Analysis
- max time kernel
584s - max time network
604s - platform
windows10-2004_x64 - resource
win10v2004-20240319-en - resource tags
arch:x64arch:x86image:win10v2004-20240319-enlocale:en-usos:windows10-2004-x64system - submitted
23/03/2024, 15:16
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
AgentSetup.exe
Resource
win7-20240319-en
windows7-x64
10 signatures
600 seconds
Behavioral task
behavioral2
Sample
AgentSetup.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
23 signatures
600 seconds
Behavioral task
behavioral3
Sample
$TEMP/AgentSetup.exe
Resource
win7-20240221-en
windows7-x64
10 signatures
600 seconds
Behavioral task
behavioral4
Sample
$TEMP/AgentSetup.exe
Resource
win10v2004-20240319-en
windows10-2004-x64
8 signatures
600 seconds
Behavioral task
behavioral5
Sample
$TEMP/WindowsUpdates.exe
Resource
win7-20240221-en
windows7-x64
16 signatures
600 seconds
General
- Target $TEMP/AgentSetup.exe
- Size 215.8MB
- Sample240323-snmrmsbe6s
- SHA256 84372730101078190450b74595424f2cee64e2563ce8f024fce69e9206ba42e4
- MD5 6f669ab8685bc09de164bdbdd4f378f1
- SHA1 89bccf94119ff5e82e0cbfc22846367b897bb2a9
- SHA512 cc7386cd2e4830ea293e4ef133790ba50ea68318b091ad04bf4cd8d2f84591c21e7e5a7cca4c1560fa84dbadb37c2540cdb36e2ba71ba073e755f3a17316e4a7
- SSDEEP 6291456:OgWtYiMKyaDkSyq1R4YWeKejXQHUX2MP4Xs:TYY9GkSyWPfjgW2MQ8
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- Loads dropped DLL 10 IoCs
pid Process 920 MsiExec.exe 920 MsiExec.exe 920 MsiExec.exe 920 MsiExec.exe 920 MsiExec.exe 920 MsiExec.exe 920 MsiExec.exe 920 MsiExec.exe 920 MsiExec.exe 920 MsiExec.exe - Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\B: AgentSetup.exe File opened (read-only) \??\Q: AgentSetup.exe File opened (read-only) \??\T: AgentSetup.exe File opened (read-only) \??\Z: AgentSetup.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\P: AgentSetup.exe File opened (read-only) \??\U: AgentSetup.exe File opened (read-only) \??\W: AgentSetup.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\I: AgentSetup.exe File opened (read-only) \??\M: AgentSetup.exe File opened (read-only) \??\N: AgentSetup.exe File opened (read-only) \??\X: AgentSetup.exe File opened (read-only) \??\K: AgentSetup.exe File opened (read-only) \??\L: AgentSetup.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\O: AgentSetup.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\S: AgentSetup.exe File opened (read-only) \??\V: AgentSetup.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\H: AgentSetup.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\A: AgentSetup.exe File opened (read-only) \??\E: AgentSetup.exe File opened (read-only) \??\G: AgentSetup.exe File opened (read-only) \??\J: AgentSetup.exe File opened (read-only) \??\R: AgentSetup.exe File opened (read-only) \??\Y: AgentSetup.exe File opened (read-only) \??\Y: msiexec.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\91C6D6EE3E8AC86384E548C299295C756C817B81 AgentSetup.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\91C6D6EE3E8AC86384E548C299295C756C817B81\Blob = 0f000000010000001400000085fef11b4f47fe3952f98301c9f98976fefee0ce7f000000010000002a000000302806082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030109000000010000002a000000302806082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030153000000010000002500000030233021060b6086480186f8450107300130123010060a2b0601040182373c0101030200c06200000001000000200000008d722f81a9c113c0791df136a2966db26c950a971db46b4199f4ea54b78bfb9f1400000001000000140000007b5b45cfafcecb7afd31921a6ab6f346eb5748501d00000001000000100000005b3b67000eeb80022e42605b6b3b72400b000000010000000e00000074006800610077007400650000007e000000010000000800000000c0032f2df8d60168000000010000000000000003000000010000001400000091c6d6ee3e8ac86384e548c299295c756c817b812000000001000000240400003082042030820308a0030201020210344ed55720d5edec49f42fce37db2b6d300d06092a864886f70d01010505003081a9310b300906035504061302555331153013060355040a130c7468617774652c20496e632e31283026060355040b131f43657274696669636174696f6e205365727669636573204469766973696f6e31383036060355040b132f2863292032303036207468617774652c20496e632e202d20466f7220617574686f72697a656420757365206f6e6c79311f301d06035504031316746861777465205072696d61727920526f6f74204341301e170d3036313131373030303030305a170d3336303731363233353935395a3081a9310b300906035504061302555331153013060355040a130c7468617774652c20496e632e31283026060355040b131f43657274696669636174696f6e205365727669636573204469766973696f6e31383036060355040b132f2863292032303036207468617774652c20496e632e202d20466f7220617574686f72697a656420757365206f6e6c79311f301d06035504031316746861777465205072696d61727920526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100aca0f0fb8059d49cc7a4cf9da159730910450c0d2c6e68f16c5b4868495937fc0b3319c2777fcc102d95341ce6eb4d09a71cd2b8c9973602b789d4245f06c0cc4494948d02626feb5add118d289a5c8490107a0dbd74662f6a38a0e2d55444eb1d079f07ba6feee9fd4e0b29f53e84a001f19cabf81c7e89a4e8a1d871650da3517beebcd222600db95b9ddfbafc515b0baf98b2e92ee904e86287de2bc8d74ec14c641eddcf8758ba4a4fca68071d1c9d4ac6d52f91cc7c71721cc5c067eb32fdc9925c94da85c09bbf537d2b09f48c9d911f976a52cbde0936a477d87b875044d53e6e2969fb3949261e09a5807b402debe82785c9fe61fd7ee67c971dd59d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e041604147b5b45cfafcecb7afd31921a6ab6f346eb574850300d06092a864886f70d010105050003820101007911c04bb391b6fcf0e967d40d6e45be55e893d2ce033fedda25b01d57cb1e3a76a04cec5076e864720ca4a9f1b88bd6d68784bb32e54111c077d9b3609deb1bd5d16e4444a9a601ec55621d77b85c8e48497c9c3b5711acad73378e2f785c906847d96060e6fc073d222017c4f716e9c4d872f9c8737cdf162f15a93efd6a27b6a1eb5aba981fd5e34d640a9d13c861baf5391c87bab8bd7b227ff6feac4079e5ac106f3d8f1b79768bc437b3211884e53600eb632099b9e9fe3304bb41c8c102f94463209e81ce42d3d63f2c76d3639c59dd8fa6e10ea02e41f72e9547cfbcfd33f3f60b617e7e912b8147c22730eea7105d378f5c392be404f07b8d568c68 AgentSetup.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\91C6D6EE3E8AC86384E548C299295C756C817B81\Blob = 190000000100000010000000dc73f9b71e16d51d26527d32b11a6a3d03000000010000001400000091c6d6ee3e8ac86384e548c299295c756c817b816800000001000000000000007e000000010000000800000000c0032f2df8d6010b000000010000000e00000074006800610077007400650000001d00000001000000100000005b3b67000eeb80022e42605b6b3b72401400000001000000140000007b5b45cfafcecb7afd31921a6ab6f346eb5748506200000001000000200000008d722f81a9c113c0791df136a2966db26c950a971db46b4199f4ea54b78bfb9f53000000010000002500000030233021060b6086480186f8450107300130123010060a2b0601040182373c0101030200c009000000010000002a000000302806082b0601050507030206082b0601050507030306082b0601050507030406082b060105050703017f000000010000002a000000302806082b0601050507030206082b0601050507030306082b0601050507030406082b060105050703010f000000010000001400000085fef11b4f47fe3952f98301c9f98976fefee0ce2000000001000000240400003082042030820308a0030201020210344ed55720d5edec49f42fce37db2b6d300d06092a864886f70d01010505003081a9310b300906035504061302555331153013060355040a130c7468617774652c20496e632e31283026060355040b131f43657274696669636174696f6e205365727669636573204469766973696f6e31383036060355040b132f2863292032303036207468617774652c20496e632e202d20466f7220617574686f72697a656420757365206f6e6c79311f301d06035504031316746861777465205072696d61727920526f6f74204341301e170d3036313131373030303030305a170d3336303731363233353935395a3081a9310b300906035504061302555331153013060355040a130c7468617774652c20496e632e31283026060355040b131f43657274696669636174696f6e205365727669636573204469766973696f6e31383036060355040b132f2863292032303036207468617774652c20496e632e202d20466f7220617574686f72697a656420757365206f6e6c79311f301d06035504031316746861777465205072696d61727920526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100aca0f0fb8059d49cc7a4cf9da159730910450c0d2c6e68f16c5b4868495937fc0b3319c2777fcc102d95341ce6eb4d09a71cd2b8c9973602b789d4245f06c0cc4494948d02626feb5add118d289a5c8490107a0dbd74662f6a38a0e2d55444eb1d079f07ba6feee9fd4e0b29f53e84a001f19cabf81c7e89a4e8a1d871650da3517beebcd222600db95b9ddfbafc515b0baf98b2e92ee904e86287de2bc8d74ec14c641eddcf8758ba4a4fca68071d1c9d4ac6d52f91cc7c71721cc5c067eb32fdc9925c94da85c09bbf537d2b09f48c9d911f976a52cbde0936a477d87b875044d53e6e2969fb3949261e09a5807b402debe82785c9fe61fd7ee67c971dd59d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e041604147b5b45cfafcecb7afd31921a6ab6f346eb574850300d06092a864886f70d010105050003820101007911c04bb391b6fcf0e967d40d6e45be55e893d2ce033fedda25b01d57cb1e3a76a04cec5076e864720ca4a9f1b88bd6d68784bb32e54111c077d9b3609deb1bd5d16e4444a9a601ec55621d77b85c8e48497c9c3b5711acad73378e2f785c906847d96060e6fc073d222017c4f716e9c4d872f9c8737cdf162f15a93efd6a27b6a1eb5aba981fd5e34d640a9d13c861baf5391c87bab8bd7b227ff6feac4079e5ac106f3d8f1b79768bc437b3211884e53600eb632099b9e9fe3304bb41c8c102f94463209e81ce42d3d63f2c76d3639c59dd8fa6e10ea02e41f72e9547cfbcfd33f3f60b617e7e912b8147c22730eea7105d378f5c392be404f07b8d568c68 AgentSetup.exe - Suspicious behavior: EnumeratesProcesses 3 IoCs
pid Process 5096 powershell.exe 5096 powershell.exe 5096 powershell.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeSecurityPrivilege 2944 msiexec.exe Token: SeCreateTokenPrivilege 1060 AgentSetup.exe Token: SeAssignPrimaryTokenPrivilege 1060 AgentSetup.exe Token: SeLockMemoryPrivilege 1060 AgentSetup.exe Token: SeIncreaseQuotaPrivilege 1060 AgentSetup.exe Token: SeMachineAccountPrivilege 1060 AgentSetup.exe Token: SeTcbPrivilege 1060 AgentSetup.exe Token: SeSecurityPrivilege 1060 AgentSetup.exe Token: SeTakeOwnershipPrivilege 1060 AgentSetup.exe Token: SeLoadDriverPrivilege 1060 AgentSetup.exe Token: SeSystemProfilePrivilege 1060 AgentSetup.exe Token: SeSystemtimePrivilege 1060 AgentSetup.exe Token: SeProfSingleProcessPrivilege 1060 AgentSetup.exe Token: SeIncBasePriorityPrivilege 1060 AgentSetup.exe Token: SeCreatePagefilePrivilege 1060 AgentSetup.exe Token: SeCreatePermanentPrivilege 1060 AgentSetup.exe Token: SeBackupPrivilege 1060 AgentSetup.exe Token: SeRestorePrivilege 1060 AgentSetup.exe Token: SeShutdownPrivilege 1060 AgentSetup.exe Token: SeDebugPrivilege 1060 AgentSetup.exe Token: SeAuditPrivilege 1060 AgentSetup.exe Token: SeSystemEnvironmentPrivilege 1060 AgentSetup.exe Token: SeChangeNotifyPrivilege 1060 AgentSetup.exe Token: SeRemoteShutdownPrivilege 1060 AgentSetup.exe Token: SeUndockPrivilege 1060 AgentSetup.exe Token: SeSyncAgentPrivilege 1060 AgentSetup.exe Token: SeEnableDelegationPrivilege 1060 AgentSetup.exe Token: SeManageVolumePrivilege 1060 AgentSetup.exe Token: SeImpersonatePrivilege 1060 AgentSetup.exe Token: SeCreateGlobalPrivilege 1060 AgentSetup.exe Token: SeCreateTokenPrivilege 1060 AgentSetup.exe Token: SeAssignPrimaryTokenPrivilege 1060 AgentSetup.exe Token: SeLockMemoryPrivilege 1060 AgentSetup.exe Token: SeIncreaseQuotaPrivilege 1060 AgentSetup.exe Token: SeMachineAccountPrivilege 1060 AgentSetup.exe Token: SeTcbPrivilege 1060 AgentSetup.exe Token: SeSecurityPrivilege 1060 AgentSetup.exe Token: SeTakeOwnershipPrivilege 1060 AgentSetup.exe Token: SeLoadDriverPrivilege 1060 AgentSetup.exe Token: SeSystemProfilePrivilege 1060 AgentSetup.exe Token: SeSystemtimePrivilege 1060 AgentSetup.exe Token: SeProfSingleProcessPrivilege 1060 AgentSetup.exe Token: SeIncBasePriorityPrivilege 1060 AgentSetup.exe Token: SeCreatePagefilePrivilege 1060 AgentSetup.exe Token: SeCreatePermanentPrivilege 1060 AgentSetup.exe Token: SeBackupPrivilege 1060 AgentSetup.exe Token: SeRestorePrivilege 1060 AgentSetup.exe Token: SeShutdownPrivilege 1060 AgentSetup.exe Token: SeDebugPrivilege 1060 AgentSetup.exe Token: SeAuditPrivilege 1060 AgentSetup.exe Token: SeSystemEnvironmentPrivilege 1060 AgentSetup.exe Token: SeChangeNotifyPrivilege 1060 AgentSetup.exe Token: SeRemoteShutdownPrivilege 1060 AgentSetup.exe Token: SeUndockPrivilege 1060 AgentSetup.exe Token: SeSyncAgentPrivilege 1060 AgentSetup.exe Token: SeEnableDelegationPrivilege 1060 AgentSetup.exe Token: SeManageVolumePrivilege 1060 AgentSetup.exe Token: SeImpersonatePrivilege 1060 AgentSetup.exe Token: SeCreateGlobalPrivilege 1060 AgentSetup.exe Token: SeCreateTokenPrivilege 1060 AgentSetup.exe Token: SeAssignPrimaryTokenPrivilege 1060 AgentSetup.exe Token: SeLockMemoryPrivilege 1060 AgentSetup.exe Token: SeIncreaseQuotaPrivilege 1060 AgentSetup.exe Token: SeMachineAccountPrivilege 1060 AgentSetup.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1060 AgentSetup.exe - Suspicious use of WriteProcessMemory 5 IoCs
description pid Process procid_target PID 2944 wrote to memory of 920 2944 msiexec.exe 97 PID 2944 wrote to memory of 920 2944 msiexec.exe 97 PID 2944 wrote to memory of 920 2944 msiexec.exe 97 PID 920 wrote to memory of 5096 920 MsiExec.exe 98 PID 920 wrote to memory of 5096 920 MsiExec.exe 98
Processes
-
C:\Users\Admin\AppData\Local\Temp\$TEMP\AgentSetup.exe"C:\Users\Admin\AppData\Local\Temp\$TEMP\AgentSetup.exe"1⤵
- Enumerates connected drives
- Modifies system certificate store
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1060
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2944 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 8152CBEE87A7604DCEC32B5837055F84 C2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:920 -
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe-NoProfile -Noninteractive -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\pssBC2E.ps1"3⤵
- Suspicious behavior: EnumeratesProcesses
PID:5096
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4048 --field-trial-handle=2276,i,5672504106535478802,17394903851940863593,262144 --variations-seed-version /prefetch:81⤵PID:1404
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1264 --field-trial-handle=2276,i,5672504106535478802,17394903851940863593,262144 --variations-seed-version /prefetch:81⤵PID:3348
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\378B079587A9184B2E2AB859CB263F40_524AD1B9B08D3C6450727265AE77B7D2
- Size 3B
- SHA256 ca3d163bab055381827226140568f3bef7eaac187cebd76878e0b63e9e442356
- MD5 8a80554c91d9fca8acb82f023de02f11
- SHA1 5f36b2ea290645ee34d943220a14b54ee5ea5be5
- SHA512 ca4b6defb8adcc010050bc8b1bb8f8092c4928b8a0fba32146abcfb256e4d91672f88ca2cdf6210e754e5b8ac5e23fb023806ccd749ac8b701f79a691f03c87a
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\AI_EXTUI_BIN_1060\dialog
- Size 11KB
- SHA256 f1fcb09df932aef09b24eea796286ceaedcbceccd4d8f4536345163c4d3d9ff7
- MD5 553df955cb4b2e7be5cef99cb8ec9254
- SHA1 370c2f61e886e53d8faf9537040daaafed330137
- SHA512 d31d4fc9080c794901b9fa3d3aec998a1b274f4c11c02362b30d2fbaf013b877198b08bb6d96fda68c7e9e329740090609a7d65249bc7e6209ace24fcfe3c34b
- SSDEEP 192:wgJIgsBpS7BU//bnrB1AHe8vq7feTiE436hV0BHh0DZ3QOE+RKGjG1Q02Dn1:wCPsBpIqbnoVKfUf4F0DZ3QyRKU
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\MSIB9AC.tmp
- Size 373KB
- SHA256 58e954de5dbec06179e7c749f321555520c8fcfbd9d3b05cc2b0110573a507d4
- MD5 f21b7303582dc0bf18fc734df1245043
- SHA1 306de4746ec0fa5fd6f67127060640abb26f2a9e
- SHA512 0170f83e53e28ad09dcf00649aa7e4c3d9e8cead49b54971df594c60062f8f4ed5b3c18588942fc038337a1f2478fb039e213fbadb55fe5091fdaaf28d9911b4
- SSDEEP 6144:ctZm0/CeltYyKrpN3j+hvoeN6Lt1slDAbYC+GuFnjK+SPVIIAOXKVKvtZjMTJRra:ctQelELt1slkbY4uFnjKFnlKVoMTJRra
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\MSIBAB7.tmp
- Size 823KB
- SHA256 479a7e0f97f95193547cdea9de3637ec28e815527cefaeaf03ae3319abb61c89
- MD5 a4dc5a2f1ec789a2d113980f2f104497
- SHA1 5202b40f78daddbf2614d58bcf9eab6d505f5e97
- SHA512 3b793f203030321e61e4caed8752cbd334bc93b22948cb51f1b1563b3dfb063689f3aa230d07043eaa6bf9020def0d2695012d622291285f7dca90b0a08ad3d6
- SSDEEP 24576:R5QiSCqJ5EQeRHH1jzvVtuRXrPcZUoYoUElcegA:+CwEQeRHHBzvVtqXrPcZUoYoUElcegA
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\MSIBC21.tmp
- Size 616KB
- SHA256 9f0cac1777e484e2881afdfcffcc165d8626adee19d22e4e55f0c35a6419a7f1
- MD5 fa165dda00cf758cf5e320fccf7ea135
- SHA1 56cc03c7cbb959d0fb63f99e8e9dfd4fae3f9a37
- SHA512 1bde9f59d75bcd594d838bd01363c83dc941fb4024780e05dadf4d93a7c238b8c168cb5ce6ce07437adbe554bce91fea137301e36b186ab8670163ad0e36bd17
- SSDEEP 12288:+A0DgYdgDb0y4emFkwdHGBlFtHQc7LJOEL7quHi9z05SLlSQg8IZh4wcd7CU44ut:+LK0dH+FtQc7LJOA7quCQwxSp8IKG3SE
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\MSIBC21.tmp
- Size 576KB
- SHA256 c3ab1b7387990310983edfb6cf9ea43253c7b143b3cdce12d0fde01f711dc257
- MD5 0f96d37513fc190124e1a722dd51c004
- SHA1 9066e45a154643f508994e1e3ccf7fc05b33818c
- SHA512 8493734fb898624997f15847fe937981b582356efd4db34143a7ca43f8a13fe925c18699428d4a9143d2a0f439ac71e2b07dd37865a0b17be640b27329d312db
- SSDEEP 12288:+A0DgYdgDb0y4emFkwdHGBlFtHQc7LJOEL7quHi9z05SLlSQg8IZh4wcd7CU44uC:+LK0dH+FtQc7LJOA7quCQwxSp8IKG3Y
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\MSIC396.tmp
- Size 320KB
- SHA256 efa5507a92f10075edecda33840d885a6ea9157ce50049e5b50240ee8073789a
- MD5 794a4318047f814b804027699b52598e
- SHA1 56b8950ed4aecfea13ad3d476a3635a266c26b21
- SHA512 f211836931205e5b166db43caf3527a7c0a9efcf77219211098e572d95bd5e4e32093ba97b91b8b4c78f5e52e8f717b38eb6fa941cb1c5be9d2098a4cd37c875
- SSDEEP 6144:oSFrPoFLbQZfAE6uexdFBKF58zcV3SEC1syaPqCy/zsSuH2e2uD345EQeRHe:qFXmfLFiBKF58zcV3csJSCesP2S45EQ3
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\MSIC462.tmp
- Size 532KB
- SHA256 9cb59f48ad2bba9765282f52a62a820b3c2a541f7b66a7073a52c7b72546b5c8
- MD5 378a7a638a288c872eed3af1d0690e04
- SHA1 73ce4b56c5d2cb0eaa819caa293f1ac88794e4f5
- SHA512 29f91f4abaecf71983bc889e72f6541dfe7073b1b2b0431b11a5d91d57bf03cc36fe2c247e2aa904b15c491f05b4b2a72a240ab3f461801af5158066e5c1be84
- SSDEEP 12288:9YSQNju69oj2axuyxNxbPSw1YPmLAGS0juflVMnRWqXWuwk8moVQySXCPbWwZU:UaMMNxb6uymzWS81VQySXCPbWwZU
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_b0lazqta.eha.ps1
- Size 60B
- SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
- MD5 d17fe0a3f47be24a6453e9ef58c94641
- SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
- SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\pssBC2D.ps1
- Size 2KB
- SHA256 a95df6d17d94865fdb7ac3bfb64a2557804e45d68b4b0641dff377ef08404e67
- MD5 2b2a9bc51b7d0607cfac5464c09adabe
- SHA1 6b796b9203d5acf863c455888a0c9907f82576ff
- SHA512 f437b58ab5706c6f5cfef0c55eae0e6975a476085a3a83fc457a00835c8a4e6edcf338cfde5304ab01d5247946d56a5a5976a82348571efa7cb80ed53780f6cc
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\pssBC2E.ps1
- Size 5KB
- SHA256 6b13773770ac84015b79f76efe493e6e0a9c81f1bb31cec6fc86af05a57f58ac
- MD5 3845a267aae4a3acfeae225b18033857
- SHA1 e6319d4ea7483d145977ba2d22a4e11c8b979dbf
- SHA512 160e576b704b815af4695d44162f534a47aadb3b56d22c74666887888002f454969be249219d2f90b552fd028e02a789a1832fd3af3f4f2ba1cf1a2d7214111b
- SSDEEP 24:QCGTKXuARQvAD5V4zzLFAmhm/YMMtEzfug/Au6+w7uVIj9u92VFo1OWGvFnpVAcc:QTtcPVRm7tGDckcgc/jy
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Acunetix Limited\Acunetix 360 Agent 1.7.1\install\AgentSetup.msi
- Size 2.6MB
- SHA256 e971a74aa37222ff7f4d3a44ec46e3982f5529a89ce7389fc0d0c6d025fdb648
- MD5 fb7b3f0eab32b475324ef3c8ff1ac3c4
- SHA1 40e9dde19179bc55cd1bad09fe6e847b5cdc6fa6
- SHA512 3e7fa1664c95e4a7be3080718f8a4f0aaf6566c93197bbc63a96659b88ad2a886ead0aba0a00f79d1c10efb42793cb6ada91fc72edd5c77bb0799508aaaf8dd5
- SSDEEP 49152:yXbYAYzVLTXrKAUCwEQeRHHBzvVtqXrPcZUoYoUElcegraMMzbWmzL81VQySXCPC:GYAY4A9zBzvGbcMgamLjWNQ98Iz7
- MD5 SHA1 SHA512 SSDEEP