28da8ec2759a3
SHA1 e48e6b92f9a5ccc5d055efc872d4d564f7a4071e
SHA512 30241b48c4f82f4b3ce2ceeb0434fc4a5ca7a6f97b2cdc68d1dcb8af6966b4cabb4a907bafc4488f7d97e8c4b3264863129fb1aa2a473cd840ec592ca2eb6da1
SSDEEP 12288:5Tl4sy6/tbxwGKG0j2tKM6H/MBejB4I+xl+G0IS8e9a/LWGXzRiC9wJe1dTvXrLK:5qqsC9Eb4fxoIWCJZUg+SwV66
TLSH
T180359F56339801A4E577E179CA97CF46EAB178460321A7CB03F497AA2F233E05A7F315
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Rtlihvs.dll

Path C:\PROGRA~1\MERCUSYS\MA60XHB\WIFIAU~1\Driver\Win10X64\Rtlihvs.dll
Size 1.2MB
SHA256 bc30fc15f01d3f370e75d9000d2ddb569b38b5022553afa0dfed611ee635e681
MD5 728a8c17741788a513facda5a518dc47
SHA1 2b74cd5ecefdba053c333ec894796f8f0490a079
SHA512 1069eb9459ce9c5308d31a2f795e3f00c3479c1a1fb2867b8f19199da8640105a5ef6ae69e65441c340ed8d6ba4b251518821619f677e41613de3f4b2776038a
SSDEEP 24576:JdpYzPGNEQd3J7CIf0fmPWrTNyrggTdFWqY:nYGZdb0fmOrup1Y
TLSH
T1D6458D53A7A401B7C8BBC1BCD9B35607EBF2B51007B08BDB02A5966D4E237D09B39761
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

netrtwlanu6.cat

Path C:\PROGRA~1\MERCUSYS\MA60XHB\WIFIAU~1\Driver\Win10X64\netrtwlanu6.cat
Size 14KB
SHA256 04a3a259545ee0f3c48abb8fbf27ff492c5c5c3c230347acd789fb3c6d3ca177
MD5 82564951a45e491c7195a7f365013bf1
SHA1 e545643c660ccc8ef03204a5173fd52a66ea02c4
SHA512 cadf1805cbb1835dcfca0f466ef77ea6f79743dda97b5be4447d4cdb7cb2865257f50561ce91a895b12b9d9865a449b2b60ea2de8b1a897c39a017cc94768acb
SSDEEP 192:/MfxQCXM4JBRaPmDR5A9Ma1Ayw9y6JCJJW7/lyKFFWQFpIkLebAw3WIX7X01k9zE:/y8DTu8iZFRH/LVifX7R9zA0Q8Na
TLSH
T10062B5A5655E42C2F5A35D705694F16BA83D7BCF484081BD31AFB72C0CA27C4FB2982E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rtwlanu6.sys

Path C:\PROGRA~1\MERCUSYS\MA60XHB\WIFIAU~1\Driver\Win10X64\rtwlanu6.sys
Size 15.7MB
SHA256 228b1f458650c5f7e1145d049cd6199ae8ec1de3871fb99bbb9795092df604e8
MD5 aab2a6750a5000e70b5673ac835659d9
SHA1 06e76ef25777d967188b5a9865f2d62021102917
SHA512 8867b54c4ed1f30886b0458eb57c827593ad01d5faf1a96c2763412bb3de594031e89c84e3eade2d51678692152c1befe8f93aa8ae8e8b0e530b39f8bf9ca55a
SSDEEP 98304:hd1nRu8RBNdXwtko0z6PB1xaBOzL9vfW14BVu:hDRu8RPdXqi6PBGiBM
TLSH
T131F65B87BB6614C0C4759B71089ADB27B2B2F4221F7B47EF1474E3619E923D0AD3628D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RtkBtfilter.sys

Path C:\PROGRA~2\REALTEK\REALTE~1\RtkBtfilter.sys
Size 815KB
SHA256 6f6022462581f8ecb849adca0b928c225dec5145728ed8c2f216eda07e1a95de
MD5 9fea88172d5b614baf918b897db3014f
SHA1 1c6c51181633665ac373541bc554e18c79264ab0
SHA512 d143ad52a6f97401794f4d09a2ea06b9f6ec1c07533dba6e8ed0b4f86653e2b6ebb53ce746f985a174afaa1382566aae039645c9163125e28f68112f623856ac
SSDEEP 24576:hYg8fuNRWx/lFA+JXZpTk6er4ami3NXsuf:uzx/lFpBa5Nd
TLSH
T131056B5CE36414FCE4BBD4F58C6A1136F2B17C872FB08AD701A55542AF4E2E89A3931A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Rtkfilter.inf

Path C:\Program Files (x86)\REALTEK\Realtek Bluetooth\Rtkfilter.inf
Size 3KB
SHA256 330024e42c3ad145235f3ba172537a32ebc1c5f2ea06821147a5cc56494f343b
MD5 7afee9e4fdf95ecc291e859ae746bcc7
SHA1 3d7e065a85820300dd6d2975effd9d4751c25a7d
SHA512 18406417ef4f84078a843e6ac458a5151dce618bfb09dcd4d399c9320a2887de2077b76f5d764733a402b40f0a4ee62aa602e48e856321816df3c7a3d91dd7ad
TLSH
T17A71CD6686864D7D109221DDBB4328E3F86860C4D2E92C0673CDFDC45BEFE9C9734A50
MD5 SHA1 SHA512 TLSH

Submit Download

install.bat

Path C:\Program Files\MERCUSYS\MA60XHB\WifiAutoInstall\Bluetooth\install.bat
Size 1KB
SHA256 5f5be22ec35cb4d90bdf61a39cf0ffe755948673245345d23c204dc00dfb0189
MD5 24a495cd48ff2106b9f73e453195de94
SHA1 4a8a72f73b082bb1b0f8c9392a17c95d0e74e0fc
SHA512 db4a4542bf7328ce52884b53ae28be0d02fdd08aebe085192e33adf9359214f3fb99640ffe7e8209b0acb527944637476de11b90243815dc9e53c6aedc6d6d97
TLSH
T1BC3124015C469D262275DAB1D72310C1F129D5C729289848F12F70B1BFBDB499DEE8D9
MD5 SHA1 SHA512 TLSH

Submit Download

DPInst.exe

Path C:\Program Files\MERCUSYS\MA60XHB\WifiAutoInstall\Bluetooth\x64\DPInst.exe
Size 1.0MB
SHA256 7476d743161c9030ffa9ca910dd93766218735fb6ec17714f3f5249bf133d2ac
MD5 cdac02d85b996c0c08aa28e7c521f4b0
SHA1 6d79e26dff25b0f560caa7e2d57e7695a53d88aa
SHA512 413b78ab0664c5cf0e2a451dfceeb756e3abc07517e9c9b4c64972674d2e3e80a82167af0d7578fcace5ceac7ca260079cafd5ee868ca8fea2cb3327f0f01df2
SSDEEP 6144:jsSOzpPId26dQcEaUrPvwgwkRVagRoDHTj8K1sqI6VLp4XOigSbduP/1HHm/hHAO:9IId79EaUTvwieMozMEcOigSpuPMaLin
TLSH
T12C258004E7FA4225F8F3AB7DA9B152528A72BC815B34CA8F4240569D1DF3AD0D971B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rtl8851b_bt_fw_rom_patch.dat

Path C:\Program Files\MERCUSYS\MA60XHB\WifiAutoInstall\Bluetooth\x64\rtl8851b_bt_fw_rom_patch.dat
Size 63KB
SHA256 81f023e4d6fbf5e88bdd299a0aec2839a850539193b6a8afbad35f94148cdee5
MD5 3170d5e04501f2be09b44011d42feaa7
SHA1 1e2bfacbf36805e633f1b425b43dc390ae11829e
SHA512 fc1bcfeb1e8d33ad303975222b0b962252910baa49527a44dd4c8e580909ddd12b3df304fc9444807579fdf4e33a538963d8ddd57ac26f50fc485a044fc9afaf
SSDEEP 1536:mHGlOk1EbwagdnJrqsNZVDWIsRovLhko/3D:qgEbqlvN73s2/3D
TLSH
T11E53BFA3AAA3ECB0FF79E5BC94FE3557C51691446C20B07A0A25307B122FBD318445EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

netrtwlanu6.inf

Path C:\Program Files\MERCUSYS\MA60XHB\WifiAutoInstall\Driver\Win10X64\netrtwlanu6.inf
Size 143KB
SHA256 2953eff77319397ee89cfb36b83b31b804147ca02276f35f116ddd0925a757ee
MD5 44fbff4f92fcfa54607823aee7572858
SHA1 fd11e5478a29758577ed46e90c1b247571b7f04e
SHA512 48d54db7c5318f19b01f1ec82b9939a28f4d5929ec59e32523df54a344f1fcca83af3dc3b6d8e99d978833521fac013719e32a1cb2083a07c2dff8bcf3ac55c8
SSDEEP 768:RpxwKpXpop2wlp4pipMp0wHpxpNp4wQpepEptwepXpIpGwRp4pypUuoItxG+GCIf:9oyxG+GCIp+9qE2hua
TLSH
T1B4E3A512E7E41E18B2F39A509AF59579C727B8C1593CCF5D42D9060E0AFFA01AC21FA7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TXPWR_ByRate_Enc.txt

Path C:\Program Files\MERCUSYS\MA60XHB\WifiAutoInstall\Driver\Win11\TXPWR_ByRate_Enc.txt
Size 3KB
SHA256 57dcabe9e744a8fcddf6729e79d3e7f99e1495fb71f6083a2152c51e26fdd30c
MD5 cd0c31c8d9dde42b0634bc9a83a3f68b
SHA1 0f745bea02b66145f3d4beaafc703be16375f457
SHA512 f78446f769e6fe70c1d7840ae4ed7ce506da881a88b93bbcce2acabb72827b4a4e47f5242c2ce6d2bc91c1fc5ccf9dc37e2805d521d7e8699a3ec34a74a36826
TLSH
T1DF711B439C277EE47E756B56BA07D82ED3D4392131160E29028EA0A328E75FC465F3CC
MD5 SHA1 SHA512 TLSH

Submit Download

is-D7V3O.tmp

Path C:\Program Files\MERCUSYS\MA60XHB\WifiAutoInstall\Driver\Win11\is-D7V3O.tmp
Size 20KB
SHA256 31ca0653666c45fdac2fddcbc364e5fa327a6e87f5651297bfe929b1a4d1f050
MD5 1c7b11dca41119c254a94826ab55eff1
SHA1 4db8079b69226ca9300a909ba027fc0d9fd4acb7
SHA512 03b1491c571db8910db31b41c0760df5eeb7272224d504c9e8fb58f345c01fc874b410044ba52441efdad85a9c3e9edd89bd0fab28201759b257e109b828f6e8
SSDEEP 384:43E0QU+uTMgEgc5O5srap8bkx+b+EkDRU3PBamgQmrZmFwVSt22iICUXHt:Z0v+uTM3gc5C+vkx+GNmgQmrZmFwVnji
TLSH
T155926C4938EFAEABD82806C14E1216B22DDCC3F83E3C674D6356594505D2BDD4AEB873
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WifiAutoInstall.ini

Path C:\Program Files\MERCUSYS\MA60XHB\WifiAutoInstall\WifiAutoInstall.ini
Size 140B
SHA256 1261af5ed2f0c49f6afc0966bc2c6fc1478c4e163b7e7dc0862968614282cb2f
MD5 93766ee6406dde1d743f89556d685dfa
SHA1 493ff304976baae823792dd2234e8a9bbe7b01d2
SHA512 daa83a8da2f8e923ad21e8b149d6a3cfed5855ded8fce7c82ac9f553d1bd760158a9578011e787becc472b29db2827b6d2226ec432c7d5af960dcd375733d9fa
TLSH
T165C08C80288DBC3AD6C39A128A3302AC1215048040622150259C2622E38890AA24A03B
MD5 SHA1 SHA512 TLSH

Submit Download

WifiAutoInstall.log

Path C:\Program Files\MERCUSYS\MA60XHB\WifiAutoInstall\WifiAutoInstall.log
Size 440B
SHA256 cc647896dae8a5f51dde0df85479500cd9477330b77dbe5127660e18086635fd
MD5 b9c1dde8754e7baf87daa1c8a4a86a59
SHA1 a289d352506cfca86268779d8358b67c5ce9e437
SHA512 a726465ebb8e0c0b441be0529ee36843e25eec54a97d41940406c66371e84e8a2cd775acfa9742890bef8b45c2e19ed7ca2794030b351129ec66498ed5a2fa35
TLSH
T1CAF01536AE8800BC253A07805BAF6C600991B71E76398932F3F78205F208881F2E72D6
MD5 SHA1 SHA512 TLSH

Submit Download

WifiAutoInstall.log

Path C:\Program Files\MERCUSYS\MA60XHB\WifiAutoInstall\WifiAutoInstall.log
Size 682B
SHA256 334c48db2ddb78348ea9fc06827aeadb54cd5367221d975a67186fa07f207d03
MD5 39aa421e7b7dfe09d0a6c3015190b812
SHA1 d14e8de467be8ff6d5a84f5d243020a32da5fe29
SHA512 df01ea6a07b863eb0795b9fb2a805de69eb6aaf38ad746b9ab13cb301207e9b81e7e9e2d90c6be08a3218d14c0ff975a5d2e7839738e3332dc145dfb218751b3
TLSH
T17001E135AF8400F9257A06845BAF6D600591B71D77399931F3FB4205F248481F1E72D7
MD5 SHA1 SHA512 TLSH

Submit Download

WifiAutoInstall.log

Path C:\Program Files\MERCUSYS\MA60XHB\WifiAutoInstall\WifiAutoInstall.log
Size 944B
SHA256 4161f8f241e0e2f01fba2b5fa2b38436d03dce3e89ce73190c6b1e3bbc0bf6fa
MD5 37d362420d25a04c68430cfee8f7fe3e
SHA1 57be50b3ccba3a7f061c041389baa23c94abc63b
SHA512 0f719570da2b02f136d8eb32e0f7b77a0d2d260d6cedf9d0fcba57b5e59149dece14138cd10f8368d3c8ea49467478b27d7299bacac8fe5e66c060c750acc3c6
TLSH
T1F611FE35AF8900F9767A06945BAF6C600952BB5D73399931F3EB4205F248882E1E72D3
MD5 SHA1 SHA512 TLSH

Submit Download

WifiAutoInstall.log

Path C:\Program Files\MERCUSYS\MA60XHB\WifiAutoInstall\WifiAutoInstall.log
Size 1KB
SHA256 be66734bd8538d297b9be67ef9da95984cb75042272899b4f5668715ad07c233
MD5 81e2b33cb0e9d39da9c1a29fc7b6041c
SHA1 964fea9f5f2a05d8ba936417026812fbd9a670cd
SHA512 be08902f3bd03b6f1f4273646d322d244c49791ef916f1c656601857582e76caa74bfc351811a4ec688ee52ba0f8430acf546216160c12299a7f623284405cea
TLSH
T1F7319034AF8900F9757A06945B9F6C700692B75CB2798A31F2E74205F24C892E2E72D7
MD5 SHA1 SHA512 TLSH

Submit Download

WifiAutoInstallDriver.exe

Path C:\Program Files\MERCUSYS\MA60XHB\WifiAutoInstall\WifiAutoInstallDriver.exe
Size 164KB
SHA256 4843f20a8dddf6ab4a657cf9773fd0e7115ed447501d0226ce8a07a91085e575
MD5 23364b8154db67d858fff064a2417f82
SHA1 c452197405ff016f8f0826cf2aca870a3bad8d1e
SHA512 6da1eb23ed0ea1eafe2c2adb56d17fb64ee4a02c803ae31bbb9dd4241e99efbd6b183624787915837459efbc03fce41f7eab0cd6ec535211bb40cb39c9352a5a
SSDEEP 3072:iHHBDL/Ne0rIAxgf1wWJYiTxrrOw+ZYD1cRWMzbIGVePq+V3I:YL/NeApEdJYiprF+qDAYoiy
TLSH
T148F36B47B3A434FAE5B78634C8954A16F77278324B619B9F03E447791F236809E3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WifiAutoInstallSrv.exe

Path C:\Program Files\MERCUSYS\MA60XHB\WifiAutoInstall\WifiAutoInstallSrv.exe
Size 130KB
SHA256 c121844e6eb1865f20f7ea52ab69d917ca78a665303fc3159a756e77aa388e5c
MD5 d58d9d0c82d74287d9b35da3ec9c8f24
SHA1 c1a446460dfc54c8f6009437f8f19f2503790740
SHA512 67e5a659baf8645219b7d0be5ea1ff51f0282e5efe684234c0980901b660ac06bcddb663fd6d5468fa6a7797460ae52f9e87efa2387517bcbd43568159273548
SSDEEP 3072:FiHmg3SBcObX34txwlxV9GFfr40CMQWd+TxEHWVJe+lrGRx5:cr3SqFwlxL8frm7pGl
TLSH
T1AED35B1175C1C472E8B61E3068B8CA715E7DFA300E709A5B63A8523E5F706C19A36FB7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5bb68633076169fd46824109adfbc6377d121619fdd6ae927e3ed1d87e1eaa22.tmp

Path C:\Users\Admin\AppData\Local\Temp\is-RVTHB.tmp\5bb68633076169fd46824109adfbc6377d121619fdd6ae927e3ed1d87e1eaa22.tmp
Size 3.0MB
SHA256 fd319c0e2d861bb86db794059a2869a141bb72cfe7017c4ba63fdcf7c72fbdfe
MD5 86a873d29ed3f6de0a6d7dada471f9dc
SHA1 1f26329c7e0a338ee3016195d15f4371fba8cb51
SHA512 a29d9144e361f9e47bb11ede1b9fa3367dd5dc9acffbdd18a4d76829a4fa63982ed89a0cdebff5667b067cd3f102c5c09598febae5136620f96b51014fa2cf61
SSDEEP 49152:6dx4HDQNJL0VR6SgMt+k4RiP+RmXMjiINiMq95FoHVHNTQTEjT333TY:LHDYsqiPRhINnq95FoHVBT333T
TLSH
T1ECE54B17F389723ED06B1A364A3385909837B6617916CCA79BFC384C8F3D5942A3E746
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SET61F4.tmp

Path C:\Users\Admin\AppData\Local\Temp\{43bff533-9214-514c-a158-2c9765a9cd06}\SET61F4.tmp
Size 972KB
SHA256 c2e9d0c5ccd9c1553bf5fd6cc0fb4a2e6524ca71040c738fbd4006f0f01059f7
MD5 7dad88396da027b5826cc40e52a19acb
SHA1 292976473c5649a1d488e39e6f88092745a78f8b
SHA512 d4e79a97957c8c9265170c445d99ab45434bbd6e9eea3ff5b0dbd6b88b51740e8f9e54c98edc92593c7556c9d6374b956077563a361103fe1c0ed39e44619a44
SSDEEP 12288:LAqYEK4ZZ6WKC14dEonBfqL+l5u/Mj0inQHSdow67UMJrw4Bu+wKr0P2L5BKbW1j:UqnI+p4P2ubWKYN0HOJfYUe98J4Viaq
TLSH
T1BA258E5673A801A5E567E038CA978E45FAB1784B0321ABCB03F456AA3F177F04A7F315
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SET636E.tmp

Path C:\Users\Admin\AppData\Local\Temp\{43bff533-9214-514c-a158-2c9765a9cd06}\SET636E.tmp
Size 1021KB
SHA256 1951e64ef661c7d10ea708a402d41d044f6ac168d25f773787c24d211605867d
MD5 a4e4a895539337bd56dadde38d0c24bb
SHA1 de0b4e2a9593120637ebd67f180cef11fe315ef0
SHA512 ed8b351940795a2254f6a9b064c8ac11e541b2b0551eee324677da3972f1536920be64bbb09b600abc8f4f91264555d0d66eba567d3090c014f967c7e38d9498
SSDEEP 12288:pMu8q6B0ZnMyEsvYkhuiyjdxutdE5MWKN0A5GY0Z3fBz0ba7P/M9KO8EHNz9ttOl:p38skzevHN/oNdql3mpNqe3Pbhybm5n1
TLSH
T1D3258E1A73A801E4E577E078C996CA46FAB1784A032197CB03F096AA1F277F05E7F315
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PidVid_List.dat

Path C:\Users\Admin\AppData\Local\Temp\{BA1F9~1\PidVid_List.dat
Size 1KB
SHA256 1341ea5d8e476458ec68560cc8279d93163dbef9f4ded18e431726d91feef82e
MD5 4a8da439181d97ea5043e60978cff883
SHA1 ad21bd7016dcd4b530e59aa25962b1ccaefa64dd
SHA512 e0edc86685eaaa0d19815bc7895d462113593fb289c278afe21461aeb6d23d00b17822f29cd7ef0e8980134c8432c232b41e6013edfd039f7ced9128096e7186
TLSH
T1FA21FF48BEEC84B5F5339273AFE7422F9521F0D2A3D127312CD6235A43D2E66A15342C
MD5 SHA1 SHA512 TLSH

Submit Download

RtkBtManServ.exe

Path C:\Users\Admin\AppData\Local\Temp\{BA1F9~1\RtkBtManServ.exe
Size 638KB
SHA256 ee528d53fcf36cb328d575ccf48d1d3947f690d07782da1f677cd87d33fff064
MD5 4aa5b773f90c42cd33f97aa7fdf13489
SHA1 2abc8887f5b1814f90158491c6a67f8e26fd8191
SHA512 c1415635563a1cb0c65cbad066fa3b320f08bb4f193eb4f6c4cb8801c22f6abe10b14a0dc0fc182bfd5694c61c9dc7d9bec2a839df00abfe247742bf10349a32
SSDEEP 12288:QxfcIK/XlPhzyLKS8dRolm5N0tqodeD7Yww:Mcv//yv8dRolm5NiqodYYww
TLSH
T17ED47C5673E500F5E43BD139CAA24666E97278114B21D78F03A883AB1F337909F7EB25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RtkFilter.cat

Path C:\Users\Admin\AppData\Local\Temp\{BA1F9~1\RtkFilter.cat
Size 12KB
SHA256 e72818cde600961fb5d7084adcb6d6e1769f6d2144a901c7b023d24cd876c548
MD5 6eeb22ca07d19f42c4496466c61ed7ad
SHA1 708143f1c81bc97db7ae39590a692718ad7906f0
SHA512 f057bec3072ad5dc01f9fe1790dd24e5e6830007a21e9afc3318028892e5bc5163cb122aab185764d28dbe855bbf94d15c181672fdaa500d2f1464d0b8c05857
SSDEEP 192:z4wWYxefQ/6cgCgD40ybJC2/W7/lyKFFWQFmIs/zp9JHX01k9z3AEsP7OUm:UGsfq/BiZFRGFbR9zwP7i
TLSH
T1D442D7E1566D45C2F8A35CB003E8E4576C3D3BCB581090A936EBF7690CA27C5FB1916E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dberr.txt

Path C:\Windows\System32\CatRoot2\dberr.txt
Size 40KB
SHA256 bf119770db8e7114257e8d144f185c4cfe0ee4151e2b4243c37492261ccfc4d0
MD5 7fbaca8a3ac533e7269b2162adcd0ed4
SHA1 d2e1a8d1720a9df2a4dc1957983d88f5981f5553
SHA512 dcdb1c8e964c45d0b7699c931d7b29dd676bd8e2dc23f5a8d232293fd91f9db6cde52f41237631a0af94ed0e25464e8dfdc8a3375eea8be7f9277b28ad1fec18
SSDEEP 768:++KndMzRkgirUcbUR9h4bIlLBFARbiNvOaw96p:++KndekgirUcbUR9hWUBFARbiNvOaw9u
TLSH
T1F2136A05D1E8C890C5F509727B7ADEB0C8DF85CAB70F6EE530AC63149AC7B042EB655A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1964-295-0x0000000000510000-0x0000000000540000-memory.dmp

Download

memory/2440-428-0x000002030B400000-0x000002030B430000-memory.dmp

Download

memory/3852-130-0x0000000000B90000-0x0000000000C0A000-memory.dmp

Download

memory/3852-131-0x0000000000D80000-0x0000000000D81000-memory.dmp

Download

memory/3852-5-0x0000000000D80000-0x0000000000D81000-memory.dmp

Download

memory/3852-129-0x0000000000400000-0x000000000071B000-memory.dmp

Download

memory/3852-431-0x0000000000B90000-0x0000000000C0A000-memory.dmp

Download

memory/3852-430-0x0000000000400000-0x000000000071B000-memory.dmp

Download

memory/4952-123-0x0000000000400000-0x00000000004D8000-memory.dmp

Download

memory/4952-0-0x0000000000400000-0x00000000004D8000-memory.dmp

Download

memory/4952-124-0x0000000000AA0000-0x0000000000D21000-memory.dmp

Download

memory/4952-432-0x0000000000400000-0x00000000004D8000-memory.dmp

Download

memory/4952-433-0x0000000000AA0000-0x0000000000D21000-memory.dmp

Download