6a02721f5227dc764b66cc48dd46e75385d2bb10b0e0aadeb8f82fea54ddaab7

Analysis

max time kernel
150s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
03/02/2026, 02:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
action1_agent(My_Organization).msi
Size 6.4MB
Sample260203-dcdx2agy5c
SHA256 6a02721f5227dc764b66cc48dd46e75385d2bb10b0e0aadeb8f82fea54ddaab7
MD5 71ef09a49e261a2b513baee7eedecd30
SHA1 edcda622671c521295846f604f9cba0063d14df2
SHA512 1892b24140107b7679821917a6bb6c035cfcb22aebcc04bde183a9cb0735c410d98d489faa65f3b0c529f60456d411bd717ca9df2a990d4449ceb69adbcb6006
SSDEEP 98304:n+UJgsMOyVEUMo7Pcwq0kiOBOLT5lNUxh5Hup4SLQPLpGKWT4UX2Zo9HPD+PEJ8L:+4gtOyfPJe4LxUxCAFvtsHPr8y
TLSH
T17D662312BA838135D99A2E30343D86B5963EFF349F34B5DFEB84351D5E302D06A71A92
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery execution persistence privilege_escalation ransomware

Malware Config

Signatures

Badlisted process makes network request 3 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
2	4624	msiexec.exe
3	4624	msiexec.exe
4	4624	msiexec.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe

Drops file in System32 directory 14 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft	action1_agent.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData	action1_agent.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_93702E680A5530C052C8D2BA33A2225F	action1_agent.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3AA0DCD5A74331FBD6F344550EC48B87_FAB5A9F6C6BE3394975FF948CA40CA87	action1_agent.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3AA0DCD5A74331FBD6F344550EC48B87_FAB5A9F6C6BE3394975FF948CA40CA87	action1_agent.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache	action1_agent.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content	action1_agent.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B2FAF7692FD9FFBD64EDE317E42334BA_93702E680A5530C052C8D2BA33A2225F	action1_agent.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\18E6B4A57A6BC7EC9B861CDF2D6D0D02_EF52C1EC85F21F31CC0157A5C8803013	action1_agent.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\18E6B4A57A6BC7EC9B861CDF2D6D0D02_EF52C1EC85F21F31CC0157A5C8803013	action1_agent.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\~DF8A0052A0FE3BEF3F.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DF409BB884AEBBB8F6.TMP	msiexec.exe
File opened for modification	C:\Windows\Action1\package_downloads\CLOUD_ee058a70-869e-11ef-9fc1-4b2f0f8dddf2_1728520262807_builtin.json	action1_agent.exe
File opened for modification	C:\Windows\Action1\package_downloads\CLOUD_2ba943b0-85b6-11ef-b9af-69a8758f6819_1728420293483_builtin_files\windowsdesktop-runtime-6.0.35.34113-win-64bit.exe	action1_agent.exe
File created	C:\Windows\Action1\package_downloads\CLOUD_41c128e0-463e-11f0-b241-d13f758cf27c_1749589365358_builtin.result	action1_agent.exe
File created	C:\Windows\Action1\package_downloads\CLOUD_41c128e0-463e-11f0-b241-d13f758cf27c_1749589365358_builtin.resume	action1_agent.exe
File opened for modification	C:\Windows\Installer\MSIE53D.tmp	msiexec.exe
File opened for modification	C:\Windows\Action1\action1_remote.exe	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\60C3F5011D783684193BDEE42A790A4B\5.221.623\action1_remote_exe	msiexec.exe
File created	C:\Windows\SystemTemp\~DF0B4FF9E30CBDD36E.TMP	msiexec.exe
File opened for modification	C:\Windows\Action1\package_downloads\CLOUD_96c0f5b0-8f71-11f0-b5ed-f5f090bb88ca_1757637847179_builtin.json	action1_agent.exe
File created	C:\Windows\Action1\first_install.tmp	action1_agent.exe
File created	C:\Windows\Action1\action1_agent.msi	action1_agent.exe
File created	C:\Windows\SystemTemp\~DF188F5C366FBDE88B.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DFAA9C11907362FBCD.TMP	msiexec.exe
File opened for modification	C:\Windows\Action1\package_downloads\CLOUD_c0429270-7d1c-11f0-97f3-3b8172a68845_1755622288664_builtin_files\Firefox_Setup_en-US_142.0_64bit.exe	action1_agent.exe
File created	C:\Windows\Action1\action1_agent.exe	msiexec.exe
File created	C:\Windows\Installer\e58e31c.msi	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\60C3F5011D783684193BDEE42A790A4B\5.221.623\a1_7z_dll_file	msiexec.exe
File created	C:\Windows\SystemTemp\~DF5C6AF0A992D78AB6.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DF86D8666D68312CB8.TMP	msiexec.exe
File created	C:\Windows\Action1\package_downloads\CLOUD_ee058a70-869e-11ef-9fc1-4b2f0f8dddf2_1728520262807_builtin.metadata.tmp	action1_agent.exe
File created	C:\Windows\Action1\action1_agent.exe.update_state	action1_agent.exe
File opened for modification	C:\Windows\Action1\action1_agent.exe.update_state	action1_agent.exe
File created	C:\Windows\Action1\package_downloads\CLOUD_ee058a70-869e-11ef-9fc1-4b2f0f8dddf2_1728520262807_builtin.json	action1_agent.exe
File created	C:\Windows\Action1\package_downloads\CLOUD_41c128e0-463e-11f0-b241-d13f758cf27c_1749589365358_builtin.json	action1_agent.exe
File created	C:\Windows\Action1\package_downloads\CLOUD_c0429270-7d1c-11f0-97f3-3b8172a68845_1755622288664_builtin.metadata.tmp	action1_agent.exe
File created	C:\Windows\Installer\SourceHash{FEC165DE-8935-4ED1-812C-DA96EC177411}	msiexec.exe
File created	C:\Windows\SystemTemp\~DF0087D9D1D97BCA23.TMP	msiexec.exe
File created	C:\Windows\Action1\package_downloads\CLOUD_31939e80-463e-11f0-b241-d13f758cf27c_1749589338216_builtin.json	action1_agent.exe
File opened for modification	C:\Windows\Installer\e58e31c.msi	msiexec.exe
File created	C:\Windows\SystemTemp\~DF84581F1A2AFD809D.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DF1C6CFE6FD9AA1782.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\{FEC165DE-8935-4ED1-812C-DA96EC177411}\ProductIcon	msiexec.exe
File created	C:\Windows\Action1\package_downloads\CLOUD_394fae00-85b6-11ef-b9af-69a8758f6819_1728420316384_builtin.metadata.tmp	action1_agent.exe
File created	C:\Windows\Action1\agent_cdm_not_downloading.threshold.tmp	action1_agent.exe
File created	C:\Windows\Action1\package_downloads\CLOUD_c0429270-7d1c-11f0-97f3-3b8172a68845_1755622288664_builtin.result	action1_agent.exe
File created	C:\Windows\Action1\package_downloads\CLOUD_31939e80-463e-11f0-b241-d13f758cf27c_1749589338216_builtin.metadata.tmp	action1_agent.exe
File opened for modification	C:\Windows\Action1\package_downloads\CLOUD_e469fa00-869e-11ef-9fc1-4b2f0f8dddf2_1728520246688_builtin.json	action1_agent.exe
File opened for modification	C:\Windows\Action1\package_downloads\CLOUD_394fae00-85b6-11ef-b9af-69a8758f6819_1728420316384_builtin.json	action1_agent.exe
File created	C:\Windows\Action1\package_downloads\CLOUD_1ddf59c0-619a-11f0-89de-331c57130e1b_1752597500253_builtin.resume	action1_agent.exe
File created	C:\Windows\Action1\package_downloads\CLOUD_394fae00-85b6-11ef-b9af-69a8758f6819_1728420316384_builtin.resume	action1_agent.exe
File created	C:\Windows\Action1\package_downloads\CLOUD_60249f20-8e86-11f0-af3f-ad4ea2a97fec_1757536823883_builtin.json	action1_agent.exe
File created	C:\Windows\Action1\datasource_data\1008.poll.tmp	action1_agent.exe
File created	C:\Windows\Action1\package_downloads\CLOUD_c0429270-7d1c-11f0-97f3-3b8172a68845_1755622288664_builtin.resume	action1_agent.exe
File opened for modification	C:\Windows\Action1\package_downloads\CLOUD_c0429270-7d1c-11f0-97f3-3b8172a68845_1755622288664_builtin.resume	action1_agent.exe
File opened for modification	C:\Windows\Installer\e58e318.msi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{105F3C06-87D1-4863-91B3-ED4EA297A0B4}	msiexec.exe
File created	C:\Windows\Installer\wix{105F3C06-87D1-4863-91B3-ED4EA297A0B4}.SchedServiceConfig.rmi	MsiExec.exe
File created	C:\Windows\SystemTemp\~DF59C047FDDF83E77E.TMP	msiexec.exe
File created	C:\Windows\Action1\agent_downgrade.version_pair.tmp	action1_agent.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\60C3F5011D783684193BDEE42A790A4B\5.221.623\action1_remote_exe	msiexec.exe
File opened for modification	C:\Windows\Action1\package_downloads\CLOUD_ee058a70-869e-11ef-9fc1-4b2f0f8dddf2_1728520262807_builtin_files\VC_redist_14.40.33816.0_32bit.exe	action1_agent.exe
File created	C:\Windows\Action1\sas.dll	msiexec.exe
File opened for modification	C:\Windows\Action1\logs\action1_log_2026-02-03_02-52-13~1576.log	action1_agent.exe
File opened for modification	C:\Windows\Installer\MSIA7D.tmp	msiexec.exe
File created	C:\Windows\Action1\package_downloads\CLOUD_96c0f5b0-8f71-11f0-b5ed-f5f090bb88ca_1757637847179_builtin.json	action1_agent.exe
File opened for modification	C:\Windows\Installer\MSIACC.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DFDCA6EB0803246146.TMP	msiexec.exe
File created	C:\Windows\Action1\schedule.json	action1_agent.exe
File opened for modification	C:\Windows\Action1\package_downloads\CLOUD_41c128e0-463e-11f0-b241-d13f758cf27c_1749589365358_builtin_files\windowsdesktop-runtime-8.0.17.34917-win-32bit.exe	action1_agent.exe
File created	C:\Windows\SystemTemp\~DFB4A3593455468C9E.TMP	msiexec.exe
File created	C:\Windows\Action1\advanced_settings.json.tmp	action1_agent.exe
File created	C:\Windows\Action1\package_downloads\CLOUD_394fae00-85b6-11ef-b9af-69a8758f6819_1728420316384_builtin.json	action1_agent.exe

Executes dropped EXE 3 IoCs

pid	Process
1576	action1_agent.exe
4864	action1_agent.exe
2796	action1_agent.exe

Loads dropped DLL 8 IoCs

pid	Process
4216	MsiExec.exe
4216	MsiExec.exe
4216	MsiExec.exe
5020	MsiExec.exe
5332	MsiExec.exe
5332	MsiExec.exe
5332	MsiExec.exe
5332	MsiExec.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
3876	powershell.exe
2036	powershell.exe
4252	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs

persistence privilege_escalation

Installer Packages

T1546.016

Msiexec

T1218.007

pid	Process
4624	msiexec.exe

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	action1_agent.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	action1_agent.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	action1_agent.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000adcdd9a6d08c0ad30000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000adcdd9a60000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed35000000ffffffff000000000700010000680900adcdd9a6000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff350000000000000005000000ffffffff000000000700010000f8ff1aadcdd9a6000000000000f0ff350000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1dadcdd9a6000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\RegFiles0000 = 43003a005c00570069006e0064006f00770073005c0041006300740069006f006e0031005c0061006300740069006f006e0031005f006100670065006e0074002e0065007800650000000000	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CProgram Files%5CWindowsApps%5CMicrosoft.StorePurchaseApp_12008.1001.1.0_x64__8wekyb3d8bbwe%5Cresources.pri\1d75a17848c79fa\a37dfe62\@{C:\Program Files\WindowsApps\Microsoft.StorePurchase = "Store Experience Host"	action1_agent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CProgram Files%5CWindowsApps%5CMicrosoft.WebpImageExtension_1.0.32731.0_x64__8wekyb3d8bbwe%5Cresources.pri\1d75a18313e55a9\a37dfe62	action1_agent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CProgram Files%5CWindowsApps%5CMicrosoft.People_10.1909.12456.0_x64__8wekyb3d8bbwe%5Cresources.pri	action1_agent.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CProgram Files%5CWindowsApps%5CMicrosoft.People_10.1909.12456.0_x64__8wekyb3d8bbwe%5Cresources.pri\1d75a1791c10cf4\a37dfe62\@{C:\Program Files\WindowsApps\Microsoft.People_10.1909.12456.0 = "Microsoft People"	action1_agent.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	action1_agent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0001	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CProgram Files%5CWindowsApps%5CMicrosoft.Todos_0.33.33351.0_x64__8wekyb3d8bbwe%5Cresources.pri\1d75a17dbf974bf\a37dfe62\@{C:\Program Files\WindowsApps\Microsoft.Todos_0.33.33351.0_x64__8w = "Microsoft To Do"	action1_agent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	action1_agent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	action1_agent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CProgram Files%5CWindowsApps%5CMicrosoft.WindowsSoundRecorder_1.0.38.0_x64__8wekyb3d8bbwe%5Cresources.pri\1d75a17ca0f450e	action1_agent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CProgram Files%5CWindowsApps%5CMicrosoft.ZuneMusic_10.21012.10511.0_x64__8wekyb3d8bbwe%5Cresources.pri	action1_agent.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CProgram Files%5CWindowsApps%5CMicrosoft.ZuneVideo_10.21012.10511.0_x64__8wekyb3d8bbwe%5Cresources.pri\1d75a17a8b4a028\fae8ab0e\@{Microsoft.ZuneVideo_10.21012.10511.0_x64__8wekyb3d8bbwe?m = "Movies & TV"	action1_agent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2d\52C64B7E\@%SystemRoot%\System32\fveui.dll,-844 = "BitLocker Data Recovery Agent"	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CProgram Files%5CWindowsApps%5CMicrosoft.Edge.GameAssist_1.0.3456.0_x64__8wekyb3d8bbwe%5Cresources.pri\1dc91b3a7de0150\fae8ab0e\@{Microsoft.Edge.GameAssist_1.0.3456.0_x64__8wekyb3d8bbwe?m = "Microsoft Edge Game Assist"	action1_agent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	action1_agent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	action1_agent.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\SessionHash = 234881da22c3e2141b499f07ea5ee6f9b2c4c785ee3ba1866df8e9b969283362	msiexec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CProgram Files%5CWindowsApps%5CMicrosoft.HEIFImageExtension_1.0.40978.0_x64__8wekyb3d8bbwe%5Cresources.pri\1d75a18288dc08d\a37dfe62\@{C:\Program Files\WindowsApps\Microsoft.HEIFImageExten = "HEIF Image Extensions"	action1_agent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CProgram Files%5CWindowsApps%5CMicrosoft.VP9VideoExtensions_1.0.41182.0_x64__8wekyb3d8bbwe%5Cresources.pri\1d75a182d03da30	action1_agent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CProgram Files%5CWindowsApps%5CMicrosoft.DesktopAppInstaller_1.0.42251.0_x64__8wekyb3d8bbwe%5Cresources.pri\1d75a181a9a5ac3\a37dfe62	action1_agent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	action1_agent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	action1_agent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CProgram Files%5CWindowsApps%5CMicrosoft.MicrosoftStickyNotes_4.0.2.0_x64__8wekyb3d8bbwe%5Cresources.pri\1d75a17d7a60c10\a37dfe62	action1_agent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CProgram Files%5CWindowsApps%5CMicrosoft.ZuneVideo_10.21012.10511.0_x64__8wekyb3d8bbwe%5Cresources.pri\1d75a17a8b4a028\fae8ab0e	action1_agent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	action1_agent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2d	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CProgram Files%5CWindowsApps%5CMicrosoft.People_10.1909.12456.0_x64__8wekyb3d8bbwe%5Cresources.pri\1d75a1791c10cf4\a37dfe62	action1_agent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CProgram Files%5CWindowsApps%5CMicrosoft.WindowsMaps_1.0.22.0_x64__8wekyb3d8bbwe%5Cresources.pri	action1_agent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CProgram Files%5CWindowsApps%5CMicrosoft.XboxIdentityProvider_12.50.6001.0_x64__8wekyb3d8bbwe%5Cresources.pri\1d75a17f912dbb4\fae8ab0e	action1_agent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	action1_agent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	action1_agent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CProgram Files%5CWindowsApps%5CMicrosoft.WebpImageExtension_1.0.32731.0_x64__8wekyb3d8bbwe%5Cresources.pri	action1_agent.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CProgram Files%5CWindowsApps%5CMicrosoft.WindowsFeedbackHub_1.2103.1172.0_x64__8wekyb3d8bbwe%5Cresources.pri\1d75a17bffb668e\a37dfe62\@{C:\Program Files\WindowsApps\Microsoft.WindowsFeedb = "Feedback Hub"	action1_agent.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CProgram Files%5CWindowsApps%5CMicrosoft.XboxIdentityProvider_12.50.6001.0_x64__8wekyb3d8bbwe%5Cresources.pri\1d75a17f912dbb4\fae8ab0e\@{Microsoft.XboxIdentityProvider_12.50.6001.0_x64__8 = "Xbox Identity Provider"	action1_agent.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2c\52C64B7E\@%SystemRoot%\System32\ci.dll,-100 = "Isolated User Mode (IUM)"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CProgram Files%5CWindowsApps%5CMicrosoft.HEIFImageExtension_1.0.40978.0_x64__8wekyb3d8bbwe%5Cresources.pri\1d75a18288dc08d	action1_agent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CProgram Files%5CWindowsApps%5CMicrosoft.MicrosoftStickyNotes_4.0.2.0_x64__8wekyb3d8bbwe%5Cresources.pri\1d75a17d7a60c10	action1_agent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	action1_agent.exe

Modifies registry class 46 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\ED561CEF53981DE418C2AD69CE714711\SourceList\LastUsedSource = "n;1;C:\\Windows\\Action1\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\60C3F5011D783684193BDEE42A790A4B\ProductName = "Action1 Agent"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\60C3F5011D783684193BDEE42A790A4B\InstanceType = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\60C3F5011D783684193BDEE42A790A4B\SourceList	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\60C3F5011D783684193BDEE42A790A4B\Clients = 3a0000000000	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\ED561CEF53981DE418C2AD69CE714711	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\ED561CEF53981DE418C2AD69CE714711\Version = "100336270"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\ED561CEF53981DE418C2AD69CE714711\InstanceType = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\3187685C39AD9D04484F43F57B7D8C2B\ED561CEF53981DE418C2AD69CE714711	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\60C3F5011D783684193BDEE42A790A4B\Version = "98370159"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\3187685C39AD9D04484F43F57B7D8C2B	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\60C3F5011D783684193BDEE42A790A4B\SourceList\PackageName = "action1_agent(My_Organization).msi"	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\60C3F5011D783684193BDEE42A790A4B	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\ED561CEF53981DE418C2AD69CE714711	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\ED561CEF53981DE418C2AD69CE714711\SourceList\Net	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\60C3F5011D783684193BDEE42A790A4B\AdvertiseFlags = "388"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\3187685C39AD9D04484F43F57B7D8C2B\60C3F5011D783684193BDEE42A790A4B	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\60C3F5011D783684193BDEE42A790A4B\SourceList\Net	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\60C3F5011D783684193BDEE42A790A4B	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\ED561CEF53981DE418C2AD69CE714711\ProductName = "Action1 Agent"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\ED561CEF53981DE418C2AD69CE714711\PackageCode = "6995E120F132981499FCADE6FAD82951"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\ED561CEF53981DE418C2AD69CE714711\Language = "1033"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\ED561CEF53981DE418C2AD69CE714711\Assignment = "1"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\60C3F5011D783684193BDEE42A790A4B	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\60C3F5011D783684193BDEE42A790A4B\Language = "1033"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\60C3F5011D783684193BDEE42A790A4B\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\60C3F5011D783684193BDEE42A790A4B\SourceList\Net	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\ED561CEF53981DE418C2AD69CE714711\AdvertiseFlags = "388"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\ED561CEF53981DE418C2AD69CE714711\ProductIcon = "C:\\Windows\\Installer\\{FEC165DE-8935-4ED1-812C-DA96EC177411}\\ProductIcon"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\ED561CEF53981DE418C2AD69CE714711\DeploymentFlags = "3"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\ED561CEF53981DE418C2AD69CE714711\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\60C3F5011D783684193BDEE42A790A4B\ProductIcon = "C:\\Windows\\Installer\\{105F3C06-87D1-4863-91B3-ED4EA297A0B4}\\ProductIcon"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\60C3F5011D783684193BDEE42A790A4B\AuthorizedLUAApp = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\60C3F5011D783684193BDEE42A790A4B\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\3187685C39AD9D04484F43F57B7D8C2B	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\60C3F5011D783684193BDEE42A790A4B	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\60C3F5011D783684193BDEE42A790A4B\PackageCode = "A0A56C4428760504C8AACD4624099BF6"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\60C3F5011D783684193BDEE42A790A4B\Assignment = "1"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\60C3F5011D783684193BDEE42A790A4B\DeploymentFlags = "3"	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\60C3F5011D783684193BDEE42A790A4B\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\ED561CEF53981DE418C2AD69CE714711\SourceList\PackageName = "action1_agent.msi"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\ED561CEF53981DE418C2AD69CE714711\SourceList\Net\1 = "C:\\Windows\\Action1\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\60C3F5011D783684193BDEE42A790A4B\A1_Agent	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\ED561CEF53981DE418C2AD69CE714711\A1_Agent	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\ED561CEF53981DE418C2AD69CE714711\AuthorizedLUAApp = "0"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\ED561CEF53981DE418C2AD69CE714711\Clients = 3a0000000000	msiexec.exe

Suspicious behavior: EnumeratesProcesses 22 IoCs

pid	Process
1140	msiexec.exe
1140	msiexec.exe
1140	msiexec.exe
1140	msiexec.exe
1140	msiexec.exe
1140	msiexec.exe
1140	msiexec.exe
1140	msiexec.exe
1140	msiexec.exe
1140	msiexec.exe
1140	msiexec.exe
1140	msiexec.exe
1140	msiexec.exe
1140	msiexec.exe
3876	powershell.exe
3876	powershell.exe
2036	powershell.exe
2036	powershell.exe
4252	powershell.exe
4252	powershell.exe
4864	action1_agent.exe
4864	action1_agent.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4624	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4624	msiexec.exe
Token: SeSecurityPrivilege	1140	msiexec.exe
Token: SeCreateTokenPrivilege	4624	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	4624	msiexec.exe
Token: SeLockMemoryPrivilege	4624	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4624	msiexec.exe
Token: SeMachineAccountPrivilege	4624	msiexec.exe
Token: SeTcbPrivilege	4624	msiexec.exe
Token: SeSecurityPrivilege	4624	msiexec.exe
Token: SeTakeOwnershipPrivilege	4624	msiexec.exe
Token: SeLoadDriverPrivilege	4624	msiexec.exe
Token: SeSystemProfilePrivilege	4624	msiexec.exe
Token: SeSystemtimePrivilege	4624	msiexec.exe
Token: SeProfSingleProcessPrivilege	4624	msiexec.exe
Token: SeIncBasePriorityPrivilege	4624	msiexec.exe
Token: SeCreatePagefilePrivilege	4624	msiexec.exe
Token: SeCreatePermanentPrivilege	4624	msiexec.exe
Token: SeBackupPrivilege	4624	msiexec.exe
Token: SeRestorePrivilege	4624	msiexec.exe
Token: SeShutdownPrivilege	4624	msiexec.exe
Token: SeDebugPrivilege	4624	msiexec.exe
Token: SeAuditPrivilege	4624	msiexec.exe
Token: SeSystemEnvironmentPrivilege	4624	msiexec.exe
Token: SeChangeNotifyPrivilege	4624	msiexec.exe
Token: SeRemoteShutdownPrivilege	4624	msiexec.exe
Token: SeUndockPrivilege	4624	msiexec.exe
Token: SeSyncAgentPrivilege	4624	msiexec.exe
Token: SeEnableDelegationPrivilege	4624	msiexec.exe
Token: SeManageVolumePrivilege	4624	msiexec.exe
Token: SeImpersonatePrivilege	4624	msiexec.exe
Token: SeCreateGlobalPrivilege	4624	msiexec.exe
Token: SeBackupPrivilege	4880	vssvc.exe
Token: SeRestorePrivilege	4880	vssvc.exe
Token: SeAuditPrivilege	4880	vssvc.exe
Token: SeBackupPrivilege	1140	msiexec.exe
Token: SeRestorePrivilege	1140	msiexec.exe
Token: SeRestorePrivilege	1140	msiexec.exe
Token: SeTakeOwnershipPrivilege	1140	msiexec.exe
Token: SeRestorePrivilege	1140	msiexec.exe
Token: SeTakeOwnershipPrivilege	1140	msiexec.exe
Token: SeRestorePrivilege	1140	msiexec.exe
Token: SeTakeOwnershipPrivilege	1140	msiexec.exe
Token: SeRestorePrivilege	1140	msiexec.exe
Token: SeTakeOwnershipPrivilege	1140	msiexec.exe
Token: SeRestorePrivilege	1140	msiexec.exe
Token: SeTakeOwnershipPrivilege	1140	msiexec.exe
Token: SeRestorePrivilege	1140	msiexec.exe
Token: SeTakeOwnershipPrivilege	1140	msiexec.exe
Token: SeShutdownPrivilege	5020	MsiExec.exe
Token: SeRestorePrivilege	1140	msiexec.exe
Token: SeTakeOwnershipPrivilege	1140	msiexec.exe
Token: SeRestorePrivilege	1140	msiexec.exe
Token: SeTakeOwnershipPrivilege	1140	msiexec.exe
Token: SeBackupPrivilege	1576	action1_agent.exe
Token: SeSecurityPrivilege	1576	action1_agent.exe
Token: SeBackupPrivilege	1576	action1_agent.exe
Token: SeSecurityPrivilege	1576	action1_agent.exe
Token: SeRestorePrivilege	1140	msiexec.exe
Token: SeTakeOwnershipPrivilege	1140	msiexec.exe
Token: SeRestorePrivilege	1140	msiexec.exe
Token: SeTakeOwnershipPrivilege	1140	msiexec.exe
Token: SeRestorePrivilege	1140	msiexec.exe
Token: SeTakeOwnershipPrivilege	1140	msiexec.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
4624	msiexec.exe
4624	msiexec.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1140 wrote to memory of 788	1140	msiexec.exe	84
PID 1140 wrote to memory of 4216	1140	msiexec.exe	86
PID 1140 wrote to memory of 5020	1140	msiexec.exe	87
PID 1576 wrote to memory of 3204	1576	action1_agent.exe	90
PID 1140 wrote to memory of 5332	1140	msiexec.exe	91
PID 4864 wrote to memory of 3876	4864	action1_agent.exe	93
PID 4864 wrote to memory of 2036	4864	action1_agent.exe	95
PID 2036 wrote to memory of 2796	2036	powershell.exe	100
PID 4864 wrote to memory of 4252	4864	action1_agent.exe	101

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\action1_agent(My_Organization).msi
1⤵
- Badlisted process makes network request
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4624

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1140
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:788
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 769451861921DE9FDE293A6DDF483DEA
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:4216
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding FC0FEF04F31FAC2E3C19DB79804A32E7 E Global\MSI0000
  2⤵
  - Drops file in Windows directory
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:5020
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 84CBE8A879A3C85BD7A5FA58839D2312 E Global\MSI0000
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:5332

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:4880

C:\Windows\Action1\action1_agent.exe
C:\Windows\Action1\action1_agent.exe service
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1576
- C:\Windows\SysWOW64\msiexec.exe
  C:\Windows\system32\msiexec.exe /I "C:\Windows\Action1\action1_agent.msi" /quiet /qn /norestart /lv* "C:\Windows\Action1\logs\agent_install_1770087141.log" ALLOWRESTRICTEDVERSIONS=1
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3204

C:\Windows\Action1\action1_agent.exe
C:\Windows\Action1\action1_agent.exe service
1⤵
- Drops file in Windows directory
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4864
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -Command "$ExecutionContext.SessionState.LanguageMode"
  2⤵
  - Drops file in System32 directory
  - Command and Scripting Interpreter: PowerShell
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:3876
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -Command -
  2⤵
  - Drops file in System32 directory
  - Command and Scripting Interpreter: PowerShell
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2036
- - C:\Windows\Action1\action1_agent.exe
    "C:\Windows\Action1\action1_agent.exe" loggedonuser
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2796
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -Command -
  2⤵
  - Drops file in System32 directory
  - Command and Scripting Interpreter: PowerShell
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:4252

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Event Triggered Execution

T1546

Installer Packages

T1546.016

Privilege Escalation

Event Triggered Execution

T1546

Installer Packages

T1546.016

Defense Evasion

System Binary Proxy Execution

T1218

Msiexec

T1218.007

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e58e319.rbs

Path C:\Config.Msi\e58e319.rbs
Size 240KB
SHA256 e8985eac56a93190a04b986e854ae2ef5269673882a7595f7f473237b8f72bc1
MD5 47dcb9ae8fdb2ee2b3b1ba118f588442
SHA1 24626351d71fbe372930181a9dcc88ac3a991000
SHA512 d0ace79581ef5d1e7cde065a60c5468f79e3a487ba444e1abfb4ac295f1b3ef6e99132877caa70ba8f6c9e2f019c04bf7c3b14c741321f0d9d943eddc16c43b7
SSDEEP 3072:HVuzXiqyhTO8W0iEa8LW0bEC9hvZpC01v+eUKflQnZl+T+J7g6EsNr7wyy/IP3B:HVgqhy8VKU3hvZUy+ppHEsuB/S
TLSH
T188349E217494547EEBFF0832953AD671AE3DF2380B90C56EC384581E6D618C1ABB7B27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e58e31a.rbs

Path C:\Config.Msi\e58e31a.rbs
Size 7KB
SHA256 3c846a50a6425c8e381ca255c9d8a37ba905a577895e8c4e57b954ec96932d03
MD5 e1887ab05b894d6751b7943428387919
SHA1 cccf3cf669c508d8f9c007c423516363abcf4031
SHA512 619b21827f82929b983e16c2df6b1cd206212b115d7dd3be29d143c27773f5cae027ba046700eb076550f5ce923af404a383cb9e85590f813d2dc20f72443865
SSDEEP 192:c+ey5US+JIE+Jtb1d8dhJS8v6E9zkCpO35ClbNA:cM+R+5h
TLSH
T1A1E1304177048AE6E99A0B3ACB070BA23BB6D3D98300234B0CCDA4606F5339D5FA51DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e58e31f.rbs

Path C:\Config.Msi\e58e31f.rbs
Size 246KB
SHA256 3ca8e6b24696962e46f13de725faa51d64a28ddbff6b3d48b2398dc28b4ba06e
MD5 425bf25076a5b8c25a47f80ea4a0926b
SHA1 bee68957ab2d321b34926eaf3957a64cc299cf71
SHA512 cd6828a107f41ba63e4f2581feec18b3ec1097593be735465cbc4efe87e333366555a550df2eb9355a0d66fbca40e90f914c3dc6b5306bf227fc52bebb0a886a
SSDEEP 3072:6EpuDuxXiqyhTO8W0iEa8LW0bEC9hvZpC01v+eUKflQnZl+T+J7g6EsNr7wyy/IJ:6EpGqqhy8VKU3hvZUy+ppHEsuB/S
TLSH
T156349E217494547EEBFF0932953ADA71AE3DF2380B50C56EC384881E5D618C1ABB7B27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e58e325.rbs

Path C:\Config.Msi\e58e325.rbs
Size 8KB
SHA256 dc68d28b6f1c98c03c8229d51942962ba0293caa4ebb4fac35beeefe54a765c8
MD5 e5e06ef8915c3bbe89da48b1c0c84248
SHA1 a56eef8bcafae309c085f900587cf9c24cabf7ca
SHA512 b99ad3c188b7076ea188b026cc06558d64c26e28b23067e19dde2bf03f7793fc2fa011c329e2b5183a55673f560055fe2d82a10f3ea022b58660ef4c4d6a54a7
SSDEEP 192:SkFERdRLRGRyDv140JnWcAOfDb4YrHwiOqTdhZ7VAVM3dA:SzRdJRGSHx3A
TLSH
T1EF025342371843F6ED964B37CA030BB26FF7D6D58305828B249CB4645F623992FA51AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e58e329.rbf

Path C:\Config.Msi\e58e329.rbf
Size 3B
SHA256 13bf7b3039c63bf5a50491fa3cfd8eb4e699d1ba1436315aef9cbe5711530354
MD5 21438ef4b9ad4fc266b6129a2f60de29
SHA1 5eb8e2242eeb4f5432beeec8b873f1ab0a6b71fd
SHA512 37436ced85e5cd638973e716d6713257d692f9dd2e1975d5511ae3856a7b3b9f0d9e497315a058b516ab31d652ea9950938c77c1ad435ea8d4b49d73427d1237
MD5 SHA1 SHA512

Submit Download

e58e32a.rbs

Path C:\Config.Msi\e58e32a.rbs
Size 1KB
SHA256 94c094870424150ab3db6eb0686fb3693dabae028e61eb57a7b9b1e8f6d2372e
MD5 13f3529d4a87e0550e48f2fcefc8ce9b
SHA1 ba148fa1577b5c6f6cf13f0c9593a3d94537dda6
SHA512 0c5800610d7b9f13dfaed197471dd5ed9f49df4b21d699c92bc2fcc4fe258aad6a0a64fd7f76d524ff1d14e87c9ef6223aa997647037605f4a1b7e676c114857
TLSH
T14E21B182F70857C2EC965B35CA0317927BBBD2E6860943831C8E36142E6135C5FB50DE
MD5 SHA1 SHA512 TLSH

Submit Download

e58e32b.rbs

Path C:\Config.Msi\e58e32b.rbs
Size 7KB
SHA256 feb5b9eefa720de8b4e920e22a31eee8fb3c7a94c9c1170ceb9d77409bc832c2
MD5 d1e8a0582b500248b57835028e20c0cc
SHA1 7ec67b48ca8cdcd6a617b74b6730baafb2817175
SHA512 039c028aca2254b04a9896f386ea86b3c2f0ec27c0a36cbf551cd22c9adde710a829f73e33f867db4e183228ab8fac948484c88fb234f63d7b8b0448354489ce
SSDEEP 192:SSeBzUzaTdmwIkdmwC2szTe/u/SkGL5kqKppu05serOS:SjIUdmQdmh2suWakGL5kZu05serOS
TLSH
T1F6E10C81B62181E2E8961F38D607176537B6D7DA5310736B08CDE0A0DF6378D4F8A68E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

18E6B4A57A6BC7EC9B861CDF2D6D0D02_EF52C1EC85F21F31CC0157A5C8803013

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\18E6B4A57A6BC7EC9B861CDF2D6D0D02_EF52C1EC85F21F31CC0157A5C8803013
Size 765B
SHA256 c51adb0cdaf5ef53cbc3484c4c1fd5857075b86ae3b261768efce56540d26579
MD5 5bda9d793dcd200915b950a1ec2c56b0
SHA1 e1204344aaf13c701aeb492f77d8d7929c0de0a3
SHA512 a9ac9cacaa2656726a08236a905354b2aa1639d8b12920a269a55e69ba0685d76e45210954587fc493e7720c2262a62b23ea341de1a68c335c499f74cf76e2ba
TLSH
T1E801251E4D3A6A05FF8F06A199D9CD7BB405B33636A50A0F651D80001834FAE5F1041C
MD5 SHA1 SHA512 TLSH

Submit Download

3AA0DCD5A74331FBD6F344550EC48B87_FAB5A9F6C6BE3394975FF948CA40CA87

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3AA0DCD5A74331FBD6F344550EC48B87_FAB5A9F6C6BE3394975FF948CA40CA87
Size 637B
SHA256 c0f692caf7908214134245789052573329ce2a1b45ff0a872e4712156cb1d0ec
MD5 02632823fb3d6fa0a8e6ab904b9ffd44
SHA1 fca561c4f7489c460479e5ea43a61ae7c6b3323e
SHA512 f220f0abc81ea21322cac280fa7d106848a5bb016edd181774b8f244e54cf539ee554ee9bdb0602a392a34a01869e4dc264827b93525d45777dad74e7e997a67
TLSH
T162F002029C19D474A522484D1E6DA5DA35F0917A3AD15DF3355E9FC927FC394AC9024C
MD5 SHA1 SHA512 TLSH

Submit Download

B2FAF7692FD9FFBD64EDE317E42334BA_93702E680A5530C052C8D2BA33A2225F

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B2FAF7692FD9FFBD64EDE317E42334BA_93702E680A5530C052C8D2BA33A2225F
Size 1KB
SHA256 f185d774e14018f9168c148160b08cacdde50afe2fe6c1d2f2aa54f306afcd9f
MD5 02900293f84b28f2c8329d6ba702df3b
SHA1 a34a4ed86f93862bcc1fc184c069fad31b8ccc5e
SHA512 7ef54ac8dbf31f36c786ba3365fc30cb06a82631632a7f070e02fbd78693b6b98b2e53166aa556cf237deb88f83fa37b6bd9bbbc6cdd897e00ad08c059f454c5
TLSH
T1C331E9D35FB8B8306D0D4E8498ED8B726C707461FE24187534B4406798A3FD0181B81D
MD5 SHA1 SHA512 TLSH

Submit Download

18E6B4A57A6BC7EC9B861CDF2D6D0D02_EF52C1EC85F21F31CC0157A5C8803013

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\18E6B4A57A6BC7EC9B861CDF2D6D0D02_EF52C1EC85F21F31CC0157A5C8803013
Size 484B
SHA256 a5c15e1f80d00b3c8bdb3d6566af6106b222edac891c91b46e4f3ad0675a2ac9
MD5 d38e652f315b5414fd0467d252f3a266
SHA1 868a1971d29c1b97c90161460bdffb55247a61b0
SHA512 0da00980904220c307883ece9fa0dfe07cade70261284a53e99853306eba8ac52b29b7528f0969e89fb95b5527350d04939d232468e1b5227dc8ec60ed58837e
TLSH
T119F0AB7C8AF9413FF0798C7529D4A03B8C0AF213100241BC01F907195B12E00FD82078
MD5 SHA1 SHA512 TLSH

Submit Download

3AA0DCD5A74331FBD6F344550EC48B87_FAB5A9F6C6BE3394975FF948CA40CA87

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3AA0DCD5A74331FBD6F344550EC48B87_FAB5A9F6C6BE3394975FF948CA40CA87
Size 488B
SHA256 d6996c670dc3f64b208966466068851d00aacc9839ddbae5598bfebd7e0a13ef
MD5 ea5f28cd0ab0bcae32d5c505a051a73b
SHA1 51e5cae7eebc1a5f876cbe609b08a5e7c0aee512
SHA512 162b239d992b02995b9e87e3a178c8c895573c4e48bb04621a8769861b603ac95555becb00a3f74b1e66a79e1868e4dec2c7a3abbc987fad75f0afb330bf3ebd
TLSH
T166F0A33459F6417FE431897A05D5D103ED2FF2122F804D5C11A05705F742E404C52D35
MD5 SHA1 SHA512 TLSH

Submit Download

B2FAF7692FD9FFBD64EDE317E42334BA_93702E680A5530C052C8D2BA33A2225F

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_93702E680A5530C052C8D2BA33A2225F
Size 482B
SHA256 3def232b8e513299a4f671afda93cbefac285adc975691719d33f101d55c0f48
MD5 0ac55bd8da6daecc174c373554a4f167
SHA1 39de84c785305259f385b2eeee38437edf52cc44
SHA512 3e731197bd025f58a5d2490a316a00de7c79f7bdb36c95272419d638ab2ad538c74d8293c5aabb973725a2972b6de3c0ec1950bcb4b7165217c347c4892772ec
TLSH
T184F0AB2819B850ADE0334E34C5E9B1659CBCF622384086A615111907260BE834E57A3B
MD5 SHA1 SHA512 TLSH

Submit Download

7z.dll

Path C:\Windows\Action1\7z.dll
Size 1.2MB
SHA256 9d5eb586d110759ef5cb3403cda57c060567a703115e9bc66819c9638294664c
MD5 5d647c67acd6dd87e7cf1515a1c94a71
SHA1 9fd82890c8cc0bd7c4115f496ce218a45500abdd
SHA512 debf045655552a7a3d8a021a48af62c536e6435f59ed84e94c2c48156eee76510b99cf9a2777bb74c6fdf71467f71bb8c21bcc25ff058d050551b1ee5bc44275
SSDEEP 24576:zgiLEtP9FaybY4B7S0APFkWPHMd6axRnt3usIPK59FQ:zgiYXbY4B7EWrTwsIPK59u
TLSH
T159458D16F7F5C074D58A4630871DABF640FCE71ACA1068C76BC0BE6E6F319D6C229989
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

action1_agent.exe

Path C:\Windows\Action1\action1_agent.exe
Size 8.3MB
SHA256 371db1fccf5743d5a3ff3161b20557f045a4c5ccf8a8bfdc3388f4d3c7173a37
MD5 d8da0a53e1adb21d08416e33e72cc4de
SHA1 98f95bd0196f6cd7027547b35af367830ea557dc
SHA512 9609b1b39ebc0a336fcf145eb2201acb3e24a5dcff240cc85261449c4439abfc34022cef36c8fc3b514e8d9a471b0c245cb61362cb65e09495e721e4e40eaeb0
SSDEEP 196608:1njhuGl1E79yJdVSNKweNywEc87ffcCn5gcOHO:1njxxHSsweNucIfcCn5gcOu
TLSH
T1DB968D10B6918135F8F301B9997E57BF8A38FE20072594DBD3C82D5E5AB19D23A32B17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

action1_agent.exe

Path C:\Windows\Action1\action1_agent.exe
Size 8.9MB
SHA256 bdaf0c46119913e3636524f2a353f3fdaef30d6bf3efb168a20edd6dd10809bd
MD5 6d8bee98ef484d5892de8a9f16950228
SHA1 ebe2473b6e7f497a79a43a01585ddafd4042ef50
SHA512 d78abf33f61286527c3bd7ff9a244e7652328193390d4c5fc9cc6afdec44ea149cf8e945fd321931e5b53d64b98308ac2965232fad29f058f452ba0c42583685
SSDEEP 196608:O2gNtQsSfSMg5AXFlFBaSIYYu4+B2v4ZnDVVx0sp52Ck:OZJM/fblYN6ZnDVn082r
TLSH
T124968D21E6418135F9A301B299BE4B6F8538AE310B2454D7D3C85CAE5AB19E33B33F57
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

action1_agent.exe.connection

Path C:\Windows\Action1\action1_agent.exe.connection
Size 2B
SHA256 565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3
MD5 e0aa021e21dddbd6d8cecec71e9cf564
SHA1 9ce3bd4224c8c1780db56b4125ecf3f24bf748b7
SHA512 900110c951560eff857b440e89cc29f529416e0e3b3d7f0ad51651bfdbd8025b91768c5ed7db5352d1a5523354ce06ced2c42047e33a3e958a1bba5f742db874
MD5 SHA1 SHA512

Submit Download

action1_agent.exe.update_state

Path C:\Windows\Action1\action1_agent.exe.update_state
Size 1B
SHA256 7902699be42c8a8e46fbbb4501726517e86b22c56a189f7625a6da49081b2451
MD5 8f14e45fceea167a5a36dedd4bea2543
SHA1 902ba3cda1883801594b6e1b452790cc53948fda
SHA512 f05210c5b4263f0ec4c3995bdab458d81d3953f354a9109520f159db1e8800bcd45b97c56dce90a1fc27ab03e0b8a9af8673747023c406299374116d6f966981
MD5 SHA1 SHA512

Submit Download

action1_agent.msi

Path C:\Windows\Action1\action1_agent.msi
Size 6.8MB
SHA256 9f7125f869316c8a80402afcff018baa6291d4175950261ebef519ee06bd8c56
MD5 7d824ac94952b55e9ce8fefb952edcf3
SHA1 e48350054f68a5829179a220612e91a188dab5b1
SHA512 fba4202b9d2b8d992f15b18c15f79d9e3e885616f0c415c98ca39103ce39c2db6d203c11dc59f4585dc5a36a284c2ba0650b087b40c8be13b5993efd90318cf6
SSDEEP 196608:Ulc4PxNgvXPtj+zc5il1FiaRg9MRuGWRHZB:grr+/tj+QITFic+MRRWRn
TLSH
T18A662321BA838036E95B1E30753D9A759B3DFE345F64B0CFA784382D5E316C05B72A92
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

action1_remote.exe

Path C:\Windows\Action1\action1_remote.exe
Size 1.5MB
SHA256 84f9e22a5f457274b80bc978cfd07a8d6597fcfc4557e2386e5e609dc46991de
MD5 83defd57b5eacddd745a689074afa859
SHA1 84cd4e7c715c18105b61933ea52d6dc662c7f61e
SHA512 42e8e194d61dc064e4f382757fa30a6129dfbe65d9e2b19b68ab3582dde9ad4f81f975be497cb78ceaca7530c00d6ac8cce22a9c8590b4d13f87c134d4dce96e
SSDEEP 24576:tjPIrhxzZxkId1cDuDkSiAHnECgYgWj5ZqrMlgrUPopzFv73OZNZ5Tc4NhwCqJtB:tb6xzZzD3B8MlgrUPUhvkTc4ECqJtVP
TLSH
T1FA758C21379B803CE9B2137168B89A7A593DBE750F75D4CFA6840A2D1C70AC25F35B27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

advanced_settings.json

Path C:\Windows\Action1\advanced_settings.json
Size 46KB
SHA256 1cdce8f4cd613234bbb1de304cffd7d30183f12a01c963616e4bbeeac880d586
MD5 80a2eeac8adb4524b7b889497c338c3b
SHA1 9b900bcd6da5f993548706ad46bab3de888426e8
SHA512 d650bc644e88a6ba7f993327cacfca2b114fd04c6a768782258db7e40f0c21330e204187b58bf4a9963a95c3ece8c0ada107b51a9d4f89900e4aa314035fc09c
SSDEEP 768:THXKnbhRgjUzmSTRQ3Lyhx4ft32qUgw6/Fh8uP5K5DIK58EOKWbBoE3a+OQzGXS8:oRoLECxOWRHK7B
TLSH
T17D235C16E4757DB108C2188C5EDB1AF7DA4E019712D906DE871CEEBF89AF52C8102E9F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

agent_cdm_not_downloading.threshold

Path C:\Windows\Action1\agent_cdm_not_downloading.threshold
Size 888B
SHA256 4286f914ebfe98fde1b20ff3b3618ebd2fee78b8bffba69c2f367943a37b6d4e
MD5 759089000394e1a07f4e26e76e6321da
SHA1 c1cc848d29fd1038ec643747183cb9a060e6c5d6
SHA512 add93d2cb9020d491347f7b20eb7ddd3f44c880c338346eec943afc58c52791a9e5ef22b63e293b8943f47258e75361239ec18b9db82feaa1368dae7637169fa
TLSH
T1A1112C819A59ECBF03D29F4579FC6B4AEE1554379E8B540B0428CE024C8F2F7DA547B4
MD5 SHA1 SHA512 TLSH

Submit Download

agent_downgrade.version_pair

Path C:\Windows\Action1\agent_downgrade.version_pair
Size 73B
SHA256 c9cf7ba4757eabd25142a469d1e7112e27cae8b9225489756be18da2d1b53ec2
MD5 ae088d2345eabc61822b13f8f58c48dc
SHA1 2f1ca4348a667b2963078dc9bdf0f760c58bdc37
SHA512 1752fe618bf0d07b3912bb7a609aa5523e1a1c6ca9c1cafd8b7b9d1f1bf474bfa72f87150e858373f18d4ad7e3240b22c3645338ab65b2b8f7c624f8d87cd3f3
TLSH
T1B2A002552209955738EF9B46293533214B4850DDEB7A5C9C116C1BC2456D3B39ACDB41
MD5 SHA1 SHA512 TLSH

Submit Download

first_install

Path C:\Windows\Action1\first_install
Size 50B
SHA256 fae5bc494c3ccd80a3bb4e575515d896ec09d832cde4a5cbb34ed0ff1ca8845c
MD5 3b5d2e29719022cc19cfb144de8e79d1
SHA1 58434f02cc2fedca303e6172f844de5008b81d73
SHA512 88de7b2676140bd121fbd04fb2eb73e4f20c300cf0f8b6e21f1dd97706b7abcafbafce51ef5acbb35627f2475020bcd4eb23b9263b76b4242ef80652e46345e6
TLSH
T188900260A012A2762859436895CA03924750A2028C49004515C907080421012149F151
MD5 SHA1 SHA512 TLSH

Submit Download

agent_install_1770087141.log

Path C:\Windows\Action1\logs\agent_install_1770087141.log
Size 1KB
SHA256 d256486635c4b9a858c0d3627c0854969e2be05473a1d43c001bf33aa9725102
MD5 dd1faa26ce4e26ea28c7c47ad8af0098
SHA1 66e2ee6e185a37424aa24cd4d8a8c23f3066d78a
SHA512 8b52b147a68d9999eb5d673521645f0a2cc4d2c4398c456ff3075e2c39e5f0fe2f23f5b6db0c457f2cc821ed45c2d3c95bb1c97b214446bceb11a7efcec2d39f
TLSH
T1CA31BE5A2BE50845B1BBA707AEB3C0624A33BDD55874C70C22C9961D066BD05B9BC3BE
MD5 SHA1 SHA512 TLSH

Submit Download

CLOUD_2ba943b0-85b6-11ef-b9af-69a8758f6819_1728420293483_builtin.result

Path C:\Windows\Action1\package_downloads\CLOUD_2ba943b0-85b6-11ef-b9af-69a8758f6819_1728420293483_builtin.result
Size 65B
SHA256 3372d33f6ca092169fd75742394e22c2ea359b30713e6d7335f93099e7286b75
MD5 e5f9031e22d166a83f211a4179539c13
SHA1 f8076bb4f95e63a3d635981c932738059571eeb0
SHA512 b07e66121ddf2421be6ac4e307e9080e0b16299e4fbed3e9a68e5d9e442c5ad40ad716e891faf44b191e6121ed922b829323fe65371a8faf99e8a2056a977a31
TLSH
T1D4A0022F3057C03090077051959C32025612252B048842A7D4BC957FA7E1992D1A4997
MD5 SHA1 SHA512 TLSH

Submit Download

CLOUD_41c128e0-463e-11f0-b241-d13f758cf27c_1749589365358_builtin.result

Path C:\Windows\Action1\package_downloads\CLOUD_41c128e0-463e-11f0-b241-d13f758cf27c_1749589365358_builtin.result
Size 65B
SHA256 aff3f2c28da7327906c4114a7f4f84e675414c3c4997da5416e4e80a4af799c8
MD5 694fa4a600640eaa93e00d195e1afd14
SHA1 24f7948f22867dbfcd500f8de64e45e7f187bdb5
SHA512 7a6dff3def75a14a1af54f022e37ed15530871ea96fee01d42b7d947a21b052fc813374969afd5c0a3aa512ca8f2d2a958eee2e866ea4415f96ccc526d669674
TLSH
T152A0022F2063C030A0067491949C22135612112F04884267D5BC555FF7E1896D1A49D7
MD5 SHA1 SHA512 TLSH

Submit Download

sas.dll

Path C:\Windows\Action1\sas.dll
Size 8KB
SHA256 996b01e15f85e165899630721a141b178a9c372b6e878012180ec9e9d4e7bd06
MD5 969d1f85151e0156d51a664e59a50213
SHA1 777735cf24fe880d00a205b5bcc79ca8df8d660b
SHA512 73f9a14d297f7dddc9e3d9b0db6cd4160cd000f31f437ea8add7d95de2f704482fa891996f2df048def3371cc9245a2efa31b2d0647a7cc1e6848db7b809e711
SSDEEP 192:l5UGq/4LYix0kmAEE8O5cTbOVT66o+1WX6wW/:nr5YiWXAjHGOVZP1WX6wW
TLSH
T13C02E60973A8067AE4FF1B76A06EA236462AB6205FF142EF195322D938355D15E307C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

what_is_this.txt

Path C:\Windows\Action1\what_is_this.txt
Size 1KB
SHA256 2e7cd2b48880898969bf0a353c328245fa4ddd7bad502cb4aea7f63816607e17
MD5 d48bc2b076d10b7f746c94236a1ef968
SHA1 bb025e20cde2408ecea56a890d7d1a339a37f88f
SHA512 b90d6a862a6c80a91f920d9ff47acbe73a62b17e37c6f50f7a4e860b7ac4a69e9fcb886f40612db3b6e6281af197ad686bdc1ac2d72d59d59560146bf6e8e1ed
TLSH
T1D431615BF72423A50F8711823A9B04D1E739D47C331AA6A418EF425883A3A4893777E9
MD5 SHA1 SHA512 TLSH

Submit Download

MSI9EF.tmp

Path C:\Windows\Installer\MSI9EF.tmp
Size 385KB
SHA256 626a4e7060bd9b789795804e8b6497743c11d61c7353fb68798dd0bc76152cae
MD5 ced03b1bf99e148e40b7834816e2c330
SHA1 a7dc2898fa0916f8484e3597ce3e2c524c9c954d
SHA512 52a52436bb240a5ec16c540e428dc5acf7f7decaee4b5df092347019ef568d4c5948535721a39deef6dacc31cf4debad665dfb077c4dc9f44dc77ccd9d60cbaa
SSDEEP 6144:Rh1TnES0D5L240+A++CGvBsee3MudRa1UIFO4I/NVTPFc:JTnEDL24Pt+CGveeenw44IHFc
TLSH
T19D849D01B542C032D5AE05B0B634EFB5AABDA9705FA568CBB7D40D7B8D302C1A735B1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSIE412.tmp

Path C:\Windows\Installer\MSIE412.tmp
Size 379KB
SHA256 d7b6867d5bcd9ec42c32d82a145949cfb6c1e4557c1dbcccd7407209810b2e54
MD5 bbe29dc8d83747d63bdc9f4829f7b201
SHA1 9fcade3a8869b0d06bcf42ec40d6adafb7b9ac3a
SHA512 fe60c502c760a7a0e84c5447febbfc268bea04423f0ea961cc2a60f4a6461516a96aab2fedf23f103a1455f862c9b00d335080cadbf93865dfc9b42f7f1a5252
SSDEEP 6144:ArYPRq4Pa3nYGxKn7xz8b3oXD5gJ2xuaqoAKDH4X7AOkz4AlEuTuEv:A0q4Pa3nYvn7xz8b3oXD5gIF4Lbqb
TLSH
T107848D00F592C131C4BE017169799FB685BDA9285F7009DFABD40E7E9E346C1BA31E2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSIE53D.tmp

Path C:\Windows\Installer\MSIE53D.tmp
Size 234KB
SHA256 78860e15e474cc2af7ad6e499a8971b6b8197afb8e49a1b9eaaa392e4378f3a5
MD5 8edc1557e9fc7f25f89ad384d01bcec4
SHA1 98e64d7f92b8254fe3f258e3238b9e0f033b5a9c
SHA512 d26c9dce3c3d17583ffb5dbcd3989f93b096a7f64a37a2701a474c1bf4b8c8b1e922c352d33f24e411f1c793e1b4af11a3aec1de489087d481b1b636df2050cd
SSDEEP 3072:5XiqyhTO8W0iEa8LW0bEC9hvZpC01v+eUKflQnZl+T+J7g6EsNr7wyy/IP3:5qhy8VKU3hvZUy+ppHEsuB/
TLSH
T159348D217494547EEBFF0832953AD671AE3DF2380B90C96EC384581E6D618C1A7B7B27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e58e318.msi

Path C:\Windows\Installer\e58e318.msi
Size 6.4MB
SHA256 6a02721f5227dc764b66cc48dd46e75385d2bb10b0e0aadeb8f82fea54ddaab7
MD5 71ef09a49e261a2b513baee7eedecd30
SHA1 edcda622671c521295846f604f9cba0063d14df2
SHA512 1892b24140107b7679821917a6bb6c035cfcb22aebcc04bde183a9cb0735c410d98d489faa65f3b0c529f60456d411bd717ca9df2a990d4449ceb69adbcb6006
SSDEEP 98304:n+UJgsMOyVEUMo7Pcwq0kiOBOLT5lNUxh5Hup4SLQPLpGKWT4UX2Zo9HPD+PEJ8L:+4gtOyfPJe4LxUxCAFvtsHPr8y
TLSH
T17D662312BA838135D99A2E30343D86B5963EFF349F34B5DFEB84351D5E302D06A71A92
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ProductIcon

Path C:\Windows\Installer\{105F3C06-87D1-4863-91B3-ED4EA297A0B4}\ProductIcon
Size 32KB
SHA256 7a214ccfe309e4c0c83f40d9b7c92e3d41206db734401e7227ef10b38064ca9d
MD5 d37f7a439b9527f73e21311db17eaf00
SHA1 d0f34b3c1368f28a419924560c282358703a8d35
SHA512 3c1bcd38ed8d6bff8e071416cda90b0331b50903d9e4c9305bc36f9ccce23cb05424576b066485e76ee17e6fdc493fd25f8776d24b98de9d3941c181bb333569
SSDEEP 96:JnbrlpScW1BwB/vmaOZaxdJVE8BEArPz578SSuQEmgo3/I:JnbrlpScW18Ued/E8f8KQEPo3/I
TLSH
T195E211067007D5DCDE28473CB0B6FCB539728A776EAC23DEF2A4B4E52882465147C6B2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_xtrsgb5x.24g.ps1

Path C:\Windows\Temp\__PSScriptPolicyTest_xtrsgb5x.24g.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

powershell.exe.log

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 85b280a39fc31ba1e15fb06102a05b8405ff3b82feb181d4170f04e466dd647c
MD5 627073ee3ca9676911bee35548eff2b8
SHA1 4c4b68c65e2cab9864b51167d710aa29ebdcff2e
SHA512 3c5f6c03e253b83c57e8d6f0334187dbdcdf4fa549eecd36cbc1322dca6d3ca891dc6a019c49ec2eafb88f82d0434299c31e4dfaab123acb42e0546218f311fb
TLSH
T19651CE323375B1D889163F47192C5AC463BF8355FA94AF4CB698620ED92741B9F222F3
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 64B
SHA256 3e924ababbd0ecfe9a78b082145a5d86b63313fe037c854691575c908fa8d907
MD5 1860e9feaeffa4b93345d9a14370f501
SHA1 3fae13f9e34098e900192b5b5758127b89a66bd1
SHA512 3c03760f005e0f9246c3e4dc45363a5add0bb692119d4fe530ab7d3d9f76c488ca0e33c8165a258f23e796bfd2002e5e6c4e46c98220857ee73c264bbaf56835
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 498ed72ca69ff988c096485f22609d6edd0969e05b7f29be088c40c7c9c91c36
MD5 20c68333119190d6a2e4fa6e52577f30
SHA1 2cc794aec29215b732ed8a5d59a18edbe8dc3c7d
SHA512 9efd79f23b87a5fdfaa0779b7bd0ba7d0665065996ea7e979cdde39644ccdc0be23583f0aa6b4bd97eeea8e128209f3fe9131c3da572e7353acc82808a49cc5c
TLSH
T104218933B7ACC1B5C8C9117A1089AD01B2B2C3C7449ECECB7B84C508E57F999DF642A4
MD5 SHA1 SHA512 TLSH

Submit Download

metadata-2

Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
Size 24.6MB
SHA256 a620e47c91fcebfa3946efedaf5f34385fcabd81a511ae02cf57a58a610e9e5a
MD5 820bf292ea28cffc20574098cd34f9d5
SHA1 5fcdb381f31552f25eaf0c3e8e2f4ba09dd87515
SHA512 af68d95c324641e76bd655f1c6ef02855db12d58a3e8f073094f1b03354062c58d11906e5908876d969f724ce5db099e698ac5b98c0b5381a9a2d3ea3b579d22
SSDEEP 24576:C2gmSp17doO/vvTLtmmeBkH6fapdwoi82GVtHZUGvNqYUqCDY93B7r8Rh:A
TLSH
T16F47C12836F92250E7F79E3C68F06A234E3A7D5B9C159A8D05451B4E0D21FB0E872F5B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{6d1458ed-633f-48c7-a713-0f691046786b}_OnDiskSnapshotProp

Path \??\Volume{a6d9cdad-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{6d1458ed-633f-48c7-a713-0f691046786b}_OnDiskSnapshotProp
Size 6KB
SHA256 8ab89dbd033dc4095aafe2debbe1995bc3eff73a415abb37c70bbfec255c5e72
MD5 70c0d6f5f0d56c5f7db89c2d9f1173f8
SHA1 a642ca02ce2865c260998ada998f07f4c6cf99fd
SHA512 63b6d356f23930d4253d67c7b92c9cfd99c644c11a720b82a444ce381cc6e546f653a0a7ee797b8e850f88f0e52fadac78590f22c35eae1704199bea04be0ff7
SSDEEP 96:F7+nhmUVsvc8DD84LTHzbOHXOHBlBRQ88Sc9XE56tOSVQpuN:duV2b++ZVmN
TLSH
T1D1D189085AE54711E2B3AB3229F14557A877B911EF33CB8E0198238E6670A10F935F6F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3876-236-0x000002436C8D0000-0x000002436C8F2000-memory.dmp

Download

memory/4252-483-0x000001DDF1F60000-0x000001DDF2013000-memory.dmp

Download

memory/4252-486-0x000001DDF21B0000-0x000001DDF21D4000-memory.dmp

Download

memory/4252-485-0x000001DDF21B0000-0x000001DDF21DA000-memory.dmp

Download

memory/4252-484-0x000001DDF2020000-0x000001DDF202A000-memory.dmp

Download

memory/4252-482-0x000001DDF1F40000-0x000001DDF1F5C000-memory.dmp

Download