ade6608a1d2797e0e1f3ba4076ebda10ebcd4ac52ae879977c58059b8c4d59c4

Analysis

max time kernel
78s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260617-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260617-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
26/06/2026, 12:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
CheckpointVPN-BMD-Cloud-AT.msi
Size 35.7MB
Sample260626-phnvzabt2t
SHA256 ade6608a1d2797e0e1f3ba4076ebda10ebcd4ac52ae879977c58059b8c4d59c4
MD5 24b447aa38146ef455741824a5571be6
SHA1 b41297e990a01296e026bff7ef01e35f44f2c188
SHA512 84c98d46f444c904ba0097294f5176df9142c116e33a440d45e711790e1f6c2cea6e5758358ee6c5e4d50d24ab261a523ce31643a1b1b5763302b57cb7434563
SSDEEP 786432:yE9qPJuTtlmkMIvq1onzynv1e362wCA+ANgAVYnL/tbb6H:1YP0hlmkMIvqenzP62n4VYLcH
TLSH
T1638712027E46C072DBAD06741029F7BE6EBDE820172045CBEBD42D3E6D705C1A67AB67
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

adware discovery persistence privilege_escalation ransomware spyware

Malware Config

Signatures

Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-28459746-3881314244-166055492-1000\Software\Microsoft\Active Setup\Installed Components	explorer.exe

Executes dropped EXE 3 IoCs

pid	Process
3068	vna_utils.exe
2504	vna_utils.exe
2016	vna_install64.exe

Loads dropped DLL 15 IoCs

pid	Process
2020	MsiExec.exe
2020	MsiExec.exe
2020	MsiExec.exe
4296	MsiExec.exe
4296	MsiExec.exe
4296	MsiExec.exe
4296	MsiExec.exe
4296	MsiExec.exe
3440	MsiExec.exe
3440	MsiExec.exe
3440	MsiExec.exe
3440	MsiExec.exe
3440	MsiExec.exe
3440	MsiExec.exe
3440	MsiExec.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Check Point Endpoint Security VPN = "\"C:\\Program Files (x86)\\CheckPoint\\Endpoint Connect\\TrGUI.exe\""	msiexec.exe

Badlisted process makes network request 3 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
2	3296	msiexec.exe
3	3296	msiexec.exe
9	2676	msiexec.exe

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\E:	explorer.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\F:	explorer.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe

Drops file in System32 directory 62 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\api-ms-win-core-file-l1-2-0.dll	msiexec.exe
File created	C:\Windows\SysWOW64\api-ms-win-core-interlocked-l1-1-0.dll	msiexec.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{02a8bb6d-7f3e-3547-8cce-32b71b90a391}\SET202D.tmp	DrvInst.exe
File created	C:\Windows\SysWOW64\api-ms-win-core-handle-l1-1-0.dll	msiexec.exe
File created	C:\Windows\SysWOW64\api-ms-win-core-profile-l1-1-0.dll	msiexec.exe
File created	C:\Windows\SysWOW64\api-ms-win-crt-conio-l1-1-0.dll	msiexec.exe
File created	C:\Windows\SysWOW64\Zonelabs\epklib.sys	msiexec.exe
File created	C:\Windows\SysWOW64\api-ms-win-core-debug-l1-1-0.dll	msiexec.exe
File created	C:\Windows\SysWOW64\api-ms-win-core-string-l1-1-0.dll	msiexec.exe
File created	C:\Windows\SysWOW64\api-ms-win-core-synch-l1-1-0.dll	msiexec.exe
File created	C:\Windows\SysWOW64\api-ms-win-core-timezone-l1-1-0.dll	msiexec.exe
File created	C:\Windows\SysWOW64\api-ms-win-crt-heap-l1-1-0.dll	msiexec.exe
File created	C:\Windows\SysWOW64\epcginashim.dll	msiexec.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{02a8bb6d-7f3e-3547-8cce-32b71b90a391}\vnaap.cat	DrvInst.exe
File created	C:\Windows\SysWOW64\api-ms-win-core-namedpipe-l1-1-0.dll	msiexec.exe
File created	C:\Windows\SysWOW64\api-ms-win-core-util-l1-1-0.dll	msiexec.exe
File created	C:\Windows\SysWOW64\api-ms-win-crt-process-l1-1-0.dll	msiexec.exe
File created	C:\Windows\SysWOW64\api-ms-win-crt-string-l1-1-0.dll	msiexec.exe
File created	C:\Windows\SysWOW64\api-ms-win-crt-time-l1-1-0.dll	msiexec.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{02a8bb6d-7f3e-3547-8cce-32b71b90a391}\vnaap.inf	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{02a8bb6d-7f3e-3547-8cce-32b71b90a391}\vnaap.sys	DrvInst.exe
File created	C:\Windows\SysWOW64\api-ms-win-core-rtlsupport-l1-1-0.dll	msiexec.exe
File created	C:\Windows\SysWOW64\api-ms-win-core-synch-l1-2-0.dll	msiexec.exe
File created	C:\Windows\SysWOW64\api-ms-win-crt-convert-l1-1-0.dll	msiexec.exe
File created	C:\Windows\SysWOW64\api-ms-win-crt-utility-l1-1-0.dll	msiexec.exe
File created	C:\Windows\SysWOW64\api-ms-win-core-file-l1-1-0.dll	msiexec.exe
File created	C:\Windows\SysWOW64\api-ms-win-crt-filesystem-l1-1-0.dll	msiexec.exe
File created	C:\Windows\SysWOW64\api-ms-win-crt-locale-l1-1-0.dll	msiexec.exe
File created	C:\Windows\SysWOW64\api-ms-win-crt-runtime-l1-1-0.dll	msiexec.exe
File created	C:\Windows\SysWOW64\CPEPC_PLAP.dll	msiexec.exe
File created	C:\Windows\SysWOW64\api-ms-win-core-datetime-l1-1-0.dll	msiexec.exe
File created	C:\Windows\SysWOW64\api-ms-win-core-localization-l1-2-0.dll	msiexec.exe
File created	C:\Windows\SysWOW64\api-ms-win-crt-multibyte-l1-1-0.dll	msiexec.exe
File created	C:\Windows\System32\DriverStore\Temp\{02a8bb6d-7f3e-3547-8cce-32b71b90a391}\SET202D.tmp	DrvInst.exe
File created	C:\Windows\SysWOW64\api-ms-win-core-errorhandling-l1-1-0.dll	msiexec.exe
File created	C:\Windows\SysWOW64\api-ms-win-core-processthreads-l1-1-1.dll	msiexec.exe
File created	C:\Windows\SysWOW64\api-ms-win-crt-private-l1-1-0.dll	msiexec.exe
File created	C:\Windows\SysWOW64\Epilogue_spdlog.dll	msiexec.exe
File created	C:\Windows\SysWOW64\api-ms-win-core-console-l1-1-0.dll	msiexec.exe
File created	C:\Windows\SysWOW64\api-ms-win-crt-environment-l1-1-0.dll	msiexec.exe
File created	C:\Windows\SysWOW64\api-ms-win-crt-stdio-l1-1-0.dll	msiexec.exe
File created	C:\Windows\System32\DriverStore\Temp\{02a8bb6d-7f3e-3547-8cce-32b71b90a391}\SET202E.tmp	DrvInst.exe
File created	C:\Windows\SysWOW64\api-ms-win-crt-math-l1-1-0.dll	msiexec.exe
File created	C:\Windows\SysWOW64\vsinit.dll	msiexec.exe
File created	C:\Windows\SysWOW64\api-ms-win-core-sysinfo-l1-1-0.dll	msiexec.exe
File created	C:\Windows\System32\DriverStore\Temp\{02a8bb6d-7f3e-3547-8cce-32b71b90a391}\SET202C.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\vnaap.inf_amd64_ea39d26158cde1be\vnaap.inf	DrvInst.exe
File opened for modification	C:\Windows\System32\CatRoot2\dberr.txt	DrvInst.exe
File opened for modification	C:\Windows\SysWOW64\ucrtbase.dll	msiexec.exe
File created	C:\Windows\SysWOW64\api-ms-win-core-processthreads-l1-1-0.dll	msiexec.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{02a8bb6d-7f3e-3547-8cce-32b71b90a391}\SET202C.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\vnaap.inf_amd64_ea39d26158cde1be\vnaap.cat	DrvInst.exe
File created	C:\Windows\SysWOW64\api-ms-win-core-memory-l1-1-0.dll	msiexec.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\vnaap.inf_amd64_ea39d26158cde1be\vnaap.sys	DrvInst.exe
File created	C:\Windows\SysWOW64\api-ms-win-core-heap-l1-1-0.dll	msiexec.exe
File created	C:\Windows\SysWOW64\api-ms-win-core-libraryloader-l1-1-0.dll	msiexec.exe
File created	C:\Windows\SysWOW64\api-ms-win-core-processenvironment-l1-1-0.dll	msiexec.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{02a8bb6d-7f3e-3547-8cce-32b71b90a391}\SET202E.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\vnaap.inf_amd64_ea39d26158cde1be.ini	DrvInst.exe
File created	C:\Windows\System32\DriverStore\drvstore.tmp	DrvInst.exe
File created	C:\Windows\SysWOW64\api-ms-win-core-file-l2-1-0.dll	msiexec.exe
File created	C:\Windows\SysWOW64\Zonelabs\ccore64.sys	msiexec.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\CheckPoint\Endpoint Connect\ProcessMonitor.dll	msiexec.exe
File created	C:\Program Files (x86)\CheckPoint\Endpoint Connect\res\SecuRemote\endpointBannerBig.png	msiexec.exe
File created	C:\Program Files (x86)\CheckPoint\Endpoint Connect\ScvPlugins.reg	msiexec.exe
File created	C:\Program Files (x86)\CheckPoint\Endpoint Connect\DataStruct.dll	msiexec.exe
File created	C:\Program Files (x86)\CheckPoint\Endpoint Connect\epcgina.dll	msiexec.exe
File created	C:\Program Files (x86)\CheckPoint\Endpoint Connect\EPS_ICA.config	msiexec.exe
File created	C:\Program Files (x86)\CheckPoint\Endpoint Connect\res\State-Error.png	msiexec.exe
File created	C:\Program Files (x86)\CheckPoint\Endpoint Connect\res\TracConnected.wav	msiexec.exe
File created	C:\Program Files (x86)\CheckPoint\Endpoint Connect\vna_install64.exe	msiexec.exe
File created	C:\Program Files (x86)\CheckPoint\Endpoint Connect\VPN_ProxyServer.exe	msiexec.exe
File created	C:\Program Files (x86)\CheckPoint\Endpoint Connect\res\cp_right.png	msiexec.exe
File created	C:\Program Files (x86)\CheckPoint\Endpoint Connect\cpbcrypt.dll	msiexec.exe
File created	C:\Program Files (x86)\CheckPoint\Endpoint Connect\DAAW_help.txt	msiexec.exe
File created	C:\Program Files (x86)\CheckPoint\Endpoint Connect\res\Modules-FW.png	msiexec.exe
File created	C:\Program Files (x86)\CheckPoint\Endpoint Connect\Watchdog\Epilogue_spdlog.dll	msiexec.exe
File created	C:\Program Files (x86)\CheckPoint\Endpoint Connect\Watchdog\EPWD.exe	msiexec.exe
File created	C:\Program Files (x86)\CheckPoint\Endpoint Connect\HWMonitor.dll	msiexec.exe
File created	C:\Program Files (x86)\CheckPoint\Endpoint Connect\res\proxy.png	msiexec.exe
File created	C:\Program Files (x86)\CheckPoint\Endpoint Connect\TrSAA.dll	msiexec.exe
File created	C:\Program Files (x86)\CheckPoint\Endpoint Connect\WindowsSecurityMonitor.dll	msiexec.exe
File created	C:\Program Files (x86)\CheckPoint\Endpoint Connect\BrowserScv.ini	msiexec.exe
File created	C:\Program Files (x86)\CheckPoint\Endpoint Connect\res\EndpointSecurity\CP_Left.png	msiexec.exe
File created	C:\Program Files (x86)\CheckPoint\Endpoint Connect\ver.ini	msiexec.exe
File created	C:\Program Files (x86)\CheckPoint\Endpoint Connect\cptmis.dll	msiexec.exe
File created	C:\Program Files (x86)\CheckPoint\Endpoint Connect\res\erroricon.png	msiexec.exe
File created	C:\Program Files (x86)\CheckPoint\Endpoint Connect\res\help.bmp	msiexec.exe
File created	C:\Program Files (x86)\CheckPoint\Endpoint Connect\res\Mobile\VPNClient.chm	msiexec.exe
File created	C:\Program Files (x86)\CheckPoint\Endpoint Connect\res\soft.png	msiexec.exe
File created	C:\Program Files (x86)\CheckPoint\Endpoint Connect\res\certificate.png	msiexec.exe
File created	C:\Program Files (x86)\CheckPoint\Endpoint Connect\res\error.png	msiexec.exe
File created	C:\Program Files (x86)\CheckPoint\Endpoint Connect\res\error_connection.png	msiexec.exe
File created	C:\Program Files (x86)\CheckPoint\Endpoint Connect\fwcpp.exe	msiexec.exe
File created	C:\Program Files (x86)\CheckPoint\Endpoint Connect\res\PinPad.png	msiexec.exe
File created	C:\Program Files (x86)\CheckPoint\Endpoint Connect\res\SecuRemote\about.png	msiexec.exe
File created	C:\Program Files (x86)\CheckPoint\Endpoint Connect\res\statusBarOrange.png	msiexec.exe
File created	C:\Program Files (x86)\CheckPoint\Endpoint Connect\AdminMode.bat	msiexec.exe
File created	C:\Program Files (x86)\CheckPoint\Endpoint Connect\FileHash_DYN.dll	msiexec.exe
File created	C:\Program Files (x86)\CheckPoint\Endpoint Connect\proxystub.dll	msiexec.exe
File created	C:\Program Files (x86)\CheckPoint\Endpoint Connect\ScvProxy.reg	msiexec.exe
File created	C:\Program Files (x86)\CheckPoint\Endpoint Connect\res\SecuRemote\ConnLogo.png	msiexec.exe
File created	C:\Program Files (x86)\CheckPoint\Endpoint Connect\Watchdog\EPWD_Tool.exe	msiexec.exe
File created	C:\Program Files (x86)\CheckPoint\Endpoint Connect\TrScvStub.dll	msiexec.exe
File created	C:\Program Files (x86)\CheckPoint\Endpoint Connect\ScriptRun.dll	msiexec.exe
File created	C:\Program Files (x86)\CheckPoint\Endpoint Connect\res\State-NotRunning.png	msiexec.exe
File created	C:\Program Files (x86)\CheckPoint\Endpoint Connect\CertEnrollProxy.dll	msiexec.exe
File created	C:\Program Files (x86)\CheckPoint\Endpoint Connect\res\cp_middle.png	msiexec.exe
File created	C:\Program Files (x86)\CheckPoint\Endpoint Connect\DAAW.exe	msiexec.exe
File created	C:\Program Files (x86)\CheckPoint\Endpoint Connect\res\happy.png	msiexec.exe
File created	C:\Program Files (x86)\CheckPoint\Endpoint Connect\res\header.png	msiexec.exe
File created	C:\Program Files (x86)\CheckPoint\Endpoint Connect\res\SecuRemote\endpointBanner.png	msiexec.exe
File created	C:\Program Files (x86)\CheckPoint\Endpoint Connect\res\State-Warning.png	msiexec.exe
File created	C:\Program Files (x86)\CheckPoint\Endpoint Connect\trac.original	msiexec.exe
File created	C:\Program Files (x86)\CheckPoint\Endpoint Connect\res\connecting.gif	msiexec.exe
File created	C:\Program Files (x86)\CheckPoint\Endpoint Connect\cptmsender.dll	msiexec.exe
File created	C:\Program Files (x86)\CheckPoint\Endpoint Connect\res\finish.png	msiexec.exe
File created	C:\Program Files (x86)\CheckPoint\Endpoint Connect\OsScv.ini	msiexec.exe
File created	C:\Program Files (x86)\CheckPoint\Endpoint Connect\PacketMon.exe	msiexec.exe
File created	C:\Program Files (x86)\CheckPoint\Endpoint Connect\res\SecuRemote\CP_Left.png	msiexec.exe
File created	C:\Program Files (x86)\CheckPoint\Endpoint Connect\TracSrvWrapper.exe	msiexec.exe
File created	C:\Program Files (x86)\CheckPoint\Endpoint Connect\TrGUI.exe	msiexec.exe
File created	C:\Program Files (x86)\CheckPoint\Endpoint Connect\dump_certs.ps1	msiexec.exe
File created	C:\Program Files (x86)\CheckPoint\Endpoint Connect\res\endpointDisconnected.png	msiexec.exe
File created	C:\Program Files (x86)\CheckPoint\Endpoint Connect\res\EnterpriseChecks-Warning.bmp	msiexec.exe
File created	C:\Program Files (x86)\CheckPoint\Endpoint Connect\res\Mobile\ConnLogo.png	msiexec.exe

Drops file in Windows directory 41 IoCs

description	ioc	Process
File opened for modification	C:\Windows\inf\oem1.inf	DrvInst.exe
File opened for modification	C:\Windows\Installer\MSICA4.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI1002.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\A7BBD2C6B4129A14DB30979CAC8BBAE1\98.61.6206	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	vna_install64.exe
File opened for modification	C:\Windows\Installer\e59c990.msi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{6C2DBB7A-214B-41A9-BD03-79C9CAB8AB1E}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI140C.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\A7BBD2C6B4129A14DB30979CAC8BBAE1	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\A7BBD2C6B4129A14DB30979CAC8BBAE1\98.61.6206\vccorlib140.dll.4E0C0521_7D4B_3B97_9D4C_5A47A4B7B4B3	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI10BE.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI1536.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI15F3.tmp	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\A7BBD2C6B4129A14DB30979CAC8BBAE1\98.61.6206\msvcp140.dll.4E0C0521_7D4B_3B97_9D4C_5A47A4B7B4B3	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\A7BBD2C6B4129A14DB30979CAC8BBAE1\98.61.6206\msvcp140_1.dll.4E0C0521_7D4B_3B97_9D4C_5A47A4B7B4B3	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File created	C:\Windows\SystemTemp\~DF22349EFA49355070.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\A7BBD2C6B4129A14DB30979CAC8BBAE1\98.61.6206\msvcp140.dll.4E0C0521_7D4B_3B97_9D4C_5A47A4B7B4B3	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\A7BBD2C6B4129A14DB30979CAC8BBAE1\98.61.6206\msvcp140_1.dll.4E0C0521_7D4B_3B97_9D4C_5A47A4B7B4B3	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\A7BBD2C6B4129A14DB30979CAC8BBAE1\98.61.6206\vccorlib140.dll.4E0C0521_7D4B_3B97_9D4C_5A47A4B7B4B3	msiexec.exe
File created	C:\Windows\Installer\{6C2DBB7A-214B-41A9-BD03-79C9CAB8AB1E}\icon.ico	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\SystemTemp\~DF6EB5F73F91B7BE00.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\A7BBD2C6B4129A14DB30979CAC8BBAE1\98.61.6206\concrt140.dll.4E0C0521_7D4B_3B97_9D4C_5A47A4B7B4B3	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\A7BBD2C6B4129A14DB30979CAC8BBAE1\98.61.6206\vcruntime140.dll.4E0C0521_7D4B_3B97_9D4C_5A47A4B7B4B3	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI1D49.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI1632.tmp	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\A7BBD2C6B4129A14DB30979CAC8BBAE1\98.61.6206\concrt140.dll.4E0C0521_7D4B_3B97_9D4C_5A47A4B7B4B3	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\A7BBD2C6B4129A14DB30979CAC8BBAE1\98.61.6206\msvcp140_2.dll.4E0C0521_7D4B_3B97_9D4C_5A47A4B7B4B3	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\A7BBD2C6B4129A14DB30979CAC8BBAE1\98.61.6206\vcruntime140.dll.4E0C0521_7D4B_3B97_9D4C_5A47A4B7B4B3	msiexec.exe
File created	C:\Windows\inf\oem1.inf	DrvInst.exe
File opened for modification	C:\Windows\Installer\MSIF94.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI113C.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\A7BBD2C6B4129A14DB30979CAC8BBAE1\98.61.6206\msvcp140_2.dll.4E0C0521_7D4B_3B97_9D4C_5A47A4B7B4B3	msiexec.exe
File created	C:\Windows\Installer\e59c990.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSID7F.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI1691.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\{6C2DBB7A-214B-41A9-BD03-79C9CAB8AB1E}\icon.ico	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI1EA1.tmp	msiexec.exe

Launches sc.exe 1 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1576	sc.exe

Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs

persistence privilege_escalation

Installer Packages

T1546.016

Msiexec

T1218.007

pid	Process
3296	msiexec.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vna_utils.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vna_utils.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	vna_install64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 00000000040000005c0864d100437b2a0000000000000000000000000000000000000000000000000000000000000000000000000000000000001071020000000000c01200000000000000000000000027010100008838015c0864d10000000000001071020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d0830200000000006025c501000000000000000000000700010000e841015c0864d1000000000000d08302000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9c701000000000000050000000000000000000000070001000098d4e35c0864d100000000000030a9c7010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9cc0100000000000005000000000000000000000007000100009854e65c0864d100000000000030a9cc01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	vna_install64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom	vna_install64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Capabilities	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom	vna_install64.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	vna_install64.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	vna_install64.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	vna_install64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002	explorer.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-28459746-3881314244-166055492-1000\Software\Microsoft\Internet Explorer\Main	explorer.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	vna_install64.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	vna_install64.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	vna_install64.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	vna_install64.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	vna_install64.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	vna_install64.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	vna_install64.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	vna_install64.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	vna_install64.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	vna_install64.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	vna_install64.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	vna_install64.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	vna_install64.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	vna_install64.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	vna_install64.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	vna_install64.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	vna_install64.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	vna_install64.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	vna_install64.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	vna_install64.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	vna_install64.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	vna_install64.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	vna_install64.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	vna_install64.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	vna_install64.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	vna_install64.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	vna_install64.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	vna_install64.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	vna_install64.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	vna_install64.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	vna_install64.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe

Modifies registry class 48 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-28459746-3881314244-166055492-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-28459746-3881314244-166055492-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\Total	SearchHost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\cpvpn	msiexec.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-28459746-3881314244-166055492-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-28459746-3881314244-166055492-1000_Classes\Local Settings\MuiCache	StartMenuExperienceHost.exe
Key created	\REGISTRY\USER\S-1-5-21-28459746-3881314244-166055492-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotify	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-28459746-3881314244-166055492-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs\ = "56"	SearchHost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\cpvpn\shell\open	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-28459746-3881314244-166055492-1000\{A8E13428-01B8-41D0-AA30-A4509E0F2EE6}	explorer.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-28459746-3881314244-166055492-1000\{35833FD6-1AE7-4CD3-A6E7-3E7CDF0B503A}	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-28459746-3881314244-166055492-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:"	SearchHost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\cpvpn\URL Protocol	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\cpvpn\shell\open\command	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\cpvpn\shell\open\command\ = "\"C:\\Program Files (x86)\\CheckPoint\\Endpoint Connect\\TrGUI.exe\" CreateSiteFromLink %1"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-28459746-3881314244-166055492-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-28459746-3881314244-166055492-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-28459746-3881314244-166055492-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-28459746-3881314244-166055492-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total	SearchHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-28459746-3881314244-166055492-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix	StartMenuExperienceHost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\cpvpn\shell\ = "open"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-28459746-3881314244-166055492-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-28459746-3881314244-166055492-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DomStorageState	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-28459746-3881314244-166055492-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\microsoftwindows.client.cbs	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-28459746-3881314244-166055492-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs\ = "23"	SearchHost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\cpvpn\shell	msiexec.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-28459746-3881314244-166055492-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-28459746-3881314244-166055492-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-28459746-3881314244-166055492-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "56"	SearchHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-28459746-3881314244-166055492-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:"	StartMenuExperienceHost.exe
Key created	\REGISTRY\MACHINE\Software\Classes\cpvpn\shell	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-28459746-3881314244-166055492-1000_Classes\Local Settings\MuiCache	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-28459746-3881314244-166055492-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-28459746-3881314244-166055492-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\client.cbs	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-28459746-3881314244-166055492-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs\Total = "56"	SearchHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-28459746-3881314244-166055492-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	StartMenuExperienceHost.exe
Key created	\REGISTRY\MACHINE\Software\Classes\cpvpn\shell\open\command	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-28459746-3881314244-166055492-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-28459746-3881314244-166055492-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-28459746-3881314244-166055492-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "23"	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-28459746-3881314244-166055492-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs\Total = "23"	SearchHost.exe
Key created	\REGISTRY\MACHINE\Software\Classes\cpvpn	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\	explorer.exe

Runs .reg file with regedit 2 IoCs

pid	Process
1136	regedit.exe
4604	regedit.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2632	explorer.exe
2632	explorer.exe
3440	MsiExec.exe
3440	MsiExec.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3296	msiexec.exe
Token: SeIncreaseQuotaPrivilege	3296	msiexec.exe
Token: SeSecurityPrivilege	2676	msiexec.exe
Token: SeCreateTokenPrivilege	3296	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	3296	msiexec.exe
Token: SeLockMemoryPrivilege	3296	msiexec.exe
Token: SeIncreaseQuotaPrivilege	3296	msiexec.exe
Token: SeMachineAccountPrivilege	3296	msiexec.exe
Token: SeTcbPrivilege	3296	msiexec.exe
Token: SeSecurityPrivilege	3296	msiexec.exe
Token: SeTakeOwnershipPrivilege	3296	msiexec.exe
Token: SeLoadDriverPrivilege	3296	msiexec.exe
Token: SeSystemProfilePrivilege	3296	msiexec.exe
Token: SeSystemtimePrivilege	3296	msiexec.exe
Token: SeProfSingleProcessPrivilege	3296	msiexec.exe
Token: SeIncBasePriorityPrivilege	3296	msiexec.exe
Token: SeCreatePagefilePrivilege	3296	msiexec.exe
Token: SeCreatePermanentPrivilege	3296	msiexec.exe
Token: SeBackupPrivilege	3296	msiexec.exe
Token: SeRestorePrivilege	3296	msiexec.exe
Token: SeShutdownPrivilege	3296	msiexec.exe
Token: SeDebugPrivilege	3296	msiexec.exe
Token: SeAuditPrivilege	3296	msiexec.exe
Token: SeSystemEnvironmentPrivilege	3296	msiexec.exe
Token: SeChangeNotifyPrivilege	3296	msiexec.exe
Token: SeRemoteShutdownPrivilege	3296	msiexec.exe
Token: SeUndockPrivilege	3296	msiexec.exe
Token: SeSyncAgentPrivilege	3296	msiexec.exe
Token: SeEnableDelegationPrivilege	3296	msiexec.exe
Token: SeManageVolumePrivilege	3296	msiexec.exe
Token: SeImpersonatePrivilege	3296	msiexec.exe
Token: SeCreateGlobalPrivilege	3296	msiexec.exe
Token: SeCreateTokenPrivilege	3296	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	3296	msiexec.exe
Token: SeLockMemoryPrivilege	3296	msiexec.exe
Token: SeIncreaseQuotaPrivilege	3296	msiexec.exe
Token: SeMachineAccountPrivilege	3296	msiexec.exe
Token: SeTcbPrivilege	3296	msiexec.exe
Token: SeSecurityPrivilege	3296	msiexec.exe
Token: SeTakeOwnershipPrivilege	3296	msiexec.exe
Token: SeLoadDriverPrivilege	3296	msiexec.exe
Token: SeSystemProfilePrivilege	3296	msiexec.exe
Token: SeSystemtimePrivilege	3296	msiexec.exe
Token: SeProfSingleProcessPrivilege	3296	msiexec.exe
Token: SeIncBasePriorityPrivilege	3296	msiexec.exe
Token: SeCreatePagefilePrivilege	3296	msiexec.exe
Token: SeCreatePermanentPrivilege	3296	msiexec.exe
Token: SeBackupPrivilege	3296	msiexec.exe
Token: SeRestorePrivilege	3296	msiexec.exe
Token: SeShutdownPrivilege	3296	msiexec.exe
Token: SeDebugPrivilege	3296	msiexec.exe
Token: SeAuditPrivilege	3296	msiexec.exe
Token: SeSystemEnvironmentPrivilege	3296	msiexec.exe
Token: SeChangeNotifyPrivilege	3296	msiexec.exe
Token: SeRemoteShutdownPrivilege	3296	msiexec.exe
Token: SeUndockPrivilege	3296	msiexec.exe
Token: SeSyncAgentPrivilege	3296	msiexec.exe
Token: SeEnableDelegationPrivilege	3296	msiexec.exe
Token: SeManageVolumePrivilege	3296	msiexec.exe
Token: SeImpersonatePrivilege	3296	msiexec.exe
Token: SeCreateGlobalPrivilege	3296	msiexec.exe
Token: SeCreateTokenPrivilege	3296	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	3296	msiexec.exe
Token: SeLockMemoryPrivilege	3296	msiexec.exe

Suspicious use of FindShellTrayWindow 55 IoCs

pid	Process
3296	msiexec.exe
2572	sihost.exe
2632	explorer.exe
2632	explorer.exe
2632	explorer.exe
2632	explorer.exe
2632	explorer.exe
2632	explorer.exe
2632	explorer.exe
2632	explorer.exe
2632	explorer.exe
2632	explorer.exe
2632	explorer.exe
2632	explorer.exe
2632	explorer.exe
2632	explorer.exe
2632	explorer.exe
2632	explorer.exe
2632	explorer.exe
2632	explorer.exe
2632	explorer.exe
2632	explorer.exe
2632	explorer.exe
2632	explorer.exe
2632	explorer.exe
2632	explorer.exe
2632	explorer.exe
2632	explorer.exe
2632	explorer.exe
2632	explorer.exe
2632	explorer.exe
2632	explorer.exe
2632	explorer.exe
2632	explorer.exe
2632	explorer.exe
2632	explorer.exe
2632	explorer.exe
2632	explorer.exe
2632	explorer.exe
2632	explorer.exe
2632	explorer.exe
2632	explorer.exe
2632	explorer.exe
2632	explorer.exe
2632	explorer.exe
2632	explorer.exe
2632	explorer.exe
2632	explorer.exe
2632	explorer.exe
2632	explorer.exe
2632	explorer.exe
2632	explorer.exe
2632	explorer.exe
2632	explorer.exe
2632	explorer.exe

Suspicious use of SendNotifyMessage 43 IoCs

pid	Process
2632	explorer.exe
2632	explorer.exe
2632	explorer.exe
2632	explorer.exe
2632	explorer.exe
2632	explorer.exe
2632	explorer.exe
2632	explorer.exe
2632	explorer.exe
2632	explorer.exe
2632	explorer.exe
2632	explorer.exe
2632	explorer.exe
2632	explorer.exe
2632	explorer.exe
2632	explorer.exe
2632	explorer.exe
2632	explorer.exe
2632	explorer.exe
2632	explorer.exe
2632	explorer.exe
2632	explorer.exe
2632	explorer.exe
2632	explorer.exe
2632	explorer.exe
2632	explorer.exe
2632	explorer.exe
2632	explorer.exe
2632	explorer.exe
2632	explorer.exe
2632	explorer.exe
2632	explorer.exe
2632	explorer.exe
2632	explorer.exe
2632	explorer.exe
2632	explorer.exe
2632	explorer.exe
2632	explorer.exe
2632	explorer.exe
2632	explorer.exe
2632	explorer.exe
2632	explorer.exe
2632	explorer.exe

Suspicious use of SetWindowsHookEx 8 IoCs

pid	Process
3296	msiexec.exe
2676	msiexec.exe
2020	MsiExec.exe
5740	StartMenuExperienceHost.exe
5568	SearchHost.exe
2632	explorer.exe
4296	MsiExec.exe
3440	MsiExec.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2676 wrote to memory of 2020	2676	msiexec.exe	90
PID 2572 wrote to memory of 2632	2572	sihost.exe	98
PID 2676 wrote to memory of 3804	2676	msiexec.exe	107
PID 2676 wrote to memory of 4296	2676	msiexec.exe	109
PID 2676 wrote to memory of 3440	2676	msiexec.exe	110
PID 3440 wrote to memory of 3068	3440	MsiExec.exe	111
PID 3440 wrote to memory of 2504	3440	MsiExec.exe	113
PID 2504 wrote to memory of 2016	2504	vna_utils.exe	115

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\CheckpointVPN-BMD-Cloud-AT.msi
1⤵
- Badlisted process makes network request
- Enumerates connected drives
- Drops file in System32 directory
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:3296

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Adds Run key to start application
- Badlisted process makes network request
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2676
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 5901E6DB3527EF001B02558019D9FB59 C
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:2020
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:3804
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding E8E133AF3D5D056C257F11D567D71306
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:4296
- - C:\Program Files (x86)\CheckPoint\Endpoint Connect\TrGUI.exe
    "C:\Program Files (x86)\CheckPoint\Endpoint Connect\TrGUI.exe"
    3⤵
    PID:5196
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding D24C1C0751017772759C4B3306D2C39D E Global\MSI0000
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3440
- - C:\Program Files (x86)\CheckPoint\Endpoint Connect\vna_utils.exe
    "C:\Program Files (x86)\CheckPoint\Endpoint Connect\vna_utils.exe" -d -ap vna dev exist cp_apvna
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:3068
- - C:\Program Files (x86)\CheckPoint\Endpoint Connect\vna_utils.exe
    "C:\Program Files (x86)\CheckPoint\Endpoint Connect\vna_utils.exe" -d -ap vna dev install "C:\Program Files (x86)\CheckPoint\Endpoint Connect\vnaap.inf" cp_apvna
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2504
  - - C:\Program Files (x86)\CheckPoint\Endpoint Connect\vna_install64.exe
      vna_install64.exe install "C:\Program Files (x86)\CheckPoint\Endpoint Connect\vnaap.inf" cp_apvna
      4⤵
      Executes dropped EXE
      Drops file in Windows directory
      Checks SCSI registry key(s)
      Modifies data under HKEY_USERS
      PID:2016
- - C:\Program Files (x86)\CheckPoint\Endpoint Connect\vna_utils.exe
    "C:\Program Files (x86)\CheckPoint\Endpoint Connect\vna_utils.exe" -d -ap vna drv unload
    3⤵
    PID:2312
- - C:\Program Files (x86)\CheckPoint\Endpoint Connect\vna_utils.exe
    "C:\Program Files (x86)\CheckPoint\Endpoint Connect\vna_utils.exe" -d -ap vna drv load
    3⤵
    PID:1716
  - - C:\Program Files (x86)\CheckPoint\Endpoint Connect\vna_install64.exe
      vna_install64.exe changestate cp_apvna 2
      4⤵
      PID:5908
- - C:\Windows\SysWOW64\regedit.exe
    regedit /s "C:\\Program Files (x86)\\CheckPoint\\Endpoint Connect\\ScvPlugins.reg"
    3⤵
    - Runs .reg file with regedit
    PID:1136
- - C:\Windows\SysWOW64\regedit.exe
    regedit /s "C:\\Program Files (x86)\\CheckPoint\\Endpoint Connect\\ScvProxy.reg"
    3⤵
    - Runs .reg file with regedit
    PID:4604
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c "del /F /Q "C:\Users\Admin\AppData\Local\Temp\2\Trac.config""
    3⤵
    PID:5588
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c "del /F /Q "C:\Users\Admin\AppData\Local\Temp\2\Pireg.exe""
    3⤵
    PID:5328
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c "del /F /Q "C:\Users\Admin\AppData\Local\Temp\2\PiReg.exe""
    3⤵
    PID:1780
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c "del /F /Q "C:\Program Files (x86)\CheckPoint\Endpoint Connect\PiReg.exe""
    3⤵
    PID:1668
- - C:\Windows\SysWOW64\sc.exe
    sc config wscsvc start= auto
    3⤵
    - Launches sc.exe
    PID:1576
- - C:\Windows\SysWOW64\net.exe
    net start TracSrvWrapper
    3⤵
    PID:4104
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 start TracSrvWrapper
      4⤵
      PID:2956

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
PID:4536

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2572
- C:\Windows\explorer.exe
  explorer.exe /LOADSAVEDWINDOWS
  2⤵
  - Boot or Logon Autostart Execution: Active Setup
  - Enumerates connected drives
  - Checks SCSI registry key(s)
  - Modifies Internet Explorer settings
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:2632

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:5568

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:5740

C:\Windows\system32\DrvInst.exe
DrvInst.exe "4" "1" "c:\program files (x86)\checkpoint\endpoint connect\vnaap.inf" "9" "4b8ec8843" "0000000000000178" "WinSta0\Default" "000000000000017C" "208" "c:\program files (x86)\checkpoint\endpoint connect"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
PID:2188

C:\Windows\system32\DrvInst.exe
DrvInst.exe "2" "211" "ROOT\NET\0000" "C:\Windows\System32\DriverStore\FileRepository\vnaap.inf_amd64_ea39d26158cde1be\vnaap.inf" "oem1.inf:daca4e3358f55059:VNA_Apollo.ndi:2.1.3.0:cp_apvna," "4b8ec8843" "0000000000000178" "5cfa"
1⤵
PID:1296

C:\Program Files (x86)\CheckPoint\Endpoint Connect\Watchdog\EPWD.exe
"C:\Program Files (x86)\CheckPoint\Endpoint Connect\Watchdog\EPWD.exe"
1⤵
PID:3548

C:\Program Files (x86)\CheckPoint\Endpoint Connect\TracSrvWrapper.exe
"C:\Program Files (x86)\CheckPoint\Endpoint Connect\TracSrvWrapper.exe"
1⤵
PID:2976
- C:\Program Files (x86)\CheckPoint\Endpoint Connect\DAAW.exe
  "C:\Program Files (x86)\CheckPoint\Endpoint Connect\DAAW.exe" getProxyAtt
  2⤵
  PID:5184
- C:\Program Files (x86)\CheckPoint\Endpoint Connect\DAAW.exe
  "C:\Program Files (x86)\CheckPoint\Endpoint Connect\DAAW.exe" getProxyAtt
  2⤵
  PID:5848

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Installer Packages

T1546.016

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Installer Packages

T1546.016

Defense Evasion

Modify Registry

T1112

System Binary Proxy Execution

T1218

Msiexec

T1218.007

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e59c991.rbs

Path C:\Config.Msi\e59c991.rbs
Size 311KB
SHA256 350014e15d164edbfe562ec52f2b8bcb88aecc4982cec3e57e6cf83f93bd64e0
MD5 4e24cbc949f1e6e8ace3c166d41160da
SHA1 1e9b93c163334aac1d3240b94d7e5587b44ba10d
SHA512 f2f6b53d7dd6649dd4d33913abf419a95d0b0a20dad6f4260bf44e400bf995be2adf83d121a23cdedb728eb4b2748ad882d3fd6ad7278ddd0f46848d065b7f5b
SSDEEP 3072:J1ElfneUCF1U3lRpZcGWTT5UnH7Vh3fKPI12fvpN4yPtKUxEWe+cxZrxkOij+:J1ElmjF1qncGWnNLhN4GJjh7I
TLSH
T153646C21265180B5F2B70531B569D620AF3BFA6433A4D86E83C88D2F9CE45D07FFA746
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScvPlugins.reg

Path C:\Program Files (x86)\CheckPoint\Endpoint Connect\ScvPlugins.reg
Size 23KB
SHA256 770216ff98abcb96fcd9738d47a12ae99ae867c2eaeaba73c3e2db7f4d85f24d
MD5 4f46e5c96b38d5065029e4173643b2ac
SHA1 ee5048de2a1212a1bf10d4480b087942983ad22d
SHA512 f547fc72300c57645c09533c5981f8f9d610f074236e20b8122ef8773728d60dcbdf4b3e525b9ca2d6c6008f9f0ac416d0178958f207c583ef282cca9dd28486
SSDEEP 48:9JfgUVeVQYLXaQ5kRnNuNFQ6imZAQm6j6jJQzSONMQGc/kM6kMJQIk08l6HtsQTd:P/Y35kRH6iamkmCGYCu6nWdnDNOeSw6
TLSH
T107B26E260D1C817EF2266800D745BD8222A1E83F56FA95EF43F44DD3E2B6C9315EA74E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScvProxy.reg

Path C:\Program Files (x86)\CheckPoint\Endpoint Connect\ScvProxy.reg
Size 507B
SHA256 7ad3019541612e6e3a0b20e48616dae661741f707d37a72487542029ff2edf25
MD5 d2832141eaa75ad38d46bf1259f4c082
SHA1 821cde32ce3767e9d3554764eb0b21c2de7d28e5
SHA512 1286169a96a6aae1189acc153b69ecf4e41a7676ac419e8fd11084ea7acbc78865d90757a4ef723d1f6489fe101026ab6c01a0dd89029263d7a3eefa4261aa9d
TLSH
T1A3F059774922814AF22968000A97ECD237E1B84F23D7DE1400E8D1803BC3CC3067575E
MD5 SHA1 SHA512 TLSH

Submit Download

Trac.config

Path C:\Program Files (x86)\CheckPoint\Endpoint Connect\Trac.config
Size 7KB
SHA256 b3c59d87a8b284479477b9198c579b270cfc7397ca0c25ae6f8527ece1891544
MD5 c5e0c667bb98607a5d2c51accfa0d3e1
SHA1 877629203341450788df82d4211b6c6c9bbd0842
SHA512 ad67e15992555ce556cfa83112667ead97e535c0e7c9c66293c55640250514b9cb1d6db2da9d54eb36226a9336c43ad2659ece77b833c178fdc450ed56b8e033
SSDEEP 3::
MD5 SHA1 SHA512 SSDEEP

Submit Download

EPWD.exe

Path C:\Program Files (x86)\CheckPoint\Endpoint Connect\Watchdog\EPWD.exe
Size 613KB
SHA256 88bd09fbd53b0a540f1a35b14eb45c4c6659d59096f2c89e8dbcc9578260c7e3
MD5 bc151e0ad829fd80d243266a6b24b84f
SHA1 bf5e73b8b3fd050e942a7629a3b2a14ddcd25263
SHA512 3d9defe7ae954a4b72143628ef21bb1a0c4c03f181ea49db89ff75cfb0ab6a8f5ba14c47ef1a2685b34397bee90485ee6d294d7ff393acef5c5e2fd23af6ca87
SSDEEP 12288:G83RkQYPA3SeYDasHn7xcR3eCXEtuJ+SWtn1m7rWF325tmOT5:G8yXPA3SeYDasHn9cleD94rWFG5sU
TLSH
T12ED45B603B55D439D6A211F19C78ABB64429BD345F3245CBB3C46B2E68709E26F32B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Epilogue_spdlog.dll

Path C:\Program Files (x86)\CheckPoint\Endpoint Connect\Watchdog\Epilogue_spdlog.dll
Size 666KB
SHA256 8ef0e6961709e94b1dcc178d29dc5463a359ca61dde38408e3d05fb954e3737e
MD5 e2db3a7711dca1406c9d5f37dea1b453
SHA1 7a04d303a71de9d2c5562b3cba87179329858d5b
SHA512 3c902dd999773cf30a4e76e99f1d2ad05ac3cf285f124a71492286fc3cec09ba73aad6ef53982fd3c7efdbe9e78596e35495883850bbc40b69f08e294f052e98
SSDEEP 12288:AODdy1cqZzMjsawQXTyRTwCfVrv0Zg54i0+fgufLe:dI1csQDyRTwCfl50+fgD
TLSH
T17CE46D327B09C1F9F99D02B3A43CAB7E865C94354B3105D7AAD49B6E98141D33F36B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vna_install64.exe

Path C:\Program Files (x86)\CheckPoint\Endpoint Connect\vna_install64.exe
Size 144KB
SHA256 689cf97ec485f6900065c72e188301c7d31d7225b53137321c05e6faa24445eb
MD5 f2e27170cc91382d8d2b41700b3abf4e
SHA1 12271bb12b7fa7a69a14ec06e101230041ca9166
SHA512 9c26c1b818480a94f19ed7f3602a306167956657c88e7c39e213f26ab555ce06fee13d4db9c53079174baf90acd6e4a0ddb70f8182c9bf5c66d2292b2eaf16fd
SSDEEP 3072:5tI5fCq7Bo+RbKPZAUoJDM6ffeSTPzD7EUwPCgssRlw3V:52Cqu1KtlfXz9Zgsh
TLSH
T173E36B5B73B534F9E57BD238C9A14506F772B43207619B9F0368436A1F23291AE3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vna_utils.exe

Path C:\Program Files (x86)\CheckPoint\Endpoint Connect\vna_utils.exe
Size 96KB
SHA256 7b5d647b1fb6a911568af9a8fc12d4163c478df239ac8ae450ec69b1ba78b8ad
MD5 234577f5e4831596bb1a085fcded066e
SHA1 d1f7dde9dff496b7a1ebae51b456a4b9e5f767a8
SHA512 636142af37a53bc4ef7c916a304d99da5cce9119aad0b3dbbfcaa9d6408e3e3497a61296be384ecbbb940bd98b9bd4d120d68271065260a8c41f66b03c6ed162
SSDEEP 3072:XX1qXLypt17gWKV81WxV06JedvsceQo7pq1v+XpEgcsZ56Aq3j:XgXOlgWKlceQodq1m55cJAQ
TLSH
T192A39E00BAC35272CA5B0B3756DA6B7B8A77B3B84B115DE3D3720D8058461E36E3F589
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vnaap.inf

Path C:\Program Files (x86)\CheckPoint\Endpoint Connect\vnaap.inf
Size 4KB
SHA256 679939d1e3c1e51d32a86c5ce348c58ba3448295b92238e350aee27b45de5c37
MD5 573345d5fe94093c254fdf95488b66c7
SHA1 638cf92b4d471885e1db95a6bcce402adb91c181
SHA512 bb66dd26379c9ab76bddf1550f94aca1c429cf4e680a65fe548050b3f5b5b0fc3c876bac8be46c79a4c9baccdfa65e3767c4a5e5f427f429826b9b155a84553e
SSDEEP 48:HkobruhUjdh5sZlexkrrx64NbKkSCNX51vuhFlSh/82HXNptDWNDMV2zLuwuL0Ci:HF/aUp6x6EvoUh/Cm5qDfDIM8uUhGH
TLSH
T16BA173194E424B3731A7E15B63022AC3F327119A2125114C71FE99096BA9F0D937F9FA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

EPWD.toml

Path C:\ProgramData\CheckPoint\Log_cfg\EPWD.toml
Size 95B
SHA256 ea5357e6a74609c78e00de3cccf5e2c14a5a066c69a09b421e79d8a2abece1d8
MD5 9c0137e1575a0272fd0f3c6cc3829941
SHA1 7d63b05e71acff863a5e71cded450b21a52ce5f2
SHA512 5f5ab5f3cc2bc14d9f538e2b85bed4e2880c249ae664c1af8fdb9d13d542894a225045ebd86cfc00d75f6e48b8e47ae821b7bd48b1be5dd1b5c20009a7dae01a
TLSH
T107B012F249434F0D2598B4448B286494E8334091094830843B10E49FC0C081BD5D350C
MD5 SHA1 SHA512 TLSH

Submit Download

default.toml

Path C:\ProgramData\CheckPoint\Log_cfg\default.toml
Size 1KB
SHA256 24e7d46823796c7509711f42cad12682d83fbc2c7dd26d0b6b0a5e12a50f5316
MD5 c701845455502c28c77defad7fdf221f
SHA1 2d56c5a291dbef960c086453c790beb60062d6d5
SHA512 1aa64501e5ac55abb7fca0d02cfc7e7cf0d7477bd45466dc9fb05bac84fcce91f6679b0ba8e063cc9ae9a6fc4c2631a7e99f1bf41eed1c9cf27e9632d7a0a54c
TLSH
T174316C6A498A1F1E3BBDB804A98D3548FD3591D16536B1946BC0B68EC0C1C1BE7C3C69
MD5 SHA1 SHA512 TLSH

Submit Download

57C8EDB95DF3F0AD4EE2DC2B8CFD4157

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157
Size 342B
SHA256 3a22750d08b6637d0583cd913aaf174e3c85ba056537ceb2144b1da4aa9470b2
MD5 3c47024c1094b9540c167f6593df003a
SHA1 7c4c01db0148442171ddc238dc095ab7cee5cc86
SHA512 e2f2d17ae4842548bfba10389582cb7e4b175093b4e418867b9657b8aed734c597eb5fc58260c2f7a7c4c620b18152088b50b7455fcc83af6666f7a68f6bd302
TLSH
T193E05E512BE80204F6770A3CA873A5499977B77BAA01CAED0275018D1C25F62CD72B1E
MD5 SHA1 SHA512 TLSH

Submit Download

prep_Activatable Class_Hermes_perf.cache

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
Size 599B
SHA256 b536a3dae9ea5c69081f0491eed829e3b57e32401fdf49a63031bcd6b20e6fdb
MD5 658ab8c32d4cc5deb36ac5f63da4658b
SHA1 30c12cd871ff0c2c4098d794e9ae4f2540586813
SHA512 a73030c008ef3c2e274f11c90bfe79fa8ae402f76801c710bed8cc1ab1218a84858ea566b772be4bade8ef639a019c57d297028df15b64b3753482cf0f3c8f85
TLSH
T12AF05C83EB6A1B72C456123DC8EE56E47B31D1846EC11367A2107B1D3C2B7192D174BD
MD5 SHA1 SHA512 TLSH

Submit Download

Pireg.exe

Path C:\Users\Admin\AppData\Local\Temp\2\Pireg.exe
Size 31KB
SHA256 43fa34936216b636882b0467884705a0573b48a6d5914dbb2fd65c2ea24a725c
MD5 cd37fb97797b7dec0092209b35405038
SHA1 7b8f8f7b9cfb8713480e7226ea3d5748f982f174
SHA512 ac29a504cff74208bd97df990933a1a066ce7d3c434474e241884411be5f505e73cee480f4c5f119dd8d54eeb43ce1ec2baba0b5c23cf473a7225390fae5e0df
SSDEEP 768:0yf4Im2zHj3Uo3S4ug0m78DEzdiAkuAsoYiB93:0OGMp3S6ODEzdiWTo7r
TLSH
T162E27C43AE541832DE468EF065F1EB2BD87BB7B05F9181D7F320462E0A1A7C25E3815E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Trac.config

Path C:\Users\Admin\AppData\Local\Temp\2\Trac.config
Size 7KB
SHA256 f0670a299418401483b539a6e4bd93eebe4fa5a10c96cd184d05df9f3fd2b055
MD5 c215c47094249dcbc7da858216266b8e
SHA1 09c0346e8bace95bd64211a06a832ab787d6e94b
SHA512 5a89faaf8d1b6860c1f38d80024b8eed600f11625f2887e683b4e4a30363d9a8eda4d91e09801490c8e2400c91967f003fc98de3b21f5e4238f2cfc40a53c58f
SSDEEP 96:erSJHHf+yMecMEys1jWjpzLbvdsfmunZ41svA14QpO7277chFjdagwBOdgxHR:CSl8nMEvjWjpzL6muq1wfQpbS6RB9R
TLSH
T1B5E1B9F496D0F0D0A64BEA6297ACFA7D663F17F357892F44122952C10BB2660FB18846
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSI30CA.tmp

Path C:\Users\Admin\AppData\Local\Temp\MSI30CA.tmp
Size 2.7MB
SHA256 b28779d9ac1b3c3d5d4ec37f8eb63a5202e76b1c0d61102d9bb73eca831ae8d2
MD5 300af9f7d2f17ac992aa1d94dce1f53b
SHA1 02e5c0d404f74d8f055ff3ee37da211dda3ab9d4
SHA512 3a05129a3cd6938c824cf9f32d454a8f782055d7804389bcc9ca7d265d6d3f2044f48118726330f6b154e77e59c906c8679b0dc24243a7462d23e86d40551408
SSDEEP 49152:NlcKcgLFqDeZ+DV1Ksy2sY/Mt7xVNrPkOAjrb8hWP+BlCYptQH5EK:zcTgLFqDeZQVDPUJxnPkOAfQhZBzY
TLSH
T134D5CF12FB8280B1E59F017461BB5B7F4D3AAA149734C9C397E01D6A9D302D2763F39A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSI3290.tmp

Path C:\Users\Admin\AppData\Local\Temp\MSI3290.tmp
Size 1.4MB
SHA256 f8a78bf26bbed4e3a1578a12f3ba62cc6064b88dbb6f5be7ff3ffaba8f5f14e1
MD5 f45c97644bdc98c73ff3e31ab91b2d51
SHA1 3434a48d428d9371b35f95da04c73514d4d6b2bc
SHA512 196416a7648cd2a062ee591eb464fb4d7358b5e8a1ae2bc0a0c1694bd7e88ec744a54da59da56fda068130e344de0b2de4c093ba418edce2270328005bf061fe
SSDEEP 24576:+YV9cpucurBf22MS8+DqQK0v6CpCbckTTKxyeJYSMx8uHOibyAkmiKN3:+YYhk22Mh+DqQKDo/yMfuHOi2AkmiKN3
TLSH
T177657D127910C031D6AD2271662DFBBA919DA4314BB049CBB3C40F7AEA611E37A71F77
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSI8efca.LOG

Path C:\Users\Admin\AppData\Local\Temp\MSI8efca.LOG
Size 78KB
SHA256 d25c4ceee4f7ef0aed9bef4e0cd64c00c780c6b4f5bf5d1840d396f0e3225d60
MD5 677a0707b9e53c3802495cc4de19331c
SHA1 a0a1edb6c4c4740e3869bad4bbb5e57deed42758
SHA512 c89b6c91e2f876794110b0eeaf386cc03f514528791401f59375f543a4838fc0fe32b3c28615dc3032d423cc17595708eba1dd4854052e20c0a5b4410c7039be
SSDEEP 1536:3bn80TmJW3NWl1MIjqRYwrep1IM9b1Hd+CNZ3HADh5y1L1Xez5l0CXjlxQzzuIiE:3bn80TrWfSAL1Xez5l0CXjlxQzzuI1d9
TLSH
T17C73E5252FFC0149B2B7AA879FF744235A37FDA66935CD0D20D2830D05B1E44A9693BB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSI1002.tmp

Path C:\Windows\Installer\MSI1002.tmp
Size 75KB
SHA256 d77ff4048f06a8410b07b6a1f7a8ed4fcaf436403179fc35561d79a841459847
MD5 7b405eef032904d8591258559d28a4fc
SHA1 b48f8ec5da4ec75751cd550a407b8cf642e3f1b1
SHA512 3a16092df60ce7479f2e419de16a932f9d53ba342bba5fd0f4046854e8dc7812ddc698bd418513ee2b6e6ceb2f828f61e70157bf0784d71e15a09bb107df45d5
SSDEEP 1536:YeVc9hCF15+73lRS012qtc8+cqXdlCPfUlnQ1i5UnH7n:YeUCF1U3lRpZcGWTT5UnH7
TLSH
T126736C2473F08032E5E71631F979C2711E3E75309AF4848B6B83567E5E606E1BABA317
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSI113C.tmp

Path C:\Windows\Installer\MSI113C.tmp
Size 168KB
SHA256 b9e73e5ab78d033e0328fc74a9e4ebbd1af614bc4a7c894beb8c59d24ee3ede9
MD5 a0962dd193b82c1946dc67e140ddf895
SHA1 7f36c38d80b7c32e750e22907ac7e1f0df76e966
SHA512 118b0bd2941d48479446ed16ab23861073d23f9cc815f5f1d380f9977f18c34a71f61496c78b77b9a70f8b0a6cd08fe1edc1adb376dad5762ad0dd2068c64751
SSDEEP 1536:ITrI12IxKBhPTpX1vPiAmd/Blv1JUQ9GTP4yl+UQ/b9wLDVkbcTx7sWjcdAle+ci:IPI12fvpN4yPtKUxEWe+cxZrxk
TLSH
T1DAF36C2266A44039F7FF0637E5689671AE3FF1682B64DA59C3844C4F29A80C0A7F7717
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSI140C.tmp

Path C:\Windows\Installer\MSI140C.tmp
Size 1.6MB
SHA256 c954b0787ee85f81a733d305d22dc2312ad939bce78fff2aba1392f61d576764
MD5 66e583a3e6dacc1b2b0ed769e36e1e22
SHA1 1637854ed71bed068e32b050018e4744a1078a2c
SHA512 8d139267e43dbbf61ebc84103678fdca00711f108ff0f53b4e014e5c20b8a7c692b506ed66f79f9d7dea40bb0b7f01ac50ee10d0024b27594c16194060e907a6
SSDEEP 49152:naE4Tnk0+3CHQ8oPogszMM5w6dW9KbbWitQZ2tFA/dVSY:l4rd+3QMM2BOi
TLSH
T10C759E137A84C032E62E2131941DB76D62EDE5B00F2442DBB3981A7EAFB15C3E536E57
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSICA4.tmp

Path C:\Windows\Installer\MSICA4.tmp
Size 737KB
SHA256 72bba5e14edf9b7b93b08093599c7c8affb8e1b4cc3e0e3122bfda514be0a211
MD5 d4aeda94a1a0f35cfd8ad967b9c66033
SHA1 e4ad31c0b0bb4cf5178405ec1b636291ae2a9ef8
SHA512 75461fcf8f11c561dea9f9c73615375974dd6b2afd3a454e6d3ba1af936d25284182a3aa25abbea9fd62c37ba2a0715d2ada43dd6227257478b03858b1144711
SSDEEP 12288:CBoa/F2IEsX3f+cFYDV6DR2Q1d448/hHZZLYBIh7SuzZZlu+i1o6EOOVBuwq0WXY:CB8IEsf+cFcV6DRYOBIh7BzZZlu+i6O2
TLSH
T10DF49E127D81C432D67A31311439DBF618FEA8310F30D6DBA398A6795F781D2963E62B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e59c992.msi

Path C:\Windows\Installer\e59c992.msi
Size 35.7MB
SHA256 ade6608a1d2797e0e1f3ba4076ebda10ebcd4ac52ae879977c58059b8c4d59c4
MD5 24b447aa38146ef455741824a5571be6
SHA1 b41297e990a01296e026bff7ef01e35f44f2c188
SHA512 84c98d46f444c904ba0097294f5176df9142c116e33a440d45e711790e1f6c2cea6e5758358ee6c5e4d50d24ab261a523ce31643a1b1b5763302b57cb7434563
SSDEEP 786432:yE9qPJuTtlmkMIvq1onzynv1e362wCA+ANgAVYnL/tbb6H:1YP0hlmkMIvqenzP62n4VYLcH
TLSH
T1638712027E46C072DBAD06741029F7BE6EBDE820172045CBEBD42D3E6D705C1A67AB67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CPEPC_PLAP.dll

Path C:\Windows\SysWOW64\CPEPC_PLAP.dll
Size 229KB
SHA256 2dcd083d50efd9ad1d85a5df881707ce7e116ba53cfb3000060576c1bc02e494
MD5 3055737ecf4c3935876199071ecc3e00
SHA1 4700855687a8b3ca243c7ee41125bdcd936e74b5
SHA512 fe2d84dbfeb2c054137dd023ca5a5aa7867625f528f64c52e19869474b12f3a06f246a0b4c5c66358e7e86fb6d5d0bded5ef5b55637ed3f57d9dcb8b5b740018
SSDEEP 3072:WkYE8OkOAEQHwWE5DowkGS9FGhLhgBzwhRgBnqrrxUk1wRo820cXEW36dD53N:WnE8OkO5QHJODoPFoqzfR72VX3u
TLSH
T172343A17BEB949ABE475523CC45B1663A3B1F4023314668F270C5E6A8F673C9B82FB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

epcginashim.dll

Path C:\Windows\SysWOW64\epcginashim.dll
Size 158KB
SHA256 2a88d56a6a13aa602f3727e900d60797132373eac16204f6ee6e308de9b35b3f
MD5 db0af586afa143e58eb2e01708b6cc6c
SHA1 220aa9c3968ef18a1f526ee5235b1ed92b225bea
SHA512 f0cd8ce501aa97fd792763b688ab1e62311bc37c7e0b3de54f645fcb4c75995a71040d0bbc3e1808c6b135145b9bf35cf87d55b90ac4e031b98c8c6448976582
SSDEEP 3072:EYPiuIi4I3FgYWpi8O+f9S13NcisgC+4L6Di3Vz:EYPimX3gpUoSirB
TLSH
T111F37C1773A500B7E57B8238C9A3560AEBB674121760979F03640B7A1F27791FE3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vnaap.inf_amd64_ea39d26158cde1be.ini

Path C:\Windows\System32\DriverStore\FileRepository\vnaap.inf_amd64_ea39d26158cde1be.ini
Size 408B
SHA256 ca580387f177903253ad90894eb8f21ed89215bb9184638db2fd85368b57f268
MD5 e09375557d6ad0f45307e202b1ea05af
SHA1 2cb2d004da206d94ef0126e1ef9ee1239c6ef473
SHA512 2cb9d677f52a8375b4fe8612cf73886c5fed1353a581694cd231ba501ba8337705cb252a24430f7b29d121d8fa2cf0ea7685cefe4fbc3639dff3161929629235
TLSH
T1C8E0E5136EBCC059152870F561682B7BF541520844427BE1309863B48F9FCAC14E4F5F
MD5 SHA1 SHA512 TLSH

Submit Download

trac_install.log

Path C:\Windows\Temp\trac_install.log
Size 1017B
SHA256 1da0ab961d332e8d5be501e5c083143e4bbe30d32cf61419f9e7aef20b34b639
MD5 6a209ac92b039e8d23f4396625c379a7
SHA1 f0793e4355b52a9ca9f7360d0e087a896971450f
SHA512 ddd23a9f129002f555045ed89767de181f069c6c07cfa1290b16255bd5b7b19de6c6fc97cabc04d1d1a24ec1c06c117b6f684a1e7650ccc922926f0615aa5487
TLSH
T19911DAC7FB979FE745C1C250D12C60C7DCA86872196E9E8FF176202E120F4C78659661
MD5 SHA1 SHA512 TLSH

Submit Download

trac_install.log

Path C:\Windows\Temp\trac_install.log
Size 1KB
SHA256 a661c98e3bca462417fe9ad95ff95344bc78b723eb6d5b8d91c184379e6addb9
MD5 23735ab7e078c124a4010c9f982bca57
SHA1 c6268f7f63be384fd47a694b26ca0ef1b179bbf6
SHA512 faf2a16063bbbd8f639994fe3daa391e7b5d267dc3099c4e4fb679a8d0a036ac6c27df5aa756a0541857073d751c30d4b4b454fa263e35eb383b18ec524c84a3
TLSH
T148212BC7EB96AFE745C1C310D12860C3DCA86872196E8ECFF0766029230F8CB8659560
MD5 SHA1 SHA512 TLSH

Submit Download

trac_install.log

Path C:\Windows\Temp\trac_install.log
Size 1KB
SHA256 5ff9a7332ea495a1939ba47be719504cdad40e236600f0a8a8f3fcf0b26320a6
MD5 ccdf1fc2edf9d91ca77641d92f5fd6f6
SHA1 1dbdd6717b1647664fdfb4e67e3b0431ad1f8a9a
SHA512 bcce880ee29a6f9819e94c2fdbf876e74e6d5c43d3d6fad6d057791e9c43014def7443c44310d2a37e6ca483ac4388cd150823c535da5a5cf6eab690da821951
TLSH
T159215CC7EB979FFA55D1C310C11C50C3DCA86472196E9ACFF1762029230F8CB8659561
MD5 SHA1 SHA512 TLSH

Submit Download

trac_install.log

Path C:\Windows\Temp\trac_install.log
Size 1KB
SHA256 1c3e14edcdba5a487b2136a3a55c6bea02acf221e5803edca21ac0aaf6b8f54e
MD5 2d982ad643e36930e1771e8015088b36
SHA1 fb46f3773d1d6ff74af504769d650946edff9d07
SHA512 6bf2c436e42e70bae2d09e3fd2f100191ef0451bc4817a99272e06e6fcbc42305e66468e2120ebc5688cfebb84849d59c2a6ba3c2cf4f1fc172d6dcf9b30abd8
TLSH
T18C4192CBDB669FF51A90C354C11910C3DD686475066F9ACFF1E6702D220FCCB825A592
MD5 SHA1 SHA512 TLSH

Submit Download

trac_install.log

Path C:\Windows\Temp\trac_install.log
Size 4KB
SHA256 1c621506b08bc04485aaa0c2b35acf2e46233e4bc32d9ab7d3001fe61b5bf1be
MD5 8218b8e71044a95058d2ecd9d5828ab0
SHA1 9bee7e9e07b4dcf530edd3a7cfcb2988136f0604
SHA512 4d7694c78785d31202d7840ee4ac45b28311de4ecc44a30626b77736513c56934c78d67d27ea10c811a78e1d19587d2a056dbcb01b4957f6ed17c443b5267f07
SSDEEP 96:Jjz1jM4Iv8vCRhmK7I7zWIPXx3Pbi4eGFzT0ma2tyDvb6v2h:JJM4MG5BPW4eGR0QtBA
TLSH
T16891D18BDF698EA41581C219C31950C7DA6828B8069EC5FBE6EB701D310FC89E479AD2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

trac_install.log

Path C:\Windows\Temp\trac_install.log
Size 6KB
SHA256 76c24751cd8695f47b2b18a65bdb30be70ad77fe9c356930d4351784aaa6d3b1
MD5 d4301226b568eee836204a84c86a0f86
SHA1 043f2226a986fef89dba4b11c50865b4151dd63c
SHA512 f95d52eb708311e2acea25b66b92cf17b3d399d631a735086948a605fc89611a473b3c9050b9aaea542de6710a3f09a7f3af286b589d73b883c19cb8a147ad7a
SSDEEP 96:Jjz1jM4Iv8vCRhmK7I7zWIPXx3Pbi4eGFzT0ma2tyDvb6v2zQCpC5bS5jaTAb1N/:JJM4MG5BPW4eGR0QtBKy0S8
TLSH
T137E1DF8BDFAECE641580C114C31C54C7CE18687906AED5EBFBEA7019310FC89A579AE2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata-2

Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
Size 26.1MB
SHA256 5072f3487325c407cbf5eb0b9d32f43fc7d2715f65fd975ac1a8111a26ed0d3a
MD5 ce167bf3197848fdd5142e78a28a69b4
SHA1 f919ab63049946835a9c2915c4c054b2fd877896
SHA512 7af1802266e1d9baac1cb17fd542d14325e49b43c90445a4e512f3c9243f86a88197d6bd69253b339f64c77d30e5146919839759123b655d52bae2ebbcf07093
SSDEEP 24576:pFo3DMPtdoO/vvTL/iA7bSlgvr+xwLcY0GdJNW1jtu1a5MKr84h2bCx6fur:5H4
TLSH
T1F957A12436F92600E7B79E7CACF06A234D3A7D5B9C15DE8D45411B4E0822F71E872F6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{7094785d-2def-4e8c-8117-fc6a06713477}_OnDiskSnapshotProp

Path \??\Volume{d164085c-0000-0000-0000-d08302000000}\System Volume Information\SPP\OnlineMetadataCache\{7094785d-2def-4e8c-8117-fc6a06713477}_OnDiskSnapshotProp
Size 6KB
SHA256 5193bbacb1f5dbd6784c907367d67318c19810eb299a674fb698997b9741d264
MD5 a220bca4b1362dd738dedaa6cc74f441
SHA1 cfe1163ac29241868260c845e60f1fe69c5f39b6
SHA512 4053124eca3ef3a278f6d6933498746e1e200f57d206ad3b149328b6bcc950c4ed11d9cb749ff02b5a0b32cd850b04c624c55e6396a60194cb13f70884a7d096
SSDEEP 96:FXTDLDOvvc6DD84LTHzbOHXOHBlBRQn8Sc9XE56tOSVQpu:BTDujb++uVm
TLSH
T1AFD178085AF54711E2B3AB3128F18557A877B911EF33CB8E0198238E2671A11F835F6F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vnaap.sys

Path \??\c:\PROGRA~2\CHECKP~1\ENDPOI~1\vnaap.sys
Size 74KB
SHA256 e1089ec93d636938186c936f9f28f360ef40ff33862e741da002317dbec4cfab
MD5 7ba5dec4c51df260bfe3129483167489
SHA1 8ebf1331fdb3462bee54f77faec374697d5cedb9
SHA512 ea7bc40aefe4a6e8c4181b5d2c29b72d8f598b0cde2725849ed4528e783e245ce9b6d0856904403f7adbbe79b8e8901d4c21fd50dc9ad387c762a5ffb153e5ea
SSDEEP 1536:TgV/+nab3+LWQtHAXcBjP1lPpmf9tvgm7nYeGE5+zutC/:bab3+LWQAXcBP1/o9tvgmDYe5Md/
TLSH
T1FE739E82E55458B9E467C8B5D9B0A617E7B07A061B10D3DF0368C2A5AF033D4BF3936E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vnaap.cat

Path \??\c:\program files (x86)\checkpoint\endpoint connect\vnaap.cat
Size 10KB
SHA256 6e8c0cbfe7cb1be818b4095dbbafd4fba04db9b02f4fe592c20afb80934d6388
MD5 f4fdf35de0ef11a52410be44e9f035ec
SHA1 c67019f44b1c886ab57c0ca3528c768aa1fa2401
SHA512 19a3d9b9c36e1c1b5dd5a9c7d4cd9a51674e4a56fabd14496589f86a55543cf292e2762cc1780ea1ad6902def9fb0556a7e39074b40dcf528ca2aaee8f01bebc
SSDEEP 192:vAKXyBJCSEIPWkjyKDUFWQFooUks9gICQX01k9z3AFN2q:YpPWRFRFU/P/R9zol
TLSH
T1F73228E68A6D0483ADA7BCB013D8E1933C3D67D75C1095BA528BF36019837CAE30813D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/5568-67-0x0000020E93FA0000-0x0000020E940A0000-memory.dmp

Download

memory/5568-96-0x0000020E942E0000-0x0000020E94300000-memory.dmp

Download

memory/5568-50-0x0000020E801E0000-0x0000020E802E0000-memory.dmp

Download

memory/5568-77-0x0000020E83C90000-0x0000020E83CB0000-memory.dmp

Download

memory/5568-65-0x0000020E83920000-0x0000020E83940000-memory.dmp

Download