Windows Analysis Report
MDE_File_Sample_e8a48b47bc6e903a5bcddebf2d9f99488f6556ac.zip

Overview

General Information

Sample name: MDE_File_Sample_e8a48b47bc6e903a5bcddebf2d9f99488f6556ac.zip
Analysis ID: 1560303
MD5: 1c3bcaa1bdaddc9620cb683ddfc29c6e
SHA1: 00d16e6d4f1da74d65c0d62f9a5a7f42bd0d339f
SHA256: ec3680e6281f7638aa5658b302296a483bef6d9c132f32c21865d84b371107f3
Infos:

Detection

Score: 56
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Installs new ROOT certificates
Registers a new ROOT certificate
Sigma detected: CMSTP Execution Process Creation
Uses cmd line tools excessively to alter registry or file data
Creates a process in suspended mode (likely to inject code)
Creates or modifies windows services
Deletes files inside the Windows folder
Drops PE files
Drops PE files to the windows directory (C:\Windows)
Drops certificate files (DER)
Found dropped PE file which has not been started or loaded
Sample execution stops while process was sleeping (likely an evasion)
Sigma detected: CurrentVersion Autorun Keys Modification
Uses a Windows Living Off The Land Binaries (LOL bins)
Uses reg.exe to modify the Windows registry

Classification

Source: Binary string: wextract.pdb source: VpnClientSetupAmd64.exe, 00000003.00000000.1231437957.00007FF627459000.00000002.00000001.01000000.00000006.sdmp, VpnClientSetupAmd64.exe, 00000006.00000002.1261207980.00007FF627459000.00000002.00000001.01000000.00000006.sdmp, VpnClientSetupAmd64.exe, 00000015.00000000.1430709877.00007FF77FFB9000.00000002.00000001.01000000.00000006.sdmp, VpnClientSetupAmd64.exe, 00000017.00000002.1463121169.00007FF77FFB9000.00000002.00000001.01000000.00000006.sdmp
Source: Binary string: wextract.pdbGCTL source: VpnClientSetupAmd64.exe, 00000003.00000000.1231437957.00007FF627459000.00000002.00000001.01000000.00000006.sdmp, VpnClientSetupAmd64.exe, 00000006.00000002.1261207980.00007FF627459000.00000002.00000001.01000000.00000006.sdmp, VpnClientSetupAmd64.exe, 00000015.00000000.1430709877.00007FF77FFB9000.00000002.00000001.01000000.00000006.sdmp, VpnClientSetupAmd64.exe, 00000017.00000002.1463121169.00007FF77FFB9000.00000002.00000001.01000000.00000006.sdmp
Source: Binary string: cmroute.pdbH source: VpnClientSetupAmd64.exe, 00000006.00000003.1249442070.00000172EEE8B000.00000004.00000020.00020000.00000000.sdmp, cmstp.exe, 00000007.00000003.1251744688.0000025039A66000.00000004.00000020.00020000.00000000.sdmp, cmstp.exe, 00000018.00000003.1454652375.000001D7A9002000.00000004.00000020.00020000.00000000.sdmp, SET501E.tmp.24.dr, cmroute.dll.6.dr, OLD500E.tmp.24.dr, SETD5.tmp.7.dr
Source: Binary string: cmroute.pdb source: VpnClientSetupAmd64.exe, 00000006.00000003.1249442070.00000172EEE8B000.00000004.00000020.00020000.00000000.sdmp, cmstp.exe, 00000007.00000003.1251744688.0000025039A66000.00000004.00000020.00020000.00000000.sdmp, cmstp.exe, 00000018.00000003.1454652375.000001D7A9002000.00000004.00000020.00020000.00000000.sdmp, SET501E.tmp.24.dr, cmroute.dll.6.dr, OLD500E.tmp.24.dr, SETD5.tmp.7.dr
Source: VpnClientSetupAmd64.exe, 00000006.00000003.1249442070.00000172EEE8B000.00000004.00000020.00020000.00000000.sdmp, cmstp.exe, 00000007.00000003.1251744688.0000025039A66000.00000004.00000020.00020000.00000000.sdmp, cmstp.exe, 00000018.00000003.1454652375.000001D7A9002000.00000004.00000020.00020000.00000000.sdmp, SET501E.tmp.24.dr, cmroute.dll.6.dr, OLD500E.tmp.24.dr, SETD5.tmp.7.dr String found in binary or memory: http://crl1.ame.gbl/aia/AMERoot_ameroot.crt0
Source: VpnClientSetupAmd64.exe, 00000006.00000003.1249442070.00000172EEE8B000.00000004.00000020.00020000.00000000.sdmp, cmstp.exe, 00000007.00000003.1251744688.0000025039A66000.00000004.00000020.00020000.00000000.sdmp, cmstp.exe, 00000018.00000003.1454652375.000001D7A9002000.00000004.00000020.00020000.00000000.sdmp, SET501E.tmp.24.dr, cmroute.dll.6.dr, OLD500E.tmp.24.dr, SETD5.tmp.7.dr String found in binary or memory: http://crl1.ame.gbl/aia/BY2PKICSCA01.AME.GBL_AME%20CS%20CA%2001(2).crt0R
Source: VpnClientSetupAmd64.exe, 00000006.00000003.1249442070.00000172EEE8B000.00000004.00000020.00020000.00000000.sdmp, cmstp.exe, 00000007.00000003.1251744688.0000025039A66000.00000004.00000020.00020000.00000000.sdmp, cmstp.exe, 00000018.00000003.1454652375.000001D7A9002000.00000004.00000020.00020000.00000000.sdmp, SET501E.tmp.24.dr, cmroute.dll.6.dr, OLD500E.tmp.24.dr, SETD5.tmp.7.dr String found in binary or memory: http://crl1.ame.gbl/crl/AME%20CS%20CA%2001(2).crl
Source: VpnClientSetupAmd64.exe, 00000006.00000003.1249442070.00000172EEE8B000.00000004.00000020.00020000.00000000.sdmp, cmstp.exe, 00000007.00000003.1251744688.0000025039A66000.00000004.00000020.00020000.00000000.sdmp, cmstp.exe, 00000018.00000003.1454652375.000001D7A9002000.00000004.00000020.00020000.00000000.sdmp, SET501E.tmp.24.dr, cmroute.dll.6.dr, OLD500E.tmp.24.dr, SETD5.tmp.7.dr String found in binary or memory: http://crl1.ame.gbl/crl/ameroot.crl
Source: VpnClientSetupAmd64.exe, 00000006.00000003.1249442070.00000172EEE8B000.00000004.00000020.00020000.00000000.sdmp, cmstp.exe, 00000007.00000003.1251744688.0000025039A66000.00000004.00000020.00020000.00000000.sdmp, cmstp.exe, 00000018.00000003.1454652375.000001D7A9002000.00000004.00000020.00020000.00000000.sdmp, SET501E.tmp.24.dr, cmroute.dll.6.dr, OLD500E.tmp.24.dr, SETD5.tmp.7.dr String found in binary or memory: http://crl2.ame.gbl/aia/AMERoot_ameroot.crt07
Source: VpnClientSetupAmd64.exe, 00000006.00000003.1249442070.00000172EEE8B000.00000004.00000020.00020000.00000000.sdmp, cmstp.exe, 00000007.00000003.1251744688.0000025039A66000.00000004.00000020.00020000.00000000.sdmp, cmstp.exe, 00000018.00000003.1454652375.000001D7A9002000.00000004.00000020.00020000.00000000.sdmp, SET501E.tmp.24.dr, cmroute.dll.6.dr, OLD500E.tmp.24.dr, SETD5.tmp.7.dr String found in binary or memory: http://crl2.ame.gbl/aia/BY2PKICSCA01.AME.GBL_AME%20CS%20CA%2001(2).crt0R
Source: VpnClientSetupAmd64.exe, 00000006.00000003.1249442070.00000172EEE8B000.00000004.00000020.00020000.00000000.sdmp, cmstp.exe, 00000007.00000003.1251744688.0000025039A66000.00000004.00000020.00020000.00000000.sdmp, cmstp.exe, 00000018.00000003.1454652375.000001D7A9002000.00000004.00000020.00020000.00000000.sdmp, SET501E.tmp.24.dr, cmroute.dll.6.dr, OLD500E.tmp.24.dr, SETD5.tmp.7.dr String found in binary or memory: http://crl2.ame.gbl/crl/AME%20CS%20CA%2001(2).crl
Source: VpnClientSetupAmd64.exe, 00000006.00000003.1249442070.00000172EEE8B000.00000004.00000020.00020000.00000000.sdmp, cmstp.exe, 00000007.00000003.1251744688.0000025039A66000.00000004.00000020.00020000.00000000.sdmp, cmstp.exe, 00000018.00000003.1454652375.000001D7A9002000.00000004.00000020.00020000.00000000.sdmp, SET501E.tmp.24.dr, cmroute.dll.6.dr, OLD500E.tmp.24.dr, SETD5.tmp.7.dr String found in binary or memory: http://crl2.ame.gbl/crl/ameroot.crl
Source: VpnClientSetupAmd64.exe, 00000006.00000003.1249442070.00000172EEE8B000.00000004.00000020.00020000.00000000.sdmp, cmstp.exe, 00000007.00000003.1251744688.0000025039A66000.00000004.00000020.00020000.00000000.sdmp, cmstp.exe, 00000018.00000003.1454652375.000001D7A9002000.00000004.00000020.00020000.00000000.sdmp, SET501E.tmp.24.dr, cmroute.dll.6.dr, OLD500E.tmp.24.dr, SETD5.tmp.7.dr String found in binary or memory: http://crl3.ame.gbl/aia/AMERoot_ameroot.crt07
Source: VpnClientSetupAmd64.exe, 00000006.00000003.1249442070.00000172EEE8B000.00000004.00000020.00020000.00000000.sdmp, cmstp.exe, 00000007.00000003.1251744688.0000025039A66000.00000004.00000020.00020000.00000000.sdmp, cmstp.exe, 00000018.00000003.1454652375.000001D7A9002000.00000004.00000020.00020000.00000000.sdmp, SET501E.tmp.24.dr, cmroute.dll.6.dr, OLD500E.tmp.24.dr, SETD5.tmp.7.dr String found in binary or memory: http://crl3.ame.gbl/aia/BY2PKICSCA01.AME.GBL_AME%20CS%20CA%2001(2).crt0R
Source: VpnClientSetupAmd64.exe, 00000006.00000003.1249442070.00000172EEE8B000.00000004.00000020.00020000.00000000.sdmp, cmstp.exe, 00000007.00000003.1251744688.0000025039A66000.00000004.00000020.00020000.00000000.sdmp, cmstp.exe, 00000018.00000003.1454652375.000001D7A9002000.00000004.00000020.00020000.00000000.sdmp, SET501E.tmp.24.dr, cmroute.dll.6.dr, OLD500E.tmp.24.dr, SETD5.tmp.7.dr String found in binary or memory: http://crl3.ame.gbl/crl/AME%20CS%20CA%2001(2).crl
Source: VpnClientSetupAmd64.exe, 00000006.00000003.1249442070.00000172EEE8B000.00000004.00000020.00020000.00000000.sdmp, cmstp.exe, 00000007.00000003.1251744688.0000025039A66000.00000004.00000020.00020000.00000000.sdmp, cmstp.exe, 00000018.00000003.1454652375.000001D7A9002000.00000004.00000020.00020000.00000000.sdmp, SET501E.tmp.24.dr, cmroute.dll.6.dr, OLD500E.tmp.24.dr, SETD5.tmp.7.dr String found in binary or memory: http://crl3.ame.gbl/crl/ameroot.crl
Source: VpnClientSetupAmd64.exe, 00000006.00000003.1249442070.00000172EEE8B000.00000004.00000020.00020000.00000000.sdmp, cmstp.exe, 00000007.00000003.1251744688.0000025039A66000.00000004.00000020.00020000.00000000.sdmp, cmstp.exe, 00000018.00000003.1454652375.000001D7A9002000.00000004.00000020.00020000.00000000.sdmp, SET501E.tmp.24.dr, cmroute.dll.6.dr, OLD500E.tmp.24.dr, SETD5.tmp.7.dr String found in binary or memory: http://crl4.ame.gbl/aia/BY2PKICSCA01.AME.GBL_AME%20CS%20CA%2001(2).crt0
Source: VpnClientSetupAmd64.exe, 00000006.00000003.1249442070.00000172EEE8B000.00000004.00000020.00020000.00000000.sdmp, cmstp.exe, 00000007.00000003.1251744688.0000025039A66000.00000004.00000020.00020000.00000000.sdmp, cmstp.exe, 00000018.00000003.1454652375.000001D7A9002000.00000004.00000020.00020000.00000000.sdmp, SET501E.tmp.24.dr, cmroute.dll.6.dr, OLD500E.tmp.24.dr, SETD5.tmp.7.dr String found in binary or memory: http://crl4.ame.gbl/crl/AME%20CS%20CA%2001(2).crl

E-Banking Fraud
barindex
Registers a new ROOT certificate
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\certutil.exe certutil -addstore root C:\Users\user\AppData\Roaming\Microsoft\Network\Connections\Cm\ce500069-adf3-426a-a91d-e5a0b4553b19\ce500069-adf3-426a-a91d-e5a0b4553b19.cer startup_13
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\certutil.exe certutil -addstore root C:\Users\user\AppData\Roaming\Microsoft\Network\Connections\Cm\ce500069-adf3-426a-a91d-e5a0b4553b19\ce500069-adf3-426a-a91d-e5a0b4553b19.cer startup_29
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\certutil.exe certutil -addstore root C:\Users\user\AppData\Roaming\Microsoft\Network\Connections\Cm\ce500069-adf3-426a-a91d-e5a0b4553b19\ce500069-adf3-426a-a91d-e5a0b4553b19.cer b_327383cd Jump to behavior
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\certutil.exe certutil -addstore root C:\Users\user\AppData\Roaming\Microsoft\Network\Connections\Cm\ce500069-adf3-426a-a91d-e5a0b4553b19\ce500069-adf3-426a-a91d-e5a0b4553b19.cer b_96934ebd
Drops certificate files (DER)
Source: C:\Windows\System32\cmstp.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Network\Connections\Cm\ce500069-adf3-426a-a91d-e5a0b4553b19\ce500069-adf3-426a-a91d-e5a0b4553b19.cer (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Temp1_MDE_File_Sample_e8a48b47bc6e903a5bcddebf2d9f99488f6556ac.zip\VpnClientSetupAmd64.exe File created: C:\Users\user\AppData\Local\Temp\IXP000.TMP\ce500069-adf3-426a-a91d-e5a0b4553b19.cer Jump to dropped file
Source: C:\Windows\System32\cmstp.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Network\Connections\Cm\ce500069-adf3-426a-a91d-e5a0b4553b19\SETE5.tmp Jump to dropped file
Source: C:\Windows\System32\cmstp.exe File created: C:\Windows\Temp\OLD502E.tmp Jump to dropped file
Source: C:\Windows\System32\cmstp.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Network\Connections\Cm\ce500069-adf3-426a-a91d-e5a0b4553b19\SET503E.tmp Jump to dropped file
Deletes files inside the Windows folder
Source: C:\Windows\System32\cmstp.exe File deleted: C:\Windows\Temp\OLD5061.tmp Jump to behavior
Uses a Windows Living Off The Land Binaries (LOL bins)
Source: C:\Users\user\AppData\Local\Temp\Temp1_MDE_File_Sample_e8a48b47bc6e903a5bcddebf2d9f99488f6556ac.zip\VpnClientSetupAmd64.exe Process created: C:\Windows\System32\cmstp.exe cmstp.exe /s /su /ns ce500069-adf3-426a-a91d-e5a0b4553b19.inf
Source: C:\Users\user\AppData\Local\Temp\Temp1_MDE_File_Sample_e8a48b47bc6e903a5bcddebf2d9f99488f6556ac.zip\VpnClientSetupAmd64.exe Process created: C:\Windows\System32\cmstp.exe cmstp.exe /s /su /ns ce500069-adf3-426a-a91d-e5a0b4553b19.inf
Source: C:\Users\user\AppData\Local\Temp\Temp1_MDE_File_Sample_e8a48b47bc6e903a5bcddebf2d9f99488f6556ac.zip\VpnClientSetupAmd64.exe Process created: C:\Windows\System32\cmstp.exe cmstp.exe /s /su /ns ce500069-adf3-426a-a91d-e5a0b4553b19.inf Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Temp1_MDE_File_Sample_e8a48b47bc6e903a5bcddebf2d9f99488f6556ac.zip\VpnClientSetupAmd64.exe Process created: C:\Windows\System32\cmstp.exe cmstp.exe /s /su /ns ce500069-adf3-426a-a91d-e5a0b4553b19.inf Jump to behavior
Uses reg.exe to modify the Windows registry
Source: C:\Windows\System32\cmstp.exe Process created: C:\Windows\System32\reg.exe reg add HKLM\SYSTEM\CurrentControlSet\Services\RasMan\PPP\EAP\13 /v SelectSelfSignedCert /t REG_DWORD /d 1 /f
Source: classification engine Classification label: mal56.bank.winZIP@27/52@0/0
Source: C:\Windows\System32\cmstp.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Network\Connections\Cm Jump to behavior
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6160:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1640:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5892:120:WilError_03
Source: C:\Windows\System32\cmstp.exe Mutant created: \Sessions\1\BaseNamedObjects\Connection Manager Profile Installer Mutex
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6448:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1556:120:WilError_03
Source: C:\Users\user\AppData\Local\Temp\Temp1_MDE_File_Sample_e8a48b47bc6e903a5bcddebf2d9f99488f6556ac.zip\VpnClientSetupAmd64.exe File created: C:\Users\user\AppData\Local\Temp\IXP000.TMP Jump to behavior
Source: C:\Windows\System32\rundll32.exe Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: unknown Process created: C:\Windows\System32\rundll32.exe C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
Source: unknown Process created: C:\Windows\System32\rundll32.exe C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
Source: unknown Process created: C:\Users\user\AppData\Local\Temp\Temp1_MDE_File_Sample_e8a48b47bc6e903a5bcddebf2d9f99488f6556ac.zip\VpnClientSetupAmd64.exe "C:\Users\user\AppData\Local\Temp\Temp1_MDE_File_Sample_e8a48b47bc6e903a5bcddebf2d9f99488f6556ac.zip\VpnClientSetupAmd64.exe"
Source: unknown Process created: C:\Users\user\AppData\Local\Temp\Temp1_MDE_File_Sample_e8a48b47bc6e903a5bcddebf2d9f99488f6556ac.zip\VpnClientSetupAmd64.exe "C:\Users\user\AppData\Local\Temp\Temp1_MDE_File_Sample_e8a48b47bc6e903a5bcddebf2d9f99488f6556ac.zip\VpnClientSetupAmd64.exe"
Source: C:\Users\user\AppData\Local\Temp\Temp1_MDE_File_Sample_e8a48b47bc6e903a5bcddebf2d9f99488f6556ac.zip\VpnClientSetupAmd64.exe Process created: C:\Windows\System32\cmstp.exe cmstp.exe /s /su /ns ce500069-adf3-426a-a91d-e5a0b4553b19.inf
Source: C:\Windows\System32\cmstp.exe Process created: C:\Windows\System32\reg.exe reg add HKLM\SYSTEM\CurrentControlSet\Services\RasMan\PPP\EAP\13 /v SelectSelfSignedCert /t REG_DWORD /d 1 /f
Source: C:\Windows\System32\reg.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmstp.exe Process created: C:\Windows\System32\cmd.exe cmd.exe /c certutil -addstore root %APPDATA%\Microsoft\Network\Connections\Cm\ce500069-adf3-426a-a91d-e5a0b4553b19\ce500069-adf3-426a-a91d-e5a0b4553b19.cer
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\certutil.exe certutil -addstore root C:\Users\user\AppData\Roaming\Microsoft\Network\Connections\Cm\ce500069-adf3-426a-a91d-e5a0b4553b19\ce500069-adf3-426a-a91d-e5a0b4553b19.cer
Source: unknown Process created: C:\Users\user\AppData\Local\Temp\Temp1_MDE_File_Sample_e8a48b47bc6e903a5bcddebf2d9f99488f6556ac.zip\VpnClientSetupAmd64.exe "C:\Users\user\AppData\Local\Temp\Temp1_MDE_File_Sample_e8a48b47bc6e903a5bcddebf2d9f99488f6556ac.zip\VpnClientSetupAmd64.exe"
Source: unknown Process created: C:\Users\user\AppData\Local\Temp\Temp1_MDE_File_Sample_e8a48b47bc6e903a5bcddebf2d9f99488f6556ac.zip\VpnClientSetupAmd64.exe "C:\Users\user\AppData\Local\Temp\Temp1_MDE_File_Sample_e8a48b47bc6e903a5bcddebf2d9f99488f6556ac.zip\VpnClientSetupAmd64.exe"
Source: C:\Users\user\AppData\Local\Temp\Temp1_MDE_File_Sample_e8a48b47bc6e903a5bcddebf2d9f99488f6556ac.zip\VpnClientSetupAmd64.exe Process created: C:\Windows\System32\cmstp.exe cmstp.exe /s /su /ns ce500069-adf3-426a-a91d-e5a0b4553b19.inf
Source: C:\Windows\System32\cmstp.exe Process created: C:\Windows\System32\reg.exe reg add HKLM\SYSTEM\CurrentControlSet\Services\RasMan\PPP\EAP\13 /v SelectSelfSignedCert /t REG_DWORD /d 1 /f
Source: C:\Windows\System32\reg.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmstp.exe Process created: C:\Windows\System32\cmd.exe cmd.exe /c certutil -addstore root %APPDATA%\Microsoft\Network\Connections\Cm\ce500069-adf3-426a-a91d-e5a0b4553b19\ce500069-adf3-426a-a91d-e5a0b4553b19.cer
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\certutil.exe certutil -addstore root C:\Users\user\AppData\Roaming\Microsoft\Network\Connections\Cm\ce500069-adf3-426a-a91d-e5a0b4553b19\ce500069-adf3-426a-a91d-e5a0b4553b19.cer
Source: unknown Process created: C:\Windows\System32\rasautou.exe "C:\Windows\system32\rasautou.exe" -o -f "C:\Users\user\AppData\Roaming\Microsoft\Network\Connections\Pbk\rasphone.pbk" -e "Vnet-Lab-WE"
Source: C:\Windows\System32\rasautou.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\Temp1_MDE_File_Sample_e8a48b47bc6e903a5bcddebf2d9f99488f6556ac.zip\VpnClientSetupAmd64.exe Process created: C:\Windows\System32\cmstp.exe cmstp.exe /s /su /ns ce500069-adf3-426a-a91d-e5a0b4553b19.inf Jump to behavior
Source: C:\Windows\System32\cmstp.exe Process created: C:\Windows\System32\reg.exe reg add HKLM\SYSTEM\CurrentControlSet\Services\RasMan\PPP\EAP\13 /v SelectSelfSignedCert /t REG_DWORD /d 1 /f Jump to behavior
Source: C:\Windows\System32\cmstp.exe Process created: C:\Windows\System32\cmd.exe cmd.exe /c certutil -addstore root %APPDATA%\Microsoft\Network\Connections\Cm\ce500069-adf3-426a-a91d-e5a0b4553b19\ce500069-adf3-426a-a91d-e5a0b4553b19.cer Jump to behavior
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\certutil.exe certutil -addstore root C:\Users\user\AppData\Roaming\Microsoft\Network\Connections\Cm\ce500069-adf3-426a-a91d-e5a0b4553b19\ce500069-adf3-426a-a91d-e5a0b4553b19.cer Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Temp1_MDE_File_Sample_e8a48b47bc6e903a5bcddebf2d9f99488f6556ac.zip\VpnClientSetupAmd64.exe Process created: C:\Windows\System32\cmstp.exe cmstp.exe /s /su /ns ce500069-adf3-426a-a91d-e5a0b4553b19.inf Jump to behavior
Source: C:\Windows\System32\cmstp.exe Process created: C:\Windows\System32\reg.exe reg add HKLM\SYSTEM\CurrentControlSet\Services\RasMan\PPP\EAP\13 /v SelectSelfSignedCert /t REG_DWORD /d 1 /f Jump to behavior
Source: C:\Windows\System32\cmstp.exe Process created: C:\Windows\System32\cmd.exe cmd.exe /c certutil -addstore root %APPDATA%\Microsoft\Network\Connections\Cm\ce500069-adf3-426a-a91d-e5a0b4553b19\ce500069-adf3-426a-a91d-e5a0b4553b19.cer Jump to behavior
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\certutil.exe certutil -addstore root C:\Users\user\AppData\Roaming\Microsoft\Network\Connections\Cm\ce500069-adf3-426a-a91d-e5a0b4553b19\ce500069-adf3-426a-a91d-e5a0b4553b19.cer
Source: C:\Users\user\AppData\Local\Temp\Temp1_MDE_File_Sample_e8a48b47bc6e903a5bcddebf2d9f99488f6556ac.zip\VpnClientSetupAmd64.exe Section loaded: cabinet.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Temp1_MDE_File_Sample_e8a48b47bc6e903a5bcddebf2d9f99488f6556ac.zip\VpnClientSetupAmd64.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Temp1_MDE_File_Sample_e8a48b47bc6e903a5bcddebf2d9f99488f6556ac.zip\VpnClientSetupAmd64.exe Section loaded: textshaping.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Temp1_MDE_File_Sample_e8a48b47bc6e903a5bcddebf2d9f99488f6556ac.zip\VpnClientSetupAmd64.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Temp1_MDE_File_Sample_e8a48b47bc6e903a5bcddebf2d9f99488f6556ac.zip\VpnClientSetupAmd64.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Temp1_MDE_File_Sample_e8a48b47bc6e903a5bcddebf2d9f99488f6556ac.zip\VpnClientSetupAmd64.exe Section loaded: textinputframework.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Temp1_MDE_File_Sample_e8a48b47bc6e903a5bcddebf2d9f99488f6556ac.zip\VpnClientSetupAmd64.exe Section loaded: coreuicomponents.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Temp1_MDE_File_Sample_e8a48b47bc6e903a5bcddebf2d9f99488f6556ac.zip\VpnClientSetupAmd64.exe Section loaded: coremessaging.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Temp1_MDE_File_Sample_e8a48b47bc6e903a5bcddebf2d9f99488f6556ac.zip\VpnClientSetupAmd64.exe Section loaded: ntmarta.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Temp1_MDE_File_Sample_e8a48b47bc6e903a5bcddebf2d9f99488f6556ac.zip\VpnClientSetupAmd64.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Temp1_MDE_File_Sample_e8a48b47bc6e903a5bcddebf2d9f99488f6556ac.zip\VpnClientSetupAmd64.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Temp1_MDE_File_Sample_e8a48b47bc6e903a5bcddebf2d9f99488f6556ac.zip\VpnClientSetupAmd64.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Temp1_MDE_File_Sample_e8a48b47bc6e903a5bcddebf2d9f99488f6556ac.zip\VpnClientSetupAmd64.exe Section loaded: feclient.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Temp1_MDE_File_Sample_e8a48b47bc6e903a5bcddebf2d9f99488f6556ac.zip\VpnClientSetupAmd64.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Temp1_MDE_File_Sample_e8a48b47bc6e903a5bcddebf2d9f99488f6556ac.zip\VpnClientSetupAmd64.exe Section loaded: advpack.dll Jump to behavior
Source: C:\Windows\System32\cmstp.exe Section loaded: cmutil.dll Jump to behavior
Source: C:\Windows\System32\cmstp.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\System32\cmstp.exe Section loaded: rtutils.dll Jump to behavior
Source: C:\Windows\System32\cmstp.exe Section loaded: cmcfg32.dll Jump to behavior
Source: C:\Windows\System32\cmstp.exe Section loaded: rasapi32.dll Jump to behavior
Source: C:\Windows\System32\cmstp.exe Section loaded: rasman.dll Jump to behavior
Source: C:\Windows\System32\cmstp.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Windows\System32\cmstp.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Windows\System32\cmstp.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Windows\System32\cmstp.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\System32\cmstp.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Windows\System32\cmstp.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Windows\System32\cmstp.exe Section loaded: advpack.dll Jump to behavior
Source: C:\Windows\System32\cmstp.exe Section loaded: devrtl.dll Jump to behavior
Source: C:\Windows\System32\cmstp.exe Section loaded: spinf.dll Jump to behavior
Source: C:\Windows\System32\cmstp.exe Section loaded: drvstore.dll Jump to behavior
Source: C:\Windows\System32\cmstp.exe Section loaded: spfileq.dll Jump to behavior
Source: C:\Windows\System32\cmstp.exe Section loaded: cabinet.dll Jump to behavior
Source: C:\Windows\System32\cmstp.exe Section loaded: ntmarta.dll Jump to behavior
Source: C:\Windows\System32\cmstp.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Windows\System32\cmstp.exe Section loaded: advpack.dll Jump to behavior
Source: C:\Windows\System32\cmstp.exe Section loaded: devrtl.dll Jump to behavior
Source: C:\Windows\System32\cmstp.exe Section loaded: spinf.dll Jump to behavior
Source: C:\Windows\System32\cmstp.exe Section loaded: drvstore.dll Jump to behavior
Source: C:\Windows\System32\cmstp.exe Section loaded: spfileq.dll Jump to behavior
Source: C:\Windows\System32\cmstp.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Windows\System32\cmstp.exe Section loaded: dsrole.dll Jump to behavior
Source: C:\Windows\System32\cmstp.exe Section loaded: advpack.dll Jump to behavior
Source: C:\Windows\System32\cmstp.exe Section loaded: devrtl.dll Jump to behavior
Source: C:\Windows\System32\cmstp.exe Section loaded: spinf.dll Jump to behavior
Source: C:\Windows\System32\cmstp.exe Section loaded: drvstore.dll Jump to behavior
Source: C:\Windows\System32\cmstp.exe Section loaded: spfileq.dll Jump to behavior
Source: C:\Windows\System32\cmstp.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Windows\System32\cmstp.exe Section loaded: cmcfg32.dll Jump to behavior
Source: C:\Windows\System32\certutil.exe Section loaded: certcli.dll Jump to behavior
Source: C:\Windows\System32\certutil.exe Section loaded: cabinet.dll Jump to behavior
Source: C:\Windows\System32\certutil.exe Section loaded: cryptui.dll Jump to behavior
Source: C:\Windows\System32\certutil.exe Section loaded: ncrypt.dll Jump to behavior
Source: C:\Windows\System32\certutil.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Windows\System32\certutil.exe Section loaded: ntdsapi.dll Jump to behavior
Source: C:\Windows\System32\certutil.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\System32\certutil.exe Section loaded: certca.dll Jump to behavior
Source: C:\Windows\System32\certutil.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Windows\System32\certutil.exe Section loaded: secur32.dll Jump to behavior
Source: C:\Windows\System32\certutil.exe Section loaded: samcli.dll Jump to behavior
Source: C:\Windows\System32\certutil.exe Section loaded: logoncli.dll Jump to behavior
Source: C:\Windows\System32\certutil.exe Section loaded: dsrole.dll Jump to behavior
Source: C:\Windows\System32\certutil.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Windows\System32\certutil.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\System32\certutil.exe Section loaded: ntasn1.dll Jump to behavior
Source: C:\Windows\System32\certutil.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Windows\System32\certutil.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Windows\System32\certutil.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Windows\System32\certutil.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Windows\System32\certutil.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Temp1_MDE_File_Sample_e8a48b47bc6e903a5bcddebf2d9f99488f6556ac.zip\VpnClientSetupAmd64.exe Section loaded: cabinet.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Temp1_MDE_File_Sample_e8a48b47bc6e903a5bcddebf2d9f99488f6556ac.zip\VpnClientSetupAmd64.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Temp1_MDE_File_Sample_e8a48b47bc6e903a5bcddebf2d9f99488f6556ac.zip\VpnClientSetupAmd64.exe Section loaded: textshaping.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Temp1_MDE_File_Sample_e8a48b47bc6e903a5bcddebf2d9f99488f6556ac.zip\VpnClientSetupAmd64.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Temp1_MDE_File_Sample_e8a48b47bc6e903a5bcddebf2d9f99488f6556ac.zip\VpnClientSetupAmd64.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Temp1_MDE_File_Sample_e8a48b47bc6e903a5bcddebf2d9f99488f6556ac.zip\VpnClientSetupAmd64.exe Section loaded: textinputframework.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Temp1_MDE_File_Sample_e8a48b47bc6e903a5bcddebf2d9f99488f6556ac.zip\VpnClientSetupAmd64.exe Section loaded: coreuicomponents.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Temp1_MDE_File_Sample_e8a48b47bc6e903a5bcddebf2d9f99488f6556ac.zip\VpnClientSetupAmd64.exe Section loaded: coremessaging.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Temp1_MDE_File_Sample_e8a48b47bc6e903a5bcddebf2d9f99488f6556ac.zip\VpnClientSetupAmd64.exe Section loaded: ntmarta.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Temp1_MDE_File_Sample_e8a48b47bc6e903a5bcddebf2d9f99488f6556ac.zip\VpnClientSetupAmd64.exe Section loaded: coremessaging.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Temp1_MDE_File_Sample_e8a48b47bc6e903a5bcddebf2d9f99488f6556ac.zip\VpnClientSetupAmd64.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Temp1_MDE_File_Sample_e8a48b47bc6e903a5bcddebf2d9f99488f6556ac.zip\VpnClientSetupAmd64.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Temp1_MDE_File_Sample_e8a48b47bc6e903a5bcddebf2d9f99488f6556ac.zip\VpnClientSetupAmd64.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Temp1_MDE_File_Sample_e8a48b47bc6e903a5bcddebf2d9f99488f6556ac.zip\VpnClientSetupAmd64.exe Section loaded: feclient.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Temp1_MDE_File_Sample_e8a48b47bc6e903a5bcddebf2d9f99488f6556ac.zip\VpnClientSetupAmd64.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Temp1_MDE_File_Sample_e8a48b47bc6e903a5bcddebf2d9f99488f6556ac.zip\VpnClientSetupAmd64.exe Section loaded: advpack.dll Jump to behavior
Source: C:\Windows\System32\cmstp.exe Section loaded: cmutil.dll Jump to behavior
Source: C:\Windows\System32\cmstp.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\System32\cmstp.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\System32\cmstp.exe Section loaded: rtutils.dll Jump to behavior
Source: C:\Windows\System32\cmstp.exe Section loaded: cmcfg32.dll Jump to behavior
Source: C:\Windows\System32\cmstp.exe Section loaded: rasapi32.dll Jump to behavior
Source: C:\Windows\System32\cmstp.exe Section loaded: rasman.dll Jump to behavior
Source: C:\Windows\System32\cmstp.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Windows\System32\cmstp.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Windows\System32\cmstp.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Windows\System32\cmstp.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\System32\cmstp.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Windows\System32\cmstp.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Windows\System32\cmstp.exe Section loaded: advpack.dll Jump to behavior
Source: C:\Windows\System32\cmstp.exe Section loaded: devrtl.dll Jump to behavior
Source: C:\Windows\System32\cmstp.exe Section loaded: spinf.dll Jump to behavior
Source: C:\Windows\System32\cmstp.exe Section loaded: drvstore.dll Jump to behavior
Source: C:\Windows\System32\cmstp.exe Section loaded: spfileq.dll Jump to behavior
Source: C:\Windows\System32\cmstp.exe Section loaded: ntmarta.dll Jump to behavior
Source: C:\Windows\System32\cmstp.exe Section loaded: cabinet.dll Jump to behavior
Source: C:\Windows\System32\cmstp.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Windows\System32\cmstp.exe Section loaded: advpack.dll Jump to behavior
Source: C:\Windows\System32\cmstp.exe Section loaded: devrtl.dll Jump to behavior
Source: C:\Windows\System32\cmstp.exe Section loaded: spinf.dll Jump to behavior
Source: C:\Windows\System32\cmstp.exe Section loaded: drvstore.dll Jump to behavior
Source: C:\Windows\System32\cmstp.exe Section loaded: spfileq.dll Jump to behavior
Source: C:\Windows\System32\cmstp.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Windows\System32\cmstp.exe Section loaded: dsrole.dll Jump to behavior
Source: C:\Windows\System32\cmstp.exe Section loaded: advpack.dll Jump to behavior
Source: C:\Windows\System32\cmstp.exe Section loaded: devrtl.dll Jump to behavior
Source: C:\Windows\System32\cmstp.exe Section loaded: spinf.dll Jump to behavior
Source: C:\Windows\System32\cmstp.exe Section loaded: drvstore.dll Jump to behavior
Source: C:\Windows\System32\cmstp.exe Section loaded: spfileq.dll Jump to behavior
Source: C:\Windows\System32\cmstp.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Windows\System32\cmstp.exe Section loaded: cmcfg32.dll Jump to behavior
Source: C:\Windows\System32\certutil.exe Section loaded: certcli.dll Jump to behavior
Source: C:\Windows\System32\certutil.exe Section loaded: cabinet.dll Jump to behavior
Source: C:\Windows\System32\certutil.exe Section loaded: cryptui.dll Jump to behavior
Source: C:\Windows\System32\certutil.exe Section loaded: ncrypt.dll Jump to behavior
Source: C:\Windows\System32\certutil.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Windows\System32\certutil.exe Section loaded: ntdsapi.dll Jump to behavior
Source: C:\Windows\System32\certutil.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\System32\certutil.exe Section loaded: certca.dll Jump to behavior
Source: C:\Windows\System32\certutil.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Windows\System32\certutil.exe Section loaded: secur32.dll Jump to behavior
Source: C:\Windows\System32\certutil.exe Section loaded: samcli.dll Jump to behavior
Source: C:\Windows\System32\certutil.exe Section loaded: logoncli.dll Jump to behavior
Source: C:\Windows\System32\certutil.exe Section loaded: dsrole.dll Jump to behavior
Source: C:\Windows\System32\certutil.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Windows\System32\certutil.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\System32\certutil.exe Section loaded: ntasn1.dll Jump to behavior
Source: C:\Windows\System32\certutil.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Windows\System32\certutil.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Windows\System32\certutil.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Windows\System32\certutil.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Windows\System32\rasautou.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Windows\System32\rasautou.exe Section loaded: rasapi32.dll Jump to behavior
Source: C:\Windows\System32\rasautou.exe Section loaded: rasdlg.dll Jump to behavior
Source: C:\Windows\System32\rasautou.exe Section loaded: rasman.dll Jump to behavior
Source: C:\Windows\System32\rasautou.exe Section loaded: mprapi.dll Jump to behavior
Source: C:\Windows\System32\rasautou.exe Section loaded: rtutils.dll Jump to behavior
Source: C:\Windows\System32\rasautou.exe Section loaded: dpapi.dll Jump to behavior
Source: C:\Windows\System32\rasautou.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\System32\rasautou.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Windows\System32\rasautou.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Windows\System32\rasautou.exe Section loaded: cmdial32.dll Jump to behavior
Source: C:\Windows\System32\rasautou.exe Section loaded: cmpbk32.dll Jump to behavior
Source: C:\Windows\System32\rasautou.exe Section loaded: cmutil.dll Jump to behavior
Source: C:\Windows\System32\rasautou.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\System32\rasautou.exe Section loaded: eappcfg.dll Jump to behavior
Source: C:\Windows\System32\rasautou.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Windows\System32\rasautou.exe Section loaded: setnetworklocation.dll Jump to behavior
Source: C:\Windows\System32\rasautou.exe Section loaded: rastls.dll Jump to behavior
Source: C:\Windows\System32\rasautou.exe Section loaded: wkscli.dll Jump to behavior
Source: C:\Windows\System32\rasautou.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Windows\System32\rasautou.exe Section loaded: eapphost.dll Jump to behavior
Source: C:\Windows\System32\rasautou.exe Section loaded: ncrypt.dll Jump to behavior
Source: C:\Windows\System32\rasautou.exe Section loaded: ntasn1.dll Jump to behavior
Source: C:\Windows\System32\rasautou.exe Section loaded: eapphost.dll Jump to behavior
Source: C:\Windows\System32\rasautou.exe Section loaded: ncrypt.dll Jump to behavior
Source: C:\Windows\System32\rasautou.exe Section loaded: ntasn1.dll Jump to behavior
Source: C:\Windows\System32\rasautou.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Windows\System32\rasautou.exe Section loaded: textinputframework.dll Jump to behavior
Source: C:\Windows\System32\rasautou.exe Section loaded: coreuicomponents.dll Jump to behavior
Source: C:\Windows\System32\rasautou.exe Section loaded: coremessaging.dll Jump to behavior
Source: C:\Windows\System32\rasautou.exe Section loaded: ntmarta.dll Jump to behavior
Source: C:\Windows\System32\rasautou.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Windows\System32\rasautou.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Windows\System32\rasautou.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Windows\System32\rasautou.exe Section loaded: textshaping.dll Jump to behavior
Source: C:\Windows\System32\rasautou.exe Section loaded: netsetupshim.dll Jump to behavior
Source: C:\Windows\System32\rasautou.exe Section loaded: netsetupapi.dll Jump to behavior
Source: C:\Windows\System32\rasautou.exe Section loaded: devrtl.dll Jump to behavior
Source: C:\Windows\System32\rasautou.exe Section loaded: netsetupengine.dll Jump to behavior
Source: C:\Windows\System32\rasautou.exe Section loaded: winnsi.dll Jump to behavior
Source: C:\Windows\System32\rasautou.exe Section loaded: cmlua.dll Jump to behavior
Source: C:\Windows\System32\rasautou.exe Section loaded: cmlua.dll Jump to behavior
Source: C:\Windows\System32\rasautou.exe Section loaded: comsvcs.dll Jump to behavior
Source: C:\Windows\System32\rasautou.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Windows\System32\rasautou.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Windows\System32\rasautou.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Windows\System32\rasautou.exe Section loaded: dsrole.dll Jump to behavior
Source: C:\Windows\System32\rasautou.exe Section loaded: rastls.dll Jump to behavior
Source: C:\Windows\System32\rasautou.exe Section loaded: wkscli.dll Jump to behavior
Source: C:\Windows\System32\rasautou.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Windows\System32\rasautou.exe Section loaded: eapphost.dll Jump to behavior
Source: C:\Windows\System32\rasautou.exe Section loaded: ncrypt.dll Jump to behavior
Source: C:\Windows\System32\rasautou.exe Section loaded: ntasn1.dll Jump to behavior
Source: C:\Windows\System32\rasautou.exe Section loaded: eapphost.dll Jump to behavior
Source: C:\Windows\System32\rasautou.exe Section loaded: ncrypt.dll Jump to behavior
Source: C:\Windows\System32\rasautou.exe Section loaded: ntasn1.dll Jump to behavior
Source: C:\Windows\System32\rasautou.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Windows\System32\rasautou.exe Section loaded: rastls.dll Jump to behavior
Source: C:\Windows\System32\rasautou.exe Section loaded: wkscli.dll Jump to behavior
Source: C:\Windows\System32\rasautou.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Windows\System32\rasautou.exe Section loaded: eapprovp.dll Jump to behavior
Source: C:\Windows\System32\rasautou.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Windows\System32\rasautou.exe Section loaded: wlanapi.dll Jump to behavior
Source: C:\Windows\System32\rasautou.exe Section loaded: ncrypt.dll Jump to behavior
Source: C:\Windows\System32\rasautou.exe Section loaded: ntasn1.dll Jump to behavior
Source: C:\Windows\System32\rasautou.exe Section loaded: eapphost.dll Jump to behavior
Source: C:\Windows\System32\rasautou.exe Section loaded: ncrypt.dll Jump to behavior
Source: C:\Windows\System32\rasautou.exe Section loaded: ntasn1.dll Jump to behavior
Source: C:\Windows\System32\rasautou.exe Section loaded: eapphost.dll Jump to behavior
Source: C:\Windows\System32\rasautou.exe Section loaded: ncrypt.dll Jump to behavior
Source: C:\Windows\System32\rasautou.exe Section loaded: ntasn1.dll Jump to behavior
Source: C:\Windows\System32\rasautou.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Windows\System32\rasautou.exe Section loaded: rastls.dll Jump to behavior
Source: C:\Windows\System32\rasautou.exe Section loaded: wkscli.dll Jump to behavior
Source: C:\Windows\System32\rasautou.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Windows\System32\rasautou.exe Section loaded: eapprovp.dll Jump to behavior
Source: C:\Windows\System32\rasautou.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Windows\System32\rasautou.exe Section loaded: wlanapi.dll Jump to behavior
Source: C:\Windows\System32\rasautou.exe Section loaded: ncrypt.dll Jump to behavior
Source: C:\Windows\System32\rasautou.exe Section loaded: ntasn1.dll Jump to behavior
Source: C:\Windows\System32\rasautou.exe Section loaded: eapphost.dll Jump to behavior
Source: C:\Windows\System32\rasautou.exe Section loaded: ncrypt.dll Jump to behavior
Source: C:\Windows\System32\rasautou.exe Section loaded: ntasn1.dll Jump to behavior
Source: C:\Windows\System32\rasautou.exe Section loaded: eapphost.dll Jump to behavior
Source: C:\Windows\System32\rasautou.exe Section loaded: ncrypt.dll Jump to behavior
Source: C:\Windows\System32\rasautou.exe Section loaded: ntasn1.dll Jump to behavior
Source: C:\Windows\System32\rasautou.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Windows\System32\rasautou.exe Section loaded: rastls.dll Jump to behavior
Source: C:\Windows\System32\rasautou.exe Section loaded: wkscli.dll Jump to behavior
Source: C:\Windows\System32\rasautou.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Windows\System32\rasautou.exe Section loaded: eapprovp.dll Jump to behavior
Source: C:\Windows\System32\rasautou.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Windows\System32\rasautou.exe Section loaded: wlanapi.dll Jump to behavior
Source: C:\Windows\System32\rasautou.exe Section loaded: ncrypt.dll Jump to behavior
Source: C:\Windows\System32\rasautou.exe Section loaded: ntasn1.dll Jump to behavior
Source: C:\Windows\System32\rasautou.exe Section loaded: eapphost.dll Jump to behavior
Source: C:\Windows\System32\rasautou.exe Section loaded: ncrypt.dll Jump to behavior
Source: C:\Windows\System32\rasautou.exe Section loaded: ntasn1.dll Jump to behavior
Source: C:\Windows\System32\rasautou.exe Section loaded: eapphost.dll Jump to behavior
Source: C:\Windows\System32\rasautou.exe Section loaded: ncrypt.dll Jump to behavior
Source: C:\Windows\System32\rasautou.exe Section loaded: ntasn1.dll Jump to behavior
Source: C:\Windows\System32\rasautou.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Windows\System32\rasautou.exe Section loaded: rastls.dll Jump to behavior
Source: C:\Windows\System32\rasautou.exe Section loaded: wkscli.dll Jump to behavior
Source: C:\Windows\System32\rasautou.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Windows\System32\rasautou.exe Section loaded: eapprovp.dll Jump to behavior
Source: C:\Windows\System32\rasautou.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Windows\System32\rasautou.exe Section loaded: wlanapi.dll Jump to behavior
Source: C:\Windows\System32\rasautou.exe Section loaded: ncrypt.dll Jump to behavior
Source: C:\Windows\System32\rasautou.exe Section loaded: ntasn1.dll Jump to behavior
Source: C:\Windows\System32\rasautou.exe Section loaded: eapphost.dll Jump to behavior
Source: C:\Windows\System32\rasautou.exe Section loaded: ncrypt.dll Jump to behavior
Source: C:\Windows\System32\rasautou.exe Section loaded: ntasn1.dll Jump to behavior
Source: C:\Windows\System32\rasautou.exe Section loaded: eapphost.dll Jump to behavior
Source: C:\Windows\System32\rasautou.exe Section loaded: ncrypt.dll Jump to behavior
Source: C:\Windows\System32\rasautou.exe Section loaded: ntasn1.dll Jump to behavior
Source: C:\Windows\System32\rasautou.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Windows\System32\rasautou.exe Section loaded: mprmsg.dll Jump to behavior
Source: C:\Windows\System32\rasautou.exe Section loaded: rastls.dll Jump to behavior
Source: C:\Windows\System32\rasautou.exe Section loaded: wkscli.dll Jump to behavior
Source: C:\Windows\System32\rasautou.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Windows\System32\rasautou.exe Section loaded: eapphost.dll Jump to behavior
Source: C:\Windows\System32\rasautou.exe Section loaded: ncrypt.dll Jump to behavior
Source: C:\Windows\System32\rasautou.exe Section loaded: ntasn1.dll Jump to behavior
Source: C:\Windows\System32\rasautou.exe Section loaded: eapphost.dll Jump to behavior
Source: C:\Windows\System32\rasautou.exe Section loaded: ncrypt.dll Jump to behavior
Source: C:\Windows\System32\rasautou.exe Section loaded: ntasn1.dll Jump to behavior
Source: C:\Windows\System32\rasautou.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Windows\System32\rasautou.exe Section loaded: rastls.dll Jump to behavior
Source: C:\Windows\System32\rasautou.exe Section loaded: wkscli.dll Jump to behavior
Source: C:\Windows\System32\rasautou.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Windows\System32\rasautou.exe Section loaded: eapprovp.dll Jump to behavior
Source: C:\Windows\System32\rasautou.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Windows\System32\rasautou.exe Section loaded: wlanapi.dll Jump to behavior
Source: C:\Windows\System32\rasautou.exe Section loaded: ncrypt.dll Jump to behavior
Source: C:\Windows\System32\rasautou.exe Section loaded: ntasn1.dll Jump to behavior
Source: C:\Windows\System32\rasautou.exe Section loaded: eapphost.dll Jump to behavior
Source: C:\Windows\System32\rasautou.exe Section loaded: ncrypt.dll Jump to behavior
Source: C:\Windows\System32\rasautou.exe Section loaded: ntasn1.dll Jump to behavior
Source: C:\Windows\System32\rasautou.exe Section loaded: eapphost.dll Jump to behavior
Source: C:\Windows\System32\rasautou.exe Section loaded: ncrypt.dll Jump to behavior
Source: C:\Windows\System32\rasautou.exe Section loaded: ntasn1.dll Jump to behavior
Source: C:\Windows\System32\rasautou.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Windows\System32\rasautou.exe Section loaded: rastls.dll Jump to behavior
Source: C:\Windows\System32\rasautou.exe Section loaded: wkscli.dll Jump to behavior
Source: C:\Windows\System32\rasautou.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Windows\System32\rasautou.exe Section loaded: eapprovp.dll Jump to behavior
Source: C:\Windows\System32\rasautou.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Windows\System32\rasautou.exe Section loaded: wlanapi.dll Jump to behavior
Source: C:\Windows\System32\rasautou.exe Section loaded: ncrypt.dll Jump to behavior
Source: C:\Windows\System32\rasautou.exe Section loaded: ntasn1.dll Jump to behavior
Source: C:\Windows\System32\rasautou.exe Section loaded: eapphost.dll Jump to behavior
Source: C:\Windows\System32\rasautou.exe Section loaded: ncrypt.dll Jump to behavior
Source: C:\Windows\System32\rasautou.exe Section loaded: ntasn1.dll Jump to behavior
Source: C:\Windows\System32\rasautou.exe Section loaded: eapphost.dll Jump to behavior
Source: C:\Windows\System32\rasautou.exe Section loaded: ncrypt.dll Jump to behavior
Source: C:\Windows\System32\rasautou.exe Section loaded: ntasn1.dll Jump to behavior
Source: C:\Windows\System32\rasautou.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Windows\System32\rasautou.exe Section loaded: rastls.dll Jump to behavior
Source: C:\Windows\System32\rasautou.exe Section loaded: wkscli.dll Jump to behavior
Source: C:\Windows\System32\rasautou.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Windows\System32\rasautou.exe Section loaded: eapprovp.dll Jump to behavior
Source: C:\Windows\System32\rasautou.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Windows\System32\rasautou.exe Section loaded: wlanapi.dll Jump to behavior
Source: C:\Windows\System32\rasautou.exe Section loaded: ncrypt.dll Jump to behavior
Source: C:\Windows\System32\rasautou.exe Section loaded: ntasn1.dll Jump to behavior
Source: C:\Windows\System32\rasautou.exe Section loaded: eapphost.dll Jump to behavior
Source: C:\Windows\System32\rasautou.exe Section loaded: ncrypt.dll Jump to behavior
Source: C:\Windows\System32\rasautou.exe Section loaded: ntasn1.dll Jump to behavior
Source: C:\Windows\System32\rasautou.exe Section loaded: eapphost.dll Jump to behavior
Source: C:\Windows\System32\rasautou.exe Section loaded: ncrypt.dll Jump to behavior
Source: C:\Windows\System32\rasautou.exe Section loaded: ntasn1.dll Jump to behavior
Source: C:\Windows\System32\rasautou.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Windows\System32\rasautou.exe Section loaded: rastls.dll Jump to behavior
Source: C:\Windows\System32\rasautou.exe Section loaded: wkscli.dll Jump to behavior
Source: C:\Windows\System32\rasautou.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Windows\System32\rasautou.exe Section loaded: eapprovp.dll Jump to behavior
Source: C:\Windows\System32\rasautou.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Windows\System32\rasautou.exe Section loaded: wlanapi.dll Jump to behavior
Source: C:\Windows\System32\rasautou.exe Section loaded: ncrypt.dll Jump to behavior
Source: C:\Windows\System32\rasautou.exe Section loaded: ntasn1.dll Jump to behavior
Source: C:\Windows\System32\rasautou.exe Section loaded: eapphost.dll Jump to behavior
Source: C:\Windows\System32\rasautou.exe Section loaded: ncrypt.dll Jump to behavior
Source: C:\Windows\System32\rasautou.exe Section loaded: ntasn1.dll Jump to behavior
Source: C:\Windows\System32\rasautou.exe Section loaded: eapphost.dll Jump to behavior
Source: C:\Windows\System32\rasautou.exe Section loaded: ncrypt.dll Jump to behavior
Source: C:\Windows\System32\rasautou.exe Section loaded: ntasn1.dll Jump to behavior
Source: C:\Windows\System32\rasautou.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Windows\System32\rasautou.exe Section loaded: rastls.dll Jump to behavior
Source: C:\Windows\System32\rasautou.exe Section loaded: wkscli.dll Jump to behavior
Source: C:\Windows\System32\rasautou.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Windows\System32\rasautou.exe Section loaded: eapphost.dll Jump to behavior
Source: C:\Windows\System32\rasautou.exe Section loaded: ncrypt.dll Jump to behavior
Source: C:\Windows\System32\rasautou.exe Section loaded: ntasn1.dll Jump to behavior
Source: C:\Windows\System32\rasautou.exe Section loaded: eapphost.dll Jump to behavior
Source: C:\Windows\System32\rasautou.exe Section loaded: ncrypt.dll Jump to behavior
Source: C:\Windows\System32\rasautou.exe Section loaded: ntasn1.dll Jump to behavior
Source: C:\Windows\System32\rasautou.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Windows\System32\rasautou.exe Section loaded: rastls.dll Jump to behavior
Source: C:\Windows\System32\rasautou.exe Section loaded: wkscli.dll Jump to behavior
Source: C:\Windows\System32\rasautou.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Windows\System32\rasautou.exe Section loaded: eapprovp.dll Jump to behavior
Source: C:\Windows\System32\rasautou.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Windows\System32\rasautou.exe Section loaded: wlanapi.dll Jump to behavior
Source: C:\Windows\System32\rasautou.exe Section loaded: ncrypt.dll Jump to behavior
Source: C:\Windows\System32\rasautou.exe Section loaded: ntasn1.dll Jump to behavior
Source: C:\Windows\System32\rasautou.exe Section loaded: eapphost.dll Jump to behavior
Source: C:\Windows\System32\rasautou.exe Section loaded: ncrypt.dll Jump to behavior
Source: C:\Windows\System32\rasautou.exe Section loaded: ntasn1.dll Jump to behavior
Source: C:\Windows\System32\rasautou.exe Section loaded: eapphost.dll Jump to behavior
Source: C:\Windows\System32\rasautou.exe Section loaded: ncrypt.dll Jump to behavior
Source: C:\Windows\System32\rasautou.exe Section loaded: ntasn1.dll Jump to behavior
Source: C:\Windows\System32\rasautou.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Windows\System32\rasautou.exe Section loaded: rastls.dll Jump to behavior
Source: C:\Windows\System32\rasautou.exe Section loaded: wkscli.dll Jump to behavior
Source: C:\Windows\System32\rasautou.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Windows\System32\rasautou.exe Section loaded: eapprovp.dll Jump to behavior
Source: C:\Windows\System32\rasautou.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Windows\System32\rasautou.exe Section loaded: wlanapi.dll Jump to behavior
Source: C:\Windows\System32\rasautou.exe Section loaded: ncrypt.dll Jump to behavior
Source: C:\Windows\System32\rasautou.exe Section loaded: ntasn1.dll Jump to behavior
Source: C:\Windows\System32\rasautou.exe Section loaded: eapphost.dll Jump to behavior
Source: C:\Windows\System32\rasautou.exe Section loaded: ncrypt.dll Jump to behavior
Source: C:\Windows\System32\rasautou.exe Section loaded: ntasn1.dll Jump to behavior
Source: C:\Windows\System32\rasautou.exe Section loaded: eapphost.dll Jump to behavior
Source: C:\Windows\System32\rasautou.exe Section loaded: ncrypt.dll Jump to behavior
Source: C:\Windows\System32\rasautou.exe Section loaded: ntasn1.dll Jump to behavior
Source: C:\Windows\System32\rasautou.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Windows\System32\rasautou.exe Section loaded: rastls.dll Jump to behavior
Source: C:\Windows\System32\rasautou.exe Section loaded: wkscli.dll Jump to behavior
Source: C:\Windows\System32\rasautou.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Windows\System32\rasautou.exe Section loaded: eapprovp.dll Jump to behavior
Source: C:\Windows\System32\rasautou.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Windows\System32\rasautou.exe Section loaded: wlanapi.dll Jump to behavior
Source: C:\Windows\System32\rasautou.exe Section loaded: ncrypt.dll Jump to behavior
Source: C:\Windows\System32\rasautou.exe Section loaded: ntasn1.dll Jump to behavior
Source: C:\Windows\System32\rasautou.exe Section loaded: eapphost.dll Jump to behavior
Source: C:\Windows\System32\rasautou.exe Section loaded: ncrypt.dll Jump to behavior
Source: C:\Windows\System32\rasautou.exe Section loaded: ntasn1.dll Jump to behavior
Source: C:\Windows\System32\rasautou.exe Section loaded: eapphost.dll Jump to behavior
Source: C:\Windows\System32\rasautou.exe Section loaded: ncrypt.dll Jump to behavior
Source: C:\Windows\System32\rasautou.exe Section loaded: ntasn1.dll Jump to behavior
Source: C:\Windows\System32\rasautou.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Windows\System32\rasautou.exe Section loaded: rastls.dll Jump to behavior
Source: C:\Windows\System32\rasautou.exe Section loaded: wkscli.dll Jump to behavior
Source: C:\Windows\System32\rasautou.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Windows\System32\rasautou.exe Section loaded: eapprovp.dll Jump to behavior
Source: C:\Windows\System32\rasautou.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Windows\System32\rasautou.exe Section loaded: wlanapi.dll Jump to behavior
Source: C:\Windows\System32\rasautou.exe Section loaded: ncrypt.dll Jump to behavior
Source: C:\Windows\System32\rasautou.exe Section loaded: ntasn1.dll Jump to behavior
Source: C:\Windows\System32\rasautou.exe Section loaded: eapphost.dll Jump to behavior
Source: C:\Windows\System32\rasautou.exe Section loaded: ncrypt.dll Jump to behavior
Source: C:\Windows\System32\rasautou.exe Section loaded: ntasn1.dll Jump to behavior
Source: C:\Windows\System32\rasautou.exe Section loaded: eapphost.dll Jump to behavior
Source: C:\Windows\System32\rasautou.exe Section loaded: ncrypt.dll Jump to behavior
Source: C:\Windows\System32\rasautou.exe Section loaded: ntasn1.dll Jump to behavior
Source: C:\Windows\System32\rasautou.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Windows\System32\rasautou.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5B035261-40F9-11D1-AAEC-00805FC1270E}\InProcServer32 Jump to behavior
Source: Window Recorder Window detected: More than 3 window changes detected
Source: Binary string: wextract.pdb source: VpnClientSetupAmd64.exe, 00000003.00000000.1231437957.00007FF627459000.00000002.00000001.01000000.00000006.sdmp, VpnClientSetupAmd64.exe, 00000006.00000002.1261207980.00007FF627459000.00000002.00000001.01000000.00000006.sdmp, VpnClientSetupAmd64.exe, 00000015.00000000.1430709877.00007FF77FFB9000.00000002.00000001.01000000.00000006.sdmp, VpnClientSetupAmd64.exe, 00000017.00000002.1463121169.00007FF77FFB9000.00000002.00000001.01000000.00000006.sdmp
Source: Binary string: wextract.pdbGCTL source: VpnClientSetupAmd64.exe, 00000003.00000000.1231437957.00007FF627459000.00000002.00000001.01000000.00000006.sdmp, VpnClientSetupAmd64.exe, 00000006.00000002.1261207980.00007FF627459000.00000002.00000001.01000000.00000006.sdmp, VpnClientSetupAmd64.exe, 00000015.00000000.1430709877.00007FF77FFB9000.00000002.00000001.01000000.00000006.sdmp, VpnClientSetupAmd64.exe, 00000017.00000002.1463121169.00007FF77FFB9000.00000002.00000001.01000000.00000006.sdmp
Source: Binary string: cmroute.pdbH source: VpnClientSetupAmd64.exe, 00000006.00000003.1249442070.00000172EEE8B000.00000004.00000020.00020000.00000000.sdmp, cmstp.exe, 00000007.00000003.1251744688.0000025039A66000.00000004.00000020.00020000.00000000.sdmp, cmstp.exe, 00000018.00000003.1454652375.000001D7A9002000.00000004.00000020.00020000.00000000.sdmp, SET501E.tmp.24.dr, cmroute.dll.6.dr, OLD500E.tmp.24.dr, SETD5.tmp.7.dr
Source: Binary string: cmroute.pdb source: VpnClientSetupAmd64.exe, 00000006.00000003.1249442070.00000172EEE8B000.00000004.00000020.00020000.00000000.sdmp, cmstp.exe, 00000007.00000003.1251744688.0000025039A66000.00000004.00000020.00020000.00000000.sdmp, cmstp.exe, 00000018.00000003.1454652375.000001D7A9002000.00000004.00000020.00020000.00000000.sdmp, SET501E.tmp.24.dr, cmroute.dll.6.dr, OLD500E.tmp.24.dr, SETD5.tmp.7.dr

Persistence and Installation Behavior
barindex
Installs new ROOT certificates
Source: C:\Windows\System32\certutil.exe Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\DF3C24F9BFD666761B268073FE06D1CC8D4F82A4 Blob Jump to behavior
Uses cmd line tools excessively to alter registry or file data
Source: C:\Windows\System32\cmstp.exe Process created: reg.exe
Source: C:\Windows\System32\cmstp.exe Process created: reg.exe
Source: C:\Windows\System32\cmstp.exe Process created: reg.exe Jump to behavior
Source: C:\Windows\System32\cmstp.exe Process created: reg.exe Jump to behavior
Drops PE files
Source: C:\Windows\System32\cmstp.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Network\Connections\Cm\ce500069-adf3-426a-a91d-e5a0b4553b19\SETD5.tmp Jump to dropped file
Source: C:\Windows\System32\cmstp.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Network\Connections\Cm\ce500069-adf3-426a-a91d-e5a0b4553b19\cmroute.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Temp1_MDE_File_Sample_e8a48b47bc6e903a5bcddebf2d9f99488f6556ac.zip\VpnClientSetupAmd64.exe File created: C:\Users\user\AppData\Local\Temp\IXP000.TMP\cmroute.dll Jump to dropped file
Source: C:\Windows\System32\cmstp.exe File created: C:\Windows\Temp\OLD500E.tmp Jump to dropped file
Source: C:\Windows\System32\cmstp.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Network\Connections\Cm\ce500069-adf3-426a-a91d-e5a0b4553b19\SET501E.tmp Jump to dropped file
Drops PE files to the windows directory (C:\Windows)
Source: C:\Windows\System32\cmstp.exe File created: C:\Windows\Temp\OLD500E.tmp Jump to dropped file
Creates or modifies windows services
Source: C:\Windows\System32\reg.exe Registry key created: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\RasMan\PPP\EAP\13 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Temp1_MDE_File_Sample_e8a48b47bc6e903a5bcddebf2d9f99488f6556ac.zip\VpnClientSetupAmd64.exe Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce wextract_cleanup0 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Temp1_MDE_File_Sample_e8a48b47bc6e903a5bcddebf2d9f99488f6556ac.zip\VpnClientSetupAmd64.exe Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce wextract_cleanup0 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Temp1_MDE_File_Sample_e8a48b47bc6e903a5bcddebf2d9f99488f6556ac.zip\VpnClientSetupAmd64.exe Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce wextract_cleanup0 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Temp1_MDE_File_Sample_e8a48b47bc6e903a5bcddebf2d9f99488f6556ac.zip\VpnClientSetupAmd64.exe Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce wextract_cleanup0 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Temp1_MDE_File_Sample_e8a48b47bc6e903a5bcddebf2d9f99488f6556ac.zip\VpnClientSetupAmd64.exe Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce wextract_cleanup0 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Temp1_MDE_File_Sample_e8a48b47bc6e903a5bcddebf2d9f99488f6556ac.zip\VpnClientSetupAmd64.exe Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce wextract_cleanup0 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Temp1_MDE_File_Sample_e8a48b47bc6e903a5bcddebf2d9f99488f6556ac.zip\VpnClientSetupAmd64.exe Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce wextract_cleanup0 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Temp1_MDE_File_Sample_e8a48b47bc6e903a5bcddebf2d9f99488f6556ac.zip\VpnClientSetupAmd64.exe Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce wextract_cleanup0 Jump to behavior
Source: C:\Windows\System32\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\cmstp.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\cmstp.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\cmstp.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\cmstp.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\cmstp.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\cmstp.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\cmstp.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\cmstp.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\cmstp.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\cmstp.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\cmstp.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\cmstp.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Found dropped PE file which has not been started or loaded
Source: C:\Windows\System32\cmstp.exe Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Microsoft\Network\Connections\Cm\ce500069-adf3-426a-a91d-e5a0b4553b19\SETD5.tmp Jump to dropped file
Source: C:\Windows\System32\cmstp.exe Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Microsoft\Network\Connections\Cm\ce500069-adf3-426a-a91d-e5a0b4553b19\cmroute.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Temp1_MDE_File_Sample_e8a48b47bc6e903a5bcddebf2d9f99488f6556ac.zip\VpnClientSetupAmd64.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\IXP000.TMP\cmroute.dll Jump to dropped file
Source: C:\Windows\System32\cmstp.exe Dropped PE file which has not been started: C:\Windows\Temp\OLD500E.tmp Jump to dropped file
Source: C:\Windows\System32\cmstp.exe Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Microsoft\Network\Connections\Cm\ce500069-adf3-426a-a91d-e5a0b4553b19\SET501E.tmp Jump to dropped file
Sample execution stops while process was sleeping (likely an evasion)
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: cmstp.exe, 00000018.00000002.1461867965.000001D7A8FB8000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAWMa
Source: cmstp.exe, 00000007.00000003.1252872378.0000025039A5C000.00000004.00000020.00020000.00000000.sdmp, cmstp.exe, 00000018.00000002.1461867965.000001D7A8FE6000.00000004.00000020.00020000.00000000.sdmp, rasautou.exe, 00000025.00000002.2430357863.0000023910C0E000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: C:\Windows\System32\rasautou.exe Process information queried: ProcessInformation Jump to behavior
Creates a process in suspended mode (likely to inject code)
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\certutil.exe certutil -addstore root C:\Users\user\AppData\Roaming\Microsoft\Network\Connections\Cm\ce500069-adf3-426a-a91d-e5a0b4553b19\ce500069-adf3-426a-a91d-e5a0b4553b19.cer Jump to behavior
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\certutil.exe certutil -addstore root C:\Users\user\AppData\Roaming\Microsoft\Network\Connections\Cm\ce500069-adf3-426a-a91d-e5a0b4553b19\ce500069-adf3-426a-a91d-e5a0b4553b19.cer
Source: C:\Windows\System32\certutil.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1560303 Sample: MDE_File_Sample_e8a48b47bc6... Startdate: 21/11/2024 Architecture: WINDOWS Score: 56 57 Sigma detected: CMSTP Execution Process Creation 2->57 8 VpnClientSetupAmd64.exe 1 12 2->8         started        11 VpnClientSetupAmd64.exe 1 12 2->11         started        13 rasautou.exe 48 3 2->13         started        15 3 other processes 2->15 process3 file4 55 C:\Users\user\AppData\Local\...\cmroute.dll, PE32+ 8->55 dropped 17 cmstp.exe 27 27 8->17         started        21 cmstp.exe 1 34 11->21         started        23 conhost.exe 13->23         started        process5 file6 47 C:\Users\user\AppData\...\cmroute.dll (copy), PE32+ 17->47 dropped 49 C:\Users\user\AppData\Roaming\...\SETD5.tmp, PE32+ 17->49 dropped 59 Uses cmd line tools excessively to alter registry or file data 17->59 25 cmd.exe 1 17->25         started        28 reg.exe 1 1 17->28         started        51 C:\Windows\Temp\OLD500E.tmp, PE32+ 21->51 dropped 53 C:\Users\user\AppData\Roaming\...\SET501E.tmp, PE32+ 21->53 dropped 30 cmd.exe 21->30         started        32 reg.exe 1 21->32         started        signatures7 process8 signatures9 63 Registers a new ROOT certificate 25->63 34 certutil.exe 5 1 25->34         started        37 conhost.exe 25->37         started        39 conhost.exe 28->39         started        41 conhost.exe 30->41         started        43 certutil.exe 1 30->43         started        45 conhost.exe 32->45         started        process10 signatures11 61 Installs new ROOT certificates 34->61
⊘No contacted IP infos