19bca902826ef0dc9a6cf849297ce43ba8b2844bdb913c37230308d3274c953c

Analysis

max time kernel
149s
max time network
123s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
30/06/2026, 12:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
OpenVPN-2.6.14-windows-amd64.msi
Size 5.5MB
Sample260630-pellfaex6m
SHA256 19bca902826ef0dc9a6cf849297ce43ba8b2844bdb913c37230308d3274c953c
MD5 1e150b4507fc951c8a23b08b85236cd2
SHA1 3f6980947c16778efb3126193726c038453c85d6
SHA512 2074822532d38e94c131ceb3b4b7a01379ea20b5d6e3fb85a6912a586b8e6f1ff5a4973c200087ccd5ecd17727acef2d5568e6afc9df392da5c1f1978b4cd3a8
SSDEEP 98304:fEnzYKCLSBI0lGIOKv8k7VHTB87GnJ6tEGb7MrisWnB+A/yue/bjBe:z/LS9ZzVV87G2hbWij+xB/Re
TLSH
T128460101B6C10462EC678230C85E925AF2F27C5117A0D66FA2DCBF7CBF3B3A5526A751
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

persistence privilege_escalation ransomware

Malware Config

Signatures

Boot or Logon Autostart Execution: Active Setup 2 TTPs 6 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Microsoft\Active Setup\Installed Components\>OpenVPN_UserSetup	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\>OpenVPN_UserSetup\ = "OpenVPN 2.6.14-I001 amd64"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\>OpenVPN_UserSetup\Version = "1"	MsiExec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\>OpenVPN_UserSetup\IsInstalled = "1"	MsiExec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\>OpenVPN_UserSetup\DontAsk = "2"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\>OpenVPN_UserSetup\StubPath = "reg add HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run /f /v OPENVPN-GUI /t REG_SZ /d \"C:\\Program Files\\OpenVPN\\bin\\openvpn-gui.exe\""	MsiExec.exe

Drops file in Drivers directory 9 IoCs

description	ioc	Process
File created	C:\Windows\System32\drivers\SETC04D.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\drivers\wintun.sys	DrvInst.exe
File opened for modification	C:\Windows\System32\drivers\SETC8AA.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\drivers\tap0901.sys	DrvInst.exe
File opened for modification	C:\Windows\System32\drivers\SETCCC1.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\drivers\SETC04D.tmp	DrvInst.exe
File created	C:\Windows\System32\drivers\SETC8AA.tmp	DrvInst.exe
File created	C:\Windows\System32\drivers\SETCCC1.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\drivers\ovpn-dco.sys	DrvInst.exe

Executes dropped EXE 6 IoCs

pid	Process
1748	openvpn-gui.exe
388	openvpn.exe
1916	openvpnserv.exe
2952	openvpnserv2.exe
4804	openvpnserv2.exe
3504	openvpn-gui.exe

Loads dropped DLL 23 IoCs

pid	Process
3208	MsiExec.exe
3208	MsiExec.exe
1932	MsiExec.exe
1932	MsiExec.exe
1932	MsiExec.exe
1932	MsiExec.exe
3912	MsiExec.exe
3912	MsiExec.exe
3912	MsiExec.exe
3912	MsiExec.exe
3912	MsiExec.exe
388	openvpn.exe
388	openvpn.exe
388	openvpn.exe
388	openvpn.exe
388	openvpn.exe
388	openvpn.exe
388	openvpn.exe
1916	openvpnserv.exe
3912	MsiExec.exe
3912	MsiExec.exe
1932	MsiExec.exe
3208	MsiExec.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OpenVPN-GUI = "C:\\Program Files\\OpenVPN\\bin\\openvpn-gui.exe"	msiexec.exe

Badlisted process makes network request 4 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
4	4744	msiexec.exe
6	4744	msiexec.exe
6	4744	msiexec.exe
4	4744	msiexec.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System32\DriverStore\FileRepository\netvchannel.inf_amd64_ba3e73aa330c95d6\netvchannel.PNF	MsiExec.exe
File created	C:\Windows\System32\DriverStore\FileRepository\bcmdhd64.inf_amd64_e0bae6831f60ea5f\bcmdhd64.PNF	MsiExec.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netvwwanmp.inf_amd64_f9e30429669d7fff\netvwwanmp.PNF	MsiExec.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{c91b8d6c-b59b-4b4b-b90a-b621813b532e}\wintun.cat	DrvInst.exe
File created	C:\Windows\System32\DriverStore\FileRepository\net7500-x64-n650f.inf_amd64_cc87c915f33d1c27\net7500-x64-n650f.PNF	MsiExec.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netwns64.inf_amd64_162bb49f925c6463\netwns64.PNF	MsiExec.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mwlu97w8x64.inf_amd64_23bc3dc6d91eebdc\mwlu97w8x64.PNF	MsiExec.exe
File created	C:\Windows\System32\DriverStore\Temp\{ba81b371-4e53-4849-a540-ea48050dcae4}\SETBE0B.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\CatRoot2\dberr.txt	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{b30565aa-1123-7a4e-90b0-36e9fbce53d5}\SETBEB8.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\ovpn-dco.inf_amd64_b737bb7e846ccda6\ovpn-dco.inf	DrvInst.exe
File created	C:\Windows\System32\DriverStore\FileRepository\rndiscmp.inf_amd64_81bff1eb756435c6\rndiscmp.PNF	MsiExec.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netathr10x.inf_amd64_2691c4f95b80eb3b\netathr10x.PNF	MsiExec.exe
File created	C:\Windows\System32\DriverStore\FileRepository\kdnic.inf_amd64_6649425cdcae9b5f\kdnic.PNF	MsiExec.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netvwifimp.inf_amd64_ec11d0ad3c5b262a\netvwifimp.PNF	MsiExec.exe
File created	C:\Windows\System32\DriverStore\FileRepository\net7400-x64-n650.inf_amd64_557ce3b37c3e0e3b\net7400-x64-n650.PNF	MsiExec.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\ovpn-dco.inf_amd64_b737bb7e846ccda6\ovpn-dco.cat	DrvInst.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netl260a.inf_amd64_783312763f8749c7\netl260a.PNF	MsiExec.exe
File created	C:\Windows\System32\DriverStore\FileRepository\ipoib6x.inf_amd64_ef71073a5867971f\ipoib6x.PNF	MsiExec.exe
File created	C:\Windows\System32\DriverStore\FileRepository\net819xp.inf_amd64_ff7a5dd4f9b1ceba\net819xp.PNF	MsiExec.exe
File created	C:\Windows\System32\DriverStore\FileRepository\net44amd.inf_amd64_450d4b1e35cc8e0d\net44amd.PNF	MsiExec.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netrasa.inf_amd64_1bdf7a435cb3580d\netrasa.PNF	MsiExec.exe
File created	C:\Windows\System32\DriverStore\FileRepository\wnetvsc.inf_amd64_9a5b429abc465278\wnetvsc.PNF	MsiExec.exe
File created	C:\Windows\System32\DriverStore\FileRepository\net8192se64.inf_amd64_167684f9283b4eca\net8192se64.PNF	MsiExec.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netrtwlane01.inf_amd64_b02695ef070d7a42\netrtwlane01.PNF	MsiExec.exe
File created	C:\Windows\System32\DriverStore\FileRepository\nete1g3e.inf_amd64_af58b4e19562a3f9\nete1g3e.PNF	MsiExec.exe
File created	C:\Windows\System32\DriverStore\FileRepository\wceisvista.inf_amd64_07ad61d07466a58a\wceisvista.PNF	MsiExec.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netg664.inf_amd64_84cd7b2798e0a666\netg664.PNF	MsiExec.exe
File created	C:\Windows\System32\DriverStore\FileRepository\athw8x.inf_amd64_55014eff4ceefbdf\athw8x.PNF	MsiExec.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{ba81b371-4e53-4849-a540-ea48050dcae4}\SETBE0C.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{ba81b371-4e53-4849-a540-ea48050dcae4}\tap0901.sys	DrvInst.exe
File created	C:\Windows\System32\DriverStore\FileRepository\ndisimplatformmp.inf_amd64_8de1181bfd1f1628\ndisimplatformmp.PNF	MsiExec.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netwbw02.inf_amd64_1c4077fa004e73b4\netwbw02.PNF	MsiExec.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netwtw06.inf_amd64_2edd50e7a54d503b\netwtw06.PNF	MsiExec.exe
File created	C:\Windows\System32\DriverStore\FileRepository\rt640x64.inf_amd64_8984d8483eef476c\rt640x64.PNF	MsiExec.exe
File created	C:\Windows\System32\DriverStore\FileRepository\usbncm.inf_amd64_9957a38c3d2283ed\usbncm.PNF	MsiExec.exe
File created	C:\Windows\System32\DriverStore\drvstore.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netwew01.inf_amd64_153e01d761813df2\netwew01.PNF	MsiExec.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netl1c63x64.inf_amd64_4d6630ce07a4fb42\netl1c63x64.PNF	MsiExec.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mrvlpcie8897.inf_amd64_07fc330c5a5730ca\mrvlpcie8897.PNF	MsiExec.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{ba81b371-4e53-4849-a540-ea48050dcae4}\tap0901.cat	DrvInst.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netloop.inf_amd64_762588e32974f9e8\netloop.PNF	MsiExec.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{c91b8d6c-b59b-4b4b-b90a-b621813b532e}\SETB939.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{b30565aa-1123-7a4e-90b0-36e9fbce53d5}\ovpn-dco.inf	DrvInst.exe
File created	C:\Windows\System32\DriverStore\FileRepository\ovpn-dco.inf_amd64_b737bb7e846ccda6\ovpn-dco.PNF	MsiExec.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netl160a.inf_amd64_e4cbe375963a69e9\netl160a.PNF	MsiExec.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netnvm64.inf_amd64_35bbbe80dec15683\netnvm64.PNF	MsiExec.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netrtwlane_13.inf_amd64_992f4f46e65f30d4\netrtwlane_13.PNF	MsiExec.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netax88772.inf_amd64_5d1c92f42d958529\netax88772.PNF	MsiExec.exe
File created	C:\Windows\System32\DriverStore\Temp\{c91b8d6c-b59b-4b4b-b90a-b621813b532e}\SETB94B.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{ba81b371-4e53-4849-a540-ea48050dcae4}	DrvInst.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netbc63a.inf_amd64_7ba6c9cea77dd549\netbc63a.PNF	MsiExec.exe
File created	C:\Windows\System32\DriverStore\FileRepository\net1ic64.inf_amd64_5f033e913d34d111\net1ic64.PNF	MsiExec.exe
File created	C:\Windows\System32\DriverStore\FileRepository\e2xw10x64.inf_amd64_04c2ae40613a06ff\e2xw10x64.PNF	MsiExec.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netsstpa.inf_amd64_e76c5387d67e3fd6\netsstpa.PNF	MsiExec.exe
File created	C:\Windows\System32\DriverStore\FileRepository\rtwlanu_oldic.inf_amd64_1a82423cc076e882\rtwlanu_oldic.PNF	MsiExec.exe
File created	C:\Windows\System32\DriverStore\FileRepository\c_net.inf_amd64_32a9ad23c1ecc42d\c_net.PNF	MsiExec.exe
File created	C:\Windows\System32\DriverStore\Temp\{ba81b371-4e53-4849-a540-ea48050dcae4}\SETBE0C.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netavpna.inf_amd64_f6f0831ba09dd9f5\netavpna.PNF	MsiExec.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netimm.inf_amd64_8b2087393aaef952\netimm.PNF	MsiExec.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netr7364.inf_amd64_310ee0bc0af86ba3\netr7364.PNF	MsiExec.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\wintun.inf_amd64_def3401515466414\wintun.inf	DrvInst.exe
File created	C:\Windows\System32\DriverStore\FileRepository\wintun.inf_amd64_def3401515466414\wintun.PNF	MsiExec.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netxex64.inf_amd64_ede00b448bfe8099\netxex64.PNF	MsiExec.exe

Drops file in Program Files directory 27 IoCs

description	ioc	Process
File created	C:\Program Files\OpenVPN\bin\openvpn-plap-uninstall.reg	msiexec.exe
File created	C:\Program Files\OpenVPN\sample-config\client.ovpn	msiexec.exe
File created	C:\Program Files\OpenVPN\config\README.txt	msiexec.exe
File created	C:\Program Files\OpenVPN\doc\INSTALL-win32.txt	msiexec.exe
File created	C:\Program Files\OpenVPN\bin\libcrypto-3-x64.dll	msiexec.exe
File created	C:\Program Files\OpenVPN\log\README.txt	msiexec.exe
File created	C:\Program Files\Common Files\ovpn-dco\Win10\ovpn-dco.cat	msiexec.exe
File created	C:\Program Files\OpenVPN\res\ovpn.ico	msiexec.exe
File created	C:\Program Files\OpenVPN\bin\openvpn.exe	msiexec.exe
File created	C:\Program Files\OpenVPN\ssl\modules\legacy.dll	msiexec.exe
File created	C:\Program Files\OpenVPN\bin\libpkcs11-helper-1.dll	msiexec.exe
File created	C:\Program Files\OpenVPN\doc\openvpn.8.html	msiexec.exe
File created	C:\Program Files\OpenVPN\bin\openvpn-gui.exe	msiexec.exe
File created	C:\Program Files\OpenVPN\bin\openvpn-plap-install.reg	msiexec.exe
File created	C:\Program Files\OpenVPN\bin\openvpnserv.exe	msiexec.exe
File created	C:\Program Files\OpenVPN\bin\openvpnserv2.exe	msiexec.exe
File created	C:\Program Files\OpenVPN\config-auto\README.txt	msiexec.exe
File created	C:\Program Files\OpenVPN\sample-config\server.ovpn	msiexec.exe
File created	C:\Program Files\OpenVPN\bin\tapctl.exe	msiexec.exe
File created	C:\Program Files\OpenVPN\bin\vcruntime140.dll	msiexec.exe
File created	C:\Program Files\OpenVPN\bin\libopenvpn_plap.dll	msiexec.exe
File created	C:\Program Files\OpenVPN\bin\libssl-3-x64.dll	msiexec.exe
File created	C:\Program Files\OpenVPN\license.txt	msiexec.exe
File created	C:\Program Files\Common Files\ovpn-dco\Win10\ovpn-dco.inf	msiexec.exe
File created	C:\Program Files\Common Files\ovpn-dco\Win10\ovpn-dco.sys	msiexec.exe
File created	C:\Program Files\OpenVPN\include\tap-windows.h	msiexec.exe
File created	C:\Program Files\OpenVPN\bin\openvpn-plap-install-new.reg	MsiExec.exe

Drops file in Windows directory 41 IoCs

description	ioc	Process
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File opened for modification	C:\Windows\Installer\MSID70C.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIAFC6.tmp	msiexec.exe
File created	C:\Windows\inf\oem4.inf	DrvInst.exe
File opened for modification	C:\Windows\Installer\MSIBFD9.tmp	msiexec.exe
File created	C:\Windows\Installer\e58a97a.msi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{CD1DCDF3-BCAC-4233-A1CC-5DAFEE1E604E}	msiexec.exe
File created	C:\Windows\inf\oem3.inf	DrvInst.exe
File created	C:\Windows\Installer\{CD1DCDF3-BCAC-4233-A1CC-5DAFEE1E604E}\tapctl_create.ico	msiexec.exe
File opened for modification	C:\Windows\inf\oem3.inf	DrvInst.exe
File opened for modification	C:\Windows\inf\oem4.inf	DrvInst.exe
File created	C:\Windows\inf\oem5.inf	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File created	C:\Windows\INF\oem5.PNF	MsiExec.exe
File opened for modification	C:\Windows\Installer\MSIAF37.tmp	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	svchost.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File opened for modification	C:\Windows\inf\oem5.inf	DrvInst.exe
File created	C:\Windows\INF\oem4.PNF	MsiExec.exe
File opened for modification	C:\Windows\Installer\e58a97a.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIAF96.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSID71D.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSID75C.tmp	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIB0E1.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIB19E.tmp	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File opened for modification	C:\Windows\Installer\MSIBE81.tmp	msiexec.exe
File created	C:\Windows\Installer\{CD1DCDF3-BCAC-4233-A1CC-5DAFEE1E604E}\openvpn.ico	msiexec.exe
File opened for modification	C:\Windows\Installer\{CD1DCDF3-BCAC-4233-A1CC-5DAFEE1E604E}\openvpn.ico	msiexec.exe
File opened for modification	C:\Windows\Installer\{CD1DCDF3-BCAC-4233-A1CC-5DAFEE1E604E}\tapctl_create.ico	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIABEB.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIAFE6.tmp	msiexec.exe
File created	C:\Windows\Installer\e58a97c.msi	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	MsiExec.exe
File opened for modification	C:\Windows\Installer\MSIBAA7.tmp	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File created	C:\Windows\INF\oem3.PNF	MsiExec.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
5128	sc.exe
2244	sc.exe

Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs

persistence privilege_escalation

Installer Packages

T1546.016

Msiexec

T1218.007

pid	Process
4744	msiexec.exe

Event Triggered Execution: Netsh Helper DLL 1 TTPs 9 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Service	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Filters	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Filters	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs	MsiExec.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Service	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Service	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	MsiExec.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Service	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\LowerFilters	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Filters	DrvInst.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Filters	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Phantom	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Filters	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\LowerFilters	DrvInst.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\CompatibleIDs	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\UpperFilters	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Service	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\CompatibleIDs	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\UpperFilters	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Filters	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Phantom	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Filters	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Service	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\LowerFilters	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Phantom	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Service	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Service	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom	MsiExec.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Service	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\LowerFilters	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\CompatibleIDs	DrvInst.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\RAS AutoDial	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows Script\Settings\Telemetry\msiexec.exe\JScriptSetScriptStateStarted = "240697125"	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe

Modifies registry class 57 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3FDCD1DCCACB33241ACCD5FAEEE106E4	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3FDCD1DCCACB33241ACCD5FAEEE106E4\SourceList\Media	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\OpenVPNFile\shell\run	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\OpenVPNFile\shell\run\command	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\3FDCD1DCCACB33241ACCD5FAEEE106E4\OpenVPN.Service = "OpenVPN"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\3FDCD1DCCACB33241ACCD5FAEEE106E4\Drivers.Wintun = "Drivers"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\OpenVPNFile\shell	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3FDCD1DCCACB33241ACCD5FAEEE106E4\Assignment = "1"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3FDCD1DCCACB33241ACCD5FAEEE106E4\AdvertiseFlags = "388"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\68FDB164983D1744FB639908B6461C72	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3FDCD1DCCACB33241ACCD5FAEEE106E4\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3FDCD1DCCACB33241ACCD5FAEEE106E4\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3FDCD1DCCACB33241ACCD5FAEEE106E4\ProductName = "OpenVPN 2.6.14-I001 amd64"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3FDCD1DCCACB33241ACCD5FAEEE106E4\SourceList\Net	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\OpenVPNFile\shell\open\command\ = "\"notepad.exe\" \"%1\""	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\OpenVPNFile\shell\import\command	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3FDCD1DCCACB33241ACCD5FAEEE106E4\Version = "33949049"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3FDCD1DCCACB33241ACCD5FAEEE106E4\ProductIcon = "C:\\Windows\\Installer\\{CD1DCDF3-BCAC-4233-A1CC-5DAFEE1E604E}\\openvpn.ico"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3FDCD1DCCACB33241ACCD5FAEEE106E4\AuthorizedLUAApp = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\68FDB164983D1744FB639908B6461C72\3FDCD1DCCACB33241ACCD5FAEEE106E4	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\OpenVPNFile\DefaultIcon	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\3FDCD1DCCACB33241ACCD5FAEEE106E4\OpenSSL = "\x06"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3FDCD1DCCACB33241ACCD5FAEEE106E4\PackageCode = "22912DF0EEBE3A3498FA548D65979F16"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\OpenVPNFile\shell	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\.ovpn	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\OpenVPNFile	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\OpenVPNFile\shell\ = "import"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\OpenVPNFile\shell\open\command	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\OpenVPNFile\shell\run\ = "Start OpenVPN on this config file"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\OpenVPNFile\shell\run\command\ = "\"C:\\Program Files\\OpenVPN\\bin\\openvpn.exe\" --pause-exit --config \"%1\""	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3FDCD1DCCACB33241ACCD5FAEEE106E4\SourceList\Media\1 = ";"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\3FDCD1DCCACB33241ACCD5FAEEE106E4\Drivers.OvpnDco = "Drivers"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3FDCD1DCCACB33241ACCD5FAEEE106E4\SourceList	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3FDCD1DCCACB33241ACCD5FAEEE106E4\Clients = 3a0000000000	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\OpenVPNFile\shell\open	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\3FDCD1DCCACB33241ACCD5FAEEE106E4\OpenVPN.GUI = "OpenVPN"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\3FDCD1DCCACB33241ACCD5FAEEE106E4\OpenVPN.Documentation = "OpenVPN"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\3FDCD1DCCACB33241ACCD5FAEEE106E4\Drivers.TAPWindows6 = "Drivers"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3FDCD1DCCACB33241ACCD5FAEEE106E4\InstanceType = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\OpenVPNFile\shell\open\command	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.ovpn\ = "OpenVPNFile"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\3FDCD1DCCACB33241ACCD5FAEEE106E4\EasyRSA = "\x06OpenSSL"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3FDCD1DCCACB33241ACCD5FAEEE106E4\DeploymentFlags = "3"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\OpenVPNFile\DefaultIcon\ = "C:\\Program Files\\OpenVPN\\res\\ovpn.ico,0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\3FDCD1DCCACB33241ACCD5FAEEE106E4\OpenVPN.SampleCfg = "OpenVPN"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\3FDCD1DCCACB33241ACCD5FAEEE106E4\OpenVPN.GUI.OnLogon = "OpenVPN.GUI"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\3FDCD1DCCACB33241ACCD5FAEEE106E4\Drivers	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3FDCD1DCCACB33241ACCD5FAEEE106E4\SourceList\PackageName = "OpenVPN-2.6.14-windows-amd64.msi"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\OpenVPNFile\shell\import	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\OpenVPNFile\shell\import\command\ = "\"C:\\Program Files\\OpenVPN\\bin\\openvpn-gui.exe\" --command import \"%1\""	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\3FDCD1DCCACB33241ACCD5FAEEE106E4\OpenVPN.PLAP.Register = "\x06OpenVPN.Service"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3FDCD1DCCACB33241ACCD5FAEEE106E4\Language = "1033"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\3FDCD1DCCACB33241ACCD5FAEEE106E4	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\3FDCD1DCCACB33241ACCD5FAEEE106E4\OpenVPN	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\OpenVPNFile\ = "OpenVPN Config File"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\OpenVPNFile	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\OpenVPNFile\shell\import\ = "Import into OpenVPN-GUI"	msiexec.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5340	msiexec.exe
5340	msiexec.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid
4

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4744	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4744	msiexec.exe
Token: SeSecurityPrivilege	5340	msiexec.exe
Token: SeCreateTokenPrivilege	4744	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	4744	msiexec.exe
Token: SeLockMemoryPrivilege	4744	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4744	msiexec.exe
Token: SeMachineAccountPrivilege	4744	msiexec.exe
Token: SeTcbPrivilege	4744	msiexec.exe
Token: SeSecurityPrivilege	4744	msiexec.exe
Token: SeTakeOwnershipPrivilege	4744	msiexec.exe
Token: SeLoadDriverPrivilege	4744	msiexec.exe
Token: SeSystemProfilePrivilege	4744	msiexec.exe
Token: SeSystemtimePrivilege	4744	msiexec.exe
Token: SeProfSingleProcessPrivilege	4744	msiexec.exe
Token: SeIncBasePriorityPrivilege	4744	msiexec.exe
Token: SeCreatePagefilePrivilege	4744	msiexec.exe
Token: SeCreatePermanentPrivilege	4744	msiexec.exe
Token: SeBackupPrivilege	4744	msiexec.exe
Token: SeRestorePrivilege	4744	msiexec.exe
Token: SeShutdownPrivilege	4744	msiexec.exe
Token: SeDebugPrivilege	4744	msiexec.exe
Token: SeAuditPrivilege	4744	msiexec.exe
Token: SeSystemEnvironmentPrivilege	4744	msiexec.exe
Token: SeChangeNotifyPrivilege	4744	msiexec.exe
Token: SeRemoteShutdownPrivilege	4744	msiexec.exe
Token: SeUndockPrivilege	4744	msiexec.exe
Token: SeSyncAgentPrivilege	4744	msiexec.exe
Token: SeEnableDelegationPrivilege	4744	msiexec.exe
Token: SeManageVolumePrivilege	4744	msiexec.exe
Token: SeImpersonatePrivilege	4744	msiexec.exe
Token: SeCreateGlobalPrivilege	4744	msiexec.exe
Token: SeCreateTokenPrivilege	4744	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	4744	msiexec.exe
Token: SeLockMemoryPrivilege	4744	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4744	msiexec.exe
Token: SeMachineAccountPrivilege	4744	msiexec.exe
Token: SeTcbPrivilege	4744	msiexec.exe
Token: SeSecurityPrivilege	4744	msiexec.exe
Token: SeTakeOwnershipPrivilege	4744	msiexec.exe
Token: SeLoadDriverPrivilege	4744	msiexec.exe
Token: SeSystemProfilePrivilege	4744	msiexec.exe
Token: SeSystemtimePrivilege	4744	msiexec.exe
Token: SeProfSingleProcessPrivilege	4744	msiexec.exe
Token: SeIncBasePriorityPrivilege	4744	msiexec.exe
Token: SeCreatePagefilePrivilege	4744	msiexec.exe
Token: SeCreatePermanentPrivilege	4744	msiexec.exe
Token: SeBackupPrivilege	4744	msiexec.exe
Token: SeRestorePrivilege	4744	msiexec.exe
Token: SeShutdownPrivilege	4744	msiexec.exe
Token: SeDebugPrivilege	4744	msiexec.exe
Token: SeAuditPrivilege	4744	msiexec.exe
Token: SeSystemEnvironmentPrivilege	4744	msiexec.exe
Token: SeChangeNotifyPrivilege	4744	msiexec.exe
Token: SeRemoteShutdownPrivilege	4744	msiexec.exe
Token: SeUndockPrivilege	4744	msiexec.exe
Token: SeSyncAgentPrivilege	4744	msiexec.exe
Token: SeEnableDelegationPrivilege	4744	msiexec.exe
Token: SeManageVolumePrivilege	4744	msiexec.exe
Token: SeImpersonatePrivilege	4744	msiexec.exe
Token: SeCreateGlobalPrivilege	4744	msiexec.exe
Token: SeCreateTokenPrivilege	4744	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	4744	msiexec.exe
Token: SeLockMemoryPrivilege	4744	msiexec.exe

Suspicious use of FindShellTrayWindow 5 IoCs

pid	Process
4744	msiexec.exe
1748	openvpn-gui.exe
1748	openvpn-gui.exe
4744	msiexec.exe
1748	openvpn-gui.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
1748	openvpn-gui.exe
1748	openvpn-gui.exe
1748	openvpn-gui.exe

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 5340 wrote to memory of 3208	5340	msiexec.exe	88
PID 5340 wrote to memory of 2920	5340	msiexec.exe	101
PID 5340 wrote to memory of 1932	5340	msiexec.exe	103
PID 5340 wrote to memory of 3912	5340	msiexec.exe	105
PID 2924 wrote to memory of 1316	2924	svchost.exe	107
PID 2924 wrote to memory of 5564	2924	svchost.exe	108
PID 2924 wrote to memory of 4432	2924	svchost.exe	109
PID 2924 wrote to memory of 2020	2924	svchost.exe	111
PID 3912 wrote to memory of 3000	3912	MsiExec.exe	115
PID 1748 wrote to memory of 388	1748	openvpn-gui.exe	118
PID 2924 wrote to memory of 5900	2924	svchost.exe	121
PID 3912 wrote to memory of 3552	3912	MsiExec.exe	122
PID 2924 wrote to memory of 5300	2924	svchost.exe	127
PID 3912 wrote to memory of 1824	3912	MsiExec.exe	128
PID 3912 wrote to memory of 2244	3912	MsiExec.exe	134
PID 3912 wrote to memory of 5128	3912	MsiExec.exe	136
PID 3208 wrote to memory of 3504	3208	MsiExec.exe	139

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\OpenVPN-2.6.14-windows-amd64.msi
1⤵
- Badlisted process makes network request
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4744

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Adds Run key to start application
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5340
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding 25E93E454F79A7912871FB805C2E0CB4 C
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:3208
- - C:\Program Files\OpenVPN\bin\openvpn-gui.exe
    "C:\Program Files\OpenVPN\bin\openvpn-gui.exe"
    3⤵
    - Executes dropped EXE
    PID:3504
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:2920
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding 45696E76E3963AE161E9C6B4F5908C0D
  2⤵
  - Loads dropped DLL
  PID:1932
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding D478C54764F9BAC15448B99121D949E0 E Global\MSI0000
  2⤵
  - Boot or Logon Autostart Execution: Active Setup
  - Loads dropped DLL
  - Drops file in System32 directory
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - Checks SCSI registry key(s)
  - Modifies data under HKEY_USERS
  - Suspicious use of WriteProcessMemory
  PID:3912
- - C:\Windows\System32\netsh.exe
    netsh interface set interface name="Local Area Connection" newname="OpenVPN Wintun"
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:3000
- - C:\Windows\System32\netsh.exe
    netsh interface set interface name="Local Area Connection" newname="OpenVPN TAP-Windows6"
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:3552
- - C:\Windows\System32\netsh.exe
    netsh interface set interface name="Local Area Connection" newname="OpenVPN Data Channel Offload"
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:1824
- - C:\Windows\System32\sc.exe
    "C:\Windows\System32\sc.exe" config OpenVPNService start= auto
    3⤵
    - Launches sc.exe
    PID:2244
- - C:\Windows\System32\sc.exe
    "C:\Windows\System32\sc.exe" start OpenVPNService
    3⤵
    - Launches sc.exe
    PID:5128

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
PID:5844

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall
1⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious use of WriteProcessMemory
PID:2924
- C:\Windows\system32\DrvInst.exe
  DrvInst.exe "4" "1" "C:\Windows\Temp\9c7debcb65b58afd8b8fce7cc6924e23b62d839d08db0817670de3073e7b78ac\wintun.inf" "9" "416dc9073" "000000000000014C" "WinSta0\Default" "000000000000015C" "208" "C:\Windows\Temp\9c7debcb65b58afd8b8fce7cc6924e23b62d839d08db0817670de3073e7b78ac"
  2⤵
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Checks SCSI registry key(s)
  - Modifies data under HKEY_USERS
  PID:1316
- C:\Windows\system32\DrvInst.exe
  DrvInst.exe "4" "1" "C:\Windows\Temp\ddb99223bbf7772d34ba1abc643e3ca8c6e7d69c2ee71505545678e868834de7\OemVista.inf" "9" "4c2d5a0cf" "000000000000015C" "WinSta0\Default" "0000000000000158" "208" "C:\Windows\Temp\ddb99223bbf7772d34ba1abc643e3ca8c6e7d69c2ee71505545678e868834de7"
  2⤵
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Checks SCSI registry key(s)
  - Modifies data under HKEY_USERS
  PID:5564
- C:\Windows\system32\DrvInst.exe
  DrvInst.exe "4" "1" "C:\Program Files\Common Files\ovpn-dco\Win10\ovpn-dco.inf" "9" "4e1f3ffd3" "0000000000000158" "WinSta0\Default" "0000000000000160" "208" "C:\Program Files\Common Files\ovpn-dco\Win10"
  2⤵
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Checks SCSI registry key(s)
  - Modifies data under HKEY_USERS
  PID:4432
- C:\Windows\system32\DrvInst.exe
  DrvInst.exe "2" "11" "ROOT\NET\0000" "C:\Windows\INF\oem3.inf" "oem3.inf:9ef34515d755ec66:Wintun.Install:0.8.0.0:wintun," "42b53aaff" "0000000000000158"
  2⤵
  - Drops file in Drivers directory
  - Drops file in Windows directory
  - Checks SCSI registry key(s)
  PID:2020
- C:\Windows\system32\DrvInst.exe
  DrvInst.exe "2" "11" "ROOT\NET\0001" "C:\Windows\INF\oem4.inf" "oem4.inf:3beb73aff103cc24:tap0901.ndi:9.27.0.0:root\tap0901," "433338203" "0000000000000158"
  2⤵
  - Drops file in Drivers directory
  - Drops file in Windows directory
  - Checks SCSI registry key(s)
  PID:5900
- C:\Windows\system32\DrvInst.exe
  DrvInst.exe "2" "11" "ROOT\NET\0002" "C:\Windows\INF\oem5.inf" "oem5.inf:c695c3de07ba2b5d:ovpn-dco_Device:1.2.1.0:ovpn-dco," "43b135903" "000000000000015C"
  2⤵
  - Drops file in Drivers directory
  - Drops file in Windows directory
  - Checks SCSI registry key(s)
  PID:5300

C:\Program Files\OpenVPN\bin\openvpn-gui.exe
"C:\Program Files\OpenVPN\bin\openvpn-gui.exe"
1⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1748
- C:\Program Files\OpenVPN\bin\openvpn.exe
  openvpn --version
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:388

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s Netman
1⤵
- Modifies data under HKEY_USERS
PID:4284

C:\Program Files\OpenVPN\bin\openvpnserv.exe
"C:\Program Files\OpenVPN\bin\openvpnserv.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1916

C:\Program Files\OpenVPN\bin\openvpnserv2.exe
"C:\Program Files\OpenVPN\bin\openvpnserv2.exe"
1⤵
- Executes dropped EXE
PID:2952

C:\Program Files\OpenVPN\bin\openvpnserv2.exe
"C:\Program Files\OpenVPN\bin\openvpnserv2.exe"
1⤵
- Executes dropped EXE
PID:4804

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Installer Packages

T1546.016

Netsh Helper DLL

T1546.007

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Installer Packages

T1546.016

Netsh Helper DLL

T1546.007

Defense Evasion

Modify Registry

T1112

System Binary Proxy Execution

T1218

Msiexec

T1218.007

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e58a97b.rbs

Path C:\Config.Msi\e58a97b.rbs
Size 876KB
SHA256 12ff8cd892e0035b5712362166eb15cc69d8a7d8d5930c4ba17193db43d5de18
MD5 05a92b27f0d3565ca9f104954757cf16
SHA1 cdf31ec83256429a248851f9e8f7c3cc8fa8e7b1
SHA512 c0c1a64f17cae294ce314bee8713c1cabd2403343565fdeaf4f4f1e1c7d520923455a6ca69146e5dc16afcbb168a6e532d7ff17efe95e4c5c2f8b953aae36300
SSDEEP 24576:YC4LJNBjSblC4LJNBjSbCC4LJNBjSb9C4LJNBjSbs:IvB+JvB+OvB+BvB+g
TLSH
T1F9157D09B7D000F9EDB7463889674616E773780107749A9F03A4837AEF2F7D1A639B62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ovpn-dco.cat

Path C:\PROGRA~1\COMMON~1\ovpn-dco\Win10\ovpn-dco.cat
Size 11KB
SHA256 26c54ce26cb43407855ba24d10fbb30a87e5a1a0a35536025a02cb003fe474f4
MD5 5551203f3f1095335ff00421b16fd7e2
SHA1 0d14402407d60952f631dffe35240de3a1f910cb
SHA512 3c31b8f60bb59e4ac3c0cda8335af1918927c51b203c8b68f2601b390ad0bc0228cb9d5566dedef05ff38cabfce46eb3d54c52cd59c828bc17dcf0b1c24a8b08
SSDEEP 192:aOLm9xJCxkJnEwKUNhYCns2owcLK+X01k9z3AB3CmByFGx:s0kmUNh3sK6R9zc3Cm+Gx
TLSH
T1E4322AEA9A2C01C2ED977C6083D8E9537C3E27CB1C5051AA21ABFA140CE73C8F71556E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ovpn-dco.sys

Path C:\PROGRA~1\COMMON~1\ovpn-dco\Win10\ovpn-dco.sys
Size 89KB
SHA256 2357e4d2007f346a3d2b3bf05115caeaf3eb069a70be654ce472be71e6f7fc75
MD5 5e69b6c42467b2673101e592a2b28638
SHA1 16d076f57b3cbdbe945c6666676823871f5c90d1
SHA512 232e9441db8da52cd5e6f29baf5340b0540125074a7ccc9d4754762c56460b72327f89d6583a8afde71ed400433eb850e1eb2b9d5fc536d8f9c18992b83fa587
SSDEEP 1536:b/+PHw1yLCA62eiARYLdBX0A0gA1j7ajEMB0khx+SmzH1CzcI:QlCWOYf0A0PO0kH+SSCYI
TLSH
T1B1930875A6E010D4F47B56B886B64E01BFB1BA522F33D6EF0410856D0F36BC88E3A759
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ovpn-dco.inf

Path C:\Program Files\Common Files\ovpn-dco\Win10\ovpn-dco.inf
Size 2KB
SHA256 1f6c35bc11d910f91c32ea54894d0fddb0094876bdd526d04a9287d04d636242
MD5 77da079a3665afc84d05c3d07bcaa0d0
SHA1 3fbfafe2c08100f5b46b792398c2ecb9157760e9
SHA512 10fcd8464c6aab386bf2f675175598764e0b784a898b7b450fef3d055ecf902c7a57ac0aef2725b9e6899146e4e9230c8677bfd2a8f18489b642fa6beca25507
TLSH
T19441F14A52C20FBD3B432D7596077BA2B9D6910050C8151AF18CDA468B8FF99B31B7EA
MD5 SHA1 SHA512 TLSH

Submit Download

libcrypto-3-x64.dll

Path C:\Program Files\OpenVPN\bin\libcrypto-3-x64.dll
Size 4.6MB
SHA256 71270ed463648bcbe45829cbc0ce3827faf3267e46d530ae0a82d9bc0c619ec0
MD5 5984ea63df1671b1d174d4d957a7b483
SHA1 3691290a86290533537593654db9e11b2bd15fac
SHA512 04f087a1bce16c811eb6a4be318dc5846e5553f3b0d50318aa335bc46a262cfe177479ea06b637aa6934df1ae4a998e7b764df17d2efba0ef80ef302c05c57a2
SSDEEP 98304:9gGN3UNaucJAWjXHJPx+s1CPwDvt3uF0nCc:6GN3UZcJAWjXpph1CPwDvt3uF0nCc
TLSH
T18E268C69A6BC0096D86A95BCC2D76227D371B41257F057CF2E284AF90F23FD426BB740
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libpkcs11-helper-1.dll

Path C:\Program Files\OpenVPN\bin\libpkcs11-helper-1.dll
Size 111KB
SHA256 e2500ded6e44090f0c76528903269938a029bee206fde25adac040d6e3a124f7
MD5 e5353f2c01b77b433ea518923b1b8dbd
SHA1 fad48fbf2d115b5426b40fd52d51a8729a976462
SHA512 b81ae3412a4312e0f499860586d866d47f41647441f5875e645ffa74f83aa2ef1569b5df6535ab347a89fd3b6bb6bc69558bca65336674f0459eeda167efeb34
SSDEEP 1536:Usfoicdz0Suh6YcYwnIrHL6PS7ySVfPrZm8KAd0uM82FjE25YiL3nyj7LoNA:qdzA3ynIrHLye1VfPrZqE25RL3nyj/ou
TLSH
T1F5B30902BD846870D49AD33DEC62022BA3767890137657DF476260E92F93F96AD39F43
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libssl-3-x64.dll

Path C:\Program Files\OpenVPN\bin\libssl-3-x64.dll
Size 818KB
SHA256 c681893dd0c9f86e7f405792dec32adab33cb899cbd3b2ddda533e28f577ab6d
MD5 10d4982726da7c122404f6d6f9bcd793
SHA1 4e6861066218f0909b8ae851fbfe9ebe0b894e46
SHA512 a7e3ce35d60ffba3072211e600bd91e4f0419673ad64471b6b94a537e4c908a02b6fee673ea55e95c22a2b4a2dcc967f56aba0ffb99a95a8875c9b4bda37e668
SSDEEP 12288:OXxxYXIy6weQqYjq2NIUuXWGfcFTdsFgIMPA3AK8t72tJAh1z/VhEi:OXkIrjY+E4bWUgIMPA5S7KJAh1znt
TLSH
T12B053A69BBB8009DD876C13986938613E6F6B4563370EBDB0B648A7A0F637D4273D344
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

openvpn-gui.exe

Path C:\Program Files\OpenVPN\bin\openvpn-gui.exe
Size 1.1MB
SHA256 1f07550f3decbfd7c8737694001ee13c26de84ef498dc493d313a79db2080646
MD5 75d5db58796acffda38dd0139a9aa15a
SHA1 f1eeab1b9967f0ba54f12f6ead70a0ce85f597e2
SHA512 d987ded834671be0894f5953a800947280b012288a2ec44fdcc7fc42dd08e70577ddd6f4c22118e18ebbf0fdca0c5054e8c11bbd3b104bd7c7f8b8f9056999bd
SSDEEP 12288:wtlBCAQ/WWOn+wP/nQStD6Fo+41GqKqx8xmwApbn:wO/LOnBHQS4Fo+yGqKtobn
TLSH
T129457001B3F98118F5F3AB349DBA46526E3BBC815E34CA8E5295755E0A72B90DD30B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

openvpn-plap-install.reg

Path C:\Program Files\OpenVPN\bin\openvpn-plap-install.reg
Size 454B
SHA256 18b542b3de918da103ea6d79f3be0c5af8349502dc9c673f2db5b6f05dc57d35
MD5 2b7d47401bad3221ed6d92996d49f9f7
SHA1 a3b8cbc667f5023e4a4dd8c50bc6ab78c51048de
SHA512 dceafceeff05a61fde179dbdf13bc2b1243ee756028b1c8a96e311f279effbd9e2567f65f8ae063841ca2c4961f6b522553b9c7095daa94898ff5ed048607aa5
TLSH
T151F0DCF2CE079202DA91122D291606F147B64569758E0B92F181A3A86DFECE343FC08B
MD5 SHA1 SHA512 TLSH

Submit Download

openvpn.exe

Path C:\Program Files\OpenVPN\bin\openvpn.exe
Size 1019KB
SHA256 89479084f420ca55864c957a689971c327209d9c0e7ea4302df947e7cefff8c2
MD5 1860b259b69d1b78e5f82013cb21af20
SHA1 530eaff3d8d54b13b391a954082a9261bc1d0452
SHA512 99b2d3c75d13ff436ac0bd380e770460f6a19162b1246ffc156b3fee7e68b94d393c0fcd6bca8986ac17d71864862b0ee3620a6354ab42046abc7aed42ff3dc2
SSDEEP 24576:vMiKDhl3hB1g8QVNaEUQVdcRZehHDLUVvNrPMJomWa:vJKDhZhk8QVNadodKZeBiPUB
TLSH
T19A259D2A139911A9D8ABD078D6178013E772745423749AEB79BCCA142F17EF2B73EF40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

openvpnserv.exe

Path C:\Program Files\OpenVPN\bin\openvpnserv.exe
Size 64KB
SHA256 4d7ba182e89f2869b650ac80a34b8f347deb360a3872ee9dca130168b32c87fa
MD5 f4bde1658456fca1af425a5ed35843d4
SHA1 0392d4a64fc4110811f54d72ba8669da93eab338
SHA512 37d83474bfbfbde3f333176b0ea0cbc287a41dbe3491e0eab6eecb9643158b53e878d020a83d362fb504218609050171920ade3b048a701259995f87cda37b6c
SSDEEP 1536:mcWMro0WY0uA8EHzz0JZQaav3huc7Lo1gYf:yMdWYTpuzQZQaapuc/o1T
TLSH
T161532941A3E804D8F9B3AB78E9B21113DAB57D152B71C6CF4264C45E0F72BC1E978B62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tapctl.exe

Path C:\Program Files\OpenVPN\bin\tapctl.exe
Size 41KB
SHA256 d5aab270d61d7d1709e85ba81525be5948ae5bf397bb7b12a11e11ba0788ecd1
MD5 bc1fec27a50d102d805f7cdb79272b50
SHA1 562719ef2494b237f5ff164f952b5ea4e23e097d
SHA512 a3c0e3c489775f704bd22ef1f01ee51615ed8ab5abd6f6e13667d117dead7a3c61810e95cfec13d0d994acdaa89312cfb1b2577ae59b2639ede75149115dcb03
SSDEEP 768:uV7EIM5A5/2jrvnihtk591X3hZaZYiLo+Cc+2EsLB:uVQIkjrPihtk591XRZaZ7Lo+ys
TLSH
T189133B016BE90099E573573898B716276A777D512B70C6DF238CC22D0F63B80BE39B66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcruntime140.dll

Path C:\Program Files\OpenVPN\bin\vcruntime140.dll
Size 94KB
SHA256 c51c64dfb7c445ecf0001f69c27e13299ddcfba0780efa72b866a7487b7491c7
MD5 5797d2a762227f35cdd581ec648693a8
SHA1 e587b804db5e95833cbd2229af54c755ee0393b9
SHA512 5c4de4f65c0338f9a63b853db356175cae15c2ddc6b727f473726d69ee0d07545ac64b313c380548211216ea667caf32c5a0fd86f7abe75fc60086822bc4c92e
SSDEEP 1536:yOHL+4KsAzAfadZw+1Hcx8uIYNU5U9H0Q8ecbjt1lLN:yOr/Z+jPYNV9H0Q8ecbjt1j
TLSH
T12F937C4A76A442B7D06BD274C1E34A5AF770B8408B7053CF03B6866A5F63BE05E3E356
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
Size 471B
SHA256 8b6a779474f7fefd0f15b81e3e0b00a8df649e762c0914a837f17190d61ea341
MD5 6f58088bd2ca66cc16b43bcaaca2609c
SHA1 4e6b4395cd3caacf15a97084ffe1eafbc722ea20
SHA512 94741c0814d3c386c75f8942e11ed255eda50afa0a7ed3874b536a3b50ec64b0cdc7a14d7cfd2e5b94ab01b9bdf110919ad8c4a596f8c0a7d313cbc3560ba5c7
TLSH
T1CBF0D40F45B675727905B47428F4DC7B347078CA0581C0736539189543E77B6A25F02A
MD5 SHA1 SHA512 TLSH

Submit Download

8EC9B1D0ABBD7F98B401D425828828CE_27898B4F26C8322E2EB8CCE79E81B433

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_27898B4F26C8322E2EB8CCE79E81B433
Size 727B
SHA256 20c6c5bff00f3fba92cd431bbd8712ef195f79075f017ffdccb64fe873305767
MD5 7100bb3305efc411296be333e4680062
SHA1 998049fadcbba06f94666d3dac8ffbc93f3f4361
SHA512 e010cd75a2bfe780168dd256210f19323a4fb78345101813bc75323a829c90597a046c32f4161992f0f025898ae6d0c97199f432c9a8cd7874f3df85e7c28182
TLSH
T1A201940B4D3CA374B401EC98DDF04A39336962169B4F3CDF34363690B1163420783A18
MD5 SHA1 SHA512 TLSH

Submit Download

C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
Size 727B
SHA256 fd5c4945208e766bd727f9108d4f080d4ede0f28f2f2e41c1d6280f47e8304d1
MD5 586186370eac5fa0c87f59227ef3f5a8
SHA1 1e2f9084ccd9e10728567bc41f20748da973d908
SHA512 7d7988123497d08fb44fa15c82eb36086447ce63c4ccd2cbf38c86d9547222bf8b1ded5a130865d61d8611163cdf1da7d4c1ec8c6ba42c34924a11414c8ccb21
TLSH
T1BC012C5B01B8EC5030261E12EEEC84F2F17FC5A92CDCA68F296B1EC904C8355A203A98
MD5 SHA1 SHA512 TLSH

Submit Download

698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
Size 400B
SHA256 7abd5fe1813fdfbc0d6232430f833e8ad6bc68558d88a5298f224bda2d1c818b
MD5 1ebe691d7d502f35af1b7ae5631b6713
SHA1 46580142a040e87530530c7c7cff309f6b0d74f9
SHA512 0cf5620a007751ff17da6bda7c0b63dd09d68a07cf3d53a46cc6149163c4dc26696a98b0c8d7fdf5f21c223b0203b94a5a6d7bdc5125bcc2bdaddc4e56770dc6
TLSH
T18FE0D83426FA502EF1619B7447E590966F36F107AD5957BE1E82141D991A9005C62C34
MD5 SHA1 SHA512 TLSH

Submit Download

8EC9B1D0ABBD7F98B401D425828828CE_27898B4F26C8322E2EB8CCE79E81B433

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_27898B4F26C8322E2EB8CCE79E81B433
Size 408B
SHA256 a24b819586a6feb6b667fdcef2ccd508c31e2c327a514b03f07ccc4acf08f2ee
MD5 68a3068675033c9de6b0c7da30c56deb
SHA1 b5fa6cee943c2607780ee0f20595209380964747
SHA512 926be9e3636ee2ce954120c0dc9247a9315f83f1cb5260d6dc5a71b7dfb280c7ea42b033fbe9578d77d9a42b2e43e10da56accb6088cd3a6c803f87640dd0582
TLSH
T17BE0263832FA456DF2F5F0B886F5D953186AF2971B45C2BA15805706AF2AB005DE2A20
MD5 SHA1 SHA512 TLSH

Submit Download

C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
Size 412B
SHA256 f2e004392a52d9366e2d99975d95280f822a725374463bb2aa0ce4207c21aac2
MD5 bdc55629bbddb0bfc5f45f6c8cfddeba
SHA1 9f6b1f19613dee896799dff0307b655a3a0fed47
SHA512 68f74a37c1d2b687efaa6650bc4778096ff7bbdb1592e263d0c18108e661da950165aed744a2b5bc2c5e50f4a44d72e67b9c24ff79e1f368f2e8f91c940597bb
TLSH
T191E06F2C2AEBB11EF090E83542FAA07A1E59E2062000A2B81A90030CAB0AE005C20AB0
MD5 SHA1 SHA512 TLSH

Submit Download

MSI59D3.tmp

Path C:\Users\Admin\AppData\Local\Temp\MSI59D3.tmp
Size 209KB
SHA256 8351a40a632facd1f79a1bccfe8e32e88876a23065be1144621533700ecb05ad
MD5 3037e214e0f9b25fc63d4d16f7c4c91d
SHA1 b03dce2090033ca3029526485039b75a5aa4b488
SHA512 437fd240c0af2afaa3a5a1791db4739dff04c7003f25f1bc512797cfffb7fc3e8377656b6eb8714a50b3189c2616b230a619730bc63628d9ab4bc214ce31de90
SSDEEP 3072:l9FCdj6rw5iUeqEetAByXxqr8lyc8t5W6/eb7eUZxfZ/oR:l9FC4wuJeiByXwrtcO6ZVxoR
TLSH
T1C6248E09B7D100B9EDB78638CD678656E673780107609A9F03A08376EF2F7D1A63DB61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSIAF96.tmp

Path C:\Windows\Installer\MSIAF96.tmp
Size 275KB
SHA256 fb1cd5e7c3ea30dfafd3cc1862e311388361d896610db28c63716da9d71e8f3f
MD5 2232c07e354364e0eb1dc80024593826
SHA1 65bb4232c0416cfb2c158bfc32a7732ad72cee72
SHA512 f0d295565b209f4dedd2a79123fa54ff9b8cbb173f14463ab3d3707b8d87aad84b05c2898478ecc148e29d02fa07ddda9499795e0ceafc2982c0adbd570a3572
SSDEEP 3072:A736bBrGsu4ldGrlmxElEmNoPl4+eDhIVJkRZ5Br/NbvcjKX5mMgQSeRocPvuocM:A736UWldGrlmxEDNMea+H5R/B/1lp4x
TLSH
T136548D41B7E404A6EC73C73499A39606FA3278411B70DAEF035082768F6B7D1AA3DB35
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSIAFC6.tmp

Path C:\Windows\Installer\MSIAFC6.tmp
Size 281KB
SHA256 45e855461f5d1be28a2f88416603070bd1778055abdd06834ae58e97b7ddf53c
MD5 718222e232d11298dfbabbc2b70d8b14
SHA1 89fc560692111c2245694867b8772fd8969f46d2
SHA512 9191961c28a7a4647ae8f9f9e1956d60b97f5f5c3e4e838d888bf78c1ea665e98e8e3c75cc1247a68a89b2413493ea6d39dbc60827eec919ddba0536d793c801
SSDEEP 3072:sEcOO6pMedPCy5654WKlfE5qbHsfmYud8d2VCsOLlk1lHgQNvLvPMm88cYzdFOS:OOO6OedPjw58l85/grhSQNDsYz2
TLSH
T111549D45BF9504B6E8BBC1348AA74A82E772740203109A9F33AC97799F2F7D1663D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSIAFE6.tmp

Path C:\Windows\Installer\MSIAFE6.tmp
Size 143KB
SHA256 2738720da0b6ce474ca6eb51a92372d047eca2d713c256f0cd6c147ac3a0db21
MD5 84a1cc9540d5cdad74bc54f8090dd27a
SHA1 c6f82d1491015457785ae0d365e7196d693d9a6b
SHA512 9c25d6e7331844d01d732ac923e99c68f305749d92407c873cd09b451e59a8864001e308864fda319fa4a2bcae9dbe50682201c67901dce14272291dedecd2c8
SSDEEP 3072:+1gnuc/GBdzVQqyIgt8DB7QKPw3hL6nCMfBXqpU:Bnuc/GBdJmIgtesKP+Lh+
TLSH
T154E37E17B7A400BBE5B78235C9635A06E772B81117219F9F03A443766F237D0AD3EB61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e58a97a.msi

Path C:\Windows\Installer\e58a97a.msi
Size 5.5MB
SHA256 19bca902826ef0dc9a6cf849297ce43ba8b2844bdb913c37230308d3274c953c
MD5 1e150b4507fc951c8a23b08b85236cd2
SHA1 3f6980947c16778efb3126193726c038453c85d6
SHA512 2074822532d38e94c131ceb3b4b7a01379ea20b5d6e3fb85a6912a586b8e6f1ff5a4973c200087ccd5ecd17727acef2d5568e6afc9df392da5c1f1978b4cd3a8
SSDEEP 98304:fEnzYKCLSBI0lGIOKv8k7VHTB87GnJ6tEGb7MrisWnB+A/yue/bjBe:z/LS9ZzVV87G2hbWij+xB/Re
TLSH
T128460101B6C10462EC678230C85E925AF2F27C5117A0D66FA2DCBF7CBF3B3A5526A751
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dberr.txt

Path C:\Windows\System32\CatRoot2\dberr.txt
Size 37KB
SHA256 15e40f7ca37577da7c437dc0a397dc5f081db66893ffc22a099ab5fd3fd6bd5e
MD5 6089b8b9f9e1d44cefbaadfadfddf8a4
SHA1 5f98bd5d875956ae6c457302997b06adc235c697
SHA512 7c147e33b8605a6f64af94633f0c8301ed366e71cf543cea86d0cee3b3324883f796099a93d90259cfdfa947a89c2f13769e72170d7437b28172a8700085d9fc
SSDEEP 768:n6e9lze3CCnLtdvoip4G+z0ha2ErzmmYB2ErY:n6e9c3CCnLtdvoip9Bha2ErzmmYB2E0
TLSH
T100035A0865D8C818C5F50966276FDE71C66BE5C6B30B0EE570BCA754E9C2B042EFA09F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dberr.txt

Path C:\Windows\System32\CatRoot2\dberr.txt
Size 37KB
SHA256 392f7fbe3a4b1d6398e9970b6d9326feabeb8d4e29987424e87ba6d6e224880b
MD5 6a0701cb6d33d02bf364124c8251a17b
SHA1 0053df2d05a1a22a03219816f48f1a7134b7ce8e
SHA512 4fcf9a2dd41a057d0d4f8f4887f473bd5279025235b47bca2adeebafba7343368250ac70ecab9abe5e738b5946fc1a1200a3e443d177c7d0e97b3151e8910711
SSDEEP 768:n6e9lze3CCnLtdvoip4G+z0ha2ErzmmYB2Er2:n6e9c3CCnLtdvoip9Bha2ErzmmYB2ES
TLSH
T16C035A0865D8C818C5F50966276FDE71C66BE5C6B30B0EE570BCA754E9C2B042EFA09F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wintun.cat

Path C:\Windows\Temp\9C7DEB~1\wintun.cat
Size 9KB
SHA256 602187e5470ddbdf9421045bb0515f358c88bf88f59fd8a886fb6373da5d0f82
MD5 faba2ccb8fe366fd281ca6be6d2bb7c2
SHA1 bb7bd32a21f3eba652fde24146387ffc5278143e
SHA512 ec424a545e2598f299706499dab07b4d12b0734a52f928216a53bca2b7f384b97bd4fc092d7d68de636a75daf79ac392c4b49b7251ec011236de1659253d6214
SSDEEP 192:6wRp8yDJCKE4uyK6iWPFWQFAnTz36ArNc4qnajr7NCo:L/iWPFRI64lrNt
TLSH
T10522F8E28A5C44C2E993ADB05398F5977C3E7BDB4C20906922ABF7650DD27C5E70843E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wintun.sys

Path C:\Windows\Temp\9C7DEB~1\wintun.sys
Size 37KB
SHA256 eb58bf00df7b4f98334178e75df3348c609ea5c6c74cf7f185f363aa23976c8b
MD5 1945d7d1f56b67ae1cad6ffe13a01985
SHA1 2c1a369f9e12e5c6549439e60dd6c728bf1bffde
SHA512 09af87898528eaa657d46c79b7c4ebc0e415478a421b0b97355294c059878178eb32e172979ee9b7c59126861d51a5831e337a96666c43c96cb1cf8f11bc0a0f
SSDEEP 768:UwtoHKG2ZqGhg+Eqpg0bUORjj71PKgPrbHZIb4:UwtoHt2ZLg+zg5cv7ld7Zy4
TLSH
T1E1037DD2E6A868C2E973CE3151F5E523BD74B2612B20D5EF4511C4350FA3BC1EA7863A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wintun.inf

Path C:\Windows\Temp\9c7debcb65b58afd8b8fce7cc6924e23b62d839d08db0817670de3073e7b78ac\wintun.inf
Size 1KB
SHA256 44098408ab9611dd99a38e140c7fb1ca5dce6eb2d5f0d5e500547ac1ba5d235b
MD5 8480579050970b0812cc3d9a1bce1340
SHA1 edebebd090602f4eee375ad754c8566d4fda23cb
SHA512 46de9202c3cf0ddbf19f9e0e02ec17530f2722abfa08669fd30a6095ce2342fa89a2cc59c1d47afd82b48c915bb95f4c6d16e7c21129a9c8f09c2bf239566933
TLSH
T1933135D954E10D693CD3322E77277F81E65C123041CA200EB6FD8559D64BCDFA654CAA
MD5 SHA1 SHA512 TLSH

Submit Download

tap0901.cat

Path C:\Windows\Temp\DDB992~1\tap0901.cat
Size 11KB
SHA256 ee062e5ef2743ceab10c64830e4cefe52e35cc1ece85947ac4e61ddd1c0b05f7
MD5 71ecece58bb00bdc1e728ee28d7a5332
SHA1 4305889415cf95662a30d024f1138f1af224cf42
SHA512 9b23404d867fc4fd7c7beeba3768e8fed3113cc7430ec1bc9ca7faf6e6105388de7057b1402f9b4ba8fbc11e5fcd3afe14233721e8d15b6c0bed40f65aa5b58b
SSDEEP 192:HxDuDjbfXJCKnEwKUNhYCy1QySaI8HNsAX01k9z3Aqcp9wdGEC:CXaUNh3auatHNsAR9zWZEC
TLSH
T1FF322AA2942C52C3ECABBC7043D4E9977C3E2BCB1950506A269FF7141DA73C8EB1516E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tap0901.sys

Path C:\Windows\Temp\DDB992~1\tap0901.sys
Size 40KB
SHA256 581dcaace05d5c1ac9512457ff50565aca5d904d2c209bd3fc369ca4d4a0d2b1
MD5 1bb9772a05517e227d1dafd3936e8f66
SHA1 d695ca5791a4b6a3509939aebdfaf5e229c6fbcf
SHA512 3f1966038f91b887fe1a71474929bd87f3c75091846c6e9563f7424d3a7c19c908f1d874895341c61a868a616aba637e3d4188d4ebb7383087886a13a4dc0aa2
SSDEEP 768:EGvByM5JLLvslmdu9lsECPURPNkilzdCH3C9zySb:EfM7VE88fkilzdCHOzySb
TLSH
T112038DD16AA814D1E8AA9874C7EBCE43F7B5B1430311AAEF0764D6691F23BD05637328
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OemVista.inf

Path C:\Windows\Temp\ddb99223bbf7772d34ba1abc643e3ca8c6e7d69c2ee71505545678e868834de7\OemVista.inf
Size 7KB
SHA256 1327ab3a8c50691f04bea8e2ca356c5b604092a719e219464f8cc4b42e192de9
MD5 6f5ffb58a9e406ab1643c890e2a198c6
SHA1 3ff1faba00ac18a93e88a6f2bbfa747c9fdc7e0c
SHA512 af29bc13cc02238208c51e4e95dd0a4445a952755635a9eab38aa77a5c087cc8e2025af55d8f3a0e9f2430baa91534e7f892bb71aa0ef72bab4483211a845b4b
SSDEEP 192:wr8tW9yCTi314vlQd22bjR+iAUC7bMP+io3DcNSj6jvKFkPs7EQTXvt1Ld4Z:LWlGBdkkzo3DcNSj6jvKFkPs7EQTXvtk
TLSH
T1F9F150681C83EE3A31FEE58557565EC7E24611823A172800355CFC549BBDD9FE33C92A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2952-522-0x0000000000E30000-0x0000000000E3A000-memory.dmp

Download