Overview

overview

6

Static

static

1

TeamMate_A..._2.msi

windows10-2004-x64

6

TeamMate_A..._2.msi

windows11-ltsc_2024-x64

6

Analysis

  • max time kernel
    149s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    07/08/2026, 08:12

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    TeamMate_Advanced_Integration_3264_December_2025_Update_2.msi
  • Size 6.5MB
  • Sample260807-j321fatthy
  • SHA256 7d522de966ec470d5e0581a42d7de8c3a6b2260a64242ea0d6fd767a8e974ade
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
executionpersistenceprivilege_escalationransomware

Malware Config

Signatures

  • Badlisted process makes network request 3 IoCs

    Network request originating from process or tool commonly abused by malware.

  • Enumerates connected drives 3 TTPs 46 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 12 IoCs
  • Drops file in Windows directory 10 IoCs
  • Launches sc.exe 1 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
    persistenceprivilege_escalation
  • Executes a command shell one-liner 1 TTPs 2 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Checks SCSI registry key(s) 3 TTPs 5 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 3 IoCs
  • Modifies registry class 37 IoCs
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: LoadsDriver 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Windows\system32\msiexec.exe
    msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\TeamMate_Advanced_Integration_3264_December_2025_Update_2.msi
    1⤵
    • Badlisted process makes network request
    • Enumerates connected drives
    • Event Triggered Execution: Installer Packages
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    PID:728
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Enumerates connected drives
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Modifies data under HKEY_USERS
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4240
    • C:\Windows\system32\srtasks.exe
      C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
      2⤵
        PID:4168
      • C:\Windows\System32\reg.exe
        "C:\Windows\System32\reg.exe" copy HKLM\SOFTWARE\Microsoft\Office\Excel\Addins\TeamMate.ExcelAddIn.Stub HKLM\SOFTWARE\Wow6432Node\Microsoft\Office\Excel\Addins\TeamMate.ExcelAddIn.Stub /s /f
        2⤵
          PID:4936
        • C:\Windows\System32\reg.exe
          "C:\Windows\System32\reg.exe" copy HKLM\SOFTWARE\Microsoft\Office\Word\Addins\TeamMate.WordAddIn.Stub HKLM\SOFTWARE\Wow6432Node\Microsoft\Office\Word\Addins\TeamMate.WordAddIn.Stub /s /f
          2⤵
            PID:632
          • C:\Windows\system32\cmd.exe
            cmd.exe /c "sc config webclient start=auto"
            2⤵
            • Executes a command shell one-liner
            • Suspicious use of WriteProcessMemory
            PID:3148
            • C:\Windows\system32\sc.exe
              sc config webclient start=auto
              3⤵
              • Launches sc.exe
              PID:3272
          • C:\Windows\system32\cmd.exe
            cmd.exe /c "net start webclient"
            2⤵
            • Executes a command shell one-liner
            • Suspicious use of WriteProcessMemory
            PID:5028
            • C:\Windows\system32\net.exe
              net start webclient
              3⤵
              • Suspicious use of WriteProcessMemory
              PID:232
              • C:\Windows\system32\net1.exe
                C:\Windows\system32\net1 start webclient
                4⤵
                  PID:3440
          • C:\Windows\system32\vssvc.exe
            C:\Windows\system32\vssvc.exe
            1⤵
            • Checks SCSI registry key(s)
            • Suspicious use of AdjustPrivilegeToken
            PID:3144

          Network

                MITRE ATT&CK Enterprise v16

                Replay Monitor

                Loading Replay Monitor...

                Downloads

                e599300.rbs
                • Path C:\Config.Msi\e599300.rbs
                • Size 24KB
                • SHA256 aa576364d20f3c6cadefaaff93a19e754078d69c52bd140cc980735eab13cfaf
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                49855FCDFA62840A2838AEF1EFAC3C9B
                • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\49855FCDFA62840A2838AEF1EFAC3C9B
                • Size 29KB
                • SHA256 8036aafae5ca1828c65617b35d27711869e28f70e18f41fe92bf32a29889962c
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                77003E887FC21E505B9E28CBA30E18ED_8ACE642DC0A43382FABA7AE806561A50
                • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77003E887FC21E505B9E28CBA30E18ED_8ACE642DC0A43382FABA7AE806561A50
                • Size 1KB
                • SHA256 1ddd4841131e61a383f0ebe71c33181b70b9b3d45fa5ed0bdbeaffaadaff9fce
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                7850C7BAFAC9456B4B92328A61976502_C02AF600796DFB874B446690B9C90A87
                • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7850C7BAFAC9456B4B92328A61976502_C02AF600796DFB874B446690B9C90A87
                • Size 5B
                • SHA256 f302d17f5177f5e0f95988efe685b25a07e95687dab4d88a960ee97d40b60cce
                • MD5 SHA1 SHA512
                Submit Download

                86844F70250DD8EF225D6B4178798C21_2CDE88B3CC9A35A2EA16DC0201366139
                • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\86844F70250DD8EF225D6B4178798C21_2CDE88B3CC9A35A2EA16DC0201366139
                • Size 2KB
                • SHA256 5e164cb51967d224ccaf995c1d8e1257d1aa0667042f233040970eeb45f295d7
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                49855FCDFA62840A2838AEF1EFAC3C9B
                • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\49855FCDFA62840A2838AEF1EFAC3C9B
                • Size 290B
                • SHA256 095aeadf429acc59541391e789c56832838e65ec5d0204804555710a6fc0ff10
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                77003E887FC21E505B9E28CBA30E18ED_8ACE642DC0A43382FABA7AE806561A50
                • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77003E887FC21E505B9E28CBA30E18ED_8ACE642DC0A43382FABA7AE806561A50
                • Size 422B
                • SHA256 dff4b3a5041acb1fdb915ff7541728ecb0c06629533bc060c0d9e67d45134ef9
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                7850C7BAFAC9456B4B92328A61976502_C02AF600796DFB874B446690B9C90A87
                • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7850C7BAFAC9456B4B92328A61976502_C02AF600796DFB874B446690B9C90A87
                • Size 422B
                • SHA256 18d6582732321de4ebf836b7f274d4e3335ab017fee962d6d74764fb7ca590e1
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                86844F70250DD8EF225D6B4178798C21_2CDE88B3CC9A35A2EA16DC0201366139
                • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\86844F70250DD8EF225D6B4178798C21_2CDE88B3CC9A35A2EA16DC0201366139
                • Size 426B
                • SHA256 d049708250c1aa0b5798cbdbfc26fb9b61be363f817ccff2073eac7f57d288d1
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                e5992ff.msi
                • Path C:\Windows\Installer\e5992ff.msi
                • Size 6.5MB
                • SHA256 7d522de966ec470d5e0581a42d7de8c3a6b2260a64242ea0d6fd767a8e974ade
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                metadata-2
                • Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
                • Size 24.1MB
                • SHA256 28f97d24e2a7cfefd3bea5e0cf9f81af622748d0e915f9662222d272ed72a804
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                {05540853-dfd6-4e44-ba38-c9f485638747}_OnDiskSnapshotProp
                • Path \??\Volume{4588d6e0-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{05540853-dfd6-4e44-ba38-c9f485638747}_OnDiskSnapshotProp
                • Size 6KB
                • SHA256 d21a52a8ca1385a5b72bf39a3778b35b374c51a4eaab74e6b5b09983adc839b0
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download