cdf8e1012400896e603aceb7d9bce167b2eeb54f6b0f194f4603efbe2db001f0

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
29/05/2026, 18:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
DocuSign.msi
Size 8.2MB
Sample260529-wvx3qset9n
SHA256 cdf8e1012400896e603aceb7d9bce167b2eeb54f6b0f194f4603efbe2db001f0
MD5 80034b172310ced0f33f1e641545f9aa
SHA1 84c3edb559a402c5a02a6d5960fe6f385ce89c90
SHA512 35f0ae8e077085eb84ec6b888ee960a32d5ee7e2968fddbef0de4bcb773e5e6ddf47147cbe0286c00bd34c2e5a247263f78af153ebed82a185bf01eb25701a37
SSDEEP 196608:yWVkavHTZiV06F/Sn8gYasBQNE42hz0O5HyIfR1V:FkavHEV06FfM8z0O5rR1
TLSH
T1A3862319BBE408BAE9B74276C4578025EFB2BC4C3761D2AF03A4710D8F36794717AB61
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery execution persistence privilege_escalation ransomware

Malware Config

Signatures

Badlisted process makes network request 13 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
5	4564	msiexec.exe
7	4564	msiexec.exe
44	1836	rundll32.exe
45	4020	rundll32.exe
47	5152	powershell.exe
49	5152	powershell.exe
51	5692	powershell.exe
53	5692	powershell.exe
55	5692	powershell.exe
56	5692	powershell.exe
60	5692	powershell.exe
65	5692	powershell.exe
69	2012	rundll32.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
5152	powershell.exe
5692	powershell.exe

Executes dropped EXE 3 IoCs

pid	Process
3184	AteraAgent.exe
3944	AteraAgent.exe
4608	dotnet.exe

Loads dropped DLL 24 IoCs

pid	Process
3608	MsiExec.exe
1308	rundll32.exe
1308	rundll32.exe
1308	rundll32.exe
3608	MsiExec.exe
1836	rundll32.exe
1836	rundll32.exe
1836	rundll32.exe
3608	MsiExec.exe
4020	rundll32.exe
4020	rundll32.exe
4020	rundll32.exe
3608	MsiExec.exe
4168	rundll32.exe
4168	rundll32.exe
4168	rundll32.exe
4360	MsiExec.exe
4360	MsiExec.exe
4360	MsiExec.exe
4608	dotnet.exe
3608	MsiExec.exe
2012	rundll32.exe
2012	rundll32.exe
2012	rundll32.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe

Drops file in System32 directory 8 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B66240B0F6C84BD4857ABA60CF5CE4A0_5043E0F5DF723415C9EECC201C838A62	AteraAgent.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\75CA58072B9926F763A91F0CC2798706_3AD253ACA02D44EA5FD30683B8A5B5FA	AteraAgent.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B66240B0F6C84BD4857ABA60CF5CE4A0_5043E0F5DF723415C9EECC201C838A62	AteraAgent.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\BAD725C80F9E10846F35D039A996E4A8_88B6AE015495C1ECC395D19C1DD02894	AteraAgent.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\BAD725C80F9E10846F35D039A996E4A8_88B6AE015495C1ECC395D19C1DD02894	AteraAgent.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\75CA58072B9926F763A91F0CC2798706_3AD253ACA02D44EA5FD30683B8A5B5FA	AteraAgent.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\D1BEC81CCAFDC823A062FF26A89A6B6D_A426B80027CB371A3A5318B09E4B1A4A	AteraAgent.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\D1BEC81CCAFDC823A062FF26A89A6B6D_A426B80027CB371A3A5318B09E4B1A4A	AteraAgent.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\8.0.27\System.Diagnostics.Debug.dll	powershell.exe
File created	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\8.0.27\System.Reflection.Emit.ILGeneration.dll	powershell.exe
File created	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\8.0.27\System.Runtime.dll	powershell.exe
File created	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\8.0.27\System.Runtime.InteropServices.dll	powershell.exe
File opened for modification	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\8.0.27\System.Runtime.Serialization.Formatters.dll	powershell.exe
File opened for modification	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\8.0.27\System.Security.SecureString.dll	powershell.exe
File created	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\8.0.27\mscorrc.dll	powershell.exe
File created	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\8.0.27\System.Diagnostics.Tracing.dll	powershell.exe
File opened for modification	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\8.0.27\System.IO.FileSystem.Primitives.dll	powershell.exe
File opened for modification	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\8.0.27\System.Linq.Queryable.dll	powershell.exe
File opened for modification	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\8.0.27\System.Net.Security.dll	powershell.exe
File opened for modification	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\8.0.27\System.Net.WebClient.dll	powershell.exe
File created	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\8.0.27\mscorlib.dll	powershell.exe
File opened for modification	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\8.0.27\System.AppContext.dll	powershell.exe
File created	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\8.0.27\System.Core.dll	powershell.exe
File opened for modification	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\8.0.27\System.Diagnostics.TextWriterTraceListener.dll	powershell.exe
File opened for modification	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\8.0.27\System.IO.FileSystem.dll	powershell.exe
File opened for modification	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\8.0.27\System.Runtime.Loader.dll	powershell.exe
File created	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\8.0.27\System.Security.Cryptography.Algorithms.dll	powershell.exe
File created	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\8.0.27\System.Security.Cryptography.dll	powershell.exe
File opened for modification	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\8.0.27\Microsoft.DiaSymReader.Native.amd64.dll	powershell.exe
File created	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\8.0.27\System.AppContext.dll	powershell.exe
File opened for modification	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\8.0.27\System.Console.dll	powershell.exe
File created	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\8.0.27\System.Net.NetworkInformation.dll	powershell.exe
File opened for modification	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\8.0.27\System.Private.Xml.dll	powershell.exe
File created	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\8.0.27\System.Runtime.Handles.dll	powershell.exe
File created	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\8.0.27\System.Security.Cryptography.Encoding.dll	powershell.exe
File created	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\8.0.27\System.Security.Cryptography.Primitives.dll	powershell.exe
File created	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\8.0.27\Microsoft.VisualBasic.dll	powershell.exe
File created	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\8.0.27\System.Collections.Immutable.dll	powershell.exe
File created	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\8.0.27\System.Drawing.dll	powershell.exe
File opened for modification	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\8.0.27\System.Net.WebHeaderCollection.dll	powershell.exe
File opened for modification	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\8.0.27\System.ObjectModel.dll	powershell.exe
File created	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\8.0.27\System.Text.Json.dll	powershell.exe
File opened for modification	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\8.0.27\System.Xml.XPath.dll	powershell.exe
File opened for modification	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\8.0.27\System.Collections.NonGeneric.dll	powershell.exe
File opened for modification	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\8.0.27\System.ComponentModel.EventBasedAsync.dll	powershell.exe
File created	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\8.0.27\System.Data.DataSetExtensions.dll	powershell.exe
File opened for modification	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\8.0.27\System.Drawing.dll	powershell.exe
File opened for modification	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\8.0.27\System.Globalization.Calendars.dll	powershell.exe
File opened for modification	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\8.0.27\System.IO.Compression.FileSystem.dll	powershell.exe
File opened for modification	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\8.0.27\System.Security.Cryptography.Primitives.dll	powershell.exe
File created	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\8.0.27\System.Threading.Overlapped.dll	powershell.exe
File created	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\e33701c2-3775-4873-871d-b0f62a7552d3	powershell.exe
File opened for modification	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\8.0.27\System.Diagnostics.StackTrace.dll	powershell.exe
File opened for modification	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\8.0.27\System.Net.WebProxy.dll	powershell.exe
File created	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\8.0.27\System.Reflection.Emit.dll	powershell.exe
File opened for modification	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\8.0.27\System.Text.Encodings.Web.dll	powershell.exe
File opened for modification	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\8.0.27\System.Threading.Tasks.dll	powershell.exe
File created	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\8.0.27\System.Xml.ReaderWriter.dll	powershell.exe
File opened for modification	C:\Program Files\ATERA Networks\AteraAgent\Agent\.settings.backup.json	AteraAgent.exe
File opened for modification	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\8.0.27\System.ComponentModel.Primitives.dll	powershell.exe
File created	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\8.0.27\System.Formats.Asn1.dll	powershell.exe
File opened for modification	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\8.0.27\System.Net.Http.dll	powershell.exe
File created	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\8.0.27\System.Runtime.Serialization.Formatters.dll	powershell.exe
File created	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\8.0.27\System.Runtime.Serialization.Json.dll	powershell.exe
File opened for modification	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\8.0.27\System.Runtime.Serialization.Json.dll	powershell.exe
File opened for modification	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\8.0.27\System.Security.Cryptography.Algorithms.dll	powershell.exe
File opened for modification	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\8.0.27\Microsoft.VisualBasic.dll	powershell.exe
File created	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\8.0.27\System.Console.dll	powershell.exe
File opened for modification	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\8.0.27\System.Runtime.Extensions.dll	powershell.exe
File created	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\8.0.27\System.Runtime.Serialization.Xml.dll	powershell.exe
File created	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\8.0.27\System.Security.Cryptography.Csp.dll	powershell.exe
File created	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\8.0.27\System.Text.RegularExpressions.dll	powershell.exe

Drops file in Windows directory 31 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\SFXCA574FF7353248F53BFC41B70248B5D753\WixToolset.Dtf.WindowsInstaller.dll	rundll32.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\SFXCA751849EAD845521A4236887D069A39E0\CustomAction.config	rundll32.exe
File opened for modification	C:\Windows\Installer\SFXCADAC5897A4449F6FA0E726CA2B0B8B9E1\Atera.Agent.Installer.Msi.Ca.dll	rundll32.exe
File created	C:\Windows\Installer\e585ab0.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e585aae.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\SFXCA751849EAD845521A4236887D069A39E0\Atera.Agent.Installer.Msi.Ca.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI72EE.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI5CA3.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\SFXCADAC5897A4449F6FA0E726CA2B0B8B9E1\WixToolset.Dtf.WindowsInstaller.dll	rundll32.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI71E3.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\SFXCA97483EB10242C2193CE50EA13A0CE6D3\Atera.Agent.Installer.Msi.Ca.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\SFXCA97483EB10242C2193CE50EA13A0CE6D3\WixToolset.Dtf.WindowsInstaller.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI7706.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIA953.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\SFXCA574FF7353248F53BFC41B70248B5D753\Atera.Agent.Installer.Msi.Ca.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI6D2E.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\SFXCA97483EB10242C2193CE50EA13A0CE6D3\CustomAction.config	rundll32.exe
File opened for modification	C:\Windows\Installer\SFXCA62092D9A0746B3BABF1994E429FAD8D3\Atera.Agent.Installer.Msi.Ca.dll	rundll32.exe
File created	C:\Windows\Installer\e585aae.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\SFXCA574FF7353248F53BFC41B70248B5D753\CustomAction.config	rundll32.exe
File opened for modification	C:\Windows\Installer\SFXCA751849EAD845521A4236887D069A39E0\WixToolset.Dtf.WindowsInstaller.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\SourceHash{6B6212C4-F69F-4711-B8B4-FF50D151913E}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI81D4.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI5B69.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\SFXCADAC5897A4449F6FA0E726CA2B0B8B9E1\CustomAction.config	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI71C3.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\SFXCA62092D9A0746B3BABF1994E429FAD8D3\WixToolset.Dtf.WindowsInstaller.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\SFXCA62092D9A0746B3BABF1994E429FAD8D3\CustomAction.config	rundll32.exe

Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs

persistence privilege_escalation

Installer Packages

T1546.016

Msiexec

T1218.007

pid	Process
4564	msiexec.exe

System Time Discovery 1 TTPs 4 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4168	rundll32.exe
5692	powershell.exe
2540	cmd.exe
4608	dotnet.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 000000000400000041efd9123c6b0a670000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff00000000270101000008000041efd9120000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed35000000ffffffff00000000070001000068090041efd912000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff350000000000000005000000ffffffff000000000700010000f8ff1a41efd912000000000000f0ff350000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d41efd912000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPublisher\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPublisher\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPublisher\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	AteraAgent.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28\52C64B7E\@%SystemRoot%\System32\fveui.dll,-844 = "BitLocker Data Recovery Agent"	AteraAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPublisher\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPublisher	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28\52C64B7E\@%SystemRoot%\System32\ci.dll,-101 = "Enclave"	AteraAgent.exe

Modifies registry class 22 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\4C2126B6F96F11748B4BFF051D1519E3\AteraAgentFeature	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4C2126B6F96F11748B4BFF051D1519E3	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4C2126B6F96F11748B4BFF051D1519E3\Assignment = "1"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4C2126B6F96F11748B4BFF051D1519E3\AdvertiseFlags = "388"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4C2126B6F96F11748B4BFF051D1519E3\InstanceType = "0"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4C2126B6F96F11748B4BFF051D1519E3\AuthorizedLUAApp = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4C2126B6F96F11748B4BFF051D1519E3\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4C2126B6F96F11748B4BFF051D1519E3\PackageCode = "A727890584FB3D6438AC20A20A80314B"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4C2126B6F96F11748B4BFF051D1519E3\DeploymentFlags = "3"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\25F46F8180ECF4345A1FA7A8935DE9AE	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\25F46F8180ECF4345A1FA7A8935DE9AE\4C2126B6F96F11748B4BFF051D1519E3	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4C2126B6F96F11748B4BFF051D1519E3\SourceList	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4C2126B6F96F11748B4BFF051D1519E3\Clients = 3a0000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4C2126B6F96F11748B4BFF051D1519E3\SourceList\PackageName = "DocuSign.msi"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4C2126B6F96F11748B4BFF051D1519E3\SourceList\Net	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4C2126B6F96F11748B4BFF051D1519E3\SourceList\Media	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\4C2126B6F96F11748B4BFF051D1519E3	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4C2126B6F96F11748B4BFF051D1519E3\ProductName = "AteraAgent"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4C2126B6F96F11748B4BFF051D1519E3\Language = "1033"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4C2126B6F96F11748B4BFF051D1519E3\Version = "33882124"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4C2126B6F96F11748B4BFF051D1519E3\SourceList\Media\1 = ";"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4C2126B6F96F11748B4BFF051D1519E3\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe

Suspicious behavior: EnumeratesProcesses 35 IoCs

pid	Process
1836	rundll32.exe
1836	rundll32.exe
4296	msiexec.exe
4296	msiexec.exe
3184	AteraAgent.exe
3184	AteraAgent.exe
5152	powershell.exe
5152	powershell.exe
5152	powershell.exe
5692	powershell.exe
5692	powershell.exe
5692	powershell.exe
3944	AteraAgent.exe
3944	AteraAgent.exe
3944	AteraAgent.exe
3944	AteraAgent.exe
3944	AteraAgent.exe
3944	AteraAgent.exe
3944	AteraAgent.exe
3944	AteraAgent.exe
3944	AteraAgent.exe
3944	AteraAgent.exe
3944	AteraAgent.exe
3944	AteraAgent.exe
3944	AteraAgent.exe
3944	AteraAgent.exe
3944	AteraAgent.exe
3944	AteraAgent.exe
3944	AteraAgent.exe
3944	AteraAgent.exe
3944	AteraAgent.exe
3944	AteraAgent.exe
3944	AteraAgent.exe
3944	AteraAgent.exe
3944	AteraAgent.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4564	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4564	msiexec.exe
Token: SeSecurityPrivilege	4296	msiexec.exe
Token: SeCreateTokenPrivilege	4564	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	4564	msiexec.exe
Token: SeLockMemoryPrivilege	4564	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4564	msiexec.exe
Token: SeMachineAccountPrivilege	4564	msiexec.exe
Token: SeTcbPrivilege	4564	msiexec.exe
Token: SeSecurityPrivilege	4564	msiexec.exe
Token: SeTakeOwnershipPrivilege	4564	msiexec.exe
Token: SeLoadDriverPrivilege	4564	msiexec.exe
Token: SeSystemProfilePrivilege	4564	msiexec.exe
Token: SeSystemtimePrivilege	4564	msiexec.exe
Token: SeProfSingleProcessPrivilege	4564	msiexec.exe
Token: SeIncBasePriorityPrivilege	4564	msiexec.exe
Token: SeCreatePagefilePrivilege	4564	msiexec.exe
Token: SeCreatePermanentPrivilege	4564	msiexec.exe
Token: SeBackupPrivilege	4564	msiexec.exe
Token: SeRestorePrivilege	4564	msiexec.exe
Token: SeShutdownPrivilege	4564	msiexec.exe
Token: SeDebugPrivilege	4564	msiexec.exe
Token: SeAuditPrivilege	4564	msiexec.exe
Token: SeSystemEnvironmentPrivilege	4564	msiexec.exe
Token: SeChangeNotifyPrivilege	4564	msiexec.exe
Token: SeRemoteShutdownPrivilege	4564	msiexec.exe
Token: SeUndockPrivilege	4564	msiexec.exe
Token: SeSyncAgentPrivilege	4564	msiexec.exe
Token: SeEnableDelegationPrivilege	4564	msiexec.exe
Token: SeManageVolumePrivilege	4564	msiexec.exe
Token: SeImpersonatePrivilege	4564	msiexec.exe
Token: SeCreateGlobalPrivilege	4564	msiexec.exe
Token: SeBackupPrivilege	4056	vssvc.exe
Token: SeRestorePrivilege	4056	vssvc.exe
Token: SeAuditPrivilege	4056	vssvc.exe
Token: SeBackupPrivilege	4296	msiexec.exe
Token: SeRestorePrivilege	4296	msiexec.exe
Token: SeRestorePrivilege	4296	msiexec.exe
Token: SeTakeOwnershipPrivilege	4296	msiexec.exe
Token: SeRestorePrivilege	4296	msiexec.exe
Token: SeTakeOwnershipPrivilege	4296	msiexec.exe
Token: SeDebugPrivilege	1308	rundll32.exe
Token: SeRestorePrivilege	4296	msiexec.exe
Token: SeTakeOwnershipPrivilege	4296	msiexec.exe
Token: SeDebugPrivilege	1836	rundll32.exe
Token: SeRestorePrivilege	4296	msiexec.exe
Token: SeTakeOwnershipPrivilege	4296	msiexec.exe
Token: SeDebugPrivilege	4020	rundll32.exe
Token: SeRestorePrivilege	4296	msiexec.exe
Token: SeTakeOwnershipPrivilege	4296	msiexec.exe
Token: SeRestorePrivilege	4296	msiexec.exe
Token: SeTakeOwnershipPrivilege	4296	msiexec.exe
Token: SeDebugPrivilege	4168	rundll32.exe
Token: SeRestorePrivilege	4296	msiexec.exe
Token: SeTakeOwnershipPrivilege	4296	msiexec.exe
Token: SeDebugPrivilege	3184	AteraAgent.exe
Token: SeRestorePrivilege	4296	msiexec.exe
Token: SeTakeOwnershipPrivilege	4296	msiexec.exe
Token: SeDebugPrivilege	5152	powershell.exe
Token: SeRestorePrivilege	4296	msiexec.exe
Token: SeTakeOwnershipPrivilege	4296	msiexec.exe
Token: SeDebugPrivilege	5692	powershell.exe
Token: SeBackupPrivilege	5488	srtasks.exe
Token: SeRestorePrivilege	5488	srtasks.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
4564	msiexec.exe
4564	msiexec.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 4296 wrote to memory of 5488	4296	msiexec.exe	103
PID 4296 wrote to memory of 3608	4296	msiexec.exe	105
PID 3608 wrote to memory of 1308	3608	MsiExec.exe	106
PID 3608 wrote to memory of 1836	3608	MsiExec.exe	107
PID 3608 wrote to memory of 4020	3608	MsiExec.exe	111
PID 3608 wrote to memory of 4168	3608	MsiExec.exe	113
PID 4296 wrote to memory of 4360	4296	msiexec.exe	114
PID 4360 wrote to memory of 3184	4360	MsiExec.exe	115
PID 4360 wrote to memory of 5152	4360	MsiExec.exe	117
PID 4360 wrote to memory of 5692	4360	MsiExec.exe	120
PID 3944 wrote to memory of 2540	3944	AteraAgent.exe	127
PID 2540 wrote to memory of 4608	2540	cmd.exe	129
PID 3608 wrote to memory of 2012	3608	MsiExec.exe	131

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\DocuSign.msi
1⤵
- Badlisted process makes network request
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4564

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4296
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:5488
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding 864888BB249E95FA4992090BB826B3C5
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:3608
- - C:\Windows\system32\rundll32.exe
    rundll32.exe "C:\Windows\Installer\MSI5B69.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240671703 2 Atera.Agent.Installer.Msi.Ca!Atera.Agent.Installer.Msi.Ca.CustomActions.GenerateAgentId
    3⤵
    - Loads dropped DLL
    - Drops file in Windows directory
    - Suspicious use of AdjustPrivilegeToken
    PID:1308
- - C:\Windows\system32\rundll32.exe
    rundll32.exe "C:\Windows\Installer\MSI5CA3.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240671921 6 Atera.Agent.Installer.Msi.Ca!Atera.Agent.Installer.Msi.Ca.CustomActions.ShouldContinueInstallation
    3⤵
    - Badlisted process makes network request
    - Loads dropped DLL
    - Drops file in Windows directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1836
- - C:\Windows\system32\rundll32.exe
    rundll32.exe "C:\Windows\Installer\MSI6D2E.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240676156 10 Atera.Agent.Installer.Msi.Ca!Atera.Agent.Installer.Msi.Ca.CustomActions.ReportMsiInstallStart
    3⤵
    - Badlisted process makes network request
    - Loads dropped DLL
    - Drops file in Windows directory
    - Suspicious use of AdjustPrivilegeToken
    PID:4020
- - C:\Windows\system32\rundll32.exe
    rundll32.exe "C:\Windows\Installer\MSI71E3.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240677359 15 Atera.Agent.Installer.Msi.Ca!Atera.Agent.Installer.Msi.Ca.CustomActions.DetectDotNetFrameworkRuntime
    3⤵
    - Loads dropped DLL
    - Drops file in Windows directory
    - System Time Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4168
- - C:\Windows\system32\rundll32.exe
    rundll32.exe "C:\Windows\Installer\MSIA953.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240691546 31 Atera.Agent.Installer.Msi.Ca!Atera.Agent.Installer.Msi.Ca.CustomActions.ReportMsiInstallEnd
    3⤵
    - Badlisted process makes network request
    - Loads dropped DLL
    - Drops file in Windows directory
    PID:2012
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding 4F12C0F57B527F26587CCD8A16BEB1D1 E Global\MSI0000
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:4360
- - C:\Program Files\ATERA Networks\AteraAgent\Agent\AteraAgent.exe
    "C:\Program Files\ATERA Networks\AteraAgent\Agent\AteraAgent.exe" init-settings --agent-id "4b73f7cd-7ae4-4aa8-8a4d-d89c3eb170d7" --account-id "1YQa15qEdxo/AZJk300eVU1MMDBQMDO2SuShs2nCsGA=" --environment "Production" --customer-id "1" --folder-id ""
    3⤵
    - Executes dropped EXE
    - Drops file in Program Files directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3184
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" -ExecutionPolicy Bypass -NoProfile -Command "[Net.ServicePointManager]::SecurityProtocol=[Net.SecurityProtocolType]::Tls12;Invoke-WebRequest -Uri 'https://dot.net/v1/dotnet-install.ps1' -OutFile \"C:\Program Files\ATERA Networks\AteraAgent\Agent\dotnet-install.ps1\""
    3⤵
    - Badlisted process makes network request
    - Command and Scripting Interpreter: PowerShell
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5152
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" -ExecutionPolicy unrestricted -NoProfile -File "C:\Program Files\ATERA Networks\AteraAgent\Agent\dotnet-install.ps1" -Channel 8.0 -Runtime dotnet -InstallDir "C:\Program Files\ATERA Networks\AteraAgent\Agent\\.dotnet"
    3⤵
    - Badlisted process makes network request
    - Command and Scripting Interpreter: PowerShell
    - Drops file in Program Files directory
    - System Time Discovery
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5692

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:4056

C:\Program Files\ATERA Networks\AteraAgent\Agent\AteraAgent.exe
"C:\Program Files\ATERA Networks\AteraAgent\Agent\AteraAgent.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3944
- C:\Windows\system32\cmd.exe
  "cmd.exe" /c "C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\dotnet.exe" --list-runtimes
  2⤵
  - System Time Discovery
  - Suspicious use of WriteProcessMemory
  PID:2540
- - C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\dotnet.exe
    "C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\dotnet.exe" --list-runtimes
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Time Discovery
    PID:4608

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Event Triggered Execution

T1546

Installer Packages

T1546.016

Privilege Escalation

Event Triggered Execution

T1546

Installer Packages

T1546.016

Defense Evasion

System Binary Proxy Execution

T1218

Msiexec

T1218.007

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e585aaf.rbs

Path C:\Config.Msi\e585aaf.rbs
Size 7KB
SHA256 9e7064b7b30a06718d40fd791bd47d27f78510b9ae204b78418972520b7e2eae
MD5 0361c2ba29e54260250c7fa5c2652e84
SHA1 4f2c0852e8157c4c22af3b93a7ecc41dd25b9155
SHA512 d5d85b69810234f4a695cf3773712d7cf06832db446097e212447f4ae47ed245e1876d89a7e449f204d87ee78495a40b57059473c5c5c5fb32496f87674bf57f
SSDEEP 96:CmqpQpz5s3Ire+IqJUBPLxCsTlXUBPLxC6jNovh+TlNQH5K9WdstWC+pljNFzEjR:jqCz5M6eGCpEImpEktQW7+pLm
TLSH
T192F12201760086EAFA661FB0C707172137B6D3E9C620735B1AEE80649F5778D6E6C38E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\dotnet.exe
Size 153KB
SHA256 07f5d2cce93e97878a765fd81d1981acc3b21be0fdfb519cf0544ca2ae2d0ab5
MD5 ef0405cc101e12e221899e0e0a5cc162
SHA1 cabcc37327d854ed9859b1bbebacd608e5f8d6ad
SHA512 c2e9fc696928f3450466c2978f83f77aa0bbd7d9ab04d362d26ff9b3dbf0c67a7d7bb122dbdd02695a9dfcc25ade3f9dec46d5db8be07adee50b26388623e8fd
SSDEEP 1536:NyPL142CnQwPtrKq4zAl8ZVVZh6ecdYt4aXMFG0vcTJhfzrn:NyP22CplCO8n06t4aXMSTJJ/n
TLSH
T151F3071AD65811AAD1AE8575CB518A41BB337C6587E0E3CB57C0FCBE0F326905EE9703
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hostfxr.dll

Path C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\host\fxr\8.0.27\hostfxr.dll
Size 357KB
SHA256 0a495d3a7befebf627a973760439da0f7f1f1667b99832f083664fac7641d2dc
MD5 2756893fc2cfe0036b926d1ff5f6c2fc
SHA1 cb4b8b21828ba738e6bfa619f99335756842148f
SHA512 094d8b233facb5983f72b8c624f1f59aeb62063f695d55a79ba343b929015e73fb4b7f5eb16fe39881f8462822f7d7502ac2d62c4fa01c9686035de28d459617
SSDEEP 6144:+E7Djww5R1Gv0crFfeUtJ9NZFSKJGDjq/2n1NonJLSHD6DPDh+vJpmE08QxsTZ6H:5MjrFPJ+OyUriJ4E8KtXZPK
TLSH
T1C6741916D6E8017CF0B7D679CAB28901EB727C494BB196CF139099661E73BD09E39323
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

.settings.json

Path C:\Program Files\ATERA Networks\AteraAgent\Agent\.settings.json
Size 179B
SHA256 73af3df7b3389d7a3888ec3feda86f2d5ea52a8cf3b8281ad007a675e0f07471
MD5 0e7d8cf3824fd19140d0b2c4f5437243
SHA1 40666fff1ef8ed721760c4475ee73859e10f6510
SHA512 3243d563eed9bfa5b33b11d60d72e01a8796d275d4f8134ad1a99997579ce223d3e57a59e400a9c3720bbf07f53056fef6b0b284c5287d8d96d59983319e96e3
TLSH
T1A9C0C08895F26108F30398704C0F0B1D08337301DEC01F0430C32004D9213D259A114E
MD5 SHA1 SHA512 TLSH

Submit Download

AteraAgent.exe

Path C:\Program Files\ATERA Networks\AteraAgent\Agent\AteraAgent.exe
Size 21.1MB
SHA256 93d6fe2287fb4a0d5466a5b466bd1838d5ba53f6e90fae960a1c709dde52062b
MD5 0cfb08cf35f43ca44a6195ea39903e6b
SHA1 b5daeb0bab48f357bb83b6c837511d98a170695b
SHA512 ab60cfc7ecc888a50e6b29cb36a1034e076bc5cd2c1b4316d292fd18454c9a0008ad57a0db23a35b904458dee7280aeb6c5eaa556ee8a2581165a627f94820af
SSDEEP 196608:gFRwrPgM2TfNNYTHM6GdD/KNjg1pHCEdDB0fEDGWXQTADWvCw0o2:gumbnzdONq/GOQTAh
TLSH
T1EC279C11A3F8426AE6BFC378C4724116D7F278462721EBCF2558A5E92E33BC05A75363
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

agent.cert.pfx

Path C:\Program Files\ATERA Networks\AteraAgent\Agent\certificates\production\agent.cert.pfx
Size 2KB
SHA256 13eedf9ee121c26790c87b2bc6e05d053ed8cdf87fbb37c41caf6b6f19665daf
MD5 05a8f7605ad32100306a1035128b6483
SHA1 778627fdd0e5cc7929ac9077bcd3ce2cf644fda8
SHA512 6ffd8568fa01799067a0df270746b42d5e233fb6f218146953baa28c7a2b087b47d4691f17b8292229a471432b10bbb38551afac917693ac5c519407a64aa322
TLSH
T17D511A01D3784653B57E9FCDF8EE67CA481256449B5EF0F79270729A0026090F9986F1
MD5 SHA1 SHA512 TLSH

Submit Download

dotnet-install.ps1

Path C:\Program Files\ATERA Networks\AteraAgent\Agent\dotnet-install.ps1
Size 74KB
SHA256 6585899aed55ff6ae13dbe1e8c3b878f2d00433520e7efbe250b75db948b7da9
MD5 ce99fb45197526495b33bb5985e53da6
SHA1 97fa2c17a9c156e2a56d799f1dd12271646b58ef
SHA512 7a0eb00023b8fed5cb98eaaac4b72211df8980bf52c6aa85767e83e70ddc9fb8df9a9fc8d1f8d32872ac266a40811eb0d6189ee98462fdb54f65df8769a803cb
SSDEEP 768:GQy0YIw0FI6Szz3G4yYijvbpyspfD2euFI1Fb2JPJFId4zT2C0U8qzqogdXMhDZ5:GSY7PwYU1JCf8qzjfcn4J4XQZcG2JYX
TLSH
T18C731A9EAD429032547363B8C96B1084FB37427B524541A8F8DDD4887F7262D93A2FEF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
Size 471B
SHA256 ad5b506e0a5c2db99afa567bbda74d3ca0fdec30b0185bcc2b9abf2f62e9ad7b
MD5 0dcbd66d687b3210c96ea5d00dedf8fe
SHA1 f6834f9d7f5673a3638a65e372ebc56d593c8a34
SHA512 47fa734d77069de9b8f4dbf9bd6d68433f3fbcc5769868362789229e2544284eaf4d82d858359be73f5b0a9928b54142c325352b063599ce5a807a765e1152ce
TLSH
T174F0DC3FA8FA5592351F18A80BF5991030EAB6CF08C2823A347425C4855FEA1610A809
MD5 SHA1 SHA512 TLSH

Submit Download

8EC9B1D0ABBD7F98B401D425828828CE_6FBFBE34ABAF2109B411B965FB39009E

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_6FBFBE34ABAF2109B411B965FB39009E
Size 727B
SHA256 ae70e5ca10f73c994474e487f7f2186da679f9bc4bf65fc225c9e0266cf15eda
MD5 93af4da2c5c5a2e39ed583bb3f903116
SHA1 de27792eaccb86f0e5df51e9225f757d2ed6a45c
SHA512 3ba00f669399dd69894a10053de260d271a6048abf48da558aa5b0bad71eea76a25fd8fe4e2f419425e9daf5fc5dafae148a111a9f870d344d2407f344efb737
TLSH
T1D301990119854F90DDA1CA44EF8C0B6C35DD852160C9471F7378708DD2D179037C358E
MD5 SHA1 SHA512 TLSH

Submit Download

C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
Size 727B
SHA256 8360cc6f51681fb6e2af86774f6ac60fe7cf57a08070f59aafe50a9bf3172a56
MD5 6fb96c657cc31897574343ee248bbc24
SHA1 cc9334595c1fee33f285ba1473b01d8a88adef7f
SHA512 ffe30bbc5c541c343f26c715a2491571892cd04e5c8ca66dcbd967cfb458fbffdb4f25389ca62b5cd0d17952eac60c465d9e43e9e066d0e585b7ce15b6b9a5f3
TLSH
T16C01441B14FBBCD475740BD8F7AE8AF9BBF1A38520C90161A77839999281FD09803B64
MD5 SHA1 SHA512 TLSH

Submit Download

698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
Size 400B
SHA256 8472a9e2bbb110cdc9d19a24d3a13705ba6b26fb4975856ba874ac3ae4c1ae7d
MD5 8e3f5d23aa57a4f5788ed276e9089377
SHA1 238b0f8a0f4970065d52dce2175b3d9dedf1705b
SHA512 e02f526636abef02d206409757d1541296e04f05bbd9a4998389eda41a3d985ab7c10fce196f0f202cf5877905051b3ea47c4924744c7c9e334ba738385d05ce
TLSH
T126E020302BFE512EF264DB7807D9D196AF29F1022C9466BE04C1182D6915E004C93D30
MD5 SHA1 SHA512 TLSH

Submit Download

8EC9B1D0ABBD7F98B401D425828828CE_6FBFBE34ABAF2109B411B965FB39009E

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_6FBFBE34ABAF2109B411B965FB39009E
Size 408B
SHA256 52ef7878886e29b0c3978b251c51cad334a4243b4795ad6ee829ad9e35ff354a
MD5 66eb61a374180275f0de53c5dbf9bd19
SHA1 95bd6100dc571a9e534cd39ec55fa1d11a49304d
SHA512 bca580b3481384a45613aeed225b6a0ddb86e950eb6b9ec121a78d3dd30f75aaad46f56e9ff1650bc83f838daa4e677800116625d087699b564b9db0081a3ca7
TLSH
T197E0C63071FB429EF2F4E83842F1BD6B489AF3030801837A108053A2FB11B008CE2238
MD5 SHA1 SHA512 TLSH

Submit Download

C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
Size 412B
SHA256 d7fa97014d88f974a0e64330e2184584b7876b3b0a7dce2a9acd225604402e10
MD5 d02cd9eb4543fa2eff042b59c3a7d03f
SHA1 4f5f75cd62b1238a788c8e6096ed0b9690f8b48d
SHA512 b65ad39a3c5fddd6e47456bda1f80ffabca1bb19eb3e71787e1d4130c933242ffb5924800821fbee73b85e15d11eaa76c61595519863d99470a500dcda221bb2
TLSH
T1C3E02628AAFBA52EF190DC3986FAE1BB5E89F701145497B919D14318FB07F005C10EF4
MD5 SHA1 SHA512 TLSH

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 3b0068d29ae4b20c447227fbf410aa2deedfef6220ccc3f698f3c7707c032c55
MD5 2f57fde6b33e89a63cf0dfdd6e60a351
SHA1 445bf1b07223a04f8a159581a3d37d630273010f
SHA512 42857c5f111bfa163e9f4ea6b81a42233d0bbb0836ecc703ce7e8011b6f8a8eca761f39adc3ed026c9a2f99206d88bab9bddb42da9113e478a31a6382af5c220
TLSH
T15F51EE323375B1D8C9167F071E68198053BF4355EAA4AF1CB69C625EDD2640B9F222F3
MD5 SHA1 SHA512 TLSH

Submit Download

rundll32.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\rundll32.exe.log
Size 847B
SHA256 f0ab05c32d6af3c2b559dbce4dec025ce3e730655a2430ade520e89a557cace8
MD5 66a0a4aa01208ed3d53a5e131a8d030a
SHA1 ef5312ba2b46b51a4d04b574ca1789ac4ff4a6b1
SHA512 626f0dcf0c6bcdc0fef25dc7da058003cf929fd9a39a9f447b79fb139a417532a46f8bca1ff2dbde09abfcd70f5fb4f8d059b1fe91977c377df2f5f751c84c5c
TLSH
T193018EB12361F1D589133F461D9C264407FF4728BA50EE1CB5A9625ED9260275F222F3
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 ab0e475782e364be238bbe72860e880d77a0945676b5366edaf07dca5c868449
MD5 2768bc588760e7b23fbef908498d9fd5
SHA1 8587f45cc860fc0b29caa02130d95dab704afbf5
SHA512 a6d461e4bf328571ecb1f6f0f5ae59961f624b81dd7a43667ab24f2a8dff7ecb466be04a309c0bcb44f3b39ec0ba009eb40e2c70a27dabf1957a2fb653cabab3
TLSH
T1FA117637B39C8A21CC96153A409DAD1172B683C781AEDF9F7BC4D215A0BF984CB712A4
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_uiuem5ld.5ny.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_uiuem5ld.5ny.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

MSI5B69.tmp

Path C:\Windows\Installer\MSI5B69.tmp
Size 340KB
SHA256 1997e4959d6c187e9ae35097b4cc0702e8a1564acb1dec7b080adcaa9b973fd0
MD5 5df8b056b8ad35f9ed4cfff03eeb0e0d
SHA1 22910bbcbe382bde85770699ba70111ee1472b65
SHA512 47e17b536b246a97e465426b8a25350e9889c127b54367a3ae491000b7aa9636712e0b5f852d8229966bb9bb7d045e0dc541ea02a1e52d5fa4a515a17336245d
SSDEEP 6144:apUNpIx1IWpJHOrwIBaiRk7QDQz6VYsSK+kAoXyVk699nsS6:BNp21IWpJkBdk0DQz6QK+kAVv99g
TLSH
T17174BF1977F80DA5FC7B563A89630605E673BC515B70DB9F0360421E9F3B390A93AB22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSI72EE.tmp

Path C:\Windows\Installer\MSI72EE.tmp
Size 390KB
SHA256 7aacd4c18710e9bc4ff2034895a0a0c8f80f21809fb177d520e93f7688216e6d
MD5 e8dc682f2c486075c6aba658971a62cc
SHA1 7cd0a2b5047a4074aa06a6caa3bb69124851e95d
SHA512 a0a1f0f418bf2d4ffd079b840aeb0142c7faab7fa72b5e33b1841798569f55a25dfd305abf9c2ca89792f6499f695b69975882697dc53e99d5a975a9fa8c7d75
SSDEEP 6144:p2ET2+QBLh+MVy5DCRoRRvc181kaKN8MMLuG:p2ET2+cVXVyNhvcCkaKN8Me
TLSH
T10D846B29F7E408EDE4B78276C5A68530FF75748D3320D5AE47A8852D1F3AAA070BB701
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Atera.Agent.Installer.Msi.Ca.dll

Path C:\Windows\Installer\SFXCA574FF7353248F53BFC41B70248B5D753\Atera.Agent.Installer.Msi.Ca.dll
Size 59KB
SHA256 46a2844072f1be835debc683da08d7a37d866c6a4a2b1bff79f9e4bae60d9403
MD5 c2ab0e13e39d5c93c352eb5e0ab16eae
SHA1 9bbd3d30ad61be4c6f5d0c9f40132ff3d81130e8
SHA512 14cd2ec84fbfdf1fc18e1d970e66488e2183bfa60f5ca9f82d6937bafd7e6fa70a16128b39debaae8a2257c0877ced098d67d90745b4d8de29a9720b863ce268
SSDEEP 768:QUak5eO8oX5qqleywzEVf6zRqbpWJARn9b424nNzTX1W4n1RDvaW:QUderqlew8qbpF9b424nFZW4nbDSW
TLSH
T1B753D44073F84719F6FF2FB87E75555489B3BC676932EA4D1A60104E0AB2B80DA60B73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CustomAction.config

Path C:\Windows\Installer\SFXCA751849EAD845521A4236887D069A39E0\CustomAction.config
Size 956B
SHA256 2dbc73a3bc444a9119c9b5e20276698384d9ad9535a8a7547c44d1b9a8d67346
MD5 a9088b24614c12b70af6ae9669a4a4b1
SHA1 d72efa4e0c7bd733ed3d51831ead7031175c27e0
SHA512 14090969a71b6c80023da29dc8582aded6d26ca349966767ce22102080abce118b846a47ea2b9abe2d5f6a788bc083031d27fdee4103e2e4b99d29c2ac494d7c
TLSH
T10811D00D4A946B7724312793BFACA1C4E76194BA3994411CB49BB9151F39938176338F
MD5 SHA1 SHA512 TLSH

Submit Download

WixToolset.Dtf.WindowsInstaller.dll

Path C:\Windows\Installer\SFXCA751849EAD845521A4236887D069A39E0\WixToolset.Dtf.WindowsInstaller.dll
Size 193KB
SHA256 a614884ea627da1925131ebf41e8ae202caeac0fe543b86384f5eb2bfaf1aa75
MD5 ef8d5785ac8669f5fd54e22f52770e6b
SHA1 4c94ae7ef233be33a56c0a5d9b8e2211d5d5792c
SHA512 ab3b140bd6531f22e994606820e6511442c23d9015b1e1a38aaed43aa42ba29a996511151d0b3a383c05c2b11f670e52cdd7f507ad1a1ad8cebea57fb22ade5a
SSDEEP 3072:8Of7tVL+l4lj19l4uDHYHj69UgoTqdda7CnfKlRUjW01KytaljYqCDPC:8gQQx54Hj6jomdrzalMqb
TLSH
T14A149C2A57F84B3ECEFF8778E2614252C7B1F1E67103DB1D9D8281A52163784B682397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e585aae.msi

Path C:\Windows\Installer\e585aae.msi
Size 8.2MB
SHA256 cdf8e1012400896e603aceb7d9bce167b2eeb54f6b0f194f4603efbe2db001f0
MD5 80034b172310ced0f33f1e641545f9aa
SHA1 84c3edb559a402c5a02a6d5960fe6f385ce89c90
SHA512 35f0ae8e077085eb84ec6b888ee960a32d5ee7e2968fddbef0de4bcb773e5e6ddf47147cbe0286c00bd34c2e5a247263f78af153ebed82a185bf01eb25701a37
SSDEEP 196608:yWVkavHTZiV06F/Sn8gYasBQNE42hz0O5HyIfR1V:FkavHEV06FfM8z0O5rR1
TLSH
T1A3862319BBE408BAE9B74276C4578025EFB2BC4C3761D2AF03A4710D8F36794717AB61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TmpB2A1.tmp

Path C:\Windows\Temp\TmpB2A1.tmp
Size 3KB
SHA256 94739ca46676bd602a78671257fbfce39feaabc9664c6326bf4970a0108e3429
MD5 560af444a6a7faa0b0ca94dc16ca2a58
SHA1 df31453fafde354870a0a9a8ca50b18e284c32e4
SHA512 7c853176c088d56a517e52c6687b6debf08f6f9726376720ade9d13fafc9be0ca72f0f2b35562a61ece653aeb789c838c60447f463b2bbe70c21bfc8c039b681
TLSH
T1B3616C88B10E28972CEECC504D495B40AEC3D754B390F25F68F4BCA64CA13E9A358C3C
MD5 SHA1 SHA512 TLSH

Submit Download

metadata-2

Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
Size 24.1MB
SHA256 6f0b8bc47cf8fc9095957dda9c8346a04c2ec56005cfe12241ee4cde70b61488
MD5 b14b4caef201575bb8bb933c424c2ec6
SHA1 3aa1de1a8e0c674d7484f16f8cead9f34cb4f144
SHA512 d6beb75877eb05bb029f922c7746be8b49dc336e365f051a774efb7432b632437d1dc396347d8307e7e2501be0fcaf7f3466c094c0db71b3da1559cb4db80b3b
SSDEEP 24576:du8m+1zcdoO/vvTL7WNeImKZc00jV1dShLmtPC8Vl0aMOqkAIv1UF7GRo:6
TLSH
T1A847C42437FD2210E7F79E3C68F06A27893A7D5B9C159E8D05411F8E0961BB0E872F5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{8826caae-1dea-4c0f-ba7e-77166bfe71e9}_OnDiskSnapshotProp

Path \??\Volume{12d9ef41-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{8826caae-1dea-4c0f-ba7e-77166bfe71e9}_OnDiskSnapshotProp
Size 6KB
SHA256 da776120be9b94d2d9e152440a3acff7d8f9873d19b20c7f2a9682b058c8f6d8
MD5 5324644df55c2848fedee1f5ccbf4df8
SHA1 800e24e46ea1b875959ed7638f4bc074f050a736
SHA512 daa36dfc3d7ce6e0b583bf87c944b7a8c53062fec75bd6be6ff78a519dc09f4cb548b5652fca0f68404651f705917918e758b8b5726148b1e35b46e27cfc19a4
SSDEEP 96:Fccnjvc8DD84LTHzbOHXOHBlBRQ88Sc9XE56tOSVQpu:2+b++ZVm
TLSH
T16DD199085AE54311E2B3AB7129F18557A477B811EF33CB8E0298238E2670A10F935F6F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1308-33-0x0000024845C40000-0x0000024845C74000-memory.dmp

Download

memory/1308-37-0x0000024845AB0000-0x0000024845AC4000-memory.dmp

Download

memory/1836-59-0x0000027AD28A0000-0x0000027AD28DC000-memory.dmp

Download

memory/1836-58-0x0000027AD2840000-0x0000027AD2852000-memory.dmp

Download

memory/5152-123-0x000002A4AD270000-0x000002A4AD292000-memory.dmp

Download

memory/5692-164-0x000001716C690000-0x000001716C6A2000-memory.dmp

Download

memory/5692-163-0x000001716C450000-0x000001716C45A000-memory.dmp

Download

memory/5692-161-0x000001716C6A0000-0x000001716C6C4000-memory.dmp

Download

memory/5692-160-0x000001716C6A0000-0x000001716C6CA000-memory.dmp

Download

memory/5692-159-0x000001716C420000-0x000001716C42A000-memory.dmp

Download

memory/5692-158-0x000001716C460000-0x000001716C515000-memory.dmp

Download

memory/5692-157-0x000001716C440000-0x000001716C45C000-memory.dmp

Download