Overview
overview
8Static
static
5LetsVPN.exe
windows10-2004-x64
8LetsVPN.exe
windows11-ltsc_2024-x64
8$PLUGINSDI...ns.dll
windows10-2004-x64
3$PLUGINSDI...ns.dll
windows11-ltsc_2024-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows11-ltsc_2024-x64
3LetsPRO.exe
windows10-2004-x64
8LetsPRO.exe
windows11-ltsc_2024-x64
8Microsoft.exe
windows10-2004-x64
8Microsoft.exe
windows11-ltsc_2024-x64
8Update.exe
windows10-2004-x64
1Update.exe
windows11-ltsc_2024-x64
1api-ms-win...-0.dll
windows10-2004-x64
3api-ms-win...-0.dll
windows10-2004-x64
3api-ms-win...-0.dll
windows10-2004-x64
3api-ms-win...-0.dll
windows10-2004-x64
3api-ms-win...-0.dll
windows10-2004-x64
3api-ms-win...-0.dll
windows10-2004-x64
3api-ms-win...-0.dll
windows10-2004-x64
3api-ms-win...-0.dll
windows10-2004-x64
3api-ms-win...-0.dll
windows10-2004-x64
3api-ms-win...-0.dll
windows10-2004-x64
3api-ms-win...-0.dll
windows10-2004-x64
3api-ms-win...-0.dll
windows10-2004-x64
3api-ms-win...-0.dll
windows10-2004-x64
3api-ms-win...-0.dll
windows10-2004-x64
3api-ms-win...-0.dll
windows10-2004-x64
3api-ms-win...-0.dll
windows10-2004-x64
3api-ms-win...-1.dll
windows10-2004-x64
3api-ms-win...-0.dll
windows10-2004-x64
3api-ms-win...-0.dll
windows10-2004-x64
3api-ms-win...-0.dll
windows10-2004-x64
3Analysis
- max time kernel
87s - max time network
156s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260629-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
04/07/2026, 12:24
Static task
static1
3 signatures
Behavioral task
behavioral1
Sample
LetsVPN.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
25 signatures
150 seconds
Behavioral task
behavioral2
Sample
LetsVPN.exe
Resource
win11ltsc2024-20260629-en
windows11-ltsc_2024-x64
24 signatures
150 seconds
Behavioral task
behavioral3
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral4
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win11ltsc2024-20260629-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
Behavioral task
behavioral5
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral6
Sample
$PLUGINSDIR/System.dll
Resource
win11ltsc2024-20260629-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
Behavioral task
behavioral7
Sample
LetsPRO.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
17 signatures
150 seconds
Behavioral task
behavioral8
Sample
LetsPRO.exe
Resource
win11ltsc2024-20260629-en
windows11-ltsc_2024-x64
24 signatures
150 seconds
Behavioral task
behavioral9
Sample
Microsoft.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
9 signatures
150 seconds
Behavioral task
behavioral10
Sample
Microsoft.exe
Resource
win11ltsc2024-20260629-en
windows11-ltsc_2024-x64
8 signatures
150 seconds
Behavioral task
behavioral11
Sample
Update.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral12
Sample
Update.exe
Resource
win11ltsc2024-20260629-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral13
Sample
api-ms-win-core-console-l1-1-0.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral14
Sample
api-ms-win-core-datetime-l1-1-0.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral15
Sample
api-ms-win-core-debug-l1-1-0.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral16
Sample
api-ms-win-core-errorhandling-l1-1-0.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral17
Sample
api-ms-win-core-file-l1-1-0.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral18
Sample
api-ms-win-core-file-l1-2-0.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral19
Sample
api-ms-win-core-file-l2-1-0.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral20
Sample
api-ms-win-core-handle-l1-1-0.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral21
Sample
api-ms-win-core-heap-l1-1-0.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral22
Sample
api-ms-win-core-interlocked-l1-1-0.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral23
Sample
api-ms-win-core-libraryloader-l1-1-0.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral24
Sample
api-ms-win-core-localization-l1-2-0.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral25
Sample
api-ms-win-core-memory-l1-1-0.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral26
Sample
api-ms-win-core-namedpipe-l1-1-0.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral27
Sample
api-ms-win-core-processenvironment-l1-1-0.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral28
Sample
api-ms-win-core-processthreads-l1-1-0.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral29
Sample
api-ms-win-core-processthreads-l1-1-1.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral30
Sample
api-ms-win-core-profile-l1-1-0.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral31
Sample
api-ms-win-core-rtlsupport-l1-1-0.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral32
Sample
api-ms-win-core-string-l1-1-0.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
General
- Target LetsPRO.exe
- Size 243KB
- Sample260704-plefpsfs9v
- SHA256 0e66192b248183324a6f3afc294e25299d096c5fbe9f99dc351613a1cf8d9d84
- MD5 fb49018cd616909b9581551e7913535e
- SHA1 2074d4eead8d3f637649c44042b70f6894ff64a3
- SHA512 e5d8a4d65cc439cbca9d7fb3f9a8b4f5444a096e12197c840dea8c5b2b588049453a04a5f2554328208021ad31eb21d20671378a438d6aa47c7c0b39765b1054
- SSDEEP 6144:xZzvhs2Z4n1E7g34XtVYAOfTd/z44JsQwuU7pI2:xJ+2Z4nShVY5JUUU1p
- TLSH T1B2348B1175D38472E5B30A3008F4E6B5AA7DFC710E659E7B63D9072E0F702C29A35EA6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
Malware Config
Signatures
- Drops file in Drivers directory 3 IoCs
description ioc Process File created C:\Windows\System32\drivers\SET78EF.tmp DrvInst.exe File opened for modification C:\Windows\System32\drivers\tap0901.sys DrvInst.exe File opened for modification C:\Windows\System32\drivers\SET78EF.tmp DrvInst.exe - Unexpected DNS network traffic destination 3 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description flow ioc pid Process Destination IP 6 119.29.29.29 3320 LetsPRO.exe Destination IP 23 119.29.29.29 3320 LetsPRO.exe Destination IP 32 119.29.29.29 3320 LetsPRO.exe - Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000\Software\Microsoft\Windows\CurrentVersion\Run\LetsPRO = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\app-3.20.0\\LetsPRO.exe\" /silent" LetsPRO.exe - Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe - Enumerates connected drives 3 TTPs 2 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\E: explorer.exe File opened (read-only) \??\F: explorer.exe -
pid Process 5144 cmd.exe 2556 ARP.EXE - Drops file in System32 directory 17 IoCs
description ioc Process File created C:\Windows\System32\DriverStore\Temp\{5cf69750-d05f-c543-8b4d-b3127f3fb634}\SET772A.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{5cf69750-d05f-c543-8b4d-b3127f3fb634}\tap0901.cat DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{5cf69750-d05f-c543-8b4d-b3127f3fb634} DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{5cf69750-d05f-c543-8b4d-b3127f3fb634}\SET772B.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{5cf69750-d05f-c543-8b4d-b3127f3fb634}\tap0901.sys DrvInst.exe File created C:\Windows\System32\DriverStore\drvstore.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\oemvista.inf_amd64_662fd96dfdced4ae\tap0901.sys DrvInst.exe File created C:\Windows\System32\DriverStore\Temp\{5cf69750-d05f-c543-8b4d-b3127f3fb634}\SET772B.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{5cf69750-d05f-c543-8b4d-b3127f3fb634}\SET773C.tmp DrvInst.exe File created C:\Windows\System32\DriverStore\Temp\{5cf69750-d05f-c543-8b4d-b3127f3fb634}\SET773C.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\oemvista.inf_amd64_662fd96dfdced4ae\oemvista.inf DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\oemvista.inf_amd64_662fd96dfdced4ae\tap0901.cat DrvInst.exe File opened for modification C:\Windows\System32\CatRoot2\dberr.txt DrvInst.exe File created C:\Windows\System32\DriverStore\FileRepository\oemvista.inf_amd64_662fd96dfdced4ae\oemvista.PNF tapinstall.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{5cf69750-d05f-c543-8b4d-b3127f3fb634}\SET772A.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{5cf69750-d05f-c543-8b4d-b3127f3fb634}\oemvista.inf DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\oemvista.inf_amd64_662fd96dfdced4ae.ini DrvInst.exe - Drops file in Windows directory 5 IoCs
description ioc Process File opened for modification C:\Windows\INF\setupapi.dev.log DrvInst.exe File opened for modification C:\Windows\inf\oem1.inf DrvInst.exe File created C:\Windows\inf\oem1.inf DrvInst.exe File opened for modification C:\Windows\INF\setupapi.dev.log DrvInst.exe File opened for modification C:\Windows\INF\setupapi.dev.log tapinstall.exe - System Location Discovery: System Language Discovery 1 TTPs 10 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LetsPRO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LetsPRO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LetsPRO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ARP.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ipconfig.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ROUTE.EXE - Checks SCSI registry key(s) 3 TTPs 64 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\CompatibleIDs tapinstall.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\UpperFilters DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Service DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs tapinstall.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\CompatibleIDs DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Capabilities explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\UpperFilters DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000 DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001 tapinstall.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID tapinstall.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000 tapinstall.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\LowerFilters DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\CompatibleIDs DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Service DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Filters DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 tapinstall.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\LowerFilters DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID tapinstall.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\CompatibleIDs tapinstall.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID tapinstall.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName explorer.exe - Gathers network information 2 TTPs 1 IoCs
Uses commandline utility to view network configuration.
pid Process 5328 ipconfig.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000\Software\Microsoft\Internet Explorer\Main explorer.exe - Modifies data under HKEY_USERS 42 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs DrvInst.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\system32\hnetcfgclient.dll,-201 = "HNetCfg Client" svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root DrvInst.exe - Modifies registry class 49 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\ explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02 explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\ explorer.exe Key created \REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\client.cbs SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs\ = "56" SearchHost.exe Set value (str) \REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:" StartMenuExperienceHost.exe Set value (data) \REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\NotificationData\0D83063EA3B8FCF5 = 0100000000000002 explorer.exe Key created \REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\MuiCache SearchHost.exe Set value (str) \REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix StartMenuExperienceHost.exe Set value (str) \REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:" StartMenuExperienceHost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\letsvpn2\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\app-3.20.0\\LetsPRO.exe\" \"%1\"" LetsPRO.exe Key created \REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ explorer.exe Key created \REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotify explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\letsvpn2 LetsPRO.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\letsvpn2\ = "letsvpn2Protocol" LetsPRO.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\ explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\ explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs\Total = "56" SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "23" SearchHost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\letsvpn2\URL Protocol = "C:\\Users\\Admin\\AppData\\Local\\Temp\\app-3.20.0\\LetsPRO.exe" LetsPRO.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\letsvpn2\shell LetsPRO.exe Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1991999443-3181470666-3272020885-1000\{22DDC333-43E8-402E-BCED-457F8A8025B7} explorer.exe Key created \REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\Total SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs\Total = "23" SearchHost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\letsvpn2\DefaultIcon LetsPRO.exe Set value (data) \REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\ explorer.exe Key created \REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\NotificationData explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:" SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\microsoftwindows.client.cbs SearchHost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\letsvpn2\shell\open LetsPRO.exe Key created \REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell explorer.exe Key created \REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\MuiCache StartMenuExperienceHost.exe Key created \REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DomStorageState SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs\ = "23" SearchHost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\letsvpn2\DefaultIcon\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\app-3.20.0\\LetsPRO.exe\",1" LetsPRO.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\ explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:" SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "56" SearchHost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\letsvpn2\shell\open\command LetsPRO.exe Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1991999443-3181470666-3272020885-1000\{84F9A2A8-CA33-42DB-BAF7-695E34926DD3} explorer.exe - Suspicious behavior: EnumeratesProcesses 5 IoCs
pid Process 3320 LetsPRO.exe 3320 LetsPRO.exe 3320 LetsPRO.exe 1220 explorer.exe 1220 explorer.exe - Suspicious behavior: LoadsDriver 2 IoCs
pid Process 828 Process not Found 828 Process not Found - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 3320 LetsPRO.exe Token: SeLoadDriverPrivilege 1912 tapinstall.exe Token: SeRestorePrivilege 3220 DrvInst.exe Token: SeBackupPrivilege 3220 DrvInst.exe Token: SeLoadDriverPrivilege 3220 DrvInst.exe Token: SeLoadDriverPrivilege 3220 DrvInst.exe Token: SeLoadDriverPrivilege 3220 DrvInst.exe Token: SeShutdownPrivilege 1220 explorer.exe Token: SeCreatePagefilePrivilege 1220 explorer.exe Token: SeShutdownPrivilege 1220 explorer.exe Token: SeCreatePagefilePrivilege 1220 explorer.exe Token: SeShutdownPrivilege 1220 explorer.exe Token: SeCreatePagefilePrivilege 1220 explorer.exe Token: SeShutdownPrivilege 1220 explorer.exe Token: SeCreatePagefilePrivilege 1220 explorer.exe Token: SeShutdownPrivilege 1220 explorer.exe Token: SeCreatePagefilePrivilege 1220 explorer.exe Token: SeShutdownPrivilege 1220 explorer.exe Token: SeCreatePagefilePrivilege 1220 explorer.exe Token: SeShutdownPrivilege 1220 explorer.exe Token: SeCreatePagefilePrivilege 1220 explorer.exe Token: SeShutdownPrivilege 1220 explorer.exe Token: SeCreatePagefilePrivilege 1220 explorer.exe Token: SeShutdownPrivilege 1220 explorer.exe Token: SeCreatePagefilePrivilege 1220 explorer.exe Token: SeShutdownPrivilege 1220 explorer.exe Token: SeCreatePagefilePrivilege 1220 explorer.exe Token: SeShutdownPrivilege 1220 explorer.exe Token: SeCreatePagefilePrivilege 1220 explorer.exe Token: SeShutdownPrivilege 1220 explorer.exe Token: SeCreatePagefilePrivilege 1220 explorer.exe Token: SeShutdownPrivilege 1220 explorer.exe Token: SeCreatePagefilePrivilege 1220 explorer.exe Token: SeShutdownPrivilege 1220 explorer.exe Token: SeCreatePagefilePrivilege 1220 explorer.exe Token: SeShutdownPrivilege 1220 explorer.exe Token: SeCreatePagefilePrivilege 1220 explorer.exe Token: SeShutdownPrivilege 1220 explorer.exe Token: SeCreatePagefilePrivilege 1220 explorer.exe Token: SeShutdownPrivilege 1220 explorer.exe Token: SeCreatePagefilePrivilege 1220 explorer.exe Token: SeShutdownPrivilege 1220 explorer.exe Token: SeCreatePagefilePrivilege 1220 explorer.exe Token: SeShutdownPrivilege 1220 explorer.exe Token: SeCreatePagefilePrivilege 1220 explorer.exe Token: SeShutdownPrivilege 1220 explorer.exe Token: SeCreatePagefilePrivilege 1220 explorer.exe Token: SeShutdownPrivilege 1220 explorer.exe Token: SeCreatePagefilePrivilege 1220 explorer.exe Token: SeShutdownPrivilege 1220 explorer.exe Token: SeCreatePagefilePrivilege 1220 explorer.exe Token: SeShutdownPrivilege 1220 explorer.exe Token: SeCreatePagefilePrivilege 1220 explorer.exe Token: SeShutdownPrivilege 1220 explorer.exe Token: SeCreatePagefilePrivilege 1220 explorer.exe Token: SeShutdownPrivilege 1220 explorer.exe Token: SeCreatePagefilePrivilege 1220 explorer.exe Token: SeShutdownPrivilege 1220 explorer.exe Token: SeCreatePagefilePrivilege 1220 explorer.exe Token: SeShutdownPrivilege 1220 explorer.exe Token: SeCreatePagefilePrivilege 1220 explorer.exe Token: SeIncreaseQuotaPrivilege 3320 LetsPRO.exe Token: SeSecurityPrivilege 3320 LetsPRO.exe Token: SeTakeOwnershipPrivilege 3320 LetsPRO.exe - Suspicious use of FindShellTrayWindow 60 IoCs
pid Process 3320 LetsPRO.exe 3320 LetsPRO.exe 3320 LetsPRO.exe 3320 LetsPRO.exe 3320 LetsPRO.exe 2460 sihost.exe 1220 explorer.exe 1220 explorer.exe 1220 explorer.exe 1220 explorer.exe 1220 explorer.exe 1220 explorer.exe 1220 explorer.exe 1220 explorer.exe 1220 explorer.exe 1220 explorer.exe 1220 explorer.exe 1220 explorer.exe 1220 explorer.exe 1220 explorer.exe 1220 explorer.exe 1220 explorer.exe 1220 explorer.exe 1220 explorer.exe 1220 explorer.exe 1220 explorer.exe 1220 explorer.exe 1220 explorer.exe 1220 explorer.exe 1220 explorer.exe 1220 explorer.exe 1220 explorer.exe 1220 explorer.exe 1220 explorer.exe 1220 explorer.exe 1220 explorer.exe 1220 explorer.exe 1220 explorer.exe 1220 explorer.exe 1220 explorer.exe 1220 explorer.exe 3320 LetsPRO.exe 3320 LetsPRO.exe 1220 explorer.exe 1220 explorer.exe 1220 explorer.exe 1220 explorer.exe 1220 explorer.exe 1220 explorer.exe 1220 explorer.exe 1220 explorer.exe 1220 explorer.exe 1220 explorer.exe 1220 explorer.exe 1220 explorer.exe 1220 explorer.exe 1220 explorer.exe 1220 explorer.exe 1220 explorer.exe 1220 explorer.exe - Suspicious use of SendNotifyMessage 50 IoCs
pid Process 3320 LetsPRO.exe 3320 LetsPRO.exe 3320 LetsPRO.exe 3320 LetsPRO.exe 3320 LetsPRO.exe 1220 explorer.exe 1220 explorer.exe 1220 explorer.exe 1220 explorer.exe 1220 explorer.exe 1220 explorer.exe 1220 explorer.exe 1220 explorer.exe 1220 explorer.exe 1220 explorer.exe 1220 explorer.exe 1220 explorer.exe 1220 explorer.exe 1220 explorer.exe 1220 explorer.exe 1220 explorer.exe 1220 explorer.exe 1220 explorer.exe 1220 explorer.exe 1220 explorer.exe 1220 explorer.exe 1220 explorer.exe 1220 explorer.exe 1220 explorer.exe 1220 explorer.exe 1220 explorer.exe 3320 LetsPRO.exe 3320 LetsPRO.exe 1220 explorer.exe 1220 explorer.exe 1220 explorer.exe 1220 explorer.exe 1220 explorer.exe 1220 explorer.exe 1220 explorer.exe 1220 explorer.exe 1220 explorer.exe 1220 explorer.exe 1220 explorer.exe 1220 explorer.exe 1220 explorer.exe 1220 explorer.exe 1220 explorer.exe 1220 explorer.exe 1220 explorer.exe - Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 4540 StartMenuExperienceHost.exe 2568 SearchHost.exe 1220 explorer.exe - Suspicious use of WriteProcessMemory 10 IoCs
description pid Process procid_target PID 1364 wrote to memory of 3320 1364 LetsPRO.exe 88 PID 3320 wrote to memory of 2576 3320 LetsPRO.exe 90 PID 2576 wrote to memory of 1912 2576 cmd.exe 92 PID 3320 wrote to memory of 2084 3320 LetsPRO.exe 103 PID 2084 wrote to memory of 5328 2084 cmd.exe 105 PID 3320 wrote to memory of 5672 3320 LetsPRO.exe 106 PID 5672 wrote to memory of 3232 5672 cmd.exe 108 PID 3320 wrote to memory of 5144 3320 LetsPRO.exe 109 PID 5144 wrote to memory of 2556 5144 cmd.exe 111 PID 2460 wrote to memory of 1220 2460 sihost.exe 116 - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\LetsPRO.exe"C:\Users\Admin\AppData\Local\Temp\LetsPRO.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1364 -
C:\Users\Admin\AppData\Local\Temp\app-3.20.0\LetsPRO.exe"C:\Users\Admin\AppData\Local\Temp\app-3.20.0\LetsPRO.exe"2⤵
- Unexpected DNS network traffic destination
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3320 -
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C ""C:\Users\Admin\AppData\Local\Temp\driver\tapinstall.exe" install "C:\Users\Admin\AppData\Local\Temp\driver\oemVista.inf" tap0901"3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2576 -
C:\Users\Admin\AppData\Local\Temp\driver\tapinstall.exe"C:\Users\Admin\AppData\Local\Temp\driver\tapinstall.exe" install "C:\Users\Admin\AppData\Local\Temp\driver\oemVista.inf" tap09014⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:1912
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C ipconfig /all3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2084 -
C:\Windows\SysWOW64\ipconfig.exeipconfig /all4⤵
- System Location Discovery: System Language Discovery
- Gathers network information
PID:5328
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C route print3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5672 -
C:\Windows\SysWOW64\ROUTE.EXEroute print4⤵
- System Location Discovery: System Language Discovery
PID:3232
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C arp -a3⤵
- Network Service Discovery
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5144 -
C:\Windows\SysWOW64\ARP.EXEarp -a4⤵
- Network Service Discovery
- System Location Discovery: System Language Discovery
PID:2556
-
-
-
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{8b6401bc-ead9-4643-aacf-563571b392f4}\oemvista.inf" "9" "4d14a44ff" "0000000000000194" "WinSta0\Default" "0000000000000198" "208" "c:\users\admin\appdata\local\temp\driver"1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
PID:5788
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "2" "211" "ROOT\NET\0000" "C:\Windows\System32\DriverStore\FileRepository\oemvista.inf_amd64_662fd96dfdced4ae\oemvista.inf" "oem1.inf:3beb73aff103cc24:tap0901.ndi:9.24.6.601:tap0901," "4d14a44ff" "0000000000000170" "8773"1⤵
- Drops file in Drivers directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:3220
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s Netman1⤵
- Modifies data under HKEY_USERS
PID:2572
-
C:\Users\Admin\AppData\Local\Temp\app-3.20.0\LetsPRO.exe"C:\Users\Admin\AppData\Local\Temp\app-3.20.0\LetsPRO.exe" /silent1⤵
- System Location Discovery: System Language Discovery
PID:6132
-
C:\Windows\system32\sihost.exesihost.exe1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2460 -
C:\Windows\explorer.exeexplorer.exe /LOADSAVEDWINDOWS2⤵
- Boot or Logon Autostart Execution: Active Setup
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:1220
-
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2568
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4540
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
2Active Setup
1Registry Run Keys / Startup Folder
1Privilege Escalation
Boot or Logon Autostart Execution
2Active Setup
1Registry Run Keys / Startup Folder
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
- Size 599B
- SHA256 b536a3dae9ea5c69081f0491eed829e3b57e32401fdf49a63031bcd6b20e6fdb
- MD5 658ab8c32d4cc5deb36ac5f63da4658b
- SHA1 30c12cd871ff0c2c4098d794e9ae4f2540586813
- SHA512 a73030c008ef3c2e274f11c90bfe79fa8ae402f76801c710bed8cc1ab1218a84858ea566b772be4bade8ef639a019c57d297028df15b64b3753482cf0f3c8f85
- TLSH T12AF05C83EB6A1B72C456123DC8EE56E47B31D1846EC11367A2107B1D3C2B7192D174BD
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\app-3.20.0\LetsPRO.INI
- Size 1KB
- SHA256 de5e478326ef40549c2b9dee246f8b8b602b488c9e48b5daaefe9f9f431b5b71
- MD5 85d93f64554a7fad5b6bd21919566e40
- SHA1 d2308ae5696a20175dbcd1749b06dc78f33b0ffa
- SHA512 1508ca772e16df264b73f2e140f4057f7a42981cd22989dd7b24910d016b71f59a97de9d6ce286f09984745d73c6d6e88e4c77f56e7c3e93f20eabaa59287446
- TLSH T17631335B46702B3194532107191FEBE3B32469AC226B54B1347C8B843703D29D33BEE9
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\System32\DriverStore\FileRepository\oemvista.inf_amd64_662fd96dfdced4ae.ini
- Size 418B
- SHA256 92d0507fd37e755ba6417b6f13a640e63036798546e00043a29809b1fb228ed7
- MD5 533219ed674e7a1f5411ea720bb31031
- SHA1 39ea7a9b22bebfcbd2992c113dc69dffbb6bc7a7
- SHA512 41b2813081fa76934d222c83dac489d4229916cb57518703f93e884e7c801b7bc3d7528812a2841df908327d3c1ab5c58ebf07e42b739abbc8a3893e650bd7a5
- TLSH T184E0E586653EC2DD46D08515AB1A0CA6ED9BF13CA45D14DD3B10E2C46F82857D75C0D3
- MD5 SHA1 SHA512 TLSH