19bca902826ef0dc9a6cf849297ce43ba8b2844bdb913c37230308d3274c953c

Analysis

max time kernel
148s
max time network
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/08/2026, 12:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
OpenVPN-2.6.14-windows-amd64.msi
Size 5.5MB
Sample260804-pg92tazera
SHA256 19bca902826ef0dc9a6cf849297ce43ba8b2844bdb913c37230308d3274c953c
MD5 1e150b4507fc951c8a23b08b85236cd2
SHA1 3f6980947c16778efb3126193726c038453c85d6
SHA512 2074822532d38e94c131ceb3b4b7a01379ea20b5d6e3fb85a6912a586b8e6f1ff5a4973c200087ccd5ecd17727acef2d5568e6afc9df392da5c1f1978b4cd3a8
SSDEEP 98304:fEnzYKCLSBI0lGIOKv8k7VHTB87GnJ6tEGb7MrisWnB+A/yue/bjBe:z/LS9ZzVV87G2hbWij+xB/Re
TLSH
T128460101B6C10462EC678230C85E925AF2F27C5117A0D66FA2DCBF7CBF3B3A5526A751
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

persistence privilege_escalation ransomware

Malware Config

Signatures

Boot or Logon Autostart Execution: Active Setup 2 TTPs 6 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\>OpenVPN_UserSetup\StubPath = "reg add HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run /f /v OPENVPN-GUI /t REG_SZ /d \"C:\\Program Files\\OpenVPN\\bin\\openvpn-gui.exe\""	MsiExec.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Active Setup\Installed Components\>OpenVPN_UserSetup	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\>OpenVPN_UserSetup\ = "OpenVPN 2.6.14-I001 amd64"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\>OpenVPN_UserSetup\Version = "1"	MsiExec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\>OpenVPN_UserSetup\IsInstalled = "1"	MsiExec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\>OpenVPN_UserSetup\DontAsk = "2"	MsiExec.exe

Drops file in Drivers directory 9 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\SET20C8.tmp	DrvInst.exe
File created	C:\Windows\System32\drivers\SET20C8.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\drivers\wintun.sys	DrvInst.exe
File opened for modification	C:\Windows\System32\drivers\SET300A.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\drivers\SET3644.tmp	DrvInst.exe
File created	C:\Windows\System32\drivers\SET3644.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\drivers\ovpn-dco.sys	DrvInst.exe
File created	C:\Windows\System32\drivers\SET300A.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\drivers\tap0901.sys	DrvInst.exe

Executes dropped EXE 6 IoCs

pid	Process
5192	openvpn-gui.exe
1896	openvpn.exe
2524	openvpnserv.exe
6080	openvpnserv2.exe
3004	openvpnserv2.exe
4904	openvpn-gui.exe

Loads dropped DLL 22 IoCs

pid	Process
4460	MsiExec.exe
4460	MsiExec.exe
3320	MsiExec.exe
3320	MsiExec.exe
3320	MsiExec.exe
3320	MsiExec.exe
2700	MsiExec.exe
2700	MsiExec.exe
2700	MsiExec.exe
2700	MsiExec.exe
2700	MsiExec.exe
1896	openvpn.exe
1896	openvpn.exe
1896	openvpn.exe
1896	openvpn.exe
1896	openvpn.exe
1896	openvpn.exe
2524	openvpnserv.exe
2700	MsiExec.exe
2700	MsiExec.exe
3320	MsiExec.exe
4460	MsiExec.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000\Software\Microsoft\Windows\CurrentVersion\Run\OpenVPN-GUI = "C:\\Program Files\\OpenVPN\\bin\\openvpn-gui.exe"	msiexec.exe

Badlisted process makes network request 2 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
3	5396	msiexec.exe
3	5396	msiexec.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System32\DriverStore\FileRepository\usb4p2pnetadapter.inf_amd64_cc88f42fbf400320\usb4p2pnetadapter.PNF	MsiExec.exe
File created	C:\Windows\System32\DriverStore\FileRepository\bcmdhd64.inf_amd64_0c3c6ca9708e5a9a\bcmdhd64.PNF	MsiExec.exe
File created	C:\Windows\System32\DriverStore\FileRepository\nett4x64.inf_amd64_345dd70a1546350e\nett4x64.PNF	MsiExec.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{5b26f65c-8efa-344c-9613-c948567cc254}\wintun.cat	DrvInst.exe
File opened for modification	C:\Windows\System32\CatRoot2\dberr.txt	DrvInst.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netwtw02.inf_amd64_669639d5a41714fa\netwtw02.PNF	MsiExec.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netrtwlans.inf_amd64_e0770fc2820687e2\netrtwlans.PNF	MsiExec.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netimm.inf_amd64_8b2087393aaef952\netimm.PNF	MsiExec.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{5b26f65c-8efa-344c-9613-c948567cc254}\SET104D.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{afd9d733-5467-0e4b-b126-65e4a878bcda}\SET1ACF.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netvchannel.inf_amd64_4282c59d3148caa2\netvchannel.PNF	MsiExec.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netwmbclass.inf_amd64_0958b27686099e9c\netwmbclass.PNF	MsiExec.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netr28ux.inf_amd64_2613a90929adebda\netr28ux.PNF	MsiExec.exe
File created	C:\Windows\System32\DriverStore\FileRepository\athw8x.inf_amd64_600627b27b9c7b10\athw8x.PNF	MsiExec.exe
File created	C:\Windows\System32\DriverStore\FileRepository\usbncm.inf_amd64_b48ccf297d0cca81\usbncm.PNF	MsiExec.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\oemvista.inf_amd64_ba3e477187f1080b\tap0901.sys	DrvInst.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netavpna.inf_amd64_27530893ea84631e\netavpna.PNF	MsiExec.exe
File created	C:\Windows\System32\DriverStore\FileRepository\bthpan.inf_amd64_c908ea6dab3e932a\bthpan.PNF	MsiExec.exe
File created	C:\Windows\System32\DriverStore\Temp\{5b26f65c-8efa-344c-9613-c948567cc254}\SET104D.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{5b26f65c-8efa-344c-9613-c948567cc254}	DrvInst.exe
File created	C:\Windows\System32\DriverStore\FileRepository\ovpn-dco.inf_amd64_b737bb7e846ccda6\ovpn-dco.PNF	MsiExec.exe
File created	C:\Windows\System32\DriverStore\FileRepository\nete1e3e.inf_amd64_71ee3a27d9580084\nete1e3e.PNF	MsiExec.exe
File created	C:\Windows\System32\DriverStore\FileRepository\qcwlan64.inf_amd64_71c84e1405061462\qcwlan64.PNF	MsiExec.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netwns64.inf_amd64_d630255fa92e6727\netwns64.PNF	MsiExec.exe
File created	C:\Windows\System32\DriverStore\FileRepository\msux64w10.inf_amd64_f329abee714f5000\msux64w10.PNF	MsiExec.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netsstpa.inf_amd64_a982732ea027811e\netsstpa.PNF	MsiExec.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netrtwlane.inf_amd64_9f581aa49737d7bf\netrtwlane.PNF	MsiExec.exe
File created	C:\Windows\System32\DriverStore\FileRepository\net2ic68.inf_amd64_7af2e2aa52ab9b71\net2ic68.PNF	MsiExec.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netmyk64.inf_amd64_2f029cbaae1f9a8c\netmyk64.PNF	MsiExec.exe
File created	C:\Windows\System32\DriverStore\FileRepository\rtcx21x64.inf_amd64_feec7a9662e785f0\rtcx21x64.PNF	MsiExec.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mrvlpcie8897.inf_amd64_668551398886eaf3\mrvlpcie8897.PNF	MsiExec.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\oemvista.inf_amd64_ba3e477187f1080b\tap0901.cat	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{afd9d733-5467-0e4b-b126-65e4a878bcda}\ovpn-dco.sys	DrvInst.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netwtw04.inf_amd64_28271e5be9a9f6f4\netwtw04.PNF	MsiExec.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netwtw06.inf_amd64_c5f16d20642e3070\netwtw06.PNF	MsiExec.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netl160a.inf_amd64_24496b197c188680\netl160a.PNF	MsiExec.exe
File opened for modification	C:\Windows\System32\CatRoot2\dberr.txt	DrvInst.exe
File created	C:\Windows\System32\DriverStore\FileRepository\rndiscmp.inf_amd64_e3cf74e485b2778b\rndiscmp.PNF	MsiExec.exe
File created	C:\Windows\System32\DriverStore\FileRepository\net8187bv64.inf_amd64_4295cf068229eafc\net8187bv64.PNF	MsiExec.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netmlx4eth63.inf_amd64_59e293fc00a669f4\netmlx4eth63.PNF	MsiExec.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\wintun.inf_amd64_def3401515466414\wintun.cat	DrvInst.exe
File created	C:\Windows\System32\DriverStore\FileRepository\usbnet.inf_amd64_7e86f0597bbc0f66\usbnet.PNF	MsiExec.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netl260a.inf_amd64_39ee03ea6ee818e4\netl260a.PNF	MsiExec.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netl1e64.inf_amd64_616d8a2e59fc462f\netl1e64.PNF	MsiExec.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netbxnda.inf_amd64_5cfb6a07d9d75a4a\netbxnda.PNF	MsiExec.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netl1c63x64.inf_amd64_20b3691d6e7445a9\netl1c63x64.PNF	MsiExec.exe
File created	C:\Windows\System32\DriverStore\FileRepository\rt640x64.inf_amd64_cbf4e23981c3c8a3\rt640x64.PNF	MsiExec.exe
File created	C:\Windows\System32\DriverStore\Temp\{2c44e0ab-78dd-5d4a-95ec-763ad9bed9c1}\SET1994.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{afd9d733-5467-0e4b-b126-65e4a878bcda}\SET1ACE.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\drvstore.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\ovpn-dco.inf_amd64_b737bb7e846ccda6\ovpn-dco.cat	DrvInst.exe
File created	C:\Windows\System32\DriverStore\FileRepository\net1ic64.inf_amd64_93678a2d694d4579\net1ic64.PNF	MsiExec.exe
File created	C:\Windows\System32\DriverStore\FileRepository\ndisimplatformmp.inf_amd64_8f9eb8ff490e6c70\ndisimplatformmp.PNF	MsiExec.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netwtw10.inf_amd64_400af1170541b7b0\netwtw10.PNF	MsiExec.exe
File created	C:\Windows\System32\DriverStore\FileRepository\c_net.inf_amd64_64490bb3b4dcbb9a\c_net.PNF	MsiExec.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netg664.inf_amd64_f4299f18c1844724\netg664.PNF	MsiExec.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{2c44e0ab-78dd-5d4a-95ec-763ad9bed9c1}\tap0901.cat	DrvInst.exe
File created	C:\Windows\System32\DriverStore\FileRepository\net1yx64.inf_amd64_3e5c319fac7067a7\net1yx64.PNF	MsiExec.exe
File created	C:\Windows\System32\DriverStore\FileRepository\nete1g3e.inf_amd64_1bcc7029f170b19a\nete1g3e.PNF	MsiExec.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netrasa.inf_amd64_417ad0eea84e3a58\netrasa.PNF	MsiExec.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{afd9d733-5467-0e4b-b126-65e4a878bcda}\ovpn-dco.inf	DrvInst.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netvwifimp.inf_amd64_16c785b9ba77e7b0\netvwifimp.PNF	MsiExec.exe
File created	C:\Windows\System32\DriverStore\FileRepository\b57nd60a.inf_amd64_86493878b5fef607\b57nd60a.PNF	MsiExec.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\wintun.inf_amd64_def3401515466414\wintun.sys	DrvInst.exe

Drops file in Program Files directory 27 IoCs

description	ioc	Process
File created	C:\Program Files\OpenVPN\bin\openvpn-gui.exe	msiexec.exe
File created	C:\Program Files\OpenVPN\sample-config\client.ovpn	msiexec.exe
File created	C:\Program Files\OpenVPN\license.txt	msiexec.exe
File created	C:\Program Files\OpenVPN\log\README.txt	msiexec.exe
File created	C:\Program Files\OpenVPN\bin\openvpnserv.exe	msiexec.exe
File created	C:\Program Files\Common Files\ovpn-dco\Win11\ovpn-dco.inf	msiexec.exe
File created	C:\Program Files\OpenVPN\bin\tapctl.exe	msiexec.exe
File created	C:\Program Files\OpenVPN\doc\INSTALL-win32.txt	msiexec.exe
File created	C:\Program Files\OpenVPN\ssl\modules\legacy.dll	msiexec.exe
File created	C:\Program Files\OpenVPN\bin\libpkcs11-helper-1.dll	msiexec.exe
File created	C:\Program Files\OpenVPN\res\ovpn.ico	msiexec.exe
File created	C:\Program Files\OpenVPN\sample-config\server.ovpn	msiexec.exe
File created	C:\Program Files\OpenVPN\include\tap-windows.h	msiexec.exe
File created	C:\Program Files\OpenVPN\bin\vcruntime140.dll	msiexec.exe
File created	C:\Program Files\OpenVPN\bin\libopenvpn_plap.dll	msiexec.exe
File created	C:\Program Files\OpenVPN\bin\openvpn-plap-install.reg	msiexec.exe
File created	C:\Program Files\OpenVPN\doc\openvpn.8.html	msiexec.exe
File created	C:\Program Files\Common Files\ovpn-dco\Win11\ovpn-dco.sys	msiexec.exe
File created	C:\Program Files\OpenVPN\bin\openvpn-plap-uninstall.reg	msiexec.exe
File created	C:\Program Files\OpenVPN\config\README.txt	msiexec.exe
File created	C:\Program Files\OpenVPN\bin\libcrypto-3-x64.dll	msiexec.exe
File created	C:\Program Files\OpenVPN\bin\libssl-3-x64.dll	msiexec.exe
File created	C:\Program Files\OpenVPN\bin\openvpnserv2.exe	msiexec.exe
File created	C:\Program Files\Common Files\ovpn-dco\Win11\ovpn-dco.cat	msiexec.exe
File created	C:\Program Files\OpenVPN\config-auto\README.txt	msiexec.exe
File created	C:\Program Files\OpenVPN\bin\openvpn-plap-install-new.reg	MsiExec.exe
File created	C:\Program Files\OpenVPN\bin\openvpn.exe	msiexec.exe

Drops file in Windows directory 41 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\MSI460E.tmp	msiexec.exe
File created	C:\Windows\inf\oem2.inf	DrvInst.exe
File created	C:\Windows\inf\oem3.inf	DrvInst.exe
File created	C:\Windows\Installer\e59ed35.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIFD43.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI219.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI46DA.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\e59ed35.msi	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI3B1.tmp	msiexec.exe
File created	C:\Windows\inf\oem1.inf	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File opened for modification	C:\Windows\Installer\MSI1F3B.tmp	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File opened for modification	C:\Windows\Installer\MSI45A0.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\SystemTemp\~DF977C8F7ED9243E80.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIF5FF.tmp	msiexec.exe
File opened for modification	C:\Windows\inf\oem1.inf	DrvInst.exe
File created	C:\Windows\Installer\{CD1DCDF3-BCAC-4233-A1CC-5DAFEE1E604E}\openvpn.ico	msiexec.exe
File opened for modification	C:\Windows\Installer\{CD1DCDF3-BCAC-4233-A1CC-5DAFEE1E604E}\openvpn.ico	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File created	C:\Windows\SystemTemp\~DF8EA7B0F17CB10F8A.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DF25E869D08D95DB9B.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIFEFA.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\{CD1DCDF3-BCAC-4233-A1CC-5DAFEE1E604E}\tapctl_create.ico	msiexec.exe
File created	C:\Windows\Installer\SourceHash{CD1DCDF3-BCAC-4233-A1CC-5DAFEE1E604E}	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File opened for modification	C:\Windows\Installer\MSIFFD6.tmp	msiexec.exe
File opened for modification	C:\Windows\inf\oem2.inf	DrvInst.exe
File opened for modification	C:\Windows\inf\oem3.inf	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File created	C:\Windows\Installer\e59ed37.msi	msiexec.exe
File created	C:\Windows\SystemTemp\~DF08162A599901B6EF.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIFF78.tmp	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	MsiExec.exe
File opened for modification	C:\Windows\Installer\MSI1238.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI1A58.tmp	msiexec.exe
File created	C:\Windows\Installer\{CD1DCDF3-BCAC-4233-A1CC-5DAFEE1E604E}\tapctl_create.ico	msiexec.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1260	sc.exe
604	sc.exe

Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs

persistence privilege_escalation

Installer Packages

T1546.016

Msiexec

T1218.007

pid	Process
5396	msiexec.exe

Event Triggered Execution: Netsh Helper DLL 1 TTPs 9 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	DrvInst.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Service	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Filters	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\UpperFilters	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Service	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\LowerFilters	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\LowerFilters	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Service	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Phantom	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\LowerFilters	DrvInst.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\LowerFilters	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\LowerFilters	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	MsiExec.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	MsiExec.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\CompatibleIDs	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	MsiExec.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID	MsiExec.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\LowerFilters	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Service	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	MsiExec.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Filters	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\UpperFilters	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\CompatibleIDs	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Service	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\UpperFilters	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Phantom	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\UpperFilters	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\UpperFilters	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Phantom	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Filters	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\UpperFilters	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	DrvInst.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows Script\Settings\Telemetry\msiexec.exe	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\RAS AutoDial	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows Script\Settings\Telemetry\msiexec.exe\JScript9LegacySetScriptStateStarted = "240786531"	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows Script	MsiExec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe

Modifies registry class 57 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3FDCD1DCCACB33241ACCD5FAEEE106E4\SourceList\Net	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3FDCD1DCCACB33241ACCD5FAEEE106E4\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\OpenVPNFile\shell\open\command	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\OpenVPNFile\shell	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\OpenVPNFile\shell\import\ = "Import into OpenVPN-GUI"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\3FDCD1DCCACB33241ACCD5FAEEE106E4\OpenVPN.GUI = "OpenVPN"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3FDCD1DCCACB33241ACCD5FAEEE106E4\Assignment = "1"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3FDCD1DCCACB33241ACCD5FAEEE106E4\InstanceType = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\3FDCD1DCCACB33241ACCD5FAEEE106E4\OpenVPN.Service = "OpenVPN"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\3FDCD1DCCACB33241ACCD5FAEEE106E4\OpenVPN.SampleCfg = "OpenVPN"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\3FDCD1DCCACB33241ACCD5FAEEE106E4\Drivers.Wintun = "Drivers"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\3FDCD1DCCACB33241ACCD5FAEEE106E4\EasyRSA = "\x06OpenSSL"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\OpenVPNFile\shell\run\command\ = "\"C:\\Program Files\\OpenVPN\\bin\\openvpn.exe\" --pause-exit --config \"%1\""	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3FDCD1DCCACB33241ACCD5FAEEE106E4\Clients = 3a0000000000	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\OpenVPNFile	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\OpenVPNFile\DefaultIcon\ = "C:\\Program Files\\OpenVPN\\res\\ovpn.ico,0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\OpenVPNFile\shell\open\command\ = "\"notepad.exe\" \"%1\""	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\OpenVPNFile\shell\import\command\ = "\"C:\\Program Files\\OpenVPN\\bin\\openvpn-gui.exe\" --command import \"%1\""	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\3FDCD1DCCACB33241ACCD5FAEEE106E4\Drivers	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\3FDCD1DCCACB33241ACCD5FAEEE106E4\Drivers.TAPWindows6 = "Drivers"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3FDCD1DCCACB33241ACCD5FAEEE106E4\ProductIcon = "C:\\Windows\\Installer\\{CD1DCDF3-BCAC-4233-A1CC-5DAFEE1E604E}\\openvpn.ico"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\3FDCD1DCCACB33241ACCD5FAEEE106E4\OpenVPN.Documentation = "OpenVPN"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\68FDB164983D1744FB639908B6461C72	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\3FDCD1DCCACB33241ACCD5FAEEE106E4\Drivers.OvpnDco = "Drivers"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3FDCD1DCCACB33241ACCD5FAEEE106E4\AuthorizedLUAApp = "0"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3FDCD1DCCACB33241ACCD5FAEEE106E4\DeploymentFlags = "3"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\OpenVPNFile\shell\ = "import"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3FDCD1DCCACB33241ACCD5FAEEE106E4\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\OpenVPNFile\ = "OpenVPN Config File"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\OpenVPNFile\shell\open\command	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\OpenVPNFile\shell\run\ = "Start OpenVPN on this config file"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\OpenVPNFile	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\3FDCD1DCCACB33241ACCD5FAEEE106E4\OpenVPN	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\3FDCD1DCCACB33241ACCD5FAEEE106E4\OpenSSL = "\x06"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\.ovpn	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3FDCD1DCCACB33241ACCD5FAEEE106E4\SourceList\PackageName = "OpenVPN-2.6.14-windows-amd64.msi"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3FDCD1DCCACB33241ACCD5FAEEE106E4\SourceList\Media	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.ovpn\ = "OpenVPNFile"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\OpenVPNFile\DefaultIcon	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\OpenVPNFile\shell\run	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\OpenVPNFile\shell\import	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3FDCD1DCCACB33241ACCD5FAEEE106E4\PackageCode = "22912DF0EEBE3A3498FA548D65979F16"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3FDCD1DCCACB33241ACCD5FAEEE106E4\Language = "1033"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3FDCD1DCCACB33241ACCD5FAEEE106E4\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3FDCD1DCCACB33241ACCD5FAEEE106E4\SourceList\Media\1 = ";"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\3FDCD1DCCACB33241ACCD5FAEEE106E4\OpenVPN.GUI.OnLogon = "OpenVPN.GUI"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\3FDCD1DCCACB33241ACCD5FAEEE106E4\OpenVPN.PLAP.Register = "\x06OpenVPN.Service"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3FDCD1DCCACB33241ACCD5FAEEE106E4\Version = "33949049"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\OpenVPNFile\shell	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\OpenVPNFile\shell\open	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\OpenVPNFile\shell\import\command	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3FDCD1DCCACB33241ACCD5FAEEE106E4\AdvertiseFlags = "388"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3FDCD1DCCACB33241ACCD5FAEEE106E4	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3FDCD1DCCACB33241ACCD5FAEEE106E4\ProductName = "OpenVPN 2.6.14-I001 amd64"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\OpenVPNFile\shell\run\command	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\3FDCD1DCCACB33241ACCD5FAEEE106E4	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\68FDB164983D1744FB639908B6461C72\3FDCD1DCCACB33241ACCD5FAEEE106E4	msiexec.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
6036	msiexec.exe
6036	msiexec.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid
4

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	5396	msiexec.exe
Token: SeIncreaseQuotaPrivilege	5396	msiexec.exe
Token: SeSecurityPrivilege	6036	msiexec.exe
Token: SeCreateTokenPrivilege	5396	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	5396	msiexec.exe
Token: SeLockMemoryPrivilege	5396	msiexec.exe
Token: SeIncreaseQuotaPrivilege	5396	msiexec.exe
Token: SeMachineAccountPrivilege	5396	msiexec.exe
Token: SeTcbPrivilege	5396	msiexec.exe
Token: SeSecurityPrivilege	5396	msiexec.exe
Token: SeTakeOwnershipPrivilege	5396	msiexec.exe
Token: SeLoadDriverPrivilege	5396	msiexec.exe
Token: SeSystemProfilePrivilege	5396	msiexec.exe
Token: SeSystemtimePrivilege	5396	msiexec.exe
Token: SeProfSingleProcessPrivilege	5396	msiexec.exe
Token: SeIncBasePriorityPrivilege	5396	msiexec.exe
Token: SeCreatePagefilePrivilege	5396	msiexec.exe
Token: SeCreatePermanentPrivilege	5396	msiexec.exe
Token: SeBackupPrivilege	5396	msiexec.exe
Token: SeRestorePrivilege	5396	msiexec.exe
Token: SeShutdownPrivilege	5396	msiexec.exe
Token: SeDebugPrivilege	5396	msiexec.exe
Token: SeAuditPrivilege	5396	msiexec.exe
Token: SeSystemEnvironmentPrivilege	5396	msiexec.exe
Token: SeChangeNotifyPrivilege	5396	msiexec.exe
Token: SeRemoteShutdownPrivilege	5396	msiexec.exe
Token: SeUndockPrivilege	5396	msiexec.exe
Token: SeSyncAgentPrivilege	5396	msiexec.exe
Token: SeEnableDelegationPrivilege	5396	msiexec.exe
Token: SeManageVolumePrivilege	5396	msiexec.exe
Token: SeImpersonatePrivilege	5396	msiexec.exe
Token: SeCreateGlobalPrivilege	5396	msiexec.exe
Token: SeCreateTokenPrivilege	5396	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	5396	msiexec.exe
Token: SeLockMemoryPrivilege	5396	msiexec.exe
Token: SeIncreaseQuotaPrivilege	5396	msiexec.exe
Token: SeMachineAccountPrivilege	5396	msiexec.exe
Token: SeTcbPrivilege	5396	msiexec.exe
Token: SeSecurityPrivilege	5396	msiexec.exe
Token: SeTakeOwnershipPrivilege	5396	msiexec.exe
Token: SeLoadDriverPrivilege	5396	msiexec.exe
Token: SeSystemProfilePrivilege	5396	msiexec.exe
Token: SeSystemtimePrivilege	5396	msiexec.exe
Token: SeProfSingleProcessPrivilege	5396	msiexec.exe
Token: SeIncBasePriorityPrivilege	5396	msiexec.exe
Token: SeCreatePagefilePrivilege	5396	msiexec.exe
Token: SeCreatePermanentPrivilege	5396	msiexec.exe
Token: SeBackupPrivilege	5396	msiexec.exe
Token: SeRestorePrivilege	5396	msiexec.exe
Token: SeShutdownPrivilege	5396	msiexec.exe
Token: SeDebugPrivilege	5396	msiexec.exe
Token: SeAuditPrivilege	5396	msiexec.exe
Token: SeSystemEnvironmentPrivilege	5396	msiexec.exe
Token: SeChangeNotifyPrivilege	5396	msiexec.exe
Token: SeRemoteShutdownPrivilege	5396	msiexec.exe
Token: SeUndockPrivilege	5396	msiexec.exe
Token: SeSyncAgentPrivilege	5396	msiexec.exe
Token: SeEnableDelegationPrivilege	5396	msiexec.exe
Token: SeManageVolumePrivilege	5396	msiexec.exe
Token: SeImpersonatePrivilege	5396	msiexec.exe
Token: SeCreateGlobalPrivilege	5396	msiexec.exe
Token: SeCreateTokenPrivilege	5396	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	5396	msiexec.exe
Token: SeLockMemoryPrivilege	5396	msiexec.exe

Suspicious use of FindShellTrayWindow 5 IoCs

pid	Process
5396	msiexec.exe
5192	openvpn-gui.exe
5192	openvpn-gui.exe
5396	msiexec.exe
5192	openvpn-gui.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
5192	openvpn-gui.exe
5192	openvpn-gui.exe
5192	openvpn-gui.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
5396	msiexec.exe
6036	msiexec.exe
4460	MsiExec.exe
3320	MsiExec.exe
2700	MsiExec.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 6036 wrote to memory of 4460	6036	msiexec.exe	90
PID 6036 wrote to memory of 4812	6036	msiexec.exe	96
PID 6036 wrote to memory of 3320	6036	msiexec.exe	98
PID 6036 wrote to memory of 2700	6036	msiexec.exe	100
PID 2700 wrote to memory of 1580	2700	MsiExec.exe	109
PID 5192 wrote to memory of 1896	5192	openvpn-gui.exe	112
PID 2700 wrote to memory of 1016	2700	MsiExec.exe	116
PID 2700 wrote to memory of 5840	2700	MsiExec.exe	120
PID 2700 wrote to memory of 1260	2700	MsiExec.exe	126
PID 2700 wrote to memory of 604	2700	MsiExec.exe	128
PID 4460 wrote to memory of 4904	4460	MsiExec.exe	132

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\OpenVPN-2.6.14-windows-amd64.msi
1⤵
- Badlisted process makes network request
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:5396

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Adds Run key to start application
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6036
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding D53F803212DC3E44112D31959A00EC6D C
  2⤵
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4460
- - C:\Program Files\OpenVPN\bin\openvpn-gui.exe
    "C:\Program Files\OpenVPN\bin\openvpn-gui.exe"
    3⤵
    - Executes dropped EXE
    PID:4904
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:4812
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding 2B0558225605D23DFD1AADF9989A3885
  2⤵
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  PID:3320
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding 7D6EA470DCD711875AADF4DDDE39164A E Global\MSI0000
  2⤵
  - Boot or Logon Autostart Execution: Active Setup
  - Loads dropped DLL
  - Drops file in System32 directory
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - Checks SCSI registry key(s)
  - Modifies data under HKEY_USERS
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2700
- - C:\Windows\System32\netsh.exe
    netsh interface set interface name="Local Area Connection" newname="OpenVPN Wintun"
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:1580
- - C:\Windows\System32\netsh.exe
    netsh interface set interface name="Local Area Connection" newname="OpenVPN TAP-Windows6"
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:1016
- - C:\Windows\System32\netsh.exe
    netsh interface set interface name="Local Area Connection" newname="OpenVPN Data Channel Offload"
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:5840
- - C:\Windows\System32\sc.exe
    "C:\Windows\System32\sc.exe" config OpenVPNService start= auto
    3⤵
    - Launches sc.exe
    PID:1260
- - C:\Windows\System32\sc.exe
    "C:\Windows\System32\sc.exe" start OpenVPNService
    3⤵
    - Launches sc.exe
    PID:604

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
PID:6004

C:\Windows\system32\DrvInst.exe
DrvInst.exe "4" "1" "C:\Windows\Temp\fc0e6b860b50f073bf13a7f68ccea1fb42ab73045ee4d2aff48c9c00401ec705\wintun.inf" "9" "46f7a3dcf" "0000000000000198" "WinSta0\Default" "0000000000000174" "208" "C:\Windows\Temp\fc0e6b860b50f073bf13a7f68ccea1fb42ab73045ee4d2aff48c9c00401ec705"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
PID:4288

C:\Windows\system32\DrvInst.exe
DrvInst.exe "4" "1" "C:\Windows\Temp\2d433454397bd5dede613388c473d0938856beee5822489e9cb1f16bfab50adf\OemVista.inf" "9" "407ede39f" "0000000000000114" "WinSta0\Default" "00000000000000EC" "208" "C:\Windows\Temp\2d433454397bd5dede613388c473d0938856beee5822489e9cb1f16bfab50adf"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
PID:5504

C:\Windows\system32\DrvInst.exe
DrvInst.exe "4" "1" "C:\Program Files\Common Files\ovpn-dco\Win11\ovpn-dco.inf" "9" "4e746adf3" "00000000000000EC" "WinSta0\Default" "000000000000017C" "208" "C:\Program Files\Common Files\ovpn-dco\Win11"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
PID:1536

C:\Windows\system32\DrvInst.exe
DrvInst.exe "2" "11" "ROOT\NET\0000" "C:\Windows\System32\DriverStore\FileRepository\wintun.inf_amd64_def3401515466414\wintun.inf" "oem1.inf:9ef34515d755ec66:Wintun.Install:0.8.0.0:wintun," "42b53aaff" "0000000000000114" "5bbe"
1⤵
- Drops file in Drivers directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
PID:3288

C:\Program Files\OpenVPN\bin\openvpn-gui.exe
"C:\Program Files\OpenVPN\bin\openvpn-gui.exe"
1⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5192
- C:\Program Files\OpenVPN\bin\openvpn.exe
  openvpn --version
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:1896

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s Netman
1⤵
- Modifies data under HKEY_USERS
PID:5256

C:\Windows\system32\DrvInst.exe
DrvInst.exe "2" "11" "ROOT\NET\0001" "C:\Windows\System32\DriverStore\FileRepository\oemvista.inf_amd64_ba3e477187f1080b\oemvista.inf" "oem2.inf:3beb73aff103cc24:tap0901.ndi:9.27.0.0:root\tap0901," "433338203" "000000000000017C" "5bbe"
1⤵
- Drops file in Drivers directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
PID:3916

C:\Windows\system32\DrvInst.exe
DrvInst.exe "2" "11" "ROOT\NET\0002" "C:\Windows\System32\DriverStore\FileRepository\ovpn-dco.inf_amd64_b737bb7e846ccda6\ovpn-dco.inf" "oem3.inf:c695c3de07ba2b5d:ovpn-dco_Device:1.2.1.0:ovpn-dco," "43b135903" "0000000000000114" "5bbe"
1⤵
- Drops file in Drivers directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
PID:2560

C:\Program Files\OpenVPN\bin\openvpnserv.exe
"C:\Program Files\OpenVPN\bin\openvpnserv.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2524

C:\Program Files\OpenVPN\bin\openvpnserv2.exe
"C:\Program Files\OpenVPN\bin\openvpnserv2.exe"
1⤵
- Executes dropped EXE
PID:6080

C:\Program Files\OpenVPN\bin\openvpnserv2.exe
"C:\Program Files\OpenVPN\bin\openvpnserv2.exe"
1⤵
- Executes dropped EXE
PID:3004

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:4960

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Installer Packages

T1546.016

Netsh Helper DLL

T1546.007

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Installer Packages

T1546.016

Netsh Helper DLL

T1546.007

Defense Evasion

Modify Registry

T1112

System Binary Proxy Execution

T1218

Msiexec

T1218.007

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e59ed36.rbs

Path C:\Config.Msi\e59ed36.rbs
Size 876KB
SHA256 9f62ef2a5d328cda363b2c02236601b82ab76373f5ee9c8aaea9a23284448858
MD5 47ae104777fd5ac7f1b45c8102f9c83b
SHA1 04accec7ca9889ad927df1ab13752e4120da950c
SHA512 d2d9e52a2ca0ca3098b9955fb02e9a88fc3f1750655011d1171fb8c828dafe5d3faaf50d5582befc1bbe06172aecd62922e48a1fe5a2d6bba96b2a65ae8104ba
SSDEEP 24576:XC4LJNBjSblC4LJNBjSbLC4LJNBjSb9C4LJNBjSbg:3vB+JvB+3vB+BvB+U
TLSH
T173157D05B7D000F9EDB7863889674616E773780107749A9F03A4837AEF2F7D1A639B62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ovpn-dco.cat

Path C:\PROGRA~1\COMMON~1\ovpn-dco\Win11\ovpn-dco.cat
Size 11KB
SHA256 8c9456aeacd5566234519b5b34ceecd0f7ebb22f6813747e595f5945517ec438
MD5 8fd89f82a273cd3ed2f76f7f09cf30ae
SHA1 43bb4e81acac468715e874ab86521497ca2e9369
SHA512 f77ad5dca3f72701ab2b779e900d22fa3f0c3ca6b8713e25bb7d6d1480992518d66879b6315122c555b32be527fef7c86ead1d59244c955287d48c3132b684f0
SSDEEP 192:FXasYRLFJCtNRnnXBEwZIhYCpMKIjwX01k9z3AmFX:FS2NdRIh3jHR9zlV
TLSH
T199322BA796280082DD97BD6042D8E897BC3E3BCB1C11556A22AFFA540DD33D8FB1416F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ovpn-dco.sys

Path C:\PROGRA~1\COMMON~1\ovpn-dco\Win11\ovpn-dco.sys
Size 90KB
SHA256 2c2958dac6f36922ae094705e058bf6470e1622b31318fb9fe0db5457e383f45
MD5 6b0722f0b6ed86877d96da4a57f3aa03
SHA1 85cd52a10a8be6ca807fb5f6e180a1b1a1554583
SHA512 74c399af44e982bb02eeb103bc634d2b5923b5623625a87bd148b6dad1afc438775a00ecbcdeeb2adb13d04c3b1d23a92cd9ee815c89f1af4fdbb3eb8fc3f49b
SSDEEP 1536:uDK30YojzlMIQLPZkecHuvaSsYU2ug/0A0gA1j7ajE/T2yR1O8Jz4:u2x5pTZUHuvat2ug/0A0Px2yTOw0
TLSH
T1CE93F875A6E010D4F47B96F886B68A05BFB17A922F32D6DF0410856D0F32BC8CE39755
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ovpn-dco.inf

Path C:\Program Files\Common Files\ovpn-dco\Win11\ovpn-dco.inf
Size 2KB
SHA256 1f6c35bc11d910f91c32ea54894d0fddb0094876bdd526d04a9287d04d636242
MD5 77da079a3665afc84d05c3d07bcaa0d0
SHA1 3fbfafe2c08100f5b46b792398c2ecb9157760e9
SHA512 10fcd8464c6aab386bf2f675175598764e0b784a898b7b450fef3d055ecf902c7a57ac0aef2725b9e6899146e4e9230c8677bfd2a8f18489b642fa6beca25507
TLSH
T19441F14A52C20FBD3B432D7596077BA2B9D6910050C8151AF18CDA468B8FF99B31B7EA
MD5 SHA1 SHA512 TLSH

Submit Download

VCRUNTIME140.dll

Path C:\Program Files\OpenVPN\bin\VCRUNTIME140.dll
Size 94KB
SHA256 c51c64dfb7c445ecf0001f69c27e13299ddcfba0780efa72b866a7487b7491c7
MD5 5797d2a762227f35cdd581ec648693a8
SHA1 e587b804db5e95833cbd2229af54c755ee0393b9
SHA512 5c4de4f65c0338f9a63b853db356175cae15c2ddc6b727f473726d69ee0d07545ac64b313c380548211216ea667caf32c5a0fd86f7abe75fc60086822bc4c92e
SSDEEP 1536:yOHL+4KsAzAfadZw+1Hcx8uIYNU5U9H0Q8ecbjt1lLN:yOr/Z+jPYNV9H0Q8ecbjt1j
TLSH
T12F937C4A76A442B7D06BD274C1E34A5AF770B8408B7053CF03B6866A5F63BE05E3E356
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libcrypto-3-x64.dll

Path C:\Program Files\OpenVPN\bin\libcrypto-3-x64.dll
Size 4.6MB
SHA256 71270ed463648bcbe45829cbc0ce3827faf3267e46d530ae0a82d9bc0c619ec0
MD5 5984ea63df1671b1d174d4d957a7b483
SHA1 3691290a86290533537593654db9e11b2bd15fac
SHA512 04f087a1bce16c811eb6a4be318dc5846e5553f3b0d50318aa335bc46a262cfe177479ea06b637aa6934df1ae4a998e7b764df17d2efba0ef80ef302c05c57a2
SSDEEP 98304:9gGN3UNaucJAWjXHJPx+s1CPwDvt3uF0nCc:6GN3UZcJAWjXpph1CPwDvt3uF0nCc
TLSH
T18E268C69A6BC0096D86A95BCC2D76227D371B41257F057CF2E284AF90F23FD426BB740
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libpkcs11-helper-1.dll

Path C:\Program Files\OpenVPN\bin\libpkcs11-helper-1.dll
Size 111KB
SHA256 e2500ded6e44090f0c76528903269938a029bee206fde25adac040d6e3a124f7
MD5 e5353f2c01b77b433ea518923b1b8dbd
SHA1 fad48fbf2d115b5426b40fd52d51a8729a976462
SHA512 b81ae3412a4312e0f499860586d866d47f41647441f5875e645ffa74f83aa2ef1569b5df6535ab347a89fd3b6bb6bc69558bca65336674f0459eeda167efeb34
SSDEEP 1536:Usfoicdz0Suh6YcYwnIrHL6PS7ySVfPrZm8KAd0uM82FjE25YiL3nyj7LoNA:qdzA3ynIrHLye1VfPrZqE25RL3nyj/ou
TLSH
T1F5B30902BD846870D49AD33DEC62022BA3767890137657DF476260E92F93F96AD39F43
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libssl-3-x64.dll

Path C:\Program Files\OpenVPN\bin\libssl-3-x64.dll
Size 818KB
SHA256 c681893dd0c9f86e7f405792dec32adab33cb899cbd3b2ddda533e28f577ab6d
MD5 10d4982726da7c122404f6d6f9bcd793
SHA1 4e6861066218f0909b8ae851fbfe9ebe0b894e46
SHA512 a7e3ce35d60ffba3072211e600bd91e4f0419673ad64471b6b94a537e4c908a02b6fee673ea55e95c22a2b4a2dcc967f56aba0ffb99a95a8875c9b4bda37e668
SSDEEP 12288:OXxxYXIy6weQqYjq2NIUuXWGfcFTdsFgIMPA3AK8t72tJAh1z/VhEi:OXkIrjY+E4bWUgIMPA5S7KJAh1znt
TLSH
T12B053A69BBB8009DD876C13986938613E6F6B4563370EBDB0B648A7A0F637D4273D344
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

openvpn-gui.exe

Path C:\Program Files\OpenVPN\bin\openvpn-gui.exe
Size 1.1MB
SHA256 1f07550f3decbfd7c8737694001ee13c26de84ef498dc493d313a79db2080646
MD5 75d5db58796acffda38dd0139a9aa15a
SHA1 f1eeab1b9967f0ba54f12f6ead70a0ce85f597e2
SHA512 d987ded834671be0894f5953a800947280b012288a2ec44fdcc7fc42dd08e70577ddd6f4c22118e18ebbf0fdca0c5054e8c11bbd3b104bd7c7f8b8f9056999bd
SSDEEP 12288:wtlBCAQ/WWOn+wP/nQStD6Fo+41GqKqx8xmwApbn:wO/LOnBHQS4Fo+yGqKtobn
TLSH
T129457001B3F98118F5F3AB349DBA46526E3BBC815E34CA8E5295755E0A72B90DD30B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

openvpn-plap-install.reg

Path C:\Program Files\OpenVPN\bin\openvpn-plap-install.reg
Size 454B
SHA256 18b542b3de918da103ea6d79f3be0c5af8349502dc9c673f2db5b6f05dc57d35
MD5 2b7d47401bad3221ed6d92996d49f9f7
SHA1 a3b8cbc667f5023e4a4dd8c50bc6ab78c51048de
SHA512 dceafceeff05a61fde179dbdf13bc2b1243ee756028b1c8a96e311f279effbd9e2567f65f8ae063841ca2c4961f6b522553b9c7095daa94898ff5ed048607aa5
TLSH
T151F0DCF2CE079202DA91122D291606F147B64569758E0B92F181A3A86DFECE343FC08B
MD5 SHA1 SHA512 TLSH

Submit Download

openvpn.exe

Path C:\Program Files\OpenVPN\bin\openvpn.exe
Size 1019KB
SHA256 89479084f420ca55864c957a689971c327209d9c0e7ea4302df947e7cefff8c2
MD5 1860b259b69d1b78e5f82013cb21af20
SHA1 530eaff3d8d54b13b391a954082a9261bc1d0452
SHA512 99b2d3c75d13ff436ac0bd380e770460f6a19162b1246ffc156b3fee7e68b94d393c0fcd6bca8986ac17d71864862b0ee3620a6354ab42046abc7aed42ff3dc2
SSDEEP 24576:vMiKDhl3hB1g8QVNaEUQVdcRZehHDLUVvNrPMJomWa:vJKDhZhk8QVNadodKZeBiPUB
TLSH
T19A259D2A139911A9D8ABD078D6178013E772745423749AEB79BCCA142F17EF2B73EF40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

openvpnserv.exe

Path C:\Program Files\OpenVPN\bin\openvpnserv.exe
Size 64KB
SHA256 4d7ba182e89f2869b650ac80a34b8f347deb360a3872ee9dca130168b32c87fa
MD5 f4bde1658456fca1af425a5ed35843d4
SHA1 0392d4a64fc4110811f54d72ba8669da93eab338
SHA512 37d83474bfbfbde3f333176b0ea0cbc287a41dbe3491e0eab6eecb9643158b53e878d020a83d362fb504218609050171920ade3b048a701259995f87cda37b6c
SSDEEP 1536:mcWMro0WY0uA8EHzz0JZQaav3huc7Lo1gYf:yMdWYTpuzQZQaapuc/o1T
TLSH
T161532941A3E804D8F9B3AB78E9B21113DAB57D152B71C6CF4264C45E0F72BC1E978B62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

openvpnserv2.exe

Path C:\Program Files\OpenVPN\bin\openvpnserv2.exe
Size 23KB
SHA256 d1e995a2d32e7833a369aa849e8b877162e07c1a161c6dccb95ca2052fc8b1e7
MD5 bc71317e0308cdbb60c144de84ab3c68
SHA1 01f4d0d5c856f9f283d93c7c909088e862679ec3
SHA512 17f2333020eb2375f79a4bcb4884662fba8129ada9de24e6d2ca51c623f0de16e6e7e5ba60a119b13474d6627b1807b466f886a414c120c5d0d85d7f71427ded
SSDEEP 384:eFwIAToAejw/JWjFTbeCY8++typ+MfznI/p0akvDGXPLon2e:it/jxbeW5nInI/nqDGcp
TLSH
T195B25B41A7E49237EAFF0F78B971962107B1BF800922D1DF4DE9A0C92EC2B411A5137B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tapctl.exe

Path C:\Program Files\OpenVPN\bin\tapctl.exe
Size 41KB
SHA256 d5aab270d61d7d1709e85ba81525be5948ae5bf397bb7b12a11e11ba0788ecd1
MD5 bc1fec27a50d102d805f7cdb79272b50
SHA1 562719ef2494b237f5ff164f952b5ea4e23e097d
SHA512 a3c0e3c489775f704bd22ef1f01ee51615ed8ab5abd6f6e13667d117dead7a3c61810e95cfec13d0d994acdaa89312cfb1b2577ae59b2639ede75149115dcb03
SSDEEP 768:uV7EIM5A5/2jrvnihtk591X3hZaZYiLo+Cc+2EsLB:uVQIkjrPihtk591XRZaZ7Lo+ys
TLSH
T189133B016BE90099E573573898B716276A777D512B70C6DF238CC22D0F63B80BE39B66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSI73A0.tmp

Path C:\Users\Admin\AppData\Local\Temp\MSI73A0.tmp
Size 209KB
SHA256 8351a40a632facd1f79a1bccfe8e32e88876a23065be1144621533700ecb05ad
MD5 3037e214e0f9b25fc63d4d16f7c4c91d
SHA1 b03dce2090033ca3029526485039b75a5aa4b488
SHA512 437fd240c0af2afaa3a5a1791db4739dff04c7003f25f1bc512797cfffb7fc3e8377656b6eb8714a50b3189c2616b230a619730bc63628d9ab4bc214ce31de90
SSDEEP 3072:l9FCdj6rw5iUeqEetAByXxqr8lyc8t5W6/eb7eUZxfZ/oR:l9FC4wuJeiByXwrtcO6ZVxoR
TLSH
T1C6248E09B7D100B9EDB78638CD678656E673780107609A9F03A08376EF2F7D1A63DB61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSIFEFA.tmp

Path C:\Windows\Installer\MSIFEFA.tmp
Size 275KB
SHA256 fb1cd5e7c3ea30dfafd3cc1862e311388361d896610db28c63716da9d71e8f3f
MD5 2232c07e354364e0eb1dc80024593826
SHA1 65bb4232c0416cfb2c158bfc32a7732ad72cee72
SHA512 f0d295565b209f4dedd2a79123fa54ff9b8cbb173f14463ab3d3707b8d87aad84b05c2898478ecc148e29d02fa07ddda9499795e0ceafc2982c0adbd570a3572
SSDEEP 3072:A736bBrGsu4ldGrlmxElEmNoPl4+eDhIVJkRZ5Br/NbvcjKX5mMgQSeRocPvuocM:A736UWldGrlmxEDNMea+H5R/B/1lp4x
TLSH
T136548D41B7E404A6EC73C73499A39606FA3278411B70DAEF035082768F6B7D1AA3DB35
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSIFF78.tmp

Path C:\Windows\Installer\MSIFF78.tmp
Size 281KB
SHA256 45e855461f5d1be28a2f88416603070bd1778055abdd06834ae58e97b7ddf53c
MD5 718222e232d11298dfbabbc2b70d8b14
SHA1 89fc560692111c2245694867b8772fd8969f46d2
SHA512 9191961c28a7a4647ae8f9f9e1956d60b97f5f5c3e4e838d888bf78c1ea665e98e8e3c75cc1247a68a89b2413493ea6d39dbc60827eec919ddba0536d793c801
SSDEEP 3072:sEcOO6pMedPCy5654WKlfE5qbHsfmYud8d2VCsOLlk1lHgQNvLvPMm88cYzdFOS:OOO6OedPjw58l85/grhSQNDsYz2
TLSH
T111549D45BF9504B6E8BBC1348AA74A82E772740203109A9F33AC97799F2F7D1663D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSIFFD6.tmp

Path C:\Windows\Installer\MSIFFD6.tmp
Size 143KB
SHA256 2738720da0b6ce474ca6eb51a92372d047eca2d713c256f0cd6c147ac3a0db21
MD5 84a1cc9540d5cdad74bc54f8090dd27a
SHA1 c6f82d1491015457785ae0d365e7196d693d9a6b
SHA512 9c25d6e7331844d01d732ac923e99c68f305749d92407c873cd09b451e59a8864001e308864fda319fa4a2bcae9dbe50682201c67901dce14272291dedecd2c8
SSDEEP 3072:+1gnuc/GBdzVQqyIgt8DB7QKPw3hL6nCMfBXqpU:Bnuc/GBdJmIgtesKP+Lh+
TLSH
T154E37E17B7A400BBE5B78235C9635A06E772B81117219F9F03A443766F237D0AD3EB61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e59ed35.msi

Path C:\Windows\Installer\e59ed35.msi
Size 5.5MB
SHA256 19bca902826ef0dc9a6cf849297ce43ba8b2844bdb913c37230308d3274c953c
MD5 1e150b4507fc951c8a23b08b85236cd2
SHA1 3f6980947c16778efb3126193726c038453c85d6
SHA512 2074822532d38e94c131ceb3b4b7a01379ea20b5d6e3fb85a6912a586b8e6f1ff5a4973c200087ccd5ecd17727acef2d5568e6afc9df392da5c1f1978b4cd3a8
SSDEEP 98304:fEnzYKCLSBI0lGIOKv8k7VHTB87GnJ6tEGb7MrisWnB+A/yue/bjBe:z/LS9ZzVV87G2hbWij+xB/Re
TLSH
T128460101B6C10462EC678230C85E925AF2F27C5117A0D66FA2DCBF7CBF3B3A5526A751
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dberr.txt

Path C:\Windows\System32\CatRoot2\dberr.txt
Size 75KB
SHA256 55526f93906e178be40c0c78ad6d7da1513011dd23fe3627c2ef43c6c03858f9
MD5 b420ec95ef880dcfa6e61771b5be681b
SHA1 ebd83f1491661db3c1fad8607bf055099d405a46
SHA512 f6f9f11b363789cb4061bea9686580c12c092310ca93606a33eac0e77a6a6b4c4965c8cc09fa0a4d8d7142ba5bf6f5258c66b15c7dd0fd5ead738c6197215781
SSDEEP 1536:9sLhTupE16dcJBJjGSpABJSxGDfD/1ZjCj33qkxTUmAzuFwg/g8nsX6kyCfpw7qc:W87s9/R
TLSH
T1BB730C0980E8C589C9F60A727269EE74D92E65CAB70F4DF531DC63149BC3B052F7A07A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dberr.txt

Path C:\Windows\System32\CatRoot2\dberr.txt
Size 75KB
SHA256 39881d3fd268491499ca347d1ac320e72c937915936a74138ae15aa4fbbbbdb9
MD5 9b7954f9ae689c3a3b78691aa3970333
SHA1 fbd3372e81b9e25742cce1a4cdfaf0b67f01232c
SHA512 34b7fc5ceeb91b68a0e01e9fa5cd48714d8b6067f417bbdd9354bf030f0840fc4dfbb8d5e2d4421f1f2526d935b6e78c1940ee4cefd15bba9d308e9a1686b6bd
SSDEEP 1536:9sLhTupE16dcJBJjGSpABJSxGDfD/1ZjCj33qkxTUmAzuFwg/g8nsX6kyCfpw7qj:W87s9/s
TLSH
T116730C0980E8C589C9F60A727269EE74D92E65CAB70F4DF531DC63149BC3B052F7A07A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

oemvista.inf_amd64_ba3e477187f1080b.ini

Path C:\Windows\System32\DriverStore\FileRepository\oemvista.inf_amd64_ba3e477187f1080b.ini
Size 421B
SHA256 dd5de632694db59dfd35ebe09d7a07928529c1fd6a9f688146473b7b04444b75
MD5 67ce06f62711cb06c627715e2c22dc85
SHA1 1b02c260321f103b0cf85ff39fe2012b1d9f0497
SHA512 7d6d2acc0001801f356564162a5170955ff77bebab32de2731f61668c5491e328494ca3d306e1a7e0ba7e54fee5412705980d909679308e66f6137e701cb54de
TLSH
T1B4E0E56390BC44C54B53452823741E248CAFF3E03DAA6BEEBA61C1052F93C6E0801525
MD5 SHA1 SHA512 TLSH

Submit Download

ovpn-dco.inf_amd64_b737bb7e846ccda6.ini

Path C:\Windows\System32\DriverStore\FileRepository\ovpn-dco.inf_amd64_b737bb7e846ccda6.ini
Size 420B
SHA256 49c88f63243f71a3a4e0e176d8834c6a6dc46e6e4ae2d1a1f50691e5f477d7e4
MD5 794439906b440f5e071729704319f1a0
SHA1 2797dc98076391073c4c49a49e28343eab63ce4c
SHA512 b46c1881158c9c683baa7f2cb6b52a045dc64bd7fba201b31aa1864b1e2e112a45d3c03c685ee9b9a53aea58b7ab2cfe7ae0795b674c5a9783a02a74a5a9d574
TLSH
T188E02B2E13F3E9EBA708AC0002277B784C4AB40A15782F117104C1452F5BE2058CBBD3
MD5 SHA1 SHA512 TLSH

Submit Download

wintun.inf_amd64_def3401515466414.ini

Path C:\Windows\System32\DriverStore\FileRepository\wintun.inf_amd64_def3401515466414.ini
Size 415B
SHA256 bfaa76d342ed0a503555dac1612f56b0e42aff2be195f684aebf3b13a8c382f2
MD5 f7ac24a460053a238fb56ead242fc86c
SHA1 f67dfa4a3ef1f4c3b16e15568698d795cfb3592e
SHA512 6c18313c13c1543a3d1289d1cbece9c650a838788588146b8c88431a593acca282dcf12fdbcded626f52de3d8650b790eef767ae2d0644e880050870ea34fce0
TLSH
T1DAE0E5D3D47891C79A53123A96252F65CC3AF751CE40A65DF222B6402F47A8B5512C98
MD5 SHA1 SHA512 TLSH

Submit Download

tap0901.cat

Path C:\Windows\Temp\2D4334~1\tap0901.cat
Size 11KB
SHA256 ee062e5ef2743ceab10c64830e4cefe52e35cc1ece85947ac4e61ddd1c0b05f7
MD5 71ecece58bb00bdc1e728ee28d7a5332
SHA1 4305889415cf95662a30d024f1138f1af224cf42
SHA512 9b23404d867fc4fd7c7beeba3768e8fed3113cc7430ec1bc9ca7faf6e6105388de7057b1402f9b4ba8fbc11e5fcd3afe14233721e8d15b6c0bed40f65aa5b58b
SSDEEP 192:HxDuDjbfXJCKnEwKUNhYCy1QySaI8HNsAX01k9z3Aqcp9wdGEC:CXaUNh3auatHNsAR9zWZEC
TLSH
T1FF322AA2942C52C3ECABBC7043D4E9977C3E2BCB1950506A269FF7141DA73C8EB1516E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tap0901.sys

Path C:\Windows\Temp\2D4334~1\tap0901.sys
Size 40KB
SHA256 581dcaace05d5c1ac9512457ff50565aca5d904d2c209bd3fc369ca4d4a0d2b1
MD5 1bb9772a05517e227d1dafd3936e8f66
SHA1 d695ca5791a4b6a3509939aebdfaf5e229c6fbcf
SHA512 3f1966038f91b887fe1a71474929bd87f3c75091846c6e9563f7424d3a7c19c908f1d874895341c61a868a616aba637e3d4188d4ebb7383087886a13a4dc0aa2
SSDEEP 768:EGvByM5JLLvslmdu9lsECPURPNkilzdCH3C9zySb:EfM7VE88fkilzdCHOzySb
TLSH
T112038DD16AA814D1E8AA9874C7EBCE43F7B5B1430311AAEF0764D6691F23BD05637328
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OemVista.inf

Path C:\Windows\Temp\2d433454397bd5dede613388c473d0938856beee5822489e9cb1f16bfab50adf\OemVista.inf
Size 7KB
SHA256 1327ab3a8c50691f04bea8e2ca356c5b604092a719e219464f8cc4b42e192de9
MD5 6f5ffb58a9e406ab1643c890e2a198c6
SHA1 3ff1faba00ac18a93e88a6f2bbfa747c9fdc7e0c
SHA512 af29bc13cc02238208c51e4e95dd0a4445a952755635a9eab38aa77a5c087cc8e2025af55d8f3a0e9f2430baa91534e7f892bb71aa0ef72bab4483211a845b4b
SSDEEP 192:wr8tW9yCTi314vlQd22bjR+iAUC7bMP+io3DcNSj6jvKFkPs7EQTXvt1Ld4Z:LWlGBdkkzo3DcNSj6jvKFkPs7EQTXvtk
TLSH
T1F9F150681C83EE3A31FEE58557565EC7E24611823A172800355CFC549BBDD9FE33C92A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wintun.cat

Path C:\Windows\Temp\FC0E6B~1\wintun.cat
Size 9KB
SHA256 602187e5470ddbdf9421045bb0515f358c88bf88f59fd8a886fb6373da5d0f82
MD5 faba2ccb8fe366fd281ca6be6d2bb7c2
SHA1 bb7bd32a21f3eba652fde24146387ffc5278143e
SHA512 ec424a545e2598f299706499dab07b4d12b0734a52f928216a53bca2b7f384b97bd4fc092d7d68de636a75daf79ac392c4b49b7251ec011236de1659253d6214
SSDEEP 192:6wRp8yDJCKE4uyK6iWPFWQFAnTz36ArNc4qnajr7NCo:L/iWPFRI64lrNt
TLSH
T10522F8E28A5C44C2E993ADB05398F5977C3E7BDB4C20906922ABF7650DD27C5E70843E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wintun.sys

Path C:\Windows\Temp\FC0E6B~1\wintun.sys
Size 37KB
SHA256 eb58bf00df7b4f98334178e75df3348c609ea5c6c74cf7f185f363aa23976c8b
MD5 1945d7d1f56b67ae1cad6ffe13a01985
SHA1 2c1a369f9e12e5c6549439e60dd6c728bf1bffde
SHA512 09af87898528eaa657d46c79b7c4ebc0e415478a421b0b97355294c059878178eb32e172979ee9b7c59126861d51a5831e337a96666c43c96cb1cf8f11bc0a0f
SSDEEP 768:UwtoHKG2ZqGhg+Eqpg0bUORjj71PKgPrbHZIb4:UwtoHt2ZLg+zg5cv7ld7Zy4
TLSH
T1E1037DD2E6A868C2E973CE3151F5E523BD74B2612B20D5EF4511C4350FA3BC1EA7863A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wintun.inf

Path C:\Windows\Temp\fc0e6b860b50f073bf13a7f68ccea1fb42ab73045ee4d2aff48c9c00401ec705\wintun.inf
Size 1KB
SHA256 44098408ab9611dd99a38e140c7fb1ca5dce6eb2d5f0d5e500547ac1ba5d235b
MD5 8480579050970b0812cc3d9a1bce1340
SHA1 edebebd090602f4eee375ad754c8566d4fda23cb
SHA512 46de9202c3cf0ddbf19f9e0e02ec17530f2722abfa08669fd30a6095ce2342fa89a2cc59c1d47afd82b48c915bb95f4c6d16e7c21129a9c8f09c2bf239566933
TLSH
T1933135D954E10D693CD3322E77277F81E65C123041CA200EB6FD8559D64BCDFA654CAA
MD5 SHA1 SHA512 TLSH

Submit Download

metadata-2

Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
Size 26.1MB
SHA256 9ca41581f6ccaf882237417943d1a76077554862bedccad3400fb29336193917
MD5 4f24a6c32df7bb3215caff99a28ae707
SHA1 c0a185aa0475399fcbd204edc00e4eddaacd3e84
SHA512 944c40111fdcca7bd8acab451888aff54a018000bd0006886d5dae81cfc89b9343ddfa9f7b4fa123ff6d9245ef17aab6c2b6b78cfca45b5c8ab127807dd38476
SSDEEP 24576:YFo3DMPYdoO/vvTL/SwJpilgfrejy7uKkkP7tknB/MnqZeIZ8YhWJwz4Nu1:NH8
TLSH
T17557F71836F92110F7F79E3CA8F0AA2749397D5B9C15DE8D45811B8E0821F71E872F6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{8db3f45b-fa38-424c-b243-23a733054192}_OnDiskSnapshotProp

Path \??\Volume{6392210f-0000-0000-0000-d08302000000}\System Volume Information\SPP\OnlineMetadataCache\{8db3f45b-fa38-424c-b243-23a733054192}_OnDiskSnapshotProp
Size 6KB
SHA256 401e05489e5e503653e6200a9407b95c6e7d383c3311857b69b38073e3a04b24
MD5 0a5b4ef88cedfea4bbb06bb852e88fdf
SHA1 21a5d115d5e4b003b31648a227e9210f2d791106
SHA512 22db587344c846a973c02e428b3233b4d32e81a895fb4295955292b23f89c5a7f6946fce38a2a10d0e06253142425ac5eb93e4d92deb267baa11759c770942d1
SSDEEP 96:FIPbD/vc6DD84LTHzbOHXOHBlBRQn8Sc9XE56tOSVQpuN:Gzb++uVmN
TLSH
T14DD1680C5AF54711E2B3AB3128F14557A877B911EF33CB8E0298238E6661A10F975F6F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/6080-390-0x0000000000300000-0x000000000030A000-memory.dmp

Download