6a02721f5227dc764b66cc48dd46e75385d2bb10b0e0aadeb8f82fea54ddaab7

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260129-en
resource tags

arch:x64arch:x86image:win10v2004-20260129-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
03/02/2026, 02:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
action1_agent(My_Organization).msi
Size 6.4MB
Sample260203-dcdx2agy5c
SHA256 6a02721f5227dc764b66cc48dd46e75385d2bb10b0e0aadeb8f82fea54ddaab7
MD5 71ef09a49e261a2b513baee7eedecd30
SHA1 edcda622671c521295846f604f9cba0063d14df2
SHA512 1892b24140107b7679821917a6bb6c035cfcb22aebcc04bde183a9cb0735c410d98d489faa65f3b0c529f60456d411bd717ca9df2a990d4449ceb69adbcb6006
SSDEEP 98304:n+UJgsMOyVEUMo7Pcwq0kiOBOLT5lNUxh5Hup4SLQPLpGKWT4UX2Zo9HPD+PEJ8L:+4gtOyfPJe4LxUxCAFvtsHPr8y
TLSH
T17D662312BA838135D99A2E30343D86B5963EFF349F34B5DFEB84351D5E302D06A71A92
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery execution persistence privilege_escalation ransomware

Malware Config

Signatures

Badlisted process makes network request 3 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
2	4640	msiexec.exe
4	4640	msiexec.exe
6	4640	msiexec.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe

Drops file in System32 directory 15 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft	action1_agent.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache	action1_agent.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\18E6B4A57A6BC7EC9B861CDF2D6D0D02_EF52C1EC85F21F31CC0157A5C8803013	action1_agent.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_93702E680A5530C052C8D2BA33A2225F	action1_agent.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content	action1_agent.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B2FAF7692FD9FFBD64EDE317E42334BA_93702E680A5530C052C8D2BA33A2225F	action1_agent.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3AA0DCD5A74331FBD6F344550EC48B87_FAB5A9F6C6BE3394975FF948CA40CA87	action1_agent.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3AA0DCD5A74331FBD6F344550EC48B87_FAB5A9F6C6BE3394975FF948CA40CA87	action1_agent.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData	action1_agent.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\18E6B4A57A6BC7EC9B861CDF2D6D0D02_EF52C1EC85F21F31CC0157A5C8803013	action1_agent.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache	powershell.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\Action1\package_downloads\CLOUD_41c128e0-463e-11f0-b241-d13f758cf27c_1749589365358_builtin.json	action1_agent.exe
File opened for modification	C:\Windows\Action1\package_downloads\CLOUD_60249f20-8e86-11f0-af3f-ad4ea2a97fec_1757536823883_builtin.resume	action1_agent.exe
File created	C:\Windows\Action1\advanced_settings.json.tmp	action1_agent.exe
File created	C:\Windows\Action1\package_downloads\CLOUD_e28473c0-8ddf-11f0-826b-f57ecc21ae72_1757465316604_builtin.metadata.tmp	action1_agent.exe
File opened for modification	C:\Windows\Action1\package_downloads\CLOUD_96c0f5b0-8f71-11f0-b5ed-f5f090bb88ca_1757637847179_builtin.resume	action1_agent.exe
File created	C:\Windows\Action1\action1_agent.exe.update_state	action1_agent.exe
File opened for modification	C:\Windows\Installer\MSIA660.tmp	msiexec.exe
File opened for modification	C:\Windows\Action1\action1_agent.exe.update_state	action1_agent.exe
File opened for modification	C:\Windows\Action1\7z.dll	msiexec.exe
File created	C:\Windows\Action1\rules.json	action1_agent.exe
File opened for modification	C:\Windows\Action1\package_downloads\CLOUD_96c0f5b0-8f71-11f0-b5ed-f5f090bb88ca_1757637847179_builtin.json	action1_agent.exe
File opened for modification	C:\Windows\Action1\package_downloads\CLOUD_41c128e0-463e-11f0-b241-d13f758cf27c_1749589365358_builtin_files\windowsdesktop-runtime-8.0.17.34917-win-32bit.exe	action1_agent.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\60C3F5011D783684193BDEE42A790A4B\5.221.623\a1_7z_dll_file	msiexec.exe
File created	C:\Windows\Action1\agent_cdm_not_downloading.threshold.tmp	action1_agent.exe
File created	C:\Windows\Action1\package_downloads\CLOUD_ee058a70-869e-11ef-9fc1-4b2f0f8dddf2_1728520262807_builtin.resume	action1_agent.exe
File opened for modification	C:\Windows\Installer\MSICD38.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSICDB6.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\60C3F5011D783684193BDEE42A790A4B\CacheSize.txt	msiexec.exe
File created	C:\Windows\Action1\rule_data\1008.suppress	action1_agent.exe
File opened for modification	C:\Windows\Action1\package_downloads\CLOUD_41c128e0-463e-11f0-b241-d13f758cf27c_1749589365358_builtin.json	action1_agent.exe
File created	C:\Windows\Action1\package_downloads\CLOUD_96c0f5b0-8f71-11f0-b5ed-f5f090bb88ca_1757637847179_builtin.metadata.tmp	action1_agent.exe
File created	C:\Windows\Action1\package_downloads\CLOUD_60249f20-8e86-11f0-af3f-ad4ea2a97fec_1757536823883_builtin.metadata.tmp	action1_agent.exe
File created	C:\Windows\Action1\action1_agent.exe.instance_lock	action1_agent.exe
File opened for modification	C:\Windows\Action1\action1_agent.exe.update_state	action1_agent.exe
File opened for modification	C:\Windows\Action1\package_downloads\CLOUD_2ba943b0-85b6-11ef-b9af-69a8758f6819_1728420293483_builtin.result	action1_agent.exe
File created	C:\Windows\Installer\SourceHash{105F3C06-87D1-4863-91B3-ED4EA297A0B4}	msiexec.exe
File created	C:\Windows\Action1\action1_agent.exe.instance_lock	action1_agent.exe
File created	C:\Windows\Action1\package_downloads\CLOUD_394fae00-85b6-11ef-b9af-69a8758f6819_1728420316384_builtin.result	action1_agent.exe
File opened for modification	C:\Windows\Action1\package_downloads\CLOUD_31939e80-463e-11f0-b241-d13f758cf27c_1749589338216_builtin.resume	action1_agent.exe
File created	C:\Windows\Action1\action1_agent.exe	msiexec.exe
File created	C:\Windows\Installer\SourceHash{FEC165DE-8935-4ED1-812C-DA96EC177411}	msiexec.exe
File created	C:\Windows\Action1\package_downloads\CLOUD_c0429270-7d1c-11f0-97f3-3b8172a68845_1755622288664_builtin.json	action1_agent.exe
File created	C:\Windows\Action1\package_downloads\CLOUD_60249f20-8e86-11f0-af3f-ad4ea2a97fec_1757536823883_builtin.json	action1_agent.exe
File created	C:\Windows\Action1\package_downloads\CLOUD_96c0f5b0-8f71-11f0-b5ed-f5f090bb88ca_1757637847179_builtin.resume	action1_agent.exe
File opened for modification	C:\Windows\Action1\sas.dll	msiexec.exe
File created	C:\Windows\Action1\package_downloads\CLOUD_96c0f5b0-8f71-11f0-b5ed-f5f090bb88ca_1757637847179_builtin.json	action1_agent.exe
File created	C:\Windows\Action1\previousUser.txt	powershell.exe
File created	C:\Windows\Action1\package_downloads\CLOUD_2ba943b0-85b6-11ef-b9af-69a8758f6819_1728420293483_builtin.result	action1_agent.exe
File opened for modification	C:\Windows\Action1\package_downloads\CLOUD_2ba943b0-85b6-11ef-b9af-69a8758f6819_1728420293483_builtin.resume	action1_agent.exe
File opened for modification	C:\Windows\Installer\e58a22b.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\60C3F5011D783684193BDEE42A790A4B\5.221.623\a1_7z_dll_file	msiexec.exe
File created	C:\Windows\Action1\package_downloads\CLOUD_2ba943b0-85b6-11ef-b9af-69a8758f6819_1728420293483_builtin.json	action1_agent.exe
File created	C:\Windows\Action1\package_downloads\CLOUD_ee058a70-869e-11ef-9fc1-4b2f0f8dddf2_1728520262807_builtin.json	action1_agent.exe
File created	C:\Windows\Action1\package_downloads\CLOUD_2ba943b0-85b6-11ef-b9af-69a8758f6819_1728420293483_builtin.metadata.tmp	action1_agent.exe
File created	C:\Windows\Action1\package_downloads\CLOUD_1ddf59c0-619a-11f0-89de-331c57130e1b_1752597500253_builtin.metadata.tmp	action1_agent.exe
File opened for modification	C:\Windows\Action1\logs\action1_log_2026-02-03_02-52-06~2556.log	action1_agent.exe
File created	C:\Windows\Action1\package_downloads\CLOUD_31939e80-463e-11f0-b241-d13f758cf27c_1749589338216_builtin.json	action1_agent.exe
File opened for modification	C:\Windows\Action1\package_downloads\CLOUD_394fae00-85b6-11ef-b9af-69a8758f6819_1728420316384_builtin_files\windowsdesktop-runtime-6.0.35.34113-win-32bit.exe	action1_agent.exe
File created	C:\Windows\Action1\agent_downgrade.version_pair.tmp	action1_agent.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIA5E2.tmp	msiexec.exe
File created	C:\Windows\Action1\action1_remote.exe	msiexec.exe
File opened for modification	C:\Windows\Action1\action1_agent.exe	msiexec.exe
File created	C:\Windows\Action1\7z.dll	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIC6DB.tmp	msiexec.exe
File created	C:\Windows\Action1\datasource_data\1008.poll.tmp	action1_agent.exe
File opened for modification	C:\Windows\Action1\package_downloads\CLOUD_e469fa00-869e-11ef-9fc1-4b2f0f8dddf2_1728520246688_builtin.json	action1_agent.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\60C3F5011D783684193BDEE42A790A4B\5.221.623	msiexec.exe
File opened for modification	C:\Windows\Installer\MSICE93.tmp	msiexec.exe
File created	C:\Windows\Action1\package_downloads\CLOUD_1ddf59c0-619a-11f0-89de-331c57130e1b_1752597500253_builtin.resume	action1_agent.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\60C3F5011D783684193BDEE42A790A4B\5.221.623\action1_remote_exe	msiexec.exe
File created	C:\Windows\Action1\package_downloads\CLOUD_e469fa00-869e-11ef-9fc1-4b2f0f8dddf2_1728520246688_builtin.metadata.tmp	action1_agent.exe
File created	C:\Windows\Action1\package_downloads\CLOUD_394fae00-85b6-11ef-b9af-69a8758f6819_1728420316384_builtin.metadata.tmp	action1_agent.exe
File opened for modification	C:\Windows\Action1\package_downloads\CLOUD_c0429270-7d1c-11f0-97f3-3b8172a68845_1755622288664_builtin.json	action1_agent.exe

Executes dropped EXE 3 IoCs

pid	Process
2556	action1_agent.exe
2208	action1_agent.exe
1068	action1_agent.exe

Loads dropped DLL 8 IoCs

pid	Process
3172	MsiExec.exe
3172	MsiExec.exe
3172	MsiExec.exe
1884	MsiExec.exe
1260	MsiExec.exe
1260	MsiExec.exe
1260	MsiExec.exe
1260	MsiExec.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
2616	powershell.exe
4740	powershell.exe
3332	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs

persistence privilege_escalation

Installer Packages

T1546.016

Msiexec

T1218.007

pid	Process
4640	msiexec.exe

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	action1_agent.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	action1_agent.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	action1_agent.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 00000000040000004ece01ae2f8ce2cb0000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff0000000027010100000800004ece01ae0000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed35000000ffffffff0000000007000100006809004ece01ae000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff350000000000000005000000ffffffff000000000700010000f8ff1a4ece01ae000000000000f0ff350000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d4ece01ae000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CProgram Files%5CWindowsApps%5CMicrosoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe%5Cresources.pri	action1_agent.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CProgram Files%5CWindowsApps%5CMicrosoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe%5Cresources.pri\1d5ace4cb13e166\a37dfe62\@{C:\Program Files\WindowsApps\Microsoft.Windows.Pho = "Microsoft Photos"	action1_agent.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CProgram Files%5CWindowsApps%5CMicrosoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe%5Cresources.pri\1d5ace48ea9bf97\a37dfe62\@{C:\Program Files\WindowsApps\Microsoft.WindowsFeedb = "Feedback Hub"	action1_agent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	action1_agent.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2c\52C64B7E\@%SystemRoot%\system32\WindowsPowerShell\v1.0\powershell.exe,-124 = "Document Encryption"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CProgram Files%5CWindowsApps%5CMicrosoft.XboxSpeechToTextOverlay_1.17.29001.0_x64__8wekyb3d8bbwe%5Cresources.pri\1d5ace4af3663bb\a37dfe62\@{C:\Program Files\WindowsApps\Microsoft.XboxSpee = "Xbox Game Speech Window"	action1_agent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CProgram Files%5CWindowsApps%5CMicrosoft.YourPhone_0.19051.7.0_x64__8wekyb3d8bbwe%5Cresources.pri	action1_agent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	action1_agent.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2d\52C64B7E\@%SystemRoot%\system32\WindowsPowerShell\v1.0\powershell.exe,-124 = "Document Encryption"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	action1_agent.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	action1_agent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	action1_agent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a	msiexec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2d\52C64B7E\@%SystemRoot%\System32\fveui.dll,-843 = "BitLocker Drive Encryption"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	action1_agent.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CProgram Files%5CWindowsApps%5CMicrosoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe%5Cresources.pri\1d5ace4f91f4df8\a37dfe62\@{C:\Program Files\WindowsApps\Microsoft.WebpImageExten = "Webp Image Extensions"	action1_agent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CProgram Files%5CWindowsApps%5CMicrosoft.WindowsCamera_2018.826.98.0_x64__8wekyb3d8bbwe%5Cresources.pri	action1_agent.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CProgram Files%5CWindowsApps%5CMicrosoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe%5Cresources.pri\1d5ace4cf7b9220\a37dfe62\@{C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906. = "Windows Maps"	action1_agent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	action1_agent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CProgram Files%5CWindowsApps%5CMicrosoft.XboxSpeechToTextOverlay_1.17.29001.0_x64__8wekyb3d8bbwe%5Cresources.pri	action1_agent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CProgram Files%5CWindowsApps%5CMicrosoft.Edge.GameAssist_1.0.3456.0_x64__8wekyb3d8bbwe%5Cresources.pri	action1_agent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	action1_agent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	action1_agent.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CProgram Files%5CWindowsApps%5CMicrosoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe%5Cresources.pri\1d5ace4d7e93ff7\a37dfe62\@{C:\Program Files\WindowsApps\Microsoft.DesktopAppIns = "App Installer"	action1_agent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CProgram Files%5CWindowsApps%5CMicrosoft.StorePurchaseApp_11811.1001.18.0_x64__8wekyb3d8bbwe%5Cresources.pri\1d5ace464ee1ce8\a37dfe62\@{C:\Program Files\WindowsApps\Microsoft.StorePurchas = "Store Experience Host"	action1_agent.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2d\52C64B7E\@%systemroot%\system32\FirewallControlPanel.dll,-12122 = "Windows Defender Firewall"	action1_agent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CProgram Files%5CWindowsApps%5CMicrosoft.YourPhone_0.19051.7.0_x64__8wekyb3d8bbwe%5Cresources.pri\1d5ace4595840bd\a37dfe62\@{C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_x = "Your Phone"	action1_agent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	action1_agent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	action1_agent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2d\52C64B7E\@%SystemRoot%\system32\dnsapi.dll,-103 = "Domain Name System (DNS) Server Trust"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CProgram Files%5CWindowsApps%5CMicrosoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe%5Cresources.pri	action1_agent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\RegFilesHash = 72bcd8380566b80b3b5cd761d69a7f0f2afd79b7077a53f40aac72a26c1cc7fe	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2c\52C64B7E	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\RegFiles0000 = 43003a005c00570069006e0064006f00770073005c0041006300740069006f006e0031005c0061006300740069006f006e0031005f006100670065006e0074002e0065007800650000000000	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0001	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	action1_agent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe

Modifies registry class 46 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\60C3F5011D783684193BDEE42A790A4B\ProductName = "Action1 Agent"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\60C3F5011D783684193BDEE42A790A4B\PackageCode = "A0A56C4428760504C8AACD4624099BF6"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\ED561CEF53981DE418C2AD69CE714711\Assignment = "1"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\ED561CEF53981DE418C2AD69CE714711\SourceList\PackageName = "action1_agent.msi"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\ED561CEF53981DE418C2AD69CE714711\Clients = 3a0000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\ED561CEF53981DE418C2AD69CE714711\SourceList\LastUsedSource = "n;1;C:\\Windows\\Action1\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\60C3F5011D783684193BDEE42A790A4B\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\3187685C39AD9D04484F43F57B7D8C2B	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\ED561CEF53981DE418C2AD69CE714711\DeploymentFlags = "3"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\60C3F5011D783684193BDEE42A790A4B\Version = "98370159"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\60C3F5011D783684193BDEE42A790A4B\InstanceType = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\3187685C39AD9D04484F43F57B7D8C2B	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\60C3F5011D783684193BDEE42A790A4B\SourceList\Net	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\60C3F5011D783684193BDEE42A790A4B\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\ED561CEF53981DE418C2AD69CE714711\A1_Agent	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\3187685C39AD9D04484F43F57B7D8C2B\ED561CEF53981DE418C2AD69CE714711	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\ED561CEF53981DE418C2AD69CE714711\SourceList	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\60C3F5011D783684193BDEE42A790A4B\AdvertiseFlags = "388"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\60C3F5011D783684193BDEE42A790A4B\Clients = 3a0000000000	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\60C3F5011D783684193BDEE42A790A4B\SourceList	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\ED561CEF53981DE418C2AD69CE714711	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\ED561CEF53981DE418C2AD69CE714711\ProductName = "Action1 Agent"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\ED561CEF53981DE418C2AD69CE714711\Version = "100336270"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\60C3F5011D783684193BDEE42A790A4B\ProductIcon = "C:\\Windows\\Installer\\{105F3C06-87D1-4863-91B3-ED4EA297A0B4}\\ProductIcon"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\60C3F5011D783684193BDEE42A790A4B\AuthorizedLUAApp = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\3187685C39AD9D04484F43F57B7D8C2B\60C3F5011D783684193BDEE42A790A4B	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\60C3F5011D783684193BDEE42A790A4B\SourceList\PackageName = "action1_agent(My_Organization).msi"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\ED561CEF53981DE418C2AD69CE714711\AuthorizedLUAApp = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\ED561CEF53981DE418C2AD69CE714711\SourceList\Net	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\60C3F5011D783684193BDEE42A790A4B\A1_Agent	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\60C3F5011D783684193BDEE42A790A4B	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\60C3F5011D783684193BDEE42A790A4B	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\ED561CEF53981DE418C2AD69CE714711\PackageCode = "6995E120F132981499FCADE6FAD82951"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\ED561CEF53981DE418C2AD69CE714711\AdvertiseFlags = "388"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\ED561CEF53981DE418C2AD69CE714711\ProductIcon = "C:\\Windows\\Installer\\{FEC165DE-8935-4ED1-812C-DA96EC177411}\\ProductIcon"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\ED561CEF53981DE418C2AD69CE714711\SourceList\Net\1 = "C:\\Windows\\Action1\\"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\60C3F5011D783684193BDEE42A790A4B\Assignment = "1"	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\60C3F5011D783684193BDEE42A790A4B	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\60C3F5011D783684193BDEE42A790A4B	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\60C3F5011D783684193BDEE42A790A4B\Language = "1033"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\60C3F5011D783684193BDEE42A790A4B\DeploymentFlags = "3"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\60C3F5011D783684193BDEE42A790A4B\SourceList	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\60C3F5011D783684193BDEE42A790A4B\SourceList\Net	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\ED561CEF53981DE418C2AD69CE714711	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\ED561CEF53981DE418C2AD69CE714711\Language = "1033"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\ED561CEF53981DE418C2AD69CE714711\InstanceType = "0"	msiexec.exe

Suspicious behavior: EnumeratesProcesses 22 IoCs

pid	Process
3972	msiexec.exe
3972	msiexec.exe
3972	msiexec.exe
3972	msiexec.exe
3972	msiexec.exe
3972	msiexec.exe
3972	msiexec.exe
3972	msiexec.exe
3972	msiexec.exe
3972	msiexec.exe
3972	msiexec.exe
3972	msiexec.exe
3972	msiexec.exe
3972	msiexec.exe
2616	powershell.exe
2616	powershell.exe
4740	powershell.exe
4740	powershell.exe
3332	powershell.exe
3332	powershell.exe
2208	action1_agent.exe
2208	action1_agent.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4640	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4640	msiexec.exe
Token: SeSecurityPrivilege	3972	msiexec.exe
Token: SeCreateTokenPrivilege	4640	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	4640	msiexec.exe
Token: SeLockMemoryPrivilege	4640	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4640	msiexec.exe
Token: SeMachineAccountPrivilege	4640	msiexec.exe
Token: SeTcbPrivilege	4640	msiexec.exe
Token: SeSecurityPrivilege	4640	msiexec.exe
Token: SeTakeOwnershipPrivilege	4640	msiexec.exe
Token: SeLoadDriverPrivilege	4640	msiexec.exe
Token: SeSystemProfilePrivilege	4640	msiexec.exe
Token: SeSystemtimePrivilege	4640	msiexec.exe
Token: SeProfSingleProcessPrivilege	4640	msiexec.exe
Token: SeIncBasePriorityPrivilege	4640	msiexec.exe
Token: SeCreatePagefilePrivilege	4640	msiexec.exe
Token: SeCreatePermanentPrivilege	4640	msiexec.exe
Token: SeBackupPrivilege	4640	msiexec.exe
Token: SeRestorePrivilege	4640	msiexec.exe
Token: SeShutdownPrivilege	4640	msiexec.exe
Token: SeDebugPrivilege	4640	msiexec.exe
Token: SeAuditPrivilege	4640	msiexec.exe
Token: SeSystemEnvironmentPrivilege	4640	msiexec.exe
Token: SeChangeNotifyPrivilege	4640	msiexec.exe
Token: SeRemoteShutdownPrivilege	4640	msiexec.exe
Token: SeUndockPrivilege	4640	msiexec.exe
Token: SeSyncAgentPrivilege	4640	msiexec.exe
Token: SeEnableDelegationPrivilege	4640	msiexec.exe
Token: SeManageVolumePrivilege	4640	msiexec.exe
Token: SeImpersonatePrivilege	4640	msiexec.exe
Token: SeCreateGlobalPrivilege	4640	msiexec.exe
Token: SeBackupPrivilege	3528	vssvc.exe
Token: SeRestorePrivilege	3528	vssvc.exe
Token: SeAuditPrivilege	3528	vssvc.exe
Token: SeBackupPrivilege	3972	msiexec.exe
Token: SeRestorePrivilege	3972	msiexec.exe
Token: SeRestorePrivilege	3972	msiexec.exe
Token: SeTakeOwnershipPrivilege	3972	msiexec.exe
Token: SeRestorePrivilege	3972	msiexec.exe
Token: SeTakeOwnershipPrivilege	3972	msiexec.exe
Token: SeRestorePrivilege	3972	msiexec.exe
Token: SeTakeOwnershipPrivilege	3972	msiexec.exe
Token: SeBackupPrivilege	1748	srtasks.exe
Token: SeRestorePrivilege	1748	srtasks.exe
Token: SeSecurityPrivilege	1748	srtasks.exe
Token: SeTakeOwnershipPrivilege	1748	srtasks.exe
Token: SeRestorePrivilege	3972	msiexec.exe
Token: SeTakeOwnershipPrivilege	3972	msiexec.exe
Token: SeRestorePrivilege	3972	msiexec.exe
Token: SeTakeOwnershipPrivilege	3972	msiexec.exe
Token: SeBackupPrivilege	1748	srtasks.exe
Token: SeRestorePrivilege	1748	srtasks.exe
Token: SeSecurityPrivilege	1748	srtasks.exe
Token: SeTakeOwnershipPrivilege	1748	srtasks.exe
Token: SeRestorePrivilege	3972	msiexec.exe
Token: SeTakeOwnershipPrivilege	3972	msiexec.exe
Token: SeShutdownPrivilege	1884	MsiExec.exe
Token: SeRestorePrivilege	3972	msiexec.exe
Token: SeTakeOwnershipPrivilege	3972	msiexec.exe
Token: SeRestorePrivilege	3972	msiexec.exe
Token: SeTakeOwnershipPrivilege	3972	msiexec.exe
Token: SeBackupPrivilege	2556	action1_agent.exe
Token: SeSecurityPrivilege	2556	action1_agent.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
4640	msiexec.exe
4640	msiexec.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 3972 wrote to memory of 1748	3972	msiexec.exe	99
PID 3972 wrote to memory of 3172	3972	msiexec.exe	101
PID 3972 wrote to memory of 1884	3972	msiexec.exe	103
PID 2556 wrote to memory of 4776	2556	action1_agent.exe	106
PID 3972 wrote to memory of 1260	3972	msiexec.exe	107
PID 2208 wrote to memory of 2616	2208	action1_agent.exe	109
PID 2208 wrote to memory of 4740	2208	action1_agent.exe	111
PID 4740 wrote to memory of 1068	4740	powershell.exe	115
PID 2208 wrote to memory of 3332	2208	action1_agent.exe	116

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\action1_agent(My_Organization).msi
1⤵
- Badlisted process makes network request
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4640

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3972
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1748
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding C68EBEEF130DB0DC6FBB936A71D9CFE4
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:3172
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 883452BE664B20A6230839359BF23C95 E Global\MSI0000
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:1884
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding E34F68002949A362F12D992E1B04E966 E Global\MSI0000
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:1260

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:3528

C:\Windows\Action1\action1_agent.exe
C:\Windows\Action1\action1_agent.exe service
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2556
- C:\Windows\SysWOW64\msiexec.exe
  C:\Windows\system32\msiexec.exe /I "C:\Windows\Action1\action1_agent.msi" /quiet /qn /norestart /lv* "C:\Windows\Action1\logs\agent_install_1770087133.log" ALLOWRESTRICTEDVERSIONS=1
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4776

C:\Windows\Action1\action1_agent.exe
C:\Windows\Action1\action1_agent.exe service
1⤵
- Drops file in Windows directory
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2208
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -Command "$ExecutionContext.SessionState.LanguageMode"
  2⤵
  - Drops file in System32 directory
  - Command and Scripting Interpreter: PowerShell
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:2616
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -Command -
  2⤵
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Command and Scripting Interpreter: PowerShell
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4740
- - C:\Windows\Action1\action1_agent.exe
    "C:\Windows\Action1\action1_agent.exe" loggedonuser
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:1068
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -Command -
  2⤵
  - Drops file in System32 directory
  - Command and Scripting Interpreter: PowerShell
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:3332

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Event Triggered Execution

T1546

Installer Packages

T1546.016

Privilege Escalation

Event Triggered Execution

T1546

Installer Packages

T1546.016

Defense Evasion

System Binary Proxy Execution

T1218

Msiexec

T1218.007

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e58a228.rbs

Path C:\Config.Msi\e58a228.rbs
Size 240KB
SHA256 9d5aa60fdc6773c5bd6127fbd11e2a993d49abfae6c3ce26ea43948af1decb4c
MD5 54aa2d294b066b221d5b0d7f6a3819e6
SHA1 77b5e085848c09ecbc58021282022c63748dc59d
SHA512 0ec8e50c0d3be9a2be7509a63cd925371d9726afe5e12887e07ef4f090426a6de31eea0cf11ef0fc7fb24d781bfe84ec2e5ef595c7dee26f7218452384b78f2d
SSDEEP 3072:AVuzXiqyhTO8W0iEa8LW0bEC9hvZpC01v+eUKflQnZl+T+J7g6EsNr7wyy/IP3B:AVgqhy8VKU3hvZUy+ppHEsuB/S
TLSH
T1CD349E217494547EEBFF0832953AD671AE3DF2380B90C56EC384581E6D618C1ABB7B27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e58a229.rbs

Path C:\Config.Msi\e58a229.rbs
Size 7KB
SHA256 d56e5982f33591b58d771c570d70b40c2ee29b62123d82f90b641ddf70ac671b
MD5 9f5dbd25f04349ae0aae5d4561b1e03d
SHA1 a4205ac9239e69e161c6d9e31e60a4131a067435
SHA512 1cbfcddc9740e0e2d780ad1f3e40020b46576f9adc371754aca9bdf5cf2684fcf9140deb59c7d30bb63b927bae38bd35585af6faec426cf3233e2fc19dfd6f41
SSDEEP 192:J+eisUS+JIE+Jtb1d8dhJS8v6E9zkCpO35ClbNA:Jh+R+5h
TLSH
T144E11F4177148AE6F99A0B39CA470BA27BB6D3DA8301234B0CCDA4646F5339D1FA51DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e58a22e.rbs

Path C:\Config.Msi\e58a22e.rbs
Size 246KB
SHA256 e5eb22b9ace8727e3250681f2b5374f3ffc9b5ac365b6a42c47a3a93d4d30ddd
MD5 81bfecdb1fab53e51f5e8305e78c6bcd
SHA1 ebd0206600db307938dc73702ff138b9faaf056c
SHA512 ee9be5c6370ced02f93cd0517b359e0063c12750619431d2564fa53f70f8ef0ee3660ca048d492a05b429aa24c5eddc4381a6b0be0b8b5693fea9c519b088f4a
SSDEEP 3072:kEpuDuxXiqyhTO8W0iEa8LW0bEC9hvZpC01v+eUKflQnZl+T+J7g6EsNr7wyy/IJ:kEpGqqhy8VKU3hvZUy+ppHEsuB/S
TLSH
T197349E217494543EEBFF0932953AD671AE3DF2380B50C56EC384981E5E618C1ABB7B27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e58a234.rbs

Path C:\Config.Msi\e58a234.rbs
Size 8KB
SHA256 dacd7272692db5eecbdbb6106d6e6dc4bc828a8780fff1dda3d353c0f5367f4a
MD5 700eb227217c704b5017befd05e371c3
SHA1 70abb73c1d89f49d236a24e41cb65c634cfa6717
SHA512 f6ba4fc0a2f5fb1f972df50349eec8acf43f5409e7ce140d063cd56ea0b3b194903307928dce17ee1b6610da4a1dcf340de391e829a4de94eb0bc7767f8d63f2
SSDEEP 192:GkMERuRLRGRyDv140JnWcAOfDb4YrHwiOqTdhZhzKVM1dA:GYRuJRGSHxfA
TLSH
T17A026342371843E6ED964B36CA030BB26FF7D6D58305429B24DCB4646F223992FE51AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e58a238.rbf

Path C:\Config.Msi\e58a238.rbf
Size 3B
SHA256 13bf7b3039c63bf5a50491fa3cfd8eb4e699d1ba1436315aef9cbe5711530354
MD5 21438ef4b9ad4fc266b6129a2f60de29
SHA1 5eb8e2242eeb4f5432beeec8b873f1ab0a6b71fd
SHA512 37436ced85e5cd638973e716d6713257d692f9dd2e1975d5511ae3856a7b3b9f0d9e497315a058b516ab31d652ea9950938c77c1ad435ea8d4b49d73427d1237
MD5 SHA1 SHA512

Submit Download

e58a239.rbs

Path C:\Config.Msi\e58a239.rbs
Size 1KB
SHA256 a163096a58daa212ec1ef3ca4845a1b0cfa26655e9497f1866440566e660d4ba
MD5 0a2f775a3ff46f7a42d2b3744b2fb375
SHA1 4846624da1a049eaf1808c777fba6d16f784dcf9
SHA512 291b412ef050f9e1d418e3f883319ec60208ad8b7e3e04cd77cc8b68f2f51a6dd396b6152686c573d7460a0dda4b1225789ad2a0b934a0003c35178fadcb9e31
TLSH
T19521B182F70857C2EC965B35CA031B927BBBD2E6860943831C8D36142E6175C5FB50DE
MD5 SHA1 SHA512 TLSH

Submit Download

e58a23a.rbs

Path C:\Config.Msi\e58a23a.rbs
Size 7KB
SHA256 f5cbe5ba3f9baf89fc1f644385745b8a7757aced398486ff4342da2fad9c7201
MD5 173953921ce75799f4f78b64ca70ff4f
SHA1 421af94560b4dcab727461a9c69581164bc2617b
SHA512 904a370a1a4598462eb72289255b4bd6a431f5abd4f7bee827d3b20533a65c1b8e04c6093af3a108bab987e0e5a683419150a0c448d11e25b5ce554c4ece6744
SSDEEP 192:GSe5zZzaTdmwIkdmwC2szTe/u/SkGL5kqKppu05serOS:GrFUdmQdmh2suWakGL5kZu05serOS
TLSH
T181E10C81B62181E2E8961F38D707176537B6D7DA5310736B08CDE0A0DF6378D4F8A68E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

18E6B4A57A6BC7EC9B861CDF2D6D0D02_EF52C1EC85F21F31CC0157A5C8803013

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\18E6B4A57A6BC7EC9B861CDF2D6D0D02_EF52C1EC85F21F31CC0157A5C8803013
Size 765B
SHA256 c51adb0cdaf5ef53cbc3484c4c1fd5857075b86ae3b261768efce56540d26579
MD5 5bda9d793dcd200915b950a1ec2c56b0
SHA1 e1204344aaf13c701aeb492f77d8d7929c0de0a3
SHA512 a9ac9cacaa2656726a08236a905354b2aa1639d8b12920a269a55e69ba0685d76e45210954587fc493e7720c2262a62b23ea341de1a68c335c499f74cf76e2ba
TLSH
T1E801251E4D3A6A05FF8F06A199D9CD7BB405B33636A50A0F651D80001834FAE5F1041C
MD5 SHA1 SHA512 TLSH

Submit Download

3AA0DCD5A74331FBD6F344550EC48B87_FAB5A9F6C6BE3394975FF948CA40CA87

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3AA0DCD5A74331FBD6F344550EC48B87_FAB5A9F6C6BE3394975FF948CA40CA87
Size 637B
SHA256 c0f692caf7908214134245789052573329ce2a1b45ff0a872e4712156cb1d0ec
MD5 02632823fb3d6fa0a8e6ab904b9ffd44
SHA1 fca561c4f7489c460479e5ea43a61ae7c6b3323e
SHA512 f220f0abc81ea21322cac280fa7d106848a5bb016edd181774b8f244e54cf539ee554ee9bdb0602a392a34a01869e4dc264827b93525d45777dad74e7e997a67
TLSH
T162F002029C19D474A522484D1E6DA5DA35F0917A3AD15DF3355E9FC927FC394AC9024C
MD5 SHA1 SHA512 TLSH

Submit Download

B2FAF7692FD9FFBD64EDE317E42334BA_93702E680A5530C052C8D2BA33A2225F

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B2FAF7692FD9FFBD64EDE317E42334BA_93702E680A5530C052C8D2BA33A2225F
Size 1KB
SHA256 f185d774e14018f9168c148160b08cacdde50afe2fe6c1d2f2aa54f306afcd9f
MD5 02900293f84b28f2c8329d6ba702df3b
SHA1 a34a4ed86f93862bcc1fc184c069fad31b8ccc5e
SHA512 7ef54ac8dbf31f36c786ba3365fc30cb06a82631632a7f070e02fbd78693b6b98b2e53166aa556cf237deb88f83fa37b6bd9bbbc6cdd897e00ad08c059f454c5
TLSH
T1C331E9D35FB8B8306D0D4E8498ED8B726C707461FE24187534B4406798A3FD0181B81D
MD5 SHA1 SHA512 TLSH

Submit Download

18E6B4A57A6BC7EC9B861CDF2D6D0D02_EF52C1EC85F21F31CC0157A5C8803013

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\18E6B4A57A6BC7EC9B861CDF2D6D0D02_EF52C1EC85F21F31CC0157A5C8803013
Size 484B
SHA256 990915d2cc75d8641b87a36df5c2b2733f3350b939070b333fe9f0727845352b
MD5 fd963b80fae371020fd1cf5a5c0e559b
SHA1 aef4a40e976de65077eaa70c9d02e59d96ebb405
SHA512 9d6654f88e38dbe73f148516e6002749471489124c5c858e25e986bec6b6ad7d5cd0c0b5c781061fdd03d350218b52c80a36217529723ce73559c4fea8fcfc70
TLSH
T1EBF0AB3C8AF9413FF0798C3929D4A03B8C0AF213100241BC02F90B196B02F01FD92075
MD5 SHA1 SHA512 TLSH

Submit Download

3AA0DCD5A74331FBD6F344550EC48B87_FAB5A9F6C6BE3394975FF948CA40CA87

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3AA0DCD5A74331FBD6F344550EC48B87_FAB5A9F6C6BE3394975FF948CA40CA87
Size 488B
SHA256 23c96c07e99a1769bea34aaad0360df88be72963b0bb364f4a6daf9b9359d34b
MD5 763b576f78c764abbe74d3d6a8f51728
SHA1 53039220634723315049a078fdb826b8db852930
SHA512 9d2b3c0bfde060c5ae4bc768b1c8a5aa77c4524b642b5fe899deeb7a56e3000f42f283ba752695f1cd2871ada43a9911d5966199d0878dd92937719a7fcb38dd
TLSH
T18AF0A33459F6417FD031897909D5D103ED2BF2122F804D5C11A05705F742E404C51D35
MD5 SHA1 SHA512 TLSH

Submit Download

B2FAF7692FD9FFBD64EDE317E42334BA_93702E680A5530C052C8D2BA33A2225F

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_93702E680A5530C052C8D2BA33A2225F
Size 482B
SHA256 4cd87da8ba8a34e23f6e273fb4cafe8bb4332eeba1baa71ffa183ec617e87db1
MD5 9f47f1edde5e37c725892118448a632a
SHA1 1f3e32b5a01d9009ea359990ba00230f20c69151
SHA512 b4707494b7faacfd180d18d309209ac0d602aaf9f2f01578fc30e33b6a731650e24c200e8523cc15897093f0da6ac5fa6edd7addcacb79d965a674a913eebb75
TLSH
T179F0AB2829B8506DE0335E3485D9B1559CBCF622380186A215121A072A0BE834E57A37
MD5 SHA1 SHA512 TLSH

Submit Download

7z.dll

Path C:\Windows\Action1\7z.dll
Size 1.2MB
SHA256 9d5eb586d110759ef5cb3403cda57c060567a703115e9bc66819c9638294664c
MD5 5d647c67acd6dd87e7cf1515a1c94a71
SHA1 9fd82890c8cc0bd7c4115f496ce218a45500abdd
SHA512 debf045655552a7a3d8a021a48af62c536e6435f59ed84e94c2c48156eee76510b99cf9a2777bb74c6fdf71467f71bb8c21bcc25ff058d050551b1ee5bc44275
SSDEEP 24576:zgiLEtP9FaybY4B7S0APFkWPHMd6axRnt3usIPK59FQ:zgiYXbY4B7EWrTwsIPK59u
TLSH
T159458D16F7F5C074D58A4630871DABF640FCE71ACA1068C76BC0BE6E6F319D6C229989
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

action1_agent.exe

Path C:\Windows\Action1\action1_agent.exe
Size 8.3MB
SHA256 371db1fccf5743d5a3ff3161b20557f045a4c5ccf8a8bfdc3388f4d3c7173a37
MD5 d8da0a53e1adb21d08416e33e72cc4de
SHA1 98f95bd0196f6cd7027547b35af367830ea557dc
SHA512 9609b1b39ebc0a336fcf145eb2201acb3e24a5dcff240cc85261449c4439abfc34022cef36c8fc3b514e8d9a471b0c245cb61362cb65e09495e721e4e40eaeb0
SSDEEP 196608:1njhuGl1E79yJdVSNKweNywEc87ffcCn5gcOHO:1njxxHSsweNucIfcCn5gcOu
TLSH
T1DB968D10B6918135F8F301B9997E57BF8A38FE20072594DBD3C82D5E5AB19D23A32B17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

action1_agent.exe

Path C:\Windows\Action1\action1_agent.exe
Size 8.9MB
SHA256 bdaf0c46119913e3636524f2a353f3fdaef30d6bf3efb168a20edd6dd10809bd
MD5 6d8bee98ef484d5892de8a9f16950228
SHA1 ebe2473b6e7f497a79a43a01585ddafd4042ef50
SHA512 d78abf33f61286527c3bd7ff9a244e7652328193390d4c5fc9cc6afdec44ea149cf8e945fd321931e5b53d64b98308ac2965232fad29f058f452ba0c42583685
SSDEEP 196608:O2gNtQsSfSMg5AXFlFBaSIYYu4+B2v4ZnDVVx0sp52Ck:OZJM/fblYN6ZnDVn082r
TLSH
T124968D21E6418135F9A301B299BE4B6F8538AE310B2454D7D3C85CAE5AB19E33B33F57
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

action1_agent.exe.connection

Path C:\Windows\Action1\action1_agent.exe.connection
Size 2B
SHA256 565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3
MD5 e0aa021e21dddbd6d8cecec71e9cf564
SHA1 9ce3bd4224c8c1780db56b4125ecf3f24bf748b7
SHA512 900110c951560eff857b440e89cc29f529416e0e3b3d7f0ad51651bfdbd8025b91768c5ed7db5352d1a5523354ce06ced2c42047e33a3e958a1bba5f742db874
MD5 SHA1 SHA512

Submit Download

action1_agent.exe.update_state

Path C:\Windows\Action1\action1_agent.exe.update_state
Size 1B
SHA256 7902699be42c8a8e46fbbb4501726517e86b22c56a189f7625a6da49081b2451
MD5 8f14e45fceea167a5a36dedd4bea2543
SHA1 902ba3cda1883801594b6e1b452790cc53948fda
SHA512 f05210c5b4263f0ec4c3995bdab458d81d3953f354a9109520f159db1e8800bcd45b97c56dce90a1fc27ab03e0b8a9af8673747023c406299374116d6f966981
MD5 SHA1 SHA512

Submit Download

action1_agent.msi

Path C:\Windows\Action1\action1_agent.msi
Size 6.8MB
SHA256 9f7125f869316c8a80402afcff018baa6291d4175950261ebef519ee06bd8c56
MD5 7d824ac94952b55e9ce8fefb952edcf3
SHA1 e48350054f68a5829179a220612e91a188dab5b1
SHA512 fba4202b9d2b8d992f15b18c15f79d9e3e885616f0c415c98ca39103ce39c2db6d203c11dc59f4585dc5a36a284c2ba0650b087b40c8be13b5993efd90318cf6
SSDEEP 196608:Ulc4PxNgvXPtj+zc5il1FiaRg9MRuGWRHZB:grr+/tj+QITFic+MRRWRn
TLSH
T18A662321BA838036E95B1E30753D9A759B3DFE345F64B0CFA784382D5E316C05B72A92
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

action1_remote.exe

Path C:\Windows\Action1\action1_remote.exe
Size 1.5MB
SHA256 84f9e22a5f457274b80bc978cfd07a8d6597fcfc4557e2386e5e609dc46991de
MD5 83defd57b5eacddd745a689074afa859
SHA1 84cd4e7c715c18105b61933ea52d6dc662c7f61e
SHA512 42e8e194d61dc064e4f382757fa30a6129dfbe65d9e2b19b68ab3582dde9ad4f81f975be497cb78ceaca7530c00d6ac8cce22a9c8590b4d13f87c134d4dce96e
SSDEEP 24576:tjPIrhxzZxkId1cDuDkSiAHnECgYgWj5ZqrMlgrUPopzFv73OZNZ5Tc4NhwCqJtB:tb6xzZzD3B8MlgrUPUhvkTc4ECqJtVP
TLSH
T1FA758C21379B803CE9B2137168B89A7A593DBE750F75D4CFA6840A2D1C70AC25F35B27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

advanced_settings.json

Path C:\Windows\Action1\advanced_settings.json
Size 46KB
SHA256 7fcd824e084c15043e2f41c5a0b36fbe05d601bc817440eea1eb6a11b86e0897
MD5 2617a731ebcc13fb50f096cc57c51298
SHA1 ebb232cd48c44564a757675e457f62973bd876f5
SHA512 730396c27ff9e8401e35146941c720013cdfa26e460ec1c2e10cce257f0e68742f28c394e8d172f08f0b7f7d2b090c56bb0aaa8db41d089baa6222adb7dfd220
SSDEEP 768:aHXKnbhRgjUzmSTRQ3Lyhx4ft32qUgw6/Fh8uP5K5DIK58EOKWbBoE3a+OQzGXSU:ZRoLECxOWRHK79
TLSH
T10D235C16E4757DB108C2188C5EDB1AF7DA4E019712D906DE871CEEBF89AF52C8102E9F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

agent_cdm_not_downloading.threshold

Path C:\Windows\Action1\agent_cdm_not_downloading.threshold
Size 627B
SHA256 109e5e32624412b76a79fcefe8940439df15459d7e263179e25ba6d6a050482b
MD5 5f69cb916863b8367cdf939fff8ef47a
SHA1 848a54dd9c064d12d0c2cb8e55047ee8a2646370
SHA512 32474cfe85851bd04221cc455f93ce593e689daf8036a7d235c908256ee84694537c254b96b4fbaa9c1d71343ed7d2a32109d4ddbfaddacc1c646d0da38aaf41
TLSH
T108F049845E0999AF83C2CE46F9F02F0BCF14143BE98B4A0B40300A024C8AEB78660339
MD5 SHA1 SHA512 TLSH

Submit Download

agent_downgrade.version_pair

Path C:\Windows\Action1\agent_downgrade.version_pair
Size 73B
SHA256 623baee7aa2a7e498b98bc48f4df34dcee9a238b803658d025aef14edba78015
MD5 ca78a2797cb5268df3f0eb23f22b0ca1
SHA1 828680db829cde3afd5aed0474d4ecddf8cca5d8
SHA512 c720426583d60bb9c5173cb3f1d597837797cd3bbd839c801ac904b712928ce8bc294ab7b555daf7697afed1525b96ac70f456ea181ab7ed4429053d361790e4
TLSH
T108A022082080020320F3E3022A3822800B08008EEBA80C0C003C0BC2022E3B322CCB00
MD5 SHA1 SHA512 TLSH

Submit Download

first_install

Path C:\Windows\Action1\first_install
Size 50B
SHA256 84a07ae0ded681a36d23cdfcf143ec10456874b51b89d33d2c2c0f1446757974
MD5 fb88e144833d8135e925cb3b40376828
SHA1 1c8ac3a9e40d879cdfd749ccd3cfc100828c2bab
SHA512 28852b0f30ac308dc490d9022f72d3d97b90593f2041389d6cca6f5dc88f5d8e2bf4dc3d40b5b83dd0ca937ef37baa71777d20ad88d3634dfe29bea427fa64de
TLSH
T11C9002A0241262762855436994C602914750A2028C49004511CD07081421012549F151
MD5 SHA1 SHA512 TLSH

Submit Download

agent_install_1770087133.log

Path C:\Windows\Action1\logs\agent_install_1770087133.log
Size 1KB
SHA256 34435ee04e4fb91320f4f6836fe16e03495996a639bc5161dcdb60ef003cea07
MD5 fef7e856c2a7a8fef4c6f7da3f888265
SHA1 4c242870575237d6d230085cd907e21b1b3bfe8e
SHA512 a4698dbc656456e4eafd1b7cac464b142394ca4e7154aad165146390a457c543ca60276ae457a9a92200ad8ff3229c223c631faa6e9702e576fe7f7b8e77703c
TLSH
T1B331D8591BD9084DB1B69747DAF3C0510A73FCD66C76CB4C23C88659066BD06AC6C37A
MD5 SHA1 SHA512 TLSH

Submit Download

CLOUD_2ba943b0-85b6-11ef-b9af-69a8758f6819_1728420293483_builtin.result

Path C:\Windows\Action1\package_downloads\CLOUD_2ba943b0-85b6-11ef-b9af-69a8758f6819_1728420293483_builtin.result
Size 65B
SHA256 1e3ac9c8a588845c709660b8732c46bffcf9b0a853858dfa3afc8af4c079eda0
MD5 78189007531a78370b9e05498ca1686e
SHA1 f860f1b2f28cf630b4f8b951d646a480c8b8795b
SHA512 4b1e0addf277308f43de21ef66e06ed0835513441d83d833a1429cb542c260237f81c3913e61c57c7f059e43a7f3f4a3b39dbc49da14b5e1ceab9ac6773f2937
TLSH
T111A0022E3017803050457050559C36615602350E0488C157D4F4ED3DA7E15A5D155597
MD5 SHA1 SHA512 TLSH

Submit Download

CLOUD_394fae00-85b6-11ef-b9af-69a8758f6819_1728420316384_builtin.result

Path C:\Windows\Action1\package_downloads\CLOUD_394fae00-85b6-11ef-b9af-69a8758f6819_1728420316384_builtin.result
Size 65B
SHA256 68866c8616cb1d63d51c34f4459f0a897be18cfc6e1a41eba1e1f8e7a8fe4f10
MD5 3726be7385174d00af66b577da5ddfa8
SHA1 0549b9de0e7a252a8ca57147b8a1e6148f720cdc
SHA512 161e5fc368a7b6d8dfff99510c26f21c3a46f075f40d4f124d010d55419ea52eceb229987eb5173679337566df78ee89b6fff840a118341d7a7ee5157fef23a3
TLSH
T13BA0022E3013803050857450549C26615206210F0488C157D4F4ED6DA7E14B5D155597
MD5 SHA1 SHA512 TLSH

Submit Download

CLOUD_e469fa00-869e-11ef-9fc1-4b2f0f8dddf2_1728520246688_builtin.result

Path C:\Windows\Action1\package_downloads\CLOUD_e469fa00-869e-11ef-9fc1-4b2f0f8dddf2_1728520246688_builtin.result
Size 65B
SHA256 e5fef12b888ae46cf9ea6d857ea48a0f893614ecf989b9dc3535d83ebf566db0
MD5 041425b0cef03022e96f25dc3b043fef
SHA1 0bf5a661fffd31459f55a4639101446f3fe9801d
SHA512 ca3edcb8321b106d64e3b35993a4a6fd11f5d6878d63a06601376417c1e7cbb2e2cea4e8ef9ac8600370c38921e481d96cece606b6670c28c03d0bee2406a64e
TLSH
T110A0021E3013C4205045B450549C26615102210E0888C15BD4F4ED3DA7F14A5D195597
MD5 SHA1 SHA512 TLSH

Submit Download

sas.dll

Path C:\Windows\Action1\sas.dll
Size 8KB
SHA256 996b01e15f85e165899630721a141b178a9c372b6e878012180ec9e9d4e7bd06
MD5 969d1f85151e0156d51a664e59a50213
SHA1 777735cf24fe880d00a205b5bcc79ca8df8d660b
SHA512 73f9a14d297f7dddc9e3d9b0db6cd4160cd000f31f437ea8add7d95de2f704482fa891996f2df048def3371cc9245a2efa31b2d0647a7cc1e6848db7b809e711
SSDEEP 192:l5UGq/4LYix0kmAEE8O5cTbOVT66o+1WX6wW/:nr5YiWXAjHGOVZP1WX6wW
TLSH
T13C02E60973A8067AE4FF1B76A06EA236462AB6205FF142EF195322D938355D15E307C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSIA340.tmp

Path C:\Windows\Installer\MSIA340.tmp
Size 379KB
SHA256 d7b6867d5bcd9ec42c32d82a145949cfb6c1e4557c1dbcccd7407209810b2e54
MD5 bbe29dc8d83747d63bdc9f4829f7b201
SHA1 9fcade3a8869b0d06bcf42ec40d6adafb7b9ac3a
SHA512 fe60c502c760a7a0e84c5447febbfc268bea04423f0ea961cc2a60f4a6461516a96aab2fedf23f103a1455f862c9b00d335080cadbf93865dfc9b42f7f1a5252
SSDEEP 6144:ArYPRq4Pa3nYGxKn7xz8b3oXD5gJ2xuaqoAKDH4X7AOkz4AlEuTuEv:A0q4Pa3nYvn7xz8b3oXD5gIF4Lbqb
TLSH
T107848D00F592C131C4BE017169799FB685BDA9285F7009DFABD40E7E9E346C1BA31E2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSIA5E2.tmp

Path C:\Windows\Installer\MSIA5E2.tmp
Size 234KB
SHA256 78860e15e474cc2af7ad6e499a8971b6b8197afb8e49a1b9eaaa392e4378f3a5
MD5 8edc1557e9fc7f25f89ad384d01bcec4
SHA1 98e64d7f92b8254fe3f258e3238b9e0f033b5a9c
SHA512 d26c9dce3c3d17583ffb5dbcd3989f93b096a7f64a37a2701a474c1bf4b8c8b1e922c352d33f24e411f1c793e1b4af11a3aec1de489087d481b1b636df2050cd
SSDEEP 3072:5XiqyhTO8W0iEa8LW0bEC9hvZpC01v+eUKflQnZl+T+J7g6EsNr7wyy/IP3:5qhy8VKU3hvZUy+ppHEsuB/
TLSH
T159348D217494547EEBFF0832953AD671AE3DF2380B90C96EC384581E6D618C1A7B7B27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSIC6DB.tmp

Path C:\Windows\Installer\MSIC6DB.tmp
Size 385KB
SHA256 626a4e7060bd9b789795804e8b6497743c11d61c7353fb68798dd0bc76152cae
MD5 ced03b1bf99e148e40b7834816e2c330
SHA1 a7dc2898fa0916f8484e3597ce3e2c524c9c954d
SHA512 52a52436bb240a5ec16c540e428dc5acf7f7decaee4b5df092347019ef568d4c5948535721a39deef6dacc31cf4debad665dfb077c4dc9f44dc77ccd9d60cbaa
SSDEEP 6144:Rh1TnES0D5L240+A++CGvBsee3MudRa1UIFO4I/NVTPFc:JTnEDL24Pt+CGveeenw44IHFc
TLSH
T19D849D01B542C032D5AE05B0B634EFB5AABDA9705FA568CBB7D40D7B8D302C1A735B1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e58a227.msi

Path C:\Windows\Installer\e58a227.msi
Size 6.4MB
SHA256 6a02721f5227dc764b66cc48dd46e75385d2bb10b0e0aadeb8f82fea54ddaab7
MD5 71ef09a49e261a2b513baee7eedecd30
SHA1 edcda622671c521295846f604f9cba0063d14df2
SHA512 1892b24140107b7679821917a6bb6c035cfcb22aebcc04bde183a9cb0735c410d98d489faa65f3b0c529f60456d411bd717ca9df2a990d4449ceb69adbcb6006
SSDEEP 98304:n+UJgsMOyVEUMo7Pcwq0kiOBOLT5lNUxh5Hup4SLQPLpGKWT4UX2Zo9HPD+PEJ8L:+4gtOyfPJe4LxUxCAFvtsHPr8y
TLSH
T17D662312BA838135D99A2E30343D86B5963EFF349F34B5DFEB84351D5E302D06A71A92
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ProductIcon

Path C:\Windows\Installer\{105F3C06-87D1-4863-91B3-ED4EA297A0B4}\ProductIcon
Size 32KB
SHA256 7a214ccfe309e4c0c83f40d9b7c92e3d41206db734401e7227ef10b38064ca9d
MD5 d37f7a439b9527f73e21311db17eaf00
SHA1 d0f34b3c1368f28a419924560c282358703a8d35
SHA512 3c1bcd38ed8d6bff8e071416cda90b0331b50903d9e4c9305bc36f9ccce23cb05424576b066485e76ee17e6fdc493fd25f8776d24b98de9d3941c181bb333569
SSDEEP 96:JnbrlpScW1BwB/vmaOZaxdJVE8BEArPz578SSuQEmgo3/I:JnbrlpScW18Ued/E8f8KQEPo3/I
TLSH
T195E211067007D5DCDE28473CB0B6FCB539728A776EAC23DEF2A4B4E52882465147C6B2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_igfgmdj1.iiy.ps1

Path C:\Windows\Temp\__PSScriptPolicyTest_igfgmdj1.iiy.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

powershell.exe.log

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
MD5 d85ba6ff808d9e5444a4b369f5bc2730
SHA1 31aa9d96590fff6981b315e0b391b575e4c0804a
SHA512 8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
TLSH
T1CE51EE323375B1E888167F071E681A8053BF4355EA94AF1CB698621ED93641B9F222F3
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 64B
SHA256 83e613b6dc8d70e3bb67c58535e014f58f3e8b2921e93b55137d799fc8c56391
MD5 5caad758326454b5788ec35315c4c304
SHA1 3aef8dba8042662a7fcf97e51047dc636b4d4724
SHA512 4e0d443cf81e2f49829b0a458a08294bf1bdc0e38d3a938fb8274eeb637d9a688b14c7999dd6b86a31fcec839a9e8c1a9611ed0bbae8bd59caa9dba1e8253693
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 726d2b3a5003e478f61d3626a078477d2ce3caa24520bafefc1750edd68ef617
MD5 91bbf1113ed5ee5b5ca394415a183a07
SHA1 c3db7fead075105a6bc6ed8de9b206fd61c69aaf
SHA512 547e90736c71c0990eed9f24e071f4acbcb2d2fa99e0a13f70cb5d564c7ed084e78e631c8795e46778926118da82aec153bb6ab32439cb009a27153e5aeda1e4
TLSH
T16B218627B39C89A1CC86163A109D9C1076B393C7809ECFDF6BC4C600A0BF988CB21290
MD5 SHA1 SHA512 TLSH

Submit Download

metadata-2

Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
Size 24.1MB
SHA256 e7ec9ca475c5d1da551c434b0b3761ba90883cc035df4a57249b90158e1850f4
MD5 8f83b838d72c725e172b840343a2da12
SHA1 bfd68cda00f9accb9d5e88f309c18c1b6bfa52e9
SHA512 6777289faf42904d9d03624628db68b9fa8ae2538d01afcff605fe0f77e1cf2aa07562fa09574976efe822ee7a85a317e5f6665ad4d55b7f17429ba5d6286e38
SSDEEP 24576:Ru8m+1z1doO/vvTL7WXOCWKDmeETPFXC7h2dVYGlfEaGuQuKIvFOPRcxC:f
TLSH
T14C47912837F92240E7B79E3D6CF06A234D3A7D5B9C159A8D45411B4E0A21FB0E872F5B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{bb2e9a0b-c724-4873-b134-91e662cbbf6d}_OnDiskSnapshotProp

Path \??\Volume{ae01ce4e-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{bb2e9a0b-c724-4873-b134-91e662cbbf6d}_OnDiskSnapshotProp
Size 6KB
SHA256 ccc11eed0f0d5d313b9c2d555edc64f50d43cc962a83a43bc92b747b0429b2d0
MD5 026982b7d955391fab2a6f52752e99ff
SHA1 12c1301d4630d55f0f34949d230506c32a2aaad4
SHA512 083de9bc76d3b5d560ceeebadb65e5bf4d584a4bd1b8bdd706bfaba85f9fa9d77a6daccf336e31d8a5399034bc860240f70eed630c0f4abf84e872b0c25f875e
SSDEEP 96:Fd+nBpPAvc8DD84LTHzbOHXOHBlBRQ88Sc9XE56tOSVQpuN:zlb++ZVmN
TLSH
T13CD189085AF54711E2B3AB7129F58557A877B911EF33CB8E0198238E2670A10F935F5F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2616-235-0x0000018AC68B0000-0x0000018AC68D2000-memory.dmp

Download

memory/3332-481-0x00000189E30E0000-0x00000189E30FC000-memory.dmp

Download

memory/3332-486-0x00000189E3100000-0x00000189E31B5000-memory.dmp

Download

memory/3332-487-0x00000189E2ED0000-0x00000189E2EDA000-memory.dmp

Download

memory/3332-488-0x00000189E3330000-0x00000189E335A000-memory.dmp

Download

memory/3332-489-0x00000189E3330000-0x00000189E3354000-memory.dmp

Download