Analysis
- max time kernel
146s - max time network
151s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
30/07/2026, 02:13
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Install_28n002.msi
Resource
win10v2004-20260513-en
windows10-2004-x64
30 signatures
150 seconds
Behavioral task
behavioral2
Sample
Install_28n002.msi
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
26 signatures
150 seconds
General
- Target Install_28n002.msi
- Size 5.7MB
- Sample260730-cnes2axdpd
- SHA256 c934ce2e4f8cb4f165edecb51d91390b00f5084809bad25c0a5a189271fa5fe8
- MD5 46fcdc786df0a6e837ca97924579d069
- SHA1 c99f0df69ed9ffb9e77b6757df6347ab6540d5a7
- SHA512 16c3e24e49e10ca11db64f4a98a77b8d5b33e36bd0c591fb35e205a81c04d08f89377c9455bcec7d5daad553f447bad1d633435a6fdcde3237e720c65d0eb919
- SSDEEP 98304:F6pdCiGJuFw5V4SGWXlgAzCEFO0kJQpAmAzKdN8wMVL66dYXzIrrrHlX:8dCis4BEoZJLm4Kv8w+GzerZ
- TLSH T1A05633D179C66F70D0A3CBF4561A6A1D3DAE3FD5B972CC0A67D43A006E32625DA32309
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Windows security bypass 2 TTPs 10 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\ProgramData = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Public\Tz0hEC = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\Documents = "0" reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users = "0" reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86) = "0" reg.exe - Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 6048 powershell.exe - Executes dropped EXE 1 IoCs
pid Process 1316 5anpFs.exe - Loads dropped DLL 2 IoCs
pid Process 464 MsiExec.exe 1316 5anpFs.exe - Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Tencent SecurityHealth = "\"C:\\Users\\Public\\Tz0hEC\\5anpFs.exe\"" 5anpFs.exe - Badlisted process makes network request 3 IoCs
Network request originating from process or tool commonly abused by malware.
flow pid Process 2 464 MsiExec.exe 7 464 MsiExec.exe 8 464 MsiExec.exe - Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\D: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\D: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\P: msiexec.exe - Indicator Removal: Clear Persistence 1 TTPs 5 IoCs
Clear artifacts associated with previously established persistence like scheduletasks on a host.
pid Process 3008 cmd.exe 5212 cmd.exe 4740 cmd.exe 3376 cmd.exe 2996 cmd.exe - Drops file in System32 directory 9 IoCs
description ioc Process File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157 MsiExec.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97 MsiExec.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97 MsiExec.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\01C6E817D6CDFECAEC27F2EB1524A7A6_905E6EE25CEC96FCC88A884EFC247049 MsiExec.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157 MsiExec.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6 MsiExec.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6 MsiExec.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\01C6E817D6CDFECAEC27F2EB1524A7A6_905E6EE25CEC96FCC88A884EFC247049 MsiExec.exe File created C:\Windows\System32\CodeIntegrity\SiPolicy.p7b 5anpFs.exe - Drops file in Program Files directory 9 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\8ZHltA\XPSPLOG.dll 5anpFs.exe File opened for modification C:\Program Files (x86)\8ZHltA\thumbs.db 5anpFs.exe File created C:\Program Files (x86)\8ZHltA\8ZHltA.exe 5anpFs.exe File created C:\Program Files (x86)\8ZHltA\image.png 5anpFs.exe File opened for modification C:\Program Files (x86)\8ZHltA\image.png 5anpFs.exe File opened for modification C:\Program Files (x86)\8ZHltA 5anpFs.exe File created C:\Program Files (x86)\8ZHltA\XPSPLOG.dll 5anpFs.exe File created C:\Program Files (x86)\8ZHltA\thumbs.db 5anpFs.exe File opened for modification C:\Program Files (x86)\8ZHltA\8ZHltA.exe 5anpFs.exe - Drops file in Windows directory 13 IoCs
description ioc Process File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File created C:\Windows\SystemTemp\~DF9D7D8EF522227B09.TMP msiexec.exe File opened for modification C:\Windows\Installer\MSI9462.tmp msiexec.exe File created C:\Windows\Installer\e5a8e97.msi msiexec.exe File created C:\Windows\SystemTemp\~DFCA05D74BA5A7B8FC.TMP msiexec.exe File created C:\Windows\Installer\e5a8e95.msi msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\Installer\SourceHash{1A6C27A2-FA3D-F13A-46E4-B05FDEE281FB} msiexec.exe File created C:\Windows\SystemTemp\~DFD8633EF58F30F34D.TMP msiexec.exe File opened for modification C:\Windows\Installer\MSI959B.tmp msiexec.exe File created C:\Windows\SystemTemp\~DF606033570283AE8A.TMP msiexec.exe File opened for modification C:\Windows\Installer\e5a8e95.msi msiexec.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
pid Process 4568 msiexec.exe - Executes a command shell one-liner 1 TTPs 5 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 2612 cmd.exe 1296 cmd.exe 3948 cmd.exe 2484 cmd.exe 3656 cmd.exe - Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 000000000400000081a973cadba16b310000000000000000000000000000000000000000000000000000000000000000000000000000000000001071020000000000c012000000000000000000000000270101000088380181a973ca0000000000001071020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d0830200000000006025c501000000000000000000000700010000e8410181a973ca000000000000d08302000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9c701000000000000050000000000000000000000070001000098d4e381a973ca00000000000030a9c7010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9cc0100000000000005000000000000000000000007000100009854e681a973ca00000000000030a9cc01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe - Modifies data under HKEY_USERS 9 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ MsiExec.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" MsiExec.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" MsiExec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing MsiExec.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" MsiExec.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" MsiExec.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E msiexec.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28 msiexec.exe - Modifies registry class 22 IoCs
description ioc Process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2A72C6A1D3AFA31F644E0BF5ED2E18BF\Clients = 3a0000000000 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2A72C6A1D3AFA31F644E0BF5ED2E18BF\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\2A72C6A1D3AFA31F644E0BF5ED2E18BF msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\2A72C6A1D3AFA31F644E0BF5ED2E18BF\UuueatYAD msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2A72C6A1D3AFA31F644E0BF5ED2E18BF\PackageCode = "DDBDB3AAAA3DFAD46BC0B0DC3E8339EA" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2A72C6A1D3AFA31F644E0BF5ED2E18BF\AuthorizedLUAApp = "0" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2A72C6A1D3AFA31F644E0BF5ED2E18BF\DeploymentFlags = "3" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2A72C6A1D3AFA31F644E0BF5ED2E18BF\SourceList\Net msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2A72C6A1D3AFA31F644E0BF5ED2E18BF\SourceList\Media msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2A72C6A1D3AFA31F644E0BF5ED2E18BF msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2A72C6A1D3AFA31F644E0BF5ED2E18BF\Assignment = "1" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\41FC6B43184718F22B055265DD07D941\2A72C6A1D3AFA31F644E0BF5ED2E18BF msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2A72C6A1D3AFA31F644E0BF5ED2E18BF\SourceList msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2A72C6A1D3AFA31F644E0BF5ED2E18BF\SourceList\PackageName = "Install_28n002.msi" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2A72C6A1D3AFA31F644E0BF5ED2E18BF\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2A72C6A1D3AFA31F644E0BF5ED2E18BF\Language = "1033" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2A72C6A1D3AFA31F644E0BF5ED2E18BF\ProductName = "CNAPP Licensing Dll" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2A72C6A1D3AFA31F644E0BF5ED2E18BF\Version = "84017285" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2A72C6A1D3AFA31F644E0BF5ED2E18BF\AdvertiseFlags = "388" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2A72C6A1D3AFA31F644E0BF5ED2E18BF\InstanceType = "0" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\41FC6B43184718F22B055265DD07D941 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2A72C6A1D3AFA31F644E0BF5ED2E18BF\SourceList\Media\1 = ";" msiexec.exe - Scheduled Task/Job: Scheduled Task 1 TTPs 5 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 4412 schtasks.exe 4532 schtasks.exe 5308 schtasks.exe 5060 schtasks.exe 6028 schtasks.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4224 msiexec.exe 4224 msiexec.exe 464 MsiExec.exe 464 MsiExec.exe 464 MsiExec.exe 464 MsiExec.exe 464 MsiExec.exe 464 MsiExec.exe 464 MsiExec.exe 464 MsiExec.exe 464 MsiExec.exe 464 MsiExec.exe 464 MsiExec.exe 464 MsiExec.exe 464 MsiExec.exe 464 MsiExec.exe 464 MsiExec.exe 464 MsiExec.exe 464 MsiExec.exe 464 MsiExec.exe 464 MsiExec.exe 464 MsiExec.exe 464 MsiExec.exe 464 MsiExec.exe 464 MsiExec.exe 464 MsiExec.exe 464 MsiExec.exe 464 MsiExec.exe 464 MsiExec.exe 464 MsiExec.exe 464 MsiExec.exe 464 MsiExec.exe 464 MsiExec.exe 464 MsiExec.exe 464 MsiExec.exe 464 MsiExec.exe 464 MsiExec.exe 464 MsiExec.exe 1316 5anpFs.exe 1316 5anpFs.exe 1316 5anpFs.exe 1316 5anpFs.exe 1316 5anpFs.exe 1316 5anpFs.exe 1316 5anpFs.exe 1316 5anpFs.exe 1316 5anpFs.exe 1316 5anpFs.exe 1316 5anpFs.exe 1316 5anpFs.exe 1316 5anpFs.exe 1316 5anpFs.exe 1316 5anpFs.exe 1316 5anpFs.exe 1316 5anpFs.exe 1316 5anpFs.exe 1316 5anpFs.exe 1316 5anpFs.exe 1316 5anpFs.exe 1316 5anpFs.exe 1316 5anpFs.exe 1316 5anpFs.exe 1316 5anpFs.exe 1316 5anpFs.exe - Suspicious behavior: LoadsDriver 6 IoCs
pid Process 816 Process not Found 816 Process not Found 816 Process not Found 816 Process not Found 816 Process not Found 816 Process not Found - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 4568 msiexec.exe Token: SeIncreaseQuotaPrivilege 4568 msiexec.exe Token: SeSecurityPrivilege 4224 msiexec.exe Token: SeCreateTokenPrivilege 4568 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 4568 msiexec.exe Token: SeLockMemoryPrivilege 4568 msiexec.exe Token: SeIncreaseQuotaPrivilege 4568 msiexec.exe Token: SeMachineAccountPrivilege 4568 msiexec.exe Token: SeTcbPrivilege 4568 msiexec.exe Token: SeSecurityPrivilege 4568 msiexec.exe Token: SeTakeOwnershipPrivilege 4568 msiexec.exe Token: SeLoadDriverPrivilege 4568 msiexec.exe Token: SeSystemProfilePrivilege 4568 msiexec.exe Token: SeSystemtimePrivilege 4568 msiexec.exe Token: SeProfSingleProcessPrivilege 4568 msiexec.exe Token: SeIncBasePriorityPrivilege 4568 msiexec.exe Token: SeCreatePagefilePrivilege 4568 msiexec.exe Token: SeCreatePermanentPrivilege 4568 msiexec.exe Token: SeBackupPrivilege 4568 msiexec.exe Token: SeRestorePrivilege 4568 msiexec.exe Token: SeShutdownPrivilege 4568 msiexec.exe Token: SeDebugPrivilege 4568 msiexec.exe Token: SeAuditPrivilege 4568 msiexec.exe Token: SeSystemEnvironmentPrivilege 4568 msiexec.exe Token: SeChangeNotifyPrivilege 4568 msiexec.exe Token: SeRemoteShutdownPrivilege 4568 msiexec.exe Token: SeUndockPrivilege 4568 msiexec.exe Token: SeSyncAgentPrivilege 4568 msiexec.exe Token: SeEnableDelegationPrivilege 4568 msiexec.exe Token: SeManageVolumePrivilege 4568 msiexec.exe Token: SeImpersonatePrivilege 4568 msiexec.exe Token: SeCreateGlobalPrivilege 4568 msiexec.exe Token: SeBackupPrivilege 360 vssvc.exe Token: SeRestorePrivilege 360 vssvc.exe Token: SeAuditPrivilege 360 vssvc.exe Token: SeBackupPrivilege 4224 msiexec.exe Token: SeRestorePrivilege 4224 msiexec.exe Token: SeRestorePrivilege 4224 msiexec.exe Token: SeTakeOwnershipPrivilege 4224 msiexec.exe Token: SeRestorePrivilege 4224 msiexec.exe Token: SeTakeOwnershipPrivilege 4224 msiexec.exe Token: SeRestorePrivilege 4224 msiexec.exe Token: SeTakeOwnershipPrivilege 4224 msiexec.exe Token: SeBackupPrivilege 936 srtasks.exe Token: SeRestorePrivilege 936 srtasks.exe Token: SeSecurityPrivilege 936 srtasks.exe Token: SeTakeOwnershipPrivilege 936 srtasks.exe Token: SeBackupPrivilege 936 srtasks.exe Token: SeRestorePrivilege 936 srtasks.exe Token: SeSecurityPrivilege 936 srtasks.exe Token: SeTakeOwnershipPrivilege 936 srtasks.exe Token: SeRestorePrivilege 4224 msiexec.exe Token: SeTakeOwnershipPrivilege 4224 msiexec.exe Token: SeRestorePrivilege 4224 msiexec.exe Token: SeTakeOwnershipPrivilege 4224 msiexec.exe Token: SeRestorePrivilege 4224 msiexec.exe Token: SeTakeOwnershipPrivilege 4224 msiexec.exe Token: SeRestorePrivilege 4224 msiexec.exe Token: SeTakeOwnershipPrivilege 4224 msiexec.exe Token: SeRestorePrivilege 4224 msiexec.exe Token: SeTakeOwnershipPrivilege 4224 msiexec.exe Token: SeRestorePrivilege 4224 msiexec.exe Token: SeTakeOwnershipPrivilege 4224 msiexec.exe Token: SeRestorePrivilege 4224 msiexec.exe - Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 4568 msiexec.exe 4568 msiexec.exe - Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 4568 msiexec.exe 4224 msiexec.exe 464 MsiExec.exe - Suspicious use of WriteProcessMemory 28 IoCs
description pid Process procid_target PID 4224 wrote to memory of 936 4224 msiexec.exe 94 PID 4224 wrote to memory of 464 4224 msiexec.exe 96 PID 1316 wrote to memory of 6048 1316 5anpFs.exe 100 PID 1316 wrote to memory of 5212 1316 5anpFs.exe 102 PID 5212 wrote to memory of 5308 5212 cmd.exe 104 PID 5212 wrote to memory of 1172 5212 cmd.exe 106 PID 1316 wrote to memory of 4740 1316 5anpFs.exe 107 PID 5212 wrote to memory of 4312 5212 cmd.exe 111 PID 4740 wrote to memory of 5060 4740 cmd.exe 112 PID 4740 wrote to memory of 1028 4740 cmd.exe 113 PID 4740 wrote to memory of 5812 4740 cmd.exe 115 PID 1316 wrote to memory of 3376 1316 5anpFs.exe 116 PID 3376 wrote to memory of 6028 3376 cmd.exe 118 PID 3376 wrote to memory of 4040 3376 cmd.exe 119 PID 3376 wrote to memory of 4632 3376 cmd.exe 121 PID 1316 wrote to memory of 2996 1316 5anpFs.exe 125 PID 2996 wrote to memory of 4412 2996 cmd.exe 127 PID 2996 wrote to memory of 3264 2996 cmd.exe 128 PID 2996 wrote to memory of 5608 2996 cmd.exe 130 PID 3948 wrote to memory of 3396 3948 cmd.exe 132 PID 1316 wrote to memory of 3008 1316 5anpFs.exe 133 PID 3008 wrote to memory of 4532 3008 cmd.exe 135 PID 3008 wrote to memory of 2524 3008 cmd.exe 136 PID 3008 wrote to memory of 2344 3008 cmd.exe 138 PID 2484 wrote to memory of 3924 2484 cmd.exe 141 PID 1296 wrote to memory of 200 1296 cmd.exe 142 PID 2612 wrote to memory of 884 2612 cmd.exe 143 PID 3656 wrote to memory of 464 3656 cmd.exe 144 - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\Install_28n002.msi1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:4568
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4224 -
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵
- Suspicious use of AdjustPrivilegeToken
PID:936
-
-
C:\Windows\System32\MsiExec.exeC:\Windows\System32\MsiExec.exe -Embedding 87D6634C0E351259E9ADE04B2B1AF336 E Global\MSI00002⤵
- Loads dropped DLL
- Badlisted process makes network request
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:464
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:360
-
C:\Users\Public\Tz0hEC\5anpFs.exe"C:\Users\Public\Tz0hEC\5anpFs.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1316 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath 'C:\ProgramData','C:\Users','C:\Program Files (x86)','C:\' -Force2⤵
- Command and Scripting Interpreter: PowerShell
PID:6048
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public\Tz0hEC\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F2⤵
- Indicator Removal: Clear Persistence
- Suspicious use of WriteProcessMemory
PID:5212 -
C:\Windows\system32\schtasks.exeSCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public\Tz0hEC\" /t REG_DWORD /d 0 /f"3⤵
- Scheduled Task/Job: Scheduled Task
PID:5308
-
-
C:\Windows\system32\schtasks.exeSCHTASKS /Run /TN "Task1"3⤵PID:1172
-
-
C:\Windows\system32\schtasks.exeSCHTASKS /Delete /TN "Task1" /F3⤵PID:4312
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F2⤵
- Indicator Removal: Clear Persistence
- Suspicious use of WriteProcessMemory
PID:4740 -
C:\Windows\system32\schtasks.exeSCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f"3⤵
- Scheduled Task/Job: Scheduled Task
PID:5060
-
-
C:\Windows\system32\schtasks.exeSCHTASKS /Run /TN "Task1"3⤵PID:1028
-
-
C:\Windows\system32\schtasks.exeSCHTASKS /Delete /TN "Task1" /F3⤵PID:5812
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F2⤵
- Indicator Removal: Clear Persistence
- Suspicious use of WriteProcessMemory
PID:3376 -
C:\Windows\system32\schtasks.exeSCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f"3⤵
- Scheduled Task/Job: Scheduled Task
PID:6028
-
-
C:\Windows\system32\schtasks.exeSCHTASKS /Run /TN "Task1"3⤵PID:4040
-
-
C:\Windows\system32\schtasks.exeSCHTASKS /Delete /TN "Task1" /F3⤵PID:4632
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F2⤵
- Indicator Removal: Clear Persistence
- Suspicious use of WriteProcessMemory
PID:2996 -
C:\Windows\system32\schtasks.exeSCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f"3⤵
- Scheduled Task/Job: Scheduled Task
PID:4412
-
-
C:\Windows\system32\schtasks.exeSCHTASKS /Run /TN "Task1"3⤵PID:3264
-
-
C:\Windows\system32\schtasks.exeSCHTASKS /Delete /TN "Task1" /F3⤵PID:5608
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"%USERPROFILE%\Documents\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F2⤵
- Indicator Removal: Clear Persistence
- Suspicious use of WriteProcessMemory
PID:3008 -
C:\Windows\system32\schtasks.exeSCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Admin\Documents\" /t REG_DWORD /d 0 /f"3⤵
- Scheduled Task/Job: Scheduled Task
PID:4532
-
-
C:\Windows\system32\schtasks.exeSCHTASKS /Run /TN "Task1"3⤵PID:2524
-
-
C:\Windows\system32\schtasks.exeSCHTASKS /Delete /TN "Task1" /F3⤵PID:2344
-
-
-
C:\Program Files (x86)\8ZHltA\8ZHltA.exe"C:\Program Files (x86)\8ZHltA\8ZHltA.exe"2⤵PID:3560
-
-
C:\Windows\system32\cmd.execmd.exe1⤵PID:1900
-
C:\Windows\system32\cmd.exe"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Public\Tz0hEC" /t REG_DWORD /d 0 /f1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1296 -
C:\Windows\System32\reg.exereg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Public\Tz0hEC" /t REG_DWORD /d 0 /f2⤵
- Windows security bypass
PID:200
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\ProgramData" /t REG_DWORD /d 0 /f1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3948 -
C:\Windows\System32\reg.exereg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\ProgramData" /t REG_DWORD /d 0 /f2⤵
- Windows security bypass
PID:3396
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users" /t REG_DWORD /d 0 /f1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2484 -
C:\Windows\System32\reg.exereg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users" /t REG_DWORD /d 0 /f2⤵
- Windows security bypass
PID:3924
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)" /t REG_DWORD /d 0 /f1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3656 -
C:\Windows\System32\reg.exereg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)" /t REG_DWORD /d 0 /f2⤵
- Windows security bypass
PID:464
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\Documents" /t REG_DWORD /d 0 /f1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2612 -
C:\Windows\System32\reg.exereg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\Documents" /t REG_DWORD /d 0 /f2⤵
- Windows security bypass
PID:884
-
-
C:\Program Files (x86)\8ZHltA\8ZHltA.exe"C:\Program Files (x86)\8ZHltA\8ZHltA.exe"1⤵PID:1860
-
C:\Program Files (x86)\8ZHltA\8ZHltA.exe"C:\Program Files (x86)\8ZHltA\8ZHltA.exe"1⤵PID:5128
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
2PowerShell
1Windows Command Shell
1Scheduled Task/Job
1Scheduled Task
1Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Installer Packages
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Installer Packages
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Impair Defenses
1Disable or Modify Tools
1Indicator Removal
1Clear Persistence
1Modify Registry
2System Binary Proxy Execution
1Msiexec
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Config.Msi\e5a8e96.rbs
- Size 7KB
- SHA256 718f32199f3f57dec63fcb4f5a56d838b444d23928e0fc18596cc55ca8020357
- MD5 7ea4e9c29eef4bbe0f8ad40562ce418c
- SHA1 bbe1ca3e923886fc9d34047a8100981b0739d804
- SHA512 430d92fdce685e10e226a2a4dd96169d9e37b57ec3410670411f8a3445e79644e3d4f5770b624f5a39667197eaa9c7e37fec7ab2cbfe6fa571620036b30015a7
- SSDEEP 96:CVBiGgu0CXPxUUpdD21CsThqK/UpdD21C6jdAsDThqKjHKIK5RPWELEyE/YwgpCS:CVoXCpzfD2IIBsfD2ISBaHtI5csKpB
- TLSH T14DF1F046B20581E2F9977730CF271B263BB3D3E49314630B0ADE84749E4B38D6EA519E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\8ZHltA\8ZHltA.exe
- Size 145KB
- SHA256 6d6ba2bc9ad414837826f7278bc3e0116f1aeda02d0c2284ed65819f5d9180a8
- MD5 5251b98614acffe5c856f4039ca03da3
- SHA1 c80ed6716e89d4862f28ebbc130ec5aa362db963
- SHA512 d750c9adb08d9525ee9948c0c18c96f0c9520068aa4aa24885ac0d98790a6cc0a8ce0e71e1c669acd4623e0aabfc08c11c02be403f275b01aa4277c4ddab3302
- SSDEEP 3072:VafgcZGuY2TqWLGzwRC7kll1xtBQDTCCvtzaYPFPR/M:Yz8upLGaPQDnFzaYPFdM
- TLSH T16AE30852B6808460F76A0B311864F9E44A6EED3C1AD0E95FF2787D3A1E311C38A7756F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\8ZHltA\XPSPLOG.dll
- Size 4.6MB
- SHA256 24127f951e9a15e256bdcada9f794cee97283cca0a0d2ef685bbe968b7272131
- MD5 d98faa7855c101a77ebdb41b6d7befab
- SHA1 409a1d2b69cc396f7a9207ac61235e78ee6c6892
- SHA512 fb4841a260e993ecb74071f89cc8c107294f735279d80c2b2974b24da7b1a5e1789082e8b9ce0d87e0aa268573199b1815af6ac4cd7193d180ad366dd367af96
- SSDEEP 98304:yCMWmcKfST5t+BceThTHfaCCUqmJPCYvboB1fdmyT:BMWKfU+BcUTHCCCfqCiUffnT
- TLSH T1F7263349BADB025DD89672704F6AFD7EB2B92CCC4204DC4DD44DE587E8B2729703A90E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\8ZHltA\XPSPLOG.dll
- Size 768KB
- SHA256 7aa6e02be0f301eaaaff34355148bd8dbbbec11ee8443a2a4d2e27e7964890cb
- MD5 2458216b9387db0a82bf476d47ded578
- SHA1 12f00841dea1aa57d370010c2fd1ec961fbfd7be
- SHA512 bcb5f48f727b0fd21a3b14b225be65143a9f41e852901c0324b4f2aff6dbd672e460a30078ee0e68c91638f4d50e21abfe9bea8b807a1a00d5ef53878bed4342
- SSDEEP 12288:6Qls2PLOuWhkdNkXDKLReoDhRyoTU0UoRclIp6W6HfSqwkRQnLyWfymj:RTOuWhLK5RyoT9xcjWByWfymj
- TLSH T16EF423C66142552AFE45B2B16F8CFDBC71B9A8E80176DD5CB8C179870473AFA503838B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\8ZHltA\XPSPLOG.dll
- Size 256KB
- SHA256 637a504f128482f8e1185cc9665f186ebc096a4767b589950e9c49141d3a3843
- MD5 f4adee8c02079ce5b57895088793af8e
- SHA1 9d9800f40a069337e8e3aa093e3e2f7775370f41
- SHA512 8a0627aed50f28606683e0c4b6e25e19033f6877aa754b1479bf99af1a53cd7a9a24f95c9420b279186b09ffdab311be8827a5e0f447ad236cdff03db0d222d0
- SSDEEP 6144:VGfQzVDspcR5LOuFQyDsy8OOnk8oNkLBHtDKqlAoo:6Qls2PLOuWhkdNkXDKLX
- TLSH T1B44412E25397082EEE8679321A0DF97C75F665FC465ACC29A0C5B5C288776B1203C9CF
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\8ZHltA\image.png
- Size 4.9MB
- SHA256 9bb0b4fcc25aa893367317217d9faef1a81d04bd9000966d4c2dd804c2863b63
- MD5 f5b45ac2e85d242466753b4406821615
- SHA1 88f72b8e1095f1fd4606f2f02b56b99c96b42010
- SHA512 40e20f325c7d4c293a64b2af3ffe21aba6f89ac03121615c88c48ae1675e8d63a144afb64ec30f120de025d2c9eeb7017bed449a71ebcf4a2bb2f57067fdb5b6
- SSDEEP 98304:JXjR0PaemmeGXdG2BHmP46ziMd4hlx00SvotfTjZ7MWwFp+0MW+:JXjRUDXdvHuTBdIlUOT9z0n+
- TLSH T1DF36337D3D2DA53F9AA3CA9079CAFD2A57B6CB4A971B0D6ACB75F403354120402C7D12
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\8ZHltA\thumbs.db
- Size 358KB
- SHA256 bea26d5b953a6abaa32f62b6dae60e124afd343b34a48e4ecdb37abeb10c8319
- MD5 ec36e0f3a875a448e35543926bfe7bd6
- SHA1 76f220b5822023b65824947b51929b4a1f70943c
- SHA512 3e5cd0e12f4fca9711bb2f95c062401c758053ca0cb8e0bab28e1d5fa96985a98cc2d9da4e3600c08d75a02b23c32c60c67454877296cd30fc864d3b56a31d42
- SSDEEP 6144:EiACk/u6n9aBOmmD1oQFu0oMOxKnJPWyD9Dcqt1oFsnrqW7mb/:z8u69CghoQxoMTFQqtKFCz7mb/
- TLSH T18574F268E6651EFE0E175FECE04F58AE9A8FD9E302C900252BF1C6D1CA106E4941FD5E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Public\Tz0hEC\5anpFs.exe
- Size 135KB
- SHA256 676a2a7b94ca2f8ec76352ee656e4d075bb342bd7ad6efbc7c19c060001eace7
- MD5 9ec587911e501b73b7cf09f05d0ae17d
- SHA1 5b62403cc9a668c6e5c70ace177fd54fcc4c5936
- SHA512 d05468a472373815c46ccb46ec743408365d24982d10d8a23ee0036c28cf3dacd05d74304ef2d4b7118f91ff3f631f676b2e86ddee92a02cf988b0d3c6247847
- SSDEEP 3072:MmhXb5pgtiaRENEErO9Uj4OqhhUvB4BNgQaJ:MmjgtiayGErsUKh3To
- TLSH T1D0D38C2776A474F9E1778635C8511A1AE772B8760770CB9F03A442A62F237D19E3EF20
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Public\Tz0hEC\UxEnhance64.dll
- Size 3.1MB
- SHA256 5bc7440e4f6fe56bbf107a6c177b9afdc2886b0e880f5cc8e384245a79957d83
- MD5 9c0544ddb01c0e549317f389a6b1096f
- SHA1 ce90bd3ea2f8e0999723c41c457428a424aef471
- SHA512 f0807bf84a135c2233673c5ebcf396799210fd5d69b2dd6b9fa8ac31ce79fff60e1137366c4b56a03b1a1f1f14d58ebabcdbc5b294d9051c1e346c611443129f
- SSDEEP 49152:P9KpI8cBa0kj6BK0x3TiMQclkGo2PXk6rkwuuWG/+WizBedfb77N3SnKrKB+C:P9m29xx3Tiqt06ox6+z2rNNrKoC
- TLSH T190E523E5B6D739F6D023CBF4DA62A1AD70393F505F635C5F3B8929014E62228973A390
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Public\Tz0hEC\adoresd.dat
- Size 4.8MB
- SHA256 e0553b835111d401ca66c74f049505893e09dc67c3b6de43ecf70b31979fabf7
- MD5 96dc6b1c2bf018eb8a1876f82a272782
- SHA1 dbc86325e77b9e5521890a4f24138dc48326c869
- SHA512 f003198031db8c67bc63f89787094f73be087fc1035bff8acbd4d560ef15e6f4e75b3af917afa41ee2f23bbc6f993cd98021b2c291d21ce0c3f0df859cdfe5ab
- SSDEEP 98304:kuZ630UjjOt6udZuYb7Ad2WAqSFmtNYNF/ltN3fjZgRnXxs:5QDPnORb7AdPEm7Y7ltlVgxs
- TLSH T1EE363339536D9C62DDC7A0F8A49D4596FF683D60FAE2A006B47C1D213015DFB98AFE08
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Public\Tz0hEC\msadox.tb
- Size 8KB
- SHA256 8b97eef14d928b51e5281c5b269c7402e645eec276ed3e86a0e3f4cae500dd90
- MD5 6c2373d34f94fe46bdb0583bd90760e1
- SHA1 d5fc5e9754eaf0bdd7a1197ee1b39c3931b295f8
- SHA512 d52c2d9709213076ced591a864902aa5281d31482adb7335489926994f3e75cf37e245e0f9d65e5b45a9ad54960dfed349285c2d811521a9d7680a91e6aebc6b
- SSDEEP 192:/qbZajnZ45X1q3JXglD+3vR8cwNhIMCGe2y0PQp:/sZqZOXQ3uqvR2Kfzp
- TLSH T1C1029E05D7A20CC3D2016C71CD9EB2F5AB13A1DADA3926719C67D4C167072DD2CE620D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\MSI959B.tmp
- Size 5.7MB
- SHA256 f2f0cc6f7b1e3334ca03256781a86ab7c7c728a28de49714dde0e915fa4eb146
- MD5 528e32e0083a77b685012405a91c6492
- SHA1 beb6b6d191c2772b2e10dc17e4ab2416b6810858
- SHA512 8195a58ee3cb5b2d33bff4694aefb266551e45a17acad33ab84133cb5f2b43c854f5fa3791b340b813ff61757d68df07b652857d502d1a726a8eee2a889b891b
- SSDEEP 98304:w6pdCiGJuFw5V4SGWXlgAzCEFO0kJQpAmAzKdN8wMVLS6dYXzIrrrHlG:TdCis4BEoZJLm4Kv8wWGzerI
- TLSH T14A5633D139C66F70D1A3CBF4665A391D3CAE3BD5B9728C0A67D43A00AE73615DA32309
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\e5a8e95.msi
- Size 5.7MB
- SHA256 c934ce2e4f8cb4f165edecb51d91390b00f5084809bad25c0a5a189271fa5fe8
- MD5 46fcdc786df0a6e837ca97924579d069
- SHA1 c99f0df69ed9ffb9e77b6757df6347ab6540d5a7
- SHA512 16c3e24e49e10ca11db64f4a98a77b8d5b33e36bd0c591fb35e205a81c04d08f89377c9455bcec7d5daad553f447bad1d633435a6fdcde3237e720c65d0eb919
- SSDEEP 98304:F6pdCiGJuFw5V4SGWXlgAzCEFO0kJQpAmAzKdN8wMVL66dYXzIrrrHlX:8dCis4BEoZJLm4Kv8w+GzerZ
- TLSH T1A05633D179C66F70D0A3CBF4561A6A1D3DAE3FD5B972CC0A67D43A006E32625DA32309
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
- Size 26.1MB
- SHA256 a2fede77edd300ce2533904e9743ab1ec6fc770645763a7153af7fd066701429
- MD5 f289add170a6aa458652dc0ab2738fed
- SHA1 14d7d18a7729327744042bc7048c624d6f67b6e5
- SHA512 8c70ee2ab5a49fb5a246e35cd0e213d8b233bb5c7ae9f4bb80e12192231eff36a863305991bc668b65f67ff863df449119c0f8f40f8891bea95cb27cd22d95e9
- SSDEEP 24576:PFo3DMPFdoO/vvTL/CwF1yFQPrOfebSmUYjHdIrtDQrKJykVM4RWVsfURed:THw
- TLSH T1FD57162436F92110E7F39E3DA8F46A234D397D579C16DE8C05425B8D0922FB1E872F6A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\Volume{ca73a981-0000-0000-0000-d08302000000}\System Volume Information\SPP\OnlineMetadataCache\{823f5b70-adbd-4e92-8977-53e8b036d377}_OnDiskSnapshotProp
- Size 6KB
- SHA256 ff233f001bdf8968734a76acabef9432d8c55b3c11909cbf7f4ac1048dddb0ae
- MD5 946a2ce69be23a5f5633db601ceaa7a4
- SHA1 e5f5d1f65ff46fe5dc83a6530860ba6967e2fb3a
- SHA512 5ab2c0dfbf5c2acd4370c1cb8b1f2a1d28472b5e6a4a13722b4375f6a147b442700bf4af73246bef88a1e4c3537145f14dacaf5b15c02e575776a2587e2cb708
- SSDEEP 96:Fe2st2EhXvc6DD84LTHzbOHXOHBlBRQn8Sc9XE56tOSVQpu:P6Zb++uVm
- TLSH T1CED199081AF54711E2B3AB3229F18557A877B911EF33CB8E0198638E6631910F975F6F
- MD5 SHA1 SHA512 SSDEEP TLSH