19bca902826ef0dc9a6cf849297ce43ba8b2844bdb913c37230308d3274c953c

Analysis

max time kernel
149s
max time network
125s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/06/2026, 12:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
OpenVPN-2.6.14-windows-amd64.msi
Size 5.5MB
Sample260630-pellfaex6m
SHA256 19bca902826ef0dc9a6cf849297ce43ba8b2844bdb913c37230308d3274c953c
MD5 1e150b4507fc951c8a23b08b85236cd2
SHA1 3f6980947c16778efb3126193726c038453c85d6
SHA512 2074822532d38e94c131ceb3b4b7a01379ea20b5d6e3fb85a6912a586b8e6f1ff5a4973c200087ccd5ecd17727acef2d5568e6afc9df392da5c1f1978b4cd3a8
SSDEEP 98304:fEnzYKCLSBI0lGIOKv8k7VHTB87GnJ6tEGb7MrisWnB+A/yue/bjBe:z/LS9ZzVV87G2hbWij+xB/Re
TLSH
T128460101B6C10462EC678230C85E925AF2F27C5117A0D66FA2DCBF7CBF3B3A5526A751
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

persistence privilege_escalation ransomware

Malware Config

Signatures

Boot or Logon Autostart Execution: Active Setup 2 TTPs 6 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Microsoft\Active Setup\Installed Components\>OpenVPN_UserSetup	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\>OpenVPN_UserSetup\ = "OpenVPN 2.6.14-I001 amd64"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\>OpenVPN_UserSetup\Version = "1"	MsiExec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\>OpenVPN_UserSetup\IsInstalled = "1"	MsiExec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\>OpenVPN_UserSetup\DontAsk = "2"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\>OpenVPN_UserSetup\StubPath = "reg add HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run /f /v OPENVPN-GUI /t REG_SZ /d \"C:\\Program Files\\OpenVPN\\bin\\openvpn-gui.exe\""	MsiExec.exe

Drops file in Drivers directory 9 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\SET6269.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\drivers\SET65C5.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\drivers\SET5B26.tmp	DrvInst.exe
File created	C:\Windows\System32\drivers\SET5B26.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\drivers\wintun.sys	DrvInst.exe
File created	C:\Windows\System32\drivers\SET6269.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\drivers\tap0901.sys	DrvInst.exe
File created	C:\Windows\System32\drivers\SET65C5.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\drivers\ovpn-dco.sys	DrvInst.exe

Executes dropped EXE 6 IoCs

pid	Process
3700	openvpn-gui.exe
4260	openvpn.exe
5152	openvpnserv.exe
1232	openvpnserv2.exe
1908	openvpnserv2.exe
5392	openvpn-gui.exe

Loads dropped DLL 21 IoCs

pid	Process
4932	MsiExec.exe
4932	MsiExec.exe
880	MsiExec.exe
880	MsiExec.exe
880	MsiExec.exe
880	MsiExec.exe
4188	MsiExec.exe
4188	MsiExec.exe
4188	MsiExec.exe
4188	MsiExec.exe
4188	MsiExec.exe
4260	openvpn.exe
4260	openvpn.exe
4260	openvpn.exe
4260	openvpn.exe
4260	openvpn.exe
5152	openvpnserv.exe
4188	MsiExec.exe
4188	MsiExec.exe
880	MsiExec.exe
4932	MsiExec.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3865087520-2734723108-1233268525-1000\Software\Microsoft\Windows\CurrentVersion\Run\OpenVPN-GUI = "C:\\Program Files\\OpenVPN\\bin\\openvpn-gui.exe"	msiexec.exe

Badlisted process makes network request 4 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
2	1016	msiexec.exe
3	1016	msiexec.exe
2	1016	msiexec.exe
3	1016	msiexec.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System32\DriverStore\FileRepository\netbc63a.inf_amd64_adc1c27c4a8b0d4f\netbc63a.PNF	MsiExec.exe
File created	C:\Windows\System32\DriverStore\FileRepository\net9500-x64-n650f.inf_amd64_566fa98f770451d2\net9500-x64-n650f.PNF	MsiExec.exe
File created	C:\Windows\System32\DriverStore\FileRepository\ndisimplatformmp.inf_amd64_8f9eb8ff490e6c70\ndisimplatformmp.PNF	MsiExec.exe
File created	C:\Windows\System32\DriverStore\FileRepository\net8187bv64.inf_amd64_4295cf068229eafc\net8187bv64.PNF	MsiExec.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netsstpa.inf_amd64_a982732ea027811e\netsstpa.PNF	MsiExec.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netl1c63x64.inf_amd64_20b3691d6e7445a9\netl1c63x64.PNF	MsiExec.exe
File created	C:\Windows\System32\DriverStore\FileRepository\c_net.inf_amd64_64490bb3b4dcbb9a\c_net.PNF	MsiExec.exe
File created	C:\Windows\System32\DriverStore\FileRepository\oemvista.inf_amd64_ba3e477187f1080b\oemvista.PNF	MsiExec.exe
File created	C:\Windows\System32\DriverStore\FileRepository\ykinx64.inf_amd64_5f83c04f4adb7630\ykinx64.PNF	MsiExec.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netavpna.inf_amd64_27530893ea84631e\netavpna.PNF	MsiExec.exe
File created	C:\Windows\System32\DriverStore\FileRepository\usbncm.inf_amd64_b48ccf297d0cca81\usbncm.PNF	MsiExec.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{40c0c7c8-c1df-2d47-9ee5-ca43e4872559}\SET5220.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\oemvista.inf_amd64_ba3e477187f1080b.ini	DrvInst.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netg664.inf_amd64_f4299f18c1844724\netg664.PNF	MsiExec.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\wintun.inf_amd64_def3401515466414\wintun.inf	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\wintun.inf_amd64_def3401515466414\wintun.cat	DrvInst.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netr28x.inf_amd64_bd4998128e365665\netr28x.PNF	MsiExec.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netrasa.inf_amd64_417ad0eea84e3a58\netrasa.PNF	MsiExec.exe
File created	C:\Windows\System32\DriverStore\FileRepository\kdnic.inf_amd64_a9d04a55194853d2\kdnic.PNF	MsiExec.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netjme.inf_amd64_7d2f6f04d092b277\netjme.PNF	MsiExec.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{fefac904-edc2-6c4f-8c92-ffa83bfdd652}\tap0901.sys	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\ovpn-dco.inf_amd64_b737bb7e846ccda6\ovpn-dco.cat	DrvInst.exe
File created	C:\Windows\System32\DriverStore\FileRepository\ovpn-dco.inf_amd64_b737bb7e846ccda6\ovpn-dco.PNF	MsiExec.exe
File created	C:\Windows\System32\DriverStore\FileRepository\wnetvsc.inf_amd64_3ea8686d80de3706\wnetvsc.PNF	MsiExec.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netwtw02.inf_amd64_669639d5a41714fa\netwtw02.PNF	MsiExec.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\wintun.inf_amd64_def3401515466414.ini	DrvInst.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netvg63a.inf_amd64_dd38edc9e96390ae\netvg63a.PNF	MsiExec.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netwbw02.inf_amd64_d0afc216e2ec6863\netwbw02.PNF	MsiExec.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netmyk64.inf_amd64_2f029cbaae1f9a8c\netmyk64.PNF	MsiExec.exe
File created	C:\Windows\System32\DriverStore\FileRepository\rtwlanu_oldic.inf_amd64_de1bf895eba0afa5\rtwlanu_oldic.PNF	MsiExec.exe
File created	C:\Windows\System32\DriverStore\Temp\{40c0c7c8-c1df-2d47-9ee5-ca43e4872559}\SET51EF.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netrtwlane01.inf_amd64_e88ba65a7546f702\netrtwlane01.PNF	MsiExec.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netl1e64.inf_amd64_616d8a2e59fc462f\netl1e64.PNF	MsiExec.exe
File created	C:\Windows\System32\DriverStore\drvstore.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\oemvista.inf_amd64_ba3e477187f1080b\OemVista.inf	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{ca5709f0-ec00-754a-a78a-5615ae773532}\SET58E6.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\ovpn-dco.inf_amd64_b737bb7e846ccda6\ovpn-dco.sys	DrvInst.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netv1x64.inf_amd64_b0aef9976b305f93\netv1x64.PNF	MsiExec.exe
File created	C:\Windows\System32\DriverStore\FileRepository\rtcx21x64.inf_amd64_feec7a9662e785f0\rtcx21x64.PNF	MsiExec.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{40c0c7c8-c1df-2d47-9ee5-ca43e4872559}\SET51FF.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\drvstore.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{fefac904-edc2-6c4f-8c92-ffa83bfdd652}\OemVista.inf	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{fefac904-edc2-6c4f-8c92-ffa83bfdd652}	DrvInst.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netl160a.inf_amd64_24496b197c188680\netl160a.PNF	MsiExec.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netnvma.inf_amd64_f3a84765144777ee\netnvma.PNF	MsiExec.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mrvlpcie8897.inf_amd64_668551398886eaf3\mrvlpcie8897.PNF	MsiExec.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netrtwlanu.inf_amd64_2814b0012fc3a833\netrtwlanu.PNF	MsiExec.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{40c0c7c8-c1df-2d47-9ee5-ca43e4872559}\wintun.inf	DrvInst.exe
File created	C:\Windows\System32\DriverStore\FileRepository\dc21x4vm.inf_amd64_9512f2b97d63f7fa\dc21x4vm.PNF	MsiExec.exe
File created	C:\Windows\System32\DriverStore\FileRepository\msux64w10.inf_amd64_f329abee714f5000\msux64w10.PNF	MsiExec.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netvwifimp.inf_amd64_16c785b9ba77e7b0\netvwifimp.PNF	MsiExec.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netk57a.inf_amd64_a4804fffb8ffc2e6\netk57a.PNF	MsiExec.exe
File opened for modification	C:\Windows\System32\CatRoot2\dberr.txt	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{fefac904-edc2-6c4f-8c92-ffa83bfdd652}\SET57FC.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netmlx5.inf_amd64_daa0dfc87505ee8d\netmlx5.PNF	MsiExec.exe
File created	C:\Windows\System32\DriverStore\FileRepository\nete1e3e.inf_amd64_71ee3a27d9580084\nete1e3e.PNF	MsiExec.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netax88772.inf_amd64_8cf5f634aa308898\netax88772.PNF	MsiExec.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netvwwanmp.inf_amd64_21a7e1c8368216a0\netvwwanmp.PNF	MsiExec.exe
File created	C:\Windows\System32\DriverStore\FileRepository\net7400-x64-n650.inf_amd64_213b9c153c9b4d01\net7400-x64-n650.PNF	MsiExec.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netmlx4eth63.inf_amd64_59e293fc00a669f4\netmlx4eth63.PNF	MsiExec.exe
File created	C:\Windows\System32\DriverStore\FileRepository\net1ic64.inf_amd64_93678a2d694d4579\net1ic64.PNF	MsiExec.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netwtw04.inf_amd64_28271e5be9a9f6f4\netwtw04.PNF	MsiExec.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netrndis.inf_amd64_7559d510c51e5594\netrndis.PNF	MsiExec.exe
File created	C:\Windows\System32\DriverStore\FileRepository\rtucx21x64.inf_amd64_286645bc82b2f9fb\rtucx21x64.PNF	MsiExec.exe

Drops file in Program Files directory 27 IoCs

description	ioc	Process
File created	C:\Program Files\OpenVPN\bin\openvpn-gui.exe	msiexec.exe
File created	C:\Program Files\OpenVPN\doc\INSTALL-win32.txt	msiexec.exe
File created	C:\Program Files\OpenVPN\license.txt	msiexec.exe
File created	C:\Program Files\OpenVPN\config-auto\README.txt	msiexec.exe
File created	C:\Program Files\OpenVPN\include\tap-windows.h	msiexec.exe
File created	C:\Program Files\OpenVPN\bin\vcruntime140.dll	msiexec.exe
File created	C:\Program Files\OpenVPN\bin\libopenvpn_plap.dll	msiexec.exe
File created	C:\Program Files\OpenVPN\bin\openvpn-plap-uninstall.reg	msiexec.exe
File created	C:\Program Files\OpenVPN\sample-config\client.ovpn	msiexec.exe
File created	C:\Program Files\OpenVPN\config\README.txt	msiexec.exe
File created	C:\Program Files\OpenVPN\ssl\modules\legacy.dll	msiexec.exe
File created	C:\Program Files\OpenVPN\bin\libcrypto-3-x64.dll	msiexec.exe
File created	C:\Program Files\OpenVPN\bin\libpkcs11-helper-1.dll	msiexec.exe
File created	C:\Program Files\OpenVPN\bin\libssl-3-x64.dll	msiexec.exe
File created	C:\Program Files\OpenVPN\bin\openvpn-plap-install.reg	msiexec.exe
File created	C:\Program Files\OpenVPN\log\README.txt	msiexec.exe
File created	C:\Program Files\OpenVPN\doc\openvpn.8.html	msiexec.exe
File created	C:\Program Files\OpenVPN\bin\openvpnserv.exe	msiexec.exe
File created	C:\Program Files\Common Files\ovpn-dco\Win11\ovpn-dco.cat	msiexec.exe
File created	C:\Program Files\Common Files\ovpn-dco\Win11\ovpn-dco.sys	msiexec.exe
File created	C:\Program Files\OpenVPN\res\ovpn.ico	msiexec.exe
File created	C:\Program Files\OpenVPN\sample-config\server.ovpn	msiexec.exe
File created	C:\Program Files\OpenVPN\bin\openvpn.exe	msiexec.exe
File created	C:\Program Files\OpenVPN\bin\openvpnserv2.exe	msiexec.exe
File created	C:\Program Files\Common Files\ovpn-dco\Win11\ovpn-dco.inf	msiexec.exe
File created	C:\Program Files\OpenVPN\bin\tapctl.exe	msiexec.exe
File created	C:\Program Files\OpenVPN\bin\openvpn-plap-install-new.reg	MsiExec.exe

Drops file in Windows directory 41 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\e593aec.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI46E7.tmp	msiexec.exe
File opened for modification	C:\Windows\inf\oem3.inf	DrvInst.exe
File created	C:\Windows\Installer\{CD1DCDF3-BCAC-4233-A1CC-5DAFEE1E604E}\tapctl_create.ico	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI4830.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI494A.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\{CD1DCDF3-BCAC-4233-A1CC-5DAFEE1E604E}\tapctl_create.ico	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File created	C:\Windows\Installer\e593aee.msi	msiexec.exe
File created	C:\Windows\SystemTemp\~DF1312977086A58CE0.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\SourceHash{CD1DCDF3-BCAC-4233-A1CC-5DAFEE1E604E}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI44A1.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI533E.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DF3832521A8C59C3EA.TMP	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File opened for modification	C:\Windows\inf\oem1.inf	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File opened for modification	C:\Windows\Installer\MSI70DB.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI71A8.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI589E.tmp	msiexec.exe
File created	C:\Windows\Installer\{CD1DCDF3-BCAC-4233-A1CC-5DAFEE1E604E}\openvpn.ico	msiexec.exe
File created	C:\Windows\Installer\e593aec.msi	msiexec.exe
File created	C:\Windows\SystemTemp\~DFCE62E5E4AB4D2375.TMP	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	MsiExec.exe
File opened for modification	C:\Windows\inf\oem2.inf	DrvInst.exe
File created	C:\Windows\inf\oem3.inf	DrvInst.exe
File opened for modification	C:\Windows\Installer\MSI7149.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI3EF3.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI4668.tmp	msiexec.exe
File created	C:\Windows\inf\oem1.inf	DrvInst.exe
File opened for modification	C:\Windows\Installer\{CD1DCDF3-BCAC-4233-A1CC-5DAFEE1E604E}\openvpn.ico	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File opened for modification	C:\Windows\Installer\MSI4697.tmp	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File created	C:\Windows\inf\oem2.inf	DrvInst.exe
File opened for modification	C:\Windows\Installer\MSI5A45.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DFC1F9BF0BF98A2B0D.TMP	msiexec.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2044	sc.exe
5384	sc.exe

Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs

persistence privilege_escalation

Installer Packages

T1546.016

Msiexec

T1218.007

pid	Process
1016	msiexec.exe

Event Triggered Execution: Netsh Helper DLL 1 TTPs 9 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Filters	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Filters	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\UpperFilters	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	MsiExec.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Filters	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	MsiExec.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	MsiExec.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\LowerFilters	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\LowerFilters	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\LowerFilters	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\UpperFilters	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Filters	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Phantom	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID	MsiExec.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Service	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	MsiExec.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Filters	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Service	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Service	DrvInst.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000defd50087e4d8ef30000000000000000000000000000000000000000000000000000000000000000000000000000000000001071020000000000c0120000000000000000000000002701010000883801defd50080000000000001071020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d0830200000000006025c501000000000000000000000700010000e84101defd5008000000000000d08302000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9c701000000000000050000000000000000000000070001000098d4e3defd500800000000000030a9c7010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9cc0100000000000005000000000000000000000007000100009854e6defd500800000000000030a9cc01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Phantom	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Filters	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\UpperFilters	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs	MsiExec.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Service	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\LowerFilters	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\CompatibleIDs	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	DrvInst.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	DrvInst.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Service	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Filters	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom	MsiExec.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\CompatibleIDs	MsiExec.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\UpperFilters	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\LowerFilters	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\LowerFilters	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	DrvInst.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows Script\Settings\Telemetry\msiexec.exe\JScript9LegacySetScriptStateStarted = "240736593"	MsiExec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows Script\Settings\Telemetry\msiexec.exe	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows Script\Settings\Telemetry	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	DrvInst.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\RAS AutoDial\Default	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	MsiExec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows Script\Settings	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	DrvInst.exe

Modifies registry class 57 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\OpenVPNFile\shell\import\ = "Import into OpenVPN-GUI"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\OpenVPNFile	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\OpenVPNFile\shell\import	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\OpenVPNFile\DefaultIcon\ = "C:\\Program Files\\OpenVPN\\res\\ovpn.ico,0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\OpenVPNFile\shell\import\command\ = "\"C:\\Program Files\\OpenVPN\\bin\\openvpn-gui.exe\" --command import \"%1\""	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\3FDCD1DCCACB33241ACCD5FAEEE106E4\Drivers.OvpnDco = "Drivers"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3FDCD1DCCACB33241ACCD5FAEEE106E4\SourceList\Media\1 = ";"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\3FDCD1DCCACB33241ACCD5FAEEE106E4\OpenVPN.GUI = "OpenVPN"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3FDCD1DCCACB33241ACCD5FAEEE106E4\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3FDCD1DCCACB33241ACCD5FAEEE106E4\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3FDCD1DCCACB33241ACCD5FAEEE106E4\Version = "33949049"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3FDCD1DCCACB33241ACCD5FAEEE106E4\AdvertiseFlags = "388"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3FDCD1DCCACB33241ACCD5FAEEE106E4\Clients = 3a0000000000	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\OpenVPNFile\shell	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\OpenVPNFile\shell\open\command	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3FDCD1DCCACB33241ACCD5FAEEE106E4\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3FDCD1DCCACB33241ACCD5FAEEE106E4\AuthorizedLUAApp = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\68FDB164983D1744FB639908B6461C72	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\OpenVPNFile\shell	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\3FDCD1DCCACB33241ACCD5FAEEE106E4\OpenVPN.Service = "OpenVPN"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\3FDCD1DCCACB33241ACCD5FAEEE106E4\Drivers	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\3FDCD1DCCACB33241ACCD5FAEEE106E4\Drivers.Wintun = "Drivers"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\3FDCD1DCCACB33241ACCD5FAEEE106E4\EasyRSA = "\x06OpenSSL"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3FDCD1DCCACB33241ACCD5FAEEE106E4	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\.ovpn	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\OpenVPNFile\DefaultIcon	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\OpenVPNFile\shell\import\command	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3FDCD1DCCACB33241ACCD5FAEEE106E4\Assignment = "1"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3FDCD1DCCACB33241ACCD5FAEEE106E4\PackageCode = "22912DF0EEBE3A3498FA548D65979F16"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\3FDCD1DCCACB33241ACCD5FAEEE106E4\OpenVPN.PLAP.Register = "\x06OpenVPN.Service"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3FDCD1DCCACB33241ACCD5FAEEE106E4\Language = "1033"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\OpenVPNFile\shell\open\command	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\3FDCD1DCCACB33241ACCD5FAEEE106E4\OpenVPN	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3FDCD1DCCACB33241ACCD5FAEEE106E4\ProductIcon = "C:\\Windows\\Installer\\{CD1DCDF3-BCAC-4233-A1CC-5DAFEE1E604E}\\openvpn.ico"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3FDCD1DCCACB33241ACCD5FAEEE106E4\SourceList\PackageName = "OpenVPN-2.6.14-windows-amd64.msi"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\3FDCD1DCCACB33241ACCD5FAEEE106E4\OpenVPN.SampleCfg = "OpenVPN"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\OpenVPNFile\shell\run\ = "Start OpenVPN on this config file"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\3FDCD1DCCACB33241ACCD5FAEEE106E4	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\OpenVPNFile\ = "OpenVPN Config File"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\3FDCD1DCCACB33241ACCD5FAEEE106E4\Drivers.TAPWindows6 = "Drivers"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\3FDCD1DCCACB33241ACCD5FAEEE106E4\OpenSSL = "\x06"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3FDCD1DCCACB33241ACCD5FAEEE106E4\InstanceType = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3FDCD1DCCACB33241ACCD5FAEEE106E4\SourceList\Net	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3FDCD1DCCACB33241ACCD5FAEEE106E4\SourceList\Media	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\OpenVPNFile\shell\open	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\OpenVPNFile\shell\run\command	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\OpenVPNFile\shell\run\command\ = "\"C:\\Program Files\\OpenVPN\\bin\\openvpn.exe\" --pause-exit --config \"%1\""	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3FDCD1DCCACB33241ACCD5FAEEE106E4\DeploymentFlags = "3"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\68FDB164983D1744FB639908B6461C72\3FDCD1DCCACB33241ACCD5FAEEE106E4	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.ovpn\ = "OpenVPNFile"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\OpenVPNFile\shell\ = "import"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3FDCD1DCCACB33241ACCD5FAEEE106E4\ProductName = "OpenVPN 2.6.14-I001 amd64"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\OpenVPNFile	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\3FDCD1DCCACB33241ACCD5FAEEE106E4\OpenVPN.Documentation = "OpenVPN"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\3FDCD1DCCACB33241ACCD5FAEEE106E4\OpenVPN.GUI.OnLogon = "OpenVPN.GUI"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\OpenVPNFile\shell\open\command\ = "\"notepad.exe\" \"%1\""	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\OpenVPNFile\shell\run	msiexec.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5596	msiexec.exe
5596	msiexec.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid
4

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1016	msiexec.exe
Token: SeIncreaseQuotaPrivilege	1016	msiexec.exe
Token: SeSecurityPrivilege	5596	msiexec.exe
Token: SeCreateTokenPrivilege	1016	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	1016	msiexec.exe
Token: SeLockMemoryPrivilege	1016	msiexec.exe
Token: SeIncreaseQuotaPrivilege	1016	msiexec.exe
Token: SeMachineAccountPrivilege	1016	msiexec.exe
Token: SeTcbPrivilege	1016	msiexec.exe
Token: SeSecurityPrivilege	1016	msiexec.exe
Token: SeTakeOwnershipPrivilege	1016	msiexec.exe
Token: SeLoadDriverPrivilege	1016	msiexec.exe
Token: SeSystemProfilePrivilege	1016	msiexec.exe
Token: SeSystemtimePrivilege	1016	msiexec.exe
Token: SeProfSingleProcessPrivilege	1016	msiexec.exe
Token: SeIncBasePriorityPrivilege	1016	msiexec.exe
Token: SeCreatePagefilePrivilege	1016	msiexec.exe
Token: SeCreatePermanentPrivilege	1016	msiexec.exe
Token: SeBackupPrivilege	1016	msiexec.exe
Token: SeRestorePrivilege	1016	msiexec.exe
Token: SeShutdownPrivilege	1016	msiexec.exe
Token: SeDebugPrivilege	1016	msiexec.exe
Token: SeAuditPrivilege	1016	msiexec.exe
Token: SeSystemEnvironmentPrivilege	1016	msiexec.exe
Token: SeChangeNotifyPrivilege	1016	msiexec.exe
Token: SeRemoteShutdownPrivilege	1016	msiexec.exe
Token: SeUndockPrivilege	1016	msiexec.exe
Token: SeSyncAgentPrivilege	1016	msiexec.exe
Token: SeEnableDelegationPrivilege	1016	msiexec.exe
Token: SeManageVolumePrivilege	1016	msiexec.exe
Token: SeImpersonatePrivilege	1016	msiexec.exe
Token: SeCreateGlobalPrivilege	1016	msiexec.exe
Token: SeCreateTokenPrivilege	1016	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	1016	msiexec.exe
Token: SeLockMemoryPrivilege	1016	msiexec.exe
Token: SeIncreaseQuotaPrivilege	1016	msiexec.exe
Token: SeMachineAccountPrivilege	1016	msiexec.exe
Token: SeTcbPrivilege	1016	msiexec.exe
Token: SeSecurityPrivilege	1016	msiexec.exe
Token: SeTakeOwnershipPrivilege	1016	msiexec.exe
Token: SeLoadDriverPrivilege	1016	msiexec.exe
Token: SeSystemProfilePrivilege	1016	msiexec.exe
Token: SeSystemtimePrivilege	1016	msiexec.exe
Token: SeProfSingleProcessPrivilege	1016	msiexec.exe
Token: SeIncBasePriorityPrivilege	1016	msiexec.exe
Token: SeCreatePagefilePrivilege	1016	msiexec.exe
Token: SeCreatePermanentPrivilege	1016	msiexec.exe
Token: SeBackupPrivilege	1016	msiexec.exe
Token: SeRestorePrivilege	1016	msiexec.exe
Token: SeShutdownPrivilege	1016	msiexec.exe
Token: SeDebugPrivilege	1016	msiexec.exe
Token: SeAuditPrivilege	1016	msiexec.exe
Token: SeSystemEnvironmentPrivilege	1016	msiexec.exe
Token: SeChangeNotifyPrivilege	1016	msiexec.exe
Token: SeRemoteShutdownPrivilege	1016	msiexec.exe
Token: SeUndockPrivilege	1016	msiexec.exe
Token: SeSyncAgentPrivilege	1016	msiexec.exe
Token: SeEnableDelegationPrivilege	1016	msiexec.exe
Token: SeManageVolumePrivilege	1016	msiexec.exe
Token: SeImpersonatePrivilege	1016	msiexec.exe
Token: SeCreateGlobalPrivilege	1016	msiexec.exe
Token: SeCreateTokenPrivilege	1016	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	1016	msiexec.exe
Token: SeLockMemoryPrivilege	1016	msiexec.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
1016	msiexec.exe
1016	msiexec.exe
3700	openvpn-gui.exe
3700	openvpn-gui.exe

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
3700	openvpn-gui.exe
3700	openvpn-gui.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
1016	msiexec.exe
5596	msiexec.exe
4932	MsiExec.exe
880	MsiExec.exe
4188	MsiExec.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 5596 wrote to memory of 4932	5596	msiexec.exe	89
PID 5596 wrote to memory of 3952	5596	msiexec.exe	94
PID 5596 wrote to memory of 880	5596	msiexec.exe	96
PID 5596 wrote to memory of 4188	5596	msiexec.exe	98
PID 3700 wrote to memory of 4260	3700	openvpn-gui.exe	106
PID 4188 wrote to memory of 460	4188	MsiExec.exe	109
PID 4188 wrote to memory of 2732	4188	MsiExec.exe	115
PID 4188 wrote to memory of 2864	4188	MsiExec.exe	118
PID 4188 wrote to memory of 5384	4188	MsiExec.exe	125
PID 4188 wrote to memory of 2044	4188	MsiExec.exe	127
PID 4932 wrote to memory of 5392	4932	MsiExec.exe	130

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\OpenVPN-2.6.14-windows-amd64.msi
1⤵
- Badlisted process makes network request
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:1016

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Adds Run key to start application
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5596
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding 98CA3174F0A2200872B102C3740E2F8D C
  2⤵
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4932
- - C:\Program Files\OpenVPN\bin\openvpn-gui.exe
    "C:\Program Files\OpenVPN\bin\openvpn-gui.exe"
    3⤵
    - Executes dropped EXE
    PID:5392
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:3952
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding 988C2446A64259EE3E5B9A45A52B5DA7
  2⤵
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  PID:880
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding 4F1F74AD1A6AAE8FA0454AF345455DE6 E Global\MSI0000
  2⤵
  - Boot or Logon Autostart Execution: Active Setup
  - Loads dropped DLL
  - Drops file in System32 directory
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - Checks SCSI registry key(s)
  - Modifies data under HKEY_USERS
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4188
- - C:\Windows\System32\netsh.exe
    netsh interface set interface name="Local Area Connection" newname="OpenVPN Wintun"
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:460
- - C:\Windows\System32\netsh.exe
    netsh interface set interface name="Local Area Connection" newname="OpenVPN TAP-Windows6"
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:2732
- - C:\Windows\System32\netsh.exe
    netsh interface set interface name="Local Area Connection" newname="OpenVPN Data Channel Offload"
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:2864
- - C:\Windows\System32\sc.exe
    "C:\Windows\System32\sc.exe" config OpenVPNService start= auto
    3⤵
    - Launches sc.exe
    PID:5384
- - C:\Windows\System32\sc.exe
    "C:\Windows\System32\sc.exe" start OpenVPNService
    3⤵
    - Launches sc.exe
    PID:2044

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
PID:1592

C:\Windows\system32\DrvInst.exe
DrvInst.exe "4" "1" "C:\Windows\Temp\cbc511e0106089c84b9fe8da68dfff5cfa4e9006b4c745e0ea77722e919b2c58\wintun.inf" "9" "4ae3e7123" "0000000000000130" "WinSta0\Default" "0000000000000170" "208" "C:\Windows\Temp\cbc511e0106089c84b9fe8da68dfff5cfa4e9006b4c745e0ea77722e919b2c58"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
PID:4764

C:\Windows\system32\DrvInst.exe
DrvInst.exe "4" "1" "C:\Windows\Temp\e162d15a639f9b4893c4f21d0103cd7bcde43bd69ac5539f37f4e6c566a16f3d\OemVista.inf" "9" "4dca1f60f" "0000000000000170" "WinSta0\Default" "0000000000000178" "208" "C:\Windows\Temp\e162d15a639f9b4893c4f21d0103cd7bcde43bd69ac5539f37f4e6c566a16f3d"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
PID:5368

C:\Windows\system32\DrvInst.exe
DrvInst.exe "4" "1" "C:\Program Files\Common Files\ovpn-dco\Win11\ovpn-dco.inf" "9" "4e746adf3" "0000000000000190" "WinSta0\Default" "0000000000000194" "208" "C:\Program Files\Common Files\ovpn-dco\Win11"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
PID:4848

C:\Program Files\OpenVPN\bin\openvpn-gui.exe
"C:\Program Files\OpenVPN\bin\openvpn-gui.exe"
1⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3700
- C:\Program Files\OpenVPN\bin\openvpn.exe
  openvpn --version
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:4260

C:\Windows\system32\DrvInst.exe
DrvInst.exe "2" "11" "ROOT\NET\0000" "C:\Windows\System32\DriverStore\FileRepository\wintun.inf_amd64_def3401515466414\wintun.inf" "oem1.inf:9ef34515d755ec66:Wintun.Install:0.8.0.0:wintun," "42b53aaff" "0000000000000178" "67a"
1⤵
- Drops file in Drivers directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
PID:2740

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s Netman
1⤵
- Modifies data under HKEY_USERS
PID:1656

C:\Windows\system32\DrvInst.exe
DrvInst.exe "2" "11" "ROOT\NET\0001" "C:\Windows\System32\DriverStore\FileRepository\oemvista.inf_amd64_ba3e477187f1080b\oemvista.inf" "oem2.inf:3beb73aff103cc24:tap0901.ndi:9.27.0.0:root\tap0901," "433338203" "000000000000016C" "67a"
1⤵
- Drops file in Drivers directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
PID:2360

C:\Windows\system32\DrvInst.exe
DrvInst.exe "2" "11" "ROOT\NET\0002" "C:\Windows\System32\DriverStore\FileRepository\ovpn-dco.inf_amd64_b737bb7e846ccda6\ovpn-dco.inf" "oem3.inf:c695c3de07ba2b5d:ovpn-dco_Device:1.2.1.0:ovpn-dco," "43b135903" "0000000000000170" "67a"
1⤵
- Drops file in Drivers directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
PID:1276

C:\Program Files\OpenVPN\bin\openvpnserv.exe
"C:\Program Files\OpenVPN\bin\openvpnserv.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:5152

C:\Program Files\OpenVPN\bin\openvpnserv2.exe
"C:\Program Files\OpenVPN\bin\openvpnserv2.exe"
1⤵
- Executes dropped EXE
PID:1232

C:\Program Files\OpenVPN\bin\openvpnserv2.exe
"C:\Program Files\OpenVPN\bin\openvpnserv2.exe"
1⤵
- Executes dropped EXE
PID:1908

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Installer Packages

T1546.016

Netsh Helper DLL

T1546.007

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Installer Packages

T1546.016

Netsh Helper DLL

T1546.007

Defense Evasion

Modify Registry

T1112

System Binary Proxy Execution

T1218

Msiexec

T1218.007

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e593aed.rbs

Path C:\Config.Msi\e593aed.rbs
Size 876KB
SHA256 578d18035397f6739f8c3769110f5b476678d8c541002ebe76e8c14ff85890f8
MD5 28404d4cb5a98ccd5589ee5a50c55d28
SHA1 f3dc553071cbad9dcb30e89326c5084e1854db95
SHA512 4172f35ec7f80e7856ef7614691adf75e96ad95e0216f240008c47e38b1b459a192073dd91374eade978853fe497bc5fbec78aecaaf82eda3eeedbcc2e38b82b
SSDEEP 24576:aC4LJNBjSblC4LJNBjSb/C4LJNBjSb9C4LJNBjSbH:ivB+JvB+rvB+BvB+j
TLSH
T115157D05B7D000F9EDB7863889674616E773780107749A9F03A4837AEF2F7D1A639B62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ovpn-dco.cat

Path C:\PROGRA~1\COMMON~1\ovpn-dco\Win11\ovpn-dco.cat
Size 11KB
SHA256 8c9456aeacd5566234519b5b34ceecd0f7ebb22f6813747e595f5945517ec438
MD5 8fd89f82a273cd3ed2f76f7f09cf30ae
SHA1 43bb4e81acac468715e874ab86521497ca2e9369
SHA512 f77ad5dca3f72701ab2b779e900d22fa3f0c3ca6b8713e25bb7d6d1480992518d66879b6315122c555b32be527fef7c86ead1d59244c955287d48c3132b684f0
SSDEEP 192:FXasYRLFJCtNRnnXBEwZIhYCpMKIjwX01k9z3AmFX:FS2NdRIh3jHR9zlV
TLSH
T199322BA796280082DD97BD6042D8E897BC3E3BCB1C11556A22AFFA540DD33D8FB1416F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ovpn-dco.sys

Path C:\PROGRA~1\COMMON~1\ovpn-dco\Win11\ovpn-dco.sys
Size 90KB
SHA256 2c2958dac6f36922ae094705e058bf6470e1622b31318fb9fe0db5457e383f45
MD5 6b0722f0b6ed86877d96da4a57f3aa03
SHA1 85cd52a10a8be6ca807fb5f6e180a1b1a1554583
SHA512 74c399af44e982bb02eeb103bc634d2b5923b5623625a87bd148b6dad1afc438775a00ecbcdeeb2adb13d04c3b1d23a92cd9ee815c89f1af4fdbb3eb8fc3f49b
SSDEEP 1536:uDK30YojzlMIQLPZkecHuvaSsYU2ug/0A0gA1j7ajE/T2yR1O8Jz4:u2x5pTZUHuvat2ug/0A0Px2yTOw0
TLSH
T1CE93F875A6E010D4F47B96F886B68A05BFB17A922F32D6DF0410856D0F32BC8CE39755
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ovpn-dco.inf

Path C:\Program Files\Common Files\ovpn-dco\Win11\ovpn-dco.inf
Size 2KB
SHA256 1f6c35bc11d910f91c32ea54894d0fddb0094876bdd526d04a9287d04d636242
MD5 77da079a3665afc84d05c3d07bcaa0d0
SHA1 3fbfafe2c08100f5b46b792398c2ecb9157760e9
SHA512 10fcd8464c6aab386bf2f675175598764e0b784a898b7b450fef3d055ecf902c7a57ac0aef2725b9e6899146e4e9230c8677bfd2a8f18489b642fa6beca25507
TLSH
T19441F14A52C20FBD3B432D7596077BA2B9D6910050C8151AF18CDA468B8FF99B31B7EA
MD5 SHA1 SHA512 TLSH

Submit Download

libcrypto-3-x64.dll

Path C:\Program Files\OpenVPN\bin\libcrypto-3-x64.dll
Size 4.6MB
SHA256 71270ed463648bcbe45829cbc0ce3827faf3267e46d530ae0a82d9bc0c619ec0
MD5 5984ea63df1671b1d174d4d957a7b483
SHA1 3691290a86290533537593654db9e11b2bd15fac
SHA512 04f087a1bce16c811eb6a4be318dc5846e5553f3b0d50318aa335bc46a262cfe177479ea06b637aa6934df1ae4a998e7b764df17d2efba0ef80ef302c05c57a2
SSDEEP 98304:9gGN3UNaucJAWjXHJPx+s1CPwDvt3uF0nCc:6GN3UZcJAWjXpph1CPwDvt3uF0nCc
TLSH
T18E268C69A6BC0096D86A95BCC2D76227D371B41257F057CF2E284AF90F23FD426BB740
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libpkcs11-helper-1.dll

Path C:\Program Files\OpenVPN\bin\libpkcs11-helper-1.dll
Size 111KB
SHA256 e2500ded6e44090f0c76528903269938a029bee206fde25adac040d6e3a124f7
MD5 e5353f2c01b77b433ea518923b1b8dbd
SHA1 fad48fbf2d115b5426b40fd52d51a8729a976462
SHA512 b81ae3412a4312e0f499860586d866d47f41647441f5875e645ffa74f83aa2ef1569b5df6535ab347a89fd3b6bb6bc69558bca65336674f0459eeda167efeb34
SSDEEP 1536:Usfoicdz0Suh6YcYwnIrHL6PS7ySVfPrZm8KAd0uM82FjE25YiL3nyj7LoNA:qdzA3ynIrHLye1VfPrZqE25RL3nyj/ou
TLSH
T1F5B30902BD846870D49AD33DEC62022BA3767890137657DF476260E92F93F96AD39F43
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libssl-3-x64.dll

Path C:\Program Files\OpenVPN\bin\libssl-3-x64.dll
Size 818KB
SHA256 c681893dd0c9f86e7f405792dec32adab33cb899cbd3b2ddda533e28f577ab6d
MD5 10d4982726da7c122404f6d6f9bcd793
SHA1 4e6861066218f0909b8ae851fbfe9ebe0b894e46
SHA512 a7e3ce35d60ffba3072211e600bd91e4f0419673ad64471b6b94a537e4c908a02b6fee673ea55e95c22a2b4a2dcc967f56aba0ffb99a95a8875c9b4bda37e668
SSDEEP 12288:OXxxYXIy6weQqYjq2NIUuXWGfcFTdsFgIMPA3AK8t72tJAh1z/VhEi:OXkIrjY+E4bWUgIMPA5S7KJAh1znt
TLSH
T12B053A69BBB8009DD876C13986938613E6F6B4563370EBDB0B648A7A0F637D4273D344
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

openvpn-gui.exe

Path C:\Program Files\OpenVPN\bin\openvpn-gui.exe
Size 1.1MB
SHA256 1f07550f3decbfd7c8737694001ee13c26de84ef498dc493d313a79db2080646
MD5 75d5db58796acffda38dd0139a9aa15a
SHA1 f1eeab1b9967f0ba54f12f6ead70a0ce85f597e2
SHA512 d987ded834671be0894f5953a800947280b012288a2ec44fdcc7fc42dd08e70577ddd6f4c22118e18ebbf0fdca0c5054e8c11bbd3b104bd7c7f8b8f9056999bd
SSDEEP 12288:wtlBCAQ/WWOn+wP/nQStD6Fo+41GqKqx8xmwApbn:wO/LOnBHQS4Fo+yGqKtobn
TLSH
T129457001B3F98118F5F3AB349DBA46526E3BBC815E34CA8E5295755E0A72B90DD30B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

openvpn-plap-install.reg

Path C:\Program Files\OpenVPN\bin\openvpn-plap-install.reg
Size 454B
SHA256 18b542b3de918da103ea6d79f3be0c5af8349502dc9c673f2db5b6f05dc57d35
MD5 2b7d47401bad3221ed6d92996d49f9f7
SHA1 a3b8cbc667f5023e4a4dd8c50bc6ab78c51048de
SHA512 dceafceeff05a61fde179dbdf13bc2b1243ee756028b1c8a96e311f279effbd9e2567f65f8ae063841ca2c4961f6b522553b9c7095daa94898ff5ed048607aa5
TLSH
T151F0DCF2CE079202DA91122D291606F147B64569758E0B92F181A3A86DFECE343FC08B
MD5 SHA1 SHA512 TLSH

Submit Download

openvpn.exe

Path C:\Program Files\OpenVPN\bin\openvpn.exe
Size 1019KB
SHA256 89479084f420ca55864c957a689971c327209d9c0e7ea4302df947e7cefff8c2
MD5 1860b259b69d1b78e5f82013cb21af20
SHA1 530eaff3d8d54b13b391a954082a9261bc1d0452
SHA512 99b2d3c75d13ff436ac0bd380e770460f6a19162b1246ffc156b3fee7e68b94d393c0fcd6bca8986ac17d71864862b0ee3620a6354ab42046abc7aed42ff3dc2
SSDEEP 24576:vMiKDhl3hB1g8QVNaEUQVdcRZehHDLUVvNrPMJomWa:vJKDhZhk8QVNadodKZeBiPUB
TLSH
T19A259D2A139911A9D8ABD078D6178013E772745423749AEB79BCCA142F17EF2B73EF40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

openvpnserv.exe

Path C:\Program Files\OpenVPN\bin\openvpnserv.exe
Size 64KB
SHA256 4d7ba182e89f2869b650ac80a34b8f347deb360a3872ee9dca130168b32c87fa
MD5 f4bde1658456fca1af425a5ed35843d4
SHA1 0392d4a64fc4110811f54d72ba8669da93eab338
SHA512 37d83474bfbfbde3f333176b0ea0cbc287a41dbe3491e0eab6eecb9643158b53e878d020a83d362fb504218609050171920ade3b048a701259995f87cda37b6c
SSDEEP 1536:mcWMro0WY0uA8EHzz0JZQaav3huc7Lo1gYf:yMdWYTpuzQZQaapuc/o1T
TLSH
T161532941A3E804D8F9B3AB78E9B21113DAB57D152B71C6CF4264C45E0F72BC1E978B62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

openvpnserv2.exe

Path C:\Program Files\OpenVPN\bin\openvpnserv2.exe
Size 23KB
SHA256 d1e995a2d32e7833a369aa849e8b877162e07c1a161c6dccb95ca2052fc8b1e7
MD5 bc71317e0308cdbb60c144de84ab3c68
SHA1 01f4d0d5c856f9f283d93c7c909088e862679ec3
SHA512 17f2333020eb2375f79a4bcb4884662fba8129ada9de24e6d2ca51c623f0de16e6e7e5ba60a119b13474d6627b1807b466f886a414c120c5d0d85d7f71427ded
SSDEEP 384:eFwIAToAejw/JWjFTbeCY8++typ+MfznI/p0akvDGXPLon2e:it/jxbeW5nInI/nqDGcp
TLSH
T195B25B41A7E49237EAFF0F78B971962107B1BF800922D1DF4DE9A0C92EC2B411A5137B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tapctl.exe

Path C:\Program Files\OpenVPN\bin\tapctl.exe
Size 41KB
SHA256 d5aab270d61d7d1709e85ba81525be5948ae5bf397bb7b12a11e11ba0788ecd1
MD5 bc1fec27a50d102d805f7cdb79272b50
SHA1 562719ef2494b237f5ff164f952b5ea4e23e097d
SHA512 a3c0e3c489775f704bd22ef1f01ee51615ed8ab5abd6f6e13667d117dead7a3c61810e95cfec13d0d994acdaa89312cfb1b2577ae59b2639ede75149115dcb03
SSDEEP 768:uV7EIM5A5/2jrvnihtk591X3hZaZYiLo+Cc+2EsLB:uVQIkjrPihtk591XRZaZ7Lo+ys
TLSH
T189133B016BE90099E573573898B716276A777D512B70C6DF238CC22D0F63B80BE39B66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcruntime140.dll

Path C:\Program Files\OpenVPN\bin\vcruntime140.dll
Size 94KB
SHA256 c51c64dfb7c445ecf0001f69c27e13299ddcfba0780efa72b866a7487b7491c7
MD5 5797d2a762227f35cdd581ec648693a8
SHA1 e587b804db5e95833cbd2229af54c755ee0393b9
SHA512 5c4de4f65c0338f9a63b853db356175cae15c2ddc6b727f473726d69ee0d07545ac64b313c380548211216ea667caf32c5a0fd86f7abe75fc60086822bc4c92e
SSDEEP 1536:yOHL+4KsAzAfadZw+1Hcx8uIYNU5U9H0Q8ecbjt1lLN:yOr/Z+jPYNV9H0Q8ecbjt1j
TLSH
T12F937C4A76A442B7D06BD274C1E34A5AF770B8408B7053CF03B6866A5F63BE05E3E356
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8EC9B1D0ABBD7F98B401D425828828CE_27898B4F26C8322E2EB8CCE79E81B433

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_27898B4F26C8322E2EB8CCE79E81B433
Size 727B
SHA256 20c6c5bff00f3fba92cd431bbd8712ef195f79075f017ffdccb64fe873305767
MD5 7100bb3305efc411296be333e4680062
SHA1 998049fadcbba06f94666d3dac8ffbc93f3f4361
SHA512 e010cd75a2bfe780168dd256210f19323a4fb78345101813bc75323a829c90597a046c32f4161992f0f025898ae6d0c97199f432c9a8cd7874f3df85e7c28182
TLSH
T1A201940B4D3CA374B401EC98DDF04A39336962169B4F3CDF34363690B1163420783A18
MD5 SHA1 SHA512 TLSH

Submit Download

8EC9B1D0ABBD7F98B401D425828828CE_27898B4F26C8322E2EB8CCE79E81B433

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_27898B4F26C8322E2EB8CCE79E81B433
Size 408B
SHA256 1e2f24dd18c57854b5a93a08314dab6ab1e0b3bf8537b9ca03e9c6eb1b8c0f1b
MD5 37693866bc1f2183c0c5c24b98494125
SHA1 9b99d222012d1cbc1071e588ea1b6fa2f9818ed2
SHA512 2f4c59015d62e971b069d1405375a3fe47097b3e47621fc928be501cdf71a0523f4bc8819ecef88e13c13de48754c41126d95fb4cee7e131e4c4b80ff2d19242
TLSH
T1D4E0203872FA057DF2F5F07846F59913546AF2971B45C26A1580570AAF2A6005ED1A20
MD5 SHA1 SHA512 TLSH

Submit Download

MSIE932.tmp

Path C:\Users\Admin\AppData\Local\Temp\MSIE932.tmp
Size 209KB
SHA256 8351a40a632facd1f79a1bccfe8e32e88876a23065be1144621533700ecb05ad
MD5 3037e214e0f9b25fc63d4d16f7c4c91d
SHA1 b03dce2090033ca3029526485039b75a5aa4b488
SHA512 437fd240c0af2afaa3a5a1791db4739dff04c7003f25f1bc512797cfffb7fc3e8377656b6eb8714a50b3189c2616b230a619730bc63628d9ab4bc214ce31de90
SSDEEP 3072:l9FCdj6rw5iUeqEetAByXxqr8lyc8t5W6/eb7eUZxfZ/oR:l9FC4wuJeiByXwrtcO6ZVxoR
TLSH
T1C6248E09B7D100B9EDB78638CD678656E673780107609A9F03A08376EF2F7D1A63DB61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSI4668.tmp

Path C:\Windows\Installer\MSI4668.tmp
Size 275KB
SHA256 fb1cd5e7c3ea30dfafd3cc1862e311388361d896610db28c63716da9d71e8f3f
MD5 2232c07e354364e0eb1dc80024593826
SHA1 65bb4232c0416cfb2c158bfc32a7732ad72cee72
SHA512 f0d295565b209f4dedd2a79123fa54ff9b8cbb173f14463ab3d3707b8d87aad84b05c2898478ecc148e29d02fa07ddda9499795e0ceafc2982c0adbd570a3572
SSDEEP 3072:A736bBrGsu4ldGrlmxElEmNoPl4+eDhIVJkRZ5Br/NbvcjKX5mMgQSeRocPvuocM:A736UWldGrlmxEDNMea+H5R/B/1lp4x
TLSH
T136548D41B7E404A6EC73C73499A39606FA3278411B70DAEF035082768F6B7D1AA3DB35
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSI4697.tmp

Path C:\Windows\Installer\MSI4697.tmp
Size 281KB
SHA256 45e855461f5d1be28a2f88416603070bd1778055abdd06834ae58e97b7ddf53c
MD5 718222e232d11298dfbabbc2b70d8b14
SHA1 89fc560692111c2245694867b8772fd8969f46d2
SHA512 9191961c28a7a4647ae8f9f9e1956d60b97f5f5c3e4e838d888bf78c1ea665e98e8e3c75cc1247a68a89b2413493ea6d39dbc60827eec919ddba0536d793c801
SSDEEP 3072:sEcOO6pMedPCy5654WKlfE5qbHsfmYud8d2VCsOLlk1lHgQNvLvPMm88cYzdFOS:OOO6OedPjw58l85/grhSQNDsYz2
TLSH
T111549D45BF9504B6E8BBC1348AA74A82E772740203109A9F33AC97799F2F7D1663D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSI46E7.tmp

Path C:\Windows\Installer\MSI46E7.tmp
Size 143KB
SHA256 2738720da0b6ce474ca6eb51a92372d047eca2d713c256f0cd6c147ac3a0db21
MD5 84a1cc9540d5cdad74bc54f8090dd27a
SHA1 c6f82d1491015457785ae0d365e7196d693d9a6b
SHA512 9c25d6e7331844d01d732ac923e99c68f305749d92407c873cd09b451e59a8864001e308864fda319fa4a2bcae9dbe50682201c67901dce14272291dedecd2c8
SSDEEP 3072:+1gnuc/GBdzVQqyIgt8DB7QKPw3hL6nCMfBXqpU:Bnuc/GBdJmIgtesKP+Lh+
TLSH
T154E37E17B7A400BBE5B78235C9635A06E772B81117219F9F03A443766F237D0AD3EB61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e593aec.msi

Path C:\Windows\Installer\e593aec.msi
Size 5.5MB
SHA256 19bca902826ef0dc9a6cf849297ce43ba8b2844bdb913c37230308d3274c953c
MD5 1e150b4507fc951c8a23b08b85236cd2
SHA1 3f6980947c16778efb3126193726c038453c85d6
SHA512 2074822532d38e94c131ceb3b4b7a01379ea20b5d6e3fb85a6912a586b8e6f1ff5a4973c200087ccd5ecd17727acef2d5568e6afc9df392da5c1f1978b4cd3a8
SSDEEP 98304:fEnzYKCLSBI0lGIOKv8k7VHTB87GnJ6tEGb7MrisWnB+A/yue/bjBe:z/LS9ZzVV87G2hbWij+xB/Re
TLSH
T128460101B6C10462EC678230C85E925AF2F27C5117A0D66FA2DCBF7CBF3B3A5526A751
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dberr.txt

Path C:\Windows\System32\CatRoot2\dberr.txt
Size 75KB
SHA256 8aa7a71429ca18a03bb31715ce67173700f2b6232154a387b69a6a8dd6de495f
MD5 9248162dd6c33f028ec31a10adc6752b
SHA1 ae1d84e05ca85281b7b2f7c2392e49aa20ca1b3f
SHA512 fd69c5e8b70deadd4589178a6a9826ae06fe102c5f51582f4d8d8b1c27d590bce431176767c027b534645570441a5d870fd7f7316bbc41d20ada3d8a1edefedd
SSDEEP 1536:FTLWgQFRfDGfL3jAIaPdOHFl1Saj/inNdhxzjXj9p39NB3L389DZdlyvRY9M1dYt:FWPq
TLSH
T1BB737D44C2E8869CC5B60E737267EE74D91E9986730F0DE632DC7340DDC2A052B7A97A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dberr.txt

Path C:\Windows\System32\CatRoot2\dberr.txt
Size 75KB
SHA256 013850901d807a631916b3a3e5e7ed411bc01b9f9b01edf346afbf491e6a449e
MD5 f0361be4845bff69b84b496a4dda8584
SHA1 ce94d3718b06171a43146f032ea57dab2a137632
SHA512 4d9a6557d715bcd19b2c36fbb1cdb720ecddea44a8c790f1938f660bfdc06988383f6a97f4365d488207757672d30ef03166497662babd1cc5ede9a1091d585b
SSDEEP 1536:FTLWgQFRfDGfL3jAIaPdOHFl1Saj/inNdhxzjXj9p39NB3L389DZdlyvRY9M1dYh:FWPE
TLSH
T184737D44C2E8869CC5B60E737267EE74D91E9986730F0DE632DC7340DDC2A052B7A97A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

oemvista.inf_amd64_ba3e477187f1080b.ini

Path C:\Windows\System32\DriverStore\FileRepository\oemvista.inf_amd64_ba3e477187f1080b.ini
Size 421B
SHA256 9e354a9aab1b9ec9406261727fa4cdf1defb6e80777a2b5c1d1a3ad0114cfa19
MD5 46bfaaa4d71814e0a11df00af2966fef
SHA1 7f94598bd4d36db1c6b72f4e26d912932b1cab44
SHA512 a5b0508d96133b37a02b74d81d3b4528033d9804ab79e3cacb3a3d118e860f832a0b781f80e5279d79504ef05dc1f34bb725cc9e84ca762a06b6e0b604bf7e1f
TLSH
T1DCE02203922C70C986E8681E73648C2EAC1B37EA1A23B17C3FA1AAE40F49C280BC0101
MD5 SHA1 SHA512 TLSH

Submit Download

ovpn-dco.inf_amd64_b737bb7e846ccda6.ini

Path C:\Windows\System32\DriverStore\FileRepository\ovpn-dco.inf_amd64_b737bb7e846ccda6.ini
Size 420B
SHA256 49c88f63243f71a3a4e0e176d8834c6a6dc46e6e4ae2d1a1f50691e5f477d7e4
MD5 794439906b440f5e071729704319f1a0
SHA1 2797dc98076391073c4c49a49e28343eab63ce4c
SHA512 b46c1881158c9c683baa7f2cb6b52a045dc64bd7fba201b31aa1864b1e2e112a45d3c03c685ee9b9a53aea58b7ab2cfe7ae0795b674c5a9783a02a74a5a9d574
TLSH
T188E02B2E13F3E9EBA708AC0002277B784C4AB40A15782F117104C1452F5BE2058CBBD3
MD5 SHA1 SHA512 TLSH

Submit Download

wintun.inf_amd64_def3401515466414.ini

Path C:\Windows\System32\DriverStore\FileRepository\wintun.inf_amd64_def3401515466414.ini
Size 415B
SHA256 5ac3a31404b31718e8c8bac614eb0061d2959241d45ce241f65c77210df7a98b
MD5 4295de8e471df129888474bc50dffec6
SHA1 17e379f7734a8ea7b5faa01d3bde60e29fc37da2
SHA512 b41955dd8c9cb6b7d03377700a058562a4787dc59b768fe5ba1ca0dc52f487777487b2e8915ebeb5670392b636abba1701be05781b14a076ec44755c9bcef871
TLSH
T147E02287DF203AC5940B3012F716AEAECC3939F0C643A01DB72022F01B0DE0B8BB6A00
MD5 SHA1 SHA512 TLSH

Submit Download

wintun.cat

Path C:\Windows\Temp\CBC511~1\wintun.cat
Size 9KB
SHA256 602187e5470ddbdf9421045bb0515f358c88bf88f59fd8a886fb6373da5d0f82
MD5 faba2ccb8fe366fd281ca6be6d2bb7c2
SHA1 bb7bd32a21f3eba652fde24146387ffc5278143e
SHA512 ec424a545e2598f299706499dab07b4d12b0734a52f928216a53bca2b7f384b97bd4fc092d7d68de636a75daf79ac392c4b49b7251ec011236de1659253d6214
SSDEEP 192:6wRp8yDJCKE4uyK6iWPFWQFAnTz36ArNc4qnajr7NCo:L/iWPFRI64lrNt
TLSH
T10522F8E28A5C44C2E993ADB05398F5977C3E7BDB4C20906922ABF7650DD27C5E70843E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wintun.sys

Path C:\Windows\Temp\CBC511~1\wintun.sys
Size 37KB
SHA256 eb58bf00df7b4f98334178e75df3348c609ea5c6c74cf7f185f363aa23976c8b
MD5 1945d7d1f56b67ae1cad6ffe13a01985
SHA1 2c1a369f9e12e5c6549439e60dd6c728bf1bffde
SHA512 09af87898528eaa657d46c79b7c4ebc0e415478a421b0b97355294c059878178eb32e172979ee9b7c59126861d51a5831e337a96666c43c96cb1cf8f11bc0a0f
SSDEEP 768:UwtoHKG2ZqGhg+Eqpg0bUORjj71PKgPrbHZIb4:UwtoHt2ZLg+zg5cv7ld7Zy4
TLSH
T1E1037DD2E6A868C2E973CE3151F5E523BD74B2612B20D5EF4511C4350FA3BC1EA7863A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tap0901.cat

Path C:\Windows\Temp\E162D1~1\tap0901.cat
Size 11KB
SHA256 ee062e5ef2743ceab10c64830e4cefe52e35cc1ece85947ac4e61ddd1c0b05f7
MD5 71ecece58bb00bdc1e728ee28d7a5332
SHA1 4305889415cf95662a30d024f1138f1af224cf42
SHA512 9b23404d867fc4fd7c7beeba3768e8fed3113cc7430ec1bc9ca7faf6e6105388de7057b1402f9b4ba8fbc11e5fcd3afe14233721e8d15b6c0bed40f65aa5b58b
SSDEEP 192:HxDuDjbfXJCKnEwKUNhYCy1QySaI8HNsAX01k9z3Aqcp9wdGEC:CXaUNh3auatHNsAR9zWZEC
TLSH
T1FF322AA2942C52C3ECABBC7043D4E9977C3E2BCB1950506A269FF7141DA73C8EB1516E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tap0901.sys

Path C:\Windows\Temp\E162D1~1\tap0901.sys
Size 40KB
SHA256 581dcaace05d5c1ac9512457ff50565aca5d904d2c209bd3fc369ca4d4a0d2b1
MD5 1bb9772a05517e227d1dafd3936e8f66
SHA1 d695ca5791a4b6a3509939aebdfaf5e229c6fbcf
SHA512 3f1966038f91b887fe1a71474929bd87f3c75091846c6e9563f7424d3a7c19c908f1d874895341c61a868a616aba637e3d4188d4ebb7383087886a13a4dc0aa2
SSDEEP 768:EGvByM5JLLvslmdu9lsECPURPNkilzdCH3C9zySb:EfM7VE88fkilzdCHOzySb
TLSH
T112038DD16AA814D1E8AA9874C7EBCE43F7B5B1430311AAEF0764D6691F23BD05637328
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wintun.inf

Path C:\Windows\Temp\cbc511e0106089c84b9fe8da68dfff5cfa4e9006b4c745e0ea77722e919b2c58\wintun.inf
Size 1KB
SHA256 44098408ab9611dd99a38e140c7fb1ca5dce6eb2d5f0d5e500547ac1ba5d235b
MD5 8480579050970b0812cc3d9a1bce1340
SHA1 edebebd090602f4eee375ad754c8566d4fda23cb
SHA512 46de9202c3cf0ddbf19f9e0e02ec17530f2722abfa08669fd30a6095ce2342fa89a2cc59c1d47afd82b48c915bb95f4c6d16e7c21129a9c8f09c2bf239566933
TLSH
T1933135D954E10D693CD3322E77277F81E65C123041CA200EB6FD8559D64BCDFA654CAA
MD5 SHA1 SHA512 TLSH

Submit Download

OemVista.inf

Path C:\Windows\Temp\e162d15a639f9b4893c4f21d0103cd7bcde43bd69ac5539f37f4e6c566a16f3d\OemVista.inf
Size 7KB
SHA256 1327ab3a8c50691f04bea8e2ca356c5b604092a719e219464f8cc4b42e192de9
MD5 6f5ffb58a9e406ab1643c890e2a198c6
SHA1 3ff1faba00ac18a93e88a6f2bbfa747c9fdc7e0c
SHA512 af29bc13cc02238208c51e4e95dd0a4445a952755635a9eab38aa77a5c087cc8e2025af55d8f3a0e9f2430baa91534e7f892bb71aa0ef72bab4483211a845b4b
SSDEEP 192:wr8tW9yCTi314vlQd22bjR+iAUC7bMP+io3DcNSj6jvKFkPs7EQTXvt1Ld4Z:LWlGBdkkzo3DcNSj6jvKFkPs7EQTXvtk
TLSH
T1F9F150681C83EE3A31FEE58557565EC7E24611823A172800355CFC549BBDD9FE33C92A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata-2

Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
Size 26.1MB
SHA256 de26445c47154e2d466c7882e58eabaed0d117a2f9df94d5f9648e23bcd3d1b7
MD5 bc753171f0cbf4db3e188329e96c0144
SHA1 3b882c7870543d8e8174112a2f3c5f0909d4b5e2
SHA512 67a664677a51f5a3a60af98634b7692a984ac08afb24ff4c192c56dceac247e4535d51f3b7adaff22f9a5e327fdbc63e30ff01345ba6d53a493cfe459262ec63
SSDEEP 24576:MFo3DMP2doO/vvTL/yAcMilQ/b+23rLvERaeNRi06ZyapL98sYxGMVG9o+2:DHY
TLSH
T16C57A12437F92240E7F79E3DA8F06A23493A7D5B9C15DE8D45411B4E0822F71E872F6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{1641d90a-9ebf-4275-b49b-32841fc9a6f4}_OnDiskSnapshotProp

Path \??\Volume{0850fdde-0000-0000-0000-d08302000000}\System Volume Information\SPP\OnlineMetadataCache\{1641d90a-9ebf-4275-b49b-32841fc9a6f4}_OnDiskSnapshotProp
Size 6KB
SHA256 d1d179d7460735703710e8939550ed6708f0740e2e3ffe03be379341219006be
MD5 084316bd3898a3544bb644162bca16cc
SHA1 4a920a184967ac8989a5529f4595fef3328ef34d
SHA512 d11822f4457d5f77d0219749d39af70479997990af52f17764a579aacd71db984c97a8a6ad7888f82727932540a696165fda7960cf96493350644bcd90240e23
SSDEEP 96:F/RPdoNvc6DD84LTHzbOHXOHBlBRQn8Sc9XE56tOSVQpuN:LaBb++uVmN
TLSH
T138D189185AF54711E2B3AB3128F18557A477B911EF33CB8E0198238F2661A10F975F6F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1232-395-0x0000000000E70000-0x0000000000E7A000-memory.dmp

Download

memory/5596-382-0x0000021605D00000-0x00000216066A4000-memory.dmp

Download