Analysis
- max time kernel
146s - max time network
150s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
30/07/2026, 02:22
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Install_28n002.msi
Resource
win10v2004-20260513-en
windows10-2004-x64
25 signatures
150 seconds
Behavioral task
behavioral2
Sample
Install_28n002.msi
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
26 signatures
150 seconds
General
- Target Install_28n002.msi
- Size 5.7MB
- Sample260730-ctsxvaae68
- SHA256 f76aec724d73ee0c4e3bb2a7a50c064b5e6d6ddec54aff95e50c1e54777d0414
- MD5 1a3614357817fd3ef344feea11368aa2
- SHA1 5e8a944343ae556ef8abc62d7aa8ff1023255669
- SHA512 85d44681c4a6ee58195e07d55d889ab97566848493ad1ccee4e90d9c2a18cd1e74f1a17c4a25dd24731f042ae73a20472fdd2a9c4741197e1cfc91733e5dc539
- SSDEEP 98304:F6pdCiGJuFw5V4SGWXlgAzCEFO0kJQpAmAzKdN8wMVL66dYXzIrrrHlY:8dCis4BEoZJLm4Kv8w+GzerW
- TLSH T1455633D179C66F70D0A3CBF4561A6A1D3DAE3FD5B972CC0A67D43A006E32625DA32309
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Windows security bypass 2 TTPs 10 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86) = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Public\3pIO3Z = "0" reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\ProgramData = "0" reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\Documents = "0" reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths reg.exe - Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 2436 powershell.exe - Executes dropped EXE 1 IoCs
pid Process 4136 ty1yGx.exe - Loads dropped DLL 2 IoCs
pid Process 4996 MsiExec.exe 4136 ty1yGx.exe - Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Tencent SecurityHealth = "\"C:\\Users\\Public\\3pIO3Z\\ty1yGx.exe\"" ty1yGx.exe - Badlisted process makes network request 3 IoCs
Network request originating from process or tool commonly abused by malware.
flow pid Process 8 4996 MsiExec.exe 9 4996 MsiExec.exe 10 4996 MsiExec.exe - Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\D: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\D: msiexec.exe - Indicator Removal: Clear Persistence 1 TTPs 5 IoCs
Clear artifacts associated with previously established persistence like scheduletasks on a host.
pid Process 3652 cmd.exe 1580 cmd.exe 4056 cmd.exe 2288 cmd.exe 2468 cmd.exe - Drops file in System32 directory 7 IoCs
description ioc Process File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B039FEA45CB4CC4BBACFC013C7C55604_FA4759C1FDA1D5B56F6A969553761240 MsiExec.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B039FEA45CB4CC4BBACFC013C7C55604_FA4759C1FDA1D5B56F6A969553761240 MsiExec.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\D077F3BA01F0F2293C650040B1B80D25_46BE3773AFCF70DA60E4725C8326A576 MsiExec.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\D077F3BA01F0F2293C650040B1B80D25_46BE3773AFCF70DA60E4725C8326A576 MsiExec.exe File created C:\Windows\System32\CodeIntegrity\SiPolicy.p7b ty1yGx.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\0DA515F703BB9B49479E8697ADB0B955_4136D3715888E22D65EBE484B233D81B MsiExec.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\0DA515F703BB9B49479E8697ADB0B955_4136D3715888E22D65EBE484B233D81B MsiExec.exe - Drops file in Program Files directory 9 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\TtQZA8 ty1yGx.exe File created C:\Program Files (x86)\TtQZA8\TtQZA8.exe ty1yGx.exe File created C:\Program Files (x86)\TtQZA8\image.png ty1yGx.exe File created C:\Program Files (x86)\TtQZA8\thumbs.db ty1yGx.exe File opened for modification C:\Program Files (x86)\TtQZA8\TtQZA8.exe ty1yGx.exe File opened for modification C:\Program Files (x86)\TtQZA8\image.png ty1yGx.exe File opened for modification C:\Program Files (x86)\TtQZA8\thumbs.db ty1yGx.exe File created C:\Program Files (x86)\TtQZA8\XPSPLOG.dll ty1yGx.exe File opened for modification C:\Program Files (x86)\TtQZA8\XPSPLOG.dll ty1yGx.exe - Drops file in Windows directory 13 IoCs
description ioc Process File created C:\Windows\Installer\e5970c1.msi msiexec.exe File opened for modification C:\Windows\Installer\e5970c1.msi msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\Installer\SourceHash{1A6C27A2-FA3D-F13A-46E4-B05FDEE281FB} msiexec.exe File created C:\Windows\SystemTemp\~DF17F2E68E2275F2E9.TMP msiexec.exe File opened for modification C:\Windows\Installer\MSI7584.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI7621.tmp msiexec.exe File created C:\Windows\Installer\e5970c3.msi msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File created C:\Windows\SystemTemp\~DF14A8F3DD76A48DC0.TMP msiexec.exe File created C:\Windows\SystemTemp\~DFB322729FEFBB7CC9.TMP msiexec.exe File created C:\Windows\SystemTemp\~DF554091FA83F3A537.TMP msiexec.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
pid Process 5532 msiexec.exe - Executes a command shell one-liner 1 TTPs 5 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 5616 cmd.exe 3684 cmd.exe 1476 cmd.exe 992 cmd.exe 5252 cmd.exe - Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000ffbf1fc65d8bbf350000000000000000000000000000000000000000000000000000000000000000000000000000000000001071020000000000c0120000000000000000000000002701010000883801ffbf1fc60000000000001071020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d0830200000000006025c501000000000000000000000700010000e84101ffbf1fc6000000000000d08302000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9c701000000000000050000000000000000000000070001000098d4e3ffbf1fc600000000000030a9c7010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9cc0100000000000005000000000000000000000007000100009854e6ffbf1fc600000000000030a9cc01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe - Modifies data under HKEY_USERS 9 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ MsiExec.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" MsiExec.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" MsiExec.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" MsiExec.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27 msiexec.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" MsiExec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing MsiExec.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28 msiexec.exe - Modifies registry class 22 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2A72C6A1D3AFA31F644E0BF5ED2E18BF\SourceList\Net msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2A72C6A1D3AFA31F644E0BF5ED2E18BF\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2A72C6A1D3AFA31F644E0BF5ED2E18BF\SourceList\Media\1 = ";" msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2A72C6A1D3AFA31F644E0BF5ED2E18BF\Clients = 3a0000000000 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\2A72C6A1D3AFA31F644E0BF5ED2E18BF msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2A72C6A1D3AFA31F644E0BF5ED2E18BF\ProductName = "CNAPP Licensing Dll" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2A72C6A1D3AFA31F644E0BF5ED2E18BF\Version = "84017285" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2A72C6A1D3AFA31F644E0BF5ED2E18BF\InstanceType = "0" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2A72C6A1D3AFA31F644E0BF5ED2E18BF\AuthorizedLUAApp = "0" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2A72C6A1D3AFA31F644E0BF5ED2E18BF\SourceList msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2A72C6A1D3AFA31F644E0BF5ED2E18BF\SourceList\PackageName = "Install_28n002.msi" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\2A72C6A1D3AFA31F644E0BF5ED2E18BF\UuueatYAD msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2A72C6A1D3AFA31F644E0BF5ED2E18BF\Language = "1033" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2A72C6A1D3AFA31F644E0BF5ED2E18BF\DeploymentFlags = "3" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2A72C6A1D3AFA31F644E0BF5ED2E18BF\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2A72C6A1D3AFA31F644E0BF5ED2E18BF msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2A72C6A1D3AFA31F644E0BF5ED2E18BF\PackageCode = "DDBDB3AAAA3DFAD46BC0B0DC3E8339EA" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2A72C6A1D3AFA31F644E0BF5ED2E18BF\AdvertiseFlags = "388" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\41FC6B43184718F22B055265DD07D941\2A72C6A1D3AFA31F644E0BF5ED2E18BF msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2A72C6A1D3AFA31F644E0BF5ED2E18BF\SourceList\Media msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2A72C6A1D3AFA31F644E0BF5ED2E18BF\Assignment = "1" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\41FC6B43184718F22B055265DD07D941 msiexec.exe - Scheduled Task/Job: Scheduled Task 1 TTPs 5 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 4800 schtasks.exe 1340 schtasks.exe 5636 schtasks.exe 1268 schtasks.exe 2564 schtasks.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4516 msiexec.exe 4516 msiexec.exe 4996 MsiExec.exe 4996 MsiExec.exe 4996 MsiExec.exe 4996 MsiExec.exe 4996 MsiExec.exe 4996 MsiExec.exe 4996 MsiExec.exe 4996 MsiExec.exe 4996 MsiExec.exe 4996 MsiExec.exe 4996 MsiExec.exe 4996 MsiExec.exe 4996 MsiExec.exe 4996 MsiExec.exe 4996 MsiExec.exe 4996 MsiExec.exe 4996 MsiExec.exe 4996 MsiExec.exe 4996 MsiExec.exe 4996 MsiExec.exe 4996 MsiExec.exe 4996 MsiExec.exe 4996 MsiExec.exe 4996 MsiExec.exe 4996 MsiExec.exe 4996 MsiExec.exe 4996 MsiExec.exe 4996 MsiExec.exe 4996 MsiExec.exe 4996 MsiExec.exe 4996 MsiExec.exe 4996 MsiExec.exe 4996 MsiExec.exe 4996 MsiExec.exe 4996 MsiExec.exe 4996 MsiExec.exe 4136 ty1yGx.exe 4136 ty1yGx.exe 4136 ty1yGx.exe 4136 ty1yGx.exe 4136 ty1yGx.exe 4136 ty1yGx.exe 4136 ty1yGx.exe 4136 ty1yGx.exe 4136 ty1yGx.exe 4136 ty1yGx.exe 4136 ty1yGx.exe 4136 ty1yGx.exe 4136 ty1yGx.exe 4136 ty1yGx.exe 4136 ty1yGx.exe 4136 ty1yGx.exe 4136 ty1yGx.exe 4136 ty1yGx.exe 4136 ty1yGx.exe 4136 ty1yGx.exe 4136 ty1yGx.exe 4136 ty1yGx.exe 4136 ty1yGx.exe 4136 ty1yGx.exe 4136 ty1yGx.exe 4136 ty1yGx.exe - Suspicious behavior: LoadsDriver 6 IoCs
pid Process 812 Process not Found 812 Process not Found 812 Process not Found 812 Process not Found 812 Process not Found 812 Process not Found - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 5532 msiexec.exe Token: SeIncreaseQuotaPrivilege 5532 msiexec.exe Token: SeSecurityPrivilege 4516 msiexec.exe Token: SeCreateTokenPrivilege 5532 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 5532 msiexec.exe Token: SeLockMemoryPrivilege 5532 msiexec.exe Token: SeIncreaseQuotaPrivilege 5532 msiexec.exe Token: SeMachineAccountPrivilege 5532 msiexec.exe Token: SeTcbPrivilege 5532 msiexec.exe Token: SeSecurityPrivilege 5532 msiexec.exe Token: SeTakeOwnershipPrivilege 5532 msiexec.exe Token: SeLoadDriverPrivilege 5532 msiexec.exe Token: SeSystemProfilePrivilege 5532 msiexec.exe Token: SeSystemtimePrivilege 5532 msiexec.exe Token: SeProfSingleProcessPrivilege 5532 msiexec.exe Token: SeIncBasePriorityPrivilege 5532 msiexec.exe Token: SeCreatePagefilePrivilege 5532 msiexec.exe Token: SeCreatePermanentPrivilege 5532 msiexec.exe Token: SeBackupPrivilege 5532 msiexec.exe Token: SeRestorePrivilege 5532 msiexec.exe Token: SeShutdownPrivilege 5532 msiexec.exe Token: SeDebugPrivilege 5532 msiexec.exe Token: SeAuditPrivilege 5532 msiexec.exe Token: SeSystemEnvironmentPrivilege 5532 msiexec.exe Token: SeChangeNotifyPrivilege 5532 msiexec.exe Token: SeRemoteShutdownPrivilege 5532 msiexec.exe Token: SeUndockPrivilege 5532 msiexec.exe Token: SeSyncAgentPrivilege 5532 msiexec.exe Token: SeEnableDelegationPrivilege 5532 msiexec.exe Token: SeManageVolumePrivilege 5532 msiexec.exe Token: SeImpersonatePrivilege 5532 msiexec.exe Token: SeCreateGlobalPrivilege 5532 msiexec.exe Token: SeBackupPrivilege 5644 vssvc.exe Token: SeRestorePrivilege 5644 vssvc.exe Token: SeAuditPrivilege 5644 vssvc.exe Token: SeBackupPrivilege 4516 msiexec.exe Token: SeRestorePrivilege 4516 msiexec.exe Token: SeRestorePrivilege 4516 msiexec.exe Token: SeTakeOwnershipPrivilege 4516 msiexec.exe Token: SeRestorePrivilege 4516 msiexec.exe Token: SeTakeOwnershipPrivilege 4516 msiexec.exe Token: SeRestorePrivilege 4516 msiexec.exe Token: SeTakeOwnershipPrivilege 4516 msiexec.exe Token: SeBackupPrivilege 2348 srtasks.exe Token: SeRestorePrivilege 2348 srtasks.exe Token: SeSecurityPrivilege 2348 srtasks.exe Token: SeTakeOwnershipPrivilege 2348 srtasks.exe Token: SeBackupPrivilege 2348 srtasks.exe Token: SeRestorePrivilege 2348 srtasks.exe Token: SeSecurityPrivilege 2348 srtasks.exe Token: SeTakeOwnershipPrivilege 2348 srtasks.exe Token: SeRestorePrivilege 4516 msiexec.exe Token: SeTakeOwnershipPrivilege 4516 msiexec.exe Token: SeRestorePrivilege 4516 msiexec.exe Token: SeTakeOwnershipPrivilege 4516 msiexec.exe Token: SeRestorePrivilege 4516 msiexec.exe Token: SeTakeOwnershipPrivilege 4516 msiexec.exe Token: SeRestorePrivilege 4516 msiexec.exe Token: SeTakeOwnershipPrivilege 4516 msiexec.exe Token: SeRestorePrivilege 4516 msiexec.exe Token: SeTakeOwnershipPrivilege 4516 msiexec.exe Token: SeRestorePrivilege 4516 msiexec.exe Token: SeTakeOwnershipPrivilege 4516 msiexec.exe Token: SeRestorePrivilege 4516 msiexec.exe - Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 5532 msiexec.exe 5532 msiexec.exe - Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 5532 msiexec.exe 4516 msiexec.exe 4996 MsiExec.exe - Suspicious use of WriteProcessMemory 28 IoCs
description pid Process procid_target PID 4516 wrote to memory of 2348 4516 msiexec.exe 94 PID 4516 wrote to memory of 4996 4516 msiexec.exe 96 PID 4136 wrote to memory of 2436 4136 ty1yGx.exe 100 PID 4136 wrote to memory of 3652 4136 ty1yGx.exe 102 PID 3652 wrote to memory of 5636 3652 cmd.exe 104 PID 3652 wrote to memory of 6044 3652 cmd.exe 105 PID 3652 wrote to memory of 548 3652 cmd.exe 108 PID 4136 wrote to memory of 1580 4136 ty1yGx.exe 110 PID 1580 wrote to memory of 1268 1580 cmd.exe 113 PID 1580 wrote to memory of 5568 1580 cmd.exe 114 PID 1580 wrote to memory of 3384 1580 cmd.exe 116 PID 4136 wrote to memory of 4056 4136 ty1yGx.exe 118 PID 4056 wrote to memory of 2564 4056 cmd.exe 120 PID 4056 wrote to memory of 5056 4056 cmd.exe 121 PID 4056 wrote to memory of 236 4056 cmd.exe 123 PID 4136 wrote to memory of 2288 4136 ty1yGx.exe 125 PID 2288 wrote to memory of 4800 2288 cmd.exe 127 PID 2288 wrote to memory of 4196 2288 cmd.exe 128 PID 2288 wrote to memory of 1480 2288 cmd.exe 130 PID 992 wrote to memory of 3484 992 cmd.exe 132 PID 4136 wrote to memory of 2468 4136 ty1yGx.exe 133 PID 2468 wrote to memory of 1340 2468 cmd.exe 135 PID 2468 wrote to memory of 5716 2468 cmd.exe 137 PID 2468 wrote to memory of 4148 2468 cmd.exe 139 PID 3684 wrote to memory of 5108 3684 cmd.exe 141 PID 1476 wrote to memory of 5380 1476 cmd.exe 142 PID 5252 wrote to memory of 1744 5252 cmd.exe 143 PID 5616 wrote to memory of 4684 5616 cmd.exe 144 - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\Install_28n002.msi1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:5532
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4516 -
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵
- Suspicious use of AdjustPrivilegeToken
PID:2348
-
-
C:\Windows\System32\MsiExec.exeC:\Windows\System32\MsiExec.exe -Embedding CF718A26F43DA0E6311188CE4F60FC2D E Global\MSI00002⤵
- Loads dropped DLL
- Badlisted process makes network request
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4996
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:5644
-
C:\Users\Public\3pIO3Z\ty1yGx.exe"C:\Users\Public\3pIO3Z\ty1yGx.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4136 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath 'C:\ProgramData','C:\Users','C:\Program Files (x86)','C:\' -Force2⤵
- Command and Scripting Interpreter: PowerShell
PID:2436
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public\3pIO3Z\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F2⤵
- Indicator Removal: Clear Persistence
- Suspicious use of WriteProcessMemory
PID:3652 -
C:\Windows\system32\schtasks.exeSCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public\3pIO3Z\" /t REG_DWORD /d 0 /f"3⤵
- Scheduled Task/Job: Scheduled Task
PID:5636
-
-
C:\Windows\system32\schtasks.exeSCHTASKS /Run /TN "Task1"3⤵PID:6044
-
-
C:\Windows\system32\schtasks.exeSCHTASKS /Delete /TN "Task1" /F3⤵PID:548
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F2⤵
- Indicator Removal: Clear Persistence
- Suspicious use of WriteProcessMemory
PID:1580 -
C:\Windows\system32\schtasks.exeSCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f"3⤵
- Scheduled Task/Job: Scheduled Task
PID:1268
-
-
C:\Windows\system32\schtasks.exeSCHTASKS /Run /TN "Task1"3⤵PID:5568
-
-
C:\Windows\system32\schtasks.exeSCHTASKS /Delete /TN "Task1" /F3⤵PID:3384
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F2⤵
- Indicator Removal: Clear Persistence
- Suspicious use of WriteProcessMemory
PID:4056 -
C:\Windows\system32\schtasks.exeSCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f"3⤵
- Scheduled Task/Job: Scheduled Task
PID:2564
-
-
C:\Windows\system32\schtasks.exeSCHTASKS /Run /TN "Task1"3⤵PID:5056
-
-
C:\Windows\system32\schtasks.exeSCHTASKS /Delete /TN "Task1" /F3⤵PID:236
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F2⤵
- Indicator Removal: Clear Persistence
- Suspicious use of WriteProcessMemory
PID:2288 -
C:\Windows\system32\schtasks.exeSCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f"3⤵
- Scheduled Task/Job: Scheduled Task
PID:4800
-
-
C:\Windows\system32\schtasks.exeSCHTASKS /Run /TN "Task1"3⤵PID:4196
-
-
C:\Windows\system32\schtasks.exeSCHTASKS /Delete /TN "Task1" /F3⤵PID:1480
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"%USERPROFILE%\Documents\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F2⤵
- Indicator Removal: Clear Persistence
- Suspicious use of WriteProcessMemory
PID:2468 -
C:\Windows\system32\schtasks.exeSCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Admin\Documents\" /t REG_DWORD /d 0 /f"3⤵
- Scheduled Task/Job: Scheduled Task
PID:1340
-
-
C:\Windows\system32\schtasks.exeSCHTASKS /Run /TN "Task1"3⤵PID:5716
-
-
C:\Windows\system32\schtasks.exeSCHTASKS /Delete /TN "Task1" /F3⤵PID:4148
-
-
-
C:\Program Files (x86)\TtQZA8\TtQZA8.exe"C:\Program Files (x86)\TtQZA8\TtQZA8.exe"2⤵PID:4496
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Public\3pIO3Z" /t REG_DWORD /d 0 /f1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3684 -
C:\Windows\System32\reg.exereg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Public\3pIO3Z" /t REG_DWORD /d 0 /f2⤵
- Windows security bypass
PID:5108
-
-
C:\Windows\system32\cmd.execmd.exe1⤵PID:1956
-
C:\Windows\system32\cmd.exe"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\ProgramData" /t REG_DWORD /d 0 /f1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1476 -
C:\Windows\System32\reg.exereg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\ProgramData" /t REG_DWORD /d 0 /f2⤵
- Windows security bypass
PID:5380
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users" /t REG_DWORD /d 0 /f1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:992 -
C:\Windows\System32\reg.exereg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users" /t REG_DWORD /d 0 /f2⤵
- Windows security bypass
PID:3484
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)" /t REG_DWORD /d 0 /f1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5252 -
C:\Windows\System32\reg.exereg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)" /t REG_DWORD /d 0 /f2⤵
- Windows security bypass
PID:1744
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\Documents" /t REG_DWORD /d 0 /f1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5616 -
C:\Windows\System32\reg.exereg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\Documents" /t REG_DWORD /d 0 /f2⤵
- Windows security bypass
PID:4684
-
-
C:\Program Files (x86)\TtQZA8\TtQZA8.exe"C:\Program Files (x86)\TtQZA8\TtQZA8.exe"1⤵PID:2200
-
C:\Program Files (x86)\TtQZA8\TtQZA8.exe"C:\Program Files (x86)\TtQZA8\TtQZA8.exe"1⤵PID:4612
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
2PowerShell
1Windows Command Shell
1Scheduled Task/Job
1Scheduled Task
1Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Installer Packages
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Installer Packages
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Impair Defenses
1Disable or Modify Tools
1Indicator Removal
1Clear Persistence
1Modify Registry
2System Binary Proxy Execution
1Msiexec
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Config.Msi\e5970c2.rbs
- Size 7KB
- SHA256 168a1181949a8ac1bbcc2f16a6464d2046bf55ca5a185bdca1419cb5424052ed
- MD5 4d3d6153c8c95606d9d277c2eb306ab7
- SHA1 efb1dce0c68f491985067aed19a74d5724365a71
- SHA512 c8e7052eac39d0da14712e1cec2172a90abd9fbf3fd90e7abd19500a135543bf7a7b80a2f3a2ac108c5f21e034df61e93353f86f58246764af9b0e10087d85cb
- SSDEEP 96:JVBiGgu0C75xUUpdD21CsThqK/UpdD21C6jdAsDThqKjHKIK5RPWELEyE/YwgpCS:JVoXCrzfD2IIBsfD2ISBaHtI5csKpB
- TLSH T135F10046B20481E2F9977730CF271B263BB3D3E49314630B1ADE84749E4738D6EA619E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\TtQZA8\TtQZA8.exe
- Size 145KB
- SHA256 6d6ba2bc9ad414837826f7278bc3e0116f1aeda02d0c2284ed65819f5d9180a8
- MD5 5251b98614acffe5c856f4039ca03da3
- SHA1 c80ed6716e89d4862f28ebbc130ec5aa362db963
- SHA512 d750c9adb08d9525ee9948c0c18c96f0c9520068aa4aa24885ac0d98790a6cc0a8ce0e71e1c669acd4623e0aabfc08c11c02be403f275b01aa4277c4ddab3302
- SSDEEP 3072:VafgcZGuY2TqWLGzwRC7kll1xtBQDTCCvtzaYPFPR/M:Yz8upLGaPQDnFzaYPFdM
- TLSH T16AE30852B6808460F76A0B311864F9E44A6EED3C1AD0E95FF2787D3A1E311C38A7756F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\TtQZA8\XPSPLOG.dll
- Size 4.6MB
- SHA256 7b2a93ad343f62d1ef6732f1582082abc98ba2d90203541f29604b3c6f16da0e
- MD5 ef57abaf04e020c6536592ea890ce3b7
- SHA1 00d2e3f087c517668b134216b9afb73b06e86c71
- SHA512 606d88138ad5b2327cb12b0c1ba2295000d928d11ae22356b08208ac571f8537716c0d037fe7cdc05de9228f29d2f68cfb7134e55917a38c313087df2ea0db69
- SSDEEP 98304:yCMWmcKfST5t+BceThTHfaCCUqmJPCYvboB1fdmyo:BMWKfU+BcUTHCCCfqCiUffno
- TLSH T109263349BADB025DD89672704F6AFD7EB2B92CCC4204DC4DD44DE587E8B2729703A90E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\TtQZA8\XPSPLOG.dll
- Size 832KB
- SHA256 ff28a850d0537183df3e48184384c44e8748482fcda1296bdda10fd32b9811c6
- MD5 d54bdd4ec5cbffd099c29140ca885bde
- SHA1 4e5d8ca5a753fcf330e9b0e2f355f49b15bda9be
- SHA512 c267ae6ac487ffe60f78afa8454910da9df37e7b2bdd2f142172505e2747965351a677721e8066fd053a77151694d0c456774202cbdf7a2b7b3ce8f925b6237a
- SSDEEP 12288:6Qls2PLOuWhkdNkXDKLReoDhRyoTU0UoRclIp6W6HfSqwkRQnLyWfymm5rHQMIDj:RTOuWhLK5RyoT9xcjWByWfymm5LQMqj
- TLSH T1330523D36183551AFE4572716FCCFDBC71BAA8D801B6DD28A4C575870473ABA503838B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\TtQZA8\XPSPLOG.dll
- Size 1.9MB
- SHA256 3bbfd2c9bba6d5755ecddff3f1d132bbb5a729a6e85c9de3f294978e713fd580
- MD5 dc398c25a92d7cae0d2f110b28fd69e3
- SHA1 5c5055324b95c2138000aa2ed84a6d6604e96ea5
- SHA512 52c56cd55a2ff6a5e09e71b3c133f0a8608d9b906ad60425b9aacbbe036c7d25c71db66e3f81f49c8e1ea3dc851c84ef9a3039f9d6de0e1b6b1045793f877f8f
- SSDEEP 49152:3KLKP3cCMWmRqKJ1JNST5Z/nvsNBcVwNew:yCMWmcKfST5t+Bce9
- TLSH T14995338BB2DB421EF59173B92F5CEC1DB47E54C8C2BDD86598A6710B2030B9E5039B8D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\TtQZA8\image.png
- Size 4.9MB
- SHA256 fd164853f772ca91560faaa554478506551c1648930b84b066445881a614f179
- MD5 009fbfd3f9564766ae82537a4ad2086e
- SHA1 c3e319df852abbc5fb53f9a254e19f659874efc8
- SHA512 17cf38fa48d8dc2332a212fdf174e397895241ff734afd8e1f6e1b87cb79a0d66090cd5eefb7acca3880d3aad6f0bdcd59bfc000ce4c6c027a17d739a42f1fdd
- SSDEEP 98304:RXjR0PaemmeGXdG2BHmP46ziMd4hlx00SvotfTjZ7MWwFp+0MW+:RXjRUDXdvHuTBdIlUOT9z0n+
- TLSH T1D836337D3D2DA53F9AA3CA9079CAFD2A57B6CB4A971B0D6ACB75F403354120402C7D12
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\TtQZA8\thumbs.db
- Size 358KB
- SHA256 e208bc63167567fadd5dcd21fb7695dbf2ea8a802aca70d040c28d6dc99fa37f
- MD5 33498e5dadf102dc05952c55a7c0e46a
- SHA1 f598a9c32f69e633e1b83f15b35b89794103026c
- SHA512 1050a458ada123ee7d4fffd65d2f854529a984da131284c9a121fd2e179f47d4d71cad69a8f1a7182a68ea48711a254854c3ef1ca2da4f1b1e72803921d53173
- SSDEEP 6144:ZiACk/u6n9aBOmmD1oQFu0oMOxKnJPWyD9Dcqt1oFsnrqW7mb/:48u69CghoQxoMTFQqtKFCz7mb/
- TLSH T17674F268E6651EFE0E175FECE04F58AE9A8FD9E302C900252BF1C6D1CA106E4941FD5E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Public\3pIO3Z\UxEnhance64.dll
- Size 3.1MB
- SHA256 86748648ee1db0e8051ccaf0d96511ecbd82aa8ffa5a145c0db3a4ff041bfcf4
- MD5 180a6290e7a1c67cec86a1cfcf238e92
- SHA1 91767a807ae8e8235d894dc84deae318bf0a3c11
- SHA512 d275106db819c2988b2d84f05ea5adb68a6dabac38f74bf266cb4a8c3889914ece2724b2366b3aca2dba975bc5c63e6d3b4726c7b69a69c23f723cda60385c55
- SSDEEP 49152:P9KpI8cBa0kj6BK0x3TiMQclkGo2PXk6rkwuuWG/+WizBedfb77N3SnKrKB+S:P9m29xx3Tiqt06ox6+z2rNNrKoS
- TLSH T197E523E5B6D739F6D023CBF4DA62A1AD70393F505F635C5F3B8929014E62228973A390
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Public\3pIO3Z\adoresd.dat
- Size 4.8MB
- SHA256 a334795c1215bcc3ba636c89e4ae4c9641254f16f11f174e4c2bfb40c108f1a4
- MD5 dc9269b45700977dad84bd44cee567ba
- SHA1 9136872a006f3a738a7374496d8f8d3b6e8123ce
- SHA512 0a49faf8b47458836797825c988ef22a5bae719405dd6eb69ca9355a28e2bd89b9c9e266d10dc58ccb481991dd7449e2be3280568c6edc460de863b126d83d5b
- SSDEEP 98304:FuZ630UjjOt6udZuYb7Ad2WAqSFmtNYNF/ltN3fjZgRnXxs:+QDPnORb7AdPEm7Y7ltlVgxs
- TLSH T134363339536D9C62DDC7A0F8A49D4596FF683D60FAE2A006B47C1D213015DFB986FE08
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Public\3pIO3Z\msadox.tb
- Size 8KB
- SHA256 8036d5b2af08e87e609f4283e151eab593ed021865246577c7b9d76c45989d92
- MD5 a1a0179cee3fb9a2aa82caa75c3ff56b
- SHA1 6f6c2ab7776d3fc3f5af08cbd17bb6893c9c0298
- SHA512 608bc18b06bd2b8948caa8a595c84767e9c3adceb7eaf6c862338d25d4559f4d71a5984f4d258c7ff5cfd8b49f4651927569ca77922f7d8e6f390ccab7e7aba3
- SSDEEP 192:lqbZajnZ45X1q3JXglD+3vR8cwNhIMCGe2y0PQp:lsZqZOXQ3uqvR2Kfzp
- TLSH T103029E05D7A20CC3D6016C71CD9EB2F5AB13A1DADA3926719C67D4C167072DE2CE620D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Public\3pIO3Z\ty1yGx.exe
- Size 135KB
- SHA256 676a2a7b94ca2f8ec76352ee656e4d075bb342bd7ad6efbc7c19c060001eace7
- MD5 9ec587911e501b73b7cf09f05d0ae17d
- SHA1 5b62403cc9a668c6e5c70ace177fd54fcc4c5936
- SHA512 d05468a472373815c46ccb46ec743408365d24982d10d8a23ee0036c28cf3dacd05d74304ef2d4b7118f91ff3f631f676b2e86ddee92a02cf988b0d3c6247847
- SSDEEP 3072:MmhXb5pgtiaRENEErO9Uj4OqhhUvB4BNgQaJ:MmjgtiayGErsUKh3To
- TLSH T1D0D38C2776A474F9E1778635C8511A1AE772B8760770CB9F03A442A62F237D19E3EF20
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\MSI7621.tmp
- Size 5.7MB
- SHA256 f2f0cc6f7b1e3334ca03256781a86ab7c7c728a28de49714dde0e915fa4eb146
- MD5 528e32e0083a77b685012405a91c6492
- SHA1 beb6b6d191c2772b2e10dc17e4ab2416b6810858
- SHA512 8195a58ee3cb5b2d33bff4694aefb266551e45a17acad33ab84133cb5f2b43c854f5fa3791b340b813ff61757d68df07b652857d502d1a726a8eee2a889b891b
- SSDEEP 98304:w6pdCiGJuFw5V4SGWXlgAzCEFO0kJQpAmAzKdN8wMVLS6dYXzIrrrHlG:TdCis4BEoZJLm4Kv8wWGzerI
- TLSH T14A5633D139C66F70D1A3CBF4665A391D3CAE3BD5B9728C0A67D43A00AE73615DA32309
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\e5970c1.msi
- Size 5.7MB
- SHA256 f76aec724d73ee0c4e3bb2a7a50c064b5e6d6ddec54aff95e50c1e54777d0414
- MD5 1a3614357817fd3ef344feea11368aa2
- SHA1 5e8a944343ae556ef8abc62d7aa8ff1023255669
- SHA512 85d44681c4a6ee58195e07d55d889ab97566848493ad1ccee4e90d9c2a18cd1e74f1a17c4a25dd24731f042ae73a20472fdd2a9c4741197e1cfc91733e5dc539
- SSDEEP 98304:F6pdCiGJuFw5V4SGWXlgAzCEFO0kJQpAmAzKdN8wMVL66dYXzIrrrHlY:8dCis4BEoZJLm4Kv8w+GzerW
- TLSH T1455633D179C66F70D0A3CBF4561A6A1D3DAE3FD5B972CC0A67D43A006E32625DA32309
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
- Size 26.1MB
- SHA256 45a5a56b2a1fbcbfd034e9256161848dfdc9e2bc15b1d3ec78bbc03b65712e45
- MD5 d9344978a6157f65ff60069b2d9fefeb
- SHA1 3149d3fa922b46886895158abbf7d858d4a8fd30
- SHA512 70da50a476d391655a766f5cf5cda9ff29c6c92bc8d3510846461751569337f5f3f7dbb01d3053d7a96b016fd8d20f94fb9a1efe380a1aaa5278548ff9f47645
- SSDEEP 24576:4Fo3DMPgdoO/vvTL/yAsMilQPrOWX7rf0R6e9BCE65iqpLNMMoR2s12Noeq:dH8
- TLSH T1F157B51436F92100E7F79E3CA8F06A234D397D5BAC19DE8D45511B8E0922F71E872F6A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\Volume{c61fbfff-0000-0000-0000-d08302000000}\System Volume Information\SPP\OnlineMetadataCache\{d9278747-ded0-4fed-aa64-0ef08e94ae57}_OnDiskSnapshotProp
- Size 6KB
- SHA256 c065dcb1fdcf55a318ad7ee1ea873a0e43164d3bd4a0d34234708b103927ee43
- MD5 6edc51ff3b0e9fab78cb323e5db65db8
- SHA1 7a5a6cf8245d4cf1ca2e980ced3c40143eaf6430
- SHA512 1b4174a3afa89ce5214f45ed57f3fce6af24bcf198d450516373678d17c5600fc396771496f2b66e4964d0bb3a3f4265d2fcaf6f2e29edad8fc321dd0333cc08
- SSDEEP 96:F/LP2EW5mYlDvc6DD84LTHzbOHXOHBlBRQn8Sc9XE56tOSVQpu:hPqNl/b++uVm
- TLSH T101D189085AF54711E2F3AB3129F18557A877B911EF33CB8E0198238E6671910F935F6B
- MD5 SHA1 SHA512 SSDEEP TLSH