Analysis
- user interaction
yes - max time kernel
38s - max time network
37s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
10/07/2026, 11:40
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
BNyaYC8QcT.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
BNyaYC8QcT.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
10 signatures
150 seconds
General
- Target BNyaYC8QcT.exe
- Size 4.4MB
- Sample260710-ntaxtaaw7r
- SHA256 47e1e821dd5fd1b5ec49c952cec04a7a416f1c1fb77fa26d3c123f090afaf08a
- MD5 56c2614335f4be3f3a34add4c9350e02
- SHA1 5f666718c957dd52f34f1faf2058e401170a1117
- SHA512 ac8d9e82f492243af31d4e0ee09673511020517d055763525a913b8c715467e0ad0dc6da230610361121afec722cc913ea392a05d09e9f2ca4deaf2015031385
- SSDEEP 98304:oZ6odPpccDCvDZYq7SOhiB60kiHiMUceTltJ:oZ6IP9CNYqOOckjiCTceTF
- TLSH T13E2601566AC902B6D1B7D1398BC3862BF0A3710A83968ECF17D55D421F53EC0673B36A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
Malware Config
Signatures
- Drops file in Drivers directory 1 IoCs
description ioc Process File opened for modification C:\Windows\System32\drivers\wintun.sys DrvInst.exe - Executes dropped EXE 1 IoCs
pid Process 5912 updater.exe - Loads dropped DLL 1 IoCs
pid Process 5912 updater.exe - Drops file in System32 directory 17 IoCs
description ioc Process File opened for modification C:\Windows\System32\DriverStore\FileRepository\wintun.inf_amd64_8ed20477a29aa8f7\wintun.sys DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\wintun.inf_amd64_8ed20477a29aa8f7\wintun.cat DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{a74b25c6-84a6-f648-ab4e-9cbe65127893}\SETA33B.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{a74b25c6-84a6-f648-ab4e-9cbe65127893}\wintun.cat DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{a74b25c6-84a6-f648-ab4e-9cbe65127893}\wintun.sys DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\wintun.inf_amd64_8ed20477a29aa8f7\wintun.inf DrvInst.exe File created C:\Windows\System32\DriverStore\Temp\{a74b25c6-84a6-f648-ab4e-9cbe65127893}\SETA33B.tmp DrvInst.exe File created C:\Windows\System32\DriverStore\Temp\{a74b25c6-84a6-f648-ab4e-9cbe65127893}\SETA33C.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{a74b25c6-84a6-f648-ab4e-9cbe65127893}\wintun.inf DrvInst.exe File created C:\Windows\System32\DriverStore\Temp\{a74b25c6-84a6-f648-ab4e-9cbe65127893}\SETA34D.tmp DrvInst.exe File created C:\Windows\System32\DriverStore\drvstore.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\wintun.inf_amd64_8ed20477a29aa8f7\wintun.sys DrvInst.exe File opened for modification C:\Windows\System32\CatRoot2\dberr.txt DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{a74b25c6-84a6-f648-ab4e-9cbe65127893} DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{a74b25c6-84a6-f648-ab4e-9cbe65127893}\SETA33C.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{a74b25c6-84a6-f648-ab4e-9cbe65127893}\SETA34D.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\wintun.inf_amd64_8ed20477a29aa8f7.ini DrvInst.exe - Drops file in Windows directory 5 IoCs
description ioc Process File opened for modification C:\Windows\INF\setupapi.dev.log DrvInst.exe File opened for modification C:\Windows\inf\oem1.inf DrvInst.exe File created C:\Windows\inf\oem1.inf DrvInst.exe File opened for modification C:\Windows\INF\setupapi.dev.log DrvInst.exe File opened for modification C:\Windows\INF\setupapi.dev.log updater.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Checks SCSI registry key(s) 3 TTPs 48 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Filters DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\UpperFilters DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\LowerFilters DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\CompatibleIDs DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002 DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Service DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000 DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 updater.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A\ updater.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 updater.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A updater.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\LowerFilters DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Filters DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Phantom DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001 DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A updater.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A updater.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\UpperFilters DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Filters DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000 DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\LowerFilters DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Filters DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\CompatibleIDs DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A\ updater.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A updater.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000 updater.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Phantom DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Service DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A\ updater.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Service DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Service DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\LowerFilters DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 updater.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A\ updater.exe - Modifies data under HKEY_USERS 41 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs DrvInst.exe - Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeRestorePrivilege 3336 DrvInst.exe Token: SeBackupPrivilege 3336 DrvInst.exe Token: SeLoadDriverPrivilege 3336 DrvInst.exe Token: SeLoadDriverPrivilege 3336 DrvInst.exe Token: SeLoadDriverPrivilege 3336 DrvInst.exe Token: SeLoadDriverPrivilege 5912 updater.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 2868 wrote to memory of 4532 2868 BNyaYC8QcT.exe 89
Processes
-
C:\Users\Admin\AppData\Local\Temp\BNyaYC8QcT.exe"C:\Users\Admin\AppData\Local\Temp\BNyaYC8QcT.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2868 -
C:\Users\Admin\AppData\Local\Temp\BNyaYC8QcT.exe"C:\Users\Admin\AppData\Local\Temp\BNyaYC8QcT.exe" --ensure-updater-service --source-updater "C:\Users\Admin\AppData\Local\Temp\updater-2868-240754343.exe" --result-file "C:\Users\Admin\AppData\Local\Temp\svcsetup-2868.tmp" --component-version "1.1.4"2⤵PID:4532
-
-
C:\ProgramData\pvupdater\updater.exe"C:\ProgramData\pvupdater\updater.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:5912
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "4" "9" "C:\Windows\Temp\7b00815215490b04b8da6e9603ff781bd57df655d4dfc69d55d6fb766c476bd0\wintun.inf" "9" "403264467" "00000000000000E0" "Service-0x0-3e7$\Default" "0000000000000178" "208" "C:\Windows\Temp\7b00815215490b04b8da6e9603ff781bd57df655d4dfc69d55d6fb766c476bd0"1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
PID:4636
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "1" "0" "SWD\Wintun\{6864B697-3AD7-4C89-BF7A-C494FC63A76A}" "" "" "4d69f6b7f" "0000000000000000" "bc1d"1⤵
- Drops file in Drivers directory
- Drops file in System32 directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:3336
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\ProgramData\pvupdater\wintun.dll
- Size 417KB
- SHA256 e5da8447dc2c320edc0fc52fa01885c103de8c118481f683643cacc3220dafce
- MD5 e861eb5789c50997d9476a6172d1c269
- SHA1 647eb6588b149efe2477fd192c8cab74d018d8ef
- SHA512 d8b49a6834c1ea5d73fee6979c59def18900c86d598ea900ab741ce71eefdaaadb4862afefa14e6cc093007eae5d4325857633549f1ade555baa0344b18e6112
- SSDEEP 6144:uNsLgQtz9nDZL4tFDjiaOE1DfsnyDQhWmnPIt:iggQh9nD2tFviW4/Qt
- TLSH T1E2947D8273E81C96E9F3CB3889638901EB3779544770CADF1261826DDE6B7D09E34B61
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\svcsetup-2868.tmp
- Size 2B
- SHA256 565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3
- MD5 e0aa021e21dddbd6d8cecec71e9cf564
- SHA1 9ce3bd4224c8c1780db56b4125ecf3f24bf748b7
- SHA512 900110c951560eff857b440e89cc29f529416e0e3b3d7f0ad51651bfdbd8025b91768c5ed7db5352d1a5523354ce06ced2c42047e33a3e958a1bba5f742db874
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\updater-2868-240754343.exe
- Size 5.8MB
- SHA256 ea8f23189dcfce8966f7b90b51dc906d1654ca5dba65358cc0622a95bbc2f196
- MD5 c768510ae00da5633bd61039dd21fc56
- SHA1 5db33552103491a161d3ef896b1dc7bbf880f7a9
- SHA512 d95f7b5dc76b6eb28e05a3b51a5ddac080e6ede1d8b95d2784a8263b1164ad031cb601486a35069bf32fb813b015abb5129e2cb05e6646b062fcd929a120fae5
- SSDEEP 98304:FGs+EMdl0kV8YoNAyJGa27iVEJUbt3SXcYY6fJolGy1ntZ:FQdlT8NjJq0Rb9ccYY0AZ
- TLSH T103561202B9E420B6D4F3D1339FE38656F1A270125762CE9F23854A025E22FD55F2BB76
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\DriverStore\FileRepository\wintun.inf_amd64_8ed20477a29aa8f7.ini
- Size 415B
- SHA256 aee0114bea51452e5f8e0a641e835a989540f333179c44578c99cd9fa830c2c0
- MD5 6ab178e45a576f1f0c27b0e5a5e6aa36
- SHA1 f526c19fb0409677652201f095aacf969927e059
- SHA512 d22a5a32e72e04431f29116027f010052e0f664fd73d35ae2dfa62c370444b7704c9e74d43c00510e94285c4ccc5a2a250d7215f92f555349707f376b0ce4a67
- TLSH T1C3E02BE52128888DB241C411B905BB24CA5D706641A6E63D33E510AC4B037575E0D8F0
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\Temp\7B0081~1\wintun.cat
- Size 9KB
- SHA256 8341392ff3ee5895c56ec900d56b1e7ebdfef4a1fafdd9265870b1e6e37c7946
- MD5 c2e6e0c40e3af1a9cddd25ba17c9bb36
- SHA1 d71050a78d0888dd670ad8fcafc8cc43d3ce344f
- SHA512 bc13b18407eadbe093979aed924b2c07e90625db12bb32c13db035d429dfa831d65e1e27c2d603cf5c03d74a2a5f4dae25ce20a0ecc787d7d37a72b6f0cb9fd0
- SSDEEP 192:/tWqfX2YCJCnXooyKfPFWQFqmsxWj21EhqnajKsLEg:FPCyrPFRMoqslGsYg
- TLSH T1D32208E289BC5483ED636DA043E8E5A7BC3D67C7281055B910DBF7A10D937C6E70942D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Temp\7B0081~1\wintun.sys
- Size 28KB
- SHA256 1a7bb3555c5419befb1a5f54267dcae9a7af16749ddf4eef9b431fcf0b863110
- MD5 43d91124fe8112d0027842824dad7326
- SHA1 1e0dd7b0d0c0b880bf6864134d1e792e80e875fc
- SHA512 6a51ad090239567052186e450425a026d15cb6870e3824d1d651f001107d8c20b8e4e4324026c155ada9b8e23e18a89dca794f8e17334a673b43af2b6619f8e0
- SSDEEP 384:P1Bx5rLKocjGgMnwOpvoM4uEO8x02L4lfutekUJAP5mUFK+N+qL3orPFRXXlKqf:HDnwOloM4uF9fuUan+g3cbXn
- TLSH T1F2D26DD3E66C14C2E236C57682F1D9837D78B0721B12A2FF9550DA660EA7BC0D234936
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Temp\7b00815215490b04b8da6e9603ff781bd57df655d4dfc69d55d6fb766c476bd0\wintun.inf
- Size 1KB
- SHA256 0181e3af3e45efd36fa74de8245103c2c93ffc01e896dd4235f55d89e26d64b3
- MD5 001c9ccc674d9d16dc371d075beeb05f
- SHA1 ebe7fed368867bb40a3cca92a87457d765ed15ea
- SHA512 8ad00678eb1428d4d0689500d675764a992b76332c1254a163d06614af268b75581b62db560a768f9a23562ba92a226eb01157c03af97875fa2994e8df115ae3
- TLSH T1413166D994E10D293CD3322D73277F82E55C223041D6201EB5BD8559D60BCDFA744CAA
- MD5 SHA1 SHA512 TLSH