a00afb3ea53da2251a5602f7e4daf76bda7083be3c11d0dbc3ced09378482a45

Resubmissions

11/08/2026, 22:28

260811-2dnqmazwb18

15/07/2026, 13:21

260715-qlpgcagv9w8

Analysis

max time kernel
149s
max time network
116s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
15/07/2026, 13:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
test.exe
Size 3.1MB
Sample260715-qlpgcagv9w
SHA256 a00afb3ea53da2251a5602f7e4daf76bda7083be3c11d0dbc3ced09378482a45
MD5 9b36444770badf58b2c0883708063fc2
SHA1 8841cdd2775a2a6a1b7b79ef44543382011e69ce
SHA512 cd8dc9e10fcf60ba298423f2bd66fad6b2ab1b0c1346e0f7a7830a4aee1f79981c9e43ea3cb9acb9cdfe6bdb18d41b84805d04c038f435b5abe0021ec2610a2a
SSDEEP 49152:AfU4Ujbn4RzdG5ZM+LzyYAyzqo22ZpA1emIdTxw9ldwD2JIa:AfUbQeOYpzqo22ZpC/092vP
TLSH
T1B7E51231A5614132F7F505B3FC28A2343E6CE7382764887AD7D4AD1D6EA84922BF7253
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery execution persistence

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
5932	powershell.exe

Executes dropped EXE 4 IoCs

pid	Process
4068	test.exe
2620	Installer_026292.exe
5640	Installer_026292.exe
1340	Installer_026292.exe

Loads dropped DLL 11 IoCs

pid	Process
4068	test.exe
4068	test.exe
4068	test.exe
4068	test.exe
4068	test.exe
1340	Installer_026292.exe
1340	Installer_026292.exe
1340	Installer_026292.exe
1340	Installer_026292.exe
1340	Installer_026292.exe
5668	MsiExec.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\{942816a5-934a-480f-a429-267311165aec} = "\"C:\\Users\\Admin\\AppData\\Local\\Package Cache\\{942816a5-934a-480f-a429-267311165aec}\\Installer_026292.exe\" /burn.runonce"	Installer_026292.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\{942816a5-934a-480f-a429-267311165aec} = "\"C:\\Users\\Admin\\AppData\\Local\\Package Cache\\{942816a5-934a-480f-a429-267311165aec}\\Installer_026292.exe\" /burn.runonce"	test.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\!Upd6d2e8595 = "msiexec /x {6d2e8595-2878-42f0-ac5f-34c300aa1bc4} /qn /norestart"	msiexec.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe

Drops file in Windows directory 17 IoCs

description	ioc	Process
File created	C:\Windows\Installer\e59527f.msi	msiexec.exe
File created	C:\Windows\SystemTemp\~DFD846B08D17FF779F.TMP	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI555A.tmp	msiexec.exe
File created	C:\Windows\Installer\e59527b.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e59527b.msi	msiexec.exe
File created	C:\Windows\SystemTemp\~DF0CA8F3B51E5EC367.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DFAF465F26FE1A849F.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DFDCA4E93E3A982B44.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI6A7A.tmp	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI5829.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DFF2D2CFADDE2A64D8.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DF6AEA7EC3DA4A81FE.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DF7F5CFDB1801AF7A1.TMP	msiexec.exe
File created	C:\Windows\Installer\SourceHash{6D2E8595-2878-42F0-AC5F-34C300AA1BC4}	msiexec.exe

System Location Discovery: System Language Discovery 1 TTPs 10 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	test.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Installer_026292.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Installer_026292.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Installer_026292.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	test.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
2116	cmd.exe
2028	PING.EXE

Modifies registry class 25 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Installer\Dependencies\{942816a5-934a-480f-a429-267311165aec}\DisplayName = "Microsoft Visual C++ 2015-2022 Redistributable (x86)"	Installer_026292.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Installer\Dependencies\{6D2E8595-2878-42F0-AC5F-34C300AA1BC4}\DisplayName = "Network Adapter Configuration"	Installer_026292.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Installer\Dependencies\{942816a5-934a-480f-a429-267311165aec}\Dependents\{942816a5-934a-480f-a429-267311165aec}	Installer_026292.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Installer\Dependencies\{942816a5-934a-480f-a429-267311165aec}	Installer_026292.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Installer\Dependencies\{942816a5-934a-480f-a429-267311165aec}\Version = "14.36.32532.0"	test.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Installer\Dependencies\{6D2E8595-2878-42F0-AC5F-34C300AA1BC4}\Version = "5.2"	test.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Installer\Dependencies\{942816a5-934a-480f-a429-267311165aec}\Version = "14.36.32532.0"	Installer_026292.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Installer\Dependencies\{6D2E8595-2878-42F0-AC5F-34C300AA1BC4}	Installer_026292.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Installer\Dependencies\{6D2E8595-2878-42F0-AC5F-34C300AA1BC4}\Version = "5.2"	Installer_026292.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Installer\Dependencies\{6D2E8595-2878-42F0-AC5F-34C300AA1BC4}\Dependents	test.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Installer\Dependencies	test.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Installer\Dependencies\{942816a5-934a-480f-a429-267311165aec}\Dependents\{942816a5-934a-480f-a429-267311165aec}	test.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Installer\Dependencies\{942816a5-934a-480f-a429-267311165aec}	Installer_026292.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Installer\Dependencies\{6D2E8595-2878-42F0-AC5F-34C300AA1BC4}\ = "{6D2E8595-2878-42F0-AC5F-34C300AA1BC4}"	Installer_026292.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Installer\Dependencies\{6D2E8595-2878-42F0-AC5F-34C300AA1BC4}\Dependents\{942816a5-934a-480f-a429-267311165aec}	test.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Installer\Dependencies\{942816a5-934a-480f-a429-267311165aec}	test.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Installer	test.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Installer\Dependencies\{942816a5-934a-480f-a429-267311165aec}\ = "{942816a5-934a-480f-a429-267311165aec}"	test.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Installer\Dependencies\{6D2E8595-2878-42F0-AC5F-34C300AA1BC4}	test.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Installer\Dependencies\{6D2E8595-2878-42F0-AC5F-34C300AA1BC4}\ = "{6D2E8595-2878-42F0-AC5F-34C300AA1BC4}"	test.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Installer\Dependencies\{6D2E8595-2878-42F0-AC5F-34C300AA1BC4}\DisplayName = "Network Adapter Configuration"	test.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Installer\Dependencies\{942816a5-934a-480f-a429-267311165aec}\Dependents	Installer_026292.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Installer\Dependencies\{942816a5-934a-480f-a429-267311165aec}\DisplayName = "Microsoft Visual C++ 2015-2022 Redistributable (x86)"	test.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Installer\Dependencies\{942816a5-934a-480f-a429-267311165aec}\Dependents	test.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Installer\Dependencies\{942816a5-934a-480f-a429-267311165aec}\ = "{942816a5-934a-480f-a429-267311165aec}"	Installer_026292.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
2028	PING.EXE

Suspicious behavior: EnumeratesProcesses 7 IoCs

pid	Process
3640	msiexec.exe
3640	msiexec.exe
5932	powershell.exe
5932	powershell.exe
5932	powershell.exe
3640	msiexec.exe
3640	msiexec.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4068	test.exe
Token: SeIncreaseQuotaPrivilege	4068	test.exe
Token: SeSecurityPrivilege	3640	msiexec.exe
Token: SeCreateTokenPrivilege	4068	test.exe
Token: SeAssignPrimaryTokenPrivilege	4068	test.exe
Token: SeLockMemoryPrivilege	4068	test.exe
Token: SeIncreaseQuotaPrivilege	4068	test.exe
Token: SeMachineAccountPrivilege	4068	test.exe
Token: SeTcbPrivilege	4068	test.exe
Token: SeSecurityPrivilege	4068	test.exe
Token: SeTakeOwnershipPrivilege	4068	test.exe
Token: SeLoadDriverPrivilege	4068	test.exe
Token: SeSystemProfilePrivilege	4068	test.exe
Token: SeSystemtimePrivilege	4068	test.exe
Token: SeProfSingleProcessPrivilege	4068	test.exe
Token: SeIncBasePriorityPrivilege	4068	test.exe
Token: SeCreatePagefilePrivilege	4068	test.exe
Token: SeCreatePermanentPrivilege	4068	test.exe
Token: SeBackupPrivilege	4068	test.exe
Token: SeRestorePrivilege	4068	test.exe
Token: SeShutdownPrivilege	4068	test.exe
Token: SeDebugPrivilege	4068	test.exe
Token: SeAuditPrivilege	4068	test.exe
Token: SeSystemEnvironmentPrivilege	4068	test.exe
Token: SeChangeNotifyPrivilege	4068	test.exe
Token: SeRemoteShutdownPrivilege	4068	test.exe
Token: SeUndockPrivilege	4068	test.exe
Token: SeSyncAgentPrivilege	4068	test.exe
Token: SeEnableDelegationPrivilege	4068	test.exe
Token: SeManageVolumePrivilege	4068	test.exe
Token: SeImpersonatePrivilege	4068	test.exe
Token: SeCreateGlobalPrivilege	4068	test.exe
Token: SeRestorePrivilege	3640	msiexec.exe
Token: SeTakeOwnershipPrivilege	3640	msiexec.exe
Token: SeRestorePrivilege	3640	msiexec.exe
Token: SeTakeOwnershipPrivilege	3640	msiexec.exe
Token: SeRestorePrivilege	3640	msiexec.exe
Token: SeTakeOwnershipPrivilege	3640	msiexec.exe
Token: SeRestorePrivilege	3640	msiexec.exe
Token: SeTakeOwnershipPrivilege	3640	msiexec.exe
Token: SeRestorePrivilege	3640	msiexec.exe
Token: SeTakeOwnershipPrivilege	3640	msiexec.exe
Token: SeRestorePrivilege	3640	msiexec.exe
Token: SeTakeOwnershipPrivilege	3640	msiexec.exe
Token: SeRestorePrivilege	3640	msiexec.exe
Token: SeTakeOwnershipPrivilege	3640	msiexec.exe
Token: SeRestorePrivilege	3640	msiexec.exe
Token: SeTakeOwnershipPrivilege	3640	msiexec.exe
Token: SeRestorePrivilege	3640	msiexec.exe
Token: SeTakeOwnershipPrivilege	3640	msiexec.exe
Token: SeRestorePrivilege	3640	msiexec.exe
Token: SeTakeOwnershipPrivilege	3640	msiexec.exe
Token: SeRestorePrivilege	3640	msiexec.exe
Token: SeTakeOwnershipPrivilege	3640	msiexec.exe
Token: SeRestorePrivilege	3640	msiexec.exe
Token: SeTakeOwnershipPrivilege	3640	msiexec.exe
Token: SeRestorePrivilege	3640	msiexec.exe
Token: SeTakeOwnershipPrivilege	3640	msiexec.exe
Token: SeRestorePrivilege	3640	msiexec.exe
Token: SeTakeOwnershipPrivilege	3640	msiexec.exe
Token: SeRestorePrivilege	3640	msiexec.exe
Token: SeTakeOwnershipPrivilege	3640	msiexec.exe
Token: SeRestorePrivilege	3640	msiexec.exe
Token: SeTakeOwnershipPrivilege	3640	msiexec.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
3640	msiexec.exe
5668	MsiExec.exe
852	msiexec.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 2744 wrote to memory of 4068	2744	test.exe	87
PID 2620 wrote to memory of 5640	2620	Installer_026292.exe	91
PID 5640 wrote to memory of 1340	5640	Installer_026292.exe	92
PID 3640 wrote to memory of 5220	3640	msiexec.exe	93
PID 3640 wrote to memory of 5668	3640	msiexec.exe	94
PID 5668 wrote to memory of 5068	5668	MsiExec.exe	96
PID 5220 wrote to memory of 4604	5220	cmd.exe	97
PID 5220 wrote to memory of 2680	5220	cmd.exe	99
PID 2680 wrote to memory of 4856	2680	conhost.exe	100
PID 5068 wrote to memory of 5932	5068	cmd.exe	101
PID 4856 wrote to memory of 2108	4856	cmd.exe	103
PID 5932 wrote to memory of 2116	5932	powershell.exe	105
PID 2116 wrote to memory of 2028	2116	cmd.exe	107

C:\Users\Admin\AppData\Local\Temp\test.exe
"C:\Users\Admin\AppData\Local\Temp\test.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2744
- C:\Windows\Temp\{331D488D-FABE-4C7F-AD89-C64CC0E27BEC}\.cr\test.exe
  "C:\Windows\Temp\{331D488D-FABE-4C7F-AD89-C64CC0E27BEC}\.cr\test.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\test.exe" -burn.filehandle.attached=608 -burn.filehandle.self=568
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  PID:4068

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Adds Run key to start application
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3640
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd.exe" /d /s /c ""C:\Users\Admin\AppData\Local\Broadcom\Network Adapter Configuration\bootstrap_3b40.cmd""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5220
- - C:\Windows\System32\where.exe
    where conhost.exe
    3⤵
    PID:4604
- - C:\Windows\System32\conhost.exe
    "C:\Windows\System32\conhost.exe" --headless cmd.exe /c "C:\Users\Admin\AppData\Local\Broadcom\Network Adapter Configuration\bootstrap_3b40.cmd" /launched
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2680
  - - C:\Windows\System32\cmd.exe
      cmd.exe /c "C:\Users\Admin\AppData\Local\Broadcom\Network Adapter Configuration\bootstrap_3b40.cmd" /launched
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4856
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe" "C:\Users\Admin\AppData\Local\Broadcom\Network Adapter Configuration\AjaxMin.csproj" /nologo /v:q
        5⤵
        
        PID:2108
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding DD02A7469A37C0816F1BC691B99F4755
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:5668
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\SysWOW64\cmd.exe" /d /s /c ""C:\Users\Admin\AppData\Local\Broadcom\Network Adapter Configuration\updater_b313.cmd""
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5068
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "Start-Process cmd -ArgumentList '/c ping -n 301 127.0.0.1 >nul & msiexec /x {6d2e8595-2878-42f0-ac5f-34c300aa1bc4} /qn /norestart' -WindowStyle Hidden"
      4⤵
      Command and Scripting Interpreter: PowerShell
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:5932
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c ping -n 301 127.0.0.1 >nul & msiexec /x {6d2e8595-2878-42f0-ac5f-34c300aa1bc4} /qn /norestart
        5⤵
        System Location Discovery: System Language Discovery
        System Network Configuration Discovery: Internet Connection Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2116
      - C:\Windows\SysWOW64\PING.EXE
        
        ping -n 301 127.0.0.1
        6⤵
        System Location Discovery: System Language Discovery
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2028

C:\Users\Admin\AppData\Local\Package Cache\{942816a5-934a-480f-a429-267311165aec}\Installer_026292.exe
"C:\Users\Admin\AppData\Local\Package Cache\{942816a5-934a-480f-a429-267311165aec}\Installer_026292.exe" /burn.runonce
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2620
- C:\Users\Admin\AppData\Local\Package Cache\{942816a5-934a-480f-a429-267311165aec}\Installer_026292.exe
  "C:\Users\Admin\AppData\Local\Package Cache\{942816a5-934a-480f-a429-267311165aec}\Installer_026292.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5640
- - C:\Users\Admin\AppData\Local\Package Cache\{942816a5-934a-480f-a429-267311165aec}\Installer_026292.exe
    "C:\Users\Admin\AppData\Local\Package Cache\{942816a5-934a-480f-a429-267311165aec}\Installer_026292.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Package Cache\{942816a5-934a-480f-a429-267311165aec}\Installer_026292.exe" -burn.filehandle.attached=568 -burn.filehandle.self=576
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:1340

C:\Windows\system32\msiexec.exe
msiexec /x {6d2e8595-2878-42f0-ac5f-34c300aa1bc4} /qn /norestart
1⤵
- Suspicious use of SetWindowsHookEx
PID:852

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e59527e.rbs

Path C:\Config.Msi\e59527e.rbs
Size 10KB
SHA256 d4b7244449695e95694ddb881cd0033996bdaa6aefb6b362c016b695559dfadf
MD5 7f7e91f8b2887da3571d103b752dee87
SHA1 00c5a9e4c43b9a9c9a00609c1bfef834f53aaf01
SHA512 344d4896d65f43099cf9f9117181bbb437298db69d81bd5eca5d7808961caa63812a210a8264f9b71f6f94d5c6c4d979e7d2ffd8cfaa817b6e2fcd66f72908e3
SSDEEP 96:itcZ1/ei2UhkxMmHzatqVj2CAPDkYlCbUOeJQCsThqQrYlCbUOeJQC6jZ5auThqE:itcor7QC4k65fXI765fX2UXFMpt
TLSH
T1F22264436A40C9E2EC831B35D3436B103772E2D99746235F155FD6146F43B98ABEB0EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e595282.rbs

Path C:\Config.Msi\e595282.rbs
Size 11KB
SHA256 d3c9806c9327eb9335be9d90148fa1f7f3a7ae1a508126db0869fe4ea738fdc4
MD5 c4cdeb13cf00cfc1ac15ebb2d45d87a5
SHA1 6ee89415ad1e44cab1185e3667289ad27fd1c2c9
SHA512 f3e65e60633851dbd3e3ba2e79840b4645f6f08f3c327ab5691a2819722841d2b0e2c6b6df9079b3dca8c20548b43e528f942f1478a0fdea980dd085a44e6da9
SSDEEP 96:EtVshPaDrG8RlS0fxGwrG8Rlv0fCj4NDv5abafGYo7fBIJDPSUwc/amB4NND2k/c:EtVf/RLfT/RqfQUwzwgcfUbNc
TLSH
T13C3272036A44C5E3DC831736D35367246B73E6E4970A035F116ED6186F53A88BFEB09A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e595288.rbf

Path C:\Config.Msi\e595288.rbf
Size 69B
SHA256 39cec4568f0b0d7b4d6f0fe94b76b5670ada9ecc144fa7f3d97375f8c482d2b8
MD5 b22d7d4ac880bf1d0aa01f51e496d9ee
SHA1 98e8c9615497fd945d069e87635394382f0d0d79
SHA512 e6a3c923a4b31460c49d4fa81e5486fbe8fe0243c365bf93950db61325545d2026f0f5b0dd5479f773bacfb55d90a83c090c73da55bd603eb099d863e992b706
TLSH
T14EA0228003CC03C8008030A0AEC0A8A080B3CC08B03300008E0023FC28C208803E00F0
MD5 SHA1 SHA512 TLSH

Submit Download

AjaxMin.csproj

Path C:\Users\Admin\AppData\Local\Broadcom\Network Adapter Configuration\AjaxMin.csproj
Size 9.4MB
SHA256 790ac90ad393f2f558f802d4e81460ebf3dcd2ba04eb3985f565899f183187d9
MD5 e53549e4a337e153a293c09380f1cb9a
SHA1 b5559ca771c0388f51a2c7d12db2b979f2be1e3b
SHA512 63912ec9f6c167837f002acd0180a06a20828c19b518f96d73437b3a4f45ee983fc4a60639fe36b8df7dbeadc00b3c5ff69d95a4f51c3b453f018f6e72c4c26c
SSDEEP 1536:WJCQJEPMggOYbCe3dyxGRUUtqx5Mh1qxaftSbfkMnLs6Bxu3jJDzJrvROP5sww7m:z
TLSH
T142A6D07B078087BAF3D807C4556B251E26F5E225B625315AA77328FFBC1A9CB807C643
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AjaxMin.csproj.user

Path C:\Users\Admin\AppData\Local\Broadcom\Network Adapter Configuration\AjaxMin.csproj.user
Size 341KB
SHA256 0c2c6495e17a69866b7d57d206b8e0ca7a268fe4732f7f0e50a16aa988b286f8
MD5 d3123b8cb2192ee85861116fd2908a26
SHA1 ebfc1dde81fb149dedf4a76f31218841b4e4a676
SHA512 b5aa4eb1d0a47be70a2135ef44436d92c5ce24406fdbad9aad70f3ef67768ea1fc895662717994abede49cdfb2c494321352ba66448dd14006de4973d058a489
SSDEEP 6144:lEzl6IJuafJFsyobFVOQuB83iSQ/871gxzNfq++Q:OuHQ
TLSH
T1EE749DB099BD21F1D74B894159BCBDE445B270D7DBCBB16833AEE1524FA8B7A3B04009
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Common.targets

Path C:\Users\Admin\AppData\Local\Broadcom\Network Adapter Configuration\Common.targets
Size 569KB
SHA256 ce29b6afab0cb962e0503b8d93e7d017a954eaa1f03c57a310fac0ebf1c9f6db
MD5 fc52fe2e8f40605a05247b13b9fdefe8
SHA1 7c54110b640cb7fa74876d1859ca83c1e2c541de
SHA512 548592660b7752e414f1e14c8e13c6d73493fb9d7f43fb813c88570ac67a5d8f7fa5b519a92d3da27406f09ed3a2ad20fc2ac9c43a2e4a963d7dbce95d71aee4
SSDEEP 6144:BDY91YQmTWrmWmOAmhmFmR6imDmTMLwA499mRl5pm0/+5hmbmdm1mlmvmym5YmF5:ts/8h4
TLSH
T10AC442B8A6DF50A4F2AFC9157AACBE64013331C79BC52D94537CE5108BE9FA53E1488C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Shared.props

Path C:\Users\Admin\AppData\Local\Broadcom\Network Adapter Configuration\Shared.props
Size 73KB
SHA256 d143aa8570b0e8a0e7fcac10d32b4d25a547818797ae6b348be168624b28ade3
MD5 c2af551f556aef0c995e85a309902c96
SHA1 6cfe884f5043ab3f63df3b1edb46f4fe82f575cd
SHA512 453c2bd7822981212087614e4f2a912c01bfef56af8d4d632b32944ec01c0faaaf1c247b4bc80b5bed61733f1d70036cbcf217e1e906498644de2c3c9d175794
SSDEEP 1536:dvfd2qH043r8RPcrEgCoy+tksKVS7ItUYH+njnEEMRpa+9yL9u2UmZh/1Ky0O/fR:pd2A043r8RPcrEgCoy+tksKVS7ItUYHS
TLSH
T10773CFF0D8BE21B5D74B89412AFCBFA886F170879BCA6184236DD35D9F64729BB0440D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bootstrap_3b40.cmd

Path C:\Users\Admin\AppData\Local\Broadcom\Network Adapter Configuration\bootstrap_3b40.cmd
Size 1KB
SHA256 a5ea0dd1195dc7e24fa1fce82eb5ab715a3442c4dc1a77bc3895303c725e08c9
MD5 b7b53a4c7020e5038c5eab6cde32a055
SHA1 fb2311d807e3697c8fc78388d74c770ef4531bed
SHA512 615b7e79da05768c61a0c5dc82e4930fc41e62ac7f80c26935f2e02bbd1dd8976a50955f7a6558790c3743966a5f7d80c0195fb8b3f3610c2104a182c63fc2f0
TLSH
T16B212996B022491994B0377A4B354733530E72C33984F1BCF1A0C8AD74CF56EBA71294
MD5 SHA1 SHA512 TLSH

Submit Download

updater_b313.cmd

Path C:\Users\Admin\AppData\Local\Broadcom\Network Adapter Configuration\updater_b313.cmd
Size 241B
SHA256 87ac3e91a19673d77ca655c24561c9027ea6a862b16749e0c1e2b62c0adcf0cf
MD5 8e4f8f924028bc78d99f561338df1a3b
SHA1 01c4913356737d96ba46e72acd8d9ec559fecc3c
SHA512 ab6152ffb1c3b7fc842311119711398d8e7db2a4e848a0bb41fab4103e5f16689003122d14ef39ed15b28889a8cbcdf73c2f1621db9d6aea9e7b74ac9e919641
TLSH
T16DD0979B1C0CB0BBF8A6C6104081E3484E4761C0010221C339968628FE020C582D98A8
MD5 SHA1 SHA512 TLSH

Submit Download

PkgUpdate83a478

Path C:\Users\Admin\AppData\Local\Package Cache\.unverified\PkgUpdate83a478
Size 2.6MB
SHA256 567e9baa623e06b287ab686d5ca97bb1a73371dca082e243ce05df0aea9dcfcf
MD5 d0d2de5ed37a83e8ab0ac885131b295a
SHA1 1ec7ebf5aeb65a6f0ed45d7021668549793b859a
SHA512 73bb2e36043ab21e988d1fae194174aa6d209d31f6500a582eefccec278c1b80fa265917495e484a4a58db60797c7c0603551ea4900254706bf4be2c11effe5d
SSDEEP 49152:IqM6i1E2wEyML8Mk9DyPGlIedwBjxMcuv7cn6RQx58x:IqF1M4Mk9DyPG+CWtXIoeU
TLSH
T116C52331B480567EE7EA0935D82EA232AE7DFE2C1B64C46D8350B91E1CB45C117F5FA2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

state.rsm

Path C:\Users\Admin\AppData\Local\Package Cache\{942816a5-934a-480f-a429-267311165aec}\state.rsm
Size 838B
SHA256 e494401b85810347de06eca0d5b534e752308bc9d8c89fffc510aa1406d80903
MD5 459ff8838fc3b50ca5a8a93d3b7601e7
SHA1 24e0f9da249fcf15ddeb4fb4b582e129be82b404
SHA512 9aa279132678658d9a31892abd6fb06874d9f03ff447f94eba01674ed3d4c2afcac5e51f8a170bb95422dcd5015fb8a3719124aabc5f43f47fff4f3022ad5cfb
TLSH
T144015E61AFF61069E3F7BB7179F616145ABFB8221E22D01D0181718E8F32B91DE24722
MD5 SHA1 SHA512 TLSH

Submit Download

MSI5829.tmp

Path C:\Windows\Installer\MSI5829.tmp
Size 202KB
SHA256 e0db1804cf53ed4819ed70cb35c67680ce1a77573efded86e6dac81010ce55e7
MD5 d773d9bd091e712df7560f576da53de8
SHA1 165cfbdce1811883360112441f7237b287cf0691
SHA512 15a956090f8756a6bfdbe191fda36739b1107eada62c6cd3058218beb417bdbd2ea82be9b055f7f6eb8017394b330daff2e9824dbc9c4f137bead8e2ac0574cd
SSDEEP 3072:r65Z1YCHGiZXOVneG/kdvLdzusAatnw1lflQnB+QDO1Q+cxbVeFT:r657r+0G/kvzoaBcHLnN
TLSH
T10C148C216494903EE7FA1936D93ED671AE7DF6280B60C99EC3848C0E5D604D16BF3B27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

test.exe

Path C:\Windows\Temp\{331D488D-FABE-4C7F-AD89-C64CC0E27BEC}\.cr\test.exe
Size 652KB
SHA256 29f2737fafefbf4f7270f701e5ec70215ebf8c7eddcd695bfa021a29598ce42f
MD5 ef231f37c6d8d627e827aafd65a4cc99
SHA1 97e025c8fa6331feb8d879262a09c094197a3656
SHA512 d7b6d4981e3d7f0a0c3f3c02edf9083d7641cdddb2b01dfb92cb7c5d3053fe7458ff77338682e984199cb28ce73e6f611ad4c56ba5f36da01b5e7ab691a2af26
SSDEEP 12288:JAjuakTOfDlEU4HWDblFlOTPThNqEdeS77MJyWVxhVznr8i:Su/OfDlEUKWflmTP3xdnYJRzAi
TLSH
T1EAE48E31A1614032E6F106B7FD28A6307E7CE738175488BAD3D8ED1D6EA84916BF7253
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BootstrapperCore.config

Path C:\Windows\Temp\{A559785A-A3EB-413D-B9FD-F5F57CA84B61}\.ba\BootstrapperCore.config
Size 732B
SHA256 77867e0c2437f36333314eb1b3a0ff0d3c95d0a41cba9618a16c3115f2cbeee0
MD5 c9b28ceed244686d1a1e53e07b9e8358
SHA1 94b904f4bc5a865374a4e244cb4cd8a036cdc3c7
SHA512 d1b29f4c0d94a1387405b3951b75c4bb46b3e6fdb38ee141db3ad3d37ada58c9257227adf84a3e99894c64e5aa2ad409e5ec31f17e80d7c18b858738bfee35dc
TLSH
T11B01280553A4FD768A32052FB6478660DFF4B2B290904848726F675B0F7208F6B5335A
MD5 SHA1 SHA512 TLSH

Submit Download

BootstrapperCore.dll

Path C:\Windows\Temp\{A559785A-A3EB-413D-B9FD-F5F57CA84B61}\.ba\BootstrapperCore.dll
Size 80KB
SHA256 886cb2a994461f091752fc7b21e3143c212efd8841c757909e74ac32761880da
MD5 c4f7146ddc56763ccdb1cb3c09478708
SHA1 bca088ab33cfb69adeae11a272e9c8a83f39a8c9
SHA512 df2ca029e95f80fc5870e541db8b1d5a03266307bb5f7680ad630868a9a3c584b3a702fbec09c26fef7287c99f5d9d1f59cd59b74dcf740c9a8e7508e07d18b5
SSDEEP 768:GBgPxZlx0MBps+j7ejaab0Y6OwE7v10WHSp5fh06iG27N9k+6ybJ17rEgtu:qHMBp/GRbgi5ofpiG2pq+517ogE
TLSH
T15183E72B179CA676D35E0BBDF4410D2793B0F90C25A2E3EB694AD63B2C6371E09415F2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SilentBA.dll

Path C:\Windows\Temp\{A559785A-A3EB-413D-B9FD-F5F57CA84B61}\.ba\SilentBA.dll
Size 4KB
SHA256 f2c71ce7db862adec34c6582805b58c4ea5cac6e51efd1772b2e67c8eff47179
MD5 fb602cabe03b95dcdcd8495bf7ffb767
SHA1 b3b14a9ced034dec57c1ce0fa39249383401f9c6
SHA512 8d4b8a308d7cbf7b78c7ac3edb85a8907a0365cabbd87f31ac427012d3b3c8c676d2e422142133ec3ff4ffd4ecf8c90349f40da224b1f33b7eaf2d2eb2e69645
SSDEEP 48:6i+lXmSHfPZo/PAWER5u56Vp3cqOv2MMEtOl/6TMiE+sVtiOll67lqF:U2zI1ZEsuM/n67
TLSH
T1E991A60263E40373ED27477BEFA3436102B4FB61AD53ABAD0DC65245AD1320A4A22B35
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mbahost.dll

Path C:\Windows\Temp\{A559785A-A3EB-413D-B9FD-F5F57CA84B61}\.ba\mbahost.dll
Size 111KB
SHA256 b925d9d3e1e2c49bf05a1b0713e2750ee6e0c43c7adc9d3c3a1b9fb8c557c3df
MD5 d7c697ceb6f40ce91dabfcbe8df08e22
SHA1 49cd0213a1655dcdb493668083ab2d7f55135381
SHA512 22ca87979ca68f10b5fda64c27913d0f2a12c359b04e4a6caa3645303fbd47cd598c805fd9a43c8f3e0934e9d2db85f7a4e1eff26cb33d233efc05ee2613cfc1
SSDEEP 1536:p80SgCFfGu7VdeirtQAXvmZ7VkxtamC/53E7UGmy+uECOVsWj1cduJPS0IK78:p8zv6AXvXxtam053YrEIuJPS0IK78
TLSH
T1A4B37C02B58180B2E5FE1D3C4934A6A15B7EB930DDB49DDB1388216A6FB00D1AF75F63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1340-174-0x00000000002E0000-0x0000000000355000-memory.dmp

Download

memory/2108-167-0x000002314E560000-0x000002314E5E0000-memory.dmp

Download

memory/2108-151-0x0000023134020000-0x000002313403A000-memory.dmp

Download

memory/2108-152-0x000002314E300000-0x000002314E45A000-memory.dmp

Download

memory/2108-149-0x0000023133B70000-0x0000023133BAE000-memory.dmp

Download

memory/2108-155-0x0000023135980000-0x00000231359B0000-memory.dmp

Download

memory/3640-204-0x0000021918810000-0x00000219191B4000-memory.dmp

Download

memory/4068-42-0x0000000073082000-0x0000000073083000-memory.dmp

Download

memory/4068-47-0x00000000030E0000-0x00000000030F8000-memory.dmp

Download

memory/4068-188-0x0000000073070000-0x000000007382C000-memory.dmp

Download

memory/4068-56-0x00000000030C0000-0x00000000030C8000-memory.dmp

Download

memory/4068-49-0x0000000073070000-0x000000007382C000-memory.dmp

Download

memory/4068-52-0x0000000073070000-0x000000007382C000-memory.dmp

Download

memory/4068-59-0x0000000073070000-0x000000007382C000-memory.dmp

Download

memory/5640-175-0x00000000002E0000-0x0000000000355000-memory.dmp

Download

memory/5932-156-0x00000000058C0000-0x0000000005926000-memory.dmp

Download

memory/5932-148-0x00000000049B0000-0x00000000049E6000-memory.dmp

Download

memory/5932-163-0x0000000005FF0000-0x000000000603C000-memory.dmp

Download

memory/5932-162-0x0000000005EA0000-0x0000000005EBE000-memory.dmp

Download

memory/5932-176-0x0000000006E70000-0x0000000006F06000-memory.dmp

Download

memory/5932-177-0x00000000063E0000-0x00000000063FA000-memory.dmp

Download

memory/5932-178-0x0000000006430000-0x0000000006452000-memory.dmp

Download

memory/5932-179-0x00000000074D0000-0x0000000007A8A000-memory.dmp

Download

memory/5932-161-0x00000000059A0000-0x0000000005CFB000-memory.dmp

Download

memory/5932-157-0x0000000005930000-0x0000000005996000-memory.dmp

Download

memory/5932-153-0x0000000005820000-0x0000000005842000-memory.dmp

Download

memory/5932-150-0x0000000005040000-0x000000000568A000-memory.dmp

Download