3723998a293f21bebfbd405bfa55c9eeb07e6587d330a78186e375a8e596a35e

Analysis

user interaction
yes
max time kernel
56s
max time network
47s
platform
windows11-21h2_x64
resource
win11-20260911-en
resource tags

arch:x64arch:x86image:win11-20260911-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
27/10/2026, 12:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
svt.exe
Size 4.5MB
Sample261027-pxhmhatyct
SHA256 3723998a293f21bebfbd405bfa55c9eeb07e6587d330a78186e375a8e596a35e
MD5 d312eb7efbe2935eea6be2d3f3dc4329
SHA1 e14b4e26591f3822e1b5f7d12a4e825b131b61b3
SHA512 75cc51e16ea1513f0f101f1c71cb3c9da78620b0ab75e322efb05635eefa408284a0e977ff133eec758ec3cb473eb3352ccdbbf417cd27523767f9c7c9c2d645
SSDEEP 49152:ZSyrMfjzTdFTAp3NWlTXgt53iDViQK9m93pKngt53iDViQK9m93pKl+cKb0aztfP:Bo/spw63iUQKU73iUQKU+9KAaz1UjT
TLSH
T1A8260221B6A541DDD2BBE1B48B376907E7723442173065EB02D089AE1F37AD14E7FB22
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery persistence spyware trojan

Malware Config

Signatures

Drops file in Drivers directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\drmk.sys	DrvInst.exe
File opened for modification	C:\Windows\System32\drivers\portcls.sys	DrvInst.exe

Executes dropped EXE 1 IoCs

pid	Process
5456	VBCABLE_Setup_x64.exe

Contacts third-party web service commonly abused for C2 1 TTPs 5 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
25	discord.com
26	discord.com
28	discord.com
31	discord.com
39	discord.com

Drops file in System32 directory 16 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\DriverStore\Temp\{60dc1d6a-aa6b-aa42-b0a7-1ec3679ea9f7}\vbaudio_cable64_win10.sys	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{60dc1d6a-aa6b-aa42-b0a7-1ec3679ea9f7}\SET4E18.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{60dc1d6a-aa6b-aa42-b0a7-1ec3679ea9f7}\vbmmecable64_win10.inf	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{60dc1d6a-aa6b-aa42-b0a7-1ec3679ea9f7}\SET4E17.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\vbmmecable64_win10.inf_amd64_dd707570a4bf06fd\vbaudio_cable64_win10.sys	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\vbmmecable64_win10.inf_amd64_dd707570a4bf06fd\vbmmecable64_win10.inf	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{60dc1d6a-aa6b-aa42-b0a7-1ec3679ea9f7}	DrvInst.exe
File created	C:\Windows\System32\DriverStore\FileRepository\vbmmecable64_win10.inf_amd64_dd707570a4bf06fd\vbmmecable64_win10.PNF	VBCABLE_Setup_x64.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{60dc1d6a-aa6b-aa42-b0a7-1ec3679ea9f7}\SET4E07.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{60dc1d6a-aa6b-aa42-b0a7-1ec3679ea9f7}\SET4E07.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{60dc1d6a-aa6b-aa42-b0a7-1ec3679ea9f7}\vbaudio_cable64_win10.cat	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\vbmmecable64_win10.inf_amd64_dd707570a4bf06fd\vbaudio_cable64_win10.cat	DrvInst.exe
File opened for modification	C:\Windows\System32\CatRoot2\dberr.txt	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{60dc1d6a-aa6b-aa42-b0a7-1ec3679ea9f7}\SET4E18.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\drvstore.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{60dc1d6a-aa6b-aa42-b0a7-1ec3679ea9f7}\SET4E17.tmp	DrvInst.exe

Drops file in Program Files directory 10 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\VB\CABLE\vbMmeCable64_win10.inf	VBCABLE_Setup_x64.exe
File created	C:\Program Files\VB\CABLE\VBCABLE_Setup_x64.exe	VBCABLE_Setup_x64.exe
File opened for modification	C:\Program Files\VB\CABLE\VBCABLE_Setup_x64.exe	VBCABLE_Setup_x64.exe
File opened for modification	C:\Program Files\VB\CABLE\VBCABLE_ControlPanel.exe	VBCABLE_Setup_x64.exe
File opened for modification	C:\Program Files\VB\CABLE\pin_in.ico	VBCABLE_Setup_x64.exe
File created	C:\Program Files\VB\CABLE\vbMmeCable64_win10.inf	VBCABLE_Setup_x64.exe
File created	C:\Program Files\VB\CABLE\VBCABLE_ControlPanel.exe	VBCABLE_Setup_x64.exe
File created	C:\Program Files\VB\CABLE\pin_in.ico	VBCABLE_Setup_x64.exe
File created	C:\Program Files\VB\CABLE\pin_out.ico	VBCABLE_Setup_x64.exe
File opened for modification	C:\Program Files\VB\CABLE\pin_out.ico	VBCABLE_Setup_x64.exe

Drops file in Windows directory 6 IoCs

description	ioc	Process
File opened for modification	C:\Windows\INF\setupapi.dev.log	svchost.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File opened for modification	C:\Windows\inf\oem3.inf	DrvInst.exe
File created	C:\Windows\inf\oem3.inf	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	VBCABLE_Setup_x64.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	svt.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	svt.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2040	msedge.exe

Checks SCSI registry key(s) 3 TTPs 42 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID	VBCABLE_Setup_x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	VBCABLE_Setup_x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	VBCABLE_Setup_x64.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	VBCABLE_Setup_x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Phantom	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	VBCABLE_Setup_x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\CompatibleIDs	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\CompatibleIDs	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	VBCABLE_Setup_x64.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	VBCABLE_Setup_x64.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\CompatibleIDs	VBCABLE_Setup_x64.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	VBCABLE_Setup_x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom	VBCABLE_Setup_x64.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\CompatibleIDs	VBCABLE_Setup_x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Phantom	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom	VBCABLE_Setup_x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	VBCABLE_Setup_x64.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs	VBCABLE_Setup_x64.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs	VBCABLE_Setup_x64.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	VBCABLE_Setup_x64.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 41 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	DrvInst.exe

Modifies system certificate store 2 TTPs 8 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\8094640EB5A7A1CA119C1FDDD59F810263A7FBD1\Blob = 0400000001000000100000004fdd07e4d42264391e0c3742ead1c6ae0f0000000100000030000000ea09c51d4c3a334ce4acd2bc08c6a9be352e334f45c4fccfcab63edb9f82dc87d4bd2ed2fadae11163fb954809984ff153000000010000007e000000307c301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0301f06092b06010401a032010230123010060a2b0601040182373c0101030200c0301b060567810c010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000056000000305406082b0601050507030206082b06010505070303060a2b0601040182370a030c060a2b0601040182370a030406082b0601050507030406082b0601050507030906082b0601050507030106082b060105050703080b000000010000003000000047006c006f00620061006c005300690067006e00200052006f006f00740020004300410020002d0020005200360000006200000001000000200000002cabeafe37d06ca22aba7391c0033d25982952c453647349763a3ab5ad6ccf697f0000000100000016000000301406082b0601050507030306082b06010505070309140000000100000014000000ae6c05a39313e2a2e7e2d71cd6c7f07fc86753a01d0000000100000010000000521f5c98970d19a8e515ef6eeb6d48ef7a000000010000000c000000300a06082b060105050703097e00000001000000080000000080c82b6886d7010300000001000000140000008094640eb5a7a1ca119c1fddd59f810263a7fbd1190000000100000010000000cb9dd0fceaaa492f75ce292c21bbfbdd200000000100000087050000308205833082036ba003020102020e45e6bb038333c3856548e6ff4551300d06092a864886f70d01010c0500304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523631133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e301e170d3134313231303030303030305a170d3334313231303030303030305a304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523631133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e30820222300d06092a864886f70d01010105000382020f003082020a02820201009507e873ca66f9ec14ca7b3cf70d08f1b4450b2c82b448c6eb5b3cae83b841923314a46f7fe92accc6b0886bc5b689d1c6b2ff14ce511421ec4add1b5ac6d687ee4d3a1506ed64660b9280ca44de73944ef3a7897f4f786308c812506d42662f4db979284d521a8a1a80b719810e7ec48abc644c211c4368d73d3c8ac5b266d5909ab73106c5bee26d3206a61ef9b9ebaaa3b8bfbe826350d0f01889dfe40f79f5eaa21f2ad2702e7be7bc93bb6d53e2487c8c100738ff66b277617ee0ea8c3caab4a4f6f3954a12076dfd8cb289cfd0a06177c85874b0d4233af75d3acaa2db9d09de5d442d90f181cd5792fa7ebc50046334df6b9318be6b36b239e4ac2436b7f0efb61c135793b6deb2f8e285b773a2b835aa45f2e09d36a16f548af172566e2e88c55142441594eea3c538969b4e4e5a0b47f30636497730bc7137e5a6ec210875fce661163f77d5d99197840a6cd4024d74c014edfd39fb83f25e14a104b00be9feee8fe16e0bb208b36166096ab1063a659659c0f035fdc9da288d1a118770810aa89a751d9e3a8605009edb80d625f9dc059e27594c76395beaf9a5a1d8830fd1ffdf3011f985cf3348f5ca6d64142c7a584fd34b0849c595641a630e793df5b38cca58ad9c4245796e0e87195c54b165b6bf8c9bdc13e90d6fb82edc676ec98b11b584148a0019708379919791d41a27bf371e3207d814633c284caf0203010001a3633061300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e04160414ae6c05a39313e2a2e7e2d71cd6c7f07fc86753a0301f0603551d23041830168014ae6c05a39313e2a2e7e2d71cd6c7f07fc86753a0300d06092a864886f70d01010c050003820201008325ede8d1fd9552cd9ec004a09169e65cd084dedcada24fe84778d66598a95ba83c877c028ad16eb71673e65fc05498d574bec1cde21191ad23183ddde1724496b4955ec07b8e99781643135657b3a2b33bb577dc4072aca3eb9b353eb10821a1e7c443377932beb5e79c2c4cbc4329998e30d3ac21e0e31dfad80733765400222ab94d202e7068dae553fc835cd39df2ff440c4466f2d2e3bd46001a6d02ba255d8da13151dd54461c4ddb9996ef1a1c045ca615ef78e079fe5ddb3eaa4c55fd9a15a96fe1a6fbdf7030e9c3ee4246edc2930589fa7d637b3fd071817c00e898ae0e7834c325fbaf0a9f206bdd3b138f128ce2411a487a73a07769c7b65c7f82c81efe581b282ba86cad5e6dc005d27bb7eb80fe2537fe029b68ac425dc3eef5ccdcf05075d236699ce67b04df6e0669b6de0a09485987eb7b14607a64aa6943ef91c74cec18dd6cef532d8c99e15ef2723ecf54c8bd67eca40f4c45ffd3b93023074c8f10bf8696d9995ab499571ca4ccbb158953ba2c050fe4c49e19b11834d54c9dbaedf71faf24950478a803bbee81e5da5f7c8b4aa1907425a7b33e4bc82c56bdc7c8ef38e25c92f079f79c84ba742d6101207e7ed1f24f07595f8b2d4352eb460c94e1f566477977d5545b1fad2437cb455a4ea04448c8d8b099c5158409f6d64949c065b8e61a716ea0a8f182e8453e6cd602d70a6783055ac9a410	svt.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\8094640EB5A7A1CA119C1FDDD59F810263A7FBD1\Blob = 5c000000010000000400000000100000190000000100000010000000cb9dd0fceaaa492f75ce292c21bbfbdd0300000001000000140000008094640eb5a7a1ca119c1fddd59f810263a7fbd17e00000001000000080000000080c82b6886d7017a000000010000000c000000300a06082b060105050703091d0000000100000010000000521f5c98970d19a8e515ef6eeb6d48ef140000000100000014000000ae6c05a39313e2a2e7e2d71cd6c7f07fc86753a07f0000000100000016000000301406082b0601050507030306082b060105050703096200000001000000200000002cabeafe37d06ca22aba7391c0033d25982952c453647349763a3ab5ad6ccf690b000000010000003000000047006c006f00620061006c005300690067006e00200052006f006f00740020004300410020002d002000520036000000090000000100000056000000305406082b0601050507030206082b06010505070303060a2b0601040182370a030c060a2b0601040182370a030406082b0601050507030406082b0601050507030906082b0601050507030106082b0601050507030853000000010000007e000000307c301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0301f06092b06010401a032010230123010060a2b0601040182373c0101030200c0301b060567810c010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f0000000100000030000000ea09c51d4c3a334ce4acd2bc08c6a9be352e334f45c4fccfcab63edb9f82dc87d4bd2ed2fadae11163fb954809984ff10400000001000000100000004fdd07e4d42264391e0c3742ead1c6ae200000000100000087050000308205833082036ba003020102020e45e6bb038333c3856548e6ff4551300d06092a864886f70d01010c0500304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523631133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e301e170d3134313231303030303030305a170d3334313231303030303030305a304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523631133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e30820222300d06092a864886f70d01010105000382020f003082020a02820201009507e873ca66f9ec14ca7b3cf70d08f1b4450b2c82b448c6eb5b3cae83b841923314a46f7fe92accc6b0886bc5b689d1c6b2ff14ce511421ec4add1b5ac6d687ee4d3a1506ed64660b9280ca44de73944ef3a7897f4f786308c812506d42662f4db979284d521a8a1a80b719810e7ec48abc644c211c4368d73d3c8ac5b266d5909ab73106c5bee26d3206a61ef9b9ebaaa3b8bfbe826350d0f01889dfe40f79f5eaa21f2ad2702e7be7bc93bb6d53e2487c8c100738ff66b277617ee0ea8c3caab4a4f6f3954a12076dfd8cb289cfd0a06177c85874b0d4233af75d3acaa2db9d09de5d442d90f181cd5792fa7ebc50046334df6b9318be6b36b239e4ac2436b7f0efb61c135793b6deb2f8e285b773a2b835aa45f2e09d36a16f548af172566e2e88c55142441594eea3c538969b4e4e5a0b47f30636497730bc7137e5a6ec210875fce661163f77d5d99197840a6cd4024d74c014edfd39fb83f25e14a104b00be9feee8fe16e0bb208b36166096ab1063a659659c0f035fdc9da288d1a118770810aa89a751d9e3a8605009edb80d625f9dc059e27594c76395beaf9a5a1d8830fd1ffdf3011f985cf3348f5ca6d64142c7a584fd34b0849c595641a630e793df5b38cca58ad9c4245796e0e87195c54b165b6bf8c9bdc13e90d6fb82edc676ec98b11b584148a0019708379919791d41a27bf371e3207d814633c284caf0203010001a3633061300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e04160414ae6c05a39313e2a2e7e2d71cd6c7f07fc86753a0301f0603551d23041830168014ae6c05a39313e2a2e7e2d71cd6c7f07fc86753a0300d06092a864886f70d01010c050003820201008325ede8d1fd9552cd9ec004a09169e65cd084dedcada24fe84778d66598a95ba83c877c028ad16eb71673e65fc05498d574bec1cde21191ad23183ddde1724496b4955ec07b8e99781643135657b3a2b33bb577dc4072aca3eb9b353eb10821a1e7c443377932beb5e79c2c4cbc4329998e30d3ac21e0e31dfad80733765400222ab94d202e7068dae553fc835cd39df2ff440c4466f2d2e3bd46001a6d02ba255d8da13151dd54461c4ddb9996ef1a1c045ca615ef78e079fe5ddb3eaa4c55fd9a15a96fe1a6fbdf7030e9c3ee4246edc2930589fa7d637b3fd071817c00e898ae0e7834c325fbaf0a9f206bdd3b138f128ce2411a487a73a07769c7b65c7f82c81efe581b282ba86cad5e6dc005d27bb7eb80fe2537fe029b68ac425dc3eef5ccdcf05075d236699ce67b04df6e0669b6de0a09485987eb7b14607a64aa6943ef91c74cec18dd6cef532d8c99e15ef2723ecf54c8bd67eca40f4c45ffd3b93023074c8f10bf8696d9995ab499571ca4ccbb158953ba2c050fe4c49e19b11834d54c9dbaedf71faf24950478a803bbee81e5da5f7c8b4aa1907425a7b33e4bc82c56bdc7c8ef38e25c92f079f79c84ba742d6101207e7ed1f24f07595f8b2d4352eb460c94e1f566477977d5545b1fad2437cb455a4ea04448c8d8b099c5158409f6d64949c065b8e61a716ea0a8f182e8453e6cd602d70a6783055ac9a410	svt.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D69B561148F01C77C54578C10926DF5B856976AD	svt.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D69B561148F01C77C54578C10926DF5B856976AD\Blob = 040000000100000010000000c5dfb849ca051355ee2dba1ac33eb0280f00000001000000200000005229ba15b31b0c6f4cca89c2985177974327d1b689a3b935a0bd975532af22ab090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b06010505070308530000000100000040000000303e301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00b000000010000003000000047006c006f00620061006c005300690067006e00200052006f006f00740020004300410020002d002000520033000000620000000100000020000000cbb522d7b7f127ad6a0113865bdf1cd4102e7d0759af635a7cf4720dc963c53b1400000001000000140000008ff04b7fa82e4524ae4d50fa639a8bdee2dd1bbc1d000000010000001000000001728e1ecf7a9d86fb3cec8948aba953030000000100000014000000d69b561148f01c77c54578c10926df5b856976ad190000000100000010000000d0fd3c9c380d7b65e26b9a3fedd39b8f2000000001000000630300003082035f30820247a003020102020b04000000000121585308a2300d06092a864886f70d01010b0500304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523331133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e301e170d3039303331383130303030305a170d3239303331383130303030305a304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523331133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e30820122300d06092a864886f70d01010105000382010f003082010a0282010100cc2576907906782216f5c083b684ca289efd057611c5ad8872fc460243c7b28a9d045f24cb2e4be1608246e152ab0c8147706cdd64d1ebf52ca30f823d0c2bae97d7b614861079bb3b1380778c08e149d26a622f1f5efa9668df892795389f06d73ec9cb26590d73deb0c8e9260e8315c6ef5b8bd20460ca49a628f6693bf6cbc82891e59d8a615737ac7414dc74e03aee722f2e9cfbd0bbbff53d00e10633e8822bae53a63a16738cdd410e203ac0b4a7a1e9b24f902e3260e957cbb904926868e538266075b29f77ff9114efae2049fcad401548d1023161195eb897efad77b7649a7abf5fc113ef9b62fb0d6ce0546916a903da6ee983937176c6698582170203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e041604148ff04b7fa82e4524ae4d50fa639a8bdee2dd1bbc300d06092a864886f70d01010b050003820101004b40dbc050aafec80ceff796544549bb96000941acb3138686280733ca6be674b9ba002daea40ad3f5f1f10f8abf73674a83c7447b78e0af6e6c6f03298e333945c38ee4b9576caafc1296ec53c62de4246cb99463fbdc536867563e83b8cf3521c3c968fecedac253aacc908ae9f05d468c95dd7a58281a2f1ddecd0037418fed446dd75328977ef367041e15d78a96b4d3de4c27a44c1b737376f41799c21f7a0ee32d08ad0a1c2cff3cab550e0f917e36ebc35749bee12e2d7c608bc3415113239dcef7326b9401a899e72c331f3a3b25d28640ce3b2c8678c9612f14baeedb556fdf84ee05094dbd28d872ced36250651eeb92978331d9b3b5ca47583f5f	svt.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D69B561148F01C77C54578C10926DF5B856976AD\Blob = 5c000000010000000400000000080000190000000100000010000000d0fd3c9c380d7b65e26b9a3fedd39b8f030000000100000014000000d69b561148f01c77c54578c10926df5b856976ad1d000000010000001000000001728e1ecf7a9d86fb3cec8948aba9531400000001000000140000008ff04b7fa82e4524ae4d50fa639a8bdee2dd1bbc620000000100000020000000cbb522d7b7f127ad6a0113865bdf1cd4102e7d0759af635a7cf4720dc963c53b0b000000010000003000000047006c006f00620061006c005300690067006e00200052006f006f00740020004300410020002d002000520033000000530000000100000040000000303e301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f00000001000000200000005229ba15b31b0c6f4cca89c2985177974327d1b689a3b935a0bd975532af22ab040000000100000010000000c5dfb849ca051355ee2dba1ac33eb0282000000001000000630300003082035f30820247a003020102020b04000000000121585308a2300d06092a864886f70d01010b0500304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523331133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e301e170d3039303331383130303030305a170d3239303331383130303030305a304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523331133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e30820122300d06092a864886f70d01010105000382010f003082010a0282010100cc2576907906782216f5c083b684ca289efd057611c5ad8872fc460243c7b28a9d045f24cb2e4be1608246e152ab0c8147706cdd64d1ebf52ca30f823d0c2bae97d7b614861079bb3b1380778c08e149d26a622f1f5efa9668df892795389f06d73ec9cb26590d73deb0c8e9260e8315c6ef5b8bd20460ca49a628f6693bf6cbc82891e59d8a615737ac7414dc74e03aee722f2e9cfbd0bbbff53d00e10633e8822bae53a63a16738cdd410e203ac0b4a7a1e9b24f902e3260e957cbb904926868e538266075b29f77ff9114efae2049fcad401548d1023161195eb897efad77b7649a7abf5fc113ef9b62fb0d6ce0546916a903da6ee983937176c6698582170203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e041604148ff04b7fa82e4524ae4d50fa639a8bdee2dd1bbc300d06092a864886f70d01010b050003820101004b40dbc050aafec80ceff796544549bb96000941acb3138686280733ca6be674b9ba002daea40ad3f5f1f10f8abf73674a83c7447b78e0af6e6c6f03298e333945c38ee4b9576caafc1296ec53c62de4246cb99463fbdc536867563e83b8cf3521c3c968fecedac253aacc908ae9f05d468c95dd7a58281a2f1ddecd0037418fed446dd75328977ef367041e15d78a96b4d3de4c27a44c1b737376f41799c21f7a0ee32d08ad0a1c2cff3cab550e0f917e36ebc35749bee12e2d7c608bc3415113239dcef7326b9401a899e72c331f3a3b25d28640ce3b2c8678c9612f14baeedb556fdf84ee05094dbd28d872ced36250651eeb92978331d9b3b5ca47583f5f	svt.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\8094640EB5A7A1CA119C1FDDD59F810263A7FBD1	svt.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\8094640EB5A7A1CA119C1FDDD59F810263A7FBD1\Blob = 0f0000000100000030000000ea09c51d4c3a334ce4acd2bc08c6a9be352e334f45c4fccfcab63edb9f82dc87d4bd2ed2fadae11163fb954809984ff153000000010000007e000000307c301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0301f06092b06010401a032010230123010060a2b0601040182373c0101030200c0301b060567810c010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000056000000305406082b0601050507030206082b06010505070303060a2b0601040182370a030c060a2b0601040182370a030406082b0601050507030406082b0601050507030906082b0601050507030106082b060105050703080b000000010000003000000047006c006f00620061006c005300690067006e00200052006f006f00740020004300410020002d0020005200360000006200000001000000200000002cabeafe37d06ca22aba7391c0033d25982952c453647349763a3ab5ad6ccf697f0000000100000016000000301406082b0601050507030306082b06010505070309140000000100000014000000ae6c05a39313e2a2e7e2d71cd6c7f07fc86753a01d0000000100000010000000521f5c98970d19a8e515ef6eeb6d48ef7a000000010000000c000000300a06082b060105050703097e00000001000000080000000080c82b6886d7010300000001000000140000008094640eb5a7a1ca119c1fddd59f810263a7fbd1200000000100000087050000308205833082036ba003020102020e45e6bb038333c3856548e6ff4551300d06092a864886f70d01010c0500304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523631133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e301e170d3134313231303030303030305a170d3334313231303030303030305a304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523631133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e30820222300d06092a864886f70d01010105000382020f003082020a02820201009507e873ca66f9ec14ca7b3cf70d08f1b4450b2c82b448c6eb5b3cae83b841923314a46f7fe92accc6b0886bc5b689d1c6b2ff14ce511421ec4add1b5ac6d687ee4d3a1506ed64660b9280ca44de73944ef3a7897f4f786308c812506d42662f4db979284d521a8a1a80b719810e7ec48abc644c211c4368d73d3c8ac5b266d5909ab73106c5bee26d3206a61ef9b9ebaaa3b8bfbe826350d0f01889dfe40f79f5eaa21f2ad2702e7be7bc93bb6d53e2487c8c100738ff66b277617ee0ea8c3caab4a4f6f3954a12076dfd8cb289cfd0a06177c85874b0d4233af75d3acaa2db9d09de5d442d90f181cd5792fa7ebc50046334df6b9318be6b36b239e4ac2436b7f0efb61c135793b6deb2f8e285b773a2b835aa45f2e09d36a16f548af172566e2e88c55142441594eea3c538969b4e4e5a0b47f30636497730bc7137e5a6ec210875fce661163f77d5d99197840a6cd4024d74c014edfd39fb83f25e14a104b00be9feee8fe16e0bb208b36166096ab1063a659659c0f035fdc9da288d1a118770810aa89a751d9e3a8605009edb80d625f9dc059e27594c76395beaf9a5a1d8830fd1ffdf3011f985cf3348f5ca6d64142c7a584fd34b0849c595641a630e793df5b38cca58ad9c4245796e0e87195c54b165b6bf8c9bdc13e90d6fb82edc676ec98b11b584148a0019708379919791d41a27bf371e3207d814633c284caf0203010001a3633061300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e04160414ae6c05a39313e2a2e7e2d71cd6c7f07fc86753a0301f0603551d23041830168014ae6c05a39313e2a2e7e2d71cd6c7f07fc86753a0300d06092a864886f70d01010c050003820201008325ede8d1fd9552cd9ec004a09169e65cd084dedcada24fe84778d66598a95ba83c877c028ad16eb71673e65fc05498d574bec1cde21191ad23183ddde1724496b4955ec07b8e99781643135657b3a2b33bb577dc4072aca3eb9b353eb10821a1e7c443377932beb5e79c2c4cbc4329998e30d3ac21e0e31dfad80733765400222ab94d202e7068dae553fc835cd39df2ff440c4466f2d2e3bd46001a6d02ba255d8da13151dd54461c4ddb9996ef1a1c045ca615ef78e079fe5ddb3eaa4c55fd9a15a96fe1a6fbdf7030e9c3ee4246edc2930589fa7d637b3fd071817c00e898ae0e7834c325fbaf0a9f206bdd3b138f128ce2411a487a73a07769c7b65c7f82c81efe581b282ba86cad5e6dc005d27bb7eb80fe2537fe029b68ac425dc3eef5ccdcf05075d236699ce67b04df6e0669b6de0a09485987eb7b14607a64aa6943ef91c74cec18dd6cef532d8c99e15ef2723ecf54c8bd67eca40f4c45ffd3b93023074c8f10bf8696d9995ab499571ca4ccbb158953ba2c050fe4c49e19b11834d54c9dbaedf71faf24950478a803bbee81e5da5f7c8b4aa1907425a7b33e4bc82c56bdc7c8ef38e25c92f079f79c84ba742d6101207e7ed1f24f07595f8b2d4352eb460c94e1f566477977d5545b1fad2437cb455a4ea04448c8d8b099c5158409f6d64949c065b8e61a716ea0a8f182e8453e6cd602d70a6783055ac9a410	svt.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\8094640EB5A7A1CA119C1FDDD59F810263A7FBD1\Blob = 190000000100000010000000cb9dd0fceaaa492f75ce292c21bbfbdd0300000001000000140000008094640eb5a7a1ca119c1fddd59f810263a7fbd17e00000001000000080000000080c82b6886d7017a000000010000000c000000300a06082b060105050703091d0000000100000010000000521f5c98970d19a8e515ef6eeb6d48ef140000000100000014000000ae6c05a39313e2a2e7e2d71cd6c7f07fc86753a07f0000000100000016000000301406082b0601050507030306082b060105050703096200000001000000200000002cabeafe37d06ca22aba7391c0033d25982952c453647349763a3ab5ad6ccf690b000000010000003000000047006c006f00620061006c005300690067006e00200052006f006f00740020004300410020002d002000520036000000090000000100000056000000305406082b0601050507030206082b06010505070303060a2b0601040182370a030c060a2b0601040182370a030406082b0601050507030406082b0601050507030906082b0601050507030106082b0601050507030853000000010000007e000000307c301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0301f06092b06010401a032010230123010060a2b0601040182373c0101030200c0301b060567810c010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f0000000100000030000000ea09c51d4c3a334ce4acd2bc08c6a9be352e334f45c4fccfcab63edb9f82dc87d4bd2ed2fadae11163fb954809984ff1200000000100000087050000308205833082036ba003020102020e45e6bb038333c3856548e6ff4551300d06092a864886f70d01010c0500304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523631133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e301e170d3134313231303030303030305a170d3334313231303030303030305a304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523631133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e30820222300d06092a864886f70d01010105000382020f003082020a02820201009507e873ca66f9ec14ca7b3cf70d08f1b4450b2c82b448c6eb5b3cae83b841923314a46f7fe92accc6b0886bc5b689d1c6b2ff14ce511421ec4add1b5ac6d687ee4d3a1506ed64660b9280ca44de73944ef3a7897f4f786308c812506d42662f4db979284d521a8a1a80b719810e7ec48abc644c211c4368d73d3c8ac5b266d5909ab73106c5bee26d3206a61ef9b9ebaaa3b8bfbe826350d0f01889dfe40f79f5eaa21f2ad2702e7be7bc93bb6d53e2487c8c100738ff66b277617ee0ea8c3caab4a4f6f3954a12076dfd8cb289cfd0a06177c85874b0d4233af75d3acaa2db9d09de5d442d90f181cd5792fa7ebc50046334df6b9318be6b36b239e4ac2436b7f0efb61c135793b6deb2f8e285b773a2b835aa45f2e09d36a16f548af172566e2e88c55142441594eea3c538969b4e4e5a0b47f30636497730bc7137e5a6ec210875fce661163f77d5d99197840a6cd4024d74c014edfd39fb83f25e14a104b00be9feee8fe16e0bb208b36166096ab1063a659659c0f035fdc9da288d1a118770810aa89a751d9e3a8605009edb80d625f9dc059e27594c76395beaf9a5a1d8830fd1ffdf3011f985cf3348f5ca6d64142c7a584fd34b0849c595641a630e793df5b38cca58ad9c4245796e0e87195c54b165b6bf8c9bdc13e90d6fb82edc676ec98b11b584148a0019708379919791d41a27bf371e3207d814633c284caf0203010001a3633061300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e04160414ae6c05a39313e2a2e7e2d71cd6c7f07fc86753a0301f0603551d23041830168014ae6c05a39313e2a2e7e2d71cd6c7f07fc86753a0300d06092a864886f70d01010c050003820201008325ede8d1fd9552cd9ec004a09169e65cd084dedcada24fe84778d66598a95ba83c877c028ad16eb71673e65fc05498d574bec1cde21191ad23183ddde1724496b4955ec07b8e99781643135657b3a2b33bb577dc4072aca3eb9b353eb10821a1e7c443377932beb5e79c2c4cbc4329998e30d3ac21e0e31dfad80733765400222ab94d202e7068dae553fc835cd39df2ff440c4466f2d2e3bd46001a6d02ba255d8da13151dd54461c4ddb9996ef1a1c045ca615ef78e079fe5ddb3eaa4c55fd9a15a96fe1a6fbdf7030e9c3ee4246edc2930589fa7d637b3fd071817c00e898ae0e7834c325fbaf0a9f206bdd3b138f128ce2411a487a73a07769c7b65c7f82c81efe581b282ba86cad5e6dc005d27bb7eb80fe2537fe029b68ac425dc3eef5ccdcf05075d236699ce67b04df6e0669b6de0a09485987eb7b14607a64aa6943ef91c74cec18dd6cef532d8c99e15ef2723ecf54c8bd67eca40f4c45ffd3b93023074c8f10bf8696d9995ab499571ca4ccbb158953ba2c050fe4c49e19b11834d54c9dbaedf71faf24950478a803bbee81e5da5f7c8b4aa1907425a7b33e4bc82c56bdc7c8ef38e25c92f079f79c84ba742d6101207e7ed1f24f07595f8b2d4352eb460c94e1f566477977d5545b1fad2437cb455a4ea04448c8d8b099c5158409f6d64949c065b8e61a716ea0a8f182e8453e6cd602d70a6783055ac9a410	svt.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1320	svt.exe
1320	svt.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe

Suspicious use of AdjustPrivilegeToken 12 IoCs

description	pid	Process
Token: 33	5836	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	5836	AUDIODG.EXE
Token: SeAuditPrivilege	6060	svchost.exe
Token: SeSecurityPrivilege	6060	svchost.exe
Token: SeLoadDriverPrivilege	5456	VBCABLE_Setup_x64.exe
Token: SeRestorePrivilege	3436	DrvInst.exe
Token: SeBackupPrivilege	3436	DrvInst.exe
Token: SeRestorePrivilege	3436	DrvInst.exe
Token: SeBackupPrivilege	3436	DrvInst.exe
Token: SeLoadDriverPrivilege	3436	DrvInst.exe
Token: SeLoadDriverPrivilege	3436	DrvInst.exe
Token: SeLoadDriverPrivilege	3436	DrvInst.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe

Suspicious use of WriteProcessMemory 45 IoCs

description	pid	Process	procid_target
PID 1320 wrote to memory of 2904	1320	svt.exe	81
PID 1320 wrote to memory of 1492	1320	svt.exe	84
PID 1492 wrote to memory of 3840	1492	msedge.exe	85
PID 1492 wrote to memory of 4688	1492	msedge.exe	86
PID 1492 wrote to memory of 2040	1492	msedge.exe	87
PID 1492 wrote to memory of 4688	1492	msedge.exe	86
PID 1492 wrote to memory of 4688	1492	msedge.exe	86
PID 1492 wrote to memory of 1000	1492	msedge.exe	90
PID 1492 wrote to memory of 2488	1492	msedge.exe	91
PID 1492 wrote to memory of 1000	1492	msedge.exe	90
PID 1492 wrote to memory of 1000	1492	msedge.exe	90
PID 1492 wrote to memory of 2488	1492	msedge.exe	91
PID 1492 wrote to memory of 2488	1492	msedge.exe	91
PID 1492 wrote to memory of 1784	1492	msedge.exe	89
PID 1492 wrote to memory of 1784	1492	msedge.exe	89
PID 1492 wrote to memory of 1980	1492	msedge.exe	92
PID 1492 wrote to memory of 1668	1492	msedge.exe	93
PID 1492 wrote to memory of 4920	1492	msedge.exe	94
PID 1492 wrote to memory of 5024	1492	msedge.exe	95
PID 1492 wrote to memory of 1980	1492	msedge.exe	92
PID 1492 wrote to memory of 1980	1492	msedge.exe	92
PID 1492 wrote to memory of 1668	1492	msedge.exe	93
PID 1492 wrote to memory of 1668	1492	msedge.exe	93
PID 1492 wrote to memory of 4920	1492	msedge.exe	94
PID 1492 wrote to memory of 4920	1492	msedge.exe	94
PID 1492 wrote to memory of 5024	1492	msedge.exe	95
PID 1492 wrote to memory of 5024	1492	msedge.exe	95
PID 1492 wrote to memory of 5456	1492	msedge.exe	97
PID 1492 wrote to memory of 5456	1492	msedge.exe	97
PID 1492 wrote to memory of 5652	1492	msedge.exe	98
PID 1492 wrote to memory of 5652	1492	msedge.exe	98
PID 1492 wrote to memory of 4188	1492	msedge.exe	100
PID 1492 wrote to memory of 4188	1492	msedge.exe	100
PID 1492 wrote to memory of 4188	1492	msedge.exe	100
PID 1492 wrote to memory of 1500	1492	msedge.exe	101
PID 1492 wrote to memory of 3312	1492	msedge.exe	102
PID 1492 wrote to memory of 4016	1492	msedge.exe	103
PID 1492 wrote to memory of 4444	1492	msedge.exe	104
PID 1492 wrote to memory of 1500	1492	msedge.exe	101
PID 1492 wrote to memory of 3312	1492	msedge.exe	102
PID 1492 wrote to memory of 4444	1492	msedge.exe	104
PID 1320 wrote to memory of 3620	1320	svt.exe	106
PID 1320 wrote to memory of 5456	1320	svt.exe	108
PID 6060 wrote to memory of 6004	6060	svchost.exe	110
PID 6060 wrote to memory of 3436	6060	svchost.exe	111

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\svt.exe
"C:\Users\Admin\AppData\Local\Temp\svt.exe"
1⤵
- Reads the TCP/IP host and domain name from the registry
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1320
- C:\Windows\system32\schtasks.exe
  "C:\Windows\system32\schtasks.exe" /Query /TN "svt"
  2⤵
  PID:2904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://discord.gg/svt
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:1492
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2e0,0x2e4,0x2e8,0x2dc,0x368,0x7ffb8163c188,0x7ffb8163c194,0x7ffb8163c1a0
    3⤵
    PID:3840
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1556,i,3697989293079000210,12843121357539810247,262144 --field-trial-handle=2184,i,8495379789664751291,2804446983510251827,262144 --variations-seed-version --mojo-platform-channel-handle=2180 /prefetch:2
    3⤵
    PID:4688
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1932,i,3317619663547353292,5798111451675466984,524288 --field-trial-handle=2184,i,8495379789664751291,2804446983510251827,262144 --variations-seed-version --mojo-platform-channel-handle=2212 /prefetch:11
    3⤵
    - System Time Discovery
    PID:2040
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2460,i,1215456587641484838,15973575628516510515,524288 --field-trial-handle=2184,i,8495379789664751291,2804446983510251827,262144 --variations-seed-version --mojo-platform-channel-handle=3084 /prefetch:13
    3⤵
    PID:1784
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3420,i,12239232083636937746,8426258062821082916,2097152 --field-trial-handle=2184,i,8495379789664751291,2804446983510251827,262144 --variations-seed-version --mojo-platform-channel-handle=3488 /prefetch:1
    3⤵
    PID:1000
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3424,i,5619836337967115668,17354069741403312713,2097152 --field-trial-handle=2184,i,8495379789664751291,2804446983510251827,262144 --variations-seed-version --mojo-platform-channel-handle=3492 /prefetch:1
    3⤵
    PID:2488
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4180,i,1420743131705659183,5951754102620653047,2097152 --field-trial-handle=2184,i,8495379789664751291,2804446983510251827,262144 --variations-seed-version --mojo-platform-channel-handle=4184 /prefetch:1
    3⤵
    PID:1980
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4244,i,4929158075646750968,9431618843815793660,2097152 --field-trial-handle=2184,i,8495379789664751291,2804446983510251827,262144 --variations-seed-version --mojo-platform-channel-handle=4204 /prefetch:9
    3⤵
    PID:1668
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4260,i,15954084934663336224,2284920724281209478,2097152 --field-trial-handle=2184,i,8495379789664751291,2804446983510251827,262144 --variations-seed-version --mojo-platform-channel-handle=4220 /prefetch:1
    3⤵
    PID:4920
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4208,i,13130415797595621013,6474108879352192897,2097152 --field-trial-handle=2184,i,8495379789664751291,2804446983510251827,262144 --variations-seed-version --mojo-platform-channel-handle=4268 /prefetch:9
    3⤵
    PID:5024
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5416,i,7833666918029933947,10083758948606611196,524288 --field-trial-handle=2184,i,8495379789664751291,2804446983510251827,262144 --variations-seed-version --mojo-platform-channel-handle=4224 /prefetch:14
    3⤵
    PID:5456
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5580,i,6335459031477411774,7547072127770433008,524288 --field-trial-handle=2184,i,8495379789664751291,2804446983510251827,262144 --variations-seed-version --mojo-platform-channel-handle=5596 /prefetch:14
    3⤵
    PID:5652
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=5428,i,7604811591408769134,2577931952523456391,2097152 --field-trial-handle=2184,i,8495379789664751291,2804446983510251827,262144 --variations-seed-version --mojo-platform-channel-handle=5576 /prefetch:1
    3⤵
    PID:4188
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5688,i,9115569140651732451,15182397673007764660,524288 --field-trial-handle=2184,i,8495379789664751291,2804446983510251827,262144 --variations-seed-version --mojo-platform-channel-handle=4184 /prefetch:14
    3⤵
    PID:1500
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5692,i,16477715314301932311,8093691387049346037,524288 --field-trial-handle=2184,i,8495379789664751291,2804446983510251827,262144 --variations-seed-version --mojo-platform-channel-handle=4896 /prefetch:14
    3⤵
    PID:3312
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5868,i,4968826284034849917,5562225852223917573,524288 --field-trial-handle=2184,i,8495379789664751291,2804446983510251827,262144 --variations-seed-version --mojo-platform-channel-handle=4952 /prefetch:14
    3⤵
    PID:4016
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5864,i,7323338524156138270,12733786529409446775,524288 --field-trial-handle=2184,i,8495379789664751291,2804446983510251827,262144 --variations-seed-version --mojo-platform-channel-handle=4972 /prefetch:12
    3⤵
    PID:4444
- C:\Windows\system32\tar.exe
  "C:\Windows\system32\tar.exe" -xf "C:\Users\Admin\AppData\Local\svt\vbcable\VBCABLE_Driver_Pack.zip" -C "C:\Users\Admin\AppData\Local\svt\vbcable"
  2⤵
  PID:3620
- C:\Users\Admin\AppData\Local\svt\vbcable\VBCABLE_Setup_x64.exe
  "C:\Users\Admin\AppData\Local\svt\vbcable\VBCABLE_Setup_x64.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - Checks SCSI registry key(s)
  - Suspicious use of AdjustPrivilegeToken
  PID:5456

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:892

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004DC 0x00000000000004D8
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:5836

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall
1⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:6060
- C:\Windows\system32\DrvInst.exe
  DrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{989b15e5-3d0f-e44b-b2ef-7bf694db78d6}\vbmmecable64_win10.inf" "9" "412cfd737" "0000000000000144" "WinSta0\Default" "00000000000000C0" "208" "c:\users\admin\appdata\local\svt\vbcable"
  2⤵
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Checks SCSI registry key(s)
  - Modifies data under HKEY_USERS
  PID:6004
- C:\Windows\system32\DrvInst.exe
  DrvInst.exe "2" "211" "ROOT\MEDIA\0000" "C:\Windows\INF\oem3.inf" "oem3.inf:c14ce8840c48fa1f:VBCableInst.NTamd64:3.3.1.7:vbaudiovacwdm," "412cfd737" "0000000000000144" "648e"
  2⤵
  - Drops file in Drivers directory
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  PID:3436

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

9ae78c17-4d27-4a16-b378-ff39419d5516.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\9ae78c17-4d27-4a16-b378-ff39419d5516.tmp
Size 8KB
SHA256 bb22b719a516f08ab3ea58e146b6443f29d25c56bea1a09652609fe72aa058bb
MD5 02ad7424ca1161b6ce5150c61fbe0c52
SHA1 8e7f9e3c134726caa50aeadd1e5131f7a2691bca
SHA512 7d99027850097ba999f691b44b3fd21225cae097a52650966f1089a9abee701738c145373926dc24043f9bcf018039a12a7676fc58caea5386bcf1a77b93b5d4
SSDEEP 192:mGNz6FPhQmiUyfkf2LX569jzor1+TRYYCPP7U6:mGNz6Rs42LX56R8TDU6
TLSH
T15E02D835AC68AC7B9AE3EE49B5873613AFE4103BA5542F84D6EC1F1C009765C1306937
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e0653c7dfe0810a5ba2c25399711a69ff5ccfc817819d34f6722ae2f2cd5878f
MD5 7d9ceef5daa4101fd9b28ee948203837
SHA1 ad81e9d42e96e81834610892e0cbe006311016fb
SHA512 5fcae862842c3f4a69612b1563a769c05365d02e6c1981b600f92a8204d1bccef7066e0f30e9f4cd820c979d8be93f5d5f5a0cbcc14e4c67fdb497df535a879a
TLSH
T15DD02230F32B8002C2C0B03B83C3C3203CCACA0A020E20AEE0302C203CAA02AF80E0C2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 880b329c34341b1a6bd386fcebb3d2cb5e0015b015381d19de17e158e38add99
MD5 2ba3ab873a8080b1e3440858b6762a77
SHA1 b0870a7a6484d6ca8f7b80fb26afed35cae93e83
SHA512 303e937d35c553a33470b684aaf71b88ae137a7d57b0a627ac098b9660b534acc5f6913cdbbe31fca9add2ef3f6b91b2abe02fd20e0a2194b41e3fd557310a63
TLSH
T1F6D09B21653655D1D1A4603F43D281102D958557475D1149A1315C156D75056EC5DDC5
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 f3441efe89f40c49c2eb2faa60bc806081bb2ed5672b81b3317480a16d9defd0
MD5 48af34be1fd83b68e08abd8324fcc533
SHA1 15f0d4791b9ba48b92ee9290ab043242241b1137
SHA512 9687f23e1f8c4b413fabcf01b867bb71849109f11f20aeb0da3a5e1a25b610ec3fa85aa3ce714ace9479c0c98da93c7301d990baf3c243f6c14cc1010ae46a5a
TLSH
T12ED0243073574401C1C0703743C3C3103CC5C505010D515FD0301C103C57055F40D0C1
MD5 SHA1 SHA512 TLSH

Submit Download

2c335ff5-caf3-41c0-a1b8-5d7b3d86d9bc.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\2c335ff5-caf3-41c0-a1b8-5d7b3d86d9bc.tmp
Size 10KB
SHA256 d90495802104532923d30f25f15df17e2ebbc579d74a2a9aefaa6b88255098f8
MD5 d7695fa1b40dccb65c68bb9f54d0d73c
SHA1 3615c5bcf36cfda4c11c8baafdf63c440803d400
SHA512 cad6a5252926a2a387237e1bf6bc4a14ebdceaeb1a42142b2e3226c6527326c72b2ccfa775d2d6548a214349405eefc33115a69e0251374bb8200b32e61b00d0
SSDEEP 192:zZ2RZCZ/fes7WpVDGxEdpnf/W6+WNx4HY/Y0PdBdIgEJ:zZ2KZ/fes7WvDNf/bf/5VI
TLSH
T16022B6526A38A93B8CCBD21DFA257F13D2F9502255D51E48FAFC892C05F66DE220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

37ff1577-2be2-4468-98a8-449b2de24ebd.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\37ff1577-2be2-4468-98a8-449b2de24ebd.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 78dfe5095062e25bc8065d04fb749b37e57f4dbc6beb4b6ddcfa73db3898b9ac
MD5 59a623dc688806615d6fe541e9ec1f79
SHA1 325350f083b3a031312d315ddb1f9edd4ed5aa62
SHA512 5689fb7fe3ae2f27a9416397435ca990ecb09f35c032af76f2950a81e2f992876cf58861cbea48c629faa9e302a682ea9c74a668ff3c38e0abfc3de6ae5aa727
TLSH
T13981FC44C6AC4BC4CFF445FEA5DA119B3274F180844BEF720DABDAF95FA5B4A421225C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 7887eba922eabb03135e383ef24de6b09d0980bd8f32f10c5b879b6ff59f2399
MD5 868f1280afb684ef706b558a7366c32c
SHA1 c6539f1f6decbde27187f8f2be3f263e1288af3b
SHA512 7b8b43e3b7888116b4e1a2d3e5f4a861145f3e725e839b63f86e30757670d2cb99cb657f729c54a631cdb6396c44ae51d9d7311da77249fe165536b516f59138
TLSH
T177513E44CA6C4AC0DFF449FCAAD712EB3674B5C1955BEE630EB8C4FA5FA1B4A5210050
MD5 SHA1 SHA512 TLSH

Submit Download

5993488c-4cec-46af-ba00-51d85531e498.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\5993488c-4cec-46af-ba00-51d85531e498.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

278134ce-cf8a-4a6c-8075-4f3cb5e8c08b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\278134ce-cf8a-4a6c-8075-4f3cb5e8c08b.tmp
Size 1KB
SHA256 567952175fd6cbd09a64da86f9725807a0bb1e77d3d09ee7ad51eaecb6f19e1b
MD5 792606083007f6c29a3420386e9361de
SHA1 e45f849d7fdabaa65835d6af623dfb62a15b246c
SHA512 8a56ed4f42d3fcc1e897d1e1754d687540774b5cf3b0e8606e709567239221afdf129362f13be892561bdf9d1480e8676594ed24081d4854a2afbf62f9feb453
TLSH
T1D03178F7C7E4867E8A0152F4AA146E1FCE2D0955531C3C6AC4E4AE1F93E29B1F18099F
MD5 SHA1 SHA512 TLSH

Submit Download

920328eb-7ffe-4f58-b5b5-f8ce12dd741e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\920328eb-7ffe-4f58-b5b5-f8ce12dd741e.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\index.txt
Size 138B
SHA256 2e2bcad279af68427abb87f627a2cbd9b519a85c8247f5e416347f34900a612e
MD5 7dd1a37057fab52d75caaa1de7aed82d
SHA1 9a34d8f594005c4d20eda444e1e0d20342597cdb
SHA512 9c21c081e23948a1178368a92f6d28df5d3b5659e34fc10c3e83947220af1e7b77c1c7b8925207393a7bde107f42f6d39999a19f914b71240a5ae61d7416da69
TLSH
T12AC08CABB04806108A340E60873380194B052C8C9A81804CB11234582430A132201EF2
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\index.txt.tmp
Size 233B
SHA256 3bb179f88c52a4ebc8f209769f98cff1d2ae7b6676ce17f08794b219c4d5b969
MD5 bd6694fb3727cf0f4541d2d8c6e5f951
SHA1 b81e6f06513b074239a6eda3fec1d0abb225b544
SHA512 c75702f952401b7b5839dca4863b6b0fb41d30714a4d7399a071f09bcf18f28d9e412115c48b7a932d1810e020d1a221d7eb1df4d33f6dd82ac5f98082910e48
TLSH
T1B4D0A56FF0250450D6B64E515F3341554A62BC4C5955C048E512345D24749579621E63
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\index.txt.tmp
Size 226B
SHA256 bf8647ac69b444f02e66e5595d83c92ac8797916f6bee201c57c88cab9477cc4
MD5 b50febf344cfa184e15c27663be0598d
SHA1 fa099ab273efcba07f3c658e70af01bf8055179d
SHA512 9c69def3edc1cc5a152041e058b5fb413c45edb7d4f07bd48fad02742728b753438af9360421a0a2cad70122bd6091a973a4d682ce38bc6c53f287ad05d7e659
TLSH
T153D0A7AFF0190990E9BA8F915F33412A4A22B88CAA95C08CF512155968A5A539222EA3
MD5 SHA1 SHA512 TLSH

Submit Download

b848dcc6-7cf4-45b2-98f6-6f58c957b2e8.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\b848dcc6-7cf4-45b2-98f6-6f58c957b2e8.tmp
Size 28KB
SHA256 28bbd91a0955758dad8371def4143afba2e893debef2d0c1aa21ec13707b7f70
MD5 72e21cbe161c8a85c3ab039dbf8fe242
SHA1 dcbe686d67cc75a3b95cf423c9bf9aa6abd6ab07
SHA512 444266961584b02f9442faf8f411cca8918bb00ccf8de57df82f25cc1f8d6a93389c1cd3630c62f75e1188b2a9f584361372191caeaa09a4e0c744bbd5244020
SSDEEP 768:t/hnP8y32aFWRmaeQoe8F1+UoAYDCx9Tuqh0VfUC9xbog/OV3plLl/9v0zz3rotx:t/hnP8y32aFWRmaeQoeu1jaKplLp9MzK
TLSH
T1A2D2093B244CCB7E4FC04A9DDC566F976EE802C7A6688D5047FE894C02C77EE512A49B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

eb32de6b-293c-4c0e-802e-38284ada3750.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\eb32de6b-293c-4c0e-802e-38284ada3750.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

aa1be7b0-3e61-473b-9a9d-e94efa17c06d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\aa1be7b0-3e61-473b-9a9d-e94efa17c06d.tmp
Size 16KB
SHA256 53b9b018782fb77febb5adae1981bc4218eba09cef41f87d3fde38e984e687fb
MD5 31d7c75df7a407e374a9de6ed643e042
SHA1 f013d2f23365ae019483ee33c99e23be3e0485a2
SHA512 ae8b39aaff7b20d7874d770e4c44bad73bca56bfc49a6a8a5d2b7de85080615de0d9468cb07b1d0130b4a5691c75d582c5f1113a9d65a3ece810b5d96d432dab
SSDEEP 384:za8NN/tc1BFfmX56R85Xz+Vvff0bKbdTXN3s:2dstz+FfOKbdTXN8
TLSH
T17672187D9C649C3F99EFBB0CA50E36239EB4013BE5B81A58D7D81B0CC176589F346826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e35da02f-af38-497b-aae5-f244253b422b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\e35da02f-af38-497b-aae5-f244253b422b.tmp
Size 8KB
SHA256 b11deee57e250f59f5ba7f7b13376d808c01ab52c2ea735cdea53bb44ce75d32
MD5 f6e21148990897484a9a42849a6d6713
SHA1 84d32f5fbb5731d1a1d0d4e73ca9a173637a92aa
SHA512 377777e0d90a657140cd25546e81ae30774cb95af7e26e722e15e3a840b68d18e044a174e1b5cdf4bbe92a84f80183c8e70e67404267fb13230a800d44dea1f2
SSDEEP 192:lGNQ6FP4QmiUyXf2lLX569jzor1+TRYzXJYeQxWUZqxGU6:lGNQ6q2wLX56R85XzY1U6
TLSH
T14D120835E8A8EC275DE3F159B5863653AEA4107BD9486F40E6E81F2C009B68D270E827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7a5b493e-48bc-431f-a91f-1c99dcbe5b66.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\7a5b493e-48bc-431f-a91f-1c99dcbe5b66.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

Cable[1].htm

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\9JGUS5P9\Cable[1].htm
Size 31KB
SHA256 84a594b9987374a6816740a465dc75885fe1380753ee870089bdf595405289b7
MD5 fc5fb0296ffd7b27e3a24f045b2733c9
SHA1 9b9d02a9b92663a1f934b416ddf8dd804511a09f
SHA512 f7bc5f98d7dc72627ccf5d86475e13f5f04d183d8b42ce14b28abaaf707ea9798e638bd1a4e1a2fdd20506ff071fca7c416350ffd01406046a2fc82a32b5aa4b
SSDEEP 192:G/73T5Z3+QX2KcmXPM4umxVr4AW7T3zU0co3ocDoS+gRk0zbzKAcnbbQPLzprJZ+:G/f5Z339dgT3wSj+gzKVWLNRTNmREVk
TLSH
T1A2E2C4AED814E45E0752CDD895092095E867420FA9B35DF13A7BB107D2D0E28B12EEFF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VBCABLE_Driver_Pack45[1].zip

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\IG59HSM3\VBCABLE_Driver_Pack45[1].zip
Size 1.3MB
SHA256 b950e39f01af1d04ea623c8f6d8eb9b6ea5c477c637295fabf20631c85116bfb
MD5 e58f7ed5b41f3a4c48f5453efacaca79
SHA1 15e4a8eff010e810be492a2e61d771f2f7e671e5
SHA512 fa73fbc483c229079c65c78de3c3ede5cacd8e8a5f9f3aac52a7e0b49bae1ec31a35db324d05afeb33388503eebec59e5bff861df56d6ad7d1a279a67ec4f92d
SSDEEP 24576:ZtBKwfPZ5JLfbe+17FbDNQUSIjH/zLI8yhbMkkTdbvxB2Hcfx6X9pxiqinDp:NKwZ5Zfbe+hb5dzHbLI8UbRubvPQzift
TLSH
T10D5533D54726841B944B29378FFD0E72A288D79800FE48E93677D5BA6F1040F49A53EF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VBCABLE_ControlPanel.exe

Path C:\Users\Admin\AppData\Local\svt\vbcable\VBCABLE_ControlPanel.exe
Size 908KB
SHA256 f5b44706fe7ba2eed0516dee791f826dc7a9891e997f6ce9704e2899300b14ff
MD5 c56acc1e49d1af04a5a5c4f737cdbfc5
SHA1 b1e6d6bd23619e46957da080d76cad96e1dae389
SHA512 1ff45dab43ad7352c899968d360d2b86cc36d522ba699bb8895a80c950613ed8c6e2ee1d7470c355c6b3537383d436c832ac356158df581aff4fd36b04fa30fb
SSDEEP 6144:M7wG/LZIILw6dxL0B4NHh9aphA2hwrYqrgLuBj2Xhntm5hJ2r9Un+Ldqscgu:UZIILw6dxL04DkLuBj2xntmgr9+yRs
TLSH
T14C150072575D32B0C440C6FF4B8F3240B401ADFD219F947ABB4A3C699378E6D928AD96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VBCABLE_Setup_x64.exe

Path C:\Users\Admin\AppData\Local\svt\vbcable\VBCABLE_Setup_x64.exe
Size 915KB
SHA256 734c35dfa6d98f48782a451633ceb471166ec70d60482fd89a1123d0ee3c4f41
MD5 fd3ec8b4d075d879af81caee8f216724
SHA1 3f6e53cef29dc30df588def8abd83cc052ededef
SHA512 816c2fe66a0333ed92d9edb3d67e852b11999e24d0e001a158c9ea46a0bc3b08858929693d6beb4cf3f91d085dfc19c0f1970f3d8bb1c959f3e378fbf0b8da7c
SSDEEP 12288:XmBbJrhTZUI6HKhgS9APmGKRH8MYmmBHBw:Xm9rhTZ36HKhx9AP0RH8MYDBHBw
TLSH
T16F15D8E531623A03C9DC45369918BBFDB9C41C44D625FA74A93BB90C103A7D0B93A7EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pin_in.ico

Path C:\Users\Admin\AppData\Local\svt\vbcable\pin_in.ico
Size 7KB
SHA256 934865449455103c1c5997d8220acd160c3891f8a870f8e745b743d12681ac42
MD5 e442346f22da9a5bb15dfaba67a360b8
SHA1 6255a045c25bda6097eca8b4d611219093cf9525
SHA512 09dc47e1b5b1f932a9b87aca9e13b9e85e0674630335f24af613ca5cb2af3d282de8438937ba30e7640accb6f1843686bb310a0bbf882c9d87bd876e7fe4d266
SSDEEP 24:Vt9xMU25SeyH2tJL7w8hoUaJWRHJdwWxg7N/26YFwtNxUb6bUZINoy3dC5Q/JkmI:HJSJVoUd1FzxMN2mbegaQ/q
TLSH
T120E19FCE54BA1E56CAD000BE35BC6C51C3D40C62D899B0993253736C987AF9DE21CE6E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pin_out.ico

Path C:\Users\Admin\AppData\Local\svt\vbcable\pin_out.ico
Size 7KB
SHA256 e8728a811e1f1af7d2ba31f77e47d449d5bba091e3e89a0df325ac7a3e67652c
MD5 235559de67569ebc8fdcf5d51d753b57
SHA1 ce78fbbc34348c637c6f8d04f5ee1d1fb572e432
SHA512 2b31c416c15ab0fd61a3e1de6e30cba777abd26bc6017e6714f0607be674db58cc81181f8ddd6eb8fc1ec1d3de4ae7396daf066f846dbf03833e11dc81ec6047
SSDEEP 96:FuzFTKHCf1OAxA9nvUsvZG0ieQGnAvqlUvX:FuRjtOA6vUmZGleQa8qlUvX
TLSH
T14BE1BEF1BD8E376AC0CE25B3C2BC3555C6D84FA1F5889B355066724A04B14E26E0DEBE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vbMmeCable64_win10.inf

Path C:\Users\Admin\AppData\Local\svt\vbcable\vbMmeCable64_win10.inf
Size 11KB
SHA256 61c857be74831cc299d9be62f8d49d137f14063454fc54f859d5bc9b4b813daf
MD5 937c403862f584e1ea23800b77fd68fc
SHA1 a89b8f0ff7d66d9a1313e9169db7e301d9601f17
SHA512 59ec053c7858f8f3598518c054a1345e677997064131cbb7bfc0dbfa6ff8835b21dc206bba8cc22c9172f137f8806bf50d646a2bfc5938e869eb8faaa7e4b520
SSDEEP 192:h0iE2f0JoxR+XsR+8wxxagRj8gABagRj8gAUEZ/gdktqqENoAglb84+54D:o28oqGwxlVxAVVxALZ/gdktqwFlb84
TLSH
T1883222C506DBBC1CC382D094DB531EC2EA0366D1A0F617197BB69503EADDB8AC3A4E74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VBFFD5~1.SYS

Path \??\c:\users\admin\appdata\local\svt\vbcable\VBFFD5~1.SYS
Size 137KB
SHA256 f01344602472f1b527de5ee98f18987c03db48fea444e457d061e937f1d531d5
MD5 7b69ad5c60efb7e802bc7fda8b22bc4e
SHA1 96749d221eea16972393ab529a6ede85a91e6f94
SHA512 827027d4951bae48b82b5cca72efbd91a48bd5fd0a5206e78c393f098013d186b4ab65f5a78a036b25e74aae4950f3ffc712571dea8335b89c35fbd6c9154d48
SSDEEP 1536:Fwg3HqjC/TQy3EDp1/Sjl5RbVpqxmubMnDp0IcjHjSezF:PKjCB3a/Sjl5vDubMlCjDhx
TLSH
T140D3E5A6B2A43AF1C48D10F1C66C9F86D760ED885BC5878720227B190E737E97D34E67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vbaudio_cable64_win10.cat

Path \??\c:\users\admin\appdata\local\svt\vbcable\vbaudio_cable64_win10.cat
Size 12KB
SHA256 0a921ebadbe39cf3fa7c14ff37d1ca22565a9651244bd3ac177dc810bc99072e
MD5 12b8515be2a7c142674fecc666e049c8
SHA1 2551eec8bd705c343f5fa03faec414cb9d865f22
SHA512 4c6c62a612bb9b2731ed76196b57cbd6147a8d66785b7c023b9f3a7399fbc498cf8d4fe9478acaf2f89c849170d10fd0e70008cc1c929be54fafed87ed590726
SSDEEP 192:zIL5u91AJCqxRnnXBEwZIhYCvrEmeDtagQ5X01k9z3A1oDnucJp:QRdRIh3wmeDtdQ5R9zQoDucJp
TLSH
T18E42F8A6855D4083FAA3AC6053E4F5577C3A37CF6C4015AA62DFF71A09A23C8F71426E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download