Analysis
- user interaction
yes - max time kernel
149s - max time network
161s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
- submitted
01/05/2026, 04:38
General
- Target Camtasia (2021) v2021.0.8 Build 32516/camtasia.exe
- Size 453.5MB
- Sample260501-e9d5qsgs4l
- SHA256 171a97520d980f2be0df770513e354ba3f8cbe39a40a52fab0c1961c42c31a68
Malware Config
Signatures
- Adds Run key to start application 2 TTPs 1 IoCs
- Badlisted process makes network request 1 IoCs
Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
- Drops file in System32 directory 22 IoCs
- Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Drops file in Program Files directory 64 IoCs
- Drops file in Windows directory 64 IoCs
- Executes dropped EXE 9 IoCs
- Loads dropped DLL 64 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 12 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
- Modifies Internet Explorer settings 1 TTPs 2 IoCs
- Modifies data under HKEY_USERS 3 IoCs
- Modifies registry class 64 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of FindShellTrayWindow 3 IoCs
- Suspicious use of SetWindowsHookEx 4 IoCs
- Suspicious use of WriteProcessMemory 15 IoCs
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\Camtasia (2021) v2021.0.8 Build 32516\camtasia.exe"C:\Users\Admin\AppData\Local\Temp\Camtasia (2021) v2021.0.8 Build 32516\camtasia.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\Temp\{73F421C1-8E0B-4638-943E-B96EDD4E4BFB}\.cr\camtasia.exe"C:\Windows\Temp\{73F421C1-8E0B-4638-943E-B96EDD4E4BFB}\.cr\camtasia.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\Camtasia (2021) v2021.0.8 Build 32516\camtasia.exe" -burn.filehandle.attached=548 -burn.filehandle.self=5402⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Windows\Temp\{2D0FE9ED-8277-452D-A88A-529AC786DB03}\.be\CamtasiaInstaller.exe"C:\Windows\Temp\{2D0FE9ED-8277-452D-A88A-529AC786DB03}\.be\CamtasiaInstaller.exe" -q -burn.elevated BurnPipe.{25878194-D52A-4774-BBBE-A6EE62CDAAB3} {56A48D27-428A-40FB-A4A2-37B3F9AA698C} 47323⤵
- Adds Run key to start application
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:21⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\ProgramData\Package Cache\{a1152843-5a52-4c99-b29c-622e86318d40}\CamtasiaInstaller.exe"C:\ProgramData\Package Cache\{a1152843-5a52-4c99-b29c-622e86318d40}\CamtasiaInstaller.exe" /burn.runonce1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\Package Cache\{a1152843-5a52-4c99-b29c-622e86318d40}\CamtasiaInstaller.exe"C:\ProgramData\Package Cache\{a1152843-5a52-4c99-b29c-622e86318d40}\CamtasiaInstaller.exe" /burn.log.append "C:\Users\Admin\AppData\Local\Temp\Camtasia_2021_20260501054544.log"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\Package Cache\{a1152843-5a52-4c99-b29c-622e86318d40}\CamtasiaInstaller.exe"C:\ProgramData\Package Cache\{a1152843-5a52-4c99-b29c-622e86318d40}\CamtasiaInstaller.exe" -burn.clean.room="C:\ProgramData\Package Cache\{a1152843-5a52-4c99-b29c-622e86318d40}\CamtasiaInstaller.exe" -burn.filehandle.attached=516 -burn.filehandle.self=536 /burn.log.append "C:\Users\Admin\AppData\Local\Temp\Camtasia_2021_20260501054544.log"3⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Badlisted process makes network request
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 0B6932D84A4CC65CFD3B5CEF6772E4252⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Windows\Installer\MSI35FA.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240727656 2 FileSystemCA!FileSystemCA.CustomActions.TSC_SetPropertyFromIniFile3⤵
- Drops file in Windows directory
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Windows\Installer\MSI37A1.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240727968 10 FileSystemCA!FileSystemCA.CustomActions.TSC_SetPropertyFromIniFile3⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Windows\Installer\MSI389C.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240728234 18 FileSystemCA!FileSystemCA.CustomActions.TSC_SetPropertyFromIniFile3⤵
- Drops file in Windows directory
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Windows\Installer\MSI3988.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240728468 26 FileSystemCA!FileSystemCA.CustomActions.TSC_SetPropertyFromIniFile3⤵
- Drops file in Windows directory
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\System32\MsiExec.exeC:\Windows\System32\MsiExec.exe -Embedding 7F400458132FFB9D38FC6E0F3BA3D7652⤵
- Loads dropped DLL
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding CCBF4F16B87650513D8C545DC0395366 E Global\MSI00002⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
-
C:\Windows\System32\MsiExec.exeC:\Windows\System32\MsiExec.exe -Embedding 70A6019F36A2757E6FEAB0C774AA43B2 E Global\MSI00002⤵
- Loads dropped DLL
-
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Program Files\TechSmith\Camtasia 2021\CamtasiaStudio.exe"C:\Program Files\TechSmith\Camtasia 2021\CamtasiaStudio.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\mountvol.exeC:\Windows\System32\mountvol.exe C: /L2⤵
-
-
C:\Program Files\TechSmith\Camtasia 2021\crashpad_handler.exe"C:\Program Files\TechSmith\Camtasia 2021\crashpad_handler.exe" --no-rate-limit "--database=C:\Users\Admin\AppData\Local\TechSmith\Camtasia Studio\21.0\CrashReportingNative" "--metrics-dir=C:\Users\Admin\AppData\Local\TechSmith\Camtasia Studio\21.0\CrashReportingNative" --url=https://submit.backtrace.io/techsmith/252ca6f32f8a07a44ceb1046d56ffdae143ffbae8f1c0fb906b4c9aea03dad15/minidump --annotation=format=minidump --annotation=token=252ca6f32f8a07a44ceb1046d56ffdae143ffbae8f1c0fb906b4c9aea03dad15 --initial-client-data=0xd28,0xd1c,0xd30,0xd2c,0xd24,0x7ff8241ea2e8,0x7ff8241ea300,0x7ff8241ea3182⤵
- Executes dropped EXE
-
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x51c 0x2fc1⤵
-
C:\Program Files\TechSmith\Camtasia 2021\CamtasiaRecorder.exe"C:\Program Files\TechSmith\Camtasia 2021\CamtasiaRecorder.exe"1⤵
- Executes dropped EXE
-
C:\Program Files\TechSmith\Camtasia 2021\LegacyCamRecorder.exe"C:\Program Files\TechSmith\Camtasia 2021\LegacyCamRecorder.exe"1⤵
- Checks computer location settings
- Executes dropped EXE
- Checks processor information in registry
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\mountvol.exeC:\Windows\System32\mountvol.exe C: /L2⤵
-
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Component Object Model Hijacking
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Component Object Model Hijacking
1Replay Monitor
Loading Replay Monitor...
Downloads
e592ad0.rbs
aero_helpsel_xl.cur
aero_nwse.xml
Keystroke_Clear.png
Keystroke_Clear32.png
Keystroke_Gray.png
Keystroke_Gray32.png
Keystroke_Traditional.png
Keystroke_Traditional32.png
Keystroke_White_outline.png
Keystroke_White_outline32.png
KeystrokeData.xml
KeystrokeData.xml
Keystrokes.xml
KeystrokeData.xml
KeystrokeData.xml
Newtonsoft.Json.dll
Camtasia 2021.lnk
Camtasia 2021.lnk
Camtasia 2021.lnk~RFe598a83.TMP
state.rsm
rundll32.exe.log
f0091ec5-edbc-4c11-b4f8-2e1a95a731af.tsctemplate
templateInfo.json
ruilogV5_36B99DCEE696FA29_amyrtibeex_Camtasia_001IGN94NPKFF.log
Camtasia 2021 Default Template.camtemplate
GRIDBKGD-WHITE-2.png
GRIDBKGD.png
Logo Placeholder.png
VIGNETTII.png
f0091ec5-edbc-4c11-b4f8-2e1a95a731af_Template_Preview.png
Camtasia_2021_20260501054544_000_CamtasiaStudioInstallerx64.log
features.json
features.json
MP4 only (up to 1080p).xml
MP4 only (up to 480p).xml
MP4 only (up to 720p).xml
MP4 with Smart Player (up to 1080p).xml
MP4 with Smart Player (up to 480p).xml
MP4 with Smart Player (up to 720p).xml
Camtasia 2021.lnk
Camtasia 2021.lnk
Camtasia 2021.lnk~RFe598ad1.TMP
653e1cae842f77e41a.lic
653e1cae842f77e41a.lic
MSI35FA.tmp
FileSystemCA.dll
Microsoft.Deployment.WindowsInstaller.dll
CustomAction.config
MSI3A54.tmp
MSI3AC2.tmp
MSI8824.tmp
MSI89BB.tmp
MSIA342.tmp
BootstrapperCore.config
BootstrapperCore.dll
CamtasiaBootstrapperApplication.dll
EditionConstants.dll
System.Windows.Interactivity.dll
WPFCommonControls.dll
WPFCommonViewModel.dll
mbahost.dll
camtasia.exe
memory/224-201-0x0000000003100000-0x000000000312E000-memory.dmp
memory/224-209-0x0000000001350000-0x00000000013C5000-memory.dmp
memory/224-205-0x0000000003140000-0x0000000003148000-memory.dmp
memory/404-1806-0x0000016AB8C20000-0x0000016AB8C75000-memory.dmp
memory/800-1988-0x00000211744B0000-0x00000211744B8000-memory.dmp
memory/800-1971-0x0000021174300000-0x000002117430C000-memory.dmp
memory/800-2086-0x0000021173620000-0x0000021173637000-memory.dmp
memory/800-2084-0x00000211561A0000-0x00000211561AC000-memory.dmp
memory/800-2085-0x0000021172BE0000-0x0000021172BE8000-memory.dmp
memory/800-2065-0x0000021977690000-0x00000219776AC000-memory.dmp
memory/800-2061-0x0000021977B80000-0x0000021977B90000-memory.dmp
memory/800-2060-0x00000219797D0000-0x0000021979F76000-memory.dmp
memory/800-2056-0x00000211561A0000-0x00000211561AC000-memory.dmp
memory/800-2057-0x0000021172BE0000-0x0000021172BE8000-memory.dmp
memory/800-2054-0x0000021177160000-0x0000021177198000-memory.dmp
memory/800-2055-0x0000021177120000-0x000002117712E000-memory.dmp
memory/800-2053-0x0000021177110000-0x0000021177118000-memory.dmp
memory/800-2002-0x00000211745F0000-0x00000211745FA000-memory.dmp
memory/800-1998-0x0000021174540000-0x000002117454C000-memory.dmp
memory/800-1853-0x0000021155D50000-0x0000021155E20000-memory.dmp
memory/800-1854-0x00000211561E0000-0x000002115620A000-memory.dmp
memory/800-1855-0x0000021156230000-0x0000021156246000-memory.dmp
memory/800-1857-0x0000021170770000-0x000002117087C000-memory.dmp
memory/800-1856-0x00000211561C0000-0x00000211561CA000-memory.dmp
memory/800-1858-0x0000021157A50000-0x0000021157A88000-memory.dmp
memory/800-1859-0x0000021157AC0000-0x0000021157AE8000-memory.dmp
memory/800-1860-0x0000021170DE0000-0x0000021171334000-memory.dmp
memory/800-1861-0x00000211704F0000-0x0000021170578000-memory.dmp
memory/800-1862-0x0000021170A20000-0x0000021170BBE000-memory.dmp
memory/800-1863-0x0000021170BC0000-0x0000021170CE0000-memory.dmp
memory/800-1865-0x0000021157A90000-0x0000021157A9A000-memory.dmp
memory/800-1864-0x0000021171340000-0x0000021171476000-memory.dmp
memory/800-1866-0x0000021171480000-0x0000021172603000-memory.dmp
memory/800-1868-0x0000021170990000-0x00000211709DB000-memory.dmp
memory/800-1869-0x0000021170CE0000-0x0000021170DA6000-memory.dmp
memory/800-1867-0x00007FF825960000-0x00007FF827093000-memory.dmp
memory/800-1870-0x0000021172910000-0x0000021172911000-memory.dmp
memory/800-1871-0x0000021172D30000-0x0000021172D74000-memory.dmp
memory/800-1872-0x0000021172A70000-0x0000021172A82000-memory.dmp
memory/800-1997-0x0000021174530000-0x0000021174540000-memory.dmp
memory/800-1996-0x0000021174520000-0x000002117452C000-memory.dmp
memory/800-1917-0x0000021173490000-0x00000211734AC000-memory.dmp
memory/800-1918-0x00007FF846C10000-0x00007FF846C2C000-memory.dmp
memory/800-1919-0x00000211735C0000-0x00000211735D0000-memory.dmp
memory/800-1920-0x0000021173650000-0x00000211736C8000-memory.dmp
memory/800-1995-0x00000211744D0000-0x00000211744D8000-memory.dmp
memory/800-1994-0x00000211744C0000-0x00000211744CA000-memory.dmp
memory/800-1991-0x0000021174500000-0x0000021174514000-memory.dmp
memory/800-1992-0x00000211745A0000-0x00000211745CC000-memory.dmp
memory/800-1993-0x0000021174610000-0x0000021174644000-memory.dmp
memory/800-1990-0x0000021174550000-0x0000021174598000-memory.dmp
memory/800-1959-0x00000211740E0000-0x00000211740F2000-memory.dmp
memory/800-1958-0x0000021174120000-0x0000021174152000-memory.dmp
memory/800-1957-0x00000211740C0000-0x00000211740DC000-memory.dmp
memory/800-1960-0x00000211740B0000-0x00000211740B8000-memory.dmp
memory/800-1961-0x0000021174100000-0x000002117410E000-memory.dmp
memory/800-1962-0x0000021174180000-0x000002117419A000-memory.dmp
memory/800-1963-0x0000021174250000-0x00000211742FA000-memory.dmp
memory/800-1964-0x00000211741A0000-0x0000021174211000-memory.dmp
memory/800-1968-0x0000021174230000-0x0000021174240000-memory.dmp
memory/800-1969-0x0000021174160000-0x000002117417D000-memory.dmp
memory/800-1989-0x00000211744E0000-0x00000211744FA000-memory.dmp
memory/800-1970-0x0000021174240000-0x000002117424A000-memory.dmp
memory/800-1986-0x0000021174310000-0x000002117431A000-memory.dmp
memory/800-1980-0x0000021174390000-0x0000021174406000-memory.dmp
memory/800-1981-0x0000021174340000-0x0000021174362000-memory.dmp
memory/800-1982-0x0000021174370000-0x000002117438E000-memory.dmp
memory/800-1983-0x0000021174410000-0x000002117442A000-memory.dmp
memory/800-1984-0x0000021174320000-0x0000021174328000-memory.dmp
memory/800-1985-0x0000021174430000-0x00000211744A0000-memory.dmp
memory/800-1987-0x00000211744A0000-0x00000211744AA000-memory.dmp
memory/1376-2106-0x00007FF6260E0000-0x00007FF626BAA000-memory.dmp
memory/1376-2114-0x00007FF6260E0000-0x00007FF626BAA000-memory.dmp
memory/1376-2110-0x00007FF6260E0000-0x00007FF626BAA000-memory.dmp
memory/1376-2105-0x00007FF82EDE0000-0x00007FF830513000-memory.dmp
memory/1376-2107-0x00007FF6260E0000-0x00007FF626BAA000-memory.dmp
memory/1376-2164-0x000002B923C40000-0x000002B923C48000-memory.dmp
memory/1376-2115-0x00007FF6260E0000-0x00007FF626BAA000-memory.dmp
memory/1896-1802-0x0000000001320000-0x0000000001395000-memory.dmp
memory/1920-267-0x0000000000770000-0x00000000007E5000-memory.dmp
memory/2280-229-0x00000000027E0000-0x0000000002855000-memory.dmp
memory/3244-1804-0x000001C088A20000-0x000001C088A75000-memory.dmp
memory/3280-319-0x000001F4DE590000-0x000001F4DE5E5000-memory.dmp
memory/3280-321-0x000001F480010000-0x000001F480018000-memory.dmp
memory/3280-1761-0x000001F4DE590000-0x000001F4DE5E5000-memory.dmp
memory/3280-320-0x000001F4FB550000-0x000001F4FB55C000-memory.dmp
memory/3772-248-0x0000000000A90000-0x0000000000B05000-memory.dmp
memory/4128-119-0x000002708B410000-0x000002708B418000-memory.dmp
memory/4484-1060-0x000001F6EE710000-0x000001F6EE765000-memory.dmp
memory/4484-1803-0x000001F6EE710000-0x000001F6EE765000-memory.dmp
memory/4692-1800-0x0000000000F90000-0x0000000001005000-memory.dmp
memory/4692-334-0x0000000000F90000-0x0000000001005000-memory.dmp
memory/4732-100-0x0000000006670000-0x0000000006680000-memory.dmp
memory/4732-66-0x00000000064C0000-0x00000000064D8000-memory.dmp
memory/4732-83-0x0000000006C40000-0x0000000006C48000-memory.dmp
memory/4732-96-0x000000000BC30000-0x000000000BC68000-memory.dmp
memory/4732-87-0x0000000006FD0000-0x0000000006FE0000-memory.dmp
memory/4732-91-0x0000000007070000-0x0000000007100000-memory.dmp
memory/4732-93-0x0000000007020000-0x0000000007060000-memory.dmp
memory/4732-94-0x0000000006670000-0x0000000006680000-memory.dmp
memory/4732-1833-0x000000000C570000-0x000000000C60F000-memory.dmp
memory/4732-114-0x000000000C570000-0x000000000C60F000-memory.dmp
memory/4732-77-0x0000000006900000-0x000000000690A000-memory.dmp
memory/4732-95-0x0000000009670000-0x0000000009678000-memory.dmp
memory/4732-78-0x0000000006670000-0x0000000006680000-memory.dmp
memory/4732-61-0x0000000006670000-0x0000000006680000-memory.dmp
memory/4732-97-0x000000000B950000-0x000000000B95E000-memory.dmp
memory/4732-98-0x0000000006670000-0x0000000006680000-memory.dmp
memory/4732-99-0x0000000006670000-0x0000000006680000-memory.dmp
memory/4732-73-0x0000000006980000-0x0000000006A3A000-memory.dmp
memory/4732-113-0x0000000006670000-0x0000000006680000-memory.dmp
memory/4732-101-0x0000000006670000-0x0000000006680000-memory.dmp
memory/4852-2103-0x000001FE1D9F0000-0x000001FE1D9FC000-memory.dmp
memory/4852-2093-0x000001FE37CB0000-0x000001FE37CB8000-memory.dmp
memory/4852-2094-0x000001FE38100000-0x000001FE3818B000-memory.dmp
memory/4852-2089-0x000001FE1D5C0000-0x000001FE1D670000-memory.dmp
memory/4852-2091-0x000001FE1DA50000-0x000001FE1DA74000-memory.dmp
memory/4852-2090-0x000001FE1DA00000-0x000001FE1DA0A000-memory.dmp
memory/4852-2092-0x000001FE37C70000-0x000001FE37C8D000-memory.dmp