cdf8e1012400896e603aceb7d9bce167b2eeb54f6b0f194f4603efbe2db001f0

Analysis

max time kernel
149s
max time network
153s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
29/05/2026, 18:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
DocuSign.msi
Size 8.2MB
Sample260529-wvx3qset9n
SHA256 cdf8e1012400896e603aceb7d9bce167b2eeb54f6b0f194f4603efbe2db001f0
MD5 80034b172310ced0f33f1e641545f9aa
SHA1 84c3edb559a402c5a02a6d5960fe6f385ce89c90
SHA512 35f0ae8e077085eb84ec6b888ee960a32d5ee7e2968fddbef0de4bcb773e5e6ddf47147cbe0286c00bd34c2e5a247263f78af153ebed82a185bf01eb25701a37
SSDEEP 196608:yWVkavHTZiV06F/Sn8gYasBQNE42hz0O5HyIfR1V:FkavHEV06FfM8z0O5rR1
TLSH
T1A3862319BBE408BAE9B74276C4578025EFB2BC4C3761D2AF03A4710D8F36794717AB61
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery execution persistence privilege_escalation ransomware

Malware Config

Signatures

Badlisted process makes network request 13 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
2	4692	msiexec.exe
3	4692	msiexec.exe
4	1212	rundll32.exe
5	3532	rundll32.exe
6	5420	powershell.exe
7	5420	powershell.exe
8	5984	powershell.exe
9	5984	powershell.exe
10	5984	powershell.exe
11	5984	powershell.exe
12	5984	powershell.exe
13	5984	powershell.exe
15	5492	rundll32.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
5420	powershell.exe
5984	powershell.exe

Executes dropped EXE 3 IoCs

pid	Process
5236	AteraAgent.exe
1604	AteraAgent.exe
4664	dotnet.exe

Loads dropped DLL 24 IoCs

pid	Process
4524	MsiExec.exe
3496	rundll32.exe
3496	rundll32.exe
3496	rundll32.exe
4524	MsiExec.exe
1212	rundll32.exe
1212	rundll32.exe
1212	rundll32.exe
4524	MsiExec.exe
3532	rundll32.exe
3532	rundll32.exe
3532	rundll32.exe
4524	MsiExec.exe
1692	rundll32.exe
1692	rundll32.exe
1692	rundll32.exe
5360	MsiExec.exe
5360	MsiExec.exe
5360	MsiExec.exe
4664	dotnet.exe
4524	MsiExec.exe
5492	rundll32.exe
5492	rundll32.exe
5492	rundll32.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe

Drops file in System32 directory 8 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B66240B0F6C84BD4857ABA60CF5CE4A0_5043E0F5DF723415C9EECC201C838A62	AteraAgent.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\BAD725C80F9E10846F35D039A996E4A8_88B6AE015495C1ECC395D19C1DD02894	AteraAgent.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\BAD725C80F9E10846F35D039A996E4A8_88B6AE015495C1ECC395D19C1DD02894	AteraAgent.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\75CA58072B9926F763A91F0CC2798706_3AD253ACA02D44EA5FD30683B8A5B5FA	AteraAgent.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B66240B0F6C84BD4857ABA60CF5CE4A0_5043E0F5DF723415C9EECC201C838A62	AteraAgent.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\75CA58072B9926F763A91F0CC2798706_3AD253ACA02D44EA5FD30683B8A5B5FA	AteraAgent.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\D1BEC81CCAFDC823A062FF26A89A6B6D_A426B80027CB371A3A5318B09E4B1A4A	AteraAgent.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\D1BEC81CCAFDC823A062FF26A89A6B6D_A426B80027CB371A3A5318B09E4B1A4A	AteraAgent.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\8.0.27\.version	powershell.exe
File created	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\8.0.27\hostpolicy.dll	powershell.exe
File opened for modification	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\8.0.27\System.IO.IsolatedStorage.dll	powershell.exe
File created	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\8.0.27\System.IO.Pipes.AccessControl.dll	powershell.exe
File opened for modification	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\8.0.27\System.Net.Quic.dll	powershell.exe
File opened for modification	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\8.0.27\System.Resources.ResourceManager.dll	powershell.exe
File opened for modification	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\8.0.27\System.Runtime.Serialization.Json.dll	powershell.exe
File created	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\8.0.27\System.Text.RegularExpressions.dll	powershell.exe
File opened for modification	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\8.0.27\mscorlib.dll	powershell.exe
File created	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\8.0.27\clretwrc.dll	powershell.exe
File opened for modification	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\8.0.27\clrgc.dll	powershell.exe
File created	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\8.0.27\System.Net.HttpListener.dll	powershell.exe
File opened for modification	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\8.0.27\System.Net.Mail.dll	powershell.exe
File created	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\8.0.27\System.Runtime.Extensions.dll	powershell.exe
File opened for modification	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\8.0.27\System.Text.Encoding.dll	powershell.exe
File created	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\8.0.27\System.Xml.XmlDocument.dll	powershell.exe
File opened for modification	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\8.0.27\Microsoft.VisualBasic.dll	powershell.exe
File opened for modification	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\8.0.27\System.IO.MemoryMappedFiles.dll	powershell.exe
File created	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\8.0.27\System.Net.Http.dll	powershell.exe
File created	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\8.0.27\System.Net.Ping.dll	powershell.exe
File created	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\8.0.27\System.Runtime.CompilerServices.VisualC.dll	powershell.exe
File created	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\8.0.27\System.Runtime.Handles.dll	powershell.exe
File created	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\8.0.27\System.Runtime.Serialization.Json.dll	powershell.exe
File opened for modification	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\8.0.27\Microsoft.NETCore.App.deps.json	powershell.exe
File opened for modification	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\8.0.27\System.Console.dll	powershell.exe
File created	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\8.0.27\System.Net.WebHeaderCollection.dll	powershell.exe
File opened for modification	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\8.0.27\System.Windows.dll	powershell.exe
File opened for modification	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\8.0.27\System.Xml.XPath.dll	powershell.exe
File created	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\8.0.27\System.Private.Uri.dll	powershell.exe
File opened for modification	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\8.0.27\System.Security.Cryptography.Algorithms.dll	powershell.exe
File created	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\8.0.27\System.Threading.dll	powershell.exe
File created	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\8.0.27\System.Net.WebClient.dll	powershell.exe
File created	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\8.0.27\System.Resources.Writer.dll	powershell.exe
File opened for modification	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\8.0.27\System.Text.Json.dll	powershell.exe
File opened for modification	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\8.0.27\Microsoft.VisualBasic.Core.dll	powershell.exe
File opened for modification	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\8.0.27\System.Net.NameResolution.dll	powershell.exe
File opened for modification	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\8.0.27\System.Runtime.dll	powershell.exe
File opened for modification	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\8.0.27\System.Security.Claims.dll	powershell.exe
File opened for modification	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\8.0.27\WindowsBase.dll	powershell.exe
File created	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\8.0.27\System.Console.dll	powershell.exe
File created	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\8.0.27\System.Diagnostics.TextWriterTraceListener.dll	powershell.exe
File created	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\8.0.27\System.IO.UnmanagedMemoryStream.dll	powershell.exe
File opened for modification	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\8.0.27\System.Security.Cryptography.Encoding.dll	powershell.exe
File created	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\8.0.27\System.Threading.Tasks.Parallel.dll	powershell.exe
File created	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\8.0.27\WindowsBase.dll	powershell.exe
File opened for modification	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\ThirdPartyNotices.txt	powershell.exe
File opened for modification	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\8.0.27\System.Diagnostics.Debug.dll	powershell.exe
File created	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\8.0.27\System.IO.Compression.dll	powershell.exe
File opened for modification	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\8.0.27\System.IO.FileSystem.Watcher.dll	powershell.exe
File created	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\8.0.27\System.Linq.Expressions.dll	powershell.exe
File opened for modification	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\8.0.27\System.Security.Cryptography.OpenSsl.dll	powershell.exe
File opened for modification	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\8.0.27\System.Threading.dll	powershell.exe
File opened for modification	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\8.0.27\System.ComponentModel.Annotations.dll	powershell.exe
File opened for modification	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\8.0.27\System.ComponentModel.TypeConverter.dll	powershell.exe
File opened for modification	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\8.0.27\System.IO.FileSystem.AccessControl.dll	powershell.exe
File created	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\8.0.27\System.Linq.dll	powershell.exe
File created	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\8.0.27\System.Net.Primitives.dll	powershell.exe
File created	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\8.0.27\System.Net.ServicePoint.dll	powershell.exe
File opened for modification	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\8.0.27\System.Private.CoreLib.dll	powershell.exe
File opened for modification	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\8.0.27\System.Runtime.Serialization.Primitives.dll	powershell.exe
File opened for modification	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\host\fxr\8.0.27\hostfxr.dll	powershell.exe
File opened for modification	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\8.0.27\mscordaccore.dll	powershell.exe
File opened for modification	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\8.0.27\System.Data.Common.dll	powershell.exe
File created	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\8.0.27\System.Data.DataSetExtensions.dll	powershell.exe

Drops file in Windows directory 36 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\MSI5FBF.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\SFXCA27E8F8346E4FEA0AA1C97B13EA3FDF60\CustomAction.config	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI8B89.tmp	msiexec.exe
File created	C:\Windows\Installer\e585ef6.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\SFXCA86BCDA436B44528829369662ABA27196\Atera.Agent.Installer.Msi.Ca.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\SFXCA465E454E6047C51B6C46F5024B84094D\WixToolset.Dtf.WindowsInstaller.dll	rundll32.exe
File created	C:\Windows\SystemTemp\~DF306DDA1D21B789C5.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\e585ef4.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\SFXCA52055C663A4BDA8856CFAE4954234A5D\Atera.Agent.Installer.Msi.Ca.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\SFXCA52055C663A4BDA8856CFAE4954234A5D\WixToolset.Dtf.WindowsInstaller.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI83E7.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\SFXCA86BCDA436B44528829369662ABA27196\WixToolset.Dtf.WindowsInstaller.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\SFXCA86BCDA436B44528829369662ABA27196\CustomAction.config	rundll32.exe
File created	C:\Windows\Installer\e585ef4.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI60AA.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\SFXCA27E8F8346E4FEA0AA1C97B13EA3FDF60\WixToolset.Dtf.WindowsInstaller.dll	rundll32.exe
File created	C:\Windows\SystemTemp\~DFE10F2B1306300BEA.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI7D6C.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIAF9C.tmp	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\SFXCA465E454E6047C51B6C46F5024B84094D\Atera.Agent.Installer.Msi.Ca.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\SFXCA465E454E6047C51B6C46F5024B84094D\CustomAction.config	rundll32.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\SystemTemp\~DF48AF2BDCF9A50A6F.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\SFXCAECE4A4E19C4507782328B14781E8A0E1\Atera.Agent.Installer.Msi.Ca.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\SFXCAECE4A4E19C4507782328B14781E8A0E1\WixToolset.Dtf.WindowsInstaller.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI7E87.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\SFXCA52055C663A4BDA8856CFAE4954234A5D\CustomAction.config	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI7879.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\SFXCA27E8F8346E4FEA0AA1C97B13EA3FDF60\Atera.Agent.Installer.Msi.Ca.dll	rundll32.exe
File created	C:\Windows\SystemTemp\~DF7163E904C4A79F7B.TMP	msiexec.exe
File opened for modification	C:\Windows\SystemTemp\TmpB580.tmp	AteraAgent.exe
File created	C:\Windows\Installer\SourceHash{6B6212C4-F69F-4711-B8B4-FF50D151913E}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI7D4C.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\SFXCAECE4A4E19C4507782328B14781E8A0E1\CustomAction.config	rundll32.exe

Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs

persistence privilege_escalation

Installer Packages

T1546.016

Msiexec

T1218.007

pid	Process
4692	msiexec.exe

System Time Discovery 1 TTPs 4 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5984	powershell.exe
1428	cmd.exe
4664	dotnet.exe
1692	rundll32.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 000000000400000035d00ca4488ad7d50000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff00000000270101000008000035d00ca40000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed35000000ffffffff00000000070001000068090035d00ca4000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff350000000000000005000000ffffffff000000000700010000f8ff1a35d00ca4000000000000f0ff350000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d35d00ca4000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPublisher	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	AteraAgent.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28\52C64B7E\@%SystemRoot%\System32\ci.dll,-100 = "Isolated User Mode (IUM)"	AteraAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPublisher\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPublisher\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28\52C64B7E	AteraAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28\52C64B7E\@%SystemRoot%\System32\ci.dll,-101 = "Enclave"	AteraAgent.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28\52C64B7E\@%SystemRoot%\System32\wuaueng.dll,-400 = "Windows Update"	AteraAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPublisher\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28\52C64B7E\@%SystemRoot%\System32\fveui.dll,-844 = "BitLocker Data Recovery Agent"	AteraAgent.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28\52C64B7E\@%SystemRoot%\system32\WindowsPowerShell\v1.0\powershell.exe,-124 = "Document Encryption"	AteraAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28\52C64B7E\@%SystemRoot%\system32\NgcRecovery.dll,-100 = "Windows Hello Recovery Key Encryption"	AteraAgent.exe

Modifies registry class 22 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4C2126B6F96F11748B4BFF051D1519E3	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4C2126B6F96F11748B4BFF051D1519E3\ProductName = "AteraAgent"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4C2126B6F96F11748B4BFF051D1519E3\AuthorizedLUAApp = "0"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4C2126B6F96F11748B4BFF051D1519E3\DeploymentFlags = "3"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4C2126B6F96F11748B4BFF051D1519E3\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4C2126B6F96F11748B4BFF051D1519E3\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\4C2126B6F96F11748B4BFF051D1519E3\AteraAgentFeature	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4C2126B6F96F11748B4BFF051D1519E3\PackageCode = "A727890584FB3D6438AC20A20A80314B"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4C2126B6F96F11748B4BFF051D1519E3\InstanceType = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\25F46F8180ECF4345A1FA7A8935DE9AE\4C2126B6F96F11748B4BFF051D1519E3	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4C2126B6F96F11748B4BFF051D1519E3\SourceList\PackageName = "DocuSign.msi"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4C2126B6F96F11748B4BFF051D1519E3\Clients = 3a0000000000	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\4C2126B6F96F11748B4BFF051D1519E3	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4C2126B6F96F11748B4BFF051D1519E3\Language = "1033"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4C2126B6F96F11748B4BFF051D1519E3\Version = "33882124"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4C2126B6F96F11748B4BFF051D1519E3\AdvertiseFlags = "388"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4C2126B6F96F11748B4BFF051D1519E3\SourceList\Media	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4C2126B6F96F11748B4BFF051D1519E3\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4C2126B6F96F11748B4BFF051D1519E3\Assignment = "1"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\25F46F8180ECF4345A1FA7A8935DE9AE	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4C2126B6F96F11748B4BFF051D1519E3\SourceList\Net	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4C2126B6F96F11748B4BFF051D1519E3\SourceList\Media\1 = ";"	msiexec.exe

Suspicious behavior: EnumeratesProcesses 32 IoCs

pid	Process
1212	rundll32.exe
3192	msiexec.exe
3192	msiexec.exe
5236	AteraAgent.exe
5236	AteraAgent.exe
5420	powershell.exe
5420	powershell.exe
5984	powershell.exe
5984	powershell.exe
1604	AteraAgent.exe
1604	AteraAgent.exe
1604	AteraAgent.exe
1604	AteraAgent.exe
1604	AteraAgent.exe
1604	AteraAgent.exe
1604	AteraAgent.exe
1604	AteraAgent.exe
1604	AteraAgent.exe
1604	AteraAgent.exe
1604	AteraAgent.exe
1604	AteraAgent.exe
1604	AteraAgent.exe
1604	AteraAgent.exe
1604	AteraAgent.exe
1604	AteraAgent.exe
1604	AteraAgent.exe
1604	AteraAgent.exe
1604	AteraAgent.exe
1604	AteraAgent.exe
1604	AteraAgent.exe
1604	AteraAgent.exe
1604	AteraAgent.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4692	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4692	msiexec.exe
Token: SeSecurityPrivilege	3192	msiexec.exe
Token: SeCreateTokenPrivilege	4692	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	4692	msiexec.exe
Token: SeLockMemoryPrivilege	4692	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4692	msiexec.exe
Token: SeMachineAccountPrivilege	4692	msiexec.exe
Token: SeTcbPrivilege	4692	msiexec.exe
Token: SeSecurityPrivilege	4692	msiexec.exe
Token: SeTakeOwnershipPrivilege	4692	msiexec.exe
Token: SeLoadDriverPrivilege	4692	msiexec.exe
Token: SeSystemProfilePrivilege	4692	msiexec.exe
Token: SeSystemtimePrivilege	4692	msiexec.exe
Token: SeProfSingleProcessPrivilege	4692	msiexec.exe
Token: SeIncBasePriorityPrivilege	4692	msiexec.exe
Token: SeCreatePagefilePrivilege	4692	msiexec.exe
Token: SeCreatePermanentPrivilege	4692	msiexec.exe
Token: SeBackupPrivilege	4692	msiexec.exe
Token: SeRestorePrivilege	4692	msiexec.exe
Token: SeShutdownPrivilege	4692	msiexec.exe
Token: SeDebugPrivilege	4692	msiexec.exe
Token: SeAuditPrivilege	4692	msiexec.exe
Token: SeSystemEnvironmentPrivilege	4692	msiexec.exe
Token: SeChangeNotifyPrivilege	4692	msiexec.exe
Token: SeRemoteShutdownPrivilege	4692	msiexec.exe
Token: SeUndockPrivilege	4692	msiexec.exe
Token: SeSyncAgentPrivilege	4692	msiexec.exe
Token: SeEnableDelegationPrivilege	4692	msiexec.exe
Token: SeManageVolumePrivilege	4692	msiexec.exe
Token: SeImpersonatePrivilege	4692	msiexec.exe
Token: SeCreateGlobalPrivilege	4692	msiexec.exe
Token: SeBackupPrivilege	2452	vssvc.exe
Token: SeRestorePrivilege	2452	vssvc.exe
Token: SeAuditPrivilege	2452	vssvc.exe
Token: SeBackupPrivilege	3192	msiexec.exe
Token: SeRestorePrivilege	3192	msiexec.exe
Token: SeRestorePrivilege	3192	msiexec.exe
Token: SeTakeOwnershipPrivilege	3192	msiexec.exe
Token: SeRestorePrivilege	3192	msiexec.exe
Token: SeTakeOwnershipPrivilege	3192	msiexec.exe
Token: SeDebugPrivilege	3496	rundll32.exe
Token: SeRestorePrivilege	3192	msiexec.exe
Token: SeTakeOwnershipPrivilege	3192	msiexec.exe
Token: SeDebugPrivilege	1212	rundll32.exe
Token: SeRestorePrivilege	3192	msiexec.exe
Token: SeTakeOwnershipPrivilege	3192	msiexec.exe
Token: SeDebugPrivilege	3532	rundll32.exe
Token: SeRestorePrivilege	3192	msiexec.exe
Token: SeTakeOwnershipPrivilege	3192	msiexec.exe
Token: SeRestorePrivilege	3192	msiexec.exe
Token: SeTakeOwnershipPrivilege	3192	msiexec.exe
Token: SeDebugPrivilege	1692	rundll32.exe
Token: SeRestorePrivilege	3192	msiexec.exe
Token: SeTakeOwnershipPrivilege	3192	msiexec.exe
Token: SeDebugPrivilege	5236	AteraAgent.exe
Token: SeRestorePrivilege	3192	msiexec.exe
Token: SeTakeOwnershipPrivilege	3192	msiexec.exe
Token: SeDebugPrivilege	5420	powershell.exe
Token: SeBackupPrivilege	3348	srtasks.exe
Token: SeRestorePrivilege	3348	srtasks.exe
Token: SeSecurityPrivilege	3348	srtasks.exe
Token: SeTakeOwnershipPrivilege	3348	srtasks.exe
Token: SeBackupPrivilege	3348	srtasks.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
4692	msiexec.exe
4692	msiexec.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 3192 wrote to memory of 3348	3192	msiexec.exe	84
PID 3192 wrote to memory of 4524	3192	msiexec.exe	86
PID 4524 wrote to memory of 3496	4524	MsiExec.exe	87
PID 4524 wrote to memory of 1212	4524	MsiExec.exe	88
PID 4524 wrote to memory of 3532	4524	MsiExec.exe	89
PID 4524 wrote to memory of 1692	4524	MsiExec.exe	90
PID 3192 wrote to memory of 5360	3192	msiexec.exe	91
PID 5360 wrote to memory of 5236	5360	MsiExec.exe	92
PID 5360 wrote to memory of 5420	5360	MsiExec.exe	94
PID 5360 wrote to memory of 5984	5360	MsiExec.exe	96
PID 1604 wrote to memory of 1428	1604	AteraAgent.exe	100
PID 1428 wrote to memory of 4664	1428	cmd.exe	102
PID 4524 wrote to memory of 5492	4524	MsiExec.exe	103

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\DocuSign.msi
1⤵
- Badlisted process makes network request
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4692

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3192
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3348
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding 7E9B7B662536BB5C2EEA321F9E787037
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:4524
- - C:\Windows\system32\rundll32.exe
    rundll32.exe "C:\Windows\Installer\MSI5FBF.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240672781 2 Atera.Agent.Installer.Msi.Ca!Atera.Agent.Installer.Msi.Ca.CustomActions.GenerateAgentId
    3⤵
    - Loads dropped DLL
    - Drops file in Windows directory
    - Suspicious use of AdjustPrivilegeToken
    PID:3496
- - C:\Windows\system32\rundll32.exe
    rundll32.exe "C:\Windows\Installer\MSI60AA.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240672953 6 Atera.Agent.Installer.Msi.Ca!Atera.Agent.Installer.Msi.Ca.CustomActions.ShouldContinueInstallation
    3⤵
    - Badlisted process makes network request
    - Loads dropped DLL
    - Drops file in Windows directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1212
- - C:\Windows\system32\rundll32.exe
    rundll32.exe "C:\Windows\Installer\MSI7879.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240679046 10 Atera.Agent.Installer.Msi.Ca!Atera.Agent.Installer.Msi.Ca.CustomActions.ReportMsiInstallStart
    3⤵
    - Badlisted process makes network request
    - Loads dropped DLL
    - Drops file in Windows directory
    - Suspicious use of AdjustPrivilegeToken
    PID:3532
- - C:\Windows\system32\rundll32.exe
    rundll32.exe "C:\Windows\Installer\MSI7D6C.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240680296 15 Atera.Agent.Installer.Msi.Ca!Atera.Agent.Installer.Msi.Ca.CustomActions.DetectDotNetFrameworkRuntime
    3⤵
    - Loads dropped DLL
    - Drops file in Windows directory
    - System Time Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1692
- - C:\Windows\system32\rundll32.exe
    rundll32.exe "C:\Windows\Installer\MSIAF9C.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240693156 31 Atera.Agent.Installer.Msi.Ca!Atera.Agent.Installer.Msi.Ca.CustomActions.ReportMsiInstallEnd
    3⤵
    - Badlisted process makes network request
    - Loads dropped DLL
    - Drops file in Windows directory
    PID:5492
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding 485E342089C573E09A7F10381970B1E9 E Global\MSI0000
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:5360
- - C:\Program Files\ATERA Networks\AteraAgent\Agent\AteraAgent.exe
    "C:\Program Files\ATERA Networks\AteraAgent\Agent\AteraAgent.exe" init-settings --agent-id "652b678d-a9ff-4a64-ad36-d253d2bfdbd6" --account-id "1YQa15qEdxo/AZJk300eVU1MMDBQMDO2SuShs2nCsGA=" --environment "Production" --customer-id "1" --folder-id ""
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5236
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" -ExecutionPolicy Bypass -NoProfile -Command "[Net.ServicePointManager]::SecurityProtocol=[Net.SecurityProtocolType]::Tls12;Invoke-WebRequest -Uri 'https://dot.net/v1/dotnet-install.ps1' -OutFile \"C:\Program Files\ATERA Networks\AteraAgent\Agent\dotnet-install.ps1\""
    3⤵
    - Badlisted process makes network request
    - Command and Scripting Interpreter: PowerShell
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5420
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" -ExecutionPolicy unrestricted -NoProfile -File "C:\Program Files\ATERA Networks\AteraAgent\Agent\dotnet-install.ps1" -Channel 8.0 -Runtime dotnet -InstallDir "C:\Program Files\ATERA Networks\AteraAgent\Agent\\.dotnet"
    3⤵
    - Badlisted process makes network request
    - Command and Scripting Interpreter: PowerShell
    - Drops file in Program Files directory
    - System Time Discovery
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    PID:5984

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:2452

C:\Program Files\ATERA Networks\AteraAgent\Agent\AteraAgent.exe
"C:\Program Files\ATERA Networks\AteraAgent\Agent\AteraAgent.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1604
- C:\Windows\system32\cmd.exe
  "cmd.exe" /c "C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\dotnet.exe" --list-runtimes
  2⤵
  - System Time Discovery
  - Suspicious use of WriteProcessMemory
  PID:1428
- - C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\dotnet.exe
    "C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\dotnet.exe" --list-runtimes
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Time Discovery
    PID:4664

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Event Triggered Execution

T1546

Installer Packages

T1546.016

Privilege Escalation

Event Triggered Execution

T1546

Installer Packages

T1546.016

Defense Evasion

System Binary Proxy Execution

T1218

Msiexec

T1218.007

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e585ef5.rbs

Path C:\Config.Msi\e585ef5.rbs
Size 7KB
SHA256 3fb0a14465918000bb3af0b0c83dfbe63811557478fdfc185b28876cc3090d27
MD5 ebe25f12964232d85128be02b5a6e3de
SHA1 30a5228196e7583264f1025eeae529d82c413084
SHA512 9eb8967bcf4da8f516e58a52ba554a489e150c7f0c485c719920db18726f5d2d3a13ee336e0b30a24268e6017b88ef459458ef142a07b28c3bc83bd92be95cbd
SSDEEP 96:zmqpQ4z5UsmCrSqJUBPLxCsTlXUBPLxC6jNovh+TlNCH5K9WdstWC+pljNFzEjBT:qqLz5wCFCpEImpEkt2W7+pLm
TLSH
T132F113017A0086EAFA661FB0C707172137F6D3E9D620635B1ADE80649F5778D6E6C38E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\dotnet.exe
Size 153KB
SHA256 07f5d2cce93e97878a765fd81d1981acc3b21be0fdfb519cf0544ca2ae2d0ab5
MD5 ef0405cc101e12e221899e0e0a5cc162
SHA1 cabcc37327d854ed9859b1bbebacd608e5f8d6ad
SHA512 c2e9fc696928f3450466c2978f83f77aa0bbd7d9ab04d362d26ff9b3dbf0c67a7d7bb122dbdd02695a9dfcc25ade3f9dec46d5db8be07adee50b26388623e8fd
SSDEEP 1536:NyPL142CnQwPtrKq4zAl8ZVVZh6ecdYt4aXMFG0vcTJhfzrn:NyP22CplCO8n06t4aXMSTJJ/n
TLSH
T151F3071AD65811AAD1AE8575CB518A41BB337C6587E0E3CB57C0FCBE0F326905EE9703
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hostfxr.dll

Path C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\host\fxr\8.0.27\hostfxr.dll
Size 357KB
SHA256 0a495d3a7befebf627a973760439da0f7f1f1667b99832f083664fac7641d2dc
MD5 2756893fc2cfe0036b926d1ff5f6c2fc
SHA1 cb4b8b21828ba738e6bfa619f99335756842148f
SHA512 094d8b233facb5983f72b8c624f1f59aeb62063f695d55a79ba343b929015e73fb4b7f5eb16fe39881f8462822f7d7502ac2d62c4fa01c9686035de28d459617
SSDEEP 6144:+E7Djww5R1Gv0crFfeUtJ9NZFSKJGDjq/2n1NonJLSHD6DPDh+vJpmE08QxsTZ6H:5MjrFPJ+OyUriJ4E8KtXZPK
TLSH
T1C6741916D6E8017CF0B7D679CAB28901EB727C494BB196CF139099661E73BD09E39323
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

.settings.json

Path C:\Program Files\ATERA Networks\AteraAgent\Agent\.settings.json
Size 179B
SHA256 14262dce17cefcf58b20f7f587ba2c37808b413782f8c95c9e69725dfa810395
MD5 ccc53567755984242a97bd06b9aa2ade
SHA1 eab5c14980971e5263597e9afb5beb59dde7e974
SHA512 279525d6fdd78d41e4a06c0ada45d2c2a2dea0ef3158905911c23312efac6564aa69d2a5480beeff581fb3ca1ec2d06301f17866d034ba337aa98a61706ae18c
TLSH
T184C0C0C041F071443302EE18080B31FF04313710CEC337003BC3004048B02D17D20655
MD5 SHA1 SHA512 TLSH

Submit Download

AteraAgent.exe

Path C:\Program Files\ATERA Networks\AteraAgent\Agent\AteraAgent.exe
Size 21.1MB
SHA256 93d6fe2287fb4a0d5466a5b466bd1838d5ba53f6e90fae960a1c709dde52062b
MD5 0cfb08cf35f43ca44a6195ea39903e6b
SHA1 b5daeb0bab48f357bb83b6c837511d98a170695b
SHA512 ab60cfc7ecc888a50e6b29cb36a1034e076bc5cd2c1b4316d292fd18454c9a0008ad57a0db23a35b904458dee7280aeb6c5eaa556ee8a2581165a627f94820af
SSDEEP 196608:gFRwrPgM2TfNNYTHM6GdD/KNjg1pHCEdDB0fEDGWXQTADWvCw0o2:gumbnzdONq/GOQTAh
TLSH
T1EC279C11A3F8426AE6BFC378C4724116D7F278462721EBCF2558A5E92E33BC05A75363
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

agent.cert.pfx

Path C:\Program Files\ATERA Networks\AteraAgent\Agent\certificates\production\agent.cert.pfx
Size 2KB
SHA256 a69eed051cc041cc8ad7d80e6a2732e1a9a2435cadfd1466bb4270e4fb0e4a43
MD5 7916b97a8eb393c238a1dd0ae475c3af
SHA1 eb78054a33679a5ce51f016ec6a9351dc5acfcb8
SHA512 316ae4ec07fd10cb5580c3f6b931656e9b5e1739a6f2923f1f648c6edb4cb7d7f02248f4fffd8f495f835524c70c02d3b416dbd0895998c575139ebc36d528e2
TLSH
T12D514C2B23B80A477CC3C88D7C0C6BB24772CB5AF63963DF32B1A1D249B4912A301607
MD5 SHA1 SHA512 TLSH

Submit Download

dotnet-install.ps1

Path C:\Program Files\ATERA Networks\AteraAgent\Agent\dotnet-install.ps1
Size 74KB
SHA256 6585899aed55ff6ae13dbe1e8c3b878f2d00433520e7efbe250b75db948b7da9
MD5 ce99fb45197526495b33bb5985e53da6
SHA1 97fa2c17a9c156e2a56d799f1dd12271646b58ef
SHA512 7a0eb00023b8fed5cb98eaaac4b72211df8980bf52c6aa85767e83e70ddc9fb8df9a9fc8d1f8d32872ac266a40811eb0d6189ee98462fdb54f65df8769a803cb
SSDEEP 768:GQy0YIw0FI6Szz3G4yYijvbpyspfD2euFI1Fb2JPJFId4zT2C0U8qzqogdXMhDZ5:GSY7PwYU1JCf8qzjfcn4J4XQZcG2JYX
TLSH
T18C731A9EAD429032547363B8C96B1084FB37427B524541A8F8DDD4887F7262D93A2FEF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
Size 471B
SHA256 ad5b506e0a5c2db99afa567bbda74d3ca0fdec30b0185bcc2b9abf2f62e9ad7b
MD5 0dcbd66d687b3210c96ea5d00dedf8fe
SHA1 f6834f9d7f5673a3638a65e372ebc56d593c8a34
SHA512 47fa734d77069de9b8f4dbf9bd6d68433f3fbcc5769868362789229e2544284eaf4d82d858359be73f5b0a9928b54142c325352b063599ce5a807a765e1152ce
TLSH
T174F0DC3FA8FA5592351F18A80BF5991030EAB6CF08C2823A347425C4855FEA1610A809
MD5 SHA1 SHA512 TLSH

Submit Download

8EC9B1D0ABBD7F98B401D425828828CE_6FBFBE34ABAF2109B411B965FB39009E

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_6FBFBE34ABAF2109B411B965FB39009E
Size 727B
SHA256 ae70e5ca10f73c994474e487f7f2186da679f9bc4bf65fc225c9e0266cf15eda
MD5 93af4da2c5c5a2e39ed583bb3f903116
SHA1 de27792eaccb86f0e5df51e9225f757d2ed6a45c
SHA512 3ba00f669399dd69894a10053de260d271a6048abf48da558aa5b0bad71eea76a25fd8fe4e2f419425e9daf5fc5dafae148a111a9f870d344d2407f344efb737
TLSH
T1D301990119854F90DDA1CA44EF8C0B6C35DD852160C9471F7378708DD2D179037C358E
MD5 SHA1 SHA512 TLSH

Submit Download

C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
Size 727B
SHA256 8360cc6f51681fb6e2af86774f6ac60fe7cf57a08070f59aafe50a9bf3172a56
MD5 6fb96c657cc31897574343ee248bbc24
SHA1 cc9334595c1fee33f285ba1473b01d8a88adef7f
SHA512 ffe30bbc5c541c343f26c715a2491571892cd04e5c8ca66dcbd967cfb458fbffdb4f25389ca62b5cd0d17952eac60c465d9e43e9e066d0e585b7ce15b6b9a5f3
TLSH
T16C01441B14FBBCD475740BD8F7AE8AF9BBF1A38520C90161A77839999281FD09803B64
MD5 SHA1 SHA512 TLSH

Submit Download

698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
Size 400B
SHA256 c217e78d2dc338feca35bddb6fd6a3e077a2a8e1659dd7448ac0f4f9e7a7374e
MD5 f3ef8a6ea85e7e10ae7323c2a6aebac5
SHA1 0b3494f5ecef838e44858ff4b0726be1b064ad89
SHA512 aeb07d3ac98956a65ffc0bec3b20af2dd8b85842180d91edbe30933e3a234d2ff0fd390c1d5b9d161dd7a62881d3d7ed399f81a8d2e72ae3a0d619a50b888c78
TLSH
T149E0203027FA501FF260D77803D5D095AF2AF1122CB466BE15C1192D6905E004C53D31
MD5 SHA1 SHA512 TLSH

Submit Download

8EC9B1D0ABBD7F98B401D425828828CE_6FBFBE34ABAF2109B411B965FB39009E

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_6FBFBE34ABAF2109B411B965FB39009E
Size 408B
SHA256 63819602f57ee5af37d44f36b00484f8cbbd4d7a39ec99c04faaf6f36840f257
MD5 e4c11bf8671c26f49cfdffc7b42b82c9
SHA1 3dcc114fd8b728a5b54163ab5a8df6d77b3e9980
SHA512 88d29b2c3de38219b1539a35336199c7f304fbcbd8e67000ed7bad344c07c8be31c968a339d1363608582018b50230e9306ebef061576c1aaa5420614fb0d02e
TLSH
T166E0C03071FA459DF1E4E83442F1B927545AF3430401837510904312BB11A008CE1234
MD5 SHA1 SHA512 TLSH

Submit Download

C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
Size 412B
SHA256 6b5664ff9f9a1b257f40d87df4fc1e6f9ee6e10965eed432fb4dc133f57242ba
MD5 cb27d2826ffca4946fb436670b6255ac
SHA1 d0c110cd29f2cb46442584d5f8f40e64759969f4
SHA512 36d0daa2c3756d0728ceff9a8dfd688cc52e5ccab9f51e50745265c4842144ff0daf1479370c452a76a926a90b52f4212fc65e9956b65250b343b5b145daa075
TLSH
T1CDE0DF28AAFBA52EF1A0DC3986FAA1765E89F601145497B919904318FB46F009D20EB4
MD5 SHA1 SHA512 TLSH

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 d69b7d84970cb04cd069299fd8aa9cef8394999588bead979104dc3cb743b4f2
MD5 5f4c933102a824f41e258078e34165a7
SHA1 d2f9e997b2465d3ae7d91dad8d99b77a2332b6ee
SHA512 a7556b2be1a69dbc1f7ff4c1c25581a28cb885c7e1116632c535fee5facaa99067bcead8f02499980f1d999810157d0fc2f9e45c200dee7d379907ef98a6f034
TLSH
T15651CF323375B1D489163F07192C59C463BF8355FA94AF4CB698624ED92700B9F222F3
MD5 SHA1 SHA512 TLSH

Submit Download

rundll32.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\rundll32.exe.log
Size 847B
SHA256 16f4a7736a0c2aee54256d3d75ce4c0816fabf130b3b92340deca34c5f5fda43
MD5 2940b232afa412901f8ae5651c790f93
SHA1 f79bd5d1433c803515e2d9a016396344187beea2
SHA512 553d5491c9bc358c7ce8a95caa445e882ab4bf744a2f5be1b2131c20f27321f65121389fd076558ba415f322fdad6ed36a05902e5c55cbbeace371182890af27
TLSH
T1B6018E722371B2D589163F43194D5B8827FF43197550ED0CB999721ED92A01B6F223F3
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 1081c6b484e3ce0572ea539029bc598ee7870cf099c5585bd52fbeee220c56b7
MD5 8117d1162c008cf731fe668d81f95ac0
SHA1 1fdce919b160546d65f946726794b3331de06938
SHA512 711cc338d15b6b36cad3e8ca1a57b0595991f060d24f39faa2b24a2c4ca08c07c82497ed8b1bfbc998452778d75fb24558d72062ef5ee6848d99e35068c5f188
TLSH
T11B117A33B79CC135C8D9157A1089AD01B2B4C3C7049EDE8B7A84C509E57F58ADB645E4
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_3jpz0mpl.v2z.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_3jpz0mpl.v2z.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

MSI5FBF.tmp

Path C:\Windows\Installer\MSI5FBF.tmp
Size 340KB
SHA256 1997e4959d6c187e9ae35097b4cc0702e8a1564acb1dec7b080adcaa9b973fd0
MD5 5df8b056b8ad35f9ed4cfff03eeb0e0d
SHA1 22910bbcbe382bde85770699ba70111ee1472b65
SHA512 47e17b536b246a97e465426b8a25350e9889c127b54367a3ae491000b7aa9636712e0b5f852d8229966bb9bb7d045e0dc541ea02a1e52d5fa4a515a17336245d
SSDEEP 6144:apUNpIx1IWpJHOrwIBaiRk7QDQz6VYsSK+kAoXyVk699nsS6:BNp21IWpJkBdk0DQz6QK+kAVv99g
TLSH
T17174BF1977F80DA5FC7B563A89630605E673BC515B70DB9F0360421E9F3B390A93AB22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSI7E87.tmp

Path C:\Windows\Installer\MSI7E87.tmp
Size 390KB
SHA256 7aacd4c18710e9bc4ff2034895a0a0c8f80f21809fb177d520e93f7688216e6d
MD5 e8dc682f2c486075c6aba658971a62cc
SHA1 7cd0a2b5047a4074aa06a6caa3bb69124851e95d
SHA512 a0a1f0f418bf2d4ffd079b840aeb0142c7faab7fa72b5e33b1841798569f55a25dfd305abf9c2ca89792f6499f695b69975882697dc53e99d5a975a9fa8c7d75
SSDEEP 6144:p2ET2+QBLh+MVy5DCRoRRvc181kaKN8MMLuG:p2ET2+cVXVyNhvcCkaKN8Me
TLSH
T10D846B29F7E408EDE4B78276C5A68530FF75748D3320D5AE47A8852D1F3AAA070BB701
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CustomAction.config

Path C:\Windows\Installer\SFXCA465E454E6047C51B6C46F5024B84094D\CustomAction.config
Size 956B
SHA256 2dbc73a3bc444a9119c9b5e20276698384d9ad9535a8a7547c44d1b9a8d67346
MD5 a9088b24614c12b70af6ae9669a4a4b1
SHA1 d72efa4e0c7bd733ed3d51831ead7031175c27e0
SHA512 14090969a71b6c80023da29dc8582aded6d26ca349966767ce22102080abce118b846a47ea2b9abe2d5f6a788bc083031d27fdee4103e2e4b99d29c2ac494d7c
TLSH
T10811D00D4A946B7724312793BFACA1C4E76194BA3994411CB49BB9151F39938176338F
MD5 SHA1 SHA512 TLSH

Submit Download

WixToolset.Dtf.WindowsInstaller.dll

Path C:\Windows\Installer\SFXCA465E454E6047C51B6C46F5024B84094D\WixToolset.Dtf.WindowsInstaller.dll
Size 193KB
SHA256 a614884ea627da1925131ebf41e8ae202caeac0fe543b86384f5eb2bfaf1aa75
MD5 ef8d5785ac8669f5fd54e22f52770e6b
SHA1 4c94ae7ef233be33a56c0a5d9b8e2211d5d5792c
SHA512 ab3b140bd6531f22e994606820e6511442c23d9015b1e1a38aaed43aa42ba29a996511151d0b3a383c05c2b11f670e52cdd7f507ad1a1ad8cebea57fb22ade5a
SSDEEP 3072:8Of7tVL+l4lj19l4uDHYHj69UgoTqdda7CnfKlRUjW01KytaljYqCDPC:8gQQx54Hj6jomdrzalMqb
TLSH
T14A149C2A57F84B3ECEFF8778E2614252C7B1F1E67103DB1D9D8281A52163784B682397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Atera.Agent.Installer.Msi.Ca.dll

Path C:\Windows\Installer\SFXCA52055C663A4BDA8856CFAE4954234A5D\Atera.Agent.Installer.Msi.Ca.dll
Size 59KB
SHA256 46a2844072f1be835debc683da08d7a37d866c6a4a2b1bff79f9e4bae60d9403
MD5 c2ab0e13e39d5c93c352eb5e0ab16eae
SHA1 9bbd3d30ad61be4c6f5d0c9f40132ff3d81130e8
SHA512 14cd2ec84fbfdf1fc18e1d970e66488e2183bfa60f5ca9f82d6937bafd7e6fa70a16128b39debaae8a2257c0877ced098d67d90745b4d8de29a9720b863ce268
SSDEEP 768:QUak5eO8oX5qqleywzEVf6zRqbpWJARn9b424nNzTX1W4n1RDvaW:QUderqlew8qbpF9b424nFZW4nbDSW
TLSH
T1B753D44073F84719F6FF2FB87E75555489B3BC676932EA4D1A60104E0AB2B80DA60B73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e585ef4.msi

Path C:\Windows\Installer\e585ef4.msi
Size 8.2MB
SHA256 cdf8e1012400896e603aceb7d9bce167b2eeb54f6b0f194f4603efbe2db001f0
MD5 80034b172310ced0f33f1e641545f9aa
SHA1 84c3edb559a402c5a02a6d5960fe6f385ce89c90
SHA512 35f0ae8e077085eb84ec6b888ee960a32d5ee7e2968fddbef0de4bcb773e5e6ddf47147cbe0286c00bd34c2e5a247263f78af153ebed82a185bf01eb25701a37
SSDEEP 196608:yWVkavHTZiV06F/Sn8gYasBQNE42hz0O5HyIfR1V:FkavHEV06FfM8z0O5rR1
TLSH
T1A3862319BBE408BAE9B74276C4578025EFB2BC4C3761D2AF03A4710D8F36794717AB61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TmpB580.tmp

Path C:\Windows\SystemTemp\TmpB580.tmp
Size 3KB
SHA256 94739ca46676bd602a78671257fbfce39feaabc9664c6326bf4970a0108e3429
MD5 560af444a6a7faa0b0ca94dc16ca2a58
SHA1 df31453fafde354870a0a9a8ca50b18e284c32e4
SHA512 7c853176c088d56a517e52c6687b6debf08f6f9726376720ade9d13fafc9be0ca72f0f2b35562a61ece653aeb789c838c60447f463b2bbe70c21bfc8c039b681
TLSH
T1B3616C88B10E28972CEECC504D495B40AEC3D754B390F25F68F4BCA64CA13E9A358C3C
MD5 SHA1 SHA512 TLSH

Submit Download

metadata-2

Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
Size 24.6MB
SHA256 27556fe431c52fe06daed0fdb0783eed10ea972415681dd5a62a38fe4314a7bc
MD5 b7009610fe4a7933f1552e0d684996a1
SHA1 c2a2087abf2c1b708d5835298a5a0889486e5ad7
SHA512 3e810d9ad60d6b9d927dbc16c1b0b5535f33eac83f735019496276bcb102818205a040d5875ad13ee661b22d0854ee6bbe36bac740268962f0bffac39198d857
SSDEEP 24576:q2gmSp15doO/vvTLZmSuBUHq/aJZwY24WWh93JkC7p6ok+mHIZzVrPoVh:2
TLSH
T16547C12436F92250E7F79E3C68F06A238D3A7D5B9C159E8D05461B4E0921FB0E872F5B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{6e2ec6fc-3c3f-463d-b26e-8d0ac43bada6}_OnDiskSnapshotProp

Path \??\Volume{a40cd035-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{6e2ec6fc-3c3f-463d-b26e-8d0ac43bada6}_OnDiskSnapshotProp
Size 6KB
SHA256 cccf90cc5fe744fdcdcea801939c339bfe4587f3982ecebcfc9cddb7ae60ef69
MD5 206c7c4472d110cd428e82f3e4f57fdb
SHA1 c642df28df86ea1e32b8695ab55b8fd6df169d9b
SHA512 01948aeadd271c737a59bfdfb116a55c55a0adab02091c4731d736d59a3179da2e84c669eb109f600fc9646ebf9056124d90ade66b4a08489a2cff4cc566ea70
SSDEEP 96:FbfcQDdtvc8DD84LTHzbOHXOHBlBRQ88Sc9XE56tOSVQpu:VfZdnb++ZVm
TLSH
T145D189085AF54711E2B3AB3129F14557A877B911EF33CB8E0298638E2670A10F935F5F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1212-59-0x000001BE883B0000-0x000001BE883EC000-memory.dmp

Download

memory/1212-58-0x000001BE88310000-0x000001BE88322000-memory.dmp

Download

memory/3496-37-0x000001E36FA90000-0x000001E36FAA4000-memory.dmp

Download

memory/3496-33-0x000001E36FA40000-0x000001E36FA74000-memory.dmp

Download

memory/5420-125-0x000001F9744D0000-0x000001F9744F2000-memory.dmp

Download

memory/5984-157-0x00000230A5430000-0x00000230A545A000-memory.dmp

Download

memory/5984-160-0x00000230A51E0000-0x00000230A51EA000-memory.dmp

Download

memory/5984-161-0x00000230A5440000-0x00000230A5452000-memory.dmp

Download

memory/5984-158-0x00000230A5430000-0x00000230A5454000-memory.dmp

Download

memory/5984-156-0x00000230A4EB0000-0x00000230A4EBA000-memory.dmp

Download

memory/5984-155-0x00000230A51F0000-0x00000230A52A3000-memory.dmp

Download

memory/5984-154-0x00000230A51D0000-0x00000230A51EC000-memory.dmp

Download