Analysis
- max time kernel
149s - max time network
128s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
21/07/2026, 03:04
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
cpolar_amd64.msi
Resource
win10ltsc2021-20260513-en
windows10-ltsc_2021-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
cpolar_amd64.msi
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
16 signatures
150 seconds
General
- Target cpolar_amd64.msi
- Size 8.0MB
- Sample260721-dk447aey7w
- SHA256 59f2f87f48c324b5ea40dbcc0cee4f8f5fbb54d1a2a42757178dcb094f92a2ca
- MD5 7f2efa93a4fac42e42c43bcfbab16b82
- SHA1 a7d1674aa26825b514efb3c02193a69be8a3b262
- SHA512 b7653a54f6b827d215153786a7c5a56323187adb10ad15ff69f289c100f358f2c3b154c36a2a16eeb39d2f76d4e7ab578870225dd255818d3d5e973b66e323be
- SSDEEP 196608:fJhWWG/uCBNI+2sqNBPjbKDwwvHLH45JfjyFK7EwNmVPnuAxCtbIW:fJhSYZPqvHD4iFK7XcfnxCtcW
- TLSH T16786123C97E342AACF9BCB31372A79440D2A5C1872D4AF85435F371B1DBC6A105ABE61
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 5 IoCs
pid Process 1440 cpolar.exe 1788 cpolar.exe 5576 cpolar.exe 1520 cpolar.exe 5648 cpolar.exe - Loads dropped DLL 5 IoCs
pid Process 4600 MsiExec.exe 2516 MsiExec.exe 2516 MsiExec.exe 2516 MsiExec.exe 448 MsiExec.exe - Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\D: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\D: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\U: msiexec.exe - Drops file in Program Files directory 4 IoCs
description ioc Process File created C:\Program Files\cpolar\cpolar.exe msiexec.exe File created C:\Program Files\cpolar\webui.url msiexec.exe File created C:\Program Files\cpolar\assets\webui.url msiexec.exe File created C:\Program Files\cpolar\assets\.DS_Store msiexec.exe - Drops file in Windows directory 20 IoCs
description ioc Process File opened for modification C:\Windows\Installer\e5a855e.msi msiexec.exe File created C:\Windows\SystemTemp\~DF69A9996813B71139.TMP msiexec.exe File opened for modification C:\Windows\Installer\MSI96B5.tmp msiexec.exe File created C:\Windows\SystemTemp\~DF5B19A94771C313A4.TMP msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File opened for modification C:\Windows\Installer\MSI8A9E.tmp msiexec.exe File created C:\Windows\Installer\{3C5EA8D1-55AC-4BE3-B1FA-CAB34CC87207}\Icon0 msiexec.exe File opened for modification C:\Windows\Installer\{3C5EA8D1-55AC-4BE3-B1FA-CAB34CC87207}\app.ico msiexec.exe File created C:\Windows\Installer\e5a8560.msi msiexec.exe File opened for modification C:\Windows\Installer\MSIAA30.tmp msiexec.exe File created C:\Windows\SystemTemp\~DFE62DB48EA43DC424.TMP msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File created C:\Windows\SystemTemp\~DF372D3EF4949123F3.TMP msiexec.exe File opened for modification C:\Windows\Installer\{3C5EA8D1-55AC-4BE3-B1FA-CAB34CC87207}\Icon0 msiexec.exe File created C:\Windows\Installer\{3C5EA8D1-55AC-4BE3-B1FA-CAB34CC87207}\app.ico msiexec.exe File created C:\Windows\Installer\e5a855e.msi msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\Installer\SourceHash{3C5EA8D1-55AC-4BE3-B1FA-CAB34CC87207} msiexec.exe File opened for modification C:\Windows\Installer\MSI8D1F.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI9B2B.tmp msiexec.exe - Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
pid Process 3972 msiexec.exe - System Location Discovery: System Language Discovery 1 TTPs 6 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe - Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000ffbf1fc65d8bbf350000000000000000000000000000000000000000000000000000000000000000000000000000000000001071020000000000c0120000000000000000000000002701010000883801ffbf1fc60000000000001071020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d0830200000000006025c501000000000000000000000700010000e84101ffbf1fc6000000000000d08302000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9c701000000000000050000000000000000000000070001000098d4e3ffbf1fc600000000000030a9c7010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9cc0100000000000005000000000000000000000007000100009854e6ffbf1fc600000000000030a9cc01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe - Modifies data under HKEY_USERS 3 IoCs
description ioc Process Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E msiexec.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28 msiexec.exe - Modifies registry class 23 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\53A24986EEB7F3E4F98AD1A040991544\1D8AE5C3CA553EB41BAFAC3BC48C2770 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1D8AE5C3CA553EB41BAFAC3BC48C2770\SourceList\Media msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1D8AE5C3CA553EB41BAFAC3BC48C2770\ProductIcon = "C:\\Windows\\Installer\\{3C5EA8D1-55AC-4BE3-B1FA-CAB34CC87207}\\app.ico" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1D8AE5C3CA553EB41BAFAC3BC48C2770\DeploymentFlags = "3" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1D8AE5C3CA553EB41BAFAC3BC48C2770\SourceList\Media\1 = ";" msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1D8AE5C3CA553EB41BAFAC3BC48C2770\Clients = 3a0000000000 msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1D8AE5C3CA553EB41BAFAC3BC48C2770\InstanceType = "0" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\53A24986EEB7F3E4F98AD1A040991544 msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1D8AE5C3CA553EB41BAFAC3BC48C2770\Language = "1033" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1D8AE5C3CA553EB41BAFAC3BC48C2770\AdvertiseFlags = "388" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1D8AE5C3CA553EB41BAFAC3BC48C2770\SourceList\Net msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1D8AE5C3CA553EB41BAFAC3BC48C2770\PackageCode = "6CF45085C7988024D822A76905537A67" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1D8AE5C3CA553EB41BAFAC3BC48C2770\AuthorizedLUAApp = "0" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1D8AE5C3CA553EB41BAFAC3BC48C2770\SourceList msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1D8AE5C3CA553EB41BAFAC3BC48C2770\SourceList\PackageName = "cpolar_amd64.msi" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1D8AE5C3CA553EB41BAFAC3BC48C2770\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1D8AE5C3CA553EB41BAFAC3BC48C2770\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\1D8AE5C3CA553EB41BAFAC3BC48C2770 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\1D8AE5C3CA553EB41BAFAC3BC48C2770\DefaultFeature msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1D8AE5C3CA553EB41BAFAC3BC48C2770 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1D8AE5C3CA553EB41BAFAC3BC48C2770\ProductName = "cpolar" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1D8AE5C3CA553EB41BAFAC3BC48C2770\Version = "50528268" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1D8AE5C3CA553EB41BAFAC3BC48C2770\Assignment = "1" msiexec.exe - Suspicious behavior: EnumeratesProcesses 22 IoCs
pid Process 4620 msiexec.exe 4620 msiexec.exe 1440 cpolar.exe 1440 cpolar.exe 1440 cpolar.exe 1440 cpolar.exe 1788 cpolar.exe 1788 cpolar.exe 1788 cpolar.exe 1788 cpolar.exe 5576 cpolar.exe 5576 cpolar.exe 5576 cpolar.exe 5576 cpolar.exe 1520 cpolar.exe 1520 cpolar.exe 1520 cpolar.exe 1520 cpolar.exe 5648 cpolar.exe 5648 cpolar.exe 5648 cpolar.exe 5648 cpolar.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 3972 msiexec.exe Token: SeIncreaseQuotaPrivilege 3972 msiexec.exe Token: SeSecurityPrivilege 4620 msiexec.exe Token: SeCreateTokenPrivilege 3972 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 3972 msiexec.exe Token: SeLockMemoryPrivilege 3972 msiexec.exe Token: SeIncreaseQuotaPrivilege 3972 msiexec.exe Token: SeMachineAccountPrivilege 3972 msiexec.exe Token: SeTcbPrivilege 3972 msiexec.exe Token: SeSecurityPrivilege 3972 msiexec.exe Token: SeTakeOwnershipPrivilege 3972 msiexec.exe Token: SeLoadDriverPrivilege 3972 msiexec.exe Token: SeSystemProfilePrivilege 3972 msiexec.exe Token: SeSystemtimePrivilege 3972 msiexec.exe Token: SeProfSingleProcessPrivilege 3972 msiexec.exe Token: SeIncBasePriorityPrivilege 3972 msiexec.exe Token: SeCreatePagefilePrivilege 3972 msiexec.exe Token: SeCreatePermanentPrivilege 3972 msiexec.exe Token: SeBackupPrivilege 3972 msiexec.exe Token: SeRestorePrivilege 3972 msiexec.exe Token: SeShutdownPrivilege 3972 msiexec.exe Token: SeDebugPrivilege 3972 msiexec.exe Token: SeAuditPrivilege 3972 msiexec.exe Token: SeSystemEnvironmentPrivilege 3972 msiexec.exe Token: SeChangeNotifyPrivilege 3972 msiexec.exe Token: SeRemoteShutdownPrivilege 3972 msiexec.exe Token: SeUndockPrivilege 3972 msiexec.exe Token: SeSyncAgentPrivilege 3972 msiexec.exe Token: SeEnableDelegationPrivilege 3972 msiexec.exe Token: SeManageVolumePrivilege 3972 msiexec.exe Token: SeImpersonatePrivilege 3972 msiexec.exe Token: SeCreateGlobalPrivilege 3972 msiexec.exe Token: SeCreateTokenPrivilege 3972 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 3972 msiexec.exe Token: SeLockMemoryPrivilege 3972 msiexec.exe Token: SeIncreaseQuotaPrivilege 3972 msiexec.exe Token: SeMachineAccountPrivilege 3972 msiexec.exe Token: SeTcbPrivilege 3972 msiexec.exe Token: SeSecurityPrivilege 3972 msiexec.exe Token: SeTakeOwnershipPrivilege 3972 msiexec.exe Token: SeLoadDriverPrivilege 3972 msiexec.exe Token: SeSystemProfilePrivilege 3972 msiexec.exe Token: SeSystemtimePrivilege 3972 msiexec.exe Token: SeProfSingleProcessPrivilege 3972 msiexec.exe Token: SeIncBasePriorityPrivilege 3972 msiexec.exe Token: SeCreatePagefilePrivilege 3972 msiexec.exe Token: SeCreatePermanentPrivilege 3972 msiexec.exe Token: SeBackupPrivilege 3972 msiexec.exe Token: SeRestorePrivilege 3972 msiexec.exe Token: SeShutdownPrivilege 3972 msiexec.exe Token: SeDebugPrivilege 3972 msiexec.exe Token: SeAuditPrivilege 3972 msiexec.exe Token: SeSystemEnvironmentPrivilege 3972 msiexec.exe Token: SeChangeNotifyPrivilege 3972 msiexec.exe Token: SeRemoteShutdownPrivilege 3972 msiexec.exe Token: SeUndockPrivilege 3972 msiexec.exe Token: SeSyncAgentPrivilege 3972 msiexec.exe Token: SeEnableDelegationPrivilege 3972 msiexec.exe Token: SeManageVolumePrivilege 3972 msiexec.exe Token: SeImpersonatePrivilege 3972 msiexec.exe Token: SeCreateGlobalPrivilege 3972 msiexec.exe Token: SeCreateTokenPrivilege 3972 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 3972 msiexec.exe Token: SeLockMemoryPrivilege 3972 msiexec.exe - Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 3972 msiexec.exe 3972 msiexec.exe - Suspicious use of SetWindowsHookEx 5 IoCs
pid Process 3972 msiexec.exe 4620 msiexec.exe 4600 MsiExec.exe 2516 MsiExec.exe 448 MsiExec.exe - Suspicious use of WriteProcessMemory 13 IoCs
description pid Process procid_target PID 4620 wrote to memory of 4600 4620 msiexec.exe 89 PID 4620 wrote to memory of 724 4620 msiexec.exe 95 PID 4620 wrote to memory of 2516 4620 msiexec.exe 97 PID 2516 wrote to memory of 1440 2516 MsiExec.exe 98 PID 1440 wrote to memory of 3748 1440 cpolar.exe 100 PID 2516 wrote to memory of 1788 2516 MsiExec.exe 101 PID 1788 wrote to memory of 2484 1788 cpolar.exe 103 PID 2516 wrote to memory of 5576 2516 MsiExec.exe 104 PID 5576 wrote to memory of 2660 5576 cpolar.exe 106 PID 1520 wrote to memory of 2916 1520 cpolar.exe 109 PID 1520 wrote to memory of 5648 1520 cpolar.exe 111 PID 5648 wrote to memory of 2152 5648 cpolar.exe 113 PID 4620 wrote to memory of 448 4620 msiexec.exe 114 - Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\cpolar_amd64.msi1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:3972
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4620 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding F38678CEC2E923A9BB14DCEE422A3786 C2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4600
-
-
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵PID:724
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 49D365AC56C54DCA72C49F6E32A6841E E Global\MSI00002⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2516 -
C:\Program Files\cpolar\cpolar.exe"C:\Program Files\cpolar\cpolar.exe" service uninstall3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1440 -
C:\Windows\SysWOW64\cmd.execmd ver4⤵
- System Location Discovery: System Language Discovery
PID:3748
-
-
-
C:\Program Files\cpolar\cpolar.exe"C:\Program Files\cpolar\cpolar.exe" service install3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1788 -
C:\Windows\SysWOW64\cmd.execmd ver4⤵
- System Location Discovery: System Language Discovery
PID:2484
-
-
-
C:\Program Files\cpolar\cpolar.exe"C:\Program Files\cpolar\cpolar.exe" service start3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5576 -
C:\Windows\SysWOW64\cmd.execmd ver4⤵
- System Location Discovery: System Language Discovery
PID:2660
-
-
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 9ECF111AE86B13EEBAC1F8A0CB55E72D2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:448
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
PID:2180
-
C:\Program Files\cpolar\cpolar.exe"C:\Program Files\cpolar\cpolar.exe" start-all -daemon=on -dashboard=on -log=C:\Users\Admin/.cpolar/logs/cpolar_service.log -config=C:\Users\Admin/.cpolar/cpolar.yml1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1520 -
C:\Windows\system32\cmd.execmd ver2⤵PID:2916
-
-
C:\Program Files\cpolar\cpolar.exe"C:\Program Files\cpolar\cpolar.exe" start-all -daemon=on -dashboard=on -log=C:\Users\Admin/.cpolar/logs/cpolar_service.log -config=C:\Users\Admin/.cpolar/cpolar.yml2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5648 -
C:\Windows\system32\cmd.execmd ver3⤵PID:2152
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Config.Msi\e5a855f.rbs
- Size 8KB
- SHA256 e9c27de58ede2a05c4bb2716441455891e3a065edb797b9ce5ae30996b8577ce
- MD5 7fabcf1ba9995c4d91a22531c8cf35a9
- SHA1 0d05d659ae66e8a82a9e582185c0f938e3bc211f
- SHA512 d7e311a4288f7cd32dbfe87cdf277ee61a3a19fc658ae61695e92872acb9d6390cd8c1c38e140211659b5ef5a9a3870765c0e72b6793a7c52590b5a2714aa4bd
- SSDEEP 192:v5+h5zIz+zeSz3z1zRzAZFCPpfOqYaZIFqfOqYaZ7FJTTllCIpO:xi5gSe+DNjJnJRTl+
- TLSH T1AB021041BB5285E2E5531731D32B0BB53BB3C7895348578F0AAC9120EF973885FB869A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\cpolar\cpolar.exe
- Size 18.7MB
- SHA256 ae4a871c33f8cd3a6ad118247b6205219b2008425d018f56cb9feec8aca90cea
- MD5 8cf601c06370612010f438fa8faa8aa7
- SHA1 849ecc7bf6c52bd1676ffe331de76c134abc6fc4
- SHA512 3171e8c3028e5c58c3992742bf6d8d42db0ba4d286de6584cc3ef1fadde68f355344bbbdc0fdf02398e3438802d5bb25826d5f6071bbc2069431ab23a03ba58d
- SSDEEP 196608:yfT35V8fnRVct5w4eb9+8Z/tamASRTE+NGRXGzX:ECcK/toSR4+NaWb
- TLSH T108176D53F95961E4CAEDD170CABA82227B30344583303BD73B29DAB52B53BD45BB9390
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\.cpolar\cpolar.yml
- Size 159B
- SHA256 dcf41d287cf9d3d4c004a4b30f6c8bd3cf9635522deab665132134d666e2191a
- MD5 994512596123f391f2d71713bd67cc1b
- SHA1 385c56875cd43db67edc93cb04d26474885f1b45
- SHA512 b6c5c3194418855e94a89cf02942822a7d74c1e0fd637b37ed7fe24caa81459652c188f4fbf1c6659b60abfbf0d4501dbedc9acde9263268bffabf3b5c6ebaa2
- TLSH T1FEC08C8E8330121AB826B188AB3E840B2E1C38538E93081CB68193C10F681D4E22188E
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\.cpolar\logs\cpolar_service.log.master.log
- Size 410B
- SHA256 ca1bb7bf9724e657cc05921a079039241e0e7cf559427caea0ad90d359d14ae0
- MD5 6c94a3eacc31b9b14be1fbb78e9492e1
- SHA1 2a1e832db47f0edc3303ea8e1041e81219fd147b
- SHA512 b52829075fb84560f279e1085a9544e39faabc24a69ffd304f8d06ead33a09c8704a7cbd41b51da58faa2e8c2b0ccf99930781371d77f5a15e6554efee950b05
- TLSH T117E09B2004B27D5E3753204196CF37CECBAEE35C188752B49738EA1C15111771E791F1
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\MSI3133.tmp
- Size 102KB
- SHA256 097f1c3f27b18010448d77e3f70c4d9f774cb9c5ab435c62baa1c00e4cadd5ef
- MD5 d9ac1b56edf330a6eb7894ab293f14f6
- SHA1 022d8944e3927fff2b330dab54716ddcbb366d16
- SHA512 e434410e2b2c2bb1fba4f3fc7c277b978c45b1df1d3c3994d6dc1530558393d7d42a713506bf95d013b2e40e9da36fd3e588fea8d8dc062a24ad931e4d76c328
- SSDEEP 3072:6SucbZHLGhmArwB2l9sv69okpLPpxVXpj:aoZ6Zrw0Lrv
- TLSH T1E6A38D21B0C0C172D9BF2D3D4574D6650BBFB830EEA59EAB635402691EB81C0BE35E67
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\MSI8D1F.tmp
- Size 199KB
- SHA256 fb7a6eb19d1d1042d3bd8b3add9271116b8b6db3714dfcc0b6fee8e088d4a2cc
- MD5 3a4e61909500d677745ef2ab508f3f3b
- SHA1 ee398e1a153ca96c2592816eb8e8b2b7bb845e1e
- SHA512 feba07bba5007a20e0a1e2ca8c9050ae8624e8fbb0f24aada5dc7c2bde3be561b844453a573cab2a24c3769a8dba401db4eeef0d22ef86e2109b67e54392ee45
- SSDEEP 3072:/gCUXX2mXSRH48su9/3wvGxtKyHcas3AOOjflQnERfjqmmQ+cx3XD:/gCgPwYo9/3RtKvasQr2L
- TLSH T11B148D3175D4803DE6FB1932A66EE270AE7DF1142764C59E83848C1FADA40D16BB3B27
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\e5a855e.msi
- Size 8.0MB
- SHA256 59f2f87f48c324b5ea40dbcc0cee4f8f5fbb54d1a2a42757178dcb094f92a2ca
- MD5 7f2efa93a4fac42e42c43bcfbab16b82
- SHA1 a7d1674aa26825b514efb3c02193a69be8a3b262
- SHA512 b7653a54f6b827d215153786a7c5a56323187adb10ad15ff69f289c100f358f2c3b154c36a2a16eeb39d2f76d4e7ab578870225dd255818d3d5e973b66e323be
- SSDEEP 196608:fJhWWG/uCBNI+2sqNBPjbKDwwvHLH45JfjyFK7EwNmVPnuAxCtbIW:fJhSYZPqvHD4iFK7XcfnxCtcW
- TLSH T16786123C97E342AACF9BCB31372A79440D2A5C1872D4AF85435F371B1DBC6A105ABE61
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
- Size 26.1MB
- SHA256 eecb30c023beb145fdb7816ca62b0b29d5d36d54fd5c07312bffd23f8b2741a5
- MD5 8f9571e9945523ffd06040c29c85b239
- SHA1 1699c50585ea684a5d46b59e4b4d1a663fa6d593
- SHA512 8343736615914e5f79546cfdc4b8b4d48293b9d16fd439974a2cd330bd97dd45f9f99be7913df16b631b7184249d9d0da8de29dcd92d35e82bae31be13977c0d
- SSDEEP 24576:GFo3DMPMdoO/vvTL/yAsMilQPrOWX7rf0R6e9BCE65iqpLNMMoR2s12NoeG:fH4
- TLSH T1E057B51436F92100E7F79E3CA8F06A234D397D5BAC19DE8D45511B8E0922F71E872F6A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\Volume{c61fbfff-0000-0000-0000-d08302000000}\System Volume Information\SPP\OnlineMetadataCache\{a03de37c-94e7-4547-b5c9-c7ff62c03547}_OnDiskSnapshotProp
- Size 6KB
- SHA256 8c4e9acbdaafcd7e23736802bc1129f3437bf385738ca562517a229941e40ef2
- MD5 a32abb2656c95cc6197a71533cf40c47
- SHA1 680122a0dc9e7628e1409df5ef85ff85633b452b
- SHA512 c86bc6d1edb0810df0882d8d86b51173bcd7fb604a63c61cd9c6bce952ddbed69a58f4877563c6d1e6d8a43f9e680b423231d7b6be2efb1745c4f424bb08adfb
- SSDEEP 96:FQJeW5mLKlDvc6DD84LTHzbOHXOHBlBRQn8Sc9XE56tOSVQpu:ch7l/b++uVm
- TLSH T11AD189085AF54711E2F3AB3229F14557A837B911EF33CB8E0198238E6671910F935F5B
- MD5 SHA1 SHA512 SSDEEP TLSH