5c672c9a12b69b75b2cf25710bac8c579b3ef7ed1a907930dc0d7e20eab7584d

Analysis

user interaction
yes
max time kernel
119s
max time network
115s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/10/2026, 10:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
hamachi.msi
Size 14.1MB
Sample261024-ml26naeg58
SHA256 5c672c9a12b69b75b2cf25710bac8c579b3ef7ed1a907930dc0d7e20eab7584d
MD5 10a97df0c3683bfa90735fb289623591
SHA1 dd43515ddcdc8b94f440f047be3518d3d007be2c
SHA512 0e085163aa70281599f38c170e23f8d2f14501658e2d68b51a9110aedfa833065b7e3f9c2ff1f46bfa46bc70e3d404b7a7f1f9e8638cb0132edcadcdbdd55e5e
SSDEEP 393216:A/wOCz9pcjycZXoK+tSbtUtMfevXD7U9ZvzB0WPEpK/dLze7f:A9CgjycZYf+tihTo9z0WcE1C
TLSH
T167E6120ABA039A72D6DFBD7921977BBD18281F1C57E484C3C7A0757A8C315E8AD3B244
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

adware discovery persistence privilege_escalation ransomware spyware

Malware Config

Signatures

Drops file in Drivers directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\DRIVERS\SET8E5B.tmp	hamachi-2.exe
File created	C:\Windows\system32\DRIVERS\SET8E5B.tmp	hamachi-2.exe
File opened for modification	C:\Windows\system32\DRIVERS\Hamdrv.sys	hamachi-2.exe
File opened for modification	C:\Windows\System32\drivers\Hamdrv.sys	DrvInst.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\LogMeIn Hamachi Ui = "\"C:\\Program Files (x86)\\LogMeIn Hamachi\\hamachi-2-ui.exe\" --auto-start"	msiexec.exe

Badlisted process makes network request 2 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
2	1032	msiexec.exe
2	1032	msiexec.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe

Drops file in System32 directory 27 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\hamdrv.inf_amd64_c59072ec40c0c372\Hamdrv.sys	DrvInst.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB	LMIGuardianSvc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_325DC716E4289E0AE281439314ED4BFA	LMIGuardianSvc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3E3E9689537B6B136ECF210088069D55_EF6C9357BB54DDB629FD2D79F1594F95	LMIGuardianSvc.exe
File created	C:\Windows\System32\DriverStore\Temp\{4a54744d-75f0-734b-9cfe-395e04fd755c}\SET8F07.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{4a54744d-75f0-734b-9cfe-395e04fd755c}\SET8F08.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{4a54744d-75f0-734b-9cfe-395e04fd755c}\SET8F08.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{4a54744d-75f0-734b-9cfe-395e04fd755c}\hamdrv.cat	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\hamdrv.inf_amd64_c59072ec40c0c372.ini	DrvInst.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_325DC716E4289E0AE281439314ED4BFA	LMIGuardianSvc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_56DB209C155B5A05FCBF555DF7E6D1BB	LMIGuardianSvc.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{4a54744d-75f0-734b-9cfe-395e04fd755c}\SET8F07.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{4a54744d-75f0-734b-9cfe-395e04fd755c}\SET8F09.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\hamdrv.inf_amd64_c59072ec40c0c372\hamdrv.cat	DrvInst.exe
File created	C:\Windows\System32\DriverStore\FileRepository\hamdrv.inf_amd64_c59072ec40c0c372\hamdrv.PNF	hamachi-2.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB	LMIGuardianSvc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141	LMIGuardianSvc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C8E534EE129F27D55460CE17FD628216_56DB209C155B5A05FCBF555DF7E6D1BB	LMIGuardianSvc.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{4a54744d-75f0-734b-9cfe-395e04fd755c}\Hamdrv.sys	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{4a54744d-75f0-734b-9cfe-395e04fd755c}\SET8F09.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\hamdrv.inf_amd64_c59072ec40c0c372\hamdrv.inf	DrvInst.exe
File opened for modification	C:\Windows\System32\CatRoot2\dberr.txt	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{4a54744d-75f0-734b-9cfe-395e04fd755c}	DrvInst.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141	LMIGuardianSvc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3E3E9689537B6B136ECF210088069D55_EF6C9357BB54DDB629FD2D79F1594F95	LMIGuardianSvc.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{4a54744d-75f0-734b-9cfe-395e04fd755c}\hamdrv.inf	DrvInst.exe
File created	C:\Windows\System32\DriverStore\drvstore.tmp	DrvInst.exe

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Drops file in Program Files directory 16 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\LogMeIn Hamachi\x64\LMIGuardianDll.dll	msiexec.exe
File created	C:\Program Files (x86)\LogMeIn Hamachi\x64\LMIGuardianEvt.Dll	msiexec.exe
File created	C:\Program Files (x86)\LogMeIn Hamachi\x64\hamdrv.sys	msiexec.exe
File created	C:\Program Files (x86)\LogMeIn Hamachi\x64\hamdrv.inf	msiexec.exe
File created	C:\Program Files (x86)\LogMeIn Hamachi\x64\LMIGuardianSvc.exe	msiexec.exe
File created	C:\Program Files (x86)\LogMeIn Hamachi\hamachi.lng	msiexec.exe
File created	C:\Program Files (x86)\LogMeIn Hamachi\LMIGuardianDll.dll	msiexec.exe
File created	C:\Program Files (x86)\LogMeIn Hamachi\x64\hamachi.inf	msiexec.exe
File created	C:\Program Files (x86)\LogMeIn Hamachi\x64\hamachi.cat	msiexec.exe
File created	C:\Program Files (x86)\LogMeIn Hamachi\LMIGuardianSvc.exe	msiexec.exe
File created	C:\Program Files (x86)\LogMeIn Hamachi\LMIGuardianEvt.Dll	msiexec.exe
File created	C:\Program Files (x86)\LogMeIn Hamachi\x64\hamachi.sys	msiexec.exe
File created	C:\Program Files (x86)\LogMeIn Hamachi\x64\hamdrv.cat	msiexec.exe
File created	C:\Program Files (x86)\LogMeIn Hamachi\x64\hamachi-2.exe	msiexec.exe
File created	C:\Program Files (x86)\LogMeIn Hamachi\ReleaseNotes.rtf	msiexec.exe
File created	C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2-ui.exe	msiexec.exe

Drops file in Windows directory 51 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\MSI857B.tmp	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File opened for modification	C:\Windows\Installer\MSIC508.tmp	msiexec.exe
File opened for modification	C:\Windows\ServiceProfiles\LocalService\AppData\Local\LogMeIn Hamachi\h2-engine.log	hamachi-2.exe
File created	C:\Windows\ServiceProfiles\LocalService\AppData\Local\LogMeIn Hamachi\h2-engine.cfg	hamachi-2.exe
File created	C:\Windows\ServiceProfiles\LocalService\AppData\Local\LogMeIn Hamachi\h2-engine.cfg.bak	hamachi-2.exe
File created	C:\Windows\ServiceProfiles\LocalService\AppData\Local\LogMeIn Hamachi\h2-engine.ini.updating	hamachi-2.exe
File created	C:\Windows\ServiceProfiles\LocalService\AppData\Local\LogMeIn Hamachi\h2-engine.ini	hamachi-2.exe
File opened for modification	C:\Windows\ServiceProfiles\LocalService\AppData\Local\LogMeIn Hamachi\h2-engine.cfg	hamachi-2.exe
File created	C:\Windows\SystemTemp\~DF81D1D8E26F5C8E77.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI7640.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIC528.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI798F.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI7F1E.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI7F6D.tmp	msiexec.exe
File created	C:\Windows\ServiceProfiles\LocalService\AppData\Local\LogMeIn Hamachi\h2-engine.id.bak	hamachi-2.exe
File created	C:\Windows\ServiceProfiles\LocalService\AppData\Local\LogMeIn Hamachi\h2-server.key	hamachi-2.exe
File opened for modification	C:\Windows\ServiceProfiles\LocalService\AppData\Local\LogMeIn Hamachi\h2-engine.cfg.bak	hamachi-2.exe
File created	C:\Windows\Installer\e597286.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI78F2.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DFB4974D7497840081.TMP	msiexec.exe
File created	C:\Windows\Installer\{3217B6C1-7F42-424A-B5FB-BB61FE3BEFE5}\UninstallIcon.ico	msiexec.exe
File created	C:\Windows\ServiceProfiles\LocalService\AppData\Local\LogMeIn Hamachi\h2-engine.id	hamachi-2.exe
File created	C:\Windows\ServiceProfiles\LocalService\AppData\Local\LogMeIn Hamachi\h2-client.key	hamachi-2.exe
File created	C:\Windows\SystemTemp\~DF5EBB8D7B5D6B73D3.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI84FD.tmp	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	hamachi-2.exe
File created	C:\Windows\inf\oem1.inf	DrvInst.exe
File opened for modification	C:\Windows\Installer\MSIBA38.tmp	msiexec.exe
File opened for modification	C:\Windows\ServiceProfiles\LocalService\AppData\Local\LogMeIn Hamachi\h2-engine.cfg.updating	hamachi-2.exe
File created	C:\Windows\ServiceProfiles\LocalService\AppData\Local\LogMeIn Hamachi\h2-engine.ini.bak	hamachi-2.exe
File opened for modification	C:\Windows\Installer\e597286.msi	msiexec.exe
File created	C:\Windows\ServiceProfiles\LocalService\AppData\Local\LogMeIn Hamachi\h2-engine.id.updating	hamachi-2.exe
File opened for modification	C:\Windows\ServiceProfiles\LocalService\AppData\Local\LogMeIn Hamachi\h2-engine.ini.updating	hamachi-2.exe
File created	C:\Windows\Installer\e597288.msi	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	hamachi-2.exe
File opened for modification	C:\Windows\Installer\MSIBB33.tmp	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File created	C:\Windows\SystemTemp\~DF4522B5EF126D4D4B.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\{3217B6C1-7F42-424A-B5FB-BB61FE3BEFE5}\UninstallIcon.ico	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File opened for modification	C:\Windows\inf\oem1.inf	DrvInst.exe
File opened for modification	C:\Windows\ServiceProfiles\LocalService\AppData\Local\LogMeIn Hamachi\h2-engine.id.updating	hamachi-2.exe
File created	C:\Windows\ServiceProfiles\LocalService\AppData\Local\LogMeIn Hamachi\h2-engine.cfg.updating	hamachi-2.exe
File opened for modification	C:\Windows\ServiceProfiles\LocalService\AppData\Local\LogMeIn Hamachi\h2-engine.log	hamachi-2.exe
File opened for modification	C:\Windows\Installer\MSI7863.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI78B3.tmp	msiexec.exe
File created	C:\Windows\Installer\SourceHash{3217B6C1-7F42-424A-B5FB-BB61FE3BEFE5}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI824D.tmp	msiexec.exe

Executes dropped EXE 16 IoCs

pid	Process
4348	hamachi-2.exe
3208	LMIGuardianSvc.exe
3632	hamachi-2-ui.exe
1648	LMIGuardianSvc.exe
5596	hamachi-2.exe
5852	LMIGuardianSvc.exe
1156	LMIGuardianSvc.exe
5048	hamachi-2.exe
3948	LMIGuardianSvc.exe
6016	LMIGuardianSvc.exe
5536	hamachi-2.exe
864	LMIGuardianSvc.exe
4844	hamachi-2.exe
3608	LMIGuardianSvc.exe
2008	hamachi-2-ui.exe
2344	LMIGuardianSvc.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
912	sc.exe
1316	sc.exe

Loads dropped DLL 28 IoCs

pid	Process
2432	MsiExec.exe
2432	MsiExec.exe
2432	MsiExec.exe
2432	MsiExec.exe
2432	MsiExec.exe
2372	MsiExec.exe
2372	MsiExec.exe
2372	MsiExec.exe
2372	MsiExec.exe
2372	MsiExec.exe
2372	MsiExec.exe
4560	MsiExec.exe
4560	MsiExec.exe
4560	MsiExec.exe
3208	LMIGuardianSvc.exe
1648	LMIGuardianSvc.exe
5852	LMIGuardianSvc.exe
4560	MsiExec.exe
1156	LMIGuardianSvc.exe
4560	MsiExec.exe
3948	LMIGuardianSvc.exe
6016	LMIGuardianSvc.exe
864	LMIGuardianSvc.exe
4560	MsiExec.exe
4560	MsiExec.exe
3608	LMIGuardianSvc.exe
2432	MsiExec.exe
2344	LMIGuardianSvc.exe

Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs

persistence privilege_escalation

Installer Packages

T1546.016

Msiexec

T1218.007

pid	Process
1032	msiexec.exe

Event Triggered Execution: Netsh Helper DLL 1 TTPs 15 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 12 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	hamachi-2.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	hamachi-2.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\NV Domain	hamachi-2.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	LMIGuardianSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	LMIGuardianSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\NV Domain	hamachi-2.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	hamachi-2.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	hamachi-2.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	hamachi-2.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	LMIGuardianSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	LMIGuardianSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	hamachi-2.exe

System Location Discovery: System Language Discovery 1 TTPs 13 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hamachi-2-ui.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	LMIGuardianSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hamachi-2-ui.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	LMIGuardianSvc.exe

Checks SCSI registry key(s) 3 TTPs 41 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Service	hamachi-2.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Service	hamachi-2.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom	DrvInst.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	hamachi-2.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\LowerFilters	hamachi-2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Filters	hamachi-2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 000000000400000020c1fdf03c8ae10a0000000000000000000000000000000000000000000000000000000000000000000000000000000000001071020000000000c012000000000000000000000000270101000088380120c1fdf00000000000001071020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d0830200000000006025c501000000000000000000000700010000e8410120c1fdf0000000000000d08302000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9c701000000000000050000000000000000000000070001000098d4e320c1fdf000000000000030a9c7010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9cc0100000000000005000000000000000000000007000100009854e620c1fdf000000000000030a9cc01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Phantom	DrvInst.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Service	hamachi-2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Filters	hamachi-2.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	hamachi-2.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\LowerFilters	hamachi-2.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\LowerFilters	hamachi-2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Phantom	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\CompatibleIDs	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	DrvInst.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Service	hamachi-2.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\LowerFilters	hamachi-2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	hamachi-2.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\UpperFilters	hamachi-2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	hamachi-2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Filters	hamachi-2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Filters	hamachi-2.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	hamachi-2.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\CompatibleIDs	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\UpperFilters	hamachi-2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	hamachi-2.exe

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	MsiExec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\hamachi-2-ui.exe = "11000"	MsiExec.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	LMIGuardianSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	LMIGuardianSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	LMIGuardianSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	LMIGuardianSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	LMIGuardianSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	LMIGuardianSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	LMIGuardianSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	hamachi-2.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	LMIGuardianSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	LMIGuardianSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	LMIGuardianSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	LMIGuardianSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	LMIGuardianSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	LMIGuardianSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	LMIGuardianSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	LMIGuardianSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	LMIGuardianSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	LMIGuardianSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	LMIGuardianSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	LMIGuardianSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	LMIGuardianSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	hamachi-2.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	LMIGuardianSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	LMIGuardianSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	LMIGuardianSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	LMIGuardianSvc.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	LMIGuardianSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	LMIGuardianSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	LMIGuardianSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	LMIGuardianSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	LMIGuardianSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	hamachi-2.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	LMIGuardianSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	LMIGuardianSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	hamachi-2.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	LMIGuardianSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	LMIGuardianSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	LMIGuardianSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	LMIGuardianSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	LMIGuardianSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	LMIGuardianSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	hamachi-2.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	LMIGuardianSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	LMIGuardianSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	LMIGuardianSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	LMIGuardianSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	LMIGuardianSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	LMIGuardianSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	LMIGuardianSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	LMIGuardianSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	LMIGuardianSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	hamachi-2.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	hamachi-2.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	LMIGuardianSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	hamachi-2.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{FAC58A4E-76CC-418B-8829-6DE882474472}\1.0\ = "LMIGuardianSvc 1.0 Type Library"	LMIGuardianSvc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4615B7A3-8EF2-40C0-83F0-63BCD479C791}	LMIGuardianSvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{4615B7A3-8EF2-40C0-83F0-63BCD479C791}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	LMIGuardianSvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\1C6B712324F7A4245BBFBB16EFB3FE5E\LanguageFI = "\x06Ui"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\1C6B712324F7A4245BBFBB16EFB3FE5E\LanguageTR = "\x06Ui"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1C6B712324F7A4245BBFBB16EFB3FE5E\ProductName = "Hamachi"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1C6B712324F7A4245BBFBB16EFB3FE5E\DeploymentFlags = "3"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\LMIGuardianSvc.GuardianSvc.1\CLSID\ = "{D4258A22-CF85-489D-83AE-49FCD0DFAD29}"	LMIGuardianSvc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D4258A22-CF85-489D-83AE-49FCD0DFAD29}\ProgID	LMIGuardianSvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D4258A22-CF85-489D-83AE-49FCD0DFAD29}\VersionIndependentProgID\ = "LMIGuardianSvc.GuardianSvc"	LMIGuardianSvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{FAC58A4E-76CC-418B-8829-6DE882474472}\1.0\FLAGS\ = "0"	LMIGuardianSvc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{FAC58A4E-76CC-418B-8829-6DE882474472}\1.0\HELPDIR	LMIGuardianSvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4615B7A3-8EF2-40C0-83F0-63BCD479C791}\TypeLib\ = "{FAC58A4E-76CC-418B-8829-6DE882474472}"	LMIGuardianSvc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\1C6B712324F7A4245BBFBB16EFB3FE5E	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\1C6B712324F7A4245BBFBB16EFB3FE5E\LanguageDA = "\x06Ui"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{67E4A0D8-8675-4FBB-BC62-F10EC894327E}\LaunchPermission = 010014807400000084000000140000003000000002001c000100000011001400010000000101000000000010001000000200440003000000000014000b000000010100000000000504000000000014000b00000001010000000000050b000000000014000b0000000101000000000005120000000102000000000005200000002002000001020000000000052000000020020000	LMIGuardianSvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\LMIGuardianSvc.EXE\AppID = "{67E4A0D8-8675-4FBB-BC62-F10EC894327E}"	LMIGuardianSvc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D4258A22-CF85-489D-83AE-49FCD0DFAD29}\TypeLib	LMIGuardianSvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{FAC58A4E-76CC-418B-8829-6DE882474472}\1.0\HELPDIR\ = "C:\\Program Files (x86)\\LogMeIn Hamachi\\x64"	LMIGuardianSvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\1C6B712324F7A4245BBFBB16EFB3FE5E\LanguageHU = "\x06Ui"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\1C6B712324F7A4245BBFBB16EFB3FE5E\LanguageNL = "\x06Ui"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\1C6B712324F7A4245BBFBB16EFB3FE5E\LanguagePTBR = "\x06Ui"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1C6B712324F7A4245BBFBB16EFB3FE5E\PackageCode = "867B58337D727344B993B2FEB2C83EB7"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{67E4A0D8-8675-4FBB-BC62-F10EC894327E}	LMIGuardianSvc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\LMIGuardianSvc.GuardianSvc	LMIGuardianSvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D4258A22-CF85-489D-83AE-49FCD0DFAD29}\TypeLib\ = "{FAC58A4E-76CC-418B-8829-6DE882474472}"	LMIGuardianSvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\1C6B712324F7A4245BBFBB16EFB3FE5E\LanguageDE = "\x06Ui"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\1C6B712324F7A4245BBFBB16EFB3FE5E\LanguageHE = "\x06Ui"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\1C6B712324F7A4245BBFBB16EFB3FE5E\LanguageSV = "\x06Ui"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1C6B712324F7A4245BBFBB16EFB3FE5E\Assignment = "1"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\0E80E241A66716B4F9A16046F5141A90	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D4258A22-CF85-489D-83AE-49FCD0DFAD29}	LMIGuardianSvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4615B7A3-8EF2-40C0-83F0-63BCD479C791}\ = "IGuardianSvc"	LMIGuardianSvc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4615B7A3-8EF2-40C0-83F0-63BCD479C791}\ProxyStubClsid32	LMIGuardianSvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1C6B712324F7A4245BBFBB16EFB3FE5E\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1C6B712324F7A4245BBFBB16EFB3FE5E\SourceList\Media\1 = ";"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{FAC58A4E-76CC-418B-8829-6DE882474472}\1.0\0\win64\ = "C:\\Program Files (x86)\\LogMeIn Hamachi\\x64\\LMIGuardianSvc.exe\\1"	LMIGuardianSvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\1C6B712324F7A4245BBFBB16EFB3FE5E\Complete	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1C6B712324F7A4245BBFBB16EFB3FE5E\SourceList\PackageName = "hamachi.msi"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{67E4A0D8-8675-4FBB-BC62-F10EC894327E}\AccessPermission = 010014807400000084000000140000003000000002001c000100000011001400010000000101000000000010001000000200440003000000000014000b000000010100000000000504000000000014000b00000001010000000000050b000000000014000b0000000101000000000005120000000102000000000005200000002002000001020000000000052000000020020000	LMIGuardianSvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{67E4A0D8-8675-4FBB-BC62-F10EC894327E}\LocalService = "LMIGuardianSvc"	LMIGuardianSvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\LMIGuardianSvc.GuardianSvc.1\ = "GuardianSvc Class"	LMIGuardianSvc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\LMIGuardianSvc.GuardianSvc.1\CLSID	LMIGuardianSvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D4258A22-CF85-489D-83AE-49FCD0DFAD29}\ = "GuardianSvc Class"	LMIGuardianSvc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{4615B7A3-8EF2-40C0-83F0-63BCD479C791}\TypeLib	LMIGuardianSvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\1C6B712324F7A4245BBFBB16EFB3FE5E\LanguageES = "\x06Ui"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\1C6B712324F7A4245BBFBB16EFB3FE5E\LanguageRU = "\x06Ui"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\LMIGuardianSvc.GuardianSvc\CurVer	LMIGuardianSvc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{FAC58A4E-76CC-418B-8829-6DE882474472}\1.0	LMIGuardianSvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{4615B7A3-8EF2-40C0-83F0-63BCD479C791}\TypeLib\Version = "1.0"	LMIGuardianSvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\1C6B712324F7A4245BBFBB16EFB3FE5E\Engine = "Complete"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\1C6B712324F7A4245BBFBB16EFB3FE5E\LanguageZH = "\x06Ui"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1C6B712324F7A4245BBFBB16EFB3FE5E\Version = "33816576"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1C6B712324F7A4245BBFBB16EFB3FE5E\InstanceType = "0"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1C6B712324F7A4245BBFBB16EFB3FE5E\AuthorizedLUAApp = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\LMIGuardianSvc.GuardianSvc\CurVer\ = "LMIGuardianSvc.GuardianSvc.1"	LMIGuardianSvc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{FAC58A4E-76CC-418B-8829-6DE882474472}	LMIGuardianSvc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{FAC58A4E-76CC-418B-8829-6DE882474472}\1.0\0	LMIGuardianSvc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4615B7A3-8EF2-40C0-83F0-63BCD479C791}\TypeLib	LMIGuardianSvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\1C6B712324F7A4245BBFBB16EFB3FE5E\LanguageAR = "\x06Ui"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{FAC58A4E-76CC-418B-8829-6DE882474472}\1.0\FLAGS	LMIGuardianSvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\1C6B712324F7A4245BBFBB16EFB3FE5E\LanguageFR = "\x06Ui"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\1C6B712324F7A4245BBFBB16EFB3FE5E\LanguageJA = "\x06Ui"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\1C6B712324F7A4245BBFBB16EFB3FE5E\LanguageKO = "\x06Ui"	msiexec.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3632	hamachi-2-ui.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1032	msiexec.exe
Token: SeIncreaseQuotaPrivilege	1032	msiexec.exe
Token: SeSecurityPrivilege	5772	msiexec.exe
Token: SeCreateTokenPrivilege	1032	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	1032	msiexec.exe
Token: SeLockMemoryPrivilege	1032	msiexec.exe
Token: SeIncreaseQuotaPrivilege	1032	msiexec.exe
Token: SeMachineAccountPrivilege	1032	msiexec.exe
Token: SeTcbPrivilege	1032	msiexec.exe
Token: SeSecurityPrivilege	1032	msiexec.exe
Token: SeTakeOwnershipPrivilege	1032	msiexec.exe
Token: SeLoadDriverPrivilege	1032	msiexec.exe
Token: SeSystemProfilePrivilege	1032	msiexec.exe
Token: SeSystemtimePrivilege	1032	msiexec.exe
Token: SeProfSingleProcessPrivilege	1032	msiexec.exe
Token: SeIncBasePriorityPrivilege	1032	msiexec.exe
Token: SeCreatePagefilePrivilege	1032	msiexec.exe
Token: SeCreatePermanentPrivilege	1032	msiexec.exe
Token: SeBackupPrivilege	1032	msiexec.exe
Token: SeRestorePrivilege	1032	msiexec.exe
Token: SeShutdownPrivilege	1032	msiexec.exe
Token: SeDebugPrivilege	1032	msiexec.exe
Token: SeAuditPrivilege	1032	msiexec.exe
Token: SeSystemEnvironmentPrivilege	1032	msiexec.exe
Token: SeChangeNotifyPrivilege	1032	msiexec.exe
Token: SeRemoteShutdownPrivilege	1032	msiexec.exe
Token: SeUndockPrivilege	1032	msiexec.exe
Token: SeSyncAgentPrivilege	1032	msiexec.exe
Token: SeEnableDelegationPrivilege	1032	msiexec.exe
Token: SeManageVolumePrivilege	1032	msiexec.exe
Token: SeImpersonatePrivilege	1032	msiexec.exe
Token: SeCreateGlobalPrivilege	1032	msiexec.exe
Token: SeCreateTokenPrivilege	1032	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	1032	msiexec.exe
Token: SeLockMemoryPrivilege	1032	msiexec.exe
Token: SeIncreaseQuotaPrivilege	1032	msiexec.exe
Token: SeMachineAccountPrivilege	1032	msiexec.exe
Token: SeTcbPrivilege	1032	msiexec.exe
Token: SeSecurityPrivilege	1032	msiexec.exe
Token: SeTakeOwnershipPrivilege	1032	msiexec.exe
Token: SeLoadDriverPrivilege	1032	msiexec.exe
Token: SeSystemProfilePrivilege	1032	msiexec.exe
Token: SeSystemtimePrivilege	1032	msiexec.exe
Token: SeProfSingleProcessPrivilege	1032	msiexec.exe
Token: SeIncBasePriorityPrivilege	1032	msiexec.exe
Token: SeCreatePagefilePrivilege	1032	msiexec.exe
Token: SeCreatePermanentPrivilege	1032	msiexec.exe
Token: SeBackupPrivilege	1032	msiexec.exe
Token: SeRestorePrivilege	1032	msiexec.exe
Token: SeShutdownPrivilege	1032	msiexec.exe
Token: SeDebugPrivilege	1032	msiexec.exe
Token: SeAuditPrivilege	1032	msiexec.exe
Token: SeSystemEnvironmentPrivilege	1032	msiexec.exe
Token: SeChangeNotifyPrivilege	1032	msiexec.exe
Token: SeRemoteShutdownPrivilege	1032	msiexec.exe
Token: SeUndockPrivilege	1032	msiexec.exe
Token: SeSyncAgentPrivilege	1032	msiexec.exe
Token: SeEnableDelegationPrivilege	1032	msiexec.exe
Token: SeManageVolumePrivilege	1032	msiexec.exe
Token: SeImpersonatePrivilege	1032	msiexec.exe
Token: SeCreateGlobalPrivilege	1032	msiexec.exe
Token: SeCreateTokenPrivilege	1032	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	1032	msiexec.exe
Token: SeLockMemoryPrivilege	1032	msiexec.exe

Suspicious use of FindShellTrayWindow 5 IoCs

pid	Process
1032	msiexec.exe
3632	hamachi-2-ui.exe
3632	hamachi-2-ui.exe
1032	msiexec.exe
2008	hamachi-2-ui.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
3632	hamachi-2-ui.exe
3632	hamachi-2-ui.exe
2008	hamachi-2-ui.exe

Suspicious use of SetWindowsHookEx 8 IoCs

pid	Process
1032	msiexec.exe
5772	msiexec.exe
2432	MsiExec.exe
2372	MsiExec.exe
4560	MsiExec.exe
3632	hamachi-2-ui.exe
3632	hamachi-2-ui.exe
2008	hamachi-2-ui.exe

Suspicious use of WriteProcessMemory 22 IoCs

description	pid	Process	procid_target
PID 5772 wrote to memory of 2432	5772	msiexec.exe	90
PID 5772 wrote to memory of 5088	5772	msiexec.exe	96
PID 5772 wrote to memory of 2372	5772	msiexec.exe	98
PID 5772 wrote to memory of 4560	5772	msiexec.exe	99
PID 4560 wrote to memory of 4348	4560	MsiExec.exe	101
PID 4348 wrote to memory of 3208	4348	hamachi-2.exe	103
PID 3632 wrote to memory of 1648	3632	hamachi-2-ui.exe	105
PID 4348 wrote to memory of 4796	4348	hamachi-2.exe	112
PID 4348 wrote to memory of 2020	4348	hamachi-2.exe	114
PID 4348 wrote to memory of 1072	4348	hamachi-2.exe	119
PID 4348 wrote to memory of 5632	4348	hamachi-2.exe	121
PID 4560 wrote to memory of 5596	4560	MsiExec.exe	123
PID 5596 wrote to memory of 5852	5596	hamachi-2.exe	125
PID 4560 wrote to memory of 912	4560	MsiExec.exe	126
PID 4560 wrote to memory of 1156	4560	MsiExec.exe	128
PID 5048 wrote to memory of 3948	5048	hamachi-2.exe	130
PID 5536 wrote to memory of 864	5536	hamachi-2.exe	134
PID 4560 wrote to memory of 1316	4560	MsiExec.exe	135
PID 4844 wrote to memory of 3608	4844	hamachi-2.exe	138
PID 4844 wrote to memory of 2024	4844	hamachi-2.exe	139
PID 2432 wrote to memory of 2008	2432	MsiExec.exe	142
PID 2008 wrote to memory of 2344	2008	hamachi-2-ui.exe	143

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\hamachi.msi
1⤵
- Badlisted process makes network request
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:1032

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Adds Run key to start application
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5772
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 5DCEE33AC45E17A5B1C91AA6A2B09CD9 C
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2432
- - C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2-ui.exe
    "C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2-ui.exe" --ipc-timeout 30
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2008
  - - C:\Program Files (x86)\LogMeIn Hamachi\LMIGuardianSvc.exe
      "C:\Program Files (x86)\LogMeIn Hamachi\LMIGuardianSvc.exe" /escort 2008 /CUSTOM Hamachi
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      PID:2344
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:5088
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 24C2E6F9179D8EB31E8F5DD6B222A275
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:2372
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 6409AF339B670007DF1EF41D9D24AC77 E Global\MSI0000
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4560
- - C:\Program Files (x86)\LogMeIn Hamachi\x64\hamachi-2.exe
    "C:\Program Files (x86)\LogMeIn Hamachi\x64\hamachi-2.exe" --add-tap-at-install Hamachi
    3⤵
    - Drops file in Drivers directory
    - Drops file in System32 directory
    - Drops file in Windows directory
    - Executes dropped EXE
    - Reads the TCP/IP host and domain name from the registry
    - Checks SCSI registry key(s)
    - Modifies data under HKEY_USERS
    - Suspicious use of WriteProcessMemory
    PID:4348
  - - C:\Program Files (x86)\LogMeIn Hamachi\x64\LMIGuardianSvc.exe
      "C:\Program Files (x86)\LogMeIn Hamachi\x64\LMIGuardianSvc.exe" /escort 4348 /CUSTOM Hamachi
      4⤵
      Drops file in System32 directory
      Executes dropped EXE
      Loads dropped DLL
      Reads the TCP/IP host and domain name from the registry
      Modifies data under HKEY_USERS
      PID:3208
  - - C:\Windows\SysWOW64\netsh.exe
      netsh interface ipv4 set subinterface "Ethernet 2" mtu=1404 store=persistent
      4⤵
      Event Triggered Execution: Netsh Helper DLL
      System Location Discovery: System Language Discovery
      PID:4796
  - - C:\Windows\SysWOW64\netsh.exe
      netsh.exe interface set interface name="Ethernet 2" newname="Hamachi"
      4⤵
      Event Triggered Execution: Netsh Helper DLL
      System Location Discovery: System Language Discovery
      PID:2020
  - - C:\Windows\SysWOW64\netsh.exe
      netsh interface tcp set global autotuninglevel=normal
      4⤵
      Event Triggered Execution: Netsh Helper DLL
      System Location Discovery: System Language Discovery
      PID:1072
  - - C:\Windows\SysWOW64\netsh.exe
      netsh interface tcp set global rss=enabled
      4⤵
      Event Triggered Execution: Netsh Helper DLL
      System Location Discovery: System Language Discovery
      PID:5632
- - C:\Program Files (x86)\LogMeIn Hamachi\x64\hamachi-2.exe
    "C:\Program Files (x86)\LogMeIn Hamachi\x64\hamachi-2.exe" --config Hamachi 25.0.0.1
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:5596
  - - C:\Program Files (x86)\LogMeIn Hamachi\x64\LMIGuardianSvc.exe
      "C:\Program Files (x86)\LogMeIn Hamachi\x64\LMIGuardianSvc.exe" /escort 5596 /CUSTOM Hamachi
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Modifies data under HKEY_USERS
      PID:5852
- - C:\Windows\SysWOW64\sc.exe
    sc config Hamachi2Svc depend= winmgmt
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:912
- - C:\Program Files (x86)\LogMeIn Hamachi\x64\LMIGuardianSvc.exe
    "C:\Program Files (x86)\LogMeIn Hamachi\x64\LMIGuardianSvc.exe" -Service
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Modifies data under HKEY_USERS
    - Modifies registry class
    PID:1156
- - C:\Windows\SysWOW64\sc.exe
    sc config Hamachi2Svc depend= winmgmt
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1316

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
PID:416

C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2-ui.exe
"C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2-ui.exe" --auto-start
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3632
- C:\Program Files (x86)\LogMeIn Hamachi\LMIGuardianSvc.exe
  "C:\Program Files (x86)\LogMeIn Hamachi\LMIGuardianSvc.exe" /escort 3632 /CUSTOM Hamachi
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  PID:1648

C:\Windows\system32\DrvInst.exe
DrvInst.exe "4" "1" "c:\program files (x86)\logmein hamachi\x64\hamdrv.inf" "9" "42b53aaff" "0000000000000188" "WinSta0\Default" "00000000000000DC" "208" "c:\program files (x86)\logmein hamachi\x64"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
PID:3448

C:\Windows\system32\DrvInst.exe
DrvInst.exe "2" "211" "ROOT\NET\0000" "C:\Windows\System32\DriverStore\FileRepository\hamdrv.inf_amd64_c59072ec40c0c372\hamdrv.inf" "oem1.inf:db04a16c4ff220c2:Hamachi.ndi:15.28.40.464:hamachi," "42b53aaff" "0000000000000188" "85d4"
1⤵
- Drops file in Drivers directory
- Drops file in Windows directory
PID:3276

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:3440

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s Netman
1⤵
PID:2636

C:\Program Files (x86)\LogMeIn Hamachi\x64\hamachi-2.exe
"C:\Program Files (x86)\LogMeIn Hamachi\x64\hamachi-2.exe" -s --get-config
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of WriteProcessMemory
PID:5048
- C:\Program Files (x86)\LogMeIn Hamachi\x64\LMIGuardianSvc.exe
  "C:\Program Files (x86)\LogMeIn Hamachi\x64\LMIGuardianSvc.exe" /escort 5048 /CUSTOM Hamachi
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Modifies data under HKEY_USERS
  PID:3948

C:\Program Files (x86)\LogMeIn Hamachi\x64\LMIGuardianSvc.exe
"C:\Program Files (x86)\LogMeIn Hamachi\x64\LMIGuardianSvc.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies data under HKEY_USERS
PID:6016

C:\Program Files (x86)\LogMeIn Hamachi\x64\hamachi-2.exe
"C:\Program Files (x86)\LogMeIn Hamachi\x64\hamachi-2.exe" -s
1⤵
- Drops file in Windows directory
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of WriteProcessMemory
PID:5536
- C:\Program Files (x86)\LogMeIn Hamachi\x64\LMIGuardianSvc.exe
  "C:\Program Files (x86)\LogMeIn Hamachi\x64\LMIGuardianSvc.exe" /escort 5536 /CUSTOM Hamachi
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:864

C:\Program Files (x86)\LogMeIn Hamachi\x64\hamachi-2.exe
"C:\Program Files (x86)\LogMeIn Hamachi\x64\hamachi-2.exe" -s
1⤵
- Drops file in Windows directory
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of WriteProcessMemory
PID:4844
- C:\Program Files (x86)\LogMeIn Hamachi\x64\LMIGuardianSvc.exe
  "C:\Program Files (x86)\LogMeIn Hamachi\x64\LMIGuardianSvc.exe" /escort 4844 /CUSTOM Hamachi
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Modifies data under HKEY_USERS
  PID:3608
- C:\Windows\system32\netsh.exe
  netsh interface ipv4 set subinterface "Hamachi" mtu=1404 store=persistent
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:2024

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Installer Packages

T1546.016

Netsh Helper DLL

T1546.007

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Installer Packages

T1546.016

Netsh Helper DLL

T1546.007

Defense Evasion

Modify Registry

T1112

System Binary Proxy Execution

T1218

Msiexec

T1218.007

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e597287.rbs

Path C:\Config.Msi\e597287.rbs
Size 23KB
SHA256 a5baeeec67f91f805c20ec1cd04b0018d5c798e8cf16f9d5ae7863abcacab71a
MD5 1d2017262c39fc2cde2baac93d68e4b6
SHA1 759b35607766f6fead8b01b23707938dfcb4b3af
SHA512 a35dfb95609a517948aa4f02bac7cdf1a76acf244c173d2ae3ebf1f3aa6cbbc0c8282b0e0f90795d78157e6238c28a78f915f3a0fa3b11895ae8372859e78cf7
SSDEEP 192:IsaW7YB7u0B53HXJrgxnzU6tWav8m5dClUjII2jIkE0BygwhgJ29i2t2+0kQBuAn:IsL7YB7uPU6pV/jSjjUb1g
TLSH
T15DB2F202DA0192D3FD679B34CF07272037EBE9E58344A34B059CA5245F87FD85EA91AE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LMIGuardianDll.dll

Path C:\Program Files (x86)\LogMeIn Hamachi\LMIGuardianDll.dll
Size 1.8MB
SHA256 c80d77f76147911eb23ff6d0f383b48a9fee8f0f1d8224dab35478d777932825
MD5 cc09c356c07e5b85634728bc8f335533
SHA1 b3878820ccdf8e8746f32e4977e0279671995742
SHA512 b56b95971503134a0f6669232a4b296f9599a50e9c949da08a2dea28e73aa4e294cf24174537484f130aa929e3561d154719b9970dd86043bc66a263ec037673
SSDEEP 12288:Jc3RCqBwgVf9e7+wEiQw7ul53Wv8X6FysisO4K02WTryAvl+/imEKmn3D+SHsXk6:Jc3RxSoVl9Wv81phUTryAv8aX+SMp5
TLSH
T1B795B28D2C41CDF6CA38053F94D2A56A03B8DD279774DCE7A6943AEB19301C5052EBBE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LMIGuardianSvc.exe

Path C:\Program Files (x86)\LogMeIn Hamachi\LMIGuardianSvc.exe
Size 418KB
SHA256 0f98dc7a0f2b34affeed3dc98a4288a7b09fea814fa5ebbdd6a461afd244dd87
MD5 da00f2503d98733267eb83547ce1aedb
SHA1 eca2764fc3fb3c91610a8fa8824a8310726a5f0d
SHA512 4660bc30f2c1449b9f5f6fa82169fd7080579cf7db33135bc973a254555dc5a3e0c39d7d290843b34177f247ecc6cf6fe47374f567df63277c213afbafb432c0
SSDEEP 3072:MJWSmhRy3o3NBVi8Z+lc6WmeLmeHG9YbXurcxA84/LFtVefRwQE:MJmhConVZkW1Hi/BtoW
TLSH
T1FD94E79438D5C5CACE251873D9D3E9DA07642C2BF7B1E962A6E077AF95383C0011E8BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hamachi-2-ui.exe

Path C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2-ui.exe
Size 7.5MB
SHA256 008d6e282e97765f5f7151a36fddbcc5f26314cee49dfb10fb68387cb474e8d1
MD5 e9df22942bfc12f1204b81f33c7754d6
SHA1 a53e519bfd9e691ba679e7426426c50d2216133a
SHA512 98b979ff347e2ec4989f77870ae5213e814b6693979546ce20dbf7cd196c7682216e7d26cba74a6d16d5bb73ed5ff0f2b6dfee0b01c3ee704ae101487739af19
SSDEEP 98304:LnDWDOAiCYpAyz3IljJ0WYXtZNhCGdPP6dS/4k24Al6mePDb4:LaDmLUPE3NhCGdPSdS/4k24AYpbb4
TLSH
T1FD8629236E044071C89F163D209DA378A67B1D513BA8E6D759A3BD5FB830DC0B63963B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hamachi.lng

Path C:\Program Files (x86)\LogMeIn Hamachi\hamachi.lng
Size 55KB
SHA256 539d21ace7964454cb3da307f4f7d4f284692309d3195bbc00028003865baefc
MD5 01282f1f794048b8f0cc2917d9b9a572
SHA1 5433bae7db6a9ff90c9f486f3edda670589b9d25
SHA512 bf0a27b28cef76bafedf2404b566df279a7a1f07b4f081defdc9d80b71d95fdaf88cb49d9473e5d9249c48e749f4c5e335ec31503db0c75023dac9e8b771a186
SSDEEP 1536:uHgMdBl7CIicRPPiy3GJh9GYpVRpccmzsNV:uHgMdXDRP6izg
TLSH
T1DE43B52DCB863435C9CB40D7591A656377E6909F1BA601A8B2FCB19C3358A4802FF7E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LMIGuardianDll.dll

Path C:\Program Files (x86)\LogMeIn Hamachi\x64\LMIGuardianDll.dll
Size 2.0MB
SHA256 1a9557a5fe2a0201921310cd2b0cafc7ff22ca1316db9d72e9d98dc81d51bb84
MD5 64a32f82314fc79db52df9f0f0ef9a16
SHA1 5c754f5423981ba84b04b9f21152fa2bbdafaddb
SHA512 2b96e3db93e77a92277cf5aa7efe22315d5008f1f1409e7e35a70a38c98601ab258a8312de9942f6e16948a41873f16872dca7a368cdd4259adda15458bb7151
SSDEEP 12288:gQcyXWGh+i+fYRaNDn7eLJhNYYU9H4m42Tn2ShTcPmEKmn3D+SHsL:gONh+i+BYdOH4ATn2ShTcPX+SML
TLSH
T1C9A5C28D2D44CDB5C639453FC8C2956A93B0EC2B5734DEA751A036EB2E322C5052E7BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LMIGuardianSvc.exe

Path C:\Program Files (x86)\LogMeIn Hamachi\x64\LMIGuardianSvc.exe
Size 435KB
SHA256 9e65156b8d90adf37d8d1f9e7447480d6f5760b1ff073232f98e1ec5b1ec53cd
MD5 29ab42d1d19b7b74a6f35639367d97d0
SHA1 0b9644169e2063431dd49d52f8e4083054ceccc4
SHA512 de5208f2eea89f18e8d1c4d287db76186c3463929c6917120452040d48738c310380479708de23f2a8f264e25a1e682e9a5400cac33a4d2923b67f4ac3eaa619
SSDEEP 3072:vg3FMYavAzeHTmQNNOPh37ec5/X+ltYLnoeDPhYbXurcxA84/LFtVmwQ:vg1+AzETW537ZdXlDN/BtP
TLSH
T18294E5852895D1CACE254833D9D3D99947712C3BE7B1E6A2A5E073AF9E3A3C00D1E47C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hamachi-2.exe

Path C:\Program Files (x86)\LogMeIn Hamachi\x64\hamachi-2.exe
Size 4.9MB
SHA256 cc3830bf0ea7c0f4219c982669e3c989a6790b08d80275f49fefd642967ec9a3
MD5 1bf3b6204e9d85f7771f2a3914f10ccf
SHA1 e80d98b96cd0cd9610b40749f94ee7712d15beeb
SHA512 3d2fabab59ca059e7d1a10b624291781658fe205168b4a5c325f206a1dce0632f9963ea584126d77b3d6a824893a843fef75523da101ee3f2e96511bc91ce520
SSDEEP 49152:yGtlqYeIU6i1VwASOhXIpx9z3+O9lxZEXRzKijhpTzSxDmGef/ARtvQfpD0rB+5W:J+7Ypn9lAnjI3fp6IoiodQsI72L5Mz
TLSH
T15B368D6AB7E401ECD4BAC138CA464523E7B2B81617B19BDF069096760F73AE01F3E751
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

h2-ui-peers.ini

Path C:\Users\Admin\AppData\Local\LogMeIn Hamachi\h2-ui-peers.ini
Size 4B
SHA256 df3f619804a92fdb4057192dc43dd748ea778adc52bc498ce80524c014b81119
MD5 f1d3ff8443297732862df21dc4e57262
SHA1 9069ca78e7450a285173431b3e52c5c25299e473
SHA512 ec2d57691d9b2d40182ac565032054b7d784ba96b18bcb5be0bb4e70e3fb041eff582c8af66ee50256539f2181d7f9e53627c0189da7e75a4d5ef10ea93b20b3
MD5 SHA1 SHA512

Submit Download

h2-ui.ini.bak

Path C:\Users\Admin\AppData\Local\LogMeIn Hamachi\h2-ui.ini.bak
Size 265B
SHA256 7a62879fbcaba71af50b3f5e6e88801bb5e6bf30ed2e88a3cf50773b9e887035
MD5 d2e6c85ca1c7bbc5106a27f9db6f9824
SHA1 8143d9a785bdbe78b039a7b83733837e39100cea
SHA512 5b6ac4aa92af61271f24e328353806351958decd3ea92612d1116b2375ea4fe8e7446df518b926a02faf0ac70cc1c1c16d5d048288ab4829b4fae2e0e1c19c14
TLSH
T1E8D02B5467451151A4989691275E178ACE2375DD97081120B28C8448734478E52ED5E1
MD5 SHA1 SHA512 TLSH

Submit Download

h2-ui.log

Path C:\Users\Admin\AppData\Local\LogMeIn Hamachi\h2-ui.log
Size 178B
SHA256 59a2c1fea083c909192603936f5752f39578d98c157a9cdf83429514789d6384
MD5 406793231b4c4e1669d565add4a59594
SHA1 b05c52a4e4dd7435a212474d042940368fd7614c
SHA512 820dabb5a91deb5dbf01a697c0cde09117a432271314803339a1b15bad18a23f98995516be73e5cc8479147b0421c622099ba2f88e5e1af0546236014c99a301
TLSH
T173C012145BE34576584522D72176473157F33C5057715F911924F489522863C70E1131
MD5 SHA1 SHA512 TLSH

Submit Download

h2-ui.log

Path C:\Users\Admin\AppData\Local\LogMeIn Hamachi\h2-ui.log
Size 342B
SHA256 d8fe7bc9ddba18431618ac9238a3f63b74677fecf1f84813d36077d992634419
MD5 97cb84944ee1aff5765c2f09eaaeec72
SHA1 c1ce845b5028d438670f1f91118f4bac5807b6c4
SHA512 7ff9e5c8edbd02ff1a60ebd6c0f69367887122c7b5f6cfb03231bd0e36ead9de8cdf215fe3487cf46e72986b654eac4ad3a61005f1b3cb4ce7b3f5c34b2a6035
TLSH
T10BE046189BE7C5B3894B13DB3B72033207B63CC153709BA06A64F889B23972D31A6171
MD5 SHA1 SHA512 TLSH

Submit Download

h2-ui.log

Path C:\Users\Admin\AppData\Local\LogMeIn Hamachi\h2-ui.log
Size 879B
SHA256 c6f2bd8badc51096ae7a86376861653d075717fb9189d4d419602133907a5d76
MD5 2ae155268772132914506d70e86bf87c
SHA1 c73f978c02d13a7077dad8b9c836bfbe81bd36db
SHA512 5242be3b865370dda754f143824771610ad62f509f8cd8e0dd2af28c2fecd9d0f5b1ce95761acd96912e9b9919ccf194471c1447daafbfa95df973381add62d5
TLSH
T19211AC2477D7C1B7888B16D9372A133297B27CC307329BA028B8E948F13C51935A8976
MD5 SHA1 SHA512 TLSH

Submit Download

h2-ui.log

Path C:\Users\Admin\AppData\Local\LogMeIn Hamachi\h2-ui.log
Size 1KB
SHA256 7250e889c5a45b69c59d1d99d4fbbb801b138ee1236f5ecd3710f8200aa7940c
MD5 fcef089de1c2db0ece9ecc42fcf07c15
SHA1 35b769477f47b0141487c942743d0899ee533c93
SHA512 61df913c6978c197f72bac6bc5829a6e8d0689d1cf4f5c8a75527f1f2a1a0509d4dfda9e6a6a775d7f055ee614a0ee7ea1dc3dbddf572668532d99b9a7371e84
TLSH
T19711AC6177D7C0B7888B56D9372A133297B27CC31732CBA029B8E548F22C81975B4476
MD5 SHA1 SHA512 TLSH

Submit Download

h2-ui.log

Path C:\Users\Admin\AppData\Local\LogMeIn Hamachi\h2-ui.log
Size 1KB
SHA256 2fa97ae66597ae4bce50a9608a524287e592563482d5abeaaafc59402f3fd000
MD5 4eb9df282d68ed516f6111a24af18c21
SHA1 5fe435ea22ecb21a348de9ac7d8d945647477812
SHA512 5f2379aadbe86c042c434f6fdaa46868520dfb80f5772806c8e7a316a5ec66ae50bacdd2fefddb5b6e76f39cd8a327c2dd7b737ee24bd639005538506488fd65
TLSH
T140215C6177D780B7898B5A9C376A133297B2BCC35B32CBE029B8D644F22C85971B4476
MD5 SHA1 SHA512 TLSH

Submit Download

h2-ui.log

Path C:\Users\Admin\AppData\Local\LogMeIn Hamachi\h2-ui.log
Size 1KB
SHA256 ed6d80181d15e9ca5d93d4c80ee2bb34bb47c7eb1176ee2837c074d591da0b12
MD5 2e61c10ba14e299356d43dcd0f025570
SHA1 d980e8d4e684b1cb7d7c25be5713ac701c50685c
SHA512 706721a9a3d2048353c639819afd988977fd9ab1aec266c2baeff5f5afad30af6869434e7396a5ddc1ef0256e8b9efe4ad2ba76ea7fbca4f4ca29335fc52178c
TLSH
T1DD31CF6177D780B789875AD8366E133297B2BCC71B32CBA029BCD548F12C85C71B4432
MD5 SHA1 SHA512 TLSH

Submit Download

h2-ui.log

Path C:\Users\Admin\AppData\Local\LogMeIn Hamachi\h2-ui.log
Size 1KB
SHA256 ccdc9ffdbf9ae9bb6404e253c51f8e72dff97b3f2891037b03425edaa8c4080f
MD5 58e7bd17d6b17841799159606be8f1e8
SHA1 33887612e7d16c585fe14ab73052dee244979035
SHA512 d1df300c3493b5014c10df02bb2f33c880d3c7ecf3b5b4bcf417e1ba161255a112ba7fe3424b5615bcb7631cb6fe46b2f10c60a047b1b902fb836f2bc289a3fd
TLSH
T1B931BE6177D780B789875AD8366E533297A2BCC72B32CBA029BCD548F12C86D71B5432
MD5 SHA1 SHA512 TLSH

Submit Download

WriteAccessTest.txt

Path C:\Users\Admin\AppData\Local\LogMeIn\Dumps\WriteAccessTest.txt
Size 39B
SHA256 89e672ba84c73b8b47c47c5cf8a77a32600a1ae915481a7bea5004dac1383487
MD5 491044e729f12a53ddbd9edae68c1571
SHA1 26cca1ae393f3b9dacf2c3b59049ed40f9b1c78b
SHA512 b4f50366b9c08fe695c6a3c55e4f43d821153e45d92973680e43d2e260b379d3e7b7005a23bbc37c55be39670270b44befa107bbc348ee77d9bc871ca68a607a
MD5 SHA1 SHA512

Submit Download

HamachiSetup.log

Path C:\Users\Admin\AppData\Local\Temp\HamachiSetup.log
Size 387B
SHA256 734d25b73b08bbbee600c42505fcb43001c22eeff82ba4634b99ddf322412e0e
MD5 9b67e5c766802f2c20b48ca1e696406f
SHA1 6c5b6b0c7681c33f94919664fb2a80db4bbf6328
SHA512 e4738338371fe17ec6241777f701b7de9b85f9c7237c60aed2f2101743bef7d22eff206484c0ed759de7729bf891bd72dc7bbe4d1664681b02faa3c8b21e0261
TLSH
T162E09BA5EE12E5BB20730264365636B04FA61DB43F33C2703199E445768C7891CB6529
MD5 SHA1 SHA512 TLSH

Submit Download

HamachiSetup.log

Path C:\Users\Admin\AppData\Local\Temp\HamachiSetup.log
Size 2KB
SHA256 8f44de33cf5d84efbe591259c1d421ec68e2055ddc83757cc45ec4dd6cf92115
MD5 fdc77b5f91922f8cb413836902441e8b
SHA1 d36dd0ef709ae125aad092960311e38478fc9678
SHA512 37ea14f06051a28a364ff1bc0ec921adb46c22fcdecac838d3d8bb1ddf6aba90f047e1a41d389454bec37f95f0589346c6854fbe7536801c9547cf8e2465ece4
TLSH
T1CA516C973B27A976246751B537632FB0CF172CB43730D6A0326AC958368C19D1CEB03A
MD5 SHA1 SHA512 TLSH

Submit Download

HamachiSetup.log

Path C:\Users\Admin\AppData\Local\Temp\HamachiSetup.log
Size 3KB
SHA256 f45e145007dbeafe005a53232e300413012b089a3d4d2483081732699853c6ba
MD5 54d4191da14bf1544e6d2cd7f987c2f9
SHA1 37cc0030dff8d4055c4f56727dcdd04fdccbab27
SHA512 7496dbfe40f7c2a9abb812bfa2d39bfd1f7bc7f10fafbce448f23d452a1c91d1f5a9e2d9748b5df0b92adde720ad70e85c9ed045563fe567cd639acd15fb5afb
TLSH
T1FA615E973B2BA9762457517537632FB1CF172CB43730D6A0326AC998368C19D1CEB436
MD5 SHA1 SHA512 TLSH

Submit Download

HamachiSetup.log

Path C:\Users\Admin\AppData\Local\Temp\HamachiSetup.log
Size 3KB
SHA256 770dcd08700c4edd9d2324b57c7cd2180a79de7acca841914b33fd371d5e324c
MD5 cd3f945253298ad381555d483fb684fa
SHA1 2f0ecb9198c4cd6c4d27c5afd2fd439a037c4bd3
SHA512 ba09e88b1c62af5b690dda04dc38700064489c7bd658f53160931a710f5a6577554d856e1706f800a0f9368451cbb17a9c555a8d739d4baea55731c4bda49d11
TLSH
T1337170977B2BA5762457917537532FB08F172CB43730DAB0326AC9A9368C15D1CEB036
MD5 SHA1 SHA512 TLSH

Submit Download

HamachiSetup.log

Path C:\Users\Admin\AppData\Local\Temp\HamachiSetup.log
Size 584B
SHA256 0040518d97a23a15229e5f2df2e1a66c2d1e4b5b3f3560f477ffba691f59bebf
MD5 a9f3490a03990a7390e11e096a16a656
SHA1 a40a5eca00aafafbd2766b541bb991a8494633e7
SHA512 6186f5f644f90b724bc8402b792fd3f2ed550d74036c482cd5380b073088f94b3ba256ad583a5798039ee39b69e384fa53f6e14f40948590791502998295ebee
TLSH
T1ACF0C8A9AE43E97B203302A4369227B08FA62DB03F32C3B03145E049768C78C1CF7425
MD5 SHA1 SHA512 TLSH

Submit Download

HamachiSetup.log

Path C:\Users\Admin\AppData\Local\Temp\HamachiSetup.log
Size 3KB
SHA256 7057ec10fdedaea1e4a05522d57612cba052ed3477b10f555071f23436a57235
MD5 ed9a6ae3bb4555553138adfe9d085ad7
SHA1 fb07128ef9396a902c65ad6f7b3827b9761f6f61
SHA512 9e48b663ad3682d39ac548b8aebc021eabe617ef5cca311e1e2e5c30353ba4e32d621d8515c62560b32341353744250501de9dc6f31c396e9a969358fd61e925
TLSH
T1E9717D977F2BA976245791B537532EB08F172CB43730DAB0326AD9A9328C15D1CEB036
MD5 SHA1 SHA512 TLSH

Submit Download

HamachiSetup.log

Path C:\Users\Admin\AppData\Local\Temp\HamachiSetup.log
Size 3KB
SHA256 a1159265c7da1823f819da43796b50c6b1f39703d155e79caa27c499d328973a
MD5 950c939fe751c293f0eb44cec38645cc
SHA1 2c070ad2e04b9dcfacb1c6ac3eb52b929e1fdaa0
SHA512 ee3abf127d8b9a21086a335116892f873763ecdf28668e2d620ae0a3fbec5f9cb1962e463d9b27c778a8fb35a3decfaf38f006a0aebf940a5b78fae9a8756b59
TLSH
T16381AD977F2BA976245752B537532EB18F172CB43730CAB0326AD969324C15D1CEB036
MD5 SHA1 SHA512 TLSH

Submit Download

HamachiSetup.log

Path C:\Users\Admin\AppData\Local\Temp\HamachiSetup.log
Size 4KB
SHA256 3f2fdaf3849361727dd72d6042b28196df991e303e22b1dc40a6a14aa5ec5c22
MD5 6e0a4c7c1d260a9f8f078c70c4b4fa35
SHA1 930e4b2c27171f634802f53c1b0cf94b92a50a68
SHA512 ab0cab2a19ff820dc1411a8b438b4d7f112186b30327a36bd9325dc6a21ea07c8caef5c52fc8a9d3f30d704a45dde9d565cedcd593f9f0fa009d868a4a5dd1a5
SSDEEP 48:Cc3k2UMkpGkFQ3dJiTEityvfYi3IuiAxxkiiPfGiAHjQIWubfli024Dun:n3kpNlFQ3dJtXvxjD4uM024Du
TLSH
T1F281CB977F6BA976245752B637532EB18F172CB43730CAB0326AC969368C15C1CEB036
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HamachiSetup.log

Path C:\Users\Admin\AppData\Local\Temp\HamachiSetup.log
Size 680B
SHA256 62d008b86d164ee3fcd8c68ad37f019474c991fc6772d379d8f954f216569254
MD5 77b9d5685ff2ab9b85f98fda1876ba28
SHA1 26f5ad0e01321b6e194fa52334ee58da12091930
SHA512 1f950d5e5a52caca56266f6bcd1eff5e570467cc066c4392fc340d7bff0ca79217aa10004e443347c6767bcab481fa0feabb7dd0c75299663e4a91b296843a3d
TLSH
T1C301A7A9AE43E97B207301A5366227F08F622DB02F32C3B03149E449768C78C1CFB525
MD5 SHA1 SHA512 TLSH

Submit Download

HamachiSetup.log

Path C:\Users\Admin\AppData\Local\Temp\HamachiSetup.log
Size 884B
SHA256 545d6a90fb2f2925c1d04a4e22839b5d7a93eb0d4a402d4995e4b58d36221cfd
MD5 7c2dbaf1319864e27ea96b53c6655eea
SHA1 0c4323cc49108fca926082357d44036d0ddb0df6
SHA512 b4f308702414b59c88f9c1bf3fd9367d8b610e6502b19a4c9f6e1170fa4b9bb1c23f220a2190d282a50acd68e75898243ff8926aae9f382d4bdc527770d708be
TLSH
T1FE11C6A9AE53E57E207301A536622AF08F532CB42F31D6F03159E489768C69C1CFB465
MD5 SHA1 SHA512 TLSH

Submit Download

HamachiSetup.log

Path C:\Users\Admin\AppData\Local\Temp\HamachiSetup.log
Size 7KB
SHA256 86c627d2d360dff50d38c7a31cbe3022340c5ac5429187d23218195169872627
MD5 0809a23839527e6ee09347180e853a28
SHA1 586e830963dc902e21a35dc55c417cd6bdfe586f
SHA512 302f43064877758d5b6d85bb1c4e42df5a6e1231f567cbcb21859f230928a5d61a6df2680438b6065e82963e3baeae695ce484030b1031e1608eb58795df295f
SSDEEP 96:n3kpNlFQ3dJtXvxjD4uM024DmU6+AsRMk6KgHoe+HUuo2Hc7E0QIapoU8j:3alFQ3XD4R021U6+AsRMHrgU2WE0yn8j
TLSH
T129F15CA62FD6A876954322A977131F724F533CE43B70CAB03179DA28B95E11C2CDB436
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HamachiSetup.log

Path C:\Users\Admin\AppData\Local\Temp\HamachiSetup.log
Size 7KB
SHA256 50234f77bd756b450027f8cdd7e3aad0731d8745391c110a6a9b2163e9c30c76
MD5 cc239cbe84bfc0a31956cf84f736b975
SHA1 0c30088fc5af185a1a104d73b1cba6e44ab2828a
SHA512 a4979e55b39b57a089e51faf1e0bb7c0751223e0ab27c02c11c571912a211e67f96bfa46de95f00cdf6eb1f1a8cd7965ca5dba61cc7e996802a0e7aec27c1936
SSDEEP 96:n3kpNlFQ3dJtXvxjD4uM024DmU6+AsRMk6KgHoe+HUuo2Hc7E0QIapoU8v:3alFQ3XD4R021U6+AsRMHrgU2WE0yn8v
TLSH
T12DF15BA62FD6A876954322A977131F724F533CE43B70CAB03169DA28B95E11C2CDB436
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HamachiSetup.log

Path C:\Users\Admin\AppData\Local\Temp\HamachiSetup.log
Size 1KB
SHA256 ecbfac2da6f108158789c03e5e02010c541e52403fce9fe38e6779a4411805b5
MD5 a1dc202d50dcc9a5f3e9f9e3b346fd46
SHA1 f6ad50c7c171b057d94f44b05842cfb4d218350c
SHA512 34a0864101e49ee71d4d5391576e08229043286e638ecfc53e8cff697ff894301fb4f0c6a6fcb537cf3c71cc180b32e28ad93439ed8099b4287c1a64bf3791ed
TLSH
T10511D3A9AE13E47A207301A532622AF08F532CF53F31C6F03148E889758C69C1CFB565
MD5 SHA1 SHA512 TLSH

Submit Download

HamachiSetup.log

Path C:\Users\Admin\AppData\Local\Temp\HamachiSetup.log
Size 1KB
SHA256 dc1f3e89a6d3072b453c095b51d25a925646a8c7f4cd19a34646d1271dbe1382
MD5 40907e4bdf0bf67f30da18ff3bd486be
SHA1 b120d4b11c64e7aebc146c9803d3770ca309ec21
SHA512 2dcea554c70aa03ced9e8f71735bcbdabb17af4c351f256207a534f4624cc58acd5af9d3d3554ae9372f8231d21fe477a0ad0aa337bc2fc02895e6af5b747054
TLSH
T12221C399AE13E57A207301B533622AF0CF532CF43B31C6B03159D889B68C69C1CFB465
MD5 SHA1 SHA512 TLSH

Submit Download

HamachiSetup.log

Path C:\Users\Admin\AppData\Local\Temp\HamachiSetup.log
Size 2KB
SHA256 0beb12b65593186bc6264773019601e9f6c660c5f3a8089aa7865caa75a75a79
MD5 fd5b2203b144d20d0626f7da9c357870
SHA1 2ab3053043fb7c6601612671595afdd781f861b6
SHA512 0aaa726281cf4d5d0b8e92016e92be9c15ee2d6437c9e0140a0cc81bda179c6c2e97c9f56127d1f9843c9371cf9d33132a6adb3cf1c935febe942d02032571c1
TLSH
T124417A963B27A97A246751B537632FB0CF172CB43730D6B0366AD858368C29D1CEB036
MD5 SHA1 SHA512 TLSH

Submit Download

MSIC7CF.tmp

Path C:\Users\Admin\AppData\Local\Temp\MSIC7CF.tmp
Size 2.3MB
SHA256 21dd4954dfeb06327c4c4bd7207f1e30a26b0f3965dc139669748d1d0e8b6496
MD5 9f02c99b9f124a551413f7f46b2c1e93
SHA1 44df67b42d4383a4635b4770a186d04e390fb050
SHA512 f2c07af2c5a72051ad5aaa68c950686a8f6b821d6870273147bac556406c98e372696836d2625fcbccfbb7840ba4805bf7cbb5e4e03d8179069edf99e79bce74
SSDEEP 49152:v5gXnEwsd8nRMQoO6WG0DVM60C182W3xQSzYhqzcJaZv:v5gXnEd64dKDZDyxQq
TLSH
T1A2B5BF16FB82C4B2E9DE827C21AB97BE5D3D49248B34D5C38BD15DBDC8215C0A63E349
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e597288.msi

Path C:\Windows\Installer\e597288.msi
Size 14.1MB
SHA256 5c672c9a12b69b75b2cf25710bac8c579b3ef7ed1a907930dc0d7e20eab7584d
MD5 10a97df0c3683bfa90735fb289623591
SHA1 dd43515ddcdc8b94f440f047be3518d3d007be2c
SHA512 0e085163aa70281599f38c170e23f8d2f14501658e2d68b51a9110aedfa833065b7e3f9c2ff1f46bfa46bc70e3d404b7a7f1f9e8638cb0132edcadcdbdd55e5e
SSDEEP 393216:A/wOCz9pcjycZXoK+tSbtUtMfevXD7U9ZvzB0WPEpK/dLze7f:A9CgjycZYf+tihTo9z0WcE1C
TLSH
T167E6120ABA039A72D6DFBD7921977BBD18281F1C57E484C3C7A0757A8C315E8AD3B244
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

h2-engine.cfg

Path C:\Windows\ServiceProfiles\LocalService\AppData\Local\LogMeIn Hamachi\h2-engine.cfg
Size 1KB
SHA256 f589e577d4344b5ac6e58c2153a95e8d9dba81cd42f7760e007500bae5120564
MD5 b07f16a3eb1ab8bf26b6738701f35f06
SHA1 61cb01e3c2057075c3682b0e214a4f1ba0a6ef81
SHA512 78c3d982f4ffd5652371b258bae01f5ad96e5585b714a2ae74c859326def47bd78436c8505ce117883d8904c9da1a79f47896f75df92a0163ccf5ea39138c02c
TLSH
T10321799651107A6CF3CD89D5723ABC0ADD7D3083B9A9D1303C0D79C147392E22EBC864
MD5 SHA1 SHA512 TLSH

Submit Download

h2-engine.cfg.updating

Path C:\Windows\ServiceProfiles\LocalService\AppData\Local\LogMeIn Hamachi\h2-engine.cfg.updating
Size 7B
SHA256 27eb5e51506c911f6fc4bb345c0d9db6f60415fceab7c18e1e9b862637415777
MD5 0f81d52e06caaa4860887488d18271c7
SHA1 13a1891af75c642306a6b695377d16e4a91f0e1b
SHA512 7ccef1661d9bae2a1a219de1d53fea0e2441354e4e4c3e111f75bf926fb12c5b0e6e7824200cf65dfa5686216b9e67436038bdc69c7ea7621f3c67b481510cd7
MD5 SHA1 SHA512

Submit Download

h2-engine.log

Path C:\Windows\ServiceProfiles\LocalService\AppData\Local\LogMeIn Hamachi\h2-engine.log
Size 668B
SHA256 e300b315ee84e5ffb6832a9445a645bb47604389816263d2856611a397354545
MD5 b6402026c26790344db3b93902cdc9cb
SHA1 a013165bf29f06c0d9df9f0c19aa865bf1b13add
SHA512 5522b7d21174ea4a54a6a44252f9ced0ab6f7fa36f45053acaeba694295892a55a8794c7eb0591258836172ff4ecb030cd3a9d3adaff30746981e6c03f5338e8
TLSH
T19901F951A6C3C1F3186A66D8B5C393359B327856572BB3A02798D88EB7CD11F34F12B1
MD5 SHA1 SHA512 TLSH

Submit Download

h2-engine.log

Path C:\Windows\ServiceProfiles\LocalService\AppData\Local\LogMeIn Hamachi\h2-engine.log
Size 1KB
SHA256 c027cefdf8f9b70b6a56b5979c9242f2bb497642983470b336da647fb2996f14
MD5 56f4fac285523ddb860ab87210cb153d
SHA1 bbfd67af87b072b31ae709ec6bd66e0bf8922497
SHA512 408dfe5048bb4e6db780d0ae6a8c01f7fcb5bf788b0cc8749616df95a43f557b7d675fba957ecee5b860055ef8e1f72646d81b78109555d128ca450a6ab6c5e1
TLSH
T1C631CE5172C6D1F31C0623E47647433A6F367CA5A326B3E52AE4D4ADB7AC11E34E6231
MD5 SHA1 SHA512 TLSH

Submit Download

h2-engine.log

Path C:\Windows\ServiceProfiles\LocalService\AppData\Local\LogMeIn Hamachi\h2-engine.log
Size 2KB
SHA256 513face6e12f7368c8bb3434c7826987ab649ccd0aadc4acbb7abd3d9eb5c129
MD5 2f22eb5de65179cc6ca58ac77756f8b3
SHA1 a72ab796f88151500093901051b4d7cf4674e227
SHA512 9cca6faeb8aab76645524191adba06b5c5e43aa379b3b62657255c1441ab5dccc6d715ebd62a74373cacbfbe0c90ae22eb9223f1d6779a54c3a072ed3fe6e00d
TLSH
T1A251CC257AC2D0F3195667E57307033A2F323CA56325E3E526A8D0ADB7AC11E39E2132
MD5 SHA1 SHA512 TLSH

Submit Download

h2-engine.log

Path C:\Windows\ServiceProfiles\LocalService\AppData\Local\LogMeIn Hamachi\h2-engine.log
Size 3KB
SHA256 3a06797d1d0ff908bec23a504899fc2074663191d0ae6516e49fcac07e2360ba
MD5 406859adbae00306eb4fdf26baf41ef7
SHA1 0006fc7fba6b287b3b4c8bb08ca4a5b2d49a4c02
SHA512 111893b71345fe059429b26a41bec084ae3f5d37403f2d6ffb76c4e4aa743a46617d533a890f81488ea184eb4da1ab408ad62b80bf1fffae49fb95c61b44118c
TLSH
T1AA71ED213AC2D1B3189327D57317033A6F223CA55335E3E566A8D4ADB7AC00E39F2131
MD5 SHA1 SHA512 TLSH

Submit Download

h2-engine.log

Path C:\Windows\ServiceProfiles\LocalService\AppData\Local\LogMeIn Hamachi\h2-engine.log
Size 4KB
SHA256 ceeade3ac7bf41002fa3be9ea039124961d803d3dd18ca9616c152d846799198
MD5 838db64da955d9add88994d8c2c777b9
SHA1 028dd2f298e6b8a967cfb8b69c7877d3821b3ccd
SHA512 19fd407756caffa998ebf353131d51c9b72df743eb815d3931df759c6f80bb607b6c7bb70867d2cd7f2a2f311d156a8817cefd3bd3cdfb1f9a8cdbe0f1b5db1a
SSDEEP 96:VTxBWwGqxdERjHzDA72OnBfpuH2QFiS884mB:VNBWw3XwHzDO2kBQ2siS88NB
TLSH
T10491DA213AC2D1B3589363D57317033A2F267CA51739E3A579A8D4ACBBAC10E39F2135
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

h2-engine.log

Path C:\Windows\ServiceProfiles\LocalService\AppData\Local\LogMeIn Hamachi\h2-engine.log
Size 4KB
SHA256 ab0803645f12fff17f3761b9c1610c634bef042b31d7c41004e06ca4c094944b
MD5 ace1e6368c1b1364bfd469b6329b2fee
SHA1 31190cf2d25b9aad59fda30ae4ceeaf25377e0f5
SHA512 dcf6602ccff0ad589838b710c28a3063529fe61d72e346c8a37c95b64f9bc7ad3128f1cae79e7b62e82ef4f100b7489711947c4b62fa1c44433a831687ae353e
SSDEEP 96:VTxBWwGqxdERjHzDA72OnBfpuH2QFiS884mZ:VNBWw3XwHzDO2kBQ2siS88NZ
TLSH
T19891DA613AC2D1B3589363D57317033A2F227CA51739E3A579A8D4ACBBAC10E39F2135
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hamdrv.inf_amd64_c59072ec40c0c372.ini

Path C:\Windows\System32\DriverStore\FileRepository\hamdrv.inf_amd64_c59072ec40c0c372.ini
Size 412B
SHA256 baacd80020dfbcf716ffcdf2ffa10d24b25dec76f66d9425039f9d7a1874c421
MD5 b555be9b0336a6ff597172aa99888fd2
SHA1 3779cba233a590d141fdef7259bec9767cd8172e
SHA512 800777509d7abd4b20c37457e7291d9c986bc059242d5587e5a76efba6049c9eb898508edf55edd514d542fb63b9bf22c3697bda7b3e655f92fdc9890a725655
TLSH
T157E09B1661B9CCD58415B403F33C6BBE8442F3A49CB39AF5334455001F159595D9EB5B
MD5 SHA1 SHA512 TLSH

Submit Download

HamachiSetup.log

Path C:\Windows\Temp\HamachiSetup.log
Size 208B
SHA256 30ef5096a639f0d5f0f4af27d14afe8e1d683967eae54a2b9fa99bf85761d24e
MD5 b9c0f3e818077dbf6cd3cdc905f0760c
SHA1 d45f8ab60aa0888f3ca7db00f3be1e564d864862
SHA512 afc5faa11dcba06b654b2dfe17b848cc09d5049bda09a49779fbf8d6a4c10999828b69b0c168802e4b96fa06dc46642512834a8b1586f5f786da0f0c602c2fae
TLSH
T199D0C9264598C2B608C10790F38933721A976E8113698F103AA4F48CA41A0CB70BBEE1
MD5 SHA1 SHA512 TLSH

Submit Download

HamachiSetup.log

Path C:\Windows\Temp\HamachiSetup.log
Size 959B
SHA256 3c48c0da71b0a4d36670ea4bc7a48bfd268fbcef1a7f81861c3e6543ce00cee0
MD5 a9fefec49562298772c99074fa7a3fb4
SHA1 f5735037a2d1988f6707c2460c43cf18c0e99dbe
SHA512 69eeafe36a888f95cc8958317e9d83fef48e198275cbd8bb7e21a65ab2e0404e55890c19a95268a53febf9e3a1d562ba6a6ab092b286614d62b1462186f71251
TLSH
T18C11082545DAC0F704490BE87BCF9332462BBD94536DAF542BA8E10DB2CA88D20F59E2
MD5 SHA1 SHA512 TLSH

Submit Download

HamachiSetup.log

Path C:\Windows\Temp\HamachiSetup.log
Size 1KB
SHA256 dc35aeaac9f83b0fb20713ad6f9228dab015fbb0f61ffa962dc33ae6bb1bdb10
MD5 bea0bbfcbe3b8979dceab6b23a7fef5c
SHA1 b67ce7a8bfcde8550baa00442def6446a256d1f5
SHA512 6fec7cfe60814ae0a3123180841d51647f0657d3636f5cc9befabb24651a3739caaeb5e83cc47822178d751516e4877bffe5b59803aecb668e061eba87d852df
TLSH
T1F841591615D7C0F3440917E87ACB9332473BBDD95329EB542BA8E10DB2DA98E20F65F1
MD5 SHA1 SHA512 TLSH

Submit Download

3E3E9689537B6B136ECF210088069D55_EF6C9357BB54DDB629FD2D79F1594F95

Path C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3E3E9689537B6B136ECF210088069D55_EF6C9357BB54DDB629FD2D79F1594F95
Size 727B
SHA256 b7a30abe475319244fbfcc7827ae5f92fe58a30fdd7b7d613ee21785a3c259cf
MD5 c982f4462af37fed4f7596d2a126ad90
SHA1 4c6ba2e7036d93fe176343829a419a3e1915104b
SHA512 732fc7bd0d9c9b1cb39aeed92d14cfaf0446890744a08173602a9d06af13ef977254f0817e172b06f5ff2618ed6c530d86ebc3168ee614b905ccf274ef4a171e
TLSH
T12D01991559CC5C391D55B9240DF74FB91211C0C91F981D5F2531987C11CAFA21B58054
MD5 SHA1 SHA512 TLSH

Submit Download

698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB

Path C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
Size 471B
SHA256 835e9be2b8d2d214a2702f3a8d5b7612724a634004e528d5d0b8287fc68913dd
MD5 71d1eb07d558d995da8100417543a2b5
SHA1 05d1d35fc2f173b4948c24e36f498736d47b8430
SHA512 5970236e6b9f949a33032e144317efc884eb6073fc3642d6a235bae4939becb3490d4d19eafe13c2d813be7ddb7bf20428ae5b9c2f53f2ae3beee9b5cefd4dda
TLSH
T134F0D47FDCBC38B1590E547C3DFDC6507CA0A04C48A3443936BD38E45957A92AB5E81D
MD5 SHA1 SHA512 TLSH

Submit Download

8EC9B1D0ABBD7F98B401D425828828CE_325DC716E4289E0AE281439314ED4BFA

Path C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_325DC716E4289E0AE281439314ED4BFA
Size 727B
SHA256 7d891daf4679335bccd1f67683339c720918878a0f83ad82586f0758a8662d16
MD5 0b96bad89341a41cb91b5e1f2d2333bb
SHA1 a39bd873de74f5ffc2d259c4bb774ed09e33fa82
SHA512 388059e210bbbb59e5c49f0d11530edc98a9f643c35b55d28853dff89ed90f61d8b52a14c33ac2624ffb4093583123137cc852022f55235dd3268345954b53ad
TLSH
T1190199008FAD33489D40CA941EEF27D0F18416E281C7801A217D8596E798BD38D4410C
MD5 SHA1 SHA512 TLSH

Submit Download

C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141

Path C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
Size 727B
SHA256 bd76d6729ade01c2f3f2c1b03ee9b9b877521e73a668a58cfac63e7684aad19f
MD5 74700b6f42358773d7f90406e6420211
SHA1 09b235f714b2b90ef876fc42eb4ec547c2e3851a
SHA512 66510aeb34e50cb646f936d9dcff365f44715998eceaedf2c0b7e869aa2cc178723968482c37274244e544ccff57eb51f9469328f3a427047f8f5af1d9e56be2
TLSH
T1130199E3DC58D6F03D502F268BBCE5507177D45E31E582713ED4408F547E0351E89544
MD5 SHA1 SHA512 TLSH

Submit Download

C8E534EE129F27D55460CE17FD628216_56DB209C155B5A05FCBF555DF7E6D1BB

Path C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C8E534EE129F27D55460CE17FD628216_56DB209C155B5A05FCBF555DF7E6D1BB
Size 727B
SHA256 d2354c848645c81293e5966cea60d2293939332cf7043948307317882019818e
MD5 427f9181225e137fad56e0f8c77267d9
SHA1 ef789a80fb7910f1f49fab946ccdde971826e0c5
SHA512 7bfddca89b2aa9556226d2a2cfb8176701af21e88c94d27153accdfdfd3065e22a527633639cbabdd0c6c286bb44ca5b718bf8e0aac9e49c825e02982780ba25
TLSH
T1EB01155358523E816C004A1A8F94EA25D116369418D6C8B73A6C419F15E47F17B19C94
MD5 SHA1 SHA512 TLSH

Submit Download

3E3E9689537B6B136ECF210088069D55_EF6C9357BB54DDB629FD2D79F1594F95

Path C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3E3E9689537B6B136ECF210088069D55_EF6C9357BB54DDB629FD2D79F1594F95
Size 416B
SHA256 1c6df61906254fd1a8c9656475a8a4896d53d621f6bf932cd803f6154bb1e6d5
MD5 6150d426ba59912bbf17ae87cca58a9e
SHA1 293c009ad7542669f670d8043462910ee3e8b62b
SHA512 89a5a48d2a84e3e283e7e5c91b84daa89fcd4ae657798024aa3cb897f66dc714a1d36cffd3156a8ddeda63ccaa77c2662c7de298c4767ff5283c0c88295a752b
TLSH
T117E06F2C32B511A8F5A0CC3807EEAAB0096EB036EA3803742AC04F22FA15701AC12676
MD5 SHA1 SHA512 TLSH

Submit Download

698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB

Path C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
Size 400B
SHA256 629920e23424e1b433f9f70e2fbd6f0c835951bf1052c892c8bb422e627752f4
MD5 1dadff9fea72b236997188458fdec18a
SHA1 c6d289bddeaa1381ebd591de3ff531bb3a654267
SHA512 c6c669b66f87317e01fcad3c097ccadda1042cd7d54f8b1fd6b577c18344fb683f129b6be4c7f69806b764253a6e2b99a936057e13e1e7b4ecca3b828b626237
TLSH
T1E3E0C03013FA012EF1608B3403C4A0955F26F0136C8491BE1EC2151C94099105C52C30
MD5 SHA1 SHA512 TLSH

Submit Download

8EC9B1D0ABBD7F98B401D425828828CE_325DC716E4289E0AE281439314ED4BFA

Path C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_325DC716E4289E0AE281439314ED4BFA
Size 408B
SHA256 47e02ad87025ecde849914fec6912d41a9ccd65d853e23143edcf086be61eb8e
MD5 64c5d7e86c462a669502bcfecce5a9d4
SHA1 108219e11a72b1571bed3654a67240f6cbc36c56
SHA512 cbc3aaaac674b890045e28cfc5af55d39f57c8e055497d5d2d2888096791b1635c3c17aed1a428fe9370d8eae81d2782041e6d1d02974b97998afe55802ecb76
TLSH
T10CE0203821F9459DF0F4D43443F56A222F65F7199989C36926D05715E624B406CE2770
MD5 SHA1 SHA512 TLSH

Submit Download

C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141

Path C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
Size 412B
SHA256 b41f6c7c13a0eca36134ccb67d04761bf8f14c79f76d478f0fb0a0600a859f65
MD5 4bce821a68be9ff42cf93ec3b91ccfcd
SHA1 760130635b3d16067abf6a01a7a24e687f76b3d6
SHA512 9dc76424dbcbe08b6c331b43ca7cd02100c16cfa2befb2272f5eacf4e3f647f7a15a1b161c6dae49dada7fff6e002c2ca85fef96891c19c7ab6a23eee3c6933d
TLSH
T1CEE0683C11EBF14EF060C83142F5A1751E59E7105440C3B90AC00718A70AF005D10AF1
MD5 SHA1 SHA512 TLSH

Submit Download

C8E534EE129F27D55460CE17FD628216_56DB209C155B5A05FCBF555DF7E6D1BB

Path C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_56DB209C155B5A05FCBF555DF7E6D1BB
Size 412B
SHA256 490b6f6165bb8f4be0ff1b9784671cb8cbc835e21c63813546fd3e8f0b74c008
MD5 1d92c74808276525aa35d4d3fbc6f5d0
SHA1 13c1488ddad11d782d0065835643e9c105d6a54f
SHA512 3b97856fce6c23c4594c420cf7d0c7462009d54c328c666182fe7435c0a53baa8d70eebb37ac8c3f60c613baa29860d28172e1e17d1e6b58996120a9e4807fcd
TLSH
T10BE0C03C11AF599EF068CD3446F5BA351E04F3114844967B2AD10314E75AF00AD206F0
MD5 SHA1 SHA512 TLSH

Submit Download

metadata-2

Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
Size 26.1MB
SHA256 ba1a7607411285e6f54a01f4410504d49aeb90f4f9f8199496df64ec9e98a5f0
MD5 601d31aa43b63e4fd7ead35fac6ba718
SHA1 3c91c335bc41130347ce0d1a63b6167df842f9f5
SHA512 9eae8952ad4ad65bc41a04ae324a75014a94bdb3eba6dd2511729b2928c128dfeaaa8b1729fb9e8f6a0dbfa919cc25f4f8ac700cda53ac4b936f8d8d09a31875
SSDEEP 24576:CFo3DMPrdoO/vvTL/igWWyFgPbuMdLxlULwEd7I+gDY65hX2cYBmWPMXyuw:kH4
TLSH
T17E57901436F92150E7F79E3CA8F0AA2349397D5B9C1ADE8D05411F4E0861FB1E872F6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{1c4ce3a3-e52e-4948-a6eb-6e2c08081f8a}_OnDiskSnapshotProp

Path \??\Volume{f0fdc120-0000-0000-0000-d08302000000}\System Volume Information\SPP\OnlineMetadataCache\{1c4ce3a3-e52e-4948-a6eb-6e2c08081f8a}_OnDiskSnapshotProp
Size 6KB
SHA256 ee5e48482632d97e530a923c316c5f544acfb05c4e3add8fb678e2c90b845fbc
MD5 bc16b9c4e56758e89555f6204a8da19e
SHA1 b5ce70fd3bf32be5beb4762ae97bf275e1564ca2
SHA512 7f6add7ae75a3617b493887828f454c8986eed21098320b1de2738350c2c25c56dbe1872eb136dd08aa942d937e8ed3351a533f0c4573a207ab37f0cb1ce3b39
SSDEEP 96:FNsq+yvc6DD84LTHzbOHXOHBlBRQn8Sc9XE56tOSVQpu:gkb++uVm
TLSH
T1E7D189185AF54711E2B3AB7128F18557A877B811EF33CB8E0198238E6670A10F975F5B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Hamdrv.sys

Path \??\c:\PROGRA~2\LOGMEI~1\x64\Hamdrv.sys
Size 44KB
SHA256 4b576903a83f33a8cf31d3887144a3d51c56d1187115c83ac99c0e9f6b4bf128
MD5 7f79205b4efa98f0767309479c8c01c6
SHA1 9d546dda7536a85a3f4228e065967be1648ad901
SHA512 418ac89f3c5996de50c846693995145e314d0cd7edee59f0cdc212720d84be1351827c7ab02e870d1940288f5c4838d39c77fbc9847b69ab5fce5d74400c19ca
SSDEEP 768:YCMEBIRBvJnaUnrZGI71bgw16vkWPVqRxO2EpUwwRbT3zf66Y++:1hIRBLFgw16vkWtqzPwwRbTjy6X+
TLSH
T187237D5666BC44ABD19BD174E3A58F83EBB0B046070197DF0BA4C6A93F233D1923D726
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hamdrv.cat

Path \??\c:\program files (x86)\logmein hamachi\x64\hamdrv.cat
Size 10KB
SHA256 e436ceef0126e703fe48bd669e3748e468b6f8027a8b6c2ae779f2911e65331c
MD5 f49c69fcca067884f38e9cab20ba8920
SHA1 bbe2113cfeb8b9a2234d97849c05c4a72b368a7d
SHA512 e233dc261ea650d0cc01834591ba5c7e113daa23da7ada913c589ddff13c7d5b946da5f3f649e81de9afa664d0c4bf5b6fc921e359c252dee5132c8f584c60d3
SSDEEP 192:EORSJjdghv9gFEwianVThYCWrIcqnajMHxxBNT068bcz5P:E3HnVTh3YIclI668bs
TLSH
T1732227A150AC44C3DD836C6023ACFE877C3EA7DB582094A925AFFA992D937C1F70546C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hamdrv.inf

Path \??\c:\program files (x86)\logmein hamachi\x64\hamdrv.inf
Size 6KB
SHA256 35e3427711eb7e0645d3f4ffbc3dd73b16e96ef1dc4c210db1f67229283f414a
MD5 da79247b2ba817d655c2db44bdebff1c
SHA1 fb62be8194096675dace18cd1217217ec2f85777
SHA512 e124e5bce81d09713b959a54da96ca7679b9880e69952faef360c7f0311a6d85a97d377281edbae22e61f7e3204847fb4eafd64a15aa97079bf9cda2cf1f0328
SSDEEP 96:kbMWRMtGOuj4ShIgfH6/1P1vYvkFgtm434s:kgWRMtGOuVPc1tvYv1
TLSH
T15CD16012A6DD1608F1F36A8496F59526DB63B854983C8E4D00EC424F1BEFE808D63FA7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads