6e65e0116ca91fa444dbc833d801d1446b74f21513ae42286f51d8744eadca7a

Analysis

max time kernel
150s
max time network
136s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
18/10/2026, 23:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_Trojan-Spy.Win32.TheRat.eu.exe
Size 3.1MB
Sample261018-24tdssda39
SHA256 6e65e0116ca91fa444dbc833d801d1446b74f21513ae42286f51d8744eadca7a
MD5 f8ffd2ab0f7532ed0b925a8c0846a05d
SHA1 99c94708c0b172a0ff491dcf943891c0f6f91c33
SHA512 7ad8e7e52a27d4f0d491471b95a4e1198ca3e7ccd986677d5b6cb460bc88fbd013d7c7882441577a93854a6a4f52d9d83da5c5a68fba0422716ac1bcc92ca662
SSDEEP 98304:qMsVLs5eWPEjiMP6pCVnEuGm0Oujr+Wa6e:oVLieYE2u2uGZx86e
TLSH
T10FE533D490A04DEBE4D239B0BB387765674E1E9080E9334AA3F9BF6278353664D3560F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

defense_evasion discovery exploit persistence privilege_escalation spyware stealer upx

Malware Config

Signatures

Detected Nirsoft tools 1 IoCs

Free utilities often used by attackers which can steal passwords, product keys, etc.

resource	yara_rule
behavioral1/memory/532-90-0x0000000000400000-0x000000000041B000-memory.dmp	Nirsoft

NirSoft NirCmd 1 IoCs

NirCmd is a lightweight Windows command-line tool for automating system tasks

resource	yara_rule
behavioral1/memory/532-90-0x0000000000400000-0x000000000041B000-memory.dmp	NirCmd

Drops file in Drivers directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\SETE402.tmp	DrvInst.exe
File created	C:\Windows\System32\drivers\SETE402.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\drivers\teamviewervpn.sys	DrvInst.exe

Modifies Windows Firewall 2 TTPs 14 IoCs

defense_evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
2688	netsh.exe
2664	netsh.exe
3452	netsh.exe
2652	netsh.exe
1264	netsh.exe
3904	netsh.exe
3084	netsh.exe
3476	netsh.exe
2128	netsh.exe
3768	netsh.exe
2932	netsh.exe
1400	netsh.exe
3268	netsh.exe
1764	netsh.exe

Possible privilege escalation attempt 2 IoCs

exploit

pid	Process
4824	takeown.exe
676	icacls.exe

Server Software Component: Terminal Services DLL 1 TTPs 1 IoCs

persistence

Terminal Services DLL

T1505.005

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\TermService\Parameters\ServiceDll = "%SystemRoot%\\system32\\rdpwrap.dll"	ehmsas.exe

Allows Network login with blank passwords 1 TTPs 1 IoCs

Allows local user accounts with blank passwords to access device from the network.

Remote Desktop Protocol

T1021.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Lsa\LimitBlankPasswordUse = "0"	ehmsas.exe

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\Control Panel\International\Geo\Nation	ehmsas.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\Control Panel\International\Geo\Nation	ehmsas.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\Control Panel\International\Geo\Nation	cl3lt455q0oxde

Executes dropped EXE 8 IoCs

pid	Process
2604	k2fl675x5el
532	cl3lt455q0oxde
4076	cl3lt455q0oxde
3380	ehmsas.exe
1396	ehmsas.exe
1004	install64.exe
5024	install64.exe
2604	ehmsas.exe

Loads dropped DLL 19 IoCs

pid	Process
896	jaffacakes118_Trojan-Spy.Win32.TheRat.eu.exe
896	jaffacakes118_Trojan-Spy.Win32.TheRat.eu.exe
896	jaffacakes118_Trojan-Spy.Win32.TheRat.eu.exe
896	jaffacakes118_Trojan-Spy.Win32.TheRat.eu.exe
896	jaffacakes118_Trojan-Spy.Win32.TheRat.eu.exe
896	jaffacakes118_Trojan-Spy.Win32.TheRat.eu.exe
896	jaffacakes118_Trojan-Spy.Win32.TheRat.eu.exe
896	jaffacakes118_Trojan-Spy.Win32.TheRat.eu.exe
896	jaffacakes118_Trojan-Spy.Win32.TheRat.eu.exe
3380	ehmsas.exe
3380	ehmsas.exe
3380	ehmsas.exe
3380	ehmsas.exe
1396	ehmsas.exe
2604	ehmsas.exe
2604	ehmsas.exe
2604	ehmsas.exe
2604	ehmsas.exe
3220	svchost.exe

Modifies file permissions 1 TTPs 2 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
676	icacls.exe
4824	takeown.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ehmsas = "C:\\Users\\Admin\\AppData\\Roaming\\ehome\\ehmsas.exe"	ehmsas.exe

Modifies WinLogon 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\AllowMultipleTSSessions = "1"	ehmsas.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in System32 directory 20 IoCs

description	ioc	Process
File created	C:\Windows\System32\DriverStore\Temp\{c89889f5-f1bd-4e4d-8577-d86da472c20d}\SETE20E.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{c89889f5-f1bd-4e4d-8577-d86da472c20d}\SETE21F.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{c89889f5-f1bd-4e4d-8577-d86da472c20d}\SETE22F.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{c89889f5-f1bd-4e4d-8577-d86da472c20d}\SETE22F.tmp	DrvInst.exe
File created	C:\Windows\System32\rdpwrap.ini	ehmsas.exe
File created	C:\Windows\System32\utilman.exe	ehmsas.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{c89889f5-f1bd-4e4d-8577-d86da472c20d}\SETE20E.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{c89889f5-f1bd-4e4d-8577-d86da472c20d}\SETE21F.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{c89889f5-f1bd-4e4d-8577-d86da472c20d}\teamviewervpn.inf	DrvInst.exe
File created	C:\Windows\System32\DriverStore\drvstore.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\teamviewervpn.inf_amd64_5e1dcb6f86e23dcd\teamviewervpn.cat	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\teamviewervpn.inf_amd64_5e1dcb6f86e23dcd\teamviewervpn.inf	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{c89889f5-f1bd-4e4d-8577-d86da472c20d}	DrvInst.exe
File created	C:\Windows\System32\rdpwrap64.dll	ehmsas.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{c89889f5-f1bd-4e4d-8577-d86da472c20d}\teamviewervpn.cat	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{c89889f5-f1bd-4e4d-8577-d86da472c20d}\teamviewervpn.sys	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\teamviewervpn.inf_amd64_5e1dcb6f86e23dcd\teamviewervpn.sys	DrvInst.exe
File opened for modification	C:\Windows\System32\CatRoot2\dberr.txt	DrvInst.exe
File created	C:\Windows\System32\DriverStore\FileRepository\teamviewervpn.inf_amd64_5e1dcb6f86e23dcd\teamviewervpn.PNF	install64.exe
File opened for modification	C:\Windows\System32\utilman.exe	ehmsas.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/532-89-0x0000000000400000-0x000000000041B000-memory.dmp	upx
behavioral1/files/0x000700000002451c-88.dat	upx
behavioral1/memory/532-90-0x0000000000400000-0x000000000041B000-memory.dmp	upx

Drops file in Windows directory 6 IoCs

description	ioc	Process
File opened for modification	C:\Windows\INF\setupapi.dev.log	install64.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	svchost.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File opened for modification	C:\Windows\inf\oem3.inf	DrvInst.exe
File created	C:\Windows\inf\oem3.inf	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe

Enumerates video capture drivers 2 TTPs 2 IoCs

Queries the legacy Video for Windows capture drivers. This is commonly abused by RATs to check for available webcams on the system before reporting to their C2.

discovery defense_evasion

Peripheral Device Discovery

T1120

Video Capture

T1125

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Drivers32\msvideo9	ehmsas.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Drivers32\msvideo9	ehmsas.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4684	sc.exe
1940	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 42 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	ehmsas.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	ehmsas.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	ehmsas.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	ehmsas.exe

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cl3lt455q0oxde
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cl3lt455q0oxde
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ehmsas.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ehmsas.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ehmsas.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_Trojan-Spy.Win32.TheRat.eu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	k2fl675x5el

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	install64.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Filters	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs	install64.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\CompatibleIDs	install64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\LowerFilters	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	install64.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom	install64.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	install64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Filters	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID	install64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Service	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\UpperFilters	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\LowerFilters	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Filters	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Service	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\CompatibleIDs	install64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\LowerFilters	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs	install64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	install64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	install64.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Phantom	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Phantom	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\LowerFilters	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Filters	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\CompatibleIDs	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Service	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	install64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	install64.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom	install64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	install64.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	install64.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	install64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	install64.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID	install64.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\CompatibleIDs	install64.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Service	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	install64.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	DrvInst.exe

Modifies data under HKEY_USERS 41 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	DrvInst.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
896	jaffacakes118_Trojan-Spy.Win32.TheRat.eu.exe
896	jaffacakes118_Trojan-Spy.Win32.TheRat.eu.exe
896	jaffacakes118_Trojan-Spy.Win32.TheRat.eu.exe
896	jaffacakes118_Trojan-Spy.Win32.TheRat.eu.exe
896	jaffacakes118_Trojan-Spy.Win32.TheRat.eu.exe
896	jaffacakes118_Trojan-Spy.Win32.TheRat.eu.exe
896	jaffacakes118_Trojan-Spy.Win32.TheRat.eu.exe
896	jaffacakes118_Trojan-Spy.Win32.TheRat.eu.exe
3380	ehmsas.exe
3380	ehmsas.exe
3380	ehmsas.exe
3380	ehmsas.exe
3380	ehmsas.exe
3380	ehmsas.exe
2604	ehmsas.exe
2604	ehmsas.exe
2604	ehmsas.exe
2604	ehmsas.exe
2604	ehmsas.exe
2604	ehmsas.exe
2604	ehmsas.exe
2604	ehmsas.exe
2604	ehmsas.exe
2604	ehmsas.exe
2604	ehmsas.exe
2604	ehmsas.exe
2604	ehmsas.exe
2604	ehmsas.exe
2604	ehmsas.exe
2604	ehmsas.exe
2604	ehmsas.exe
2604	ehmsas.exe
2604	ehmsas.exe
2604	ehmsas.exe
2604	ehmsas.exe
2604	ehmsas.exe
2604	ehmsas.exe
2604	ehmsas.exe
2604	ehmsas.exe
2604	ehmsas.exe
2604	ehmsas.exe
2604	ehmsas.exe
2604	ehmsas.exe
2604	ehmsas.exe
2604	ehmsas.exe
2604	ehmsas.exe
2604	ehmsas.exe
2604	ehmsas.exe
2604	ehmsas.exe
2604	ehmsas.exe
2604	ehmsas.exe
2604	ehmsas.exe
2604	ehmsas.exe
2604	ehmsas.exe
2604	ehmsas.exe
2604	ehmsas.exe
2604	ehmsas.exe
2604	ehmsas.exe
2604	ehmsas.exe
2604	ehmsas.exe
2604	ehmsas.exe
2604	ehmsas.exe
2604	ehmsas.exe
2604	ehmsas.exe

Suspicious behavior: LoadsDriver 4 IoCs

pid	Process
652	Process not Found
652	Process not Found
652	Process not Found
652	Process not Found

Suspicious use of AdjustPrivilegeToken 21 IoCs

description	pid	Process
Token: SeRestorePrivilege	2604	k2fl675x5el
Token: 35	2604	k2fl675x5el
Token: SeSecurityPrivilege	2604	k2fl675x5el
Token: SeSecurityPrivilege	2604	k2fl675x5el
Token: SeDebugPrivilege	3380	ehmsas.exe
Token: SeAuditPrivilege	4692	svchost.exe
Token: SeSecurityPrivilege	4692	svchost.exe
Token: SeLoadDriverPrivilege	1004	install64.exe
Token: SeRestorePrivilege	1448	DrvInst.exe
Token: SeBackupPrivilege	1448	DrvInst.exe
Token: SeLoadDriverPrivilege	1448	DrvInst.exe
Token: SeLoadDriverPrivilege	1448	DrvInst.exe
Token: SeLoadDriverPrivilege	1448	DrvInst.exe
Token: SeLoadDriverPrivilege	5024	install64.exe
Token: SeLoadDriverPrivilege	5024	install64.exe
Token: SeDebugPrivilege	2604	ehmsas.exe
Token: SeTakeOwnershipPrivilege	4824	takeown.exe
Token: SeAuditPrivilege	3220	svchost.exe
Token: SeAuditPrivilege	3220	svchost.exe
Token: SeAuditPrivilege	3220	svchost.exe
Token: SeAuditPrivilege	3220	svchost.exe

Suspicious use of WriteProcessMemory 31 IoCs

description	pid	Process	procid_target
PID 896 wrote to memory of 2604	896	jaffacakes118_Trojan-Spy.Win32.TheRat.eu.exe	85
PID 896 wrote to memory of 532	896	jaffacakes118_Trojan-Spy.Win32.TheRat.eu.exe	87
PID 896 wrote to memory of 4076	896	jaffacakes118_Trojan-Spy.Win32.TheRat.eu.exe	95
PID 4076 wrote to memory of 3380	4076	cl3lt455q0oxde	96
PID 3380 wrote to memory of 1004	3380	ehmsas.exe	99
PID 4692 wrote to memory of 3256	4692	svchost.exe	102
PID 4692 wrote to memory of 1448	4692	svchost.exe	103
PID 3380 wrote to memory of 5024	3380	ehmsas.exe	107
PID 3380 wrote to memory of 2604	3380	ehmsas.exe	109
PID 2604 wrote to memory of 1592	2604	ehmsas.exe	112
PID 1592 wrote to memory of 3212	1592	net.exe	114
PID 2604 wrote to memory of 3452	2604	ehmsas.exe	115
PID 2604 wrote to memory of 4684	2604	ehmsas.exe	117
PID 2604 wrote to memory of 1940	2604	ehmsas.exe	119
PID 2604 wrote to memory of 3800	2604	ehmsas.exe	121
PID 3800 wrote to memory of 4800	3800	net.exe	123
PID 2604 wrote to memory of 4824	2604	ehmsas.exe	125
PID 2604 wrote to memory of 676	2604	ehmsas.exe	127
PID 2604 wrote to memory of 2652	2604	ehmsas.exe	129
PID 2604 wrote to memory of 2128	2604	ehmsas.exe	131
PID 2604 wrote to memory of 3768	2604	ehmsas.exe	133
PID 2604 wrote to memory of 1264	2604	ehmsas.exe	135
PID 2604 wrote to memory of 3904	2604	ehmsas.exe	137
PID 2604 wrote to memory of 2932	2604	ehmsas.exe	139
PID 2604 wrote to memory of 1400	2604	ehmsas.exe	141
PID 2604 wrote to memory of 3084	2604	ehmsas.exe	143
PID 2604 wrote to memory of 3268	2604	ehmsas.exe	145
PID 2604 wrote to memory of 1764	2604	ehmsas.exe	147
PID 2604 wrote to memory of 3476	2604	ehmsas.exe	149
PID 2604 wrote to memory of 2688	2604	ehmsas.exe	151
PID 2604 wrote to memory of 2664	2604	ehmsas.exe	153

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Spy.Win32.TheRat.eu.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Spy.Win32.TheRat.eu.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:896
- C:\Users\Admin\AppData\Local\Temp\nsbA209.tmp\k2fl675x5el
  "C:\Users\Admin\AppData\Local\Temp\nsbA209.tmp\k2fl675x5el" x -pE19B1ABA748D76C5D6C7EB9A5F88E083235C6C7E4373F6CEF5C0B75BDC028164FBD63D028B8D901DB1AA19FA5B8B8D58 "C:\Users\Admin\AppData\Local\Temp\9hdn20x9i5bxhgfel.jpg" "-oC:\Users\Admin\AppData\Roaming"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:2604
- C:\Users\Admin\AppData\Local\Temp\cl3lt455q0oxde
  "C:\Users\Admin\AppData\Local\Temp\cl3lt455q0oxde" wait 10000
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:532
- C:\Users\Admin\AppData\Local\Temp\cl3lt455q0oxde
  "C:\Users\Admin\AppData\Local\Temp\cl3lt455q0oxde" shexec "" "C:\Users\Admin\AppData\Roaming\ehome\ehmsas.lnk"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4076
- - C:\Users\Admin\AppData\Roaming\ehome\ehmsas.exe
    "C:\Users\Admin\AppData\Roaming\ehome\ehmsas.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Loads dropped DLL
    - Adds Run key to start application
    - Enumerates video capture drivers
    - Reads the TCP/IP host and domain name from the registry
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:3380
  - - C:\Users\Admin\AppData\Roaming\ehome\x64\install64.exe
      C:\Users\Admin\AppData\Roaming\ehome\x64\install64.exe -r install C:\Users\Admin\AppData\Roaming\ehome\x64\TeamViewerVPN.inf teamviewervpn
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      Drops file in Windows directory
      Checks SCSI registry key(s)
      Suspicious use of AdjustPrivilegeToken
      PID:1004
  - - C:\Users\Admin\AppData\Roaming\ehome\x64\install64.exe
      C:\Users\Admin\AppData\Roaming\ehome\x64\install64.exe restart teamviewervpn
      4⤵
      Executes dropped EXE
      Checks SCSI registry key(s)
      Suspicious use of AdjustPrivilegeToken
      PID:5024
  - - C:\Users\Admin\AppData\Roaming\ehome\ehmsas.exe
      C:\Users\Admin\AppData\Roaming\ehome\ehmsas.exe
      4⤵
      Server Software Component: Terminal Services DLL
      Allows Network login with blank passwords
      Checks computer location settings
      Executes dropped EXE
      Loads dropped DLL
      Modifies WinLogon
      Drops file in System32 directory
      Enumerates video capture drivers
      Reads the TCP/IP host and domain name from the registry
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2604
    - - C:\Windows\System32\net.exe
        
        C:\Windows\System32\net.exe stop TermService /y
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:1592
      - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 stop TermService /y
        6⤵
        
        PID:3212
    - - C:\Windows\System32\netsh.exe
        
        C:\Windows\System32\netsh.exe advfirewall firewall add rule name="Remote Desktop" dir=in protocol=tcp localport=3389 profile=any action=allow
        5⤵
        Modifies Windows Firewall
        Event Triggered Execution: Netsh Helper DLL
        
        PID:3452
    - - C:\Windows\System32\sc.exe
        
        C:\Windows\System32\sc.exe config TermService start= auto
        5⤵
        Launches sc.exe
        
        PID:4684
    - - C:\Windows\System32\sc.exe
        
        C:\Windows\System32\sc.exe config DcomLauch start= auto
        5⤵
        Launches sc.exe
        
        PID:1940
    - - C:\Windows\System32\net.exe
        
        C:\Windows\System32\net.exe start TermService /y
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:3800
      - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 start TermService /y
        6⤵
        
        PID:4800
    - - C:\Windows\System32\takeown.exe
        
        C:\Windows\System32\takeown.exe /f C:\Windows\System32\utilman.exe
        5⤵
        Possible privilege escalation attempt
        Modifies file permissions
        Suspicious use of AdjustPrivilegeToken
        
        PID:4824
    - - C:\Windows\System32\icacls.exe
        
        C:\Windows\System32\icacls.exe C:\Windows\System32\utilman.exe /grant *S-1-5-32-544:F
        5⤵
        Possible privilege escalation attempt
        Modifies file permissions
        
        PID:676
    - - C:\Windows\System32\netsh.exe
        
        C:\Windows\System32\netsh.exe advfirewall firewall add rule name="Remote Desktop" dir=in protocol=tcp localport=3389 profile=any action=allow
        5⤵
        Modifies Windows Firewall
        Event Triggered Execution: Netsh Helper DLL
        
        PID:2652
    - - C:\Windows\System32\netsh.exe
        
        C:\Windows\System32\netsh.exe advfirewall firewall set rule name="File and Printer Sharing (NB-Session-In)" new enable=yes profile=any action=allow
        5⤵
        Modifies Windows Firewall
        Event Triggered Execution: Netsh Helper DLL
        
        PID:2128
    - - C:\Windows\System32\netsh.exe
        
        C:\Windows\System32\netsh.exe advfirewall firewall set rule name="File and Printer Sharing (NB-Session-Out)" new enable=yes profile=any action=allow
        5⤵
        Modifies Windows Firewall
        Event Triggered Execution: Netsh Helper DLL
        
        PID:3768
    - - C:\Windows\System32\netsh.exe
        
        C:\Windows\System32\netsh.exe advfirewall firewall set rule name="File and Printer Sharing (SMB-In)" new enable=yes profile=any action=allow
        5⤵
        Modifies Windows Firewall
        Event Triggered Execution: Netsh Helper DLL
        
        PID:1264
    - - C:\Windows\System32\netsh.exe
        
        C:\Windows\System32\netsh.exe advfirewall firewall set rule name="File and Printer Sharing (SMB-Out)" new enable=yes profile=any action=allow
        5⤵
        Modifies Windows Firewall
        Event Triggered Execution: Netsh Helper DLL
        
        PID:3904
    - - C:\Windows\System32\netsh.exe
        
        C:\Windows\System32\netsh.exe advfirewall firewall set rule name="File and Printer Sharing (NB-Name-In)" new enable=yes profile=any action=allow
        5⤵
        Modifies Windows Firewall
        Event Triggered Execution: Netsh Helper DLL
        
        PID:2932
    - - C:\Windows\System32\netsh.exe
        
        C:\Windows\System32\netsh.exe advfirewall firewall set rule name="File and Printer Sharing (NB-Name-Out)" new enable=yes profile=any action=allow
        5⤵
        Modifies Windows Firewall
        Event Triggered Execution: Netsh Helper DLL
        
        PID:1400
    - - C:\Windows\System32\netsh.exe
        
        C:\Windows\System32\netsh.exe advfirewall firewall set rule name="File and Printer Sharing (NB-Datagram-In)" new enable=yes profile=any action=allow
        5⤵
        Modifies Windows Firewall
        Event Triggered Execution: Netsh Helper DLL
        
        PID:3084
    - - C:\Windows\System32\netsh.exe
        
        C:\Windows\System32\netsh.exe advfirewall firewall set rule name="File and Printer Sharing (NB-Datagram-Out)" new enable=yes profile=any action=allow
        5⤵
        Modifies Windows Firewall
        Event Triggered Execution: Netsh Helper DLL
        
        PID:3268
    - - C:\Windows\System32\netsh.exe
        
        C:\Windows\System32\netsh.exe advfirewall firewall set rule name="File and Printer Sharing (Spooler Service - RPC)" new enable=yes profile=any action=allow
        5⤵
        Modifies Windows Firewall
        Event Triggered Execution: Netsh Helper DLL
        
        PID:1764
    - - C:\Windows\System32\netsh.exe
        
        C:\Windows\System32\netsh.exe advfirewall firewall set rule name="File and Printer Sharing (Spooler Service - RPC-EPMAP)" new enable=yes profile=any action=allow
        5⤵
        Modifies Windows Firewall
        Event Triggered Execution: Netsh Helper DLL
        
        PID:3476
    - - C:\Windows\System32\netsh.exe
        
        C:\Windows\System32\netsh.exe advfirewall firewall set rule name="File and Printer Sharing (Echo Request - ICMPv4-In)" new enable=yes profile=any action=allow
        5⤵
        Modifies Windows Firewall
        Event Triggered Execution: Netsh Helper DLL
        
        PID:2688
    - - C:\Windows\System32\netsh.exe
        
        C:\Windows\System32\netsh.exe advfirewall firewall set rule name="File and Printer Sharing (Echo Request - ICMPv4-Out)" new enable=yes profile=any action=allow
        5⤵
        Modifies Windows Firewall
        Event Triggered Execution: Netsh Helper DLL
        
        PID:2664

C:\Users\Admin\AppData\Roaming\ehome\ehmsas.exe
C:\Users\Admin\AppData\Roaming\ehome\ehmsas.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1396

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall
1⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4692
- C:\Windows\system32\DrvInst.exe
  DrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{4763445f-abc1-0044-a2e3-685b51eaca4b}\teamviewervpn.inf" "9" "4b0706d3f" "000000000000014C" "WinSta0\Default" "000000000000015C" "208" "c:\users\admin\appdata\roaming\ehome\x64"
  2⤵
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Checks SCSI registry key(s)
  - Modifies data under HKEY_USERS
  PID:3256
- C:\Windows\system32\DrvInst.exe
  DrvInst.exe "2" "211" "ROOT\NET\0000" "C:\Windows\INF\oem3.inf" "oem3.inf:3beb73aff103cc24:teamviewervpn.ndi:2.10.0.0:teamviewervpn," "4b0706d3f" "000000000000014C"
  2⤵
  - Drops file in Drivers directory
  - Drops file in Windows directory
  - Checks SCSI registry key(s)
  - Suspicious use of AdjustPrivilegeToken
  PID:1448

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -s TermService
1⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:3220

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Server Software Component

T1505

Terminal Services DLL

T1505.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

File and Directory Permissions Modification

T1222

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Network Share Discovery

T1135

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Remote Services

T1021

Remote Desktop Protocol

T1021.001

Collection

Data from Local System

T1005

Video Capture

T1125

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

9hdn20x9i5bxhgfel.jpg

Path C:\Users\Admin\AppData\Local\Temp\9hdn20x9i5bxhgfel.jpg
Size 2.7MB
SHA256 e789fe6e2b98e75de8464503ce4b53455e3cf43b824b8bab3e3ef6205fb5ee4e
MD5 1371a444460758a5d3a4f1612d54c45a
SHA1 4481c2298c6935f3ac106d91c92a1c5c56c69fa5
SHA512 7051c61442707869ccfe69ae6d044f0d17660ccac4f3743cf007bbe475748a44d807825222305c2d856a373f8c281869b1eab1ddddefe6b4c29f3bd8dea42ac2
SSDEEP 49152:ymXwFhUjzF801eAhtx4+hwXoS/cPk+WSitAvpH/m9WXg:/gjQF9YAhtxS4S/h0phXg
TLSH
T11AD533D0479C25D78A326BF7367D1E5EBEC3226300611427AB89D4695D8F8BFB09306E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cl3lt455q0oxde

Path C:\Users\Admin\AppData\Local\Temp\cl3lt455q0oxde
Size 43KB
SHA256 31b3b228382dc359f22ae97b2602eee81dc743fb21196061eacc6619533881f5
MD5 84d499f558570c32f4cb100a9124890b
SHA1 9adfc7ab66348d84ebdd9c1e8093cad4cc8485ef
SHA512 560aaadebcbd425d35fc3a567c987a5f15a5f091962328f0479c1ec2378c732cca892eb3252179c8895413b0f3d08f44fbcf8c9d2375877c81622f42e6549c86
SSDEEP 768:e4OBw5XDtS0d0xr6xczY6jU19q2T5D8EZdZzaJqn:+wtDtS0yV6B6A19FTiEZXaJqn
TLSH
T13313F115B370A129F9D391F5209A216543DCB12C587E87F73CF070D3ACF65A2BA9B212
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Crypto.dll

Path C:\Users\Admin\AppData\Local\Temp\nsbA209.tmp\Crypto.dll
Size 3KB
SHA256 b7b819dcf3aaed2774cecfa507f9baee47660b18758f7cb718bb5cb2d77947fa
MD5 5fc727c579f3c3b69ce0eb7f2ec7d48a
SHA1 4686ade71a45feb36f5f5f48e78bd673f60e45b5
SHA512 b407eb19db8967fc7eeea8d5576cbb909c89195a0ae2f2382b79ecc13f04d984ec46d014b7f8e2124c8fe6088097cdc8203e4258cdd36a38db94c7cb4a929fd0
TLSH
T1DF718343B5B02BFFC4E911705D91C82716E9E3502B1E9B3FDC0B644D7884BB15535E1A
MD5 SHA1 SHA512 TLSH

Submit Download

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nsbA209.tmp\System.dll
Size 11KB
SHA256 904fd5481d72f4e03b01a455f848dedd095d0fb17e33608e0d849f5196fb6ff8
MD5 55a26d7800446f1373056064c64c3ce8
SHA1 80256857e9a0a9c8897923b717f3435295a76002
SHA512 04b8ab7a85c26f188c0a06f524488d6f2ac2884bf107c860c82e94ae12c3859f825133d78338fd2b594dfc48f7dc9888ae76fee786c6252a5c77c88755128a5b
SSDEEP 192:MPtkumJX7zBE2kGwfy9S9VkPsFQ1Mx1c:97O2k5q9wA1Mxa
TLSH
T1F2324C15031086F3E1D2853D682B39AB2FB969118AF04E438FB35952EE347C7AD79352
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

k2fl675x5el

Path C:\Users\Admin\AppData\Local\Temp\nsbA209.tmp\k2fl675x5el
Size 637KB
SHA256 e0e2c7d0f740fe2a4e8658ce54dfb6eb3c47c37fe90a44a839e560c685f1f1fa
MD5 e3c061fa0450056e30285fd44a74cd2a
SHA1 8c7659e6ee9fe5ead17cae2969d3148730be509b
SHA512 fe7796b4c5aa07c40aa2511a987fed59366d3c27bf7343f126f06cb937bfe7a7d8bd6cd785a7e3dc9087b99973e8542b6da7be6eed4585bd3cee13164aed79b4
SSDEEP 12288:MCEg6ksPgamGycPycplunzCke+tMU0gKVDrnI/Anky3ZDH:MCCks4ECO8zfeJ3rnI/A93F
TLSH
T135D48E1236F6C0BED2720131CA1DABF591FBE7190B2548C36780CE1D2B799D5CA3AA5D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsExec.dll

Path C:\Users\Admin\AppData\Local\Temp\nsbA209.tmp\nsExec.dll
Size 6KB
SHA256 c2c88e4a32c734b0cb4ae507c1a9a1b417a2375079111fb1b35fab23aedd41d9
MD5 b38561661a7164e3bbb04edc3718fe89
SHA1 f13c873c8db121ba21244b1e9a457204360d543f
SHA512 fedcaac20722de3519382011ccf22314af3edcd11b69f814db14710966853b69b9b5fc98383edcdb64d050ff825264eaba27b1c5adfe61d1fc9d77f13a052ced
SSDEEP 96:f7GUxNkO6GR0t9GKKr1Zd8NHYVVHp4dEeY3kRnHdMqqyVgNPS3e:zXhHR0aTQN4gRHdMqJVgNPR
TLSH
T11ED1F97675E22EB3C54ECE353C527A2B57F8C8111B9401549B978BD23CC5EB3EA39282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

uulqllf69et5

Path C:\Users\Admin\AppData\Local\Temp\uulqllf69et5
Size 178B
SHA256 4947127aad44a160c610bc8c6246973943eb838ffb609d1e79ff1ef7512adbad
MD5 d9552c506d91c05d197bbdf5bc427859
SHA1 7115616ad1c44ddcca2f8a5bb8dab1961f1954b2
SHA512 a54ceb9e6549ee773405365ef659703e1ddf1b1363e41c8f8a2832c999db5b3c12836c62241e94b59caa3b6ef288f3996424c67026276ebc12312f58463e5873
TLSH
T152C08CF2548438A2DAC483A940D2E0E03A2B7D3C40EE9B38322322027D610044A0723A
MD5 SHA1 SHA512 TLSH

Submit Download

SETE183.tmp

Path C:\Users\Admin\AppData\Local\Temp\{4763445f-abc1-0044-a2e3-685b51eaca4b}\SETE183.tmp
Size 34KB
SHA256 b8e555d92440bf93e3b55a66e27cef936477ef7528f870d3b78bd3b294a05cc0
MD5 f5520dbb47c60ee83024b38720abda24
SHA1 bc355c14a2b22712b91ff43cd4e046489a91cae5
SHA512 3c5bb212467d932f5eaa17a2346ef8f401a49760c9c6c89c6318a1313fcbabb1d43b1054692c01738ea6a3648cc57e06845b81becb3069f478d5b1a7cbcb0e66
SSDEEP 768:/a/ZSDKMhnknetMdlHJRXz0yjSDomtN6l5cJQGftSSXakqEqLXb9:C/ZWnkn0uTRXz00Ss1m1YvEq/9
TLSH
T114F25C87676404E5ECA3AB70D5F3C326DFB1F4211B61A1CF5170925A2E0BBE86A7C319
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

545d80

Path C:\Users\Admin\AppData\Roaming\ehome\545d80
Size 45KB
SHA256 38a5ffb91c9ce283316d61ee8f4ed7042e2c9007a17c67d96f0b2998e835cc4f
MD5 2618252c2d137d3c9d24e053f187506d
SHA1 66ca100c89aa50efc9c4a70beae3f2a5606c9e36
SHA512 89c632882115866ab4c501b7ef1c9060dbc4941a515594f26b0b7e344db9cfe953e645959c96cdb8efe3ab110f29dce756b0f9f568accc174b94c5af96a0ee21
SSDEEP 768:XFqLptnmBBbBEk4vg0ewq7m1NvSk/wO8s6xoQRkgqyvhTn:yLnQpOjq7mjKk/nSrRkgqyx
TLSH
T1A523E03172954E25CB60A4B04ABF8F772F7DB10F603E8F4B0FAF515A6D98DA09911A81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TeamViewer_Desktop.exe

Path C:\Users\Admin\AppData\Roaming\ehome\TeamViewer_Desktop.exe
Size 2.1MB
SHA256 9fe4685f1d76b3c0ff80e2b9348d5f1b5a7856d472ae4be4b0fe9d9c08d32669
MD5 95b5331ae88259d3a9dda90f2a29905c
SHA1 3df3d52c6fc9e1811954a0b66c0e29f52f844a8e
SHA512 e9e67334758f2261131310b1ecf9dd9f6d70a123b3519110ec781d3dd26b7832734cee45c6643809b741d74b0c9d9f3b3abddefb427a4d691a31a9cef81848db
SSDEEP 24576:MnRPeCeNPMRei86k0mseV9/N74g9VdX06wDkf+nNfHCQ2ugW51xoIdVfeSJp1zSA:KWBL0WNsg9VdX0/P2uL7oITfxEJWc1Y
TLSH
T1ABA56B213BE9C23ADC6F22B0461D81AD60B9F4557A71D14FBBC4CF0D3B70D929629B62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TeamViewer_Resource_en.dll

Path C:\Users\Admin\AppData\Roaming\ehome\TeamViewer_Resource_en.dll
Size 1.2MB
SHA256 a40088e36440f9de74bbd2d6e5cf969ab42ff629cea6d685cc9d8300b91b5028
MD5 97878dceaf0632f49b75601e998c53e1
SHA1 ee60be147721e2c4ef5d7d6860fce8645b2088e6
SHA512 9691057e6f0aefeac2c4275c278ac8cbe5ac95d820bd92b2e65c0d8aee6768241b4832b31db7df2e0b203c77b2c486662bdd31c66892b84bb2a49edabda9abf7
SSDEEP 12288:Xhmfaa/lRMxerSaye0dHVGFlSyhUcTm8i1aWjD9TQN:RmfnJrSayGF6VsN
TLSH
T1AB4592A057F4C5A5F6B72A30FC3961F1096E7C82C975812F3142BE5E35B0AD049B8B6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ehmsas.exe

Path C:\Users\Admin\AppData\Roaming\ehome\ehmsas.exe
Size 7.0MB
SHA256 5c80b0ced982b868d7e2ba6269509f597a05704fa6d86a30e8d51bf5687c3361
MD5 28c4c35aed7949277a9c68a04a113114
SHA1 2a845df5253b3f5becb9c83527c9bfd3113be092
SHA512 ed4ca23c7efd4fbf39ae50dc14020aead7d515e27b002aa2dd7a5417ba63c550d19120f84ef7058147035dfbc55f937debbde61bcd1af2e2070ae6b04b786618
SSDEEP 196608:Geyu0aUoyhWLIFMUu3iIbQmzVcfHWWlIx:Gey9WUFMUu3iEBx
TLSH
T1ED769D213685C33AE1BE12B157AE515641FD7AA45870C64BFF94CF2E3FB0682B035E92
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ehmsas.lnk

Path C:\Users\Admin\AppData\Roaming\ehome\ehmsas.lnk
Size 894B
SHA256 41d553e91c8786e4cf35acc4b846caba5d96aadafbad271e25596ffc24cbe204
MD5 2a23780e44fdd34cb16e0c7779afd52d
SHA1 58cc78883d95a8457b806707045f10a4ad4e3d75
SHA512 a51880284ef3cc8224f5f50d14fc37553eb82eb9719f2768fab1a01612354224d453ce900377946d8c69bff4410aade4ca555d55477dee17413876b1e90210a3
TLSH
T17B1125605BCF4F24D07B48F60AFA17189B39B825DF02524C5780E9040C90223951C326
MD5 SHA1 SHA512 TLSH

Submit Download

hn65mvz063tghuli1.jpg

Path C:\Users\Admin\AppData\Roaming\ehome\hn65mvz063tghuli1.jpg
Size 8KB
SHA256 fe8fd071b3c574f41c42568283d92f541b25cf7812f1c4408943df04c45a649f
MD5 2972ee2bc8c363c69c0e3f9a8c36e96f
SHA1 99f60f7a0657ffc64ff3c87f3f608cad1602df08
SHA512 31419072a6be0139f8e76a9b03d5f89dac1d890570ae0f57992f61be9091a21dfdaf3b1733ca0c9fd4df025cf53a037b8db31bbb11b3975056d90b80544e50df
SSDEEP 192:2AZXkZEs2plOI7mMQav1AvycGU5pfb1wt6nUKttcoEia6QH:2AZXuEs2plOIWKAa85NKMnzWozoH
TLSH
T1CA02BF1FAD0EE50AC442C1376171D25CD3DA7F2C92A24599C97512362EAC5BE303D7FA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

installvpn.pg

Path C:\Users\Admin\AppData\Roaming\ehome\installvpn.pg
Size 3KB
SHA256 36c60f63fb12f9df18afb3e255b44d96ead54c9d48dcb4638e12b1a54475d0c2
MD5 1dbcbc0aeefbef5a941ecee7568bb7d1
SHA1 9061ff9830499ccd2df0d20afd73373f766659de
SHA512 3b0adc6e7adac47e217f5a77bdbb35e2f633b47e661598163f6b1832e05ce064c8b7bff10710f13fd771673aff3cf7da804508fb5a72e28a8b50d28a43e54e91
TLSH
T199715CE2BAC73C5AE3F50B50D9361A212AA02F9B06B96BBD1A0126D263E901C70FC545
MD5 SHA1 SHA512 TLSH

Submit Download

rdw.pg

Path C:\Users\Admin\AppData\Roaming\ehome\rdw.pg
Size 406KB
SHA256 d9a301684e39a64c68f8a17374bf67acdc98fd17e7be79b610eda0ac09446e2e
MD5 1b8ca0bc04d94d0bf2fbc128d49a3c44
SHA1 34512c7376ac65ace1693b8fe5833c9f6672eb1b
SHA512 c23334942a5d1ea5ef6575a77d6bd8e813d1ef165ffdb246a1970cbb6f42bb6b80851c40ffa4d00093a5470e74b0555c458c5f209a6987fae7a632e6d653a475
SSDEEP 12288:9rcrIaVjAaCt/NqJW8iikv8c8IHRuJS/kTs:NcrIijJ6/AJrixv8c8IHRGs
TLSH
T1BA94235C9670793AD87E0B9962F4B0D6933574B0A2CCBD1ABF0C6AD5EFC040CAC954D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

scankey.pg

Path C:\Users\Admin\AppData\Roaming\ehome\scankey.pg
Size 2KB
SHA256 7fd3d650ffea9a2c4bb43770985a39d393d100c01569fd06fa67ff45f6403566
MD5 b65ee713a834f3e0712cc5d0f494f8cc
SHA1 231ce0ffd58502dca27eaa5653d07b7cfda76b36
SHA512 bd60aa037901fe5b721d3637037b7aa5a01522912683c0274a16665c66f99cae01ed59cdc7f8a78b1674a1fd08f759f9c6edec3bc4b61b3ea6bf2f9f3e5e4be7
TLSH
T11A4128B280782CC36BE01C86B9CA240261D1EAA4246753ECFD27123728C66AB03A34D2
MD5 SHA1 SHA512 TLSH

Submit Download

tv.cfg

Path C:\Users\Admin\AppData\Roaming\ehome\tv.cfg
Size 916B
SHA256 b5d637b8e847a2536cdb73e1aa2cfa81b55cc368504c2ac07fee341168e1b253
MD5 e3200b900cd6cde4fe679ae84fba3eb3
SHA1 f715d411368bb1da02e41a8ae2bf07fbfb545b8c
SHA512 aa535be89d49b0f39d5391cb398d42d43cc8663031f759c4b3c0aace643e34ab32f43e6bfde87a77b483d5ec449b3e01afe00d2babde99364472250bff3c5a58
TLSH
T1A311B796422EDE589297EE2407F30F0625007A44A00ECF277A7CA6F63739994C412F9D
MD5 SHA1 SHA512 TLSH

Submit Download

tv_w32.dll

Path C:\Users\Admin\AppData\Roaming\ehome\tv_w32.dll
Size 49KB
SHA256 d2b39bcf9ca3888887fb84a0897fcb80dccacc5ccfb5a66357e3dbdcafee3904
MD5 d1cae98656bc6703e21f4580b8830dfc
SHA1 d0c1f9219380ae73c5b151e5c7afa9e11c07bd97
SHA512 1270c00a01be2d8e27dc31a3e355eee8e5f56330674ec9776e2a5c6ba7990c3a4d4eccc501675e83e4baed977ea94dde2c857f63400564b85a27a94910d07cae
SSDEEP 768:gnbNOCWYFawkf5soDYunk220HOtUM3CCyV/QiFp82sk51aI:sBSsunocCUD1V/j5sk51R
TLSH
T1C6334C5241ABD936E5921538186F5DA52D72E9D64B30B3C7E2273746ECB83C32D39233
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tv_w32.exe

Path C:\Users\Admin\AppData\Roaming\ehome\tv_w32.exe
Size 106KB
SHA256 c96ed3b60727973d746834eaec3df520447a039dc447f717f6cd32335e2dc1d0
MD5 7d90bdf0f9c2d9224d8b4d5d2f195506
SHA1 aa1bef60878b8c43c6fd763a0bf83b65a488ba81
SHA512 4b08e6b4da089d46ce806baa1c3896d46bf9aa3598141502c3dd62683d97a50e560e48c1060bde0e959b3e33f05b1fc43056cf99b2252a9a1a0099294bd6a5b6
SSDEEP 1536:NaooQTXvqXtkFFCN3bzLqFu0azJPPY08MPMyY/eetFDiCc3NwGzpo1+4soahtemi:NaoD2Prpozahtem3y
TLSH
T17AB39E12B1D0C472D55382724CA6CB77E737F9258B3985C7BBAC06999F243E0A63B247
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tv_x64.dll

Path C:\Users\Admin\AppData\Roaming\ehome\tv_x64.dll
Size 52KB
SHA256 a21dafab3d25f88d7001de9437f0a01c72d66db0c1a190dd5acdb2cc38ea9513
MD5 dcd8cda46bb20ff09c8c8be8be2f3098
SHA1 f39483343c5f95011131048cc0326ab1d034ef29
SHA512 9d28691f3532f8126429940623872503560c3244d111b64d3e598e08d961f8bb05efc87247d5f78b288506d8e77e08a9ce20c76cc8ac14b28a84d26f2d8f8565
SSDEEP 768:dsbXkYJwW1DSveW1oI8iGkDDTn/Azi5uQotGbxJYQflr61TYU:dsbnJj1OvDv/0zdtGbffguU
TLSH
T148335B6596D244B2D677963AD8B20A2688B0F851473072CF4071A364DF733D3BA7EB4B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tv_x64.exe

Path C:\Users\Admin\AppData\Roaming\ehome\tv_x64.exe
Size 141KB
SHA256 7a487c2cba93e7d6963930c5734f14d6cf17e85fc2316d6aeccd617100a1ff9f
MD5 e0331b54a56e7aa48f97b4956bcef769
SHA1 2907cf777d6cf92656c8de211093751e12ddf9c4
SHA512 dc423898519ac48ca0b12e72076e7e9441e35f0fbc409af95b90288f3fefe23a2cd4a4b9c83e1a3dc123b0fcd2ea4f8ca981bb667be56be2cdcf8ad4df047aaf
SSDEEP 3072:VWINt2c3+Iiq7oaXVb17FXLxKuiYsS/iYgWxYYYTOw4wOBLWT1vFO:VZ+IixaXVb17FRVn6Y9uYYaBkThQ
TLSH
T1F5E34B4BB26940F9E0A6C27E86D24716E371B419573563CB17248B560F27BD0EE3EB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TeamViewerVPN.inf

Path C:\Users\Admin\AppData\Roaming\ehome\x64\TeamViewerVPN.inf
Size 5KB
SHA256 a817b0e8a669d5acaf2ddfbc95acf2a1213b092b44dc896a0ee4a5301d06ebc3
MD5 447fc733747db11cd4492ae01c5652fe
SHA1 2a70dcd391464cb8d3736322e07e966e105d396e
SHA512 238099db072af55445d421e941944abe8a6f52a124a26cae84c1dd52fffafc4dac5586d0c7407b461cd0db8e771e1dbb6ca34aee84581b24347f401410b2afe5
SSDEEP 96:s2iQJD2WlsdGebjR+iAz4C7bZ7xpRStQ2rtu3DcNSjXKjvKY8ks7nuwfQTXv/zof:FiQQWlsdGebjR+iAUC7bpR6o3DcNSj6e
TLSH
T1FBB1C7504C83BE3836FFE5015A514ECEE1D5214275AA2802B65DB890BFBCD8FF72D929
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

install64.exe

Path C:\Users\Admin\AppData\Roaming\ehome\x64\install64.exe
Size 79KB
SHA256 f627380e9de14af3eb5331bb9a4d559b2c970abacff038ea464044ca1ef62163
MD5 112b0c8b6b0c0a6c24f90081cc8a77d0
SHA1 1776a73316baeeb818884196a54f49d1385c06c8
SHA512 1552b267931004d8936058f5cac49dc618eae2224ea3b082f1d899cd1b2c1cb7eaa98ac7653740fd07b2df40abbdd2d6318a9bed8794bb7a8872e379a50ef585
SSDEEP 768:3p+EGTIX/CfbpGTO0ePDMGRPqIXvqFT8eRS2r3lvip+82BSOe9oKSJ2SLD0BEZWk:3ge/CfbcTODD1nXiN3Rxr3lap+F4O7W
TLSH
T14583830263E94609F1F77A346AB652211EB77C959E3CC68D0298911D1FF3E90CC79BA3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

teamviewervpn.cat

Path \??\c:\users\admin\appdata\roaming\ehome\x64\teamviewervpn.cat
Size 10KB
SHA256 aa7c09a817eb54e3cc5c342454608364a679e231824f83ba5a2d0278edcc1851
MD5 5cffe65f36b60bc151486c90382f1627
SHA1 f2a66eae89b4b19d4cab2ac630536af5eeeef121
SHA512 1bd48ef66f8714e7e9591043d03bd69a30881ed3d0f2463b15750a3282df667ffb076b3a92358eecedae0e54485b07d702667e8fe0af64c52be04db47145920b
SSDEEP 192:H64PyG0o6orbfUG3afdjIafdjShjFivhE:jnrbVafdjIafdjcjFiJE
TLSH
T16522F8C28A2C8587FD476DE113A8FD837C79EBC718418D3E219AF6D808837D9A70881C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rdpwrap.dll

Path \??\c:\windows\system32\rdpwrap.dll
Size 114KB
SHA256 798af20db39280f90a1d35f2ac2c1d62124d1f5218a2a0fa29d87a13340bd3e4
MD5 461ade40b800ae80a40985594e1ac236
SHA1 b3892eef846c044a2b0785d54a432b3e93a968c8
SHA512 421f9060c4b61fa6f4074508602a2639209032fd5df5bfc702a159e3bad5479684ccb3f6e02f3e38fb8db53839cf3f41fe58a3acad6ec1199a48dc333b2d8a26
SSDEEP 3072:m3zxbyHM+TstVfFyov7je9LBMMmMJDOvYYVs:oMjTiVw2ve9LBMMpJsT
TLSH
T14EB35B4773A100BBD4A7D638CDA34A12D77A78864771AB4E1790459A9F337E09E3CB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rdpwrap.ini

Path \??\c:\windows\system32\rdpwrap.ini
Size 27KB
SHA256 db1d30ec1fcec8186b0ec01b8a2984244b3393dd7883be442d983aa4cbf29814
MD5 398be25b8f112ffcb06c8fed2cd23cfc
SHA1 5b159798d57e5e302a2970e9bf1f7b8c95516655
SHA512 b26f1c90ce79bd62c4198d7d2bf42fb2e3ee70f3093f167bfdebe705c0f7b83c1563b135accbfa329a888110f5c43ee69491469fcae5e643abe2706b585bb371
SSDEEP 768:IUbQVQv5UfUqQ2px8Rr/d6gl/+f8jZ0fdW/C:3C
TLSH
T154C27918A089977E1C0BE532E63107B7E7FDBD586E507304BD681B5A7B8E2483B2961C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/532-90-0x0000000000400000-0x000000000041B000-memory.dmp

Download

memory/532-89-0x0000000000400000-0x000000000041B000-memory.dmp

Download

memory/1396-127-0x0000000007000000-0x0000000007010000-memory.dmp

Download

memory/2604-232-0x0000000006560000-0x0000000006563000-memory.dmp

Download

memory/2604-229-0x0000000004270000-0x0000000004297000-memory.dmp

Download

memory/2604-244-0x0000000007000000-0x0000000007010000-memory.dmp

Download

memory/2604-230-0x0000000006550000-0x0000000006553000-memory.dmp

Download

memory/2604-234-0x0000000006560000-0x0000000006563000-memory.dmp

Download

memory/2604-224-0x0000000007000000-0x0000000007010000-memory.dmp

Download

memory/2604-235-0x0000000006A40000-0x0000000006AAB000-memory.dmp

Download

memory/3380-123-0x00000000043B0000-0x00000000043D7000-memory.dmp

Download

memory/3380-225-0x0000000007000000-0x0000000007010000-memory.dmp

Download

memory/3380-103-0x0000000007000000-0x0000000007010000-memory.dmp

Download

memory/3380-141-0x0000000006420000-0x0000000006423000-memory.dmp

Download

memory/3380-132-0x0000000006410000-0x0000000006413000-memory.dmp

Download

memory/3380-106-0x0000000007000000-0x0000000007010000-memory.dmp

Download

memory/3380-134-0x0000000006470000-0x00000000064DB000-memory.dmp

Download

memory/3380-139-0x0000000006420000-0x0000000006423000-memory.dmp

Download