Overview

overview

8

Static

static

3

openvpn-fi...01.exe

windows10-2004-x64

8

openvpn-fi...01.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    149s
  • max time network
    132s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    15/08/2026, 09:16

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    openvpn-firewall-udp-1194-ghiona01-install-2.4.4-I601.exe
  • Size 3.4MB
  • Sample260815-k8pgzashqa
  • SHA256 7e4f0d09648d027fb57278cf98643e8a303934311284d2ec2e93539e45da48cf
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
discoveryinstallerpersistence

Malware Config

Signatures

  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 6 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Drops file in Drivers directory 3 IoCs
  • Manipulates Digital Signatures 1 TTPs 1 IoCs

    Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to make their binary seem validly signed.

  • Executes dropped EXE 8 IoCs
  • Loads dropped DLL 47 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops file in System32 directory 17 IoCs
  • Drops file in Program Files directory 28 IoCs
  • Drops file in Windows directory 5 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • NSIS installer 4 IoCs
    installer
  • Checks SCSI registry key(s) 3 TTPs 58 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 42 IoCs
  • Modifies registry class 15 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 6 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\openvpn-firewall-udp-1194-ghiona01-install-2.4.4-I601.exe
    "C:\Users\Admin\AppData\Local\Temp\openvpn-firewall-udp-1194-ghiona01-install-2.4.4-I601.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:5084
    • C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\openvpn-postinstall.exe
      "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\openvpn-postinstall.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:4588
      • C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\openvpn-install.exe
        ".\openvpn-install.exe"
        3⤵
        • Boot or Logon Autostart Execution: Active Setup
        • Executes dropped EXE
        • Loads dropped DLL
        • Drops file in Program Files directory
        • System Location Discovery: System Language Discovery
        • Modifies registry class
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:4876
        • C:\Users\Admin\AppData\Local\Temp\tap-windows.exe
          "C:\Users\Admin\AppData\Local\Temp\tap-windows.exe" /S /SELECT_UTILITIES=1
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Drops file in Program Files directory
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:2764
          • C:\Program Files\TAP-Windows\bin\tapinstall.exe
            "C:\Program Files\TAP-Windows\bin\tapinstall.exe" hwids tap0901
            5⤵
            • Executes dropped EXE
            • Checks SCSI registry key(s)
            PID:5012
          • C:\Program Files\TAP-Windows\bin\tapinstall.exe
            "C:\Program Files\TAP-Windows\bin\tapinstall.exe" install "C:\Program Files\TAP-Windows\driver\OemVista.inf" tap0901
            5⤵
            • Executes dropped EXE
            • Drops file in System32 directory
            • Drops file in Windows directory
            • Checks SCSI registry key(s)
            • Suspicious use of AdjustPrivilegeToken
            PID:1572
  • C:\Program Files\OpenVPN\bin\openvpnserv2.exe
    "C:\Program Files\OpenVPN\bin\openvpnserv2.exe"
    1⤵
    • Executes dropped EXE
    PID:5900
  • C:\Program Files\OpenVPN\bin\openvpnserv.exe
    "C:\Program Files\OpenVPN\bin\openvpnserv.exe"
    1⤵
    • Executes dropped EXE
    PID:1172
  • C:\Windows\system32\DrvInst.exe
    DrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{ba38fcc0-0bdd-2e46-854e-fd910e754b75}\oemvista.inf" "9" "4d14a44ff" "00000000000000EC" "WinSta0\Default" "0000000000000178" "208" "c:\program files\tap-windows\driver"
    1⤵
    • Manipulates Digital Signatures
    • Drops file in System32 directory
    • Drops file in Windows directory
    • Checks SCSI registry key(s)
    • Modifies data under HKEY_USERS
    • Suspicious use of WriteProcessMemory
    PID:956
    • C:\Windows\system32\rundll32.exe
      rundll32.exe C:\Windows\system32\pnpui.dll,InstallSecurityPromptRunDllW 20 Global\{663ED861-C58F-4DE8-8F63-AB4B04A067AA} Global\{2ADA71D7-5962-4555-9986-5254E3B1170E} C:\Windows\System32\DriverStore\Temp\{ac16159f-2b44-a243-ba04-2fb6259168a5}\oemvista.inf C:\Windows\System32\DriverStore\Temp\{ac16159f-2b44-a243-ba04-2fb6259168a5}\tap0901.cat
      2⤵
        PID:1912
    • C:\Windows\system32\DrvInst.exe
      DrvInst.exe "2" "211" "ROOT\NET\0000" "C:\Windows\System32\DriverStore\FileRepository\oemvista.inf_amd64_a572b7f20c402d28\oemvista.inf" "oem1.inf:3beb73aff103cc24:tap0901.ndi:9.0.0.21:tap0901," "4d14a44ff" "00000000000000EC" "c339"
      1⤵
      • Drops file in Drivers directory
      • Drops file in Windows directory
      • Checks SCSI registry key(s)
      • Suspicious use of AdjustPrivilegeToken
      PID:3044
    • C:\Program Files\OpenVPN\bin\openvpnserv.exe
      "C:\Program Files\OpenVPN\bin\openvpnserv.exe"
      1⤵
      • Executes dropped EXE
      PID:2436
    • C:\Windows\system32\svchost.exe
      C:\Windows\system32\svchost.exe -k GPSvcGroup
      1⤵
        PID:6040

      Network

            MITRE ATT&CK Enterprise v16

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            openvpn-gui.exe
            • Path C:\Program Files\OpenVPN\bin\openvpn-gui.exe
            • Size 628KB
            • SHA256 9a00ffddf518671e43f5001c30bfbf710f33b7e9e19b62bb19702d004942d852
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            openvpnserv.exe
            • Path C:\Program Files\OpenVPN\bin\openvpnserv.exe
            • Size 72KB
            • SHA256 a19a41f5ad7136ccfe30456bd4c1d3598615114dd3a1843000371b09b8b09516
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            openvpnserv2.exe
            • Path C:\Program Files\OpenVPN\bin\openvpnserv2.exe
            • Size 15KB
            • SHA256 c3970ec979ccbdb03d38c1df606fc3437a85cea2f3b56a2f03c32fde4dfe9046
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            tapinstall.exe
            • Path C:\Program Files\TAP-Windows\bin\tapinstall.exe
            • Size 90KB
            • SHA256 c9963a3f8abf6fedc8f983a9655a387d67c752bd59b0d16fd6fc2396b4b4ca67
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            OemVista.inf
            • Path C:\Program Files\TAP-Windows\driver\OemVista.inf
            • Size 7KB
            • SHA256 b5728e42ea12c67577cb9188b472005ee74399b6ac976e7f72b48409baee3b41
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            openvpn-install.exe
            • Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\openvpn-install.exe
            • Size 3.3MB
            • SHA256 d33f5399e2a42080fbd32f96703164a85c77cb787e8d1eddf75a9bffa0fe789f
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            openvpn-postinstall.exe
            • Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\openvpn-postinstall.exe
            • Size 113KB
            • SHA256 120d5f1a791671b563e7344593b8acac265af3332748971bb8ab3261096d9aba
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            DotNetChecker.dll
            • Path C:\Users\Admin\AppData\Local\Temp\nsnA2A1.tmp\DotNetChecker.dll
            • Size 83KB
            • SHA256 45e15d319084e019d4db5a3081533ba8c032308cf35384abf8b65ddbac6c5f9d
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            SimpleSC.dll
            • Path C:\Users\Admin\AppData\Local\Temp\nsnA2A1.tmp\SimpleSC.dll
            • Size 61KB
            • SHA256 e0c580bbe48a483075c21277c6e0f23f3cbd6ce3eb2ccd3bf48cf68f05628f43
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            UserInfo.dll
            • Path C:\Users\Admin\AppData\Local\Temp\nsnA2A1.tmp\UserInfo.dll
            • Size 6KB
            • SHA256 a94fd67daf9137b26e2d98aa4cf46614439bd64263c5c211369a232c444862ea
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            modern-wizard.bmp
            • Path C:\Users\Admin\AppData\Local\Temp\nsnA2A1.tmp\modern-wizard.bmp
            • Size 25KB
            • SHA256 3ad2dc318056d0a2024af1804ea741146cfc18cc404649a44610cbf8b2056cf2
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            nsExec.dll
            • Path C:\Users\Admin\AppData\Local\Temp\nsnA2A1.tmp\nsExec.dll
            • Size 9KB
            • SHA256 9cb71f00c19397723d39861ff809c70f9d2cdbcf91b3dd8021060714512a39cb
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            nsProcess.dll
            • Path C:\Users\Admin\AppData\Local\Temp\nsnA2A1.tmp\nsProcess.dll
            • Size 4KB
            • SHA256 95fe9d92512ff2318cc2520311ef9145b2cee01209ab0e1b6e45c7ce1d4d0e89
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            System.dll
            • Path C:\Users\Admin\AppData\Local\Temp\nsu8228.tmp\System.dll
            • Size 23KB
            • SHA256 d821a62802900b068dcf61ddc9fdff2f7ada04b706815ab6e5038b21543da8a5
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            nsDialogs.dll
            • Path C:\Users\Admin\AppData\Local\Temp\nsu8228.tmp\nsDialogs.dll
            • Size 11KB
            • SHA256 57a001c9770c864f983aa33e4c81e60cac4335b83dc036e269f0727a629dd221
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            System.dll
            • Path C:\Users\Admin\AppData\Local\Temp\nsy156F.tmp\System.dll
            • Size 11KB
            • SHA256 dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            UserInfo.dll
            • Path C:\Users\Admin\AppData\Local\Temp\nsy156F.tmp\UserInfo.dll
            • Size 4KB
            • SHA256 564c80dec62d76c53497c40094db360ff8a36e0dc1bda8383d0f9583138997f5
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            nsExec.dll
            • Path C:\Users\Admin\AppData\Local\Temp\nsy156F.tmp\nsExec.dll
            • Size 6KB
            • SHA256 168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            tap-windows.exe
            • Path C:\Users\Admin\AppData\Local\Temp\tap-windows.exe
            • Size 250KB
            • SHA256 645bee92ba4e9f32ddfdd9f8519dc1b9f9ff0b0a8e87e342f08d39da77e499a9
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            oemvista.inf_amd64_a572b7f20c402d28.ini
            • Path C:\Windows\System32\DriverStore\FileRepository\oemvista.inf_amd64_a572b7f20c402d28.ini
            • Size 418B
            • SHA256 b573fd6d95fb486a69273e7d7e9000d0442226186917ea7ac74550dc715b016e
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            tap0901.sys
            • Path \??\c:\PROGRA~1\TAP-WI~1\driver\tap0901.sys
            • Size 26KB
            • SHA256 89c5ca1440df186497ce158eb71c0c6bf570a75b6bc1880eac7c87a0250201c0
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            tap0901.cat
            • Path \??\c:\program files\tap-windows\driver\tap0901.cat
            • Size 19KB
            • SHA256 91ebea8ad199e97832cf91ea77328ed7ff49a1b5c06ddaacb0e420097a9b079e
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            memory/1172-262-0x0000000000400000-0x0000000000419000-memory.dmp
            Download

            memory/2436-344-0x0000000000400000-0x0000000000419000-memory.dmp
            Download

            memory/4588-16-0x000000000042D000-0x000000000042E000-memory.dmp
            Download

            memory/4588-22-0x0000000000400000-0x0000000000445000-memory.dmp
            Download

            memory/4588-62-0x000000006EB40000-0x000000006EB4A000-memory.dmp
            Download

            memory/4588-61-0x000000006E5C0000-0x000000006E5CD000-memory.dmp
            Download

            memory/4588-42-0x0000000000400000-0x0000000000445000-memory.dmp
            Download

            memory/4876-264-0x0000000000400000-0x0000000000450000-memory.dmp
            Download

            memory/4876-63-0x0000000000400000-0x0000000000450000-memory.dmp
            Download

            memory/4876-81-0x00000000067B0000-0x00000000067C3000-memory.dmp
            Download

            memory/4876-267-0x00000000067B0000-0x00000000067B8000-memory.dmp
            Download

            memory/4876-265-0x000000006E5C0000-0x000000006E5CD000-memory.dmp
            Download

            memory/4876-70-0x0000000000400000-0x0000000000450000-memory.dmp
            Download

            memory/4876-43-0x0000000000400000-0x0000000000450000-memory.dmp
            Download

            memory/4876-32-0x0000000000400000-0x0000000000450000-memory.dmp
            Download

            memory/4876-326-0x00000000041F0000-0x0000000004203000-memory.dmp
            Download

            memory/4876-66-0x000000006EB40000-0x000000006EB4A000-memory.dmp
            Download

            memory/4876-338-0x0000000000400000-0x0000000000450000-memory.dmp
            Download

            memory/4876-340-0x000000006EB40000-0x000000006EB4A000-memory.dmp
            Download

            memory/4876-339-0x000000006E5C0000-0x000000006E5CD000-memory.dmp
            Download

            memory/5900-258-0x0000000000610000-0x000000000061A000-memory.dmp
            Download