Analysis
- max time kernel
149s - max time network
150s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
03/04/2026, 04:47
Behavioral task
behavioral1
Sample
systemutilities.msi
Resource
win10v2004-20260130-en
windows10-2004-x64
24 signatures
150 seconds
Behavioral task
behavioral2
Sample
systemutilities.msi
Resource
win11-20260130-en
windows11-21h2-x64
23 signatures
150 seconds
General
- Target systemutilities.msi
- Size 7.4MB
- Sample260403-fenaladv9s
- SHA256 658a4936d2254cac14353ebce5b8b1fec4d9f46a1b8e474aee267c6f621cb586
- MD5 16c475fe60c3bfa59a0dbe3805001c2a
- SHA1 807698cc715b9e0058cca059588bf94154408715
- SHA512 8a6c79a267ae39d24c58a39ca38aca319bc831536d91a92a591e7ca7dd409e04f221c2ca7b54f0a8c6f30b2f817dfcb5e4499129a971a1d03ca0c9e4cef08240
- SSDEEP 196608:NKMvOh0LuSt6rGWpQ0qLLlEOEFYhS8y3RpV:UMvjJclp8LLuBYu3R
- TLSH T13C76230655D1F912C3FB16B306EADE7ECAEABD604530C206BA78B16CA97378C501177B
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Anypdf family
- Detects AnyPdf backdoor 2 IoCs
resource yara_rule behavioral2/files/0x001900000002b4aa-190.dat family_anypdf behavioral2/memory/4896-195-0x000001D85AB60000-0x000001D85AB8C000-memory.dmp family_anypdf - Executes dropped EXE 5 IoCs
pid Process 4896 DiagnosticDriver.exe 4380 DiagnosticDriver.exe 6080 DiagnosticDriverUpdater.exe 5256 autorun.exe 4208 SystemUtilities.exe - Loads dropped DLL 31 IoCs
pid Process 4676 MsiExec.exe 2992 rundll32.exe 2992 rundll32.exe 2992 rundll32.exe 2992 rundll32.exe 2992 rundll32.exe 4676 MsiExec.exe 392 rundll32.exe 392 rundll32.exe 392 rundll32.exe 392 rundll32.exe 392 rundll32.exe 5492 MsiExec.exe 1516 rundll32.exe 1516 rundll32.exe 1516 rundll32.exe 1516 rundll32.exe 1516 rundll32.exe 5492 MsiExec.exe 3252 rundll32.exe 3252 rundll32.exe 3252 rundll32.exe 3252 rundll32.exe 3252 rundll32.exe 5492 MsiExec.exe 800 rundll32.exe 800 rundll32.exe 800 rundll32.exe 800 rundll32.exe 800 rundll32.exe 4896 DiagnosticDriver.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DiagnosticDriver = "C:\\Users\\Admin\\AppData\\Local\\DiagnosticDriver\\DiagnosticDriver.exe" msiexec.exe - Badlisted process makes network request 9 IoCs
Network request originating from process or tool commonly abused by malware.
flow pid Process 2 4320 msiexec.exe 3 4320 msiexec.exe 4 4320 msiexec.exe 5 4320 msiexec.exe 6 4320 msiexec.exe 7 4320 msiexec.exe 8 4320 msiexec.exe 9 4320 msiexec.exe 10 5788 msiexec.exe - Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\A: msiexec.exe - Drops file in Program Files directory 12 IoCs
description ioc Process File created C:\Program Files (x86)\SystemUtilities\autorun.exe msiexec.exe File created C:\Program Files (x86)\SystemUtilities\Newtonsoft.Json.dll msiexec.exe File created C:\Program Files (x86)\SystemUtilities\es\SystemUtilities.resources.dll msiexec.exe File created C:\Program Files (x86)\SystemUtilities\Microsoft.WindowsAPICodePack.Shell.dll msiexec.exe File created C:\Program Files (x86)\SystemUtilities\SystemUtilities.exe msiexec.exe File created C:\Program Files (x86)\SystemUtilities\de\SystemUtilities.resources.dll msiexec.exe File created C:\Program Files (x86)\SystemUtilities\DotNetProjects.DataVisualization.Toolkit.dll msiexec.exe File created C:\Program Files (x86)\SystemUtilities\DotNetZip.dll msiexec.exe File created C:\Program Files (x86)\SystemUtilities\Downloader.exe msiexec.exe File created C:\Program Files (x86)\SystemUtilities\Microsoft.WindowsAPICodePack.dll msiexec.exe File created C:\Program Files (x86)\SystemUtilities\System.Drawing.Common.dll msiexec.exe File created C:\Program Files (x86)\SystemUtilities\update.json SystemUtilities.exe - Drops file in Windows directory 28 IoCs
description ioc Process File opened for modification C:\Windows\Installer\MSI6C0.tmp-\SystemUtilities.CustomActionsWix.dll rundll32.exe File opened for modification C:\Windows\Installer\MSI6C0.tmp-\CustomAction.config rundll32.exe File created C:\Windows\SystemTemp\~DF04398FC18F60E763.TMP msiexec.exe File opened for modification C:\Windows\Installer\MSI19C.tmp-\Microsoft.Deployment.WindowsInstaller.dll rundll32.exe File created C:\Windows\SystemTemp\~DFE13BD791C40B9C01.TMP msiexec.exe File created C:\Windows\Installer\{E260E69D-A75E-4723-9758-1C5E3EC4B021}\SystemUtilitiesIcon.ico msiexec.exe File opened for modification C:\Windows\Installer\MSI5A5.tmp-\Microsoft.Deployment.WindowsInstaller.dll rundll32.exe File opened for modification C:\Windows\Installer\{79D068F5-40E4-3614-A683-E351DF40BEBD}\icon.ico SystemUtilities.exe File opened for modification C:\Windows\Installer\e590006.msi msiexec.exe File opened for modification C:\Windows\Installer\MSI19C.tmp-\SystemUtilities.CustomActionsWix.dll rundll32.exe File opened for modification C:\Windows\Installer\MSI19C.tmp-\CustomAction.config rundll32.exe File created C:\Windows\Installer\SourceHash{E260E69D-A75E-4723-9758-1C5E3EC4B021} msiexec.exe File opened for modification C:\Windows\Installer\MSI5A5.tmp-\SystemUtilities.CustomActionsWix.dll rundll32.exe File opened for modification C:\Windows\Installer\MSI6C0.tmp msiexec.exe File created C:\Windows\SystemTemp\~DF9DAAE294879EF32D.TMP msiexec.exe File opened for modification C:\Windows\Installer\{E260E69D-A75E-4723-9758-1C5E3EC4B021}\SystemUtilitiesIcon.ico SystemUtilities.exe File created C:\Windows\Installer\e590006.msi msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File opened for modification C:\Windows\Installer\MSI3C0.tmp msiexec.exe File opened for modification C:\Windows\Installer\{E260E69D-A75E-4723-9758-1C5E3EC4B021}\SystemUtilitiesIcon.ico msiexec.exe File created C:\Windows\Installer\e590008.msi msiexec.exe File opened for modification C:\Windows\Installer\MSI6C0.tmp-\Microsoft.Deployment.WindowsInstaller.dll rundll32.exe File created C:\Windows\SystemTemp\~DFE69F96C54D77B2FA.TMP msiexec.exe File opened for modification C:\Windows\Installer\MSI19C.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI5A5.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI5A5.tmp-\CustomAction.config rundll32.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
pid Process 4320 msiexec.exe - System Location Discovery: System Language Discovery 1 TTPs 9 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DiagnosticDriverUpdater.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language autorun.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe - Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000611ecaf51c3c1a840000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000611ecaf50000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed35000000ffffffff000000000700010000680900611ecaf5000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff350000000000000005000000ffffffff000000000700010000f8ff1a611ecaf5000000000000f0ff350000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d611ecaf5000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe - Modifies data under HKEY_USERS 3 IoCs
description ioc Process Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E msiexec.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28 msiexec.exe - Modifies registry class 28 IoCs
description ioc Process Set value (data) \REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff SystemUtilities.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\D96E062EE57A32747985C1E5E34C0B12 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\D96E062EE57A32747985C1E5E34C0B12\ProductFeature msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D96E062EE57A32747985C1E5E34C0B12\ProductName = "SystemUtilities" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D96E062EE57A32747985C1E5E34C0B12\PackageCode = "B0959514BC86DF645AF91F3AB836788A" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D96E062EE57A32747985C1E5E34C0B12\ProductIcon = "C:\\Windows\\Installer\\{E260E69D-A75E-4723-9758-1C5E3EC4B021}\\SystemUtilitiesIcon.ico" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D96E062EE57A32747985C1E5E34C0B12\SourceList msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D96E062EE57A32747985C1E5E34C0B12\SourceList\Net msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D96E062EE57A32747985C1E5E34C0B12\SourceList\Media\1 = ";" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D96E062EE57A32747985C1E5E34C0B12 msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D96E062EE57A32747985C1E5E34C0B12\AdvertiseFlags = "388" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\124EBC2DE2A5C7D478994EE4B20AE6E2 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D96E062EE57A32747985C1E5E34C0B12\SourceList\PackageName = "systemutilities.msi" msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D96E062EE57A32747985C1E5E34C0B12\Clients = 3a0000000000 msiexec.exe Key created \REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell SystemUtilities.exe Key created \REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU SystemUtilities.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D96E062EE57A32747985C1E5E34C0B12\Language = "1033" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D96E062EE57A32747985C1E5E34C0B12\InstanceType = "0" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D96E062EE57A32747985C1E5E34C0B12\AuthorizedLUAApp = "0" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D96E062EE57A32747985C1E5E34C0B12\SourceList\Media msiexec.exe Key created \REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000_Classes\Local Settings SystemUtilities.exe Set value (data) \REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots SystemUtilities.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D96E062EE57A32747985C1E5E34C0B12\Version = "16973825" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D96E062EE57A32747985C1E5E34C0B12\Assignment = "1" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D96E062EE57A32747985C1E5E34C0B12\DeploymentFlags = "3" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\124EBC2DE2A5C7D478994EE4B20AE6E2\D96E062EE57A32747985C1E5E34C0B12 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D96E062EE57A32747985C1E5E34C0B12\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D96E062EE57A32747985C1E5E34C0B12\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\" msiexec.exe - Suspicious behavior: EnumeratesProcesses 3 IoCs
pid Process 800 rundll32.exe 800 rundll32.exe 4208 SystemUtilities.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 4320 msiexec.exe Token: SeIncreaseQuotaPrivilege 4320 msiexec.exe Token: SeSecurityPrivilege 5788 msiexec.exe Token: SeCreateTokenPrivilege 4320 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 4320 msiexec.exe Token: SeLockMemoryPrivilege 4320 msiexec.exe Token: SeIncreaseQuotaPrivilege 4320 msiexec.exe Token: SeMachineAccountPrivilege 4320 msiexec.exe Token: SeTcbPrivilege 4320 msiexec.exe Token: SeSecurityPrivilege 4320 msiexec.exe Token: SeTakeOwnershipPrivilege 4320 msiexec.exe Token: SeLoadDriverPrivilege 4320 msiexec.exe Token: SeSystemProfilePrivilege 4320 msiexec.exe Token: SeSystemtimePrivilege 4320 msiexec.exe Token: SeProfSingleProcessPrivilege 4320 msiexec.exe Token: SeIncBasePriorityPrivilege 4320 msiexec.exe Token: SeCreatePagefilePrivilege 4320 msiexec.exe Token: SeCreatePermanentPrivilege 4320 msiexec.exe Token: SeBackupPrivilege 4320 msiexec.exe Token: SeRestorePrivilege 4320 msiexec.exe Token: SeShutdownPrivilege 4320 msiexec.exe Token: SeDebugPrivilege 4320 msiexec.exe Token: SeAuditPrivilege 4320 msiexec.exe Token: SeSystemEnvironmentPrivilege 4320 msiexec.exe Token: SeChangeNotifyPrivilege 4320 msiexec.exe Token: SeRemoteShutdownPrivilege 4320 msiexec.exe Token: SeUndockPrivilege 4320 msiexec.exe Token: SeSyncAgentPrivilege 4320 msiexec.exe Token: SeEnableDelegationPrivilege 4320 msiexec.exe Token: SeManageVolumePrivilege 4320 msiexec.exe Token: SeImpersonatePrivilege 4320 msiexec.exe Token: SeCreateGlobalPrivilege 4320 msiexec.exe Token: SeCreateTokenPrivilege 4320 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 4320 msiexec.exe Token: SeLockMemoryPrivilege 4320 msiexec.exe Token: SeIncreaseQuotaPrivilege 4320 msiexec.exe Token: SeMachineAccountPrivilege 4320 msiexec.exe Token: SeTcbPrivilege 4320 msiexec.exe Token: SeSecurityPrivilege 4320 msiexec.exe Token: SeTakeOwnershipPrivilege 4320 msiexec.exe Token: SeLoadDriverPrivilege 4320 msiexec.exe Token: SeSystemProfilePrivilege 4320 msiexec.exe Token: SeSystemtimePrivilege 4320 msiexec.exe Token: SeProfSingleProcessPrivilege 4320 msiexec.exe Token: SeIncBasePriorityPrivilege 4320 msiexec.exe Token: SeCreatePagefilePrivilege 4320 msiexec.exe Token: SeCreatePermanentPrivilege 4320 msiexec.exe Token: SeBackupPrivilege 4320 msiexec.exe Token: SeRestorePrivilege 4320 msiexec.exe Token: SeShutdownPrivilege 4320 msiexec.exe Token: SeDebugPrivilege 4320 msiexec.exe Token: SeAuditPrivilege 4320 msiexec.exe Token: SeSystemEnvironmentPrivilege 4320 msiexec.exe Token: SeChangeNotifyPrivilege 4320 msiexec.exe Token: SeRemoteShutdownPrivilege 4320 msiexec.exe Token: SeUndockPrivilege 4320 msiexec.exe Token: SeSyncAgentPrivilege 4320 msiexec.exe Token: SeEnableDelegationPrivilege 4320 msiexec.exe Token: SeManageVolumePrivilege 4320 msiexec.exe Token: SeImpersonatePrivilege 4320 msiexec.exe Token: SeCreateGlobalPrivilege 4320 msiexec.exe Token: SeCreateTokenPrivilege 4320 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 4320 msiexec.exe Token: SeLockMemoryPrivilege 4320 msiexec.exe - Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 4320 msiexec.exe 4320 msiexec.exe - Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 5788 wrote to memory of 4676 5788 msiexec.exe 80 PID 4676 wrote to memory of 2992 4676 MsiExec.exe 81 PID 4676 wrote to memory of 392 4676 MsiExec.exe 83 PID 5788 wrote to memory of 3924 5788 msiexec.exe 87 PID 5788 wrote to memory of 5492 5788 msiexec.exe 89 PID 5492 wrote to memory of 1516 5492 MsiExec.exe 90 PID 5492 wrote to memory of 3252 5492 MsiExec.exe 92 PID 5492 wrote to memory of 800 5492 MsiExec.exe 93 PID 800 wrote to memory of 4896 800 rundll32.exe 94 PID 4896 wrote to memory of 6080 4896 DiagnosticDriver.exe 100 PID 4320 wrote to memory of 5256 4320 msiexec.exe 101 PID 5256 wrote to memory of 4208 5256 autorun.exe 102 - Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\systemutilities.msi1⤵
- Badlisted process makes network request
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4320 -
C:\Program Files (x86)\SystemUtilities\autorun.exe"C:\Program Files (x86)\SystemUtilities\autorun.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5256 -
C:\Program Files (x86)\SystemUtilities\SystemUtilities.exe"C:\Program Files (x86)\SystemUtilities\SystemUtilities.exe"3⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:4208
-
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Adds Run key to start application
- Badlisted process makes network request
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5788 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 419F9951C53FE1B7CD7A1BD0AAE1D9B4 C2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4676 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSIB10B.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240693625 1 SystemUtilities.CustomActionsWix!SystemUtilities.CustomActionsWix.CustomActions.InstallerStartedCustomAction3⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2992
-
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSID08B.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240701578 5 SystemUtilities.CustomActionsWix!SystemUtilities.CustomActionsWix.CustomActions.UserInteractedCustomAction3⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:392
-
-
-
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵PID:3924
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 2675BA9B8146F5AAE80A7DA5F61D705C2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5492 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Windows\Installer\MSI19C.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240714218 2 SystemUtilities.CustomActionsWix!SystemUtilities.CustomActionsWix.CustomActions.InstallationStartedCustomAction3⤵
- Loads dropped DLL
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1516
-
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Windows\Installer\MSI5A5.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240715203 6 SystemUtilities.CustomActionsWix!SystemUtilities.CustomActionsWix.CustomActions.InstallCompleteCustomAction3⤵
- Loads dropped DLL
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3252
-
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Windows\Installer\MSI6C0.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240715453 10 SystemUtilities.CustomActionsWix!SystemUtilities.CustomActionsWix.CustomActions.StartDhtCustomAction3⤵
- Loads dropped DLL
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:800 -
C:\Users\Admin\AppData\Local\DiagnosticDriver\DiagnosticDriver.exe"C:\Users\Admin\AppData\Local\DiagnosticDriver\DiagnosticDriver.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:4896 -
C:\Users\Admin\AppData\Local\DiagnosticDriver\DiagnosticDriverUpdater.exe"C:\Users\Admin\AppData\Local\DiagnosticDriver\DiagnosticDriverUpdater.exe" SystemUtilities https://yasupro.net/lup/version/last a2ef21b7c171d0bec03f50fc2158bf0411376209cc24ab7fce3009459ade3640 C:\Users\Admin\AppData\Local\DiagnosticDriver\DiagnosticDriver.exe5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:6080
-
-
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
PID:5296
-
C:\Users\Admin\AppData\Local\DiagnosticDriver\DiagnosticDriver.exeC:\Users\Admin\AppData\Local\DiagnosticDriver\DiagnosticDriver.exe1⤵
- Executes dropped EXE
PID:4380
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Installer Packages
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Installer Packages
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Config.Msi\e590007.rbs
- Size 12KB
- SHA256 0c69e52bfbf363677bf981f285fc4c7b1ce048762120e915b9c1f64f954881d0
- MD5 a42e6111e47bdea8bff95a403fa1a88f
- SHA1 1b174e8e1f9de193aee7f4f0c584bf7aa299f900
- SHA512 9aca9000bf0c66e95ce3031812c39beb0216d5a7e9c6168fa8cf7232af5a4da6124da0c2c3417b2a743432493220a2e1ee341d52b5878d3d67e7f38235763c52
- SSDEEP 384:iJNruj8L04yYZTC45hP9YNps5PqeqO4suQd4t:iJNruj8L04yYZTC45hP9YDstvp4s3d4t
- TLSH T10142D8C2A31AD1C3F6A70BB1D75B560A73738A945F82170F16ED48208F21BCC5BE559B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\SystemUtilities\Microsoft.WindowsAPICodePack.Shell.dll
- Size 529KB
- SHA256 e6fa9d9e34ff3bf63ce782654b14e4b54a3abd1022c87bc099032c2948157672
- MD5 54fe9a2748c4a0f282d4ec91e3cadc16
- SHA1 970b783a697d893ecd4916dd86b5ff7574896c9e
- SHA512 c7d567e3c039f98f3a99249b2d9bc2186c34efd73eec421331732d2307a8af940911381e27b015f58d0f65871bb4b038cc0f27d3fa495acd08994226bb033b7f
- SSDEEP 6144:KRAFnp++R1yj124hKX97kANqQHlWBwn9dgPan1W86b8c3v6n9c6KwZErn+LYHtA:iApI2D97kANVFWBwn9iPIL9Mwh
- TLSH T19AB429207BBA811BE19F477CE5F61721D7B58602B213EF0D0E8462AE2DC275645839FB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\SystemUtilities\Microsoft.WindowsAPICodePack.dll
- Size 102KB
- SHA256 418b5e7a96f9a6105cc6fe45896a9164e79c8849f40be23a411b5563a8e3a0d0
- MD5 9531b41519156855a45c46f0b379a784
- SHA1 00b857f09dcf0c71dab40c1a8c4c54d411fdb197
- SHA512 10034288101d235cb7af984fd6a0db11c7f56dbed648a71596b8b0c93f68d5ac5cf00be033153a91e71a311374b220507f07aa5b6e1849a80930d37a5c2577f0
- SSDEEP 3072:3BPJ2fTauHhiiWPCeOMt0ImL6HKgqYR1FliQ:3UpWPCeBHxZ
- TLSH T18EA3396173BC467AEAFF2F78F8255120CBB2F9862213DB1F2C94754E08927809959773
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\SystemUtilities\SystemUtilities.exe
- Size 1.9MB
- SHA256 8573c51c89b3be8fd3dd1341756c7fa0d30fbbf310024dd44b43913a358a2d69
- MD5 27a9c93160f44607de5ad000a44a2fb1
- SHA1 2ef1b8245fd107487f3a4df2e1ec857066906c42
- SHA512 a5a7fddbfe3d067b76e302e3e6898bb89bddfd8c08ebdaa0d8ec4a80e9a16c7129c2f77f9c9a882a766eee946b6670e3dbce21f09207f215c443439043c70e52
- SSDEEP 24576:oJhq2fZ0D/uFszx3Qqr8DZyuJ1ugrWFIvpPg:Mhq2R0D/uyWpHuy
- TLSH T147957C02F3C3DA19C7E26935A8BD9F7E89F4F4267C7B810731986B2A99C6544DC80778
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\SystemUtilities\autorun.exe
- Size 16KB
- SHA256 325483361ab0e0aaa4805087d502066d52099a1b6d096e3c9cdfe9e1068b84a3
- MD5 608c75745d5342f3952a0a16a2aa5a3d
- SHA1 999657b2042937923a08d9fecfd571a4aa34fa12
- SHA512 27dc8299c59fc3e531a1ae00db2d47837257f256327341facb7b7b8eeb8b45fb16240af5395f591879c90dff42d3829217bac699f18a72fa7bb9e9c332ac0ed3
- SSDEEP 384:GfmBfBYV/uo6ki2LBiNkSRV0rS+ShjmM6IGBkSP:GMf+Er2LINSS+ST6nk6
- TLSH T15D724C174B2C4363EF96CF79E4D695032CB8F783CCDD554E700A961D6D083A42BA6A3A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\357F04AD41BCF5FE18FCB69F60C6680F_916782E55E1A78E82793614EB4F362C2
- Size 1KB
- SHA256 76dba7ff4511f0cf070579b7101826d36e7fd060cb358a875a60ed97689692e2
- MD5 23c21b2f77ba9420b1f50e97e92d964a
- SHA1 4135f3a364b33de2810dd42b782167a6657df776
- SHA512 51f3f09bcf6ede89e20855a79cc386a47891fd8f688dbff7fb8f93928ee7fb79c876cff30d60f9870538e2318a22ec3c7d34415e3a63536f5d5634c25477b88b
- TLSH T10331DA5E9DFD24827A97DC3819C59B7571E5F0F9D2BC7042B03B83A698A03A31FA7016
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157
- Size 4KB
- SHA256 0300e9ddb527990e8b59d06e9ccf3ec2bd92d3bbd0ef4fba69d6336e4195e82d
- MD5 5f036f91e86e30f749961506951d51eb
- SHA1 acb87b59117c6e2db86f98c4c8bac52eade97cd4
- SHA512 341f250cf3764207b5328a12b31016c0750daddcd16722b4bcef502bcbef7ef379abb601649ee6c3fdf121f3d3cd6890c8a80e5dae3169fe56ef82af20631944
- SSDEEP 96:Dbonzjs6o1BXl7EV4/sClywa3UHimRkISatmQFjm:Dbsns6KXxUrClywawinLatvFjm
- TLSH T100A19E44A75AEB61C331EBB6829B7B51033B6D20178468FAEFDAA1E1695B44C143C3C2
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\9CB4373A4252DE8D2212929836304EC5_1AB74AA2E3A56E1B8AD8D3FEC287554E
- Size 1KB
- SHA256 95a7c1909d396771f8dbed85b908cddaafca8d6000634972fb886cedb6de52ca
- MD5 38eeaa49993bb517903a770ac93fd672
- SHA1 fdedbe1abdb197bbf1de205c94bba3ae42a8046b
- SHA512 87db00897c866c0ffb7140b829964c15c7542e7fcd700d4315f315da7ef2156c671f128479992555855d37f65cf10fbb877ce8d4741dd35184fdf3c42bd9d723
- TLSH T10831D65B863451126D10CDE15AECC6352CF092905AC7645466BF925BA8083B73FE498C
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B039FEA45CB4CC4BBACFC013C7C55604_50385F8EB1F713E33924A830D7A2A41C
- Size 1KB
- SHA256 36e7dc636e73b1f4328a532a743296685ba2b471962facbc2e6b410c02c26b33
- MD5 6bc9de3e7c75b47a0c793837d14dd302
- SHA1 a84c86dab8c0bc52c5810e0344d4fcc7d56ec193
- SHA512 34facc48ccf90aad1e8f1dd3902b64e94cf0a8660c1e4258476fb83ff6124aedecb41c3c39d510875baa9f0e3e29e0ea8b2ff35e2125c26a4ea0101c21a102b0
- TLSH T1B821B92617B948056F068D891CDDD9373CF173A6D69C2507B11B86561C81BB23F1501C
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\357F04AD41BCF5FE18FCB69F60C6680F_916782E55E1A78E82793614EB4F362C2
- Size 540B
- SHA256 01493c613a0dce94df486ead05ff0b78b46515938df454c045c91f1352cc13d5
- MD5 79e84e478f7e6eecfb410e51577b6beb
- SHA1 37101cf001a921010232bec4018fd767f273008f
- SHA512 5383f1c03dc058d5badbc2a5748250cc70f38304c2aa64ed78cdac8be208cd3ba32613453d04c7428f677cdc7dc55c3cfffab70d7cee32f36fb924a0bb02dd81
- TLSH T1F5F0523811BA021FF171EA380AE195AA7969FB1334B18E5819994309B822E801DD3A3E
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157
- Size 342B
- SHA256 a3162fb276761e30490ee58e4fda5ef69176fb2bf07996640b6ddfd1ea465ff4
- MD5 c81d2ed0e85b1d8b2df987b5edfa3521
- SHA1 387d69cd08b83174d0ac9f5b3b79650be8292e95
- SHA512 df0f3124101f41d544b5e5213ede826192aafe185c7583646c4ab49df55a9f14f847608779a396873c2a359db744e980f95151adb1ffc589d3c9d85c43f56d19
- TLSH T15FE0C2617AB84204F5730E3C6873A4449A37F32BAE21CACE033445AE0C35FA2C83632D
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\9CB4373A4252DE8D2212929836304EC5_1AB74AA2E3A56E1B8AD8D3FEC287554E
- Size 536B
- SHA256 88f1f7be0f81c0f76d73ab8587a418346a5af085c71e962af3ceac982052be95
- MD5 a4979bd6d3bb7a8a9fe1500c1de92499
- SHA1 dba4e8c2f9a4fd2b6c70cb22cbcddca035eb116b
- SHA512 ae60b64b1f6047b9846d4cab87e38cf3d50401d490eed2287e92d70b79c45f9c263adf7dfd5498f4b40375685024d31315cef70544faa7797dff598a8555408a
- TLSH T144F0DC2801F1423EF0B3C9390DEC56E6E16BFC023C619668026A4B0ABD22B00DD2342A
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B039FEA45CB4CC4BBACFC013C7C55604_50385F8EB1F713E33924A830D7A2A41C
- Size 508B
- SHA256 121212e30c9237724e9d3b2e90541c2de06b1aa4d3b2fae31b1ce348dc400a19
- MD5 61513d2390f0a75393e88c8908c134b1
- SHA1 ca01a652f880fb3f69455f355c829c244f3a3e54
- SHA512 272e17fbf05c14a0383d1feab9f64254146b8c098461a60e5474d8c2a179d4490adb1e6c18704df374a9fbf5e74f956660994b8427367ae6a4f72f5939b17ae1
- TLSH T193F0DC1854FCD00DF173CF74A4E5AAF77E2BFA03282506BC051857092B13F021C82938
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\DiagnosticDriver\Config.txt
- Size 296B
- SHA256 984d1ce3ffcc988d27b739f6f41dfd959c617e51c459ed72e08b81c1243004fe
- MD5 23bc669aa82b3cf8c4e8243eae7be74f
- SHA1 ed4e56a75682046e2d8dc867952b6485435bf800
- SHA512 88f57a851f88a966339ffe565770e310ed804b51c3b0af3261d4729c1a5f3c0f6703a3591eed0104bce5e2be58a42f37b9129d8dfe2f5199417f4aaca4d3da15
- TLSH T129E026317A61662EE518005212DA15190C7C2C1B0030E2670E92DFC12288A1230F58A9
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\DiagnosticDriver\DiagnosticDriver.exe
- Size 159KB
- SHA256 8debd07096a23dbba47d3de896956a687376918e2f678f36031117c5907e452a
- MD5 9d206fcce71d989dddc7f86862db0ee2
- SHA1 3ea00b843536b5aa7c47812a4282f246f1edb695
- SHA512 3996165785a7ec2ba9f624c4f829c0af5c0b13fb82cd3f1ff0810b80ce0bc3e4ca20055c714982b2a1d528f20db2bb387a9f6fe0426b0754d3e7951dfcf9ea8e
- SSDEEP 3072:UiNLY6kFY5t2EfLHX4eZlOBHDNosA/QGngZZqx45JEJA9TMfh/:EFY5tlfL3BKHDNoRYGngZZqyU
- TLSH T15BF34B3A2B495E77CA5C86F4C0EB612017F2968B5B33D74B2DC016D94E033867E6768E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\DiagnosticDriver\DiagnosticDriverUpdater.exe
- Size 88KB
- SHA256 8705b334815a1676f62aadf46cc0e201f77e27e78de9c064d149544d916d0fc3
- MD5 8ab419b24ea30504e1e90b1a73752f99
- SHA1 07779af442636002c905352bc796e5c34e922f35
- SHA512 42b99767b5014b9f3e063607b1291f31b2b46ecd2caa8926ef74b63936b0fcafd0ec789eb949628ff6c297757ce0f2aac4203a5570af988be78e017b444e15b5
- SSDEEP 1536:irDYsqaAXAHtI/s1MlLNWiATf5m4dH31dB/mBg:ifYUNI/saWrTs4F17/qg
- TLSH T10D932A16376B4722C65849B880E7251707F2E7CB67B3C64E3E0852DA1F063E9AF85BC5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\DiagnosticDriver\Newtonsoft.Json.dll
- Size 685KB
- SHA256 b624949df8b0e3a6153fdfb730a7c6f4990b6592ee0d922e1788433d276610f3
- MD5 081d9558bbb7adce142da153b2d5577a
- SHA1 7d0ad03fbda1c24f883116b940717e596073ae96
- SHA512 2fdf035661f349206f58ea1feed8805b7f9517a21f9c113e7301c69de160f184c774350a12a710046e3ff6baa37345d319b6f47fd24fbba4e042d54014bee511
- SSDEEP 12288:U9BzaPm657wqehcZBLX+HK+kPJUQEKx07N0TCBGiBCjC0PDgM5j9FKjc3Q5:U8m657w6ZBLmkitKqBCjC0PDgM5A5
- TLSH T1B8E44A0633E88F66D1AF2735B8305A1997F6F407A2B6EBCF6904D5B81D677608E00367
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\DiagnosticDriver\System.Data.SQLite.dll
- Size 384KB
- SHA256 5fac5a9e9b8bbdad6cf661dbf3187e395914cd7139e34b725906efbb60122c0d
- MD5 55c797383dbbbfe93c0fe3215b99b8ec
- SHA1 1b089157f3d8ae64c62ea15cdad3d82eafa1df4b
- SHA512 648a7da0bcda6ccd31b4d6cdc1c90c3bc3c11023fcceb569f1972b8f6ab8f92452d1a80205038edcf409669265b6756ba0da6b1a734bd1ae4b6c527bbebb8757
- SSDEEP 12288:5vXCrbE724yjK3r/fFNFfcaFeFOFwcGF6cmFWc0FWc8cIcKcUFJFpcNcHc7cbchs:h8dDm3r/7
- TLSH T122845BA423EC2A19E1FF5774E8F068408B70F452ABAAD31D78C054A92D27B41BD537B7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\DiagnosticDriver\x64\SQLite.Interop.dll
- Size 1.7MB
- SHA256 9309fb2a3f326d0f2cc3f2ab837cfd02e4f8cb6b923b3b2be265591fd38f4961
- MD5 56a504a34d2cfbfc7eaa2b68e34af8ad
- SHA1 426b48b0f3b691e3bb29f465aed9b936f29fc8cc
- SHA512 170c3645083d869e2368ee16325d7edaeba2d8f1d3d4a6a1054cfdd8616e03073772eeae30c8f79a93173825f83891e7b0e4fd89ef416808359f715a641747d7
- SSDEEP 24576:YPUxmkgSxPgobZPRjZ22H6edtOZzWySRO3mlE0i/Yl5P+qF+8k+ao/si6:8UxXPgo8e6WYBSJZSS5P97I
- TLSH T154858D4AB3B8019DD567C17DC6675B07EBB174022310ABDB17A08AAA2F13FE5177E324
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\rundll32.exe.log
- Size 1KB
- SHA256 71b942a59df956f6ee45246123dedaaa6ec1611a20b93812f779d504bfd0bae1
- MD5 21f763f6ddeb0eef8c2982b82141cf79
- SHA1 cd51109aea7b024d39d72846689bb12d1cbe1262
- SHA512 fe5a6d3f83943083eb3685c7f3d03859f600f4d5ad5b56903d5e5184b5006f97b6b461f889a0224854baa697f449708f279478813a00b3b9db9f45d3e531b156
- TLSH T171214F713231B5D449426F53086CA58456FF0745B9E4EF6C7698621EDD2A04B6F222F3
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\SystemUtilities\Clue
- Size 39B
- SHA256 ea893b03682e7742df0b2598b60203546eb9a9f62100cf18a6cb76bbc598e0c6
- MD5 176907cfbcd005973a9c6d107a9c8003
- SHA1 ad09be5ea464c487e15a5ef9b25aea7eb700df52
- SHA512 4432a59f8fcf11081cb66b2b8baca8175b7999888a4fedd02c9b79d8b239fd8c549cf7a1e2bbb1d4aaa816b45f660596316cd0385b3f3400b3a54e7641a4037d
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\SystemUtilities\Sources
- Size 64B
- SHA256 4d7c23187a194e2ffde3f7a5ac176514f57ea39253497e18e2b3a0f4d33aafb3
- MD5 674c553f2f80544112f15dcb540447e4
- SHA1 d776a91b70181962afb021a26c7eb83607ab39e7
- SHA512 adc7d4f916af474581a958f50aeae37d24622ee57d6346de2e3ee9ac5ce7a4b749368b551f9771b8919ad040776f0a7e5305ebfe3d76ef8311e9ed7f1b6505cf
- TLSH T1F3A002A9810E9871784281D6337851598011426E405BB14E4FCB2CD63E61558E4626C3
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\MSIB10B.tmp
- Size 251KB
- SHA256 843f4ed51c95d6892cedf04bb41fb48cf717b06c747f939d474a11db957de7c7
- MD5 8252ae1adafb79e8f5bb0818cb276d77
- SHA1 e5beecaeceb0c4c83339340da14d5a1d1a29df7d
- SHA512 d86787ce0af38d6c96a4d067add2fb6429482bacca0c51b7d190fe216c8e563bab76903d6be3e5cb0c1aeac8bc8c38fd3f5ff443087b6362c9055837a2cd5407
- SSDEEP 3072:RArbg5BxgracGnEnRQOl9WGPotLx9uYxiPLTPeKKRn0iZzjeCzoprzALTpX53YY:RArbtraBqLlAGwofPeRRn0qzyvYp3YY
- TLSH T1EC44AE01B6D88431F2BF1E381D34A6654ABFBD601F71CA4F6748862E5EB46C0DA21F67
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\MSIB10B.tmp-\CustomAction.config
- Size 1KB
- SHA256 33d947c04a10e3aff3dca3b779393fa56ce5f02251c8cbae5076a125fdea081f
- MD5 01c01d040563a55e0fd31cc8daa5f155
- SHA1 3c1c229703198f9772d7721357f1b90281917842
- SHA512 9c3f0cc17868479575090e1949e31a688b8c1cdfa56ac4a08cbe661466bb40ecfc94ea512dc4b64d5ff14a563f96f1e71c03b6eeacc42992455bd4f1c91f17d5
- TLSH T11031568E0B05B77711312753AEED90C5DB7561A73C95811834DE99293F36978137338E
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\MSIB10B.tmp-\Microsoft.Deployment.WindowsInstaller.dll
- Size 179KB
- SHA256 cf06d4ed4a8baf88c82d6c9ae0efc81c469de6da8788ab35f373b350a4b4cdca
- MD5 1a5caea6734fdd07caa514c3f3fb75da
- SHA1 f070ac0d91bd337d7952abd1ddf19a737b94510c
- SHA512 a22dd3b7cf1c2edcf5b540f3daa482268d8038d468b8f00ca623d1c254affbbc1446e5bd42adc3d8e274be3ba776b0034e179faccd9ac8612ccd75186d1e3bf1
- SSDEEP 3072:BGfZS7hUuK3PcbFeRRLxyR69UgoCaf8+aCnfKlRUjW01KymkO:9zMRLkR6joxfRPW
- TLSH T159046B2953FC473ACAFF4778E261425197B1F2E67117DB0EEC8181AA2522780F792397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\MSIB10B.tmp-\SystemUtilities.CustomActionsWix.dll
- Size 28KB
- SHA256 40a5073210d5fb101dc105bf2d134b08a6e887140238e125a748f970a0b4eeef
- MD5 ac84d525779f4638664aa3227821425b
- SHA1 577980c1d6e7ef64b34d511ecb16eef933a647b2
- SHA512 e1e7c4cb8f5c8fcfc8aebd5ae917c8a697ee3c4b80f4839c463f1e5d1c30631058dc05e0ca14ef25d421a42224220a20914451b735288f76095d0bc4f6046602
- SSDEEP 384:yIR6z8sML4Mj4MC4MQ84Mb4QMi4QMb94QcMA4S6z4co26z8sYcQo06zV6zcoU6zl:fUkIjUnqbAXb7O6+Bw93AxEgU
- TLSH T19BD297437778862AD6FA4E799DB1813401F3B99ABC81CA6E2D4170C53F277089E43E76
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\e590006.msi
- Size 7.4MB
- SHA256 658a4936d2254cac14353ebce5b8b1fec4d9f46a1b8e474aee267c6f621cb586
- MD5 16c475fe60c3bfa59a0dbe3805001c2a
- SHA1 807698cc715b9e0058cca059588bf94154408715
- SHA512 8a6c79a267ae39d24c58a39ca38aca319bc831536d91a92a591e7ca7dd409e04f221c2ca7b54f0a8c6f30b2f817dfcb5e4499129a971a1d03ca0c9e4cef08240
- SSDEEP 196608:NKMvOh0LuSt6rGWpQ0qLLlEOEFYhS8y3RpV:UMvjJclp8LLuBYu3R
- TLSH T13C76230655D1F912C3FB16B306EADE7ECAEABD604530C206BA78B16CA97378C501177B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\{E260E69D-A75E-4723-9758-1C5E3EC4B021}\SystemUtilitiesIcon.ico
- Size 54KB
- SHA256 64b7539df855b445ec76009240cc310374266ef15b1d5209561c55cb983df9ea
- MD5 34d2b40fc19071aec7bca1cadc24ab65
- SHA1 d31076b4cef88772cdee6b7330841a156c6fd215
- SHA512 58e80f050785b5f10e70f151917d09aed7963ee15be2a8047e8a263e6f4892e4be88d50cb212e00f606fa3e8e1d493abbfd3909d078f74c67e25c348c11fb38d
- SSDEEP 384:PjPZJhBHhaJ7IuhXgQ2DTkPqhjbRj+Yg7hZaYbBh4HFE:PjbhxhwIhDcqlbU7hIYbMC
- TLSH T17943FC0691E5F806D2FA22F306D9CD3ECADAF6619470E642F97C957EA42779D000933B
- MD5 SHA1 SHA512 SSDEEP TLSH