Analysis
- user interaction
yes - max time kernel
210s - max time network
193s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
21/07/2026, 16:49
Static task
static1
Behavioral task
behavioral1
Sample
vac4.65/setup64.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
vac4.65/setup64.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target vac4.65/setup64.exe
- Size 136KB
- Sample260721-vb6ebser31
- SHA256 d9ff7eb0f7536c199e9e6bccd5da2b7dd52e4894b03d22257518faf224b174b1
- MD5 c5f79a0e4c19a6beffc73da5285ed712
- SHA1 0e41f62ce7b5dec2f46b57f6d6e0a06e663b8012
- SHA512 c545198c04d7ca8501cdf46fb159374ba420908d2fdbab4c112e0afcd29b831e4065d888431d02b031631b8d0c5b105a38f6fb937d6996a7eef14855627b31bf
- SSDEEP 3072:r1JUYrr64PE7PEwkNBgHMcnL8zsHMOY4jb0r0Q:SAwkNSpL2sU4jxQ
- TLSH T19BD34F8077F80668F6B6AF75ADB401269A727C959F34C2CF1225C94E2D62BC4D874B33
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
Malware Config
Signatures
- Drops file in Drivers directory 6 IoCs
description ioc Process File opened for modification C:\Windows\System32\drivers\drmk.sys DrvInst.exe File opened for modification C:\Windows\System32\drivers\portcls.sys DrvInst.exe File created C:\Windows\System32\Drivers\vrtaucbl.sys setup64.exe File opened for modification C:\Windows\System32\drivers\SET4F44.tmp DrvInst.exe File created C:\Windows\System32\drivers\SET4F44.tmp DrvInst.exe File opened for modification C:\Windows\System32\drivers\vrtaucbl.sys DrvInst.exe - Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\Control Panel\International\Geo\Nation setup64.exe - Drops file in System32 directory 17 IoCs
description ioc Process File created C:\Windows\System32\DriverStore\FileRepository\vrtaucbl.inf_amd64_7dc9aa85a9f9ca87\vrtaucbl.PNF setup64.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{5074ab36-56e1-1b41-8452-1ecdefcf798a}\vrtaucbl.cat DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\vrtaucbl.inf_amd64_7dc9aa85a9f9ca87\vrtaucbl.inf DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{5074ab36-56e1-1b41-8452-1ecdefcf798a}\SET4CD4.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\vrtaucbl.inf_amd64_7dc9aa85a9f9ca87\vrtaucbl.cat DrvInst.exe File opened for modification C:\Windows\System32\CatRoot2\dberr.txt DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{5074ab36-56e1-1b41-8452-1ecdefcf798a}\x64\SET4CB4.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{5074ab36-56e1-1b41-8452-1ecdefcf798a}\x64\vrtaucbl.sys DrvInst.exe File created C:\Windows\System32\DriverStore\Temp\{5074ab36-56e1-1b41-8452-1ecdefcf798a}\SET4CD4.tmp DrvInst.exe File created C:\Windows\System32\DriverStore\Temp\{5074ab36-56e1-1b41-8452-1ecdefcf798a}\SET4CF4.tmp DrvInst.exe File created C:\Windows\System32\DriverStore\drvstore.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\vrtaucbl.inf_amd64_7dc9aa85a9f9ca87\x64\vrtaucbl.sys DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{5074ab36-56e1-1b41-8452-1ecdefcf798a}\x64 DrvInst.exe File created C:\Windows\System32\DriverStore\Temp\{5074ab36-56e1-1b41-8452-1ecdefcf798a}\x64\SET4CB4.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{5074ab36-56e1-1b41-8452-1ecdefcf798a}\SET4CF4.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{5074ab36-56e1-1b41-8452-1ecdefcf798a}\vrtaucbl.inf DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{5074ab36-56e1-1b41-8452-1ecdefcf798a} DrvInst.exe - Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Drops file in Program Files directory 14 IoCs
description ioc Process File created C:\Program Files\Virtual Audio Cable\vac.chm setup64.exe File created C:\Program Files\Virtual Audio Cable\readme.txt setup64.exe File created C:\Program Files\Virtual Audio Cable\homepage.url setup64.exe File created C:\Program Files\Virtual Audio Cable\delsettings.cmd setup64.exe File created C:\Program Files\Virtual Audio Cable\delservice.cmd setup64.exe File created C:\Program Files\Virtual Audio Cable\vcctlpan.exe setup64.exe File created C:\Program Files\Virtual Audio Cable\audiorepeater_ks.exe setup64.exe File created C:\Program Files\Virtual Audio Cable\install.log setup64.exe File created C:\Program Files\Virtual Audio Cable\license.txt setup64.exe File created C:\Program Files\Virtual Audio Cable\setvars.cmd setup64.exe File created C:\Program Files\Virtual Audio Cable\audiorepeater.exe setup64.exe File created C:\Program Files\Virtual Audio Cable\setup64.exe setup64.exe File created C:\Program Files\Virtual Audio Cable\uninst.ini setup64.exe File opened for modification C:\Program Files\Virtual Audio Cable\uninst.ini setup64.exe - Drops file in Windows directory 6 IoCs
description ioc Process File opened for modification C:\Windows\INF\setupapi.dev.log DrvInst.exe File opened for modification C:\Windows\inf\oem3.inf DrvInst.exe File created C:\Windows\inf\oem3.inf DrvInst.exe File opened for modification C:\Windows\INF\setupapi.dev.log DrvInst.exe File opened for modification C:\Windows\INF\setupapi.dev.log setup64.exe File opened for modification C:\Windows\INF\setupapi.dev.log svchost.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Checks SCSI registry key(s) 3 TTPs 42 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Phantom DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID setup64.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Phantom DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags setup64.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID setup64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002 setup64.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags setup64.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID setup64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000 DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs setup64.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\CompatibleIDs setup64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000 setup64.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\CompatibleIDs setup64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\CompatibleIDs DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom setup64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002 DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 setup64.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID setup64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001 DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001 setup64.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom setup64.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs setup64.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\CompatibleIDs DrvInst.exe - Modifies data under HKEY_USERS 41 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates DrvInst.exe - Suspicious use of AdjustPrivilegeToken 15 IoCs
description pid Process Token: SeLoadDriverPrivilege 64 setup64.exe Token: SeShutdownPrivilege 64 setup64.exe Token: SeAuditPrivilege 516 svchost.exe Token: SeSecurityPrivilege 516 svchost.exe Token: SeLoadDriverPrivilege 64 setup64.exe Token: SeRestorePrivilege 3660 DrvInst.exe Token: SeBackupPrivilege 3660 DrvInst.exe Token: SeRestorePrivilege 3660 DrvInst.exe Token: SeBackupPrivilege 3660 DrvInst.exe Token: SeRestorePrivilege 3660 DrvInst.exe Token: SeBackupPrivilege 3660 DrvInst.exe Token: SeLoadDriverPrivilege 3660 DrvInst.exe Token: SeLoadDriverPrivilege 3660 DrvInst.exe Token: SeLoadDriverPrivilege 3660 DrvInst.exe Token: SeLoadDriverPrivilege 64 setup64.exe - Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 516 wrote to memory of 5060 516 svchost.exe 92 PID 516 wrote to memory of 3660 516 svchost.exe 93 PID 64 wrote to memory of 3900 64 setup64.exe 105 PID 3900 wrote to memory of 3972 3900 control.exe 106
Processes
-
C:\Users\Admin\AppData\Local\Temp\vac4.65\setup64.exe"C:\Users\Admin\AppData\Local\Temp\vac4.65\setup64.exe"1⤵
- Drops file in Drivers directory
- Checks computer location settings
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:64 -
C:\Windows\System32\control.exe"C:\Windows\System32\control.exe" mmsys.cpl2⤵
- Suspicious use of WriteProcessMemory
PID:3900 -
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL mmsys.cpl3⤵PID:3972
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall1⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:516 -
C:\Windows\system32\DrvInst.exeDrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{cd827f23-9224-bb4e-a8ae-5d54a224795c}\vrtaucbl.inf" "9" "4646d1453" "0000000000000154" "WinSta0\Default" "000000000000016C" "208" "c:\users\admin\appdata\local\temp\vac4.65"2⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
PID:5060
-
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "2" "11" "ROOT\{83ED7F0E-2028-4956-B0B4-39C76FDAEF1D}\0000" "C:\Windows\INF\oem3.inf" "oem3.inf:a52522ad0c48fa1f:DevInst:4.65.0.11535:virtualaudiocable_83ed7f0e-2028-4956-b0b4-39c76fdaef1d," "4646d1453" "0000000000000170"2⤵
- Drops file in Drivers directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:3660
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\Virtual Audio Cable\setup64.exe
- Size 136KB
- SHA256 d9ff7eb0f7536c199e9e6bccd5da2b7dd52e4894b03d22257518faf224b174b1
- MD5 c5f79a0e4c19a6beffc73da5285ed712
- SHA1 0e41f62ce7b5dec2f46b57f6d6e0a06e663b8012
- SHA512 c545198c04d7ca8501cdf46fb159374ba420908d2fdbab4c112e0afcd29b831e4065d888431d02b031631b8d0c5b105a38f6fb937d6996a7eef14855627b31bf
- SSDEEP 3072:r1JUYrr64PE7PEwkNBgHMcnL8zsHMOY4jb0r0Q:SAwkNSpL2sU4jxQ
- TLSH T19BD34F8077F80668F6B6AF75ADB401269A727C959F34C2CF1225C94E2D62BC4D874B33
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Virtual Audio Cable\uninst.ini
- Size 4KB
- SHA256 85ee480862249d983941c46dd9daa69bbb10ac1147af61fce05150d8823fdabd
- MD5 2446f070374e5a63d5109233c81c3e68
- SHA1 7b935eafd81425e45f83572bb93117ccda4905c1
- SHA512 82c55d60013fd23664a43a3dc61a76e7102314b8fc87eff1a44d392b134e3c8135472bb8cc7069dad1c473f8443c56db8ae0a6642a7c691064a69b08fb2c9945
- SSDEEP 96:NtcU5+i01M1E1M1T1X1vw101c9p1N1lm1l9V1R1hMsCjMsCj/sCjExsCj9FsCjbU:NtMr6yKRFFwiKrPGdVjYM/W9Fbk0JWHn
- TLSH T1E491287297F94214F3F79ED6BE7199290F77F972AE34E96E8088158C0CB2620C521793
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\{CD827~1\vrtaucbl.cat
- Size 11KB
- SHA256 6d0e104d75eea33cd8137223ddbd92c9dff3eda2bec5d97e7b44214669ffe0f9
- MD5 a81b3326c2b4dd35e8d42dab377d8afa
- SHA1 fa4bf6db9bb980396bdce04313d3e512016b43e4
- SHA512 35051bcd059984a196c04a8532d5e05c2cd4c34431d7b15136e5dc67c0d4831ca410e16fa8af97bb3476b7ee0a14fee66054ebd5418dca3b9d090b2a11afd0e4
- SSDEEP 192:iS3bZgolwL+bJC4Gp5UEwQl/WGhYCMRXqCE0qnajTAMZZ:iElglM7Gpzlnh32aCl3A6
- TLSH T16232F7A249A84083E963ACB013E4F997BD3E77CB28104159346FF72A0DA37C1F71866C
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\{CD827~1\x64\vrtaucbl.sys
- Size 219KB
- SHA256 d3b8219f346289cbe0bc09a7705e68c362e7523b4cc49f2e77ee91d3a5d10c7f
- MD5 1f497b2948eefa06c1838e0ff2f490a1
- SHA1 5b0e55ba72d8746ede0b1c99ed60db67d1f5a46d
- SHA512 7723ddb85bdcd870ed4ff17c62ce5bd5187c6ff559927da35aee50f273ee14c03dfe898e402950bad86436fd27731d900c2438e0961b2860be45c60f2cc98d83
- SSDEEP 3072:Wdck3CoSFZvrwpQK5+P23f20+VQOWrmAusmGe8WBX2tH3ya/S7F0u0l:7kyoVe24SHtkp8W29u0l
- TLSH T19F241A4572B90CA5F5F6B678CAA14A06FA71F480173993CF3310A7791E2FBD4AA35320
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\{cd827f23-9224-bb4e-a8ae-5d54a224795c}\vrtaucbl.inf
- Size 2KB
- SHA256 c8cc71ce2619a54517d3c990d6d7a2ddef4c24b05b8639c291fd6fb3d0d41da1
- MD5 81de14aa72f299354bd0f0a7f04dca41
- SHA1 22c139dce960c3efbffd5f57b5171d6650e7a711
- SHA512 b0c4eb9d9ec26520e9d9247fcf6b29e53100acd4a2035fc4941e2c3c1bee3f7ad7ef7652117e0cce5fe6e8747cca0842f58c64f8b43fad4f7434e8fb0d102e0e
- TLSH T1255122AE86A71A402307793D7E131D827BA12560DD3B1009BEEC4B48E9DCB8C95958FF
- MD5 SHA1 SHA512 TLSH