56d043a791def60f7f619ca93a1efc03419e1dd71e3c8b97decebcc1ad89f90f

Analysis

max time kernel
150s
max time network
155s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/07/2026, 01:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
MSsetup.exe
Size 7.3MB
Sample260730-bja4lswepf
SHA256 56d043a791def60f7f619ca93a1efc03419e1dd71e3c8b97decebcc1ad89f90f
MD5 bb7e2dee53a4bc17ce47dcf91a32a8d8
SHA1 c97885f4a6f802bc93498fb9ad86a4df8647f7f6
SHA512 51175e7becd6c992b0187575c072639b7c3189f973735fd2900c9cf83218dfedabd267cc4b6b52f28884a0b791b455e7d137e6dbc9e05ab4d59a803f124507e0
SSDEEP 196608:o0DiBKen57LpFX0ljoUkmGl/2jfXzSuerc6m7L:oBT77E6mqkmuerP+
TLSH
T1D476339C73049F22F13D8970CAF19703CC9E41351E2239937782A7F1A65BFD29A95AD8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

adware discovery execution installer persistence privilege_escalation spyware stealer

Malware Config

Signatures

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Executes dropped EXE 6 IoCs

pid	Process
3976	MSTeamsSetup.exe
5880	Update.exe
5796	zgqmQcC2.exe
3984	zgqmQcC2.tmp
5592	MicrosoftPhotos.exe
3084	MicrosoftPhotos.exe

Loads dropped DLL 11 IoCs

pid	Process
6080	MSsetup.exe
6080	MSsetup.exe
6080	MSsetup.exe
3984	zgqmQcC2.tmp
5420	MsiExec.exe
5420	MsiExec.exe
1744	rundll32.exe
5420	MsiExec.exe
5420	MsiExec.exe
5420	MsiExec.exe
5420	MsiExec.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\Teams = "\"C:\\Users\\Admin\\AppData\\Local\\Microsoft\\WindowsApps\\MSTeams_8wekyb3d8bbwe\\ms-teams.exe\" msteams:system-initiated"	ms-teams.exe

Enumerates connected drives 3 TTPs 45 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\D:	MicrosoftPhotos.exe
File opened (read-only)	\??\G:	MicrosoftPhotos.exe
File opened (read-only)	\??\M:	MicrosoftPhotos.exe
File opened (read-only)	\??\O:	MicrosoftPhotos.exe
File opened (read-only)	\??\Q:	MicrosoftPhotos.exe
File opened (read-only)	\??\R:	MicrosoftPhotos.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\P:	MicrosoftPhotos.exe
File opened (read-only)	\??\X:	MicrosoftPhotos.exe
File opened (read-only)	\??\Z:	MicrosoftPhotos.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\B:	MicrosoftPhotos.exe
File opened (read-only)	\??\I:	MicrosoftPhotos.exe
File opened (read-only)	\??\J:	MicrosoftPhotos.exe
File opened (read-only)	\??\N:	MicrosoftPhotos.exe
File opened (read-only)	\??\S:	MicrosoftPhotos.exe
File opened (read-only)	\??\U:	MicrosoftPhotos.exe
File opened (read-only)	\??\Y:	MicrosoftPhotos.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\K:	MicrosoftPhotos.exe
File opened (read-only)	\??\T:	MicrosoftPhotos.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\L:	MicrosoftPhotos.exe
File opened (read-only)	\??\V:	MicrosoftPhotos.exe
File opened (read-only)	\??\W:	MicrosoftPhotos.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\H:	MicrosoftPhotos.exe
File opened (read-only)	\??\L:	msiexec.exe

Looks up external IP address via web service 1 TTPs 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
1	api64.ipify.org

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs

execution

Visual Basic

T1059.005

pid	Process
5828	cscript.exe

Drops file in Windows directory 19 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4220_918907257\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4220_918907257\Microsoft.CognitiveServices.Speech.core.dll	msedgewebview2.exe
File created	C:\Windows\Installer\e5a39b3.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI445D.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI4577.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI5400.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DF5CBEF09197E9728D.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\e5a39af.msi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{A7AB73A3-CB10-4AA5-9D38-6AEFFBDE4C91}	msiexec.exe
File created	C:\Windows\SystemTemp\~DF36E492260BDB07F2.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4220_918907257\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\Installer\e5a39af.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File created	C:\Windows\SystemTemp\~DFD2E5D9B1B5F55C85.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DFE2778D5822019BDB.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI479B.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI56C0.tmp	msiexec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 10 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSsetup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cscript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSTeamsSetup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Update.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zgqmQcC2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zgqmQcC2.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftPhotos.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe

Inno Setup is an open-source installation builder for Windows applications. 3 IoCs

Inno Setup installer

installer

resource	yara_rule
behavioral2/files/0x000f00000001c580-56.dat	innosetup
behavioral2/memory/5796-57-0x0000000000500000-0x00000000005D8000-memory.dmp	innosetup
behavioral2/memory/5796-500-0x0000000000500000-0x00000000005D8000-memory.dmp	innosetup

Checks SCSI registry key(s) 3 TTPs 48 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	ms-teams.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	ms-teams.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	ms-teams.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	ms-teams.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{a35996ab-11cf-4935-8b61-a6761081ecdf}\000F	ms-teams.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A\	ms-teams.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	ms-teams.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	ms-teams.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	ms-teams.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	ms-teams.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0008	ms-teams.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	ms-teams.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	ms-teams.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	ms-teams.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	ms-teams.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0008	ms-teams.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	ms-teams.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	ms-teams.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	ms-teams.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	ms-teams.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	ms-teams.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	ms-teams.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0008	ms-teams.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{a35996ab-11cf-4935-8b61-a6761081ecdf}\000F	ms-teams.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	ms-teams.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	ms-teams.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	ms-teams.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	ms-teams.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	ms-teams.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A	ms-teams.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{a35996ab-11cf-4935-8b61-a6761081ecdf}\000F	ms-teams.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	ms-teams.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	ms-teams.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	ms-teams.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	ms-teams.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A	ms-teams.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A\	ms-teams.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	ms-teams.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	ms-teams.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{a35996ab-11cf-4935-8b61-a6761081ecdf}\000F	ms-teams.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0008	ms-teams.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	ms-teams.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	ms-teams.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	ms-teams.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	ms-teams.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	ms-teams.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	ms-teams.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	ms-teams.exe

Checks processor information in registry 2 TTPs 26 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz	ms-teams.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ms-teamsupdate.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	ms-teamsupdate.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString	ms-teamsupdate.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ms-teamsupdate.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString	ms-teams.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	MicrosoftPhotos.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ms-teams.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ms-teams.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString	ms-teams.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ms-teamsupdate.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	ms-teamsupdate.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ms-teams.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz	ms-teams.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	MicrosoftPhotos.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz	ms-teamsupdate.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	ms-teams.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	ms-teams.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	ms-teamsupdate.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz	ms-teamsupdate.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ms-teamsupdate.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	ms-teamsupdate.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString	ms-teamsupdate.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	ms-teams.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ms-teams.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	ms-teams.exe

Enumerates system info in registry 2 TTPs 5 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\Bios	ms-teams.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	ms-teams.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe

Modifies Internet Explorer settings 1 TTPs 4 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\Registry\user\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Internet Explorer\ProtocolExecute\msteams	ms-teams.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Internet Explorer\ProtocolExecute\msteams\WarnOnOpen = "0"	ms-teams.exe
Key created	\Registry\user\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Internet Explorer\ProtocolExecute\ms-teams	ms-teams.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Internet Explorer\ProtocolExecute\ms-teams\WarnOnOpen = "0"	ms-teams.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\TypeLib\{C0529B10-073A-4754-9BB0-72325D80D122}\1.0\FLAGS	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\CLSID\{EABAE40C-B27C-455A-B672-F234DD780948}\InprocServer32\1.26.16801\CodeBase = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\TeamsMeetingAdd-in\\1.26.16801\\x64\\Microsoft.Teams.MeetingAddin.DLL"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\ms-teams\shell\open	ms-teams.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\TypeLib\{C0529B10-073A-4754-9BB0-72325D80D122}\1.0\HELPDIR\ = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\TeamsMeetingAdd-in\\1.26.16801\\x64\\"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\WOW6432Node\TypeLib\{C0529B10-073A-4754-9BB0-72325D80D122}	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\WOW6432Node\CLSID\{19A6E644-14E6-4A60-B8D7-DD20610A871D}\TypeLib	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\WOW6432Node\CLSID\{EABAE40C-B27C-455A-B672-F234DD780948}\Implemented Categories	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\CLSID\{19A6E644-14E6-4A60-B8D7-DD20610A871D}\VersionIndependentProgID	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\CLSID\{19A6E644-14E6-4A60-B8D7-DD20610A871D}\InprocServer32\ThreadingModel = "Apartment"	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\CLSID\{EABAE40C-B27C-455A-B672-F234DD780948}\InprocServer32\Codebase = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\TeamsMeetingAdd-in\\1.26.16801\\x64\\Microsoft.Teams.MeetingAddin.DLL"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\TypeLib\{C0529B10-073A-4754-9BB0-72325D80D122}\1.0\HELPDIR	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\CLSID\{19A6E644-14E6-4A60-B8D7-DD20610A871D}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\TeamsMeetingAdd-in\\1.26.16801\\x64\\Microsoft.Teams.AddinLoader.dll"	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\CLSID\{EABAE40C-B27C-455A-B672-F234DD780948}\InprocServer32\Assembly = "Microsoft.Teams.MeetingAddin, Version=1.26.16801, Culture=neutral, PublicKeyToken=null"	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\CLSID\{EABAE40C-B27C-455A-B672-F234DD780948}\InprocServer32\1.26.16801\RuntimeVersion = "v4.0.30319"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\TeamsAddin.FastConnect.1\CLSID	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\	MSsetup.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\msteams_8wekyb3d8bbwe\Internet Settings\Cache	ms-teams.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\CLSID\{19A6E644-14E6-4A60-B8D7-DD20610A871D}\Version	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\CLSID\{EABAE40C-B27C-455A-B672-F234DD780948}\InprocServer32\ThreadingModel = "Apartment"	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\CLSID\{EABAE40C-B27C-455A-B672-F234DD780948}\InprocServer32\RuntimeVersion = "v4.0.30319"	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\CLSID\{EABAE40C-B27C-455A-B672-F234DD780948}\InprocServer32\1.26.16801\Class = "Microsoft.Teams.MeetingAddin.View.Controls.MeetingOptionsControl"	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\TeamsAddin.Connect\CurVer\ = "TeamsAddin.Connect.1"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\WOW6432Node\CLSID\{19A6E644-14E6-4A60-B8D7-DD20610A871D}	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\CLSID\{EABAE40C-B27C-455A-B672-F234DD780948}\ = "Microsoft.Teams.MeetingAddin.View.Controls.MeetingOptionsControl"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\WOW6432Node\TypeLib\{C0529B10-073A-4754-9BB0-72325D80D122}\1.0\HELPDIR	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\WOW6432Node\TypeLib\{C0529B10-073A-4754-9BB0-72325D80D122}\1.0\HELPDIR\ = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\TeamsMeetingAdd-in\\1.26.16801\\x86\\"	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\WOW6432Node\CLSID\{19A6E644-14E6-4A60-B8D7-DD20610A871D}\Version\ = "1.0"	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\WOW6432Node\CLSID\{19A6E644-14E6-4A60-B8D7-DD20610A871D}\ = "FastConnect Class"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\WOW6432Node\CLSID\{EABAE40C-B27C-455A-B672-F234DD780948}\Implemented Categories\{62C8FE65-4EBB-45e7-B440-6E39B2CDBF29}	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\msteams\shell\open\command	ms-teams.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\TeamsAddin.FastConnect\CurVer\FriendlyName = "Microsoft Teams Meeting Add-in for Microsoft Office"	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\TypeLib\{C0529B10-073A-4754-9BB0-72325D80D122}\1.0\ = "AddinLoaderLib"	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Microsoft.Teams.Meeting.Addin.MOControl\ = "Microsoft.Teams.MeetingAddin.View.Controls.MeetingOptionsControl"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\CLSID\{19A6E644-14E6-4A60-B8D7-DD20610A871D}\InprocServer32	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Microsoft.Teams.Meeting.Addin.MOControl\CLSID	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\WOW6432Node\CLSID\{EABAE40C-B27C-455A-B672-F234DD780948}\InprocServer32\1.26.16801\Class = "Microsoft.Teams.MeetingAddin.View.Controls.MeetingOptionsControl"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\TeamsAddin.FastConnect\CurVer	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\TypeLib\{C0529B10-073A-4754-9BB0-72325D80D122}\1.0\FLAGS\ = "0"	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\TeamsAddin.Connect.1\ = "Connect Class"	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\WOW6432Node\CLSID\{19A6E644-14E6-4A60-B8D7-DD20610A871D}\InprocServer32\ThreadingModel = "Apartment"	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\TypeLib\{C0529B10-073A-4754-9BB0-72325D80D122}\1.0\0\win32\ = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\TeamsMeetingAdd-in\\1.26.16801\\x86\\Microsoft.Teams.AddinLoader.dll"	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\CLSID\{EABAE40C-B27C-455A-B672-F234DD780948}\InprocServer32\ = "mscoree.dll"	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\WOW6432Node\CLSID\{EABAE40C-B27C-455A-B672-F234DD780948}\InprocServer32\Assembly = "Microsoft.Teams.MeetingAddin, Version=1.26.16801, Culture=neutral, PublicKeyToken=null"	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\CLSID\{19A6E644-14E6-4A60-B8D7-DD20610A871D}\ProgID\ = "TeamsAddin.FastConnect.1"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\TeamsAddin.Connect	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\WOW6432Node\CLSID\{19A6E644-14E6-4A60-B8D7-DD20610A871D}\VersionIndependentProgID	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\CLSID\{19A6E644-14E6-4A60-B8D7-DD20610A871D}\TypeLib\ = "{C0529B10-073A-4754-9BB0-72325D80D122}"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\ms-teams\shell	ms-teams.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\MSTeams_8wekyb3d8bbwe\TeamsTfwStartupTask\UserEnabledStartupOnce = "0"	Update.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\TypeLib\{C0529B10-073A-4754-9BB0-72325D80D122}\1.0	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\WOW6432Node\CLSID\{EABAE40C-B27C-455A-B672-F234DD780948}\InprocServer32\1.26.16801\Runtime = "v4.0.30319"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\MSTeams_8wekyb3d8bbwe	Update.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Microsoft.Teams.Meeting.Addin.MOControl	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\TeamsAddin.FastConnect.1\CLSID\ = "{19A6E644-14E6-4A60-B8D7-DD20610A871D}"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\WOW6432Node	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\msteams\shell\open	ms-teams.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\TeamsAddin.FastConnect.1\ = "FastConnect Class"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\TeamsAddin.Connect\CurVer	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\WOW6432Node\CLSID	msiexec.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\MSTeams_8wekyb3d8bbwe\TeamsTfwStartupTask\State = "2"	Update.exe
Key created	\Registry\User\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\ms-teams\shell\open\command	ms-teams.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\WOW6432Node\CLSID\{EABAE40C-B27C-455A-B672-F234DD780948}\InprocServer32\1.26.16801\CodeBase = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\TeamsMeetingAdd-in\\1.26.16801\\x86\\Microsoft.Teams.MeetingAddin.DLL"	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\WOW6432Node\CLSID\{EABAE40C-B27C-455A-B672-F234DD780948}\InprocServer32\1.26.16801\Assembly = "Microsoft.Teams.MeetingAddin, Version=1.26.16801, Culture=neutral, PublicKeyToken=null"	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\WOW6432Node\CLSID\{EABAE40C-B27C-455A-B672-F234DD780948}\InprocServer32\Class = "Microsoft.Teams.MeetingAddin.View.Controls.MeetingOptionsControl"	msiexec.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
6080	MSsetup.exe
6080	MSsetup.exe
3984	zgqmQcC2.tmp
3984	zgqmQcC2.tmp
3448	msiexec.exe
3448	msiexec.exe
5592	MicrosoftPhotos.exe
5592	MicrosoftPhotos.exe
5592	MicrosoftPhotos.exe
5592	MicrosoftPhotos.exe
5592	MicrosoftPhotos.exe
5592	MicrosoftPhotos.exe
5592	MicrosoftPhotos.exe
5592	MicrosoftPhotos.exe
5592	MicrosoftPhotos.exe
5592	MicrosoftPhotos.exe
5592	MicrosoftPhotos.exe
5592	MicrosoftPhotos.exe
5592	MicrosoftPhotos.exe
5592	MicrosoftPhotos.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
4220	msedgewebview2.exe
4220	msedgewebview2.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	5880	Update.exe
Token: SeShutdownPrivilege	6024	ms-teamsupdate.exe
Token: SeIncreaseQuotaPrivilege	6024	ms-teamsupdate.exe
Token: SeSecurityPrivilege	3448	msiexec.exe
Token: SeCreateTokenPrivilege	6024	ms-teamsupdate.exe
Token: SeAssignPrimaryTokenPrivilege	6024	ms-teamsupdate.exe
Token: SeLockMemoryPrivilege	6024	ms-teamsupdate.exe
Token: SeIncreaseQuotaPrivilege	6024	ms-teamsupdate.exe
Token: SeMachineAccountPrivilege	6024	ms-teamsupdate.exe
Token: SeTcbPrivilege	6024	ms-teamsupdate.exe
Token: SeSecurityPrivilege	6024	ms-teamsupdate.exe
Token: SeTakeOwnershipPrivilege	6024	ms-teamsupdate.exe
Token: SeLoadDriverPrivilege	6024	ms-teamsupdate.exe
Token: SeSystemProfilePrivilege	6024	ms-teamsupdate.exe
Token: SeSystemtimePrivilege	6024	ms-teamsupdate.exe
Token: SeProfSingleProcessPrivilege	6024	ms-teamsupdate.exe
Token: SeIncBasePriorityPrivilege	6024	ms-teamsupdate.exe
Token: SeCreatePagefilePrivilege	6024	ms-teamsupdate.exe
Token: SeCreatePermanentPrivilege	6024	ms-teamsupdate.exe
Token: SeBackupPrivilege	6024	ms-teamsupdate.exe
Token: SeRestorePrivilege	6024	ms-teamsupdate.exe
Token: SeShutdownPrivilege	6024	ms-teamsupdate.exe
Token: SeDebugPrivilege	6024	ms-teamsupdate.exe
Token: SeAuditPrivilege	6024	ms-teamsupdate.exe
Token: SeSystemEnvironmentPrivilege	6024	ms-teamsupdate.exe
Token: SeChangeNotifyPrivilege	6024	ms-teamsupdate.exe
Token: SeRemoteShutdownPrivilege	6024	ms-teamsupdate.exe
Token: SeUndockPrivilege	6024	ms-teamsupdate.exe
Token: SeSyncAgentPrivilege	6024	ms-teamsupdate.exe
Token: SeEnableDelegationPrivilege	6024	ms-teamsupdate.exe
Token: SeManageVolumePrivilege	6024	ms-teamsupdate.exe
Token: SeImpersonatePrivilege	6024	ms-teamsupdate.exe
Token: SeCreateGlobalPrivilege	6024	ms-teamsupdate.exe
Token: SeRestorePrivilege	3448	msiexec.exe
Token: SeTakeOwnershipPrivilege	3448	msiexec.exe
Token: SeBackupPrivilege	5964	ms-teams.exe
Token: SeRestorePrivilege	3448	msiexec.exe
Token: SeTakeOwnershipPrivilege	3448	msiexec.exe
Token: SeRestorePrivilege	3448	msiexec.exe
Token: SeTakeOwnershipPrivilege	3448	msiexec.exe
Token: SeRestorePrivilege	3448	msiexec.exe
Token: SeTakeOwnershipPrivilege	3448	msiexec.exe
Token: SeRestorePrivilege	3448	msiexec.exe
Token: SeTakeOwnershipPrivilege	3448	msiexec.exe
Token: SeRestorePrivilege	3448	msiexec.exe
Token: SeTakeOwnershipPrivilege	3448	msiexec.exe
Token: SeRestorePrivilege	3448	msiexec.exe
Token: SeTakeOwnershipPrivilege	3448	msiexec.exe
Token: SeRestorePrivilege	3448	msiexec.exe
Token: SeTakeOwnershipPrivilege	3448	msiexec.exe
Token: SeRestorePrivilege	3448	msiexec.exe
Token: SeTakeOwnershipPrivilege	3448	msiexec.exe
Token: SeRestorePrivilege	3448	msiexec.exe
Token: SeTakeOwnershipPrivilege	3448	msiexec.exe
Token: SeRestorePrivilege	3448	msiexec.exe
Token: SeTakeOwnershipPrivilege	3448	msiexec.exe
Token: SeRestorePrivilege	3448	msiexec.exe
Token: SeTakeOwnershipPrivilege	3448	msiexec.exe
Token: SeRestorePrivilege	3448	msiexec.exe
Token: SeTakeOwnershipPrivilege	3448	msiexec.exe
Token: SeRestorePrivilege	3448	msiexec.exe
Token: SeTakeOwnershipPrivilege	3448	msiexec.exe
Token: SeRestorePrivilege	3448	msiexec.exe
Token: SeTakeOwnershipPrivilege	3448	msiexec.exe

Suspicious use of FindShellTrayWindow 8 IoCs

pid	Process
5880	Update.exe
5964	ms-teams.exe
5964	ms-teams.exe
3984	zgqmQcC2.tmp
5964	ms-teams.exe
5964	ms-teams.exe
5964	ms-teams.exe
5964	ms-teams.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
5964	ms-teams.exe
5964	ms-teams.exe
5964	ms-teams.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3448	msiexec.exe
5420	MsiExec.exe

Suspicious use of WriteProcessMemory 33 IoCs

description	pid	Process	procid_target
PID 6080 wrote to memory of 5828	6080	MSsetup.exe	90
PID 6080 wrote to memory of 3976	6080	MSsetup.exe	92
PID 3976 wrote to memory of 5880	3976	MSTeamsSetup.exe	93
PID 6080 wrote to memory of 5796	6080	MSsetup.exe	98
PID 5796 wrote to memory of 3984	5796	zgqmQcC2.exe	99
PID 5964 wrote to memory of 4220	5964	ms-teams.exe	102
PID 4220 wrote to memory of 2176	4220	msedgewebview2.exe	103
PID 5964 wrote to memory of 4876	5964	ms-teams.exe	106
PID 5964 wrote to memory of 6024	5964	ms-teams.exe	105
PID 4220 wrote to memory of 5136	4220	msedgewebview2.exe	107
PID 4220 wrote to memory of 5136	4220	msedgewebview2.exe	107
PID 4220 wrote to memory of 5136	4220	msedgewebview2.exe	107
PID 4220 wrote to memory of 5136	4220	msedgewebview2.exe	107
PID 4220 wrote to memory of 3952	4220	msedgewebview2.exe	108
PID 4220 wrote to memory of 2260	4220	msedgewebview2.exe	109
PID 4220 wrote to memory of 2260	4220	msedgewebview2.exe	109
PID 4220 wrote to memory of 2260	4220	msedgewebview2.exe	109
PID 4220 wrote to memory of 3668	4220	msedgewebview2.exe	110
PID 4220 wrote to memory of 3668	4220	msedgewebview2.exe	110
PID 4220 wrote to memory of 3668	4220	msedgewebview2.exe	110
PID 4220 wrote to memory of 3668	4220	msedgewebview2.exe	110
PID 4220 wrote to memory of 3668	4220	msedgewebview2.exe	110
PID 4220 wrote to memory of 1836	4220	msedgewebview2.exe	112
PID 4220 wrote to memory of 1836	4220	msedgewebview2.exe	112
PID 4220 wrote to memory of 1836	4220	msedgewebview2.exe	112
PID 4220 wrote to memory of 1836	4220	msedgewebview2.exe	112
PID 4220 wrote to memory of 1836	4220	msedgewebview2.exe	112
PID 3448 wrote to memory of 5420	3448	msiexec.exe	120
PID 5592 wrote to memory of 5936	5592	MicrosoftPhotos.exe	121
PID 4576 wrote to memory of 1744	4576	rundll32.exe	123
PID 4220 wrote to memory of 5924	4220	msedgewebview2.exe	126
PID 4220 wrote to memory of 5924	4220	msedgewebview2.exe	126
PID 4220 wrote to memory of 5924	4220	msedgewebview2.exe	126

C:\Users\Admin\AppData\Local\Temp\MSsetup.exe
"C:\Users\Admin\AppData\Local\Temp\MSsetup.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:6080
- C:\Windows\SysWOW64\cscript.exe
  cscript.exe /nologo "C:\Users\Admin\AppData\Roaming\Quh54cfx\adddf.vbe" C:\
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  - System Location Discovery: System Language Discovery
  PID:5828
- C:\Users\Admin\AppData\Local\Temp\genteeC7\MSTeamsSetup.exe
  "C:\Users\Admin\AppData\Local\Temp\genteeC7\MSTeamsSetup.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3976
- - C:\Users\Admin\AppData\Local\SquirrelTemp\Update.exe
    "C:\Users\Admin\AppData\Local\SquirrelTemp\Update.exe" --install . --exeName=MSTeamsSetup.exe --bootstrapperMode
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    PID:5880
  - - C:\Program Files\WindowsApps\MSTeams_26183.1903.4892.4448_x64__8wekyb3d8bbwe\ms-teams.exe
      "C:\Program Files\WindowsApps\MSTeams_26183.1903.4892.4448_x64__8wekyb3d8bbwe\ms-teams.exe" msteams:?instVersion=3.7.16&instExecTime=1785373849425&launchSrc=t2installer
      4⤵
      Adds Run key to start application
      Checks SCSI registry key(s)
      Checks processor information in registry
      Enumerates system info in registry
      Modifies Internet Explorer settings
      Modifies registry class
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      Suspicious use of WriteProcessMemory
      PID:5964
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=ms-teams.exe --webview-exe-version=26183.1903.4892.4448 --user-data-dir="C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --autoplay-policy=no-user-gesture-required --disable-background-timer-throttling --disable-features=msEnhancedTrackingPreventionEnabled,msWebOOUI --enable-features=MojoIpcz,msSingleSignOnOSForPrimaryAccountIsShared,msWebView2SetUserAgentOverrideOnIframes,PartitionedCookies,ThirdPartyStoragePartitioning,msWebView2TextureStream,msWebView2EnableDraggableRegions,msAbydos,msAbydosHandwritingAttr,msAbydosGestureSupport --gpu-watchdog-timeout-seconds=60 --isolate-origins=https://[*.]microsoft.com,https://[*.]sharepoint.com,https://[*.]sharepointonline.com,https://mesh-hearts-teams.azurewebsites.net,https://[*.]meshxp.net,https://res-sdf.cdn.office.net,https://res.cdn.office.net,https://copilot.teams.cloud.microsoft,https://local.copilot.teams.office.com,https://m365copilotchat.svc.cloud.microsoft,https://m365copilotapp.svc.cloud.microsoft --js-flags=--stack-trace-limit=50 --lang=en-US --accept-lang=en-US --mojo-named-platform-channel-pipe=5964.1280.11390515324820888859 /pfhostedapp:0d596a59e8915878bea1af71a068eef6dd16cd26
        5⤵
        Drops file in Windows directory
        Enumerates system info in registry
        Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        Suspicious use of WriteProcessMemory
        
        PID:4220
      - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView /prefetch:4 /pfhostedapp:0d596a59e8915878bea1af71a068eef6dd16cd26 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x180,0x184,0x188,0x15c,0x190,0x7ffa47505fd8,0x7ffa47505fe4,0x7ffa47505ff0
        6⤵
        
        PID:2176
      - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --gpu-watchdog-timeout-seconds=60 --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView" --webview-exe-name=ms-teams.exe --webview-exe-version=26183.1903.4892.4448 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1720 --field-trial-handle=1724,i,13318218480685872349,53323663289529459,262144 --enable-features=MojoIpcz,PartitionedCookies,ThirdPartyStoragePartitioning,msAbydos,msAbydosGestureSupport,msAbydosHandwritingAttr,msSingleSignOnOSForPrimaryAccountIsShared,msWebView2EnableDraggableRegions,msWebView2SetUserAgentOverrideOnIframes,msWebView2TextureStream --disable-features=msEnhancedTrackingPreventionEnabled,msWebOOUI --variations-seed-version /prefetch:2 /pfhostedapp:0d596a59e8915878bea1af71a068eef6dd16cd26
        6⤵
        
        PID:5136
      - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView" --webview-exe-name=ms-teams.exe --webview-exe-version=26183.1903.4892.4448 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2132 --field-trial-handle=1724,i,13318218480685872349,53323663289529459,262144 --enable-features=MojoIpcz,PartitionedCookies,ThirdPartyStoragePartitioning,msAbydos,msAbydosGestureSupport,msAbydosHandwritingAttr,msSingleSignOnOSForPrimaryAccountIsShared,msWebView2EnableDraggableRegions,msWebView2SetUserAgentOverrideOnIframes,msWebView2TextureStream --disable-features=msEnhancedTrackingPreventionEnabled,msWebOOUI --variations-seed-version /prefetch:3 /pfhostedapp:0d596a59e8915878bea1af71a068eef6dd16cd26
        6⤵
        
        PID:3952
      - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView" --webview-exe-name=ms-teams.exe --webview-exe-version=26183.1903.4892.4448 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2424 --field-trial-handle=1724,i,13318218480685872349,53323663289529459,262144 --enable-features=MojoIpcz,PartitionedCookies,ThirdPartyStoragePartitioning,msAbydos,msAbydosGestureSupport,msAbydosHandwritingAttr,msSingleSignOnOSForPrimaryAccountIsShared,msWebView2EnableDraggableRegions,msWebView2SetUserAgentOverrideOnIframes,msWebView2TextureStream --disable-features=msEnhancedTrackingPreventionEnabled,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:0d596a59e8915878bea1af71a068eef6dd16cd26
        6⤵
        
        PID:2260
      - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView" --webview-exe-name=ms-teams.exe --webview-exe-version=26183.1903.4892.4448 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --autoplay-policy=no-user-gesture-required --disable-background-timer-throttling --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--stack-trace-limit=50 --harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=en-US" --mojo-platform-channel-handle=3632 --field-trial-handle=1724,i,13318218480685872349,53323663289529459,262144 --enable-features=MojoIpcz,PartitionedCookies,ThirdPartyStoragePartitioning,msAbydos,msAbydosGestureSupport,msAbydosHandwritingAttr,msSingleSignOnOSForPrimaryAccountIsShared,msWebView2EnableDraggableRegions,msWebView2SetUserAgentOverrideOnIframes,msWebView2TextureStream --disable-features=msEnhancedTrackingPreventionEnabled,msWebOOUI --variations-seed-version /pfhostedapp:0d596a59e8915878bea1af71a068eef6dd16cd26 /prefetch:1
        6⤵
        
        PID:3668
      - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView" --webview-exe-name=ms-teams.exe --webview-exe-version=26183.1903.4892.4448 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --autoplay-policy=no-user-gesture-required --disable-background-timer-throttling --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --js-flags="--stack-trace-limit=50 --harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=en-US" --mojo-platform-channel-handle=4228 --field-trial-handle=1724,i,13318218480685872349,53323663289529459,262144 --enable-features=MojoIpcz,PartitionedCookies,ThirdPartyStoragePartitioning,msAbydos,msAbydosGestureSupport,msAbydosHandwritingAttr,msSingleSignOnOSForPrimaryAccountIsShared,msWebView2EnableDraggableRegions,msWebView2SetUserAgentOverrideOnIframes,msWebView2TextureStream --disable-features=msEnhancedTrackingPreventionEnabled,msWebOOUI --variations-seed-version /pfhostedapp:0d596a59e8915878bea1af71a068eef6dd16cd26 /prefetch:1
        6⤵
        
        PID:1836
      - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView" --webview-exe-name=ms-teams.exe --webview-exe-version=26183.1903.4892.4448 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4896 --field-trial-handle=1724,i,13318218480685872349,53323663289529459,262144 --enable-features=MojoIpcz,PartitionedCookies,ThirdPartyStoragePartitioning,msAbydos,msAbydosGestureSupport,msAbydosHandwritingAttr,msSingleSignOnOSForPrimaryAccountIsShared,msWebView2EnableDraggableRegions,msWebView2SetUserAgentOverrideOnIframes,msWebView2TextureStream --disable-features=msEnhancedTrackingPreventionEnabled,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:0d596a59e8915878bea1af71a068eef6dd16cd26
        6⤵
        
        PID:5924
    - - C:\Program Files\WindowsApps\MSTeams_26183.1903.4892.4448_x64__8wekyb3d8bbwe\ms-teamsupdate.exe
        
        "C:\Program Files\WindowsApps\MSTeams_26183.1903.4892.4448_x64__8wekyb3d8bbwe\ms-teamsupdate.exe" -EnsureTmaInstallation -AppSessionGUID a8d8cdae-6dce-4acf-9c11-469a78b70b7d -Trigger EnsureTmaAtStartup
        5⤵
        Checks processor information in registry
        Suspicious use of AdjustPrivilegeToken
        
        PID:6024
    - - C:\Program Files\WindowsApps\MSTeams_26183.1903.4892.4448_x64__8wekyb3d8bbwe\ms-teamsupdate.exe
        
        "C:\Program Files\WindowsApps\MSTeams_26183.1903.4892.4448_x64__8wekyb3d8bbwe\ms-teamsupdate.exe" -RegisterBackgroundUpdater -AppSessionGUID a8d8cdae-6dce-4acf-9c11-469a78b70b7d -Trigger SchedulerDirectLaunch -BgTaskDelay 4800
        5⤵
        Checks processor information in registry
        
        PID:4876
- C:\Users\Admin\AppData\Local\Temp\genteeC7\zgqmQcC2.exe
  "C:\Users\Admin\AppData\Local\Temp\genteeC7\zgqmQcC2.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5796
- - C:\Users\Admin\AppData\Local\Temp\is-K8GJV.tmp\zgqmQcC2.tmp
    "C:\Users\Admin\AppData\Local\Temp\is-K8GJV.tmp\zgqmQcC2.tmp" /SL5="$B0272,1022596,821760,C:\Users\Admin\AppData\Local\Temp\genteeC7\zgqmQcC2.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of FindShellTrayWindow
    PID:3984

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:2496

C:\Program Files\WindowsApps\MSTeams_26183.1903.4892.4448_x64__8wekyb3d8bbwe\ms-teams.exe
"C:\Users\Admin\AppData\Local\Microsoft\WindowsApps\MSTeams_8wekyb3d8bbwe\ms-teams.exe" msteams:system-initiated
1⤵
- Checks processor information in registry
PID:1224

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3448
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 05CC5E8150C6F708369025D597FEE4E1
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:5420

C:\Windows\System32\rundll32.exe
"C:\Windows\System32\rundll32.exe" C:\ProgramData\MicrosoftDevKit\9e314ca7.dll,dLXs4hgCwCw
1⤵
- Suspicious use of WriteProcessMemory
PID:4576
- C:\Windows\SysWOW64\rundll32.exe
  "C:\Windows\System32\rundll32.exe" C:\ProgramData\MicrosoftDevKit\9e314ca7.dll,dLXs4hgCwCw
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:1744

C:\ProgramData\MicrosoftDevKit\MicrosoftPhotos.exe
"C:\ProgramData\MicrosoftDevKit\MicrosoftPhotos.exe"
1⤵
- Executes dropped EXE
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5592
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /run /tn MicrosoftToolKit
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5936

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe
1⤵
PID:2972

C:\ProgramData\MicrosoftDevKit\MicrosoftPhotos.exe
C:\ProgramData\MicrosoftDevKit\MicrosoftPhotos.exe
1⤵
- Executes dropped EXE
PID:3084

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Visual Basic

T1059.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Network Share Discovery

T1135

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e5a39b2.rbs

Path C:\Config.Msi\e5a39b2.rbs
Size 358KB
SHA256 8c539645ffb6aaed2acaae3f295f10c340adaaba7df1211566b4dcd407aeaad0
MD5 007c3a9d6c6019906ced2c97d8d0430c
SHA1 87ea62bfc793e546a13d7196246b187c77a8b2d0
SHA512 e0ca596c046a43322a50def4e2abbd9cbda581c783c23877c1859287d50199f4567eebf21903fe711167144c4aec72a55439d422e799a36d36bf57cefee6d15d
SSDEEP 3072:neSzDNgS8SgMe+jVrrb1MMBRMoly1DhIfS8SgMe+jVrrb1MMBRMoly1DhIsG4dar:neSzKVkp11O3eVkp11O3O
TLSH
T1C8746C11AB41CDB6D978397302707A9CB03DFA732AC1BEAF8704D6680F567C4E719A52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9e314ca7.dll

Path C:\ProgramData\MicrosoftDevKit\9e314ca7.dll
Size 145KB
SHA256 7028ae19b5019049600c30833aac6bb0a19ae41b3a908e79e2d7f6aa1a2ac4a3
MD5 bea4093c3ea1270cad31f7d619895410
SHA1 b42fc5f30d1c50797cf2470da47df69b5f9ba029
SHA512 19ebf179ffc6557a77da41b31c3208dc9003ca9626213de65fc3c304c714c9dfda9b18953bcbb4793f4329501019b21f1ec6c7184fc9ad7a9b4690c31e21b73b
SSDEEP 3072:d1U+y/dpYoBlRo8lvmwgsGVtpFXV3WDg2nIjyRoww4wcdcv:d1Ujdp588dVGrADg2IeKn
TLSH
T1C8E38C4079C1C072D5BE28340AB9DB724B3D79501B78CDCB67D45EBA9E306C0AA35E6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MicrosoftPhotos.exe

Path C:\ProgramData\MicrosoftDevKit\MicrosoftPhotos.exe
Size 116KB
SHA256 7557e8d113abaac3ec4bf74befe13167b993d9da37e7aa9cdc4c79d4cef9079d
MD5 31a5c11460f89ae28276938f22cc6572
SHA1 3391b4c192206e24e51db62bdcbf566f1c19f391
SHA512 dffef5ce38acf4019c47edf5a436bd7b58b62530b56151eab4f52eb594f847534ccd8370e9c3efa37ede05fccb454b1e270a2686bf69ca3f5fa0492bfa8015d2
SSDEEP 3072:zUhWBPhyr9Y7q5Ur7YJR6sqxZRplHPX9iAB2:YYph8cHYJRAjlv6
TLSH
T17DC3020FF321C421C461B9B12605EA7EC955101A2BF2D0175729AFF5B4D3BFD69338AA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AddinInstaller.dll

Path C:\Users\Admin\AppData\Local\Microsoft\TeamsMeetingAdd-in\1.26.16801\AddinInstaller.dll
Size 35KB
SHA256 4d40809f0fe018208d825047bb01df29343ac4cd5fffd8a28e3b39840b197cb1
MD5 c46985c1bae0c78c59c1a71aba231d96
SHA1 75f5c4273ae908ee5f051e25c5fad43090a8959b
SHA512 f9c435dec84fb06b92a64a4309717adfb9a1382e48a42810bca638b3b60576aa433def377f5f4cb0e232d2819e29207f4527ab27b6e5d84a8343d8842d53ff43
SSDEEP 384:XBlT5P3LVITaIJN+g0fAA3MSYlhx40dGCtucaGAh0RXki+R9zCfnVO2y4GlNmt15:7JLNIDER3wl00QCgbh0c9zCu+3P9zm6
TLSH
T1DBF21791A7F88107FAFB6F706AB4D5022DB9BF865C30D96E15C5A14D0C63BC4CA2173A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.IdentityModel.JsonWebTokens.dll

Path C:\Users\Admin\AppData\Local\Microsoft\TeamsMeetingAdd-in\1.26.16801\x64\Microsoft.IdentityModel.JsonWebTokens.dll
Size 66KB
SHA256 041946c132c0561ce8d0a1b0f74eb979d69660deda241bef4a0570f1cd1d9289
MD5 622623a04c985eeaa82d2a1f15d508cf
SHA1 f6e6bcc42d1e1bf0dc7d635beb4a1f063a4f2b66
SHA512 46027876fd165c8399e3896ab6bcba034bb69cc5e67c68fadb40101db05eb81882b12f86bfb75845155bb94d08c9c7d1c97461f1677b0cbe6b71e3a8358a6f81
SSDEEP 1536:gm6516C0z6v8JyJNPk2DuttJ6gDEkeLJu1FzaO:gmqEC0zhyJNPktDXiMWO
TLSH
T1BB630685A7EC8354F6FF3B316AF1510158BABD8AA839E74D1D80D29F2D23B408B50776
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.IdentityModel.Tokens.Jwt.dll

Path C:\Users\Admin\AppData\Local\Microsoft\TeamsMeetingAdd-in\1.26.16801\x64\System.IdentityModel.Tokens.Jwt.dll
Size 81KB
SHA256 15aa3a16426b1281f0a4cecafc2a054bb29b7f3d09b3048f048ebf67c4f53e1a
MD5 ef26e784474ef5ee4c86225829784bd6
SHA1 db058e83d7b6cde77821d9da640f7b169fd80e07
SHA512 7621855326125262ffa2de6577d79fbc20f60f0aad3aa6fd42006ab806438cf262e18cabb802eacb1337b7de424fa32c543b8315436d05e519a29458405ef706
SSDEEP 1536:erLOBZPOcQY5bOfk4GftC07uktN9XNEgfpXaXr0iMJgBGILkDzVZl0+88niFF2Gq:eeBZPOcQY5bOM4IuktN9XNEgfpXaXr0l
TLSH
T19B8391043BFD5649F2FBAF3D68B054050976BE5AAC31D78D1DA0928E4873F809A60B77
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 a4bda13b1ff3e145b41a5c9f7200d3abe22882b5aa98b10661252278ecdf5856
MD5 8774144df44c0aa7c591fab5fbd500e2
SHA1 964eb7bf7a3a6d73b34ab3c639bcc581b7afbeef
SHA512 c5f0e6815ffeb3074c68131a7763321b8027751c79089ccc09d453b9a0a50eb1cd10c8220a67d013bdb77780ec353bedc9f5d7fe83df3590e81f0ec06499673c
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 9f1bd6e8b354da77084381c6e477b5d690a93e839674631d62b7cbe5c907f9d5
MD5 dba499ce10e5605de1b6a2c39dca9398
SHA1 1c16c93366b31e1eec5277265c66e3c41b72ff55
SHA512 4cd82836ea757b4fb5651f679dac0599388c7709c38637df7d60a5575c6c3eb6b60c6a8904de757d16a71a91154a6833148bf735be9a7dbf7604a97ffc1373a8
TLSH
T12DD0121A32510634E4203133040269081700C30B80454241A82C851E7A140501D12562
MD5 SHA1 SHA512 TLSH

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView\Default\Extension Scripts\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView\Default\Network\Network Persistent State
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

index

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView\Default\Shared Dictionary\cache\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView\Default\Site Characteristics Database\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView\GraphiteDawnCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView\GraphiteDawnCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView\GraphiteDawnCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView\GraphiteDawnCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView\Local State
Size 2KB
SHA256 f94abd049f82040a6e6b21343c9ed0f7d75bf3ad688baeae998fc112c9248575
MD5 2d149292db1348dc52a34ce710191889
SHA1 fa6336ae108b168c095a834d4ba7b08964d97175
SHA512 e5fd2f0ea610b173773ed978bc39fffa26b2fe0561681513939f2e959c4fd6427918911ac53ad5318a6707aed950dfc366dae58996017e3a458579723bbce6f9
TLSH
T12651A4337920AB379AF25A047A463B535F79E0A6DB521F20A9FC0B0C01DB25C2302C3A
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView\Local State
Size 3KB
SHA256 f958a4aa882cdbf6ef89f466ccbc144d9a2cebe97b948e3264e9a26a5115d40f
MD5 9bc355bbafb38d7badff92eb83704f07
SHA1 8836d03b06f07536d06c8d6fadeef85a55226fa0
SHA512 ac1cd0b09aa33a7a6f4f12ce3804f58062947f7af19a817812ca6281a613f7d9c3b8ab06bba6dcf457535034414de9d58d8bb12243aee7089c5f6ed0a5b168d0
TLSH
T1476184376A70A9378EF39A05B9863B066BA5A067DA913F64D9FC0F0D01D739C1352C1B
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView\Local State
Size 16KB
SHA256 79afaa2ba297ce719ebafe85d4c2cc751b5bacd62eac7167e1bef0828af684e4
MD5 a869df31f59232ef3c231155d9c15799
SHA1 f9a6c1519a4322121cc5610edb5df64b6ae17047
SHA512 68092ed808152f9e8c38b5bb9e3fe360bbe85e332b525a3103f1e79cc31d0f006ebc18403d76a61bf1a95c8f7f3bce78aef62e9d900e2665d311da2c2932ae6c
SSDEEP 384:w+aQikB+z/xvxjg/qhEwNBSaiRFJ/sv8isdJgo9za:P/UxvxjgC+tFJEv8isTgoFa
TLSH
T161728D2B55393D379AB3E9047949079BA7F99473D5C27EB88AFD5F0D06872D80342807
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State~RFe5a2414.TMP

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView\Local State~RFe5a2414.TMP
Size 1KB
SHA256 613f90d3187bdb4d41083adf8e848ace64788c97450eab5c679799ac40f0fe95
MD5 d659cc0552bd0a74c3158673c4018974
SHA1 85f08d5298ee7b311877b5e5892795c21ec1a611
SHA512 ec070c6e0c7650780fc2640bf7ac003e84e5c383288beeb97b285258fc6c8d47d9f52d1f90b723d7ec8b6270af6c7d9518c6809eaa31cc5441328a954c6ddae9
TLSH
T1E5216573A6605F33BD922656324237871F20A0BAC2514F10A5FD8B0D02E718D933BC3A
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView\WV2Profile_tfw\Code Cache\js\index-dir\the-real-index
Size 1KB
SHA256 dcd54f4c4db1d6be07a630f42cf817e8dd33363b8aa0d40e9360a1bf8a6e26d3
MD5 71506927fe9003723715fe508876794e
SHA1 ece62b7cb23fa089dc129756f159f9d8e8e7240c
SHA512 43acbdcc1c5efc8bfe5d7aa30c6f0b85872f51b9f1034dc0ad9f7915564e516c32f6a0c30cd6fe16c50bee0f05eaac28572026ed068157f87f7387059418aa5a
TLSH
T1D93132B8C5C52B84CFDA83F87B136D690A106E95CA0F83C7EEE11AD6868F2C46F4D404
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5a8d1e.TMP

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView\WV2Profile_tfw\Code Cache\js\index-dir\the-real-index~RFe5a8d1e.TMP
Size 48B
SHA256 0ba529e861a303be9bc72e46e13ca1b90b58daa30e2fce8949ff49a8d626fef8
MD5 04d7207256da3ce2190cf73c1474aec9
SHA1 7d758577373c9407c9812bbba4f2258aa9628cf0
SHA512 f4943d508f1ea4ba388af2675a72f65729608ac6decd3b01b0f9d45f68fdda7fbef2c8377f3ceb0f273cc448b9839cf5aea28b1e146354a8121bb7a29b26913f
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView\WV2Profile_tfw\Network\Network Persistent State
Size 874B
SHA256 36fb86f656ad1f283c46e4aba3da4c62451382c762829ae89ab59d4af7dcf21a
MD5 c43f547e5c87fbffd6cab1d12baa3a18
SHA1 8430ab83cabe70fd74c0a3cd46bf561bb8428bbb
SHA512 ac5fd74f7e8002325e3f5e594cbc46966928cf8ac670de272fd593338199fb06d4980600ee2d754c06ff053eada9f249dadeb85451287e12cac03b9e12ad8cf7
TLSH
T1A011CCB387A4486ECA8546F41A24ED2BEE2D0616421C38258AC4FFA7D3F3076E10254B
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView\WV2Profile_tfw\Service Worker\CacheStorage\2b5c392d2730c0910fd56433cc5e73e510d0f2b4\a74195f8-db93-482d-91dc-0735dcfc1987\index-dir\temp-index
Size 96B
SHA256 831749d73022be5f46816f18a8aa366f3f8e769ad84e10a960206792013fbc0d
MD5 1958ad345cfd8449a835f74adad23951
SHA1 d7beacc144c25ea29c72ffe98adf64c4ae174ebd
SHA512 b338cc16193d615d652ed9c0dbe72575d9990c0685fa3d10e50894a96abb34f6a50c008094376c4284b3167ad2b054c81d933812e910c9807fd93a6a9c100450
TLSH
T193B011A03802000AC20002B280A200C233280EA8AA030A3C82C00023882A3808280000
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5a8761.TMP

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView\WV2Profile_tfw\Service Worker\CacheStorage\2b5c392d2730c0910fd56433cc5e73e510d0f2b4\a74195f8-db93-482d-91dc-0735dcfc1987\index-dir\the-real-index~RFe5a8761.TMP
Size 48B
SHA256 b27f411584e617fd0f30d9d38cf2816d0e0303b80e7e84daa4e67b060771c9f3
MD5 1b0dee225d7bcbae666a18df471c9735
SHA1 1d2b787d82241e4849cabed28aa75d2a1d9db1de
SHA512 a1cd74233a4d47c9c0c3534cc15cdb44b3185526164a8a2a28a543b0a411ac57883f249aebbafc95511cdf1704e66fa8816b14eb3cbe09c77ae572f952367c69
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView\WV2Profile_tfw\Service Worker\CacheStorage\2b5c392d2730c0910fd56433cc5e73e510d0f2b4\ca9c5ccf-2139-44d7-ac6c-6a0941d33a97\index-dir\the-real-index
Size 96B
SHA256 9ba0546f4a282f4c8fb141d028b46f3f58bec181c2b8a1c6a9cff7489951569e
MD5 0fc0325ccab35b663ce90af18539b608
SHA1 f2efe0593bcb9c1029840663504e00a120a6553f
SHA512 746d417de5c25ffbc055ee3c4448732ad815b8ee17cfa64bf8ba09d41e7d443474d82d6964673269e68bfb97e82ea9c8f4950e758f99181901025e2769bd2254
TLSH
T10FB011080230002AC00003BEA08282802B3C0F08CA2A0320E08AA2A88C2A28A02003A0
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5a8435.TMP

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView\WV2Profile_tfw\Service Worker\CacheStorage\2b5c392d2730c0910fd56433cc5e73e510d0f2b4\ca9c5ccf-2139-44d7-ac6c-6a0941d33a97\index-dir\the-real-index~RFe5a8435.TMP
Size 48B
SHA256 5a470c141f485b15545e43e4ea8936ae3588f23f6adaa4f7ce436ba30dd43374
MD5 52233bba0b70bbaf510bda62bb8e2951
SHA1 a5ac555b430ae8c8dbbc81cbb232fe8cb68e238e
SHA512 026c652a55736e5b6f7c084776f2ed55a6deb53624b90b1c118f0c2ce8363e3a6a15437ad1f8ef8039728bf982e05c5187709302bfa64ef6e663f9f7efb13fdb
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView\WV2Profile_tfw\Service Worker\CacheStorage\2b5c392d2730c0910fd56433cc5e73e510d0f2b4\index.txt
Size 221B
SHA256 7d8932ada4367cda751b73a2fb67ace4826ecda4e3c1829320564e63f6be607d
MD5 a1affd49b406c4194ad7baef4696acb7
SHA1 e7816c8e05afeacccde96a39c3e195f12e8f8d86
SHA512 e4d0b0a131f4088266f5ed8a46ae249bad7c53b1badea9bbf8c0ff1e7e34b6a0e766f36c1f227837c605c25d40c4708a20cba2d9b99b4c72f153d0e5aca9629b
TLSH
T110D0A71FC10098615F8845C0A4C1D057615F0D4B3945B1909E8BB446B93E9E1DA02674
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView\WV2Profile_tfw\Service Worker\CacheStorage\2b5c392d2730c0910fd56433cc5e73e510d0f2b4\index.txt
Size 295B
SHA256 2f31f3982cfe3d503f910f166fc0b95894f1e81d30322e55a99664abcdec8a0f
MD5 f78a32e146d1413e519e3f8814e109cd
SHA1 fb206ab0d0e41f7cce120cee9072b11b9cc4b514
SHA512 ff85a26d6fb063b74d8eb9ea4d2de048f9de8379d16aa82308912130e11339353e983bc8193f3a56acff422f5010323713b0d505c56d16ebe225e8089c678f84
TLSH
T158E0CD0F82109C715F8D56C5E484D156516B0D4B5D80F1905D56E4467C7E9E1E7052AA
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt.tmp

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView\WV2Profile_tfw\Service Worker\CacheStorage\2b5c392d2730c0910fd56433cc5e73e510d0f2b4\index.txt.tmp
Size 289B
SHA256 2edede3fb3967476e50d98abe366c755216995a4d707b7a19dffd082da186382
MD5 f764aa76997e32d5d8e5710f7133b09e
SHA1 c2e2d1fbcfa2c85d64da94f245dc5ce5f35bc629
SHA512 17505dcfb6b63b0476091e6f67b8368b43068270b8972f1014bc07f0feb0e801b0998cab66659ad8e3ceb039e3cb1dbe9e4c56885f358ad53867dcce6d419117
TLSH
T16AD0C20F86109C761F8D56C4A884D05A619B094F6990F1909E9AC84A7C7F9E1EB062AA
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe5a2aea.TMP

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView\WV2Profile_tfw\Service Worker\CacheStorage\2b5c392d2730c0910fd56433cc5e73e510d0f2b4\index.txt~RFe5a2aea.TMP
Size 141B
SHA256 3b1c49c85235104dce1948ddb0e080ca1e10a4d00b31385dcc75722bb0773756
MD5 094c4d34bf07a9982b6e8c45cc905222
SHA1 8064a346349d78f195a97c226e34906ee28013ad
SHA512 e8c0233266169d1bb6c290e6c60efce6e128a019e0e8027b2224bbdb672a74a6abc79ae87f690bd17195af17def735c4e1f89dff5b9e1956806316a9d718b5ba
TLSH
T13EC02B1F81000D115F4410C1C1C0D057906E0E8F5C89F0D0924F7402743E5D7E6036BC
MD5 SHA1 SHA512 TLSH

Submit Download

cc450700-43ad-4948-b870-4157ed21c745.tmp

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView\WV2Profile_tfw\cc450700-43ad-4948-b870-4157ed21c745.tmp
Size 6KB
SHA256 3bef279b90e2b4facb5164a758762eec33686075599b2a033fa34283566933e1
MD5 86a8960da90f63223d808cedd83f7790
SHA1 f8c71a152dad8484ba753749583d6d9e0f2b21c1
SHA512 a5e0692b9f08c59a937f3dca0c8ec97003b5468b7dc8e0ae0a890609830c0684a026782cc80c4eb58d8a4e5485b4691be3ca9bf0708e8abf98647bb0e245d4ae
SSDEEP 96:st5RUBBvb9MJkro5h16ZEjIs7/x+6Mb+4eY+4egmuec0+4OS1ejey+4eUK+gm28U:stWAJ4ohIsV+FFvYOSQjfiQG6K
TLSH
T1C1D1B5075E24A87B4CC6E219BA28B757E2F9A033A5D52E58E7FC461C04DB6DC630784B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tma_addin_msi.log

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\Logs\tma_addin_msi.log
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download

app_settings.json

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\app_settings.json
Size 2KB
SHA256 57d97b69e6676701b0a96dd8a0668d584f78142535f5837cc5e84161b12708a8
MD5 824978d68f162a5eb86efdfd2f5b2960
SHA1 4401f2bb14b170ebd3b040051e2d2bc3c6776385
SHA512 60ac675b834bb03e79445276802d80f64a7f1a6279d5dc8ac8bcb7eff41d9c7a2b9824de879fd798ce7f4b8d48fca6f701a63b30c051e1bdd5c9c11e4cfa76d0
TLSH
T12951D52C0614A2BEDDC7864BB54F3E238AE741A4DFA67FD6E8AC181C19821FD1321497
MD5 SHA1 SHA512 TLSH

Submit Download

app_settings.json~RFe5a1e66.TMP

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\app_settings.json~RFe5a1e66.TMP
Size 2KB
SHA256 fcb6899a7705e4e330024cdb0199e071892fe0d12469d5cb9accddb3a705d1b2
MD5 56df44154f4261077901832014d243dc
SHA1 df4a4fb570e9fcfd5eb9a128f4e0435954c29af9
SHA512 c40c689df3c3c6f3ca4e7e0fdd0ef7f14374c21d0439c4463c166f3969ffbb8ba5f556d8336464063a160f9192ce3e9696fd8a83c9b94c5468ff782bffd2f87d
TLSH
T14A51C62C0614A2BDDDC7864BB54F3E238AE741A4DF667FD6E8AC5C1C59820FD1321497
MD5 SHA1 SHA512 TLSH

Submit Download

ecs_settings.dat64

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\ecs_settings.dat64
Size 2.0MB
SHA256 9e327135253cbb63cb7052b99f2e222c5582f7449f033a82b9af1c6296ab5c52
MD5 73a61e7bac9b8744e259d90d236afc76
SHA1 69861367245a2aa7b32f47bfb07ddf0b1b8a63e6
SHA512 3e5865678764d1ff294f873aa4dc76189378c8186392a1d2cc7409f0687ba84f87e3539748668ba20375fb3fdf11b513f88fc9f5a9c2165cf901cfe0a2d550c8
SSDEEP 1536:HhA+MRa3K15OAJRb5uVdUBYDireJi7YDereNrHdffyFXazVkM:3FVnd
TLSH
T110A551A51844A6FED78AC2F867382F18B5FC8DB78C415014EADDDA0D706746B73238A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ecs_settings.dat64

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\ecs_settings.dat64
Size 2.0MB
SHA256 371ac45c6ed288d78810f3f1fa2a3cd013fc9fed1deddd1e5fd282d03db129f6
MD5 98f1618dd08bdb391a157123deed377b
SHA1 8cdb7aff0ba22c9e515d1a373f39e88363f8ded9
SHA512 096d8d30934cb6a91c59bac05991d9bc5b2223708f924d54c7ef5d818415a4af391da5d69fbfa8c9d01ef0b8ac923f9d0b2676e6a479a8c48666ec68c6c2b1cf
SSDEEP 1536:DUA+MRleK15OAJRb5uVdUBYDireJi7YDereDrHdffyFXazVkM:rGVhd
TLSH
T161A551A51844A6FEDB8AC2F867382F18B5FC8DB78C415014EADEDA0D70674677323897
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cloud_settings.json

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\tfw\cloud_settings.json
Size 154B
SHA256 cd7f02f72b0c4b167374dcc295c30acb5d90d56c91dc8619e4c848d42dedf25b
MD5 6b284df7273f237e30829adf6461bbdc
SHA1 7e0590fbb967191cfe9cf8d8f4c43548baf9766d
SHA512 01bbabf43b8713d0341df35ef26ffe26ed0bd7ca55017bef538935e053267dbae48770e0320905df11cb69d4c18b91dd38220efd907859a025af1065aaf7b135
TLSH
T1E4C02B421436C175FF73251C404B33141C0C11F0D724228580BD0401F8008C3743F0CF
MD5 SHA1 SHA512 TLSH

Submit Download

cloud_settings.json~RFe5a3d87.TMP

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\tfw\cloud_settings.json~RFe5a3d87.TMP
Size 154B
SHA256 d0d9f92181138474a07cb257841d6367425bbbf6f7bd49ed9ed7a832594438c3
MD5 379a2b6aeb5bc4f2d9b492aff71bb9dd
SHA1 acbec06e2d40630ed6ba703656036ad2344bb9c5
SHA512 2256801a70c62db701de36d671a7bfaf16c9327a7399f3184bf05223b89d5da85154a4f12ee6ef296b5eaa9de18544ea4298b062e259ba9602835bfae60ae1b9
TLSH
T170C08C411036C175EF722618400B23141C0811F0DB24224580A90401F9004C3642B08F
MD5 SHA1 SHA512 TLSH

Submit Download

dGVsZW1ldHJ5X29mZmxpbmVfc3RvcmFnZV9ST1dDT01NRVJDSUFM

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\tfw\dGVsZW1ldHJ5X29mZmxpbmVfc3RvcmFnZV9ST1dDT01NRVJDSUFM
Size 4KB
SHA256 70de54757510156256662b3a0f3a0aab4411851c8baf50b31adc199459e8bd32
MD5 89f220526c0289b3b1aab682e26a6a71
SHA1 56c9fedb7e79275583ba6fe28c8cfd80c2f6da95
SHA512 4db6a415251ac8434fd9806ca3fc447538c652b76f389be4719e8fc413a354ef8f4dd8b87aee1fb7e528a77bff8b440720ad44658012b56c4b461037631462a1
TLSH
T152810241464000E3D05807B654D113182B1791D497530B1365010201C8417484860A44
MD5 SHA1 SHA512 TLSH

Submit Download

dGVsZW1ldHJ5X29mZmxpbmVfc3RvcmFnZV9ST1dDT01NRVJDSUFM-wal

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\tfw\dGVsZW1ldHJ5X29mZmxpbmVfc3RvcmFnZV9ST1dDT01NRVJDSUFM-wal
Size 48KB
SHA256 5af5a338102c9cc466c21bdd39a61622408adc1a6a0cf26f8d1ad6aa1cb5d10d
MD5 1fa92500b01abfe04f6efada02f41c4e
SHA1 2174535351ed1bb707c4ab17d7b4d93735fd3964
SHA512 0e7d8966611df8e0d864a1119b2cef51f77f40a520c17734932d8cfe24882631027231df891be1aa89f79319d8d7ca7d6a92288115944ce326e3ed8e36e832f4
SSDEEP 48:56JXQkNxll7DYMWCO8VFDYMRFSO8VFDYML:Pwll4ojVGVjVGC
TLSH
T15F23C0C16AF83061D06A12F7CDB3136B133ED1A558236F532D7255E2DCC1A8A58215FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tma_settings.json

Path C:\Users\Admin\AppData\Local\Publishers\8wekyb3d8bbwe\TeamsSharedConfig\tma_settings.json
Size 143B
SHA256 e56b97055dcb952702b1903ec74da0b58a4c6b23894851f826d4f6ef172d0b93
MD5 e77d6fcb20c638d882c5219d4b019dd2
SHA1 3e79d32920d83d2d70be71790b4e400b86c165f1
SHA512 e08a8425e7b4ea5a8a58a7a228355efd79d694197c380bf714de8d865eb02ed072a8d48c47a3564a26fcee6bfc5ff3d9a909893786cba46d99133a2f67d1293f
TLSH
T1D1C02B020D07A5330B500A10C8BBBCC2C5E8BC8701201821497EC04D0B2C2DFF000186
MD5 SHA1 SHA512 TLSH

Submit Download

tma_settings.json

Path C:\Users\Admin\AppData\Local\Publishers\8wekyb3d8bbwe\TeamsSharedConfig\tma_settings.json
Size 361B
SHA256 d3e8b34a0ac006208f1d02fcbc9986440a0d6018b7f5fc493ffb50806483f097
MD5 3a893e0d8989356c6186ca6cfa8d948d
SHA1 0e7b989d15ee9ae1a4f52e9542416f13db5a7710
SHA512 00f82ea5c8ac248f0ea85c8da21536e3caaee1af73eb34656b87ff5092539597e6b02f6b85cf163870ee550641697145958dcd7091e6e63b90c534e45f581cd3
TLSH
T156E0C01A1D060C3701942A008CF64D81C175F84BC38184E859FF814D0728BFCB040D42
MD5 SHA1 SHA512 TLSH

Submit Download

tma_settings.json~RFe5a1ce0.TMP

Path C:\Users\Admin\AppData\Local\Publishers\8wekyb3d8bbwe\TeamsSharedConfig\tma_settings.json~RFe5a1ce0.TMP
Size 124B
SHA256 d651df9b25e7b36f5492d15050c5281f0519042cbc4b40742332d10fe220d90c
MD5 98d8595a47c9f70033706bb441d55a86
SHA1 162943310d516c7f44341af615241bbcd08f5c87
SHA512 c7c81b6d80d0a868eaff3193e53f24c0eeeb25d7cf8d4df1b0d0aec14a4ef5f402e290ff5c9640cc3687462f8a9ccd4957715e823e9a50f38d635b7a7dc44e1b
TLSH
T1B9B092161D0AA6735BA00A10C9BBAD82C2D96D9A06642861857AE49D0B286DEB10064A
MD5 SHA1 SHA512 TLSH

Submit Download

Update.exe

Path C:\Users\Admin\AppData\Local\SquirrelTemp\Update.exe
Size 2.4MB
SHA256 fccdc07fb399838b345838400cc086f59221297e4ad237911513e974ed71d468
MD5 99bce53f81997c05e348d174126b3a6a
SHA1 c9bc67638cfd2274a776cb596158d064c08f4d44
SHA512 22bee232ee15b0f03a9f1ea31b0f8b49b2e0b1c09341f2df502493ca242406a9b57e10c60a661fa46d9c51ffd108cf583fc852bc762fd499cf34a3d5889f0519
SSDEEP 49152:AizoKjTAkibv0W2XhnQAcEz9xU0gzHCUZ5nEb:Aiz7Ribv0WUnvznEiUZ5Eb
TLSH
T1E0B55A10A7E88E2AE4BF1BB6F57101510BF6F98AA772F78F160C60782E933548D51763
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

downloading.gif

Path C:\Users\Admin\AppData\Local\SquirrelTemp\downloading.gif
Size 9KB
SHA256 effcd4e74fe3fe14ab9fe2916ad97eaab7ea9294aeb4c3310406cc2ae195d39e
MD5 18cf95269eab6519867f9c240ea57c6b
SHA1 7026775355daf1cf1a49d380d7cdd7785a6278e0
SHA512 873c83d15803396a636a09349313f90e2a1a9aa8e1a41b474f898ec0b6580b107f3e3763e8e1613f8cb9d7c611a21762ce712824b68de9ae48be73425f045096
SSDEEP 192:FTaPIYtYvIOnHW+pYt6wRpy6/WVkiS3s20AbCWGShWMeqf4:Fl8YQO2+pQDfykakiS3pb/1tw
TLSH
T14212AE53DBC9B884A0509FF7AD8C201A670381554D6458DBF9BA34AB350603A7B6E3BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

.ses

Path C:\Users\Admin\AppData\Local\Temp\.ses
Size 53B
SHA256 993f547fee7e126604e3f1a745487ea750f198ee3677811140c610d02ef2487c
MD5 f92c774ae2906dd3723818d888bc979f
SHA1 13a67c8e3bf3c46254063188736f35727cb6609f
SHA512 76c09d43bde8927f7bf4c4b72777c6bc01ba1beedbfd46aed6225cae49e6b32d84d09debd3a8ed06cf7ff81901a829e3ac27fd9b4141c5979a0c3eda29e04744
TLSH
T1C09002D5AD504DAA524104100469C0977E459956FE6268578665159A183B2B54154211
MD5 SHA1 SHA512 TLSH

Submit Download

CFG4548.tmp

Path C:\Users\Admin\AppData\Local\Temp\CFG4548.tmp
Size 150B
SHA256 02375fa63b79648ed6bb419c08f78ba9032ee22ba7170250e24427f47fddfa4e
MD5 2be48f533744efa173a2ede37ea8031e
SHA1 41fad4dd24cc97a3d3056b026ca8056c9e4b9e3f
SHA512 f49495311687f2a1af4ff60f8ff304d3ccddcd66effc36dfcfd71de91ee86a405c14c3f9bd81240cca76d4de1f4abd3259a7af6d53b2c3737c8963123d6f6815
TLSH
T174C02B09402C7D37EC230F579112CD12FFF003616034000CE01FB72B021006D5306306
MD5 SHA1 SHA512 TLSH

Submit Download

meeting-addin-t21-msi.log

Path C:\Users\Admin\AppData\Local\Temp\Microsoft\Teams\meeting-addin\meeting-addin-t21-msi.log
Size 1KB
SHA256 eff554b3aea4ac28f64691324e2618f13b68f697ea43dfb1e67ef19ae5763d09
MD5 95c6ff40921c433547b18a9f97e9fc4c
SHA1 3cd00cf0cbde96fe3b5528a99a8fdd9def71f123
SHA512 bef2d0247f554bcd5cf8cc07a992449083705a320e032fcafb00376fa0582009ac9c5ecd728fb832c39eb7bacd3e9966ca75b165e090baa7c557f54fc391520a
TLSH
T11521F10249B0527D4AE0314556B44E8EF6B6E24B33097661A7FDC60C33C24EAF7FA0C2
MD5 SHA1 SHA512 TLSH

Submit Download

MSTeamsSetup.exe

Path C:\Users\Admin\AppData\Local\Temp\genteeC7\MSTeamsSetup.exe
Size 1.3MB
SHA256 e0b0a89c449acdb6ac9eb181dbf1be6ca0824ea215429ddcc927703086a0e608
MD5 425f32686744df3d826acdddecc89aab
SHA1 d80428d65e2ec8432963159aa2edd40f6e365bae
SHA512 19e7e320ec29bc705be110a51fa260797a91efd9dd805010286efb8427fbe8d00fede5035cc9de176b9b2136646448d1236f78517ad9cd792071ca3b78a6a264
SSDEEP 24576:FmPjS7HX11VQrCINkE1O67IkwtL/bwx79x94J3bJmDQY2XJSlanwxAnEoOq:m+31bgNt8IIkI/bCj4J3bJDdlnwmnE
TLSH
T1DE55121176C28032D6B305320B78E6729A7EB8211F659AEF53E4125CDE346C1EB35F7A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

guig.dll

Path C:\Users\Admin\AppData\Local\Temp\genteeC7\guig.dll
Size 20KB
SHA256 624f4c25504ba431f450d8ecee2e2d0a4d87b95f7fa0b72db43f057ca021c328
MD5 ddd4a31094764a9deb6a82c8658fd9c5
SHA1 4c098a5b44aca27b13222dd64903d3fb286fc274
SHA512 45e2b5373ceb9b92dcd1d23a0b2410b5562d2a59c2a0d4dbca1c51f6264bc4659370ae3c170662bb8d316c3dfc0439874b3354ebf1ecd7ea27de125b4975ba6e
SSDEEP 96:Vp+rqxZxbVbQosZK61Oi0sIqUWfNBd8HwoO6EVV2JVdY0l4RSID1/Qw/g3ATg:+OLOK6UsPnzB6aVd0AD1/Qw/g3
TLSH
T17D92D6B672D148F3D0CF17F00A622BAE6BB58420177578A64A134BCE96A6641F926B02
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zgqmQcC2.exe

Path C:\Users\Admin\AppData\Local\Temp\genteeC7\zgqmQcC2.exe
Size 1.9MB
SHA256 ceeb2c2901bc48ae4004982986bc406f172a96f21d203a15797de98cfab8acb9
MD5 2c5740ef82708d4956838cc6a13e11cf
SHA1 577fa764732f042b718a393c16cfd4ffd05cee52
SHA512 319e267486201acfbd930b428403aff3ea548bfbf5273df32b0cf878109a2728577cbfbd078a168b1becbf7dff8f3d8af35f2640108e4c58d2762f078637acb7
SSDEEP 49152:BxXXm66O7MEX8OEaZKSEohy/SsDlMCsdbFqZ4:BxHX7RXxEaZHEoMVDqvqC
TLSH
T19695DF13B2CB613FF0BE8A364A77E222553BBA6165124C6797F8086CCF261D41D3F646
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

genteert.dll

Path C:\Users\Admin\AppData\Local\Temp\genteert.dll
Size 60KB
SHA256 54c0da1735bb1cb02b60c321de938488345f8d1d26bf389c8cb2acad5d01b831
MD5 6ce814fd1ad7ae07a9e462c26b3a0f69
SHA1 15f440c2a8498a4efe2d9ba0c6268fab4fb8e0a7
SHA512 e5cff6bcb063635e5193209b94a9b2f5465f1c82394f23f50bd30bf0a2b117b209f5fca5aa10a7912a94ad88711dcd490aa528a7202f09490acd96cd640a3556
SSDEEP 768:BVPbKk9022j0efXs6X8zqk3pT3oMapzxc7Ep+DnSIiacDwGpr1a:BVTK+022j0V6mqMozpzxcXOpwEr1
TLSH
T16A536D03678600F5D6526A7A342F7277FB34DFE742E6C6836F69DC902D221A1A52A1C3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b92d20d9.dll

Path C:\Users\Admin\AppData\Local\Temp\is-935A7.tmp\b92d20d9.dll
Size 104KB
SHA256 2c43dc8031cf4a3192f71d410ec699b5253e48f8d1d185e0fa2c1d945967300f
MD5 4eef8e41c2385b9ad55e05760f55e167
SHA1 41aadc7bd0e15d81376b1c697e4247a281b218f7
SHA512 b8a3d83a87685bb0c493a8b07100b7d5653ac5e853d3fd4310614a5cce5b89e8170786f8603c771f4c4dd8823e499cff624c98664fa0d83b775539a5733aae3f
SSDEEP 3072:njjoZ1J3hcHwDzrVrT4cKJFdTgO8Z6CjTO4Md5sA:njjoZH3hcQDzBjYF91mBjqsA
TLSH
T1A5A36B40B5C1C072D5AE167E8828CB758B3FA820DF615DDB73545ABE1E342E1AF31A1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zgqmQcC2.tmp

Path C:\Users\Admin\AppData\Local\Temp\is-K8GJV.tmp\zgqmQcC2.tmp
Size 3.3MB
SHA256 174a79d951cdf00b65a987e5a1e8aa628481b0f1fa0fad667fb4bc66e88f2013
MD5 6b43973e1b89f2be3703919ccb9913dc
SHA1 c8eb439107a299e57e150f09c76dda98a0f29381
SHA512 97faffd1588384e8fcafbba0251167de8efa1e25e818aef0e28d8e8395fe21a55a76bdf8a23d5510cd0f02d2ed7516164b963d6432dbaea9442f0dfaa49d1c91
SSDEEP 49152:cDwGHAkqMu7Ht6SCiGognuzsDaarpQAB1KkX/q52guQk3332C:cMGdPvuzEVTBoPdur3339
TLSH
T143F55C23F24D693ED05B3E3D673792A4987B76602D128C57A7EC3A4C4F391812E2A747
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

adddf.vbe

Path C:\Users\Admin\AppData\Roaming\Quh54cfx\adddf.vbe
Size 9KB
SHA256 4ab61a28fb3175a523e528c1d6964d6005afcde98c5c2bda11b96023e7762822
MD5 9a61b0b598accb28f85ef37a3ddb0ac9
SHA1 be606c84b9adc32097377ebe7181a38f705bbcfc
SHA512 b5fd3086e299419228f7225f39e8fc5111fd17985a1408de64b083e5d077b4bfb003679d3ff0de609dc506937fedecdf1f30a0aa81a168fda5305783aec06943
SSDEEP 192:UK/4eC2uWB9XN5JLoQUlYf0Kd7IeHpySDdKwi9SK6DLXkDxW:ZQP2uyb6S0KlzHpySDo7SK6DIxW
TLSH
T1E612195C021093408EFC9172ADCB19AE771FDE9046C96991E58CED8CF5DE2BC40AE7E5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSI445D.tmp

Path C:\Windows\Installer\MSI445D.tmp
Size 298KB
SHA256 da1fe86141c446921021bb26b6fe2bd2d1bb51e3e614f46f8103ffad8042f2c0
MD5 684f2d21637cb5835172edad55b6a8d9
SHA1 5eac3b8d0733aa11543248b769d7c30d2c53fcdb
SHA512 7b626c2839ac7df4dd764d52290da80f40f7c02cb70c8668a33ad166b0bcb0c1d4114d08a8754e0ae9c0210129ae7e885a90df714ca79bd946fbd8009848538c
SSDEEP 6144:ruAOGlvgiHqfcTmGZ8009t0svTPxmx4yAyA5bDB+urH+nPAMyoZ3:iclvgiHAcTmS80g9vTMx4yAyA5b0urH0
TLSH
T12D548D517BD19032E2FE05307979A6A22ABEB8305CF0CA5FD794156D5E706C0AB28F37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSI5400.tmp

Path C:\Windows\Installer\MSI5400.tmp
Size 114KB
SHA256 a97a4223b0d8d59f4a7ad04e84d4c2016804e8f0fecee8b1496d19d2127f7469
MD5 b6d17ac9c08a829a2fa594ec24bb9d71
SHA1 0772528a16419b52d254fe8f4715fec7251fb280
SHA512 c81e4b16cd95fd1044f1dae88b318910086cd7fdfe35a4403b78bf174f72eed341f3278592fe67d62c0b7e14c7cc03814cb4f9c45e0f0387d5ac42c7674c5263
SSDEEP 1536:VS8CWyksWMcdMyBpjr+UsgtFmVrrXL1MgbIurgnQMolQJs8DhIwc:VS8SgMe+jVrrb1MMBRMoly1DhI
TLSH
T1B3B39D11BA908432D4FF2D381578DA622E3E7D701FE09DAF175456B90EB43D09B39E2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5a39af.msi

Path C:\Windows\Installer\e5a39af.msi
Size 14.0MB
SHA256 cba6e50a9d5d453771bcef4d193bebfa565febbd74a77821c2cb7954b969f77a
MD5 863cbb9994e7ed7be1c128d0b52df781
SHA1 4bf5bc588c0908fe70c82153499fed75008e9adc
SHA512 1289d8494da8fb0605c564105ac40f72fb8f7f5ab83a553403cd364fc9744098f35823d4ee85b470f66fc468a8373e131dd9d3bb882b7cc8c938df954c643427
SSDEEP 393216:aM1Ds9X1ZZBN18AKBye47SvhiSvNv2QI6j35Tcrx:aMY1XD1CyZFSZq6Rc
TLSH
T1D0E6335279425932C1BA0D34287F9B081B7E3E752DB1488F9B64F64E2C727805B79F63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3668-588-0x0000021F896A0000-0x0000021F89776000-memory.dmp

Download

memory/3668-256-0x00007FFA68AC0000-0x00007FFA68AC1000-memory.dmp

Download

memory/3984-499-0x00000000006A0000-0x0000000000A04000-memory.dmp

Download

memory/5136-578-0x000001F5E0280000-0x000001F5E0356000-memory.dmp

Download

memory/5136-254-0x00007FFA68AC0000-0x00007FFA68AC1000-memory.dmp

Download

memory/5420-760-0x0000000002FB0000-0x0000000002FCA000-memory.dmp

Download

memory/5420-764-0x0000000002FF0000-0x0000000002FFA000-memory.dmp

Download

memory/5420-777-0x0000000005190000-0x00000000051A2000-memory.dmp

Download

memory/5420-778-0x00000000051F0000-0x000000000522C000-memory.dmp

Download

memory/5592-547-0x00000000029E0000-0x0000000002A08000-memory.dmp

Download

memory/5796-57-0x0000000000500000-0x00000000005D8000-memory.dmp

Download

memory/5796-500-0x0000000000500000-0x00000000005D8000-memory.dmp

Download

memory/5880-42-0x00000000079D0000-0x00000000079F6000-memory.dmp

Download

memory/5880-32-0x0000000000CF0000-0x0000000000F52000-memory.dmp

Download

memory/5880-39-0x00000000068F0000-0x0000000006E1C000-memory.dmp

Download

memory/5880-37-0x00000000061F0000-0x0000000006256000-memory.dmp

Download

memory/5880-36-0x0000000006130000-0x000000000613A000-memory.dmp

Download

memory/5880-34-0x0000000073490000-0x0000000073C4C000-memory.dmp

Download

memory/5880-33-0x0000000005A00000-0x0000000005A1E000-memory.dmp

Download

memory/5880-49-0x00000000734A2000-0x00000000734A3000-memory.dmp

Download

memory/5880-31-0x00000000734A2000-0x00000000734A3000-memory.dmp

Download

memory/5880-50-0x0000000073490000-0x0000000073C4C000-memory.dmp

Download

memory/5880-53-0x0000000073490000-0x0000000073C4C000-memory.dmp

Download

memory/5880-46-0x000000000D550000-0x000000000D55E000-memory.dmp

Download

memory/5880-45-0x000000000D570000-0x000000000D5AE000-memory.dmp

Download

memory/5924-904-0x00007FFA68BA0000-0x00007FFA68BA1000-memory.dmp

Download

memory/5924-905-0x00007FFA68C50000-0x00007FFA68C51000-memory.dmp

Download