9774a7d35b93219216067172fa3741ade7df2adbbee19dbc391013f52ebd00b5

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
22/04/2026, 12:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
IDGo800_Minidriver_v129/IDGo800_Minidriver_64.msi
Size 4.5MB
Sample260422-pp46jae18j
SHA256 9774a7d35b93219216067172fa3741ade7df2adbbee19dbc391013f52ebd00b5
MD5 431eefd1b99b2f4d6f5c1e61a82aa7cd
SHA1 78bbde10ad06f75bf0d730c6398ba43cc6629ee5
SHA512 be73ca70a5979122b635171c309c4f27c115ae61df5eeb5186591f425e78509871e13222c02786d9703ba83e5756e65adfa05576722800adb399d43e47f31c4b
SSDEEP 98304:JvXC2LSFllRCYyOzP8Kr5hkczq27KVG5P5wVVwsx33ijLXLYEUENuyB1+82P4Wmm:Ri9Pfz2P4Wof6b/M3UOVE5
TLSH
T12D26DF11F6A4023AD0528A7FD5939A69D6B23C5627318BCF1302F7BA0D375D68636F32
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery persistence privilege_escalation ransomware

Malware Config

Signatures

Loads dropped DLL 4 IoCs

pid	Process
5088	MsiExec.exe
4888	MsiExec.exe
4764	MsiExec.exe
4888	MsiExec.exe

Badlisted process makes network request 5 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
4	4300	msiexec.exe
6	4300	msiexec.exe
8	4300	msiexec.exe
10	4300	msiexec.exe
12	4300	msiexec.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe

Drops file in System32 directory 23 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\DriverStore\Temp\{584f7d73-5d0f-af4a-ad27-c9590f8c8ddf}\SETCBB.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{584f7d73-5d0f-af4a-ad27-c9590f8c8ddf}\Gemalto.MiniDriver.IDPrime.inf	DrvInst.exe
File created	C:\Windows\SysWOW64\axaltocm.dll	msiexec.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{584f7d73-5d0f-af4a-ad27-c9590f8c8ddf}\axaltocm64.dll	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{584f7d73-5d0f-af4a-ad27-c9590f8c8ddf}\SETCBA.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{584f7d73-5d0f-af4a-ad27-c9590f8c8ddf}\SETCBA.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{584f7d73-5d0f-af4a-ad27-c9590f8c8ddf}\delta.cat	DrvInst.exe
File created	C:\Windows\System32\DriverStore\drvstore.tmp	DrvInst.exe
File created	C:\Windows\system32\axaltocm.dll	msiexec.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{584f7d73-5d0f-af4a-ad27-c9590f8c8ddf}\SETC89.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{584f7d73-5d0f-af4a-ad27-c9590f8c8ddf}\SETC89.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{584f7d73-5d0f-af4a-ad27-c9590f8c8ddf}\SETCBB.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\gemalto.minidriver.idprime.inf_amd64_f0b2caeee065e222\axaltocm64.dll	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\gemalto.minidriver.idprime.inf_amd64_f0b2caeee065e222\delta.cat	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\gemalto.minidriver.idprime.inf_amd64_f0b2caeee065e222\Gemalto.MiniDriver.IDPrime.inf	DrvInst.exe
File created	C:\Windows\System32\DriverStore\FileRepository\gemalto.minidriver.idprime.inf_amd64_f0b2caeee065e222\Gemalto.MiniDriver.IDPrime.PNF	MsiExec.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{584f7d73-5d0f-af4a-ad27-c9590f8c8ddf}\axaltocm.dll	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{584f7d73-5d0f-af4a-ad27-c9590f8c8ddf}\SETCB9.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{584f7d73-5d0f-af4a-ad27-c9590f8c8ddf}\SETCB9.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\CatRoot2\dberr.txt	DrvInst.exe
File opened for modification	C:\Windows\System32\CatRoot2\dberr.txt	MsiExec.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\gemalto.minidriver.idprime.inf_amd64_f0b2caeee065e222\axaltocm.dll	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{584f7d73-5d0f-af4a-ad27-c9590f8c8ddf}	DrvInst.exe

Drops file in Program Files directory 4 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Gemalto\IDGo 800 Minidriver\Gemalto.MiniDriver.IDPrime.inf	msiexec.exe
File created	C:\Program Files (x86)\Gemalto\IDGo 800 Minidriver\axaltocm.dll	msiexec.exe
File created	C:\Program Files (x86)\Gemalto\IDGo 800 Minidriver\axaltocm64.dll	msiexec.exe
File created	C:\Program Files (x86)\Gemalto\IDGo 800 Minidriver\delta.cat	msiexec.exe

Drops file in Windows directory 18 IoCs

description	ioc	Process
File created	C:\Windows\Installer\e590296.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File created	C:\Windows\Installer\SourceHash{E5093A2F-2B39-4863-83AE-379D8923A1AC}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI3FE.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI95E.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\{E5093A2F-2B39-4863-83AE-379D8923A1AC}\ARPPRODUCTICON.exe	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	svchost.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\e590298.msi	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	MsiExec.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File opened for modification	C:\Windows\inf\oem3.inf	DrvInst.exe
File opened for modification	C:\Windows\Installer\e590296.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIEFD.tmp	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\Installer\{E5093A2F-2B39-4863-83AE-379D8923A1AC}\ARPPRODUCTICON.exe	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIBB0.tmp	msiexec.exe
File created	C:\Windows\inf\oem3.inf	DrvInst.exe

Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs

persistence privilege_escalation

Installer Packages

T1546.016

Msiexec

T1218.007

pid	Process
4300	msiexec.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe

Checks SCSI registry key(s) 3 TTPs 47 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	MsiExec.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID	MsiExec.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\CompatibleIDs	MsiExec.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom	MsiExec.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Phantom	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	DrvInst.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000550aa4e2285040970000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000550aa4e20000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed35000000ffffffff000000000700010000680900550aa4e2000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff350000000000000005000000ffffffff000000000700010000f8ff1a550aa4e2000000000000f0ff350000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d550aa4e2000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\CompatibleIDs	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\CompatibleIDs	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\CompatibleIDs	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom	MsiExec.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	MsiExec.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Phantom	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	MsiExec.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	MsiExec.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	MsiExec.exe

Modifies data under HKEY_USERS 44 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe

Modifies registry class 26 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\F2A3905E93B2368438EA73D998321ACA\INSTALL_32 = "MinidriverIDGo800_Files"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F2A3905E93B2368438EA73D998321ACA\Language = "1033"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F2A3905E93B2368438EA73D998321ACA\Version = "16908297"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F2A3905E93B2368438EA73D998321ACA\Assignment = "1"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F2A3905E93B2368438EA73D998321ACA\AdvertiseFlags = "388"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\22C8EB0044E0F694683A3C70EBCAB13E	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F2A3905E93B2368438EA73D998321ACA\SourceList\Media\DiskPrompt = "[1]"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F2A3905E93B2368438EA73D998321ACA\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F2A3905E93B2368438EA73D998321ACA\SourceList\PackageName = "IDGo800_Minidriver_64.msi"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F2A3905E93B2368438EA73D998321ACA\SourceList\Net	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F2A3905E93B2368438EA73D998321ACA\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\IDGo800_Minidriver_v129\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F2A3905E93B2368438EA73D998321ACA\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\IDGo800_Minidriver_v129\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\F2A3905E93B2368438EA73D998321ACA	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F2A3905E93B2368438EA73D998321ACA\ProductName = "IDGo 800 Minidriver v1.2.9 for 64 bits"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F2A3905E93B2368438EA73D998321ACA\DeploymentFlags = "3"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F2A3905E93B2368438EA73D998321ACA\SourceList\Media	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F2A3905E93B2368438EA73D998321ACA\SourceList\Media\1 = "DISK1;1"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\F2A3905E93B2368438EA73D998321ACA\INSTALL_64 = "MinidriverIDGo800_Files"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F2A3905E93B2368438EA73D998321ACA	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F2A3905E93B2368438EA73D998321ACA\PackageCode = "403DC097E7A88C946A444EB1C7E3D1C5"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F2A3905E93B2368438EA73D998321ACA\ProductIcon = "C:\\Windows\\Installer\\{E5093A2F-2B39-4863-83AE-379D8923A1AC}\\ARPPRODUCTICON.exe"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F2A3905E93B2368438EA73D998321ACA\InstanceType = "0"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F2A3905E93B2368438EA73D998321ACA\AuthorizedLUAApp = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\22C8EB0044E0F694683A3C70EBCAB13E\F2A3905E93B2368438EA73D998321ACA	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F2A3905E93B2368438EA73D998321ACA\Clients = 3a0000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\F2A3905E93B2368438EA73D998321ACA\MinidriverIDGo800_Files	msiexec.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4820	msiexec.exe
4820	msiexec.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4300	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4300	msiexec.exe
Token: SeSecurityPrivilege	4820	msiexec.exe
Token: SeCreateTokenPrivilege	4300	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	4300	msiexec.exe
Token: SeLockMemoryPrivilege	4300	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4300	msiexec.exe
Token: SeMachineAccountPrivilege	4300	msiexec.exe
Token: SeTcbPrivilege	4300	msiexec.exe
Token: SeSecurityPrivilege	4300	msiexec.exe
Token: SeTakeOwnershipPrivilege	4300	msiexec.exe
Token: SeLoadDriverPrivilege	4300	msiexec.exe
Token: SeSystemProfilePrivilege	4300	msiexec.exe
Token: SeSystemtimePrivilege	4300	msiexec.exe
Token: SeProfSingleProcessPrivilege	4300	msiexec.exe
Token: SeIncBasePriorityPrivilege	4300	msiexec.exe
Token: SeCreatePagefilePrivilege	4300	msiexec.exe
Token: SeCreatePermanentPrivilege	4300	msiexec.exe
Token: SeBackupPrivilege	4300	msiexec.exe
Token: SeRestorePrivilege	4300	msiexec.exe
Token: SeShutdownPrivilege	4300	msiexec.exe
Token: SeDebugPrivilege	4300	msiexec.exe
Token: SeAuditPrivilege	4300	msiexec.exe
Token: SeSystemEnvironmentPrivilege	4300	msiexec.exe
Token: SeChangeNotifyPrivilege	4300	msiexec.exe
Token: SeRemoteShutdownPrivilege	4300	msiexec.exe
Token: SeUndockPrivilege	4300	msiexec.exe
Token: SeSyncAgentPrivilege	4300	msiexec.exe
Token: SeEnableDelegationPrivilege	4300	msiexec.exe
Token: SeManageVolumePrivilege	4300	msiexec.exe
Token: SeImpersonatePrivilege	4300	msiexec.exe
Token: SeCreateGlobalPrivilege	4300	msiexec.exe
Token: SeCreateTokenPrivilege	4300	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	4300	msiexec.exe
Token: SeLockMemoryPrivilege	4300	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4300	msiexec.exe
Token: SeMachineAccountPrivilege	4300	msiexec.exe
Token: SeTcbPrivilege	4300	msiexec.exe
Token: SeSecurityPrivilege	4300	msiexec.exe
Token: SeTakeOwnershipPrivilege	4300	msiexec.exe
Token: SeLoadDriverPrivilege	4300	msiexec.exe
Token: SeSystemProfilePrivilege	4300	msiexec.exe
Token: SeSystemtimePrivilege	4300	msiexec.exe
Token: SeProfSingleProcessPrivilege	4300	msiexec.exe
Token: SeIncBasePriorityPrivilege	4300	msiexec.exe
Token: SeCreatePagefilePrivilege	4300	msiexec.exe
Token: SeCreatePermanentPrivilege	4300	msiexec.exe
Token: SeBackupPrivilege	4300	msiexec.exe
Token: SeRestorePrivilege	4300	msiexec.exe
Token: SeShutdownPrivilege	4300	msiexec.exe
Token: SeDebugPrivilege	4300	msiexec.exe
Token: SeAuditPrivilege	4300	msiexec.exe
Token: SeSystemEnvironmentPrivilege	4300	msiexec.exe
Token: SeChangeNotifyPrivilege	4300	msiexec.exe
Token: SeRemoteShutdownPrivilege	4300	msiexec.exe
Token: SeUndockPrivilege	4300	msiexec.exe
Token: SeSyncAgentPrivilege	4300	msiexec.exe
Token: SeEnableDelegationPrivilege	4300	msiexec.exe
Token: SeManageVolumePrivilege	4300	msiexec.exe
Token: SeImpersonatePrivilege	4300	msiexec.exe
Token: SeCreateGlobalPrivilege	4300	msiexec.exe
Token: SeCreateTokenPrivilege	4300	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	4300	msiexec.exe
Token: SeLockMemoryPrivilege	4300	msiexec.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
4300	msiexec.exe
4300	msiexec.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 4820 wrote to memory of 5088	4820	msiexec.exe	86
PID 4820 wrote to memory of 1968	4820	msiexec.exe	93
PID 4820 wrote to memory of 4888	4820	msiexec.exe	95
PID 4820 wrote to memory of 4764	4820	msiexec.exe	96
PID 3144 wrote to memory of 3800	3144	svchost.exe	98

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\IDGo800_Minidriver_v129\IDGo800_Minidriver_64.msi
1⤵
- Badlisted process makes network request
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4300

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4820
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 3A58599F6EC6B1AB3E16CB0357D806BE C
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:5088
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:1968
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding 6EFCBEC0DADB0C87C9A2CC43444C9B46
  2⤵
  - Loads dropped DLL
  PID:4888
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding D3930879F10A3D50951F95F3F4EF7D66 E Global\MSI0000
  2⤵
  - Loads dropped DLL
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Checks SCSI registry key(s)
  PID:4764

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
PID:4792

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall
1⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious use of WriteProcessMemory
PID:3144
- C:\Windows\system32\DrvInst.exe
  DrvInst.exe "4" "1" "C:\Program Files (x86)\Gemalto\IDGo 800 Minidriver\Gemalto.MiniDriver.IDPrime.inf" "9" "41bd40ceb" "0000000000000144" "WinSta0\Default" "0000000000000158" "208" "C:\Program Files (x86)\Gemalto\IDGo 800 Minidriver"
  2⤵
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Checks SCSI registry key(s)
  - Modifies data under HKEY_USERS
  PID:3800

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Installer Packages

T1546.016

Privilege Escalation

Event Triggered Execution

T1546

Installer Packages

T1546.016

Defense Evasion

System Binary Proxy Execution

T1218

Msiexec

T1218.007

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e590297.rbs

Path C:\Config.Msi\e590297.rbs
Size 674KB
SHA256 337599695b6f660bbe6ab65faf18d63d31f5bfc742fd2fc84f1a1b325cf63448
MD5 e9282b6219adfa768958732b952046b6
SHA1 abc6fc29f3d942c229665e84f9edc7c529c80ca8
SHA512 9be5bc6c836a401d1df52bf95cda6a96b8330a720ed802a4fb25f32ae7eacfc40307720cbd70d04c792c57cd54837d82b878d4dd416636771b330cce9b25ac7b
SSDEEP 6144:E11HMbt9eFVmIGccehSleghteGzRSDWFQ//fo4CyRg5Sy3rRsaCUhsm27QB:z5cceNKt7zRy/zCyas8ROUOVq
TLSH
T1B5E46614F9B80521E163997FA6A2AE5DD17239861731CACF0302DBF61D3B5D68632F32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

axaltocm.dll

Path C:\PROGRA~2\Gemalto\IDGO80~1\axaltocm.dll
Size 1.1MB
SHA256 0d6264f1ede0306eb100f3a9453833c331f04349e5f9ea748a1143658bdd5bb6
MD5 005d09aa627a0a1ad3198ce79247bd7c
SHA1 a16c2e7d38abe16f3108ab0b28dbf92f63c35138
SHA512 efb437801d03bd988f5ff9adc0642ce177f58c2b2d36ab72cc1b826f91234cabf4883e9b3554744b5a62981efd4ae5124c93ac6a7128121f7cd8ddc0040a9cb0
SSDEEP 24576:OXTGsdMqa1ey3XiQm+M8e5jVgYrDfeN1PEZ29e1IgZ2mkQYsi6Nm:5grzjIeDZjkf0Nm
TLSH
T1B8459E22B740C132EA9E12704578B76B187E7A71276584C3F7D6BED9AE701E2763430B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

delta.cat

Path C:\PROGRA~2\Gemalto\IDGO80~1\delta.cat
Size 8KB
SHA256 10685c1bec6ad2c884887727f3be07681b6f1d0da4af72f2d6cd06dd0c362c84
MD5 c073c9928fa25a6f50bd99449d5fb123
SHA1 18c9593e0e2ed682916e3f42e43577cc59f6c019
SHA512 8d2c01fa5e63749483a5e5507f98d1ee94dba80aff0d98362836389f15bebdb128fdddeafbdd7932b768b7fa8b049449ad60ba4841ff37a8be53467931fbe3e3
SSDEEP 192:shETvT20TR2SwdRivT1D6LJT+wa+3Ef5KYpBjSgUd:p72O1wdIvT1DS+x+3Ef5dpBjB4
TLSH
T13712D8A58EBC1183F983C97193F5EA93BC39EBD3EC40462D50AFA79848923C5B74851D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Gemalto.MiniDriver.IDPrime.inf

Path C:\Program Files (x86)\Gemalto\IDGo 800 Minidriver\Gemalto.MiniDriver.IDPrime.inf
Size 25KB
SHA256 8df8580a8a484b5648f0b03bfdc9ead2aa70c3a93d8154ca753213e629fb04d6
MD5 9fa2baa4d109a3d1403cdedeb5c752d4
SHA1 1f699a90767d9648dcfecb92597f40f73a6c98ff
SHA512 51f86009dcfe182aad609b2b0dbb14a7c6fc06a0164d9e7749cb5ff4239e5d3bb852dd122a37bb78f964fa0727694a1fad216f55803f669486ce2124bcf36c95
SSDEEP 768:V3rOCWGWdNLNiiniEItTySbcPY4YmN3NvGL8Tqu8haFs0BObB86wPOkdx6+4iMTX:hrOCWGWdNLNiiniEItTySbcPY4YmN3Nw
TLSH
T138C2F0B28391C937E1202796BB107E63E2B5F60731E5BE2FA5B281358947DD50E097CB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

40C68D5626484A90937F0752C8B950AB

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\40C68D5626484A90937F0752C8B950AB
Size 834B
SHA256 de6bcf84b3f5959cfdf2f8b6622a68cbbbd52d804e59751a5e52a8ac985d369d
MD5 4ae5d026e246530e8e5c389ad0814e17
SHA1 e1c1a7225cac5fafcbb8bd8abf30559d2029914c
SHA512 1d0139cf1270f44e1d0fcc8d9eca365fbb86bb3bcd0993904c02b581a20f51aeb14d1de32a9224337f35a2c61667e791bf3a965d34633a5905526e986f772170
TLSH
T1740112E6C1187921A4915725C19CFD5FC87473C95FC9D44A90F8C7CA2C63F986B4206B
MD5 SHA1 SHA512 TLSH

Submit Download

EA618097E393409AFA316F0F87E2C202_952BC80A898840589746AED219F44DAF

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\EA618097E393409AFA316F0F87E2C202_952BC80A898840589746AED219F44DAF
Size 5B
SHA256 bebe2853a3485d1c2e5c5be4249183e0ddaff9f87de71652371700a89d937128
MD5 5bfa51f3a417b98e7443eca90fc94703
SHA1 8c015d80b8a23f780bdd215dc842b0f5551f63bd
SHA512 4cd03686254bb28754cbaa635ae1264723e2be80ce1dd0f78d1ab7aee72232f5b285f79e488e9c5c49ff343015bd07bb8433d6cee08ae3cea8c317303e3ac399
MD5 SHA1 SHA512

Submit Download

ECF3006D44DA211141391220EE5049F4

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\ECF3006D44DA211141391220EE5049F4
Size 87KB
SHA256 ca6108a6a569ec0aefb3167a7a3bc744127fe0c1522325d17d68d9d053327ef7
MD5 fe637bc16d93e22c38591c37bff493c5
SHA1 0be45a318fc0b930064dd33c529b09ccc199ae21
SHA512 eddfad6496f136d5176884aa07560a069bf4a94d35be292021f0d2b97d807cfd43c1f2e18cf272004c9b1aaca2e34079ebbd61ff1006f292ffca826270d36e1f
SSDEEP 1536:ufb1ULoksiiozs4/VCLA3Qy2gsvHuuQSJAjCz2Q59:mb1Jk15sEVTjRs/uSOj2l
TLSH
T1F493EBDCAC5539D76045A2B1C89B4EEBDDB2B58533D2D41A92A54F014822FCEDEE80F3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

40C68D5626484A90937F0752C8B950AB

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\40C68D5626484A90937F0752C8B950AB
Size 180B
SHA256 d2bc9de9099086be512905ba801a5194b26b7571a377b6a1b567e022ccf33cd0
MD5 59eef34c5e55f0fce16af662020c6eb0
SHA1 a8d7ab4000b3c8ff6c294863caf0426312c8314d
SHA512 73466dd216ca097731f285aece486e3dbd6eb1cda607b651fb113c76fa843004c1c65920aa81277b638ee39358dad3c08cc716bcc37951bd24d83b65d2d80108
TLSH
T113C02B002F9607CBED10053D207506107F38A302DB02C3010FFC1084491FE100D73D07
MD5 SHA1 SHA512 TLSH

Submit Download

EA618097E393409AFA316F0F87E2C202_952BC80A898840589746AED219F44DAF

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\EA618097E393409AFA316F0F87E2C202_952BC80A898840589746AED219F44DAF
Size 402B
SHA256 00cfb0f67cb68d63734922f6442aa68f02f8e0b8c5b659c85cb7ca25c2782c1f
MD5 8783fb464b26ea874dfe9301ab11e356
SHA1 85d081ec0efa191c0df86f989b8a2b0662aa4046
SHA512 ac2af644b18d81cd8c1b59c10373ecd447bea42346138bf77fc338d66b8257d87764b140921438c96766a8f802345bc384515b5686d5edb353857f6404f5ac28
TLSH
T18EE07D080ABFC11DF632CEB9DDE964752D19E122180956F900E05309BF07E01BCA2A70
MD5 SHA1 SHA512 TLSH

Submit Download

ECF3006D44DA211141391220EE5049F4

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\ECF3006D44DA211141391220EE5049F4
Size 170B
SHA256 adf203da6c772f39689f0c7c97c002dac4ad4923723e64b43a8d348917193032
MD5 60dd32910e104d54af84ed6901d3f0e4
SHA1 cb8ae4ea3bbfb78ff047f694973fb3a23b7bf26e
SHA512 11edb1e0d9e68fcc90c3a2ff03c4a86d4b9555fca510e3c0864d3ba4773356c2b53be8d775106bd36311cf1fbda769864a065cccd35f5b1f8ff23b73c614dad6
TLSH
T16CC02B400E1483CBE9740F3D10AD2A106B1000409C29C38043FC00880D50F11CCF2C04
MD5 SHA1 SHA512 TLSH

Submit Download

MSI874C.tmp

Path C:\Users\Admin\AppData\Local\Temp\MSI874C.tmp
Size 141KB
SHA256 4c3d85e7c49928af0f43623dcbed474a157ef50af3cba40b7fd7ac3fe3df2f15
MD5 edb88affffd67bca3523b41d3e2e4810
SHA1 0055b93907665fed56d22a7614a581a87d060ead
SHA512 2b9d99c57bfa9ab00d8582d55b18c5bf155a4ac83cf4c92247be23c35be818b082b3d6fe38fa905d304d2d8b957f3db73428da88e46acc3a7e3fee99d05e4daf
SSDEEP 3072:Biaf8jGZY0WHkCKblNnRNE/I6CQQAMllgKtf5nY+M:L8jWY0WTcRNEw5QQpX9m
TLSH
T138E359117BE0C032E4AA2938193597755A3FB930AF74C6CB77650A6E4E70BD19E3A307
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSI95E.tmp

Path C:\Windows\Installer\MSI95E.tmp
Size 107KB
SHA256 16c4cf37242385f27d2625ee8b660b745342ef8340541e6c7e4673522ed13956
MD5 cf6354b5789cb6b9691b8896e255a378
SHA1 e9429ffa42b00f45073fa1989f92c2c27d7aad86
SHA512 7ba049a5ec80d94763d44c7cdc85d2e94b4edfe5db2ce575d594e4914f321bbb730f60b33f2ff9f58f359ce4f4b35dd5efbaad670c30c31dd836735110776202
SSDEEP 1536:zCDvWcAQcnkygLVSA10DUXqUWqJ76Yjfx6Luy/ViX:DkyASA1CUdRLTy/QX
TLSH
T115B3F915BFBC0029F1716A3E95E25528E1753D822B3187EF2D02A7DA1E37AD58436F32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSIBB0.tmp

Path C:\Windows\Installer\MSIBB0.tmp
Size 650KB
SHA256 07694439a93f220f5e9f46ac3ceb0b22fe1dadb3ed9bf18a9f2835be7a5c3bc6
MD5 6aa987dbea3f424fa44cd541dbae7368
SHA1 47ba276719f0a3e25e24fb546ecad8b97b6ebe67
SHA512 c5c5901bcdfdb413cb679d39c90a4fa64e96ad10d25476c62e2d2276bdc1cf8a5b4d987f881acb701ffaaa22662b64442e399f1aa8cb6ff5c761e03c474756a2
SSDEEP 6144:R11HMbt9eFVmIGccehSleghteGzRSDWFQ//fo4CyRg5Sy3rRsaCUhsm27QE:w5cceNKt7zRy/zCyas8ROUOVb
TLSH
T185E46514F9B80525E163997FA2A29E5DD17239861731CACF0302DBF61D3B5DA8632F32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e590296.msi

Path C:\Windows\Installer\e590296.msi
Size 4.5MB
SHA256 9774a7d35b93219216067172fa3741ade7df2adbbee19dbc391013f52ebd00b5
MD5 431eefd1b99b2f4d6f5c1e61a82aa7cd
SHA1 78bbde10ad06f75bf0d730c6398ba43cc6629ee5
SHA512 be73ca70a5979122b635171c309c4f27c115ae61df5eeb5186591f425e78509871e13222c02786d9703ba83e5756e65adfa05576722800adb399d43e47f31c4b
SSDEEP 98304:JvXC2LSFllRCYyOzP8Kr5hkczq27KVG5P5wVVwsx33ijLXLYEUENuyB1+82P4Wmm:Ri9Pfz2P4Wof6b/M3UOVE5
TLSH
T12D26DF11F6A4023AD0528A7FD5939A69D6B23C5627318BCF1302F7BA0D375D68636F32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dberr.txt

Path C:\Windows\System32\CatRoot2\dberr.txt
Size 40KB
SHA256 aa4c0c38fcdb7b3d7929bbbf6ee1f3db04b67e05e29c6581edaa056fd454cf43
MD5 cad966e21ce75572c6c972cac416748d
SHA1 659411451d560e3378ffbf3bbe8d639bc72785e4
SHA512 e4c53683ac0fad33f16ce74bde29a712a5acd33d17b1d7afa7d4559d5d46555e5cb62031560390810fd75ba3262a3245ace6299c02a9e9114c00f241028365d1
SSDEEP 768:xC3VUI40LPZKTTD3eej4t9kaCwQ3cwQxxwzVAy:xC3VU4LPZKTTD3eejkTCwQ3cwQxxwzVJ
TLSH
T15E033906D1E84490C5F50972777EDEB0C9DFA5CAB70B6EED30AC63149AC2B042EB645E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

axaltocm64.dll

Path C:\Windows\System32\DriverStore\Temp\{584f7d73-5d0f-af4a-ad27-c9590f8c8ddf}\axaltocm64.dll
Size 1.5MB
SHA256 6984ed0b9ea0e68597fd037783fbd067627b4f47c99207e29a92af8bffbe34f7
MD5 957c575464fd9301333bf68a954b52e7
SHA1 09f0b9ef841270e9675e0a50aed4b7f031d9db01
SHA512 a41b08f337767db3cc205bcaef8cc8e2ef65fd7f85511d097471c5adcc7206f06ffe2ae2a6d8f19fd4bfbc7111d4f779a428f865d9b9d84505928f8db14c9e48
SSDEEP 24576:TRtbl/FbNZZXkzs6uYkZXCd4uvMjd3YJNOXikgj6gNI5SETmDtQoZgqkJL:Tb/bxXkzs6uYkZXCd4uvMj8NOykgpI5X
TLSH
T114758D16F71C40B9C077C178C9979607E6B178185B706BDF4A85AF9D1E23BE8AA3DB00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata-2

Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
Size 24.1MB
SHA256 20b15e52d8e89000fc913d85561a4ce4ad22cd2802e4f9c2bd611a791ba6d2e7
MD5 19ff5d8ca41b2901d952af89bf0947de
SHA1 8dcf593bc1ec04e524327e3a50a8e37344352e6d
SHA512 411e128f500de38a42a7c3c426b4ab97edb0f573479e6691f5e98a0364551af5c41c659d8b61ed7758505cf3120bc34a2e261f13854a281b57dc9af7d2724748
SSDEEP 24576:ru8m+1zkdoO/vvTLLWO+bGaKvX0T21eiCYGNshfFG06fOZ3TIPVX2oFx7:k
TLSH
T1C547D52436FD2110E7F79E3C78F46A23893A7D5B9C15DE8D05461B4E0A21BB0E872F5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{0e6bb09c-841c-4651-b1bf-e54d0671563b}_OnDiskSnapshotProp

Path \??\Volume{e2a40a55-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{0e6bb09c-841c-4651-b1bf-e54d0671563b}_OnDiskSnapshotProp
Size 6KB
SHA256 0601c5a60c1ec53542f980210a99a46e1dc48dc33f182a096ede60b30c19db19
MD5 9811d180ff54f4264666c2dca01c4939
SHA1 404b46d6d3f4eac0a4afe0e9015efb04b432e3c2
SHA512 53cef38ac967ab1e787ea12569bd52c54e5907699fdc5eb5b46b3806552f40d9cce9099d5274185dea0871c798c489ac2b94da30527de9ddb74ea3612d2924cf
SSDEEP 96:FkRcu+vc8DD84LTHzbOHXOHBlBRQ88Sc9XE56tOSVQpu:ywb++ZVm
TLSH
T10CD178085AF54311E2B3AB7129F18557A877B811EF33CB8E0198238E6671910F975F5F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3800-115-0x0000021647AA0000-0x0000021647AAC000-memory.dmp

Download

memory/4300-19-0x000001F220F80000-0x000001F221095000-memory.dmp

Download

memory/4300-20-0x000001F220F60000-0x000001F220F6C000-memory.dmp

Download

memory/4300-136-0x000001F220F60000-0x000001F220F6C000-memory.dmp

Download

memory/4300-135-0x000001F220F80000-0x000001F221095000-memory.dmp

Download

memory/4820-137-0x000002AD67230000-0x000002AD6723C000-memory.dmp

Download