ateraagent | e7d97013314341bbdb5abd3bdade00039a87ec865efc3df4a72feab27f82bf52

Analysis

max time kernel
148s
max time network
149s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
08/11/2024, 12:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
e7d97013314341bbdb5abd3bdade00039a87ec865efc3df4a72feab27f82bf52.msi
Size 2.9MB
Sample241108-pnbslasdrl
SHA256 e7d97013314341bbdb5abd3bdade00039a87ec865efc3df4a72feab27f82bf52
MD5 d3fe8c624c5cf20711ca3d62c66d208c
SHA1 d831219e226b63d4a9394d26333151356539c000
SHA512 bbb0f11d69d9c5750a469618cb6aab065bc0ec74bd46d2ebc1bb0ba52e44a62a77436173835e580f70a1de62aa9b58c9d4902a969fca5449acb5d5f708833473
SSDEEP 49152:F+1Ypn4N2MGVv1zyIBWGppT9jnMHRjOOozjcqZJN8dUZTwYaH7oqPxMbY+K/tzQz:F+lUlz9FKbsodq0YaH7ZPxMb8tT
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

ateraagent discovery persistence privilege_escalation rat

Malware Config

Signatures

AteraAgent
AteraAgent is a remote monitoring and management tool.
rat ateraagent
Ateraagent family
ateraagent

Detects AteraAgent 1 IoCs

resource	yara_rule
behavioral1/files/0x000a000000016d0e-397.dat	family_ateraagent

Blocklisted process makes network request 7 IoCs

flow	pid	Process
3	236	msiexec.exe
5	236	msiexec.exe
7	236	msiexec.exe
11	2404	rundll32.exe
13	2404	rundll32.exe
18	1592	rundll32.exe
20	1592	rundll32.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe

Network Service Discovery 1 TTPs 1 IoCs

Attempt to gather information on host's network.

discovery

Network Service Discovery

T1046

pid	Process
3028	AteraAgent.exe

Drops file in System32 directory 18 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\InstallUtil.InstallLog	AteraAgent.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141	AteraAgent.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\070E0202839D9D67350CD2613E78E416	AteraAgent.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015	AgentPackageAgentInformation.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB	AteraAgent.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357	AteraAgent.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C56C4404C4DEF0DC88E5FCD9F09CB2F1	AteraAgent.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F2E248BEDDBB2D85122423C41028BFD4	AteraAgent.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_DEB07B5578A606ED6489DDA2E357A944	AteraAgent.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015	AteraAgent.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\070E0202839D9D67350CD2613E78E416	AteraAgent.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C56C4404C4DEF0DC88E5FCD9F09CB2F1	AteraAgent.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F2E248BEDDBB2D85122423C41028BFD4	AteraAgent.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB	AteraAgent.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141	AteraAgent.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_DEB07B5578A606ED6489DDA2E357A944	AteraAgent.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015	AteraAgent.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357	AteraAgent.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 18 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe	msiexec.exe
File created	C:\Program Files (x86)\ATERA Networks\AteraAgent\System.ValueTuple.dll	msiexec.exe
File opened for modification	C:\Program Files (x86)\ATERA Networks\AteraAgent\log.txt	AteraAgent.exe
File created	C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation.zip	AteraAgent.exe
File created	C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe	AteraAgent.exe
File created	C:\Program Files (x86)\ATERA Networks\AteraAgent\ICSharpCode.SharpZipLib.dll	msiexec.exe
File created	C:\Program Files (x86)\ATERA Networks\AteraAgent\Pubnub.dll	msiexec.exe
File opened for modification	C:\Program Files (x86)\ATERA Networks\AteraAgent\log.txt	AteraAgent.exe
File created	C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe.config	msiexec.exe
File created	C:\Program Files (x86)\ATERA Networks\AteraAgent\BouncyCastle.Crypto.dll	msiexec.exe
File opened for modification	C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\log.txt	AgentPackageAgentInformation.exe
File created	C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe.config	AteraAgent.exe
File created	C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.ini	AteraAgent.exe
File created	C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\Atera.AgentPackage.Common.dll	AteraAgent.exe
File created	C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\Newtonsoft.Json.dll	AteraAgent.exe
File created	C:\Program Files (x86)\ATERA Networks\AteraAgent\Newtonsoft.Json.dll	msiexec.exe
File opened for modification	C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.InstallLog	AteraAgent.exe
File created	C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.InstallState	AteraAgent.exe

Drops file in Windows directory 37 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\MSIDB37.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIDB48.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIDB88.tmp	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.ev3	DrvInst.exe
File opened for modification	C:\Windows\Installer\MSID991.tmp-\Newtonsoft.Json.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\f76c2d2.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIC6CB.tmp-\AlphaControlAgentInstallation.dll	rundll32.exe
File created	C:\Windows\Installer\f76c2d3.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIE5A9.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIE5A9.tmp-\AlphaControlAgentInstallation.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSIC6CB.tmp	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File opened for modification	C:\Windows\Installer\MSIC6CB.tmp-\System.Management.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSID991.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSID991.tmp-\Microsoft.Deployment.WindowsInstaller.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSIE5A9.tmp-\System.Management.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSIE5A9.tmp-\CustomAction.config	rundll32.exe
File opened for modification	C:\Windows\INF\setupapi.ev1	DrvInst.exe
File opened for modification	C:\Windows\Installer\MSIC370.tmp-\Microsoft.Deployment.WindowsInstaller.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSIC6CB.tmp-\Newtonsoft.Json.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSIC6CB.tmp-\CustomAction.config	rundll32.exe
File created	C:\Windows\Installer\f76c2d2.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIC370.tmp-\System.Management.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSIC370.tmp-\CustomAction.config	rundll32.exe
File opened for modification	C:\Windows\Installer\MSIC6CB.tmp-\Microsoft.Deployment.WindowsInstaller.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSID991.tmp-\System.Management.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSID991.tmp-\CustomAction.config	rundll32.exe
File created	C:\Windows\Installer\f76c2d5.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\f76c2d3.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIC370.tmp-\Newtonsoft.Json.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSIE5A9.tmp-\Microsoft.Deployment.WindowsInstaller.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSIC370.tmp-\AlphaControlAgentInstallation.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSIC370.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIDC06.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIE5A9.tmp-\Newtonsoft.Json.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSID991.tmp-\AlphaControlAgentInstallation.dll	rundll32.exe

Executes dropped EXE 3 IoCs

pid	Process
3028	AteraAgent.exe
1268	AteraAgent.exe
3068	AgentPackageAgentInformation.exe

Launches sc.exe 1 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1124	sc.exe

Loads dropped DLL 35 IoCs

pid	Process
2600	MsiExec.exe
1952	rundll32.exe
1952	rundll32.exe
1952	rundll32.exe
1952	rundll32.exe
1952	rundll32.exe
2600	MsiExec.exe
2404	rundll32.exe
2404	rundll32.exe
2404	rundll32.exe
2404	rundll32.exe
2404	rundll32.exe
2404	rundll32.exe
2404	rundll32.exe
2404	rundll32.exe
2404	rundll32.exe
2600	MsiExec.exe
1240	rundll32.exe
1240	rundll32.exe
1240	rundll32.exe
1240	rundll32.exe
1240	rundll32.exe
2600	MsiExec.exe
2836	MsiExec.exe
2836	MsiExec.exe
2600	MsiExec.exe
1592	rundll32.exe
1592	rundll32.exe
1592	rundll32.exe
1592	rundll32.exe
1592	rundll32.exe
1592	rundll32.exe
1592	rundll32.exe
1592	rundll32.exe
1592	rundll32.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs

persistence privilege_escalation

Installer Packages

T1546.016

Msiexec

T1218.007

pid	Process
236	msiexec.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NET.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TaskKill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe

Kills process with taskkill 1 IoCs

evasion

pid	Process
1224	TaskKill.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	AgentPackageAgentInformation.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CRLs	AgentPackageAgentInformation.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates	AteraAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\Certificates	AteraAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CRLs	AteraAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\Certificates	AteraAgent.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2E\52C64B7E\@%SystemRoot%\System32\fveui.dll,-843 = "BitLocker Drive Encryption"	AteraAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	AgentPackageAgentInformation.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CTLs	AteraAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	AteraAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	AgentPackageAgentInformation.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CRLs	AteraAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	AteraAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	AteraAgent.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2E\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	AteraAgent.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2E\52C64B7E\@%SystemRoot%\System32\fveui.dll,-844 = "BitLocker Data Recovery Agent"	AteraAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates	AgentPackageAgentInformation.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	AteraAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	AteraAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CTLs	AteraAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	AteraAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	AteraAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CTLs	AteraAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	AgentPackageAgentInformation.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	DrvInst.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	AteraAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CTLs	AteraAgent.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2E\52C64B7E\@%SystemRoot%\system32\p2pcollab.dll,-8042 = "Peer to Peer Trust"	AteraAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	AgentPackageAgentInformation.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CRLs	AteraAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CTLs	AteraAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	AteraAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\Certificates	AgentPackageAgentInformation.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	AteraAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CRLs	AgentPackageAgentInformation.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CRLs	AteraAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CTLs	AteraAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\Certificates	AgentPackageAgentInformation.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	AgentPackageAgentInformation.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1"	AteraAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\Certificates	AteraAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CTLs	AteraAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CRLs	AteraAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	AgentPackageAgentInformation.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CRLs	AgentPackageAgentInformation.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	AteraAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CTLs	AteraAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CTLs	AgentPackageAgentInformation.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	AgentPackageAgentInformation.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CTLs	AteraAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\Certificates	AteraAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	AgentPackageAgentInformation.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	AteraAgent.exe

Modifies registry class 22 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7D0A237E2F2A7564CA141B792446E854\DeploymentFlags = "3"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7D0A237E2F2A7564CA141B792446E854\SourceList\Net	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\7D0A237E2F2A7564CA141B792446E854	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7D0A237E2F2A7564CA141B792446E854\ProductName = "AteraAgent"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7D0A237E2F2A7564CA141B792446E854\Language = "1033"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7D0A237E2F2A7564CA141B792446E854\Version = "17301511"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7D0A237E2F2A7564CA141B792446E854\InstanceType = "0"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7D0A237E2F2A7564CA141B792446E854\AuthorizedLUAApp = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7D0A237E2F2A7564CA141B792446E854	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7D0A237E2F2A7564CA141B792446E854\Assignment = "1"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\25F46F8180ECF4345A1FA7A8935DE9AE	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7D0A237E2F2A7564CA141B792446E854\SourceList\Media	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7D0A237E2F2A7564CA141B792446E854\SourceList\Media\1 = ";"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7D0A237E2F2A7564CA141B792446E854\Clients = 3a0000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\7D0A237E2F2A7564CA141B792446E854\INSTALLFOLDER_files_Feature	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7D0A237E2F2A7564CA141B792446E854\PackageCode = "559DA127DF979104BB5FD9CCC41157BB"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7D0A237E2F2A7564CA141B792446E854\AdvertiseFlags = "388"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7D0A237E2F2A7564CA141B792446E854\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7D0A237E2F2A7564CA141B792446E854\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7D0A237E2F2A7564CA141B792446E854\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\25F46F8180ECF4345A1FA7A8935DE9AE\7D0A237E2F2A7564CA141B792446E854	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7D0A237E2F2A7564CA141B792446E854\SourceList\PackageName = "e7d97013314341bbdb5abd3bdade00039a87ec865efc3df4a72feab27f82bf52.msi"	msiexec.exe

Modifies system certificate store 2 TTPs 6 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\317A2AD07F2B335EF5A1C34E4B57E8B7D8F1FCA6	AteraAgent.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\317A2AD07F2B335EF5A1C34E4B57E8B7D8F1FCA6\Blob = 040000000100000010000000a923759bba49366e31c2dbf2e766ba870f000000010000001400000007eeabaf80a9ef4ae1b2cb9b4b5fc70d0428e6a953000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c00b000000010000002e00000053007400610072006600690065006c006400200054006500630068006e006f006c006f0067006900650073000000090000000100000016000000301406082b0601050507030406082b06010505070301140000000100000014000000a848b4242fc6ea24a0d78e3cb93c5c78d79833e41d00000001000000100000005959ddbc9c7632ba0a05f06316846fe6030000000100000014000000317a2ad07f2b335ef5a1c34e4b57e8b7d8f1fca619000000010000001000000044ba5fd9039fc9b56fd8aadccd597ca62000000001000000eb020000308202e730820250020101300d06092a864886f70d01010505003081bb312430220603550407131b56616c69436572742056616c69646174696f6e204e6574776f726b31173015060355040a130e56616c69436572742c20496e632e31353033060355040b132c56616c694365727420436c617373203220506f6c6963792056616c69646174696f6e20417574686f726974793121301f06035504031318687474703a2f2f7777772e76616c69636572742e636f6d2f3120301e06092a864886f70d0109011611696e666f4076616c69636572742e636f6d301e170d3939303632363030313935345a170d3139303632363030313935345a3081bb312430220603550407131b56616c69436572742056616c69646174696f6e204e6574776f726b31173015060355040a130e56616c69436572742c20496e632e31353033060355040b132c56616c694365727420436c617373203220506f6c6963792056616c69646174696f6e20417574686f726974793121301f06035504031318687474703a2f2f7777772e76616c69636572742e636f6d2f3120301e06092a864886f70d0109011611696e666f4076616c69636572742e636f6d30819f300d06092a864886f70d010101050003818d0030818902818100ce3a71cae5abc8599255d7abd8740ef9eed9f655475965470e0555dceb98363c5c535dd330cf38ecbd4189ed254209246b0a5eb37cdd522d4ce6d4d67d5a59a965d449132d244d1c506fb5c185543bfe71e4d35c42f980e0911a0a5b393667f33f557c1b3fb45f647334e3b412bf8764f8da12ff3727c1b343bbef7b6e2e69f70203010001300d06092a864886f70d0101050500038181003b7f506f6f509499496238381f4bf8a5c83ea78281f62bc7e8c5cee83a1082cb18008e4dbda8587fa17900b5bbe98daf41d90f34ee218119a0324928f4c48e56d55233fd50d57e996c03e4c94cfccb6cab66b34a218ce5b50c323e10b2cc6ca1dc9a984c025bf3ceb99ea5720e4ab73f3ce61668f8beed744cbc5bd5621f43dd	AteraAgent.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AD7E1C28B064EF8F6003402014C3D0E3370EB58A	AteraAgent.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AD7E1C28B064EF8F6003402014C3D0E3370EB58A\Blob = 0f00000001000000140000000f6aad4c3fe04619cdc8b2bd655aa1a26042e6500b000000010000005400000053007400610072006600690065006c006400200043006c00610073007300200032002000430065007200740069006600690063006100740069006f006e00200041007500740068006f007200690074007900000053000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c009000000010000002a000000302806082b0601050507030106082b0601050507030206082b0601050507030406082b06010505070303140000000100000014000000bf5fb7d1cedd1f86f45b55acdcd710c20ea988e71d000000010000001000000090c4f4233b006b7bfaa6adcd8f577d77030000000100000014000000ad7e1c28b064ef8f6003402014c3d0e3370eb58a2000000001000000130400003082040f308202f7a003020102020100300d06092a864886f70d01010505003068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479301e170d3034303632393137333931365a170d3334303632393137333931365a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f7269747930820120300d06092a864886f70d01010105000382010d00308201080282010100b732c8fee971a60485ad0c1164dfce4defc80318873fa1abfb3ca69ff0c3a1dad4d86e2b5390fb24a43e84f09ee85fece52744f528a63f7bdee02af0c8af532f9eca0501931e8f661c39a74dfa5ab673042566eb777fe759c64a99251454eb26c7f37f19d530708fafb0462affadeb29edd79faa0487a3d4f989a5345fdb43918236d9663cb1b8b982fd9c3a3e10c83bef0665667a9b19183dff71513c302e5fbe3d7773b25d066cc323569a2b8526921ca702b3e43f0daf087982b8363dea9cd335b3bc69caf5cc9de8fd648d1780336e5e4a5d99c91e87b49d1ac0d56e1335235edf9b5f3defd6f776c2ea3ebb780d1c42676b04d8f8d6da6f8bf244a001ab020103a381c53081c2301d0603551d0e04160414bf5fb7d1cedd1f86f45b55acdcd710c20ea988e73081920603551d2304818a3081878014bf5fb7d1cedd1f86f45b55acdcd710c20ea988e7a16ca46a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479820100300c0603551d13040530030101ff300d06092a864886f70d01010505000382010100059d3f889dd1c91a55a1ac69f3f359da9b01871a4f57a9a179092adbf72fb21eccc75e6ad88387a197ef49353e7706415862bf8e58b80a673fecb3dd21661fc954fa72cc3d4c40d881af779e837abba2c7f534178ed91140f4fc2c2a4d157fa7625d2e25d3000b201a1d68f917b8f4bd8bed2859dd4d168b1783c8b265c72d7aa5aabc53866ddd57a4caf820410b68f0f4fb74be565d7a79f5f91d85e32d95bef5719043cc8d1f9a000a8729e95522580023eae31243295b4708dd8c416a6506a8e521aa41b4952195b97dd134ab13d6adbcdce23d39cdbd3e7570a1185903c922b48f9cd55e2ad7a5b6d40a6df8b74011469a1f790e62bf0f97ece02f1f1794	AteraAgent.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AD7E1C28B064EF8F6003402014C3D0E3370EB58A\Blob = 190000000100000010000000fd960962ac6938e0d4b0769aa1a64e26030000000100000014000000ad7e1c28b064ef8f6003402014c3d0e3370eb58a1d000000010000001000000090c4f4233b006b7bfaa6adcd8f577d77140000000100000014000000bf5fb7d1cedd1f86f45b55acdcd710c20ea988e709000000010000002a000000302806082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030353000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c00b000000010000005400000053007400610072006600690065006c006400200043006c00610073007300200032002000430065007200740069006600690063006100740069006f006e00200041007500740068006f00720069007400790000000f00000001000000140000000f6aad4c3fe04619cdc8b2bd655aa1a26042e6502000000001000000130400003082040f308202f7a003020102020100300d06092a864886f70d01010505003068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479301e170d3034303632393137333931365a170d3334303632393137333931365a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f7269747930820120300d06092a864886f70d01010105000382010d00308201080282010100b732c8fee971a60485ad0c1164dfce4defc80318873fa1abfb3ca69ff0c3a1dad4d86e2b5390fb24a43e84f09ee85fece52744f528a63f7bdee02af0c8af532f9eca0501931e8f661c39a74dfa5ab673042566eb777fe759c64a99251454eb26c7f37f19d530708fafb0462affadeb29edd79faa0487a3d4f989a5345fdb43918236d9663cb1b8b982fd9c3a3e10c83bef0665667a9b19183dff71513c302e5fbe3d7773b25d066cc323569a2b8526921ca702b3e43f0daf087982b8363dea9cd335b3bc69caf5cc9de8fd648d1780336e5e4a5d99c91e87b49d1ac0d56e1335235edf9b5f3defd6f776c2ea3ebb780d1c42676b04d8f8d6da6f8bf244a001ab020103a381c53081c2301d0603551d0e04160414bf5fb7d1cedd1f86f45b55acdcd710c20ea988e73081920603551d2304818a3081878014bf5fb7d1cedd1f86f45b55acdcd710c20ea988e7a16ca46a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479820100300c0603551d13040530030101ff300d06092a864886f70d01010505000382010100059d3f889dd1c91a55a1ac69f3f359da9b01871a4f57a9a179092adbf72fb21eccc75e6ad88387a197ef49353e7706415862bf8e58b80a673fecb3dd21661fc954fa72cc3d4c40d881af779e837abba2c7f534178ed91140f4fc2c2a4d157fa7625d2e25d3000b201a1d68f917b8f4bd8bed2859dd4d168b1783c8b265c72d7aa5aabc53866ddd57a4caf820410b68f0f4fb74be565d7a79f5f91d85e32d95bef5719043cc8d1f9a000a8729e95522580023eae31243295b4708dd8c416a6506a8e521aa41b4952195b97dd134ab13d6adbcdce23d39cdbd3e7570a1185903c922b48f9cd55e2ad7a5b6d40a6df8b74011469a1f790e62bf0f97ece02f1f1794	AteraAgent.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AD7E1C28B064EF8F6003402014C3D0E3370EB58A\Blob = 040000000100000010000000324a4bbbc863699bbe749ac6dd1d46240f00000001000000140000000f6aad4c3fe04619cdc8b2bd655aa1a26042e6500b000000010000005400000053007400610072006600690065006c006400200043006c00610073007300200032002000430065007200740069006600690063006100740069006f006e00200041007500740068006f007200690074007900000053000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c009000000010000002a000000302806082b0601050507030106082b0601050507030206082b0601050507030406082b06010505070303140000000100000014000000bf5fb7d1cedd1f86f45b55acdcd710c20ea988e71d000000010000001000000090c4f4233b006b7bfaa6adcd8f577d77030000000100000014000000ad7e1c28b064ef8f6003402014c3d0e3370eb58a190000000100000010000000fd960962ac6938e0d4b0769aa1a64e262000000001000000130400003082040f308202f7a003020102020100300d06092a864886f70d01010505003068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479301e170d3034303632393137333931365a170d3334303632393137333931365a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f7269747930820120300d06092a864886f70d01010105000382010d00308201080282010100b732c8fee971a60485ad0c1164dfce4defc80318873fa1abfb3ca69ff0c3a1dad4d86e2b5390fb24a43e84f09ee85fece52744f528a63f7bdee02af0c8af532f9eca0501931e8f661c39a74dfa5ab673042566eb777fe759c64a99251454eb26c7f37f19d530708fafb0462affadeb29edd79faa0487a3d4f989a5345fdb43918236d9663cb1b8b982fd9c3a3e10c83bef0665667a9b19183dff71513c302e5fbe3d7773b25d066cc323569a2b8526921ca702b3e43f0daf087982b8363dea9cd335b3bc69caf5cc9de8fd648d1780336e5e4a5d99c91e87b49d1ac0d56e1335235edf9b5f3defd6f776c2ea3ebb780d1c42676b04d8f8d6da6f8bf244a001ab020103a381c53081c2301d0603551d0e04160414bf5fb7d1cedd1f86f45b55acdcd710c20ea988e73081920603551d2304818a3081878014bf5fb7d1cedd1f86f45b55acdcd710c20ea988e7a16ca46a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479820100300c0603551d13040530030101ff300d06092a864886f70d01010505000382010100059d3f889dd1c91a55a1ac69f3f359da9b01871a4f57a9a179092adbf72fb21eccc75e6ad88387a197ef49353e7706415862bf8e58b80a673fecb3dd21661fc954fa72cc3d4c40d881af779e837abba2c7f534178ed91140f4fc2c2a4d157fa7625d2e25d3000b201a1d68f917b8f4bd8bed2859dd4d168b1783c8b265c72d7aa5aabc53866ddd57a4caf820410b68f0f4fb74be565d7a79f5f91d85e32d95bef5719043cc8d1f9a000a8729e95522580023eae31243295b4708dd8c416a6506a8e521aa41b4952195b97dd134ab13d6adbcdce23d39cdbd3e7570a1185903c922b48f9cd55e2ad7a5b6d40a6df8b74011469a1f790e62bf0f97ece02f1f1794	AteraAgent.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
2772	msiexec.exe
2772	msiexec.exe
1268	AteraAgent.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	236	msiexec.exe
Token: SeIncreaseQuotaPrivilege	236	msiexec.exe
Token: SeRestorePrivilege	2772	msiexec.exe
Token: SeTakeOwnershipPrivilege	2772	msiexec.exe
Token: SeSecurityPrivilege	2772	msiexec.exe
Token: SeCreateTokenPrivilege	236	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	236	msiexec.exe
Token: SeLockMemoryPrivilege	236	msiexec.exe
Token: SeIncreaseQuotaPrivilege	236	msiexec.exe
Token: SeMachineAccountPrivilege	236	msiexec.exe
Token: SeTcbPrivilege	236	msiexec.exe
Token: SeSecurityPrivilege	236	msiexec.exe
Token: SeTakeOwnershipPrivilege	236	msiexec.exe
Token: SeLoadDriverPrivilege	236	msiexec.exe
Token: SeSystemProfilePrivilege	236	msiexec.exe
Token: SeSystemtimePrivilege	236	msiexec.exe
Token: SeProfSingleProcessPrivilege	236	msiexec.exe
Token: SeIncBasePriorityPrivilege	236	msiexec.exe
Token: SeCreatePagefilePrivilege	236	msiexec.exe
Token: SeCreatePermanentPrivilege	236	msiexec.exe
Token: SeBackupPrivilege	236	msiexec.exe
Token: SeRestorePrivilege	236	msiexec.exe
Token: SeShutdownPrivilege	236	msiexec.exe
Token: SeDebugPrivilege	236	msiexec.exe
Token: SeAuditPrivilege	236	msiexec.exe
Token: SeSystemEnvironmentPrivilege	236	msiexec.exe
Token: SeChangeNotifyPrivilege	236	msiexec.exe
Token: SeRemoteShutdownPrivilege	236	msiexec.exe
Token: SeUndockPrivilege	236	msiexec.exe
Token: SeSyncAgentPrivilege	236	msiexec.exe
Token: SeEnableDelegationPrivilege	236	msiexec.exe
Token: SeManageVolumePrivilege	236	msiexec.exe
Token: SeImpersonatePrivilege	236	msiexec.exe
Token: SeCreateGlobalPrivilege	236	msiexec.exe
Token: SeBackupPrivilege	2852	vssvc.exe
Token: SeRestorePrivilege	2852	vssvc.exe
Token: SeAuditPrivilege	2852	vssvc.exe
Token: SeBackupPrivilege	2772	msiexec.exe
Token: SeRestorePrivilege	2772	msiexec.exe
Token: SeRestorePrivilege	1396	DrvInst.exe
Token: SeRestorePrivilege	1396	DrvInst.exe
Token: SeRestorePrivilege	1396	DrvInst.exe
Token: SeRestorePrivilege	1396	DrvInst.exe
Token: SeRestorePrivilege	1396	DrvInst.exe
Token: SeRestorePrivilege	1396	DrvInst.exe
Token: SeRestorePrivilege	1396	DrvInst.exe
Token: SeLoadDriverPrivilege	1396	DrvInst.exe
Token: SeLoadDriverPrivilege	1396	DrvInst.exe
Token: SeLoadDriverPrivilege	1396	DrvInst.exe
Token: SeRestorePrivilege	2772	msiexec.exe
Token: SeTakeOwnershipPrivilege	2772	msiexec.exe
Token: SeRestorePrivilege	2772	msiexec.exe
Token: SeTakeOwnershipPrivilege	2772	msiexec.exe
Token: SeRestorePrivilege	2772	msiexec.exe
Token: SeTakeOwnershipPrivilege	2772	msiexec.exe
Token: SeDebugPrivilege	2404	rundll32.exe
Token: SeRestorePrivilege	2772	msiexec.exe
Token: SeTakeOwnershipPrivilege	2772	msiexec.exe
Token: SeRestorePrivilege	2772	msiexec.exe
Token: SeTakeOwnershipPrivilege	2772	msiexec.exe
Token: SeRestorePrivilege	2772	msiexec.exe
Token: SeTakeOwnershipPrivilege	2772	msiexec.exe
Token: SeRestorePrivilege	2772	msiexec.exe
Token: SeTakeOwnershipPrivilege	2772	msiexec.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
236	msiexec.exe
236	msiexec.exe

Suspicious use of WriteProcessMemory 63 IoCs

description	pid	Process	procid_target
PID 2772 wrote to memory of 2600	2772	msiexec.exe	35
PID 2772 wrote to memory of 2600	2772	msiexec.exe	35
PID 2772 wrote to memory of 2600	2772	msiexec.exe	35
PID 2772 wrote to memory of 2600	2772	msiexec.exe	35
PID 2772 wrote to memory of 2600	2772	msiexec.exe	35
PID 2772 wrote to memory of 2600	2772	msiexec.exe	35
PID 2772 wrote to memory of 2600	2772	msiexec.exe	35
PID 2600 wrote to memory of 1952	2600	MsiExec.exe	36
PID 2600 wrote to memory of 1952	2600	MsiExec.exe	36
PID 2600 wrote to memory of 1952	2600	MsiExec.exe	36
PID 2600 wrote to memory of 1952	2600	MsiExec.exe	36
PID 2600 wrote to memory of 1952	2600	MsiExec.exe	36
PID 2600 wrote to memory of 1952	2600	MsiExec.exe	36
PID 2600 wrote to memory of 1952	2600	MsiExec.exe	36
PID 2600 wrote to memory of 2404	2600	MsiExec.exe	37
PID 2600 wrote to memory of 2404	2600	MsiExec.exe	37
PID 2600 wrote to memory of 2404	2600	MsiExec.exe	37
PID 2600 wrote to memory of 2404	2600	MsiExec.exe	37
PID 2600 wrote to memory of 2404	2600	MsiExec.exe	37
PID 2600 wrote to memory of 2404	2600	MsiExec.exe	37
PID 2600 wrote to memory of 2404	2600	MsiExec.exe	37
PID 2600 wrote to memory of 1240	2600	MsiExec.exe	39
PID 2600 wrote to memory of 1240	2600	MsiExec.exe	39
PID 2600 wrote to memory of 1240	2600	MsiExec.exe	39
PID 2600 wrote to memory of 1240	2600	MsiExec.exe	39
PID 2600 wrote to memory of 1240	2600	MsiExec.exe	39
PID 2600 wrote to memory of 1240	2600	MsiExec.exe	39
PID 2600 wrote to memory of 1240	2600	MsiExec.exe	39
PID 2772 wrote to memory of 2836	2772	msiexec.exe	41
PID 2772 wrote to memory of 2836	2772	msiexec.exe	41
PID 2772 wrote to memory of 2836	2772	msiexec.exe	41
PID 2772 wrote to memory of 2836	2772	msiexec.exe	41
PID 2772 wrote to memory of 2836	2772	msiexec.exe	41
PID 2772 wrote to memory of 2836	2772	msiexec.exe	41
PID 2772 wrote to memory of 2836	2772	msiexec.exe	41
PID 2836 wrote to memory of 2088	2836	MsiExec.exe	42
PID 2836 wrote to memory of 2088	2836	MsiExec.exe	42
PID 2836 wrote to memory of 2088	2836	MsiExec.exe	42
PID 2836 wrote to memory of 2088	2836	MsiExec.exe	42
PID 2088 wrote to memory of 2588	2088	NET.exe	44
PID 2088 wrote to memory of 2588	2088	NET.exe	44
PID 2088 wrote to memory of 2588	2088	NET.exe	44
PID 2088 wrote to memory of 2588	2088	NET.exe	44
PID 2836 wrote to memory of 1224	2836	MsiExec.exe	45
PID 2836 wrote to memory of 1224	2836	MsiExec.exe	45
PID 2836 wrote to memory of 1224	2836	MsiExec.exe	45
PID 2836 wrote to memory of 1224	2836	MsiExec.exe	45
PID 2772 wrote to memory of 3028	2772	msiexec.exe	47
PID 2772 wrote to memory of 3028	2772	msiexec.exe	47
PID 2772 wrote to memory of 3028	2772	msiexec.exe	47
PID 2600 wrote to memory of 1592	2600	MsiExec.exe	49
PID 2600 wrote to memory of 1592	2600	MsiExec.exe	49
PID 2600 wrote to memory of 1592	2600	MsiExec.exe	49
PID 2600 wrote to memory of 1592	2600	MsiExec.exe	49
PID 2600 wrote to memory of 1592	2600	MsiExec.exe	49
PID 2600 wrote to memory of 1592	2600	MsiExec.exe	49
PID 2600 wrote to memory of 1592	2600	MsiExec.exe	49
PID 1268 wrote to memory of 1124	1268	AteraAgent.exe	50
PID 1268 wrote to memory of 1124	1268	AteraAgent.exe	50
PID 1268 wrote to memory of 1124	1268	AteraAgent.exe	50
PID 1268 wrote to memory of 3068	1268	AteraAgent.exe	52
PID 1268 wrote to memory of 3068	1268	AteraAgent.exe	52
PID 1268 wrote to memory of 3068	1268	AteraAgent.exe	52

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\e7d97013314341bbdb5abd3bdade00039a87ec865efc3df4a72feab27f82bf52.msi
1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:236

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2772
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding DB3C8E5EA5A029D9A7062285C9A74751
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2600
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Windows\Installer\MSIC370.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_259441705 1 AlphaControlAgentInstallation!AlphaControlAgentInstallation.CustomActions.GenerateAgentId
    3⤵
    - Drops file in Windows directory
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:1952
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Windows\Installer\MSIC6CB.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_259442392 5 AlphaControlAgentInstallation!AlphaControlAgentInstallation.CustomActions.ReportMsiStart
    3⤵
    - Blocklisted process makes network request
    - Drops file in Windows directory
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2404
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Windows\Installer\MSID991.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_259447275 10 AlphaControlAgentInstallation!AlphaControlAgentInstallation.CustomActions.ShouldContinueInstallation
    3⤵
    - Drops file in Windows directory
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:1240
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Windows\Installer\MSIE5A9.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_259450286 32 AlphaControlAgentInstallation!AlphaControlAgentInstallation.CustomActions.ReportMsiEnd
    3⤵
    - Blocklisted process makes network request
    - Drops file in Windows directory
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:1592
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 5CD7FCF3E97117D06A42B6AA1B31DCB7 M Global\MSI0000
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2836
- - C:\Windows\syswow64\NET.exe
    "NET" STOP AteraAgent
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2088
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 STOP AteraAgent
      4⤵
      System Location Discovery: System Language Discovery
      PID:2588
- - C:\Windows\syswow64\TaskKill.exe
    "TaskKill.exe" /f /im AteraAgent.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    PID:1224
- C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe
  "C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe" /i /IntegratorLogin="[email protected]" /CompanyId="1" /IntegratorLoginUI="" /CompanyIdUI="" /FolderId="" /AccountId="001Q300000M0aRpIAJ" /AgentId="df4cb963-9d6c-4cea-8aaf-afd39307e0a4"
  2⤵
  - Network Service Discovery
  - Drops file in System32 directory
  - Drops file in Program Files directory
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  PID:3028

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2852

C:\Windows\system32\DrvInst.exe
DrvInst.exe "1" "200" "STORAGE\VolumeSnapshot\HarddiskVolumeSnapshot19" "" "" "61530dda3" "0000000000000000" "00000000000003D0" "00000000000003D8"
1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:1396

C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe
"C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1268
- C:\Windows\System32\sc.exe
  "C:\Windows\System32\sc.exe" failure AteraAgent reset= 600 actions= restart/25000
  2⤵
  - Launches sc.exe
  PID:1124
- C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe
  "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe" df4cb963-9d6c-4cea-8aaf-afd39307e0a4 "8c9db334-abcb-4d1f-a63e-874de87d102a" agent-api.atera.com/Production 443 or8ixLi90Mf "minimalIdentification" 001Q300000M0aRpIAJ
  2⤵
  - Drops file in System32 directory
  - Drops file in Program Files directory
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  PID:3068

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Installer Packages

T1546.016

Privilege Escalation

Event Triggered Execution

T1546

Installer Packages

T1546.016

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

System Binary Proxy Execution

T1218

Msiexec

T1218.007

Credential Access

Discovery

Network Service Discovery

T1046

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

f76c2d4.rbs

Path C:\Config.Msi\f76c2d4.rbs
Size 8KB
SHA256 3a9953c387b483b9e156bb1e5e6b50422d3dcb85ebe6ab0ca46e5720a1ddcba0
MD5 c76e914b4758a2cf090932e4642d80dd
SHA1 8cd422569fcc16e843bc15013c6f35936e07aa02
SHA512 3c59609040c475fec5c7af99058684e824737c45afcf337405b36b9df3a86f737b73b9c91c0b0695f08049befb99bfe177483b530fe83caa9957401cab3aec8f
SSDEEP 192:ojRxz1ccbTOOeMeaj6L7r63fL7r6kAVv7bVotBVeZEmzmYpLAV77RwpY9zr:olD29DCDti+2ih
MD5 SHA1 SHA512 SSDEEP

Submit Download

AteraAgent.InstallLog

Path C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.InstallLog
Size 753B
SHA256 6fbf5845a6738e2dc2aa67dd5f78da2c8f8cb41d866bbba10e5336787c731b25
MD5 8298451e4dee214334dd2e22b8996bdc
SHA1 bc429029cc6b42c59c417773ea5df8ae54dbb971
SHA512 cda4ffd7d6c6dff90521c6a67a3dba27bf172cc87cee2986ae46dccd02f771d7e784dcad8aea0ad10decf46a1c8ae1041c184206ec2796e54756e49b9217d7ba
MD5 SHA1 SHA512

Submit Download

AteraAgent.exe

Path C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe
Size 142KB
SHA256 a96a0ba7998a6956c8073b6eff9306398cc03fb9866e4cabf0810a69bb2a43b2
MD5 477293f80461713d51a98a24023d45e8
SHA1 e9aa4e6c514ee951665a7cd6f0b4a4c49146241d
SHA512 23f3bd44a5fb66be7fea3f7d6440742b657e4050b565c1f8f4684722502d46b68c9e54dcc2486e7de441482fcc6aa4ad54e94b1d73992eb5d070e2a17f35de2f
SSDEEP 3072:bk/SImWggsVz8TzihTmmrG/GOXYsqRK3ybTXzpUTQM9/FMp:ISWB/YrRK3yb37
MD5 SHA1 SHA512 SSDEEP

Submit Download

AteraAgent.exe.config

Path C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe.config
Size 1KB
SHA256 e505b08308622ad12d98e1c7a07e5dc619a2a00bcd4a5cbe04fe8b078bcf94a2
MD5 b3bb71f9bb4de4236c26578a8fae2dcd
SHA1 1ad6a034ccfdce5e3a3ced93068aa216bd0c6e0e
SHA512 fb6a46708d048a8f964839a514315b9c76659c8e1ab2cd8c5c5d8f312aa4fb628ab3ce5d23a793c41c13a2aa6a95106a47964dad72a5ecb8d035106fc5b7ba71
MD5 SHA1 SHA512

Submit Download

ICSharpCode.SharpZipLib.dll

Path C:\Program Files (x86)\ATERA Networks\AteraAgent\ICSharpCode.SharpZipLib.dll
Size 210KB
SHA256 2b5b7a2afbc88a4f674e1d7836119b57e65fae6863f4be6832c38e08341f2d68
MD5 c106df1b5b43af3b937ace19d92b42f3
SHA1 7670fc4b6369e3fb705200050618acaa5213637f
SHA512 616e45e1f15486787418a2b2b8eca50cacac6145d353ff66bf2c13839cd3db6592953bf6feed1469db7ddf2f223416d5651cd013fb32f64dc6c72561ab2449ae
SSDEEP 6144:r1uYsjrFIzmuxpOI/1MvCdRbpSISC8j7s/k:mIzm6pOIgvr7ok
MD5 SHA1 SHA512 SSDEEP

Submit Download

Newtonsoft.Json.dll

Path C:\Program Files (x86)\ATERA Networks\AteraAgent\Newtonsoft.Json.dll
Size 693KB
SHA256 2a7a84768cc09a15362878b270371daad9872caacbbeebe7f30c4a7ed6c03ca7
MD5 2c4d25b7fbd1adfd4471052fa482af72
SHA1 fd6cd773d241b581e3c856f9e6cd06cb31a01407
SHA512 f7f94ec00435466db2fb535a490162b906d60a3cfa531a36c4c552183d62d58ccc9a6bb8bbfe39815844b0c3a861d3e1f1178e29dbcb6c09fa2e6ebbb7ab943a
SSDEEP 12288:3BARJBRZl/j1TbQ7n5WLm4k0X57ZYrgNHgK9C1BSjRlXP36RMGy1NqTUU:3BA/ZTvQD0XY0AJBSjRlXP36RMGV
MD5 SHA1 SHA512 SSDEEP

Submit Download

AgentPackageAgentInformation.INI

Path C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.INI
Size 12B
SHA256 3b54d00f00aa80384de88e4f4005e9d4d889a2ccf64b56e0c29d274352495c85
MD5 dc63026e80d2bb04f71e41916f807e33
SHA1 6cda386d2c365f94ea3de41e2390fd916622eb51
SHA512 61da550efd55187978872f5d8e88164a6181a11c8a720684eaa737e0846fe20b9e82b73e1f689a6585834b84c4cee8dd949af43e76fd0158f6cafa704ab25183
MD5 SHA1 SHA512

Submit Download

AgentPackageAgentInformation.exe

Path C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe
Size 173KB
SHA256 36704967877e4117405bde5ec30beaf31e7492166714f3ffb2ceb262bf2fb571
MD5 31def444e6135301ea3c38a985341837
SHA1 f135be75c721af2d5291cb463cbc22a32467084a
SHA512 bd654388202cb5090c860a7229950b1184620746f4c584ab864eade831168bc7fae0b5e59b90165b1a9e4ba2bd154f235749718ae2df35d3dd10403092185ed1
SSDEEP 3072:fDpvOyLSson7aezB53Pbsk4GJCMA1TSuAehsZ7f2lz8/ChoCby:fD4y07asBx4krGSeCZXH
MD5 SHA1 SHA512 SSDEEP

Submit Download

AgentPackageAgentInformation.exe.config

Path C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe.config
Size 546B
SHA256 5e38ef232f42f9b0474f8ce937a478200f7a8926b90e45cb375ffda339ec3c21
MD5 158fb7d9323c6ce69d4fce11486a40a1
SHA1 29ab26f5728f6ba6f0e5636bf47149bd9851f532
SHA512 7eefcc5e65ab4110655e71bc282587e88242c15292d9c670885f0daae30fa19a4b059390eb8e934607b8b14105e3e25d7c5c1b926b6f93bdd40cbd284aaa3ceb
MD5 SHA1 SHA512

Submit Download

Newtonsoft.Json.dll

Path C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\Newtonsoft.Json.dll
Size 688KB
SHA256 12d64550cb536a067d8afff42864836f6d41566e18f46d3ca92cb68726bdd4e9
MD5 ba66874c510645c1fb5fe74f85b32e98
SHA1 e33c7e6991a25cc40d9e0dcc260b5a27f4a34e6c
SHA512 44e8caa916ab98da36af02b84ac944fbf0a65c80b0adbdc1a087f8ed3eff71c750fb6116f2c12034f9f9b429d6915db8f88511b79507cc4d063bab40c4eaa568
SSDEEP 12288:i9BzaPm657wqehcZBLX+HK+kPJUQEKx07N0TCBGiBCjC0PDgM5j9FKjc33:i8m657w6ZBLmkitKqBCjC0PDgM5H
MD5 SHA1 SHA512 SSDEEP

Submit Download

log.txt

Path C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\log.txt
Size 23KB
SHA256 87d7aad6843872547d06f340ab50e81f722d0783cc4c15d59a0e1ed0aa58f203
MD5 583b9aa2c173ced95f4c81d6798920d9
SHA1 1730ceac03e364cc071fee68e6bf65efe9aed1de
SHA512 31385c2670b64925eaadcdef06233f844e843ecdc494e3465e5cca90dbfe1022d8fac056015382e84511a634bca7df8198692a26a7abd5b579d1a7a6be0b5820
SSDEEP 384:h2FaSBb2Bb2Bb2Bb2Bb2Bb2xr972DdK2FaSBb2Bb2Bb2Bb2Bb2Bb2xr972Ddc2FT:sFaSBb2Bb2Bb2Bb2Bb2Bb2xGFaSBb2Bx
MD5 SHA1 SHA512 SSDEEP

Submit Download

Pubnub.dll

Path C:\Program Files (x86)\ATERA Networks\AteraAgent\Pubnub.dll
Size 588KB
SHA256 13774cc16c1254752ea801538bfb9a9d1328f8b4dd3ff41760ac492a245fbb15
MD5 17d74c03b6bcbcd88b46fcc58fc79a0d
SHA1 bc0316e11c119806907c058d62513eb8ce32288c
SHA512 f1457a8596a4d4f9b98a7dcb79f79885fa28bd7fc09a606ad3cd6f37d732ec7e334a64458e51e65d839ddfcdf20b8b5676267aa8ced0080e8cf81a1b2291f030
SSDEEP 6144:UShQrHBJEwJiIJJ8TihsEWdzs29glRleqn4uRTJgwhVHhoNw0r17K7DDaiC3KM+9:gHDxJGihsEKwSuTuwvOWgFA
MD5 SHA1 SHA512 SSDEEP

Submit Download

log.txt

Path C:\Program Files (x86)\ATERA Networks\AteraAgent\log.txt
Size 218B
SHA256 f18b2ee9f8647566a366746415ae07f0abdeb29e862cffd5d4455266b9fa4a30
MD5 d8493ed8894b0336860a1934cabe4a96
SHA1 296db0a00a20d64faf280f04f76053e6a656882f
SHA512 41303ac65a4b62c62c079f034f51c57b64f4b25b744b7416b205ca4cdba346fe4eda5197a785037ddf5bc5ba0490f3f517b0a917477b255855abe7f44a04554c
MD5 SHA1 SHA512

Submit Download

698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
Size 471B
SHA256 6ad47d714f3dd55b2fe9072e829542851d2ecf60cb88254002c60449e8aca736
MD5 7795df33fc7dd3aa62e0bc052f9dfbad
SHA1 ea227ec994561b5bce01c5228f9c337286fbec9c
SHA512 de11027f0ca32119ebbb17976ecbe6582ab6af8caa7ce522d75c4185da722550f1f981064db9be6074eb1c6c096c933c2de7ee42b1f31b4fedc9982f87157f9d
MD5 SHA1 SHA512

Submit Download

8EC9B1D0ABBD7F98B401D425828828CE_DEB07B5578A606ED6489DDA2E357A944

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_DEB07B5578A606ED6489DDA2E357A944
Size 727B
SHA256 69354ff510301b85c14cc1ecd0e5b3c98308b820cfbce483389a7b9a437f67d5
MD5 29dd7378778c44788bac45d70ea7b440
SHA1 7a3c5e30c0c9a9be505b18fd2c24422d5e3dbe56
SHA512 9e67bee1ae05b0f2408210a6662926cc9da6ee2864820a4704adffae9dd78b80e79ee32e83f5a5e35bed9603e82795a38570d56cc93384b82dc6254940079fe7
MD5 SHA1 SHA512

Submit Download

C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
Size 727B
SHA256 20d856d68dba3e2246ebb62a5eaedcefda221accfa1b9362b33afad33b6e48c7
MD5 eb9a1d98cc4b6ac3d674a6621df5a758
SHA1 5e9bc182d48b8e86a61d8a3f4b5add9c88da6800
SHA512 1054d82e5e1b2f2c1416d31f01ff2c172aca8dcc31a622cdd959f918b78a474bd9b40a9b7316122a8262fac24d6236860e2eadd665030a61d56c5c0a153f81c7
MD5 SHA1 SHA512

Submit Download

698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
Size 400B
SHA256 d57b69cc14b71f1487d4513d7935571f89d432e1f4d2e69cef95d7f607f67a91
MD5 471c85fc0d06f2b36e6ff410a4c59d06
SHA1 b5c612ec62df1356208491a522d0a177a037888a
SHA512 a7c1c331c7efccc6a0f0e4aa90b7fd2d77abaae2c3eabc798afe44047c699c42391d8584d7ad4f56f99a55192a97e1a2bbafffa8a0e213867fc35c0e2635deef
MD5 SHA1 SHA512

Submit Download

8EC9B1D0ABBD7F98B401D425828828CE_DEB07B5578A606ED6489DDA2E357A944

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_DEB07B5578A606ED6489DDA2E357A944
Size 404B
SHA256 55fd18769c336d4efd81fc0f7bcd2254f5435c4f68bcb3b525d3c4496a4c2925
MD5 64fe3a06733ad35e0e1d3835c64dd14c
SHA1 06f690448761ab73d6b9e452e629d40957a815c1
SHA512 99e0c727c7d64450074a2d7ec5b8b89294655822c44d7f715b4347a1dd3e483fb840f30e0bea7a76591d4f983f835472ab80c5c53d744acdb825e86bd5a681aa
MD5 SHA1 SHA512

Submit Download

94308059B57B3142E455B38A6EB92015

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Size 342B
SHA256 01faf6776c2f44a628147f0adbd1d8a07a049555225ebeb275ae380cb03d811a
MD5 338883d27a15dedc79db00e327530d0f
SHA1 5df5a36855936a923d15fcc19c51d9465ec84119
SHA512 7874be3651b195e647669ba116cb03b1c8753de9f53a6424fe2d6e350d1c0f830556b6bc93f968dde00231e5d196aedb4249cdd1b8a4a2ba41fd4263eb0913df
MD5 SHA1 SHA512

Submit Download

94308059B57B3142E455B38A6EB92015

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Size 342B
SHA256 37c292677d8c8595358bacdf94b9dc3a4c5f0fd82ecf859d4fa105969d42abc2
MD5 75dbc5c61ff5548bad414726e0d79a9f
SHA1 7c9440ba6e372e0479bb8744eb214ec7fc22701f
SHA512 974cad701d74dd3f4c10ecc11d876412dc7057e899664b38c1a81f40652b63637a04e6824e17b92662dad3254e51f807e76bc917ec63dd7528aa59f5875f92b3
MD5 SHA1 SHA512

Submit Download

C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
Size 412B
SHA256 4aa5b2653124f9b4ee74e0b364d67052fa9fee03fd41069161d10d3392b0251c
MD5 b73aabd2663a769f10baf28ffd640b10
SHA1 8e46015202c18eaf24ae0e5765b11c17def39743
SHA512 78738882a7fdc650ac5b35dd6a3ebfa70d12a3dddb28df244089b086aef64a82c6711c40ab75d0884ad2b1bf89c55db18bfb5a37584dfb375624d13c96408997
MD5 SHA1 SHA512

Submit Download

Cab9D0C.tmp

Path C:\Users\Admin\AppData\Local\Temp\Cab9D0C.tmp
Size 70KB
SHA256 b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
MD5 49aebf8cbd62d92ac215b2923fb1b9f5
SHA1 1723be06719828dda65ad804298d0431f6aff976
SHA512 bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
SSDEEP 1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

Tar9E57.tmp

Path C:\Users\Admin\AppData\Local\Temp\Tar9E57.tmp
Size 181KB
SHA256 8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
MD5 4ea6026cf93ec6338144661bf1202cd1
SHA1 a1dec9044f750ad887935a01430bf49322fbdcb7
SHA512 6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b
SSDEEP 1536:aAZw/J+lCUsTRvsqgCyqWlUDNWdm1wpSru2A0XwjY/z02DTr3rmt6mZ:as2J+qTR0XCy/dmASru2AijbdG
MD5 SHA1 SHA512 SSDEEP

Submit Download

CustomAction.config

Path C:\Windows\Installer\MSIC6CB.tmp-\CustomAction.config
Size 1KB
SHA256 e4ff538599c2d8e898d7f90ccf74081192d5afa8040e6b6c180f3aa0f46ad2c5
MD5 bc17e956cde8dd5425f2b2a68ed919f8
SHA1 5e3736331e9e2f6bf851e3355f31006ccd8caa99
SHA512 02090daf1d5226b33edaae80263431a7a5b35a2ece97f74f494cc138002211e71498d42c260395ed40aee8e4a40474b395690b8b24e4aee19f0231da7377a940
MD5 SHA1 SHA512

Submit Download

Newtonsoft.Json.dll

Path C:\Windows\Installer\MSIC6CB.tmp-\Newtonsoft.Json.dll
Size 695KB
SHA256 c5c83bbc1741be6ff4c490c0aee34c162945423ec577c646538b2d21ce13199e
MD5 715a1fbee4665e99e859eda667fe8034
SHA1 e13c6e4210043c4976dcdc447ea2b32854f70cc6
SHA512 bf9744ccb20f8205b2de39dbe79d34497b4d5c19b353d0f95e87ea7ef7fa1784aea87e10efcef11e4c90451eaa47a379204eb0533aa3018e378dd3511ce0e8ad
SSDEEP 12288:WBARJBRZl/j1TbQ7n5WLm4k0X57ZYrgNHgK9C1BSjRlXP36RMGy1NqTU+:WBA/ZTvQD0XY0AJBSjRlXP36RMG7
MD5 SHA1 SHA512 SSDEEP

Submit Download

MSIDB48.tmp

Path C:\Windows\Installer\MSIDB48.tmp
Size 211KB
SHA256 c8d190d5be1efd2d52f72a72ae9dfa3940ab3faceb626405959349654fe18b74
MD5 a3ae5d86ecf38db9427359ea37a5f646
SHA1 eb4cb5ff520717038adadcc5e1ef8f7c24b27a90
SHA512 96ecb3bc00848eeb2836e289ef7b7b2607d30790ffd1ae0e0acfc2e14f26a991c6e728b8dc67280426e478c70231f9e13f514e52c8ce7d956c1fad0e322d98e0
SSDEEP 3072:/Jz/kyKA1X1dxbOZU32KndB4GLvyui2lhQtEaY4IDflQn0xHuudQ+cxEHSiZxaQ:/t/kE1jOZy2KL4GBiwQtEa4L2sV
MD5 SHA1 SHA512 SSDEEP

Submit Download

f76c2d2.msi

Path C:\Windows\Installer\f76c2d2.msi
Size 2.9MB
SHA256 e7d97013314341bbdb5abd3bdade00039a87ec865efc3df4a72feab27f82bf52
MD5 d3fe8c624c5cf20711ca3d62c66d208c
SHA1 d831219e226b63d4a9394d26333151356539c000
SHA512 bbb0f11d69d9c5750a469618cb6aab065bc0ec74bd46d2ebc1bb0ba52e44a62a77436173835e580f70a1de62aa9b58c9d4902a969fca5449acb5d5f708833473
SSDEEP 49152:F+1Ypn4N2MGVv1zyIBWGppT9jnMHRjOOozjcqZJN8dUZTwYaH7oqPxMbY+K/tzQz:F+lUlz9FKbsodq0YaH7ZPxMb8tT
MD5 SHA1 SHA512 SSDEEP

Submit Download

F0ACCF77CDCBFF39F6191887F6D2D357

Path C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357
Size 1KB
SHA256 df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e
MD5 a266bb7dcc38a562631361bbf61dd11b
SHA1 3b1efd3a66ea28b16697394703a72ca340a05bd5
SHA512 0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc
MD5 SHA1 SHA512

Submit Download

94308059B57B3142E455B38A6EB92015

Path C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Size 342B
SHA256 de9eda07643326863a0d52c8c8906863b52177de58f935e8a19c38df550c83ce
MD5 7ae0ef9d34b12cc162919b6fe035011b
SHA1 774daa52df70e3509365df759481b51132a9f91b
SHA512 a05cfd55569758053e215c1e3f2c9172255d4c85d5d60faff642495374ed863462f75eccbb001dd0a35dbe9a6a530720c35460c8763b4324028aaae23d5fde76
MD5 SHA1 SHA512

Submit Download

94308059B57B3142E455B38A6EB92015

Path C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Size 342B
SHA256 4a4f21f0ffc1a4e68a9e222d05b2b5dd69e8c84e5d4ff1f9d29698819fb7b04e
MD5 07fbd4e4ad8efc055626ee93708f959f
SHA1 736338c3c85675c9c7720789807b27a4dc6a0bf4
SHA512 058cfb0d91c4570ea5798073a3e7713c705f25e30b4977fa37b032c1aa766efac061026bad0aa9824d18af6fa85cc1ca657a5528de6caaea06538ca964365062
MD5 SHA1 SHA512

Submit Download

94308059B57B3142E455B38A6EB92015

Path C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Size 342B
SHA256 31975d32890509ec458e090ba715499dfb0ad441109681e88b6863a4cc825002
MD5 c2f0d837a5d9021361c314890c4febf9
SHA1 88161bcc889dc9a9dfb80697fa5f62172fd3af75
SHA512 331bd748af771ddba58772f8ce599ac5c554e1d3a1fe02a62f11086da77bc7e465b9d651a0a668a3f704122bb7ed8842db8e39d0776700ac399218b8e55df8c4
MD5 SHA1 SHA512

Submit Download

94308059B57B3142E455B38A6EB92015

Path C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Size 342B
SHA256 f3b0a3d57b19847679e0a57a0ec8e247ed3e80d0dd042c1179a1b371279cdaeb
MD5 6e9bee323a0497075ac61c929a64139b
SHA1 518286d054207a7d19410be4b524e0781b23d828
SHA512 eddeb27e61ea9e2f89861f5ab5bd9b240ccc8af1d9bf126f00c3a0dcc68cb538d8e008d31696d67827722fa4491c89ae07ba383a67b1cac6f16ad7e2d7b52fcd
MD5 SHA1 SHA512

Submit Download

94308059B57B3142E455B38A6EB92015

Path C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Size 342B
SHA256 694f1eba5fa19edb31214783d47dbe79bc92949089df47a7adf0b80ba124d4cb
MD5 3b63abc1d3098aa2c2bf08b748b4a9ad
SHA1 5568e5d51d07968345e92d8017bc648b79feeea2
SHA512 d8307ddbaaf7fb245f6f71687dabf0b00eb0668c5d9ad38373017869c18ff2cfcb8e6fd2abac3b262c99a65f9b372b23a4d21bf6b8cfb283ae33509c444c5071
MD5 SHA1 SHA512

Submit Download

94308059B57B3142E455B38A6EB92015

Path C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Size 342B
SHA256 d9a1d730e007a63328f783a360bbb4d1d88ad2018f9187e22a9de16bbb7c9d5f
MD5 155a42044ecd459a38adbfce369e35be
SHA1 4e0a80e96076558e5e11ac1c32198947d892b34c
SHA512 fbcbde59806bd3302b5ab060cf7c9917586a8a662f56aeadda02a0d680dc534c8bd8316c0459ad239515287001268728d0e8928dc07eb818f4d8f3c3e8dd3a5b
MD5 SHA1 SHA512

Submit Download

94308059B57B3142E455B38A6EB92015

Path C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Size 342B
SHA256 1cc09a7adb496f9e267f17e6540b10108556154502e5c4b0742abb731b074323
MD5 c74dfcf353aa6a843d8cf7f4d3c51add
SHA1 1b4761fc71a21009c5aa8a2ebd784414adb54fa6
SHA512 9a7b3459f00a0e2cac6b1fd09be852463dcf18ea6e6252868ccecc11bd1613ea6098b42489665f8bd7a9e69cb655db8a5ca9eebea1f20632edc6801eeabec87c
MD5 SHA1 SHA512

Submit Download

94308059B57B3142E455B38A6EB92015

Path C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Size 342B
SHA256 109eaa8ac78c904fa30ec0b141d9b66f2b94d402d3eaba33f8533f9b82c9a82c
MD5 e83ac06a71a64d35027cd085adb09a85
SHA1 9c1eac3c66546d7e213556dd28924c5005b7562c
SHA512 727e16009730639227ccb503d5389fa18e34ee25780a3adb20d4c0d616484b7a23b78a2e421cb59afa5fb1bc66ea29861e1c0217774c2105fbb43d987c1c11f5
MD5 SHA1 SHA512

Submit Download

94308059B57B3142E455B38A6EB92015

Path C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Size 342B
SHA256 0cb072192804d0b8f31c3e9f865f20c1ab2f0bc1ed11cfdf4fb78fd575946753
MD5 e49bf16300c543c579257c3c8b7d7af0
SHA1 2a84e6bf385f184b81d80022726d9ade12fd7baa
SHA512 412e6924085934b563c90250f91e01a7e426c27200a8dccec8a75cff70a535ae5548878c93c9179ed372eaa2959d376031ccf6bf0d549e0a397c4b728a0fd665
MD5 SHA1 SHA512

Submit Download

94308059B57B3142E455B38A6EB92015

Path C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Size 342B
SHA256 f050aa214e00b44bb781de5da14355b766a18307fd262d2c78c1875ed74719c9
MD5 2437de6cda8f6ae64280b26523bc8a97
SHA1 48f8f37efb2fc0d32c02e2f85f064fcd6da3dbe3
SHA512 8a8429cae0ace3f56603bb1afc293bd0e5306500b96caa00548f007600fee6d3ffa8bf937a6fb6b1802d54931eb75661ee4c99ec07cc8794fe6576a12189fd80
MD5 SHA1 SHA512

Submit Download

94308059B57B3142E455B38A6EB92015

Path C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Size 342B
SHA256 f9b5d524501c77e43200292c4b7241ee6e7cc4f89bbce6618545d80fe3220f07
MD5 78c5c19d41492c5e2941e41b3f950feb
SHA1 e58e8d2e058d9c96545afd0ad46fe296c0304e0c
SHA512 f7c07193f08eee6201eabdfeb2169ed5b338cf23d4439eed091c980202dc6cf9eefd2fac8df758d44f92973b610ba671411d7755d56786afa07bc900774a6062
MD5 SHA1 SHA512

Submit Download

F0ACCF77CDCBFF39F6191887F6D2D357

Path C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357
Size 242B
SHA256 e04531ca3cfeff9b9249ad632b082a9c21feaafe332c6c2a9b6229076a0fd7cb
MD5 87f327fc12e95a3d86841dba4a1d360c
SHA1 56dec1e19bbb62267482938b5210bfbacd496bd3
SHA512 08ac659c17934bbd07e564fdb2295c86c138c24f123ff90874b71df83e83209ff0d7a0de47cea564990074aa782936d61f029124fcf62516bb31d79983fbddf5
MD5 SHA1 SHA512

Submit Download

CabF2E7.tmp

Path C:\Windows\Temp\CabF2E7.tmp
Size 29KB
SHA256 a38d01d3f024e626d579cf052ac3bd4260bb00c34bc6085977a5f4135ab09b53
MD5 d59a6b36c5a94916241a3ead50222b6f
SHA1 e274e9486d318c383bc4b9812844ba56f0cff3c6
SHA512 17012307955fef045e7c13bf0613bd40df27c29778ba6572640b76c18d379e02dc478e855c9276737363d0ad09b9a94f2adaa85da9c77ebb3c2d427aa68e2489
SSDEEP 768:hbIXHqGVBV+xrk2TY+Awydbvk18hbhMtSsQgCE7:hbIXHqGVBVYrU+Ar788LuYs
MD5 SHA1 SHA512 SSDEEP

Submit Download

TarF2F9.tmp

Path C:\Windows\Temp\TarF2F9.tmp
Size 81KB
SHA256 725980edc240c928bec5a5f743fdabeee1692144da7091cf836dc7d0997cef15
MD5 b13f51572f55a2d31ed9f266d581e9ea
SHA1 7eef3111b878e159e520f34410ad87adecf0ca92
SHA512 f437202723b2817f2fef64b53d4eb67f782bdc61884c0c1890b46deca7ca63313ee2ad093428481f94edfcecd9c77da6e72b604998f7d551af959dbd6915809c
SSDEEP 1536:FPmjsoxXSSRrByDBo/DYBK4HZpCnfOOxhgGS5:MjsQ14DSbuy5A5
MD5 SHA1 SHA512 SSDEEP

Submit Download

MSIC370.tmp

Path \Windows\Installer\MSIC370.tmp
Size 509KB
SHA256 87c97269e2b68898be87b884cd6a21880e6f15336b1194713e12a2db45f1dccf
MD5 88d29734f37bdcffd202eafcdd082f9d
SHA1 823b40d05a1cab06b857ed87451bf683fdd56a5e
SHA512 1343ed80dccf0fa4e7ae837b68926619d734bc52785b586a4f4102d205497d2715f951d9acacc8c3e5434a94837820493173040dc90fb7339a34b6f3ef0288d0
SSDEEP 12288:GnBaimP+DJLxQb6CBCldjCaOIM7PmD8WoKO2qHxf:kG2D3QbCldj1MK/tzG
MD5 SHA1 SHA512 SSDEEP

Submit Download

AlphaControlAgentInstallation.dll

Path \Windows\Installer\MSIC370.tmp-\AlphaControlAgentInstallation.dll
Size 25KB
SHA256 e44a6582cd3f84f4255d3c230e0a2c284e0cffa0ca5e62e4d749e089555494c7
MD5 aa1b9c5c685173fad2dabebeb3171f01
SHA1 ed756b1760e563ce888276ff248c734b7dd851fb
SHA512 d3bfb4bd7e7fdb7159fbfc14056067c813ce52cdd91e885bdaac36820b5385fb70077bf58ec434d31a5a48245eb62b6794794618c73fe7953f79a4fc26592334
SSDEEP 384:akuS4rIWmFo967HkYc/4CmvZqVZa9VSlkfO2IROklJhwaHr1LpvTVi:RuVs3bXCmvZqu3u9OiNL1LpvTs
MD5 SHA1 SHA512 SSDEEP

Submit Download

Microsoft.Deployment.WindowsInstaller.dll

Path \Windows\Installer\MSIC370.tmp-\Microsoft.Deployment.WindowsInstaller.dll
Size 179KB
SHA256 cf06d4ed4a8baf88c82d6c9ae0efc81c469de6da8788ab35f373b350a4b4cdca
MD5 1a5caea6734fdd07caa514c3f3fb75da
SHA1 f070ac0d91bd337d7952abd1ddf19a737b94510c
SHA512 a22dd3b7cf1c2edcf5b540f3daa482268d8038d468b8f00ca623d1c254affbbc1446e5bd42adc3d8e274be3ba776b0034e179faccd9ac8612ccd75186d1e3bf1
SSDEEP 3072:BGfZS7hUuK3PcbFeRRLxyR69UgoCaf8+aCnfKlRUjW01KymkO:9zMRLkR6joxfRPW
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1268-305-0x000000001A500000-0x000000001A5B2000-memory.dmp

Download

memory/1268-1293-0x0000000019BA0000-0x0000000019BD8000-memory.dmp

Download

memory/1592-304-0x0000000000910000-0x000000000093E000-memory.dmp

Download

memory/1592-313-0x0000000002560000-0x0000000002612000-memory.dmp

Download

memory/1592-309-0x0000000000BA0000-0x0000000000BAC000-memory.dmp

Download

memory/1952-76-0x0000000001FD0000-0x0000000001FDC000-memory.dmp

Download

memory/1952-72-0x0000000002020000-0x000000000204E000-memory.dmp

Download

memory/2404-109-0x0000000002510000-0x00000000025C2000-memory.dmp

Download

memory/2404-105-0x0000000000410000-0x000000000041C000-memory.dmp

Download

memory/2404-101-0x00000000003B0000-0x00000000003DE000-memory.dmp

Download

memory/3028-245-0x0000000002230000-0x00000000022C8000-memory.dmp

Download

memory/3028-233-0x0000000000350000-0x0000000000378000-memory.dmp

Download

memory/3068-1392-0x0000000000AC0000-0x0000000000AF0000-memory.dmp

Download

memory/3068-1395-0x0000000000CE0000-0x0000000000D90000-memory.dmp

Download

memory/3068-1396-0x00000000002E0000-0x00000000002FC000-memory.dmp

Download