Overview

overview

6

Static

static

1

TeamMate_A..._2.msi

windows10-2004-x64

6

TeamMate_A..._2.msi

windows11-ltsc_2024-x64

6

Analysis

  • max time kernel
    148s
  • max time network
    147s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    07/08/2026, 08:12

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    TeamMate_Advanced_Integration_3264_December_2025_Update_2.msi
  • Size 6.5MB
  • Sample260807-j321fatthy
  • SHA256 7d522de966ec470d5e0581a42d7de8c3a6b2260a64242ea0d6fd767a8e974ade
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
executionpersistenceprivilege_escalationransomware

Malware Config

Signatures

  • Badlisted process makes network request 1 IoCs

    Network request originating from process or tool commonly abused by malware.

  • Enumerates connected drives 3 TTPs 46 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 12 IoCs
  • Drops file in Windows directory 14 IoCs
  • Launches sc.exe 1 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
    persistenceprivilege_escalation
  • Executes a command shell one-liner 1 TTPs 2 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Checks SCSI registry key(s) 3 TTPs 5 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 3 IoCs
  • Modifies registry class 37 IoCs
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: LoadsDriver 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Windows\system32\msiexec.exe
    msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\TeamMate_Advanced_Integration_3264_December_2025_Update_2.msi
    1⤵
    • Badlisted process makes network request
    • Enumerates connected drives
    • Event Triggered Execution: Installer Packages
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    PID:5956
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Enumerates connected drives
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Modifies data under HKEY_USERS
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:3816
    • C:\Windows\system32\srtasks.exe
      C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
      2⤵
        PID:4636
      • C:\Windows\System32\reg.exe
        "C:\Windows\System32\reg.exe" copy HKLM\SOFTWARE\Microsoft\Office\Excel\Addins\TeamMate.ExcelAddIn.Stub HKLM\SOFTWARE\Wow6432Node\Microsoft\Office\Excel\Addins\TeamMate.ExcelAddIn.Stub /s /f
        2⤵
          PID:1948
        • C:\Windows\System32\reg.exe
          "C:\Windows\System32\reg.exe" copy HKLM\SOFTWARE\Microsoft\Office\Word\Addins\TeamMate.WordAddIn.Stub HKLM\SOFTWARE\Wow6432Node\Microsoft\Office\Word\Addins\TeamMate.WordAddIn.Stub /s /f
          2⤵
            PID:1156
          • C:\Windows\system32\cmd.exe
            cmd.exe /c "sc config webclient start=auto"
            2⤵
            • Executes a command shell one-liner
            • Suspicious use of WriteProcessMemory
            PID:3472
            • C:\Windows\system32\sc.exe
              sc config webclient start=auto
              3⤵
              • Launches sc.exe
              PID:1212
          • C:\Windows\system32\cmd.exe
            cmd.exe /c "net start webclient"
            2⤵
            • Executes a command shell one-liner
            • Suspicious use of WriteProcessMemory
            PID:1396
            • C:\Windows\system32\net.exe
              net start webclient
              3⤵
              • Suspicious use of WriteProcessMemory
              PID:4480
              • C:\Windows\system32\net1.exe
                C:\Windows\system32\net1 start webclient
                4⤵
                  PID:4664
          • C:\Windows\system32\svchost.exe
            C:\Windows\system32\svchost.exe -k GPSvcGroup
            1⤵
              PID:1560
            • C:\Windows\system32\vssvc.exe
              C:\Windows\system32\vssvc.exe
              1⤵
              • Checks SCSI registry key(s)
              • Suspicious use of AdjustPrivilegeToken
              PID:2168

            Network

                  MITRE ATT&CK Enterprise v16

                  Replay Monitor

                  Loading Replay Monitor...

                  Downloads

                  e5a7801.rbs
                  • Path C:\Config.Msi\e5a7801.rbs
                  • Size 24KB
                  • SHA256 a6ea57c905594df789b5cbd54fe834122d541cbe14d1099a27c8dca9566897a6
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  e5a7800.msi
                  • Path C:\Windows\Installer\e5a7800.msi
                  • Size 6.5MB
                  • SHA256 7d522de966ec470d5e0581a42d7de8c3a6b2260a64242ea0d6fd767a8e974ade
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  metadata-2
                  • Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
                  • Size 26.1MB
                  • SHA256 16956dc47be259d58a3d5d3f3e129a463263945bb143cff51fa6c70ec0f90410
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  {ad682238-84bf-4206-8001-45aa07990754}_OnDiskSnapshotProp
                  • Path \??\Volume{c61f8367-0000-0000-0000-d08302000000}\System Volume Information\SPP\OnlineMetadataCache\{ad682238-84bf-4206-8001-45aa07990754}_OnDiskSnapshotProp
                  • Size 6KB
                  • SHA256 268bdd5fed3468bc92ffa6094badc957602f4542bc798e057b59b52b4ccfe862
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download