29cbd9d9bc6571d15d6a2b29dd2532fe6c7fb81d255778deb40f64dc79502bf5

Analysis

user interaction
yes
max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
19/08/2026, 00:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
CL-Eye-Driver-5.3.0.0341-Emuline.exe
Size 5.2MB
Sample260819-ac94pavvbx
SHA256 29cbd9d9bc6571d15d6a2b29dd2532fe6c7fb81d255778deb40f64dc79502bf5
MD5 64112c1df0d80d195d006da9c15bf710
SHA1 f0bfbc32171ecfb03614470b9c06ef34c07e66b0
SHA512 eefac2d69ece3ac07745a71c6e895200f1fb1b7c1f144ba44fcb658f9232bd613d894929bb81f24d86815eb09f87757b96277f7cd0aa40b1f092c366b54bc1c6
SSDEEP 98304:4cf1PgNuKGzp9kp2aqDNsmXWtKI/cdVo+J2v1I54UJV17j7MayZkxMCOaX:7xz3zApCXEtECd64eV1TyZkxJ
TLSH
T11B46332AEE8625C3D04764B4053A57F487E197D371A4600B0729FF2759BB23A1F63CB9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery spyware trojan

Malware Config

Signatures

Manipulates Digital Signatures 1 TTPs 2 IoCs

Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to make their binary seem validly signed.

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\97B8DB93E99E6D5D8F6424143BE1F8F96D0F4FA7\Blob = 03000000010000001400000097b8db93e99e6d5d8f6424143be1f8f96d0f4fa7200000000100000077050000308205733082045ba00302010202103621615d5dc8015358e6e878c541abf0300d06092a864886f70d01010505003081b4310b300906035504061302555331173015060355040a130e566572695369676e2c20496e632e311f301d060355040b1316566572695369676e205472757374204e6574776f726b313b3039060355040b13325465726d73206f66207573652061742068747470733a2f2f7777772e766572697369676e2e636f6d2f727061202863293130312e302c06035504031325566572695369676e20436c617373203320436f6465205369676e696e672032303130204341301e170d3132313230323030303030305a170d3134303130313233353935395a3081b6310b3009060355040613025553310f300d060355040813064e6576616461311230100603550407130948656e646572736f6e3120301e060355040a1417436f6465204c61626f7261746f726965732c20496e632e313e303c060355040b13354469676974616c20494420436c6173732033202d204d6963726f736f667420536f6674776172652056616c69646174696f6e2076323120301e06035504031417436f6465204c61626f7261746f726965732c20496e632e30820122300d06092a864886f70d01010105000382010f003082010a0282010100db4b56899f9bd1e780be42d133beb8426d253c6b5cf7b128e80d41bd72f947737c78608b0b45dedddb081bbd9e049fc4a29d5f1c3ac2f04299858cce5d349e6d9aa60e86bc37a16538944aa347b47b9a0e4be17e3ff56d4eb4b8982b6db146f6dec8df75e49c0403e4e97b201e95edbf7e76d1b1ffc11da2d142734e9bc5d3e4ba589b1633d3a8aba95e7ca19b179b0bb8b91ada8ea120f6acd01cca47869d41fd4455258e8ad5ed4ed96e74152434aebc2d4b60212e79b9bbef9e70d80243e2a3b22ef9fc852cb328f11b921c88980deb34891439674778e653dee265537a42de0953083ccd56b57242a4279b7d6a4eda6f31b6335ae56864ca65d5dfac073d0203010001a382017b3082017730090603551d1304023000300e0603551d0f0101ff04040302078030400603551d1f043930373035a033a031862f687474703a2f2f637363332d323031302d63726c2e766572697369676e2e636f6d2f435343332d323031302e63726c30440603551d20043d303b3039060b6086480186f84501071703302a302806082b06010505070201161c68747470733a2f2f7777772e766572697369676e2e636f6d2f72706130130603551d25040c300a06082b06010505070303307106082b0601050507010104653063302406082b060105050730018618687474703a2f2f6f6373702e766572697369676e2e636f6d303b06082b06010505073002862f687474703a2f2f637363332d323031302d6169612e766572697369676e2e636f6d2f435343332d323031302e636572301f0603551d23041830168014cf99a9ea7b26f44bc98e8fd7f00526efe3d2a79d301106096086480186f84201010404030204103016060a2b06010401823702011b040830060101000101ff300d06092a864886f70d010105050003820101006cb2632ab501ff6eee27631a111c2f2066724399bbd09c80e7a0a68e2ab14816dc7d13c4a7285a640f8a8b63fcc40e718b81513d7b1d12b65408c093b14f0d4a3bd2df599de287b5a5ac62b71b795fa33d5f1ee81a07117ef04cd43c2c68e4e94088d62324b1b0d9a4362e3fbe8a9398a89e17315dd942e782f36de5b3cb1b58c6c4dd67da13277b2cbcfd5bb48e1133bef9d2bf1ec2d26a3acbb93da0a94ec01def19f79f5b442fd29a648bfdc96996bd9c64945c39af5e3603706c7677000b9f5776bf339fc650701617b12c45478f56052249a68e0996f4b54e89a747c157d113f7ed5c4790ea1d6ea9c874b86c3f52135e9bbf755121319043f441e6a07b	CertMgr.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\97B8DB93E99E6D5D8F6424143BE1F8F96D0F4FA7\Blob = 0f00000001000000140000009429b7ba3c207e859f3b6087ebf608f3af34a09303000000010000001400000097b8db93e99e6d5d8f6424143be1f8f96d0f4fa7200000000100000077050000308205733082045ba00302010202103621615d5dc8015358e6e878c541abf0300d06092a864886f70d01010505003081b4310b300906035504061302555331173015060355040a130e566572695369676e2c20496e632e311f301d060355040b1316566572695369676e205472757374204e6574776f726b313b3039060355040b13325465726d73206f66207573652061742068747470733a2f2f7777772e766572697369676e2e636f6d2f727061202863293130312e302c06035504031325566572695369676e20436c617373203320436f6465205369676e696e672032303130204341301e170d3132313230323030303030305a170d3134303130313233353935395a3081b6310b3009060355040613025553310f300d060355040813064e6576616461311230100603550407130948656e646572736f6e3120301e060355040a1417436f6465204c61626f7261746f726965732c20496e632e313e303c060355040b13354469676974616c20494420436c6173732033202d204d6963726f736f667420536f6674776172652056616c69646174696f6e2076323120301e06035504031417436f6465204c61626f7261746f726965732c20496e632e30820122300d06092a864886f70d01010105000382010f003082010a0282010100db4b56899f9bd1e780be42d133beb8426d253c6b5cf7b128e80d41bd72f947737c78608b0b45dedddb081bbd9e049fc4a29d5f1c3ac2f04299858cce5d349e6d9aa60e86bc37a16538944aa347b47b9a0e4be17e3ff56d4eb4b8982b6db146f6dec8df75e49c0403e4e97b201e95edbf7e76d1b1ffc11da2d142734e9bc5d3e4ba589b1633d3a8aba95e7ca19b179b0bb8b91ada8ea120f6acd01cca47869d41fd4455258e8ad5ed4ed96e74152434aebc2d4b60212e79b9bbef9e70d80243e2a3b22ef9fc852cb328f11b921c88980deb34891439674778e653dee265537a42de0953083ccd56b57242a4279b7d6a4eda6f31b6335ae56864ca65d5dfac073d0203010001a382017b3082017730090603551d1304023000300e0603551d0f0101ff04040302078030400603551d1f043930373035a033a031862f687474703a2f2f637363332d323031302d63726c2e766572697369676e2e636f6d2f435343332d323031302e63726c30440603551d20043d303b3039060b6086480186f84501071703302a302806082b06010505070201161c68747470733a2f2f7777772e766572697369676e2e636f6d2f72706130130603551d25040c300a06082b06010505070303307106082b0601050507010104653063302406082b060105050730018618687474703a2f2f6f6373702e766572697369676e2e636f6d303b06082b06010505073002862f687474703a2f2f637363332d323031302d6169612e766572697369676e2e636f6d2f435343332d323031302e636572301f0603551d23041830168014cf99a9ea7b26f44bc98e8fd7f00526efe3d2a79d301106096086480186f84201010404030204103016060a2b06010401823702011b040830060101000101ff300d06092a864886f70d010105050003820101006cb2632ab501ff6eee27631a111c2f2066724399bbd09c80e7a0a68e2ab14816dc7d13c4a7285a640f8a8b63fcc40e718b81513d7b1d12b65408c093b14f0d4a3bd2df599de287b5a5ac62b71b795fa33d5f1ee81a07117ef04cd43c2c68e4e94088d62324b1b0d9a4362e3fbe8a9398a89e17315dd942e782f36de5b3cb1b58c6c4dd67da13277b2cbcfd5bb48e1133bef9d2bf1ec2d26a3acbb93da0a94ec01def19f79f5b442fd29a648bfdc96996bd9c64945c39af5e3603706c7677000b9f5776bf339fc650701617b12c45478f56052249a68e0996f4b54e89a747c157d113f7ed5c4790ea1d6ea9c874b86c3f52135e9bbf755121319043f441e6a07b	DrvInst.exe

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral1/files/0x00090000000243bb-131.dat	acprotect

Executes dropped EXE 2 IoCs

pid	Process
516	CertMgr.exe
2500	wdreg.exe

Loads dropped DLL 10 IoCs

pid	Process
2100	CL-Eye-Driver-5.3.0.0341-Emuline.exe
2100	CL-Eye-Driver-5.3.0.0341-Emuline.exe
2100	CL-Eye-Driver-5.3.0.0341-Emuline.exe
2100	CL-Eye-Driver-5.3.0.0341-Emuline.exe
2100	CL-Eye-Driver-5.3.0.0341-Emuline.exe
2100	CL-Eye-Driver-5.3.0.0341-Emuline.exe
2100	CL-Eye-Driver-5.3.0.0341-Emuline.exe
2100	CL-Eye-Driver-5.3.0.0341-Emuline.exe
2100	CL-Eye-Driver-5.3.0.0341-Emuline.exe
3200	regsvr32.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in System32 directory 20 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\DriverStore\Temp\{2bd5f268-6b9f-f346-bcd9-59f06acfb4f8}\PS3EyeCamera.cat	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{2bd5f268-6b9f-f346-bcd9-59f06acfb4f8}\SET3900.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{2bd5f268-6b9f-f346-bcd9-59f06acfb4f8}\WinUSBCoInstaller2.dll	DrvInst.exe
File created	C:\Windows\System32\DriverStore\drvstore.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\ps3eyecamera.inf_amd64_1bee6f347e56b9c0\PS3EyeCamera.cat	DrvInst.exe
File opened for modification	C:\Windows\System32\CatRoot2\dberr.txt	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{2bd5f268-6b9f-f346-bcd9-59f06acfb4f8}	DrvInst.exe
File created	C:\Windows\system32\CLEyeDevices.dll	CL-Eye-Driver-5.3.0.0341-Emuline.exe
File created	C:\Windows\System32\DriverStore\Temp\{2bd5f268-6b9f-f346-bcd9-59f06acfb4f8}\SET38DE.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{2bd5f268-6b9f-f346-bcd9-59f06acfb4f8}\SET38DF.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{2bd5f268-6b9f-f346-bcd9-59f06acfb4f8}\PS3EyeCamera.inf	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\ps3eyecamera.inf_amd64_1bee6f347e56b9c0\WinUSBCoInstaller2.dll	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{2bd5f268-6b9f-f346-bcd9-59f06acfb4f8}\SET38E0.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{2bd5f268-6b9f-f346-bcd9-59f06acfb4f8}\WdfCoInstaller01009.dll	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{2bd5f268-6b9f-f346-bcd9-59f06acfb4f8}\SET3900.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\ps3eyecamera.inf_amd64_1bee6f347e56b9c0\PS3EyeCamera.inf	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{2bd5f268-6b9f-f346-bcd9-59f06acfb4f8}\SET38DE.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{2bd5f268-6b9f-f346-bcd9-59f06acfb4f8}\SET38DF.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{2bd5f268-6b9f-f346-bcd9-59f06acfb4f8}\SET38E0.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\ps3eyecamera.inf_amd64_1bee6f347e56b9c0\WdfCoInstaller01009.dll	DrvInst.exe

Drops file in Program Files directory 8 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Code Laboratories\CL-Eye Driver\Driver\CLEyeDevices.dll	CL-Eye-Driver-5.3.0.0341-Emuline.exe
File created	C:\Program Files (x86)\Code Laboratories\CL-Eye Driver\Driver\PS3EyeCamera.inf	CL-Eye-Driver-5.3.0.0341-Emuline.exe
File created	C:\Program Files (x86)\Code Laboratories\CL-Eye Driver\Driver\WdfCoInstaller01009.dll	CL-Eye-Driver-5.3.0.0341-Emuline.exe
File created	C:\Program Files (x86)\Code Laboratories\CL-Eye Driver\Driver\WinUSBCoInstaller2.dll	CL-Eye-Driver-5.3.0.0341-Emuline.exe
File created	C:\Program Files (x86)\Code Laboratories\CL-Eye Driver\Driver\ps3eyecamera.cat	CL-Eye-Driver-5.3.0.0341-Emuline.exe
File created	C:\Program Files (x86)\Code Laboratories\CL-Eye Driver\CL-EyeTest.exe	CL-Eye-Driver-5.3.0.0341-Emuline.exe
File created	C:\Program Files (x86)\Code Laboratories\CL-Eye Driver\PS3EyeAxFilter.ax	CL-Eye-Driver-5.3.0.0341-Emuline.exe
File created	C:\Program Files (x86)\Code Laboratories\CL-Eye Driver\uninst.exe	CL-Eye-Driver-5.3.0.0341-Emuline.exe

Drops file in Windows directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Windows\INF\setupapi.dev.log	svchost.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File opened for modification	C:\Windows\inf\oem3.inf	DrvInst.exe
File created	C:\Windows\inf\oem3.inf	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	wdreg.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CertMgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CL-Eye-Driver-5.3.0.0341-Emuline.exe

Checks SCSI registry key(s) 3 TTPs 32 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	wdreg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\CompatibleIDs	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID	wdreg.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\CompatibleIDs	wdreg.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	wdreg.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\CompatibleIDs	wdreg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Phantom	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	wdreg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Phantom	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\CompatibleIDs	DrvInst.exe

Modifies data under HKEY_USERS 42 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	DrvInst.exe

Modifies registry class 30 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CA72091E-1213-41BB-8E13-5478D0AEB711}\InprocServer32\ = "C:\\Program Files (x86)\\Code Laboratories\\CL-Eye Driver\\PS3EyeAxFilter.ax"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{860BB310-5D01-11d0-BD3B-00A0C911CE86}\Instance\PS3Eye Camera	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A8E36632-8B66-410A-B7C9-8AAF2B27392D}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CA72091E-1213-41BB-8E13-5478D0AEB711}\ = "Camera Settings"	regsvr32.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{860BB310-5D01-11d0-BD3B-00A0C911CE86}\Instance\PS3Eye Camera\FilterData = 02000000000020000100000000000000307069330800000000000000010000000000000000000000307479330000000038000000480000007669647300001000800000aa00389b7100000000000000000000000000000000	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A8E36632-8B66-410A-B7C9-8AAF2B27392D}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B07D086D-BE71-4089-A5CD-5A0E450964C4}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B07D086D-BE71-4089-A5CD-5A0E450964C4}\ = "Camera Properties"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CA72091E-1213-41BB-8E13-5478D0AEB711}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{860BB310-5D01-11d0-BD3B-00A0C911CE86}\Instance	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A8E36632-8B66-410A-B7C9-8AAF2B27392D}\InprocServer32\ = "C:\\Program Files (x86)\\Code Laboratories\\CL-Eye Driver\\PS3EyeAxFilter.ax"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B07D086D-BE71-4089-A5CD-5A0E450964C4}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{A8E36632-8B66-410A-B7C9-8AAF2B27392D}	regsvr32.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{A8E36632-8B66-410A-B7C9-8AAF2B27392D}\FilterData = 02000000000020000100000000000000307069330800000000000000010000000000000000000000307479330000000038000000480000007669647300001000800000aa00389b7100000000000000000000000000000000	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{860BB310-5D01-11D0-BD3B-00A0C911CE86}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A8E36632-8B66-410A-B7C9-8AAF2B27392D}\ = "PS3Eye Camera"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A8E36632-8B66-410A-B7C9-8AAF2B27392D}\InprocServer32\ThreadingModel = "Both"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{A8E36632-8B66-410A-B7C9-8AAF2B27392D}\FriendlyName = "PS3Eye Camera"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{860BB310-5D01-11d0-BD3B-00A0C911CE86}\Instance\PS3Eye Camera\DevicePath = "PS3Eye Camera"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{860BB310-5D01-11d0-BD3B-00A0C911CE86}\Instance\PS3Eye Camera\Description = "PS3Eye Camera"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B07D086D-BE71-4089-A5CD-5A0E450964C4}\InprocServer32\ = "C:\\Program Files (x86)\\Code Laboratories\\CL-Eye Driver\\PS3EyeAxFilter.ax"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B07D086D-BE71-4089-A5CD-5A0E450964C4}\InprocServer32\ThreadingModel = "Both"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CA72091E-1213-41BB-8E13-5478D0AEB711}\InprocServer32\ThreadingModel = "Both"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{A8E36632-8B66-410A-B7C9-8AAF2B27392D}\CLSID = "{A8E36632-8B66-410A-B7C9-8AAF2B27392D}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{860BB310-5D01-11D0-BD3B-00A0C911CE86}\Instance\PS3Eye Camera	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CA72091E-1213-41BB-8E13-5478D0AEB711}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{860BB310-5D01-11d0-BD3B-00A0C911CE86}\Instance\PS3Eye Camera\FriendlyName = "PS3Eye Camera"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{860BB310-5D01-11d0-BD3B-00A0C911CE86}\Instance\PS3Eye Camera\CLSID = "{A8E36632-8B66-410A-B7C9-8AAF2B27392D}"	regsvr32.exe

Modifies system certificate store 2 TTPs 2 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\97B8DB93E99E6D5D8F6424143BE1F8F96D0F4FA7	CertMgr.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\97B8DB93E99E6D5D8F6424143BE1F8F96D0F4FA7\Blob = 03000000010000001400000097b8db93e99e6d5d8f6424143be1f8f96d0f4fa7200000000100000077050000308205733082045ba00302010202103621615d5dc8015358e6e878c541abf0300d06092a864886f70d01010505003081b4310b300906035504061302555331173015060355040a130e566572695369676e2c20496e632e311f301d060355040b1316566572695369676e205472757374204e6574776f726b313b3039060355040b13325465726d73206f66207573652061742068747470733a2f2f7777772e766572697369676e2e636f6d2f727061202863293130312e302c06035504031325566572695369676e20436c617373203320436f6465205369676e696e672032303130204341301e170d3132313230323030303030305a170d3134303130313233353935395a3081b6310b3009060355040613025553310f300d060355040813064e6576616461311230100603550407130948656e646572736f6e3120301e060355040a1417436f6465204c61626f7261746f726965732c20496e632e313e303c060355040b13354469676974616c20494420436c6173732033202d204d6963726f736f667420536f6674776172652056616c69646174696f6e2076323120301e06035504031417436f6465204c61626f7261746f726965732c20496e632e30820122300d06092a864886f70d01010105000382010f003082010a0282010100db4b56899f9bd1e780be42d133beb8426d253c6b5cf7b128e80d41bd72f947737c78608b0b45dedddb081bbd9e049fc4a29d5f1c3ac2f04299858cce5d349e6d9aa60e86bc37a16538944aa347b47b9a0e4be17e3ff56d4eb4b8982b6db146f6dec8df75e49c0403e4e97b201e95edbf7e76d1b1ffc11da2d142734e9bc5d3e4ba589b1633d3a8aba95e7ca19b179b0bb8b91ada8ea120f6acd01cca47869d41fd4455258e8ad5ed4ed96e74152434aebc2d4b60212e79b9bbef9e70d80243e2a3b22ef9fc852cb328f11b921c88980deb34891439674778e653dee265537a42de0953083ccd56b57242a4279b7d6a4eda6f31b6335ae56864ca65d5dfac073d0203010001a382017b3082017730090603551d1304023000300e0603551d0f0101ff04040302078030400603551d1f043930373035a033a031862f687474703a2f2f637363332d323031302d63726c2e766572697369676e2e636f6d2f435343332d323031302e63726c30440603551d20043d303b3039060b6086480186f84501071703302a302806082b06010505070201161c68747470733a2f2f7777772e766572697369676e2e636f6d2f72706130130603551d25040c300a06082b06010505070303307106082b0601050507010104653063302406082b060105050730018618687474703a2f2f6f6373702e766572697369676e2e636f6d303b06082b06010505073002862f687474703a2f2f637363332d323031302d6169612e766572697369676e2e636f6d2f435343332d323031302e636572301f0603551d23041830168014cf99a9ea7b26f44bc98e8fd7f00526efe3d2a79d301106096086480186f84201010404030204103016060a2b06010401823702011b040830060101000101ff300d06092a864886f70d010105050003820101006cb2632ab501ff6eee27631a111c2f2066724399bbd09c80e7a0a68e2ab14816dc7d13c4a7285a640f8a8b63fcc40e718b81513d7b1d12b65408c093b14f0d4a3bd2df599de287b5a5ac62b71b795fa33d5f1ee81a07117ef04cd43c2c68e4e94088d62324b1b0d9a4362e3fbe8a9398a89e17315dd942e782f36de5b3cb1b58c6c4dd67da13277b2cbcfd5bb48e1133bef9d2bf1ec2d26a3acbb93da0a94ec01def19f79f5b442fd29a648bfdc96996bd9c64945c39af5e3603706c7677000b9f5776bf339fc650701617b12c45478f56052249a68e0996f4b54e89a747c157d113f7ed5c4790ea1d6ea9c874b86c3f52135e9bbf755121319043f441e6a07b	CertMgr.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeAuditPrivilege	4248	svchost.exe
Token: SeSecurityPrivilege	4248	svchost.exe
Token: SeLoadDriverPrivilege	2500	wdreg.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2100 wrote to memory of 516	2100	CL-Eye-Driver-5.3.0.0341-Emuline.exe	91
PID 2100 wrote to memory of 2500	2100	CL-Eye-Driver-5.3.0.0341-Emuline.exe	93
PID 4248 wrote to memory of 4732	4248	svchost.exe	96
PID 2100 wrote to memory of 3200	2100	CL-Eye-Driver-5.3.0.0341-Emuline.exe	97

C:\Users\Admin\AppData\Local\Temp\CL-Eye-Driver-5.3.0.0341-Emuline.exe
"C:\Users\Admin\AppData\Local\Temp\CL-Eye-Driver-5.3.0.0341-Emuline.exe"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2100
- C:\Users\Admin\AppData\Local\Temp\nsvFABD.tmp\CertMgr.exe
  C:\Users\Admin\AppData\Local\Temp\nsvFABD.tmp\CertMgr.exe -add C:\Users\Admin\AppData\Local\Temp\nsvFABD.tmp\CodeLabs.cer -c -s -r localMachine TrustedPublisher
  2⤵
  - Manipulates Digital Signatures
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Modifies system certificate store
  PID:516
- C:\Users\Admin\AppData\Local\Temp\nsvFABD.tmp\wdreg.exe
  C:\Users\Admin\AppData\Local\Temp\nsvFABD.tmp\wdreg.exe -inf PS3EyeCamera.inf -silent -compat install
  2⤵
  - Executes dropped EXE
  - Drops file in Windows directory
  - Checks SCSI registry key(s)
  - Suspicious use of AdjustPrivilegeToken
  PID:2500
- C:\Windows\SysWOW64\regsvr32.exe
  regsvr32 /s PS3EyeAxFilter.ax
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  PID:3200

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall
1⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4248
- C:\Windows\system32\DrvInst.exe
  DrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{a0359aa1-8d41-3d4f-b582-dab4e55400d3}\PS3EyeCamera.inf" "9" "47b741263" "0000000000000154" "WinSta0\Default" "00000000000000E8" "208" "C:\Program Files (x86)\Code Laboratories\CL-Eye Driver\Driver"
  2⤵
  - Manipulates Digital Signatures
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Checks SCSI registry key(s)
  - Modifies data under HKEY_USERS
  PID:4732

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

PS3EYE~1.CAT

Path C:\PROGRA~2\CODELA~1\CL-EYE~1\Driver\PS3EYE~1.CAT
Size 8KB
SHA256 d70910eb2d223f843328443a18b79b50a71470b40f0a19b7c422f062322cd562
MD5 2b1ef3be14db406855e7ef58a725ffe0
SHA1 7498d416ad02288ce86696ca1633e750fd8a2c7f
SHA512 1633ed6842962a135f5750a2c2aaf48d2c5fcb6ebd44c84514425546bdf0afc1f2f8fd2290aa8edd57f9f5e642edb481278fbd3a7ed16dc3684699f13d885f14
SSDEEP 192:Tt+quC09Qw335/wJirNmL/TSrR1DHC+v+pSXjtlAur9ZCspE+TMcrZQvM:YP3mirILTaTICUHeMcQE
TLSH
T1B1120AEB4A181462EC86CF70D5E6E02BFD3073D66DC8556A40B683C56D827B03B5980F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WDFCOI~1.DLL

Path C:\PROGRA~2\CODELA~1\CL-EYE~1\Driver\WDFCOI~1.DLL
Size 1.6MB
SHA256 18487b4ff94edccc98ed59d9fca662d4a1331c5f1e14df8db3093256dd9f1c3e
MD5 4da5da193e0e4f86f6f8fd43ef25329a
SHA1 68a44d37ff535a2c454f2440e1429833a1c6d810
SHA512 b3d73ed5e45d6f2908b2f3086390dd28c1631e298756cee9bdf26b185f0b77d1b8c03ad55e0495dba982c5bed4a03337b130c76f7112f3e19821127d2cf36853
SSDEEP 24576:oU4MsColC6Je/ZgY7OOfcEpiRLH87SyVXGe38uKUj+NFVov1PJLfVKZ8F5mEeZWF:BFCsfZRZA6Xn388avVovfLd+Mo4iEF
TLSH
T10485234577FC1178F1F3AAB48ABA84062A767C854FB6D28F0250C95D6DB2FC489B4363
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WINUSB~1.DLL

Path C:\PROGRA~2\CODELA~1\CL-EYE~1\Driver\WINUSB~1.DLL
Size 979KB
SHA256 981a17effddbc20377512ddaec9f22c2b7067e17a3e2a8ccf82bb7bb7b2420b6
MD5 246900ce6474718730ecd4f873234cf5
SHA1 0c84b56c82e4624824154d27926ded1c45f4b331
SHA512 6a9e305bfbfb57d8f8fd16edabef9291a8a97e4b9c2ae90622f6c056e518a0a731fbb3e33a2591d87c8e4293d0f983ec515e6a241792962257b82401a8811d5c
SSDEEP 24576:aAEBXzGJ7fW6hHv62VYeL7WCE3wixdLZWQzMjp:uBXQz/hPzxRwPdcO
TLSH
T16225124117A48478E4F2AB74A5FB8A11D770BC111735C3CF8285AAAC2E727D9DE38727
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CL-EyeTest.exe

Path C:\Program Files (x86)\Code Laboratories\CL-Eye Driver\CL-EyeTest.exe
Size 157KB
SHA256 8560d2f4fdf7d3a2c5fd7f3ed1c414cbb4477d8d39f84e161dcc8895cea00e3b
MD5 c4be1ab315322e9c3d7de01e7a6880f9
SHA1 9931363ccd9c113c3cda4be6092cb09564f37543
SHA512 6113e9945ad0bfa5d38a91eb23a297d0ebbe17b0c69ca4c75e8c92173c3fbc1624cb53e7a103e645a395d7325642d10c9622778ce934542c1d2298486b4583a3
SSDEEP 3072:OPeHl6ZYeUSPzphcZ6DMgPOjT22lv5nHr7wZTG:ieF6Z1Pths6PPt2lv5LMZq
TLSH
T13EF36D1236E0C13ED0E265B1CD75DA6616B9FC31073941EB67E8297D8E70BC1BA78352
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PS3EyeCamera.inf

Path C:\Program Files (x86)\Code Laboratories\CL-Eye Driver\Driver\PS3EyeCamera.inf
Size 2KB
SHA256 3d75843cf756e744177c3c5b31b9100d2c18c9fe8a7b6d0cf62ffee9b5f53788
MD5 60bb6d15f8989d61064565c5e7b7e7bb
SHA1 7a56f978ce9f66ff9fe7c399155d9c16f0309b2f
SHA512 74e9a3ab0507272d5dfa928c870bd3d0dac23c32cfb8c95149819aefe4f033cca54bd9bb27c988004f83758689e88521d0bd3421fe6f206a6aa138a6a19a516d
TLSH
T1BC511E4C528A257DB6D3170D2F032C95B564B444A1BA2939F6DF49CACF84FDC23612BB
MD5 SHA1 SHA512 TLSH

Submit Download

PS3EyeAxFilter.ax

Path C:\Program Files (x86)\Code Laboratories\CL-Eye Driver\PS3EyeAxFilter.ax
Size 100KB
SHA256 d64bf4dd9944c21da5e21f7aaaecbe9ada4cbf77933738ab17d4bc68571cb346
MD5 a71f6a671273897012b7b656d9e41f3e
SHA1 231ea80c336a55e7a3143b747b2fea97a2e9b7fc
SHA512 1797b73c18e89a04c16ab7109953be94ad3cadfa63830efff81d94240532aac2af709185e8c5c1c8b9bff7f9db14b7ba50190ed24cf260d70499623acadf0e7a
SSDEEP 3072:DtL8kpWxTAPjG7hJ2JtYbZVB7ZLs5kgYLbYvC:DWkMtAKbCKV1ZLmkgYLb7
TLSH
T151A30183CA191C30FDCB1E7D7BCFA0A6C935729596D64186459882CEAE7FB54230670F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CertMgr.exe

Path C:\Users\Admin\AppData\Local\Temp\nsvFABD.tmp\CertMgr.exe
Size 63KB
SHA256 781f4eca34d7ea200ec534f556ae0d39a89e0e38d909899166a6e910b57e2cbd
MD5 1444bcfeff029bb1e9b1ca3b896cd143
SHA1 a002c0995aef87a0b523c69073b0b10ef850acaa
SHA512 2bd309dc6605a0ed714c21e9c0bbe9a973e7d4f078e9944ec1e2cc273c98b400a76b94beaa8389d000eee3ff982b4a1b9a4e6e5fd21fae84de622951b15faebc
SSDEEP 1536:qnOUkO0UXRiKvbVAc5xt3xGnmdYw+WXsA9iYzvy:OOUu3KvbVtxtBGnmdt+WXso
TLSH
T14C53B50163F94926F9F326B15E3A66A44FB7BA901A30D78F0378468D0E73B94C971367
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CodeLabs.cer

Path C:\Users\Admin\AppData\Local\Temp\nsvFABD.tmp\CodeLabs.cer
Size 1KB
SHA256 7d535ad3e333875076288791bbce84fd7db67624940b2639418eb40bf39ce465
MD5 972b62b8c7088af29c364514e6582f0b
SHA1 97b8db93e99e6d5d8f6424143be1f8f96d0f4fa7
SHA512 f0e54b5eab3d67902b823c879cf73db95372ae222f60885597c43ba93be81852008c88cc20de1fb96a93b86e219025191d670ec373e4fe256071bd3ae7d175cd
TLSH
T1642174F7090018228DD55F40D1E7E7539D7133C2AFC4B492965840C73B8E7B1379465A
MD5 SHA1 SHA512 TLSH

Submit Download

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nsvFABD.tmp\System.dll
Size 11KB
SHA256 dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f
MD5 c17103ae9072a06da581dec998343fc1
SHA1 b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d
SHA512 d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f
SSDEEP 192:7DKnJZCv6VmbJQC+tFiUdK7ckD4gRXKQx+LQ2CSF:7ViJrtFRdbmXK8+PCw
TLSH
T1CA325C5993A0C1F3D5A0823C0D973A7B1779722016B14FA3CFA35842AE196D7AC7D227
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

modern-wizard.bmp

Path C:\Users\Admin\AppData\Local\Temp\nsvFABD.tmp\modern-wizard.bmp
Size 150KB
SHA256 8d40754ea0871fea52cf2d97c9cfef69d0828fce118b13b178310a9fd390f9bc
MD5 5f3567bf12b8c1ebb11696240b49a1f6
SHA1 f8082db4d83ccd587fe1db1a6bb6cecfb793b646
SHA512 eb784c1a91d9e72ece96db7656fc26f296c36f18656b8356a5091f8ac4f92a725738b64c354b8e35ae3a1d986c0b3a39a9b4bcbd1d649734080292ba84434b05
SSDEEP 768:7PP4Cu6o3BJeg3m4IBzaGhVmF3mIpVR2VoGEwUNg6KKIrs+ysufmhAGU/oZIy8Zd:mr
TLSH
T105E36BAFE50AFA0767D0C8E9C9655BB54E98FC8E176358786D6C389C953F3200A0D21F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsDialogs.dll

Path C:\Users\Admin\AppData\Local\Temp\nsvFABD.tmp\nsDialogs.dll
Size 9KB
SHA256 e31ad6c6e82e603378cb6b80e67d0e0dcd9cf384e1199ac5a65cb4935680021a
MD5 c10e04dd4ad4277d5adc951bb331c777
SHA1 b1e30808198a3ae6d6d1cca62df8893dc2a7ad43
SHA512 853a5564bf751d40484ea482444c6958457cb4a17fb973cf870f03f201b8b2643be41bccde00f6b2026dc0c3d113e6481b0dc4c7b0f3ae7966d38c92c6b5862e
SSDEEP 96:hBABCcnl5TKhkfLxSslykcxM2DjDf3GE+Xv8Xav+Yx4VndY7ndS27gA:h6n+0SAfRE+/8ZYxMdqn420
TLSH
T17F12F8675A4041B3E9A3223D306A3E3F8B7C9325D0927C03C677AE566AB031A7D3A354
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsExec.dll

Path C:\Users\Admin\AppData\Local\Temp\nsvFABD.tmp\nsExec.dll
Size 6KB
SHA256 168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e
MD5 acc2b699edfea5bf5aae45aba3a41e96
SHA1 d2accf4d494e43ceb2cff69abe4dd17147d29cc2
SHA512 e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe
SSDEEP 96:M7GUb+YNfwgcr8zyKwZ5S4JxN8BS0ef9/3VI9d0qqyVgNk32E:eKgfwgcr8zylsB49Ud0qJVgNX
TLSH
T19BD1E73D75C33DB3C54ACA762C65292B0FB8C9261B5402119B6716C279D5AE3FE29382
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wdreg.exe

Path C:\Users\Admin\AppData\Local\Temp\nsvFABD.tmp\wdreg.exe
Size 142KB
SHA256 5957f8a0bea130c6c4d91af8c5d6879943dc76faf1ebb50a70e3bd285fc8d86e
MD5 d0047e39b0dfd11ec2a50e2a45c2d9be
SHA1 7dd0c7c4689aa4c70e3ffad86c2336d0785283b3
SHA512 4807e11cdff1f5fe78b7172cc0170de51fa97997f0096ef44e1c6d159df7e933889e64a368055cac5c57f5297478f1a035e0402818ccf33c540503f36305a64c
SSDEEP 3072:pDsy3Iz27vf6Uz4wtApVzVH8csZm5Z4GFQeLn04gQAL/iha8n:pDsy3K2jfewtApTH9sc5Z70n
TLSH
T14AE34959736151B6E463C17EC9838786EB32B4158B3113CF136A977A1F233D2BD3A621
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3200-133-0x0000000074440000-0x00000000744D4000-memory.dmp

Download

memory/3200-134-0x00000000744D3000-0x00000000744D4000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads