45e71fb42e9fc51f5d8f6f6b2d5daf24f3b7f3e8850e6de1235dc78c60d7a8f5

Analysis

max time kernel
300s
max time network
281s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260513-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260513-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
02/08/2026, 14:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
EasySuiteSetup.msi
Size 71.6MB
Sample260802-renf5sbb42
SHA256 45e71fb42e9fc51f5d8f6f6b2d5daf24f3b7f3e8850e6de1235dc78c60d7a8f5
MD5 50b0b7d854f14594d419cce69a66b517
SHA1 9c7705850f70aa3af850dba47ea5a78de3077f57
SHA512 fd611022d53e630487670bd0e1923c7d301ec63a8c3dbea2b7b97ba19dc23c982372f2bc4943804fdf00bde74c416d0a2a2409d3f10af661f38750092adb6806
SSDEEP 1572864:pSZm7O3jPaLd4bN4LZAw5GGxITqLAVrPtDJw+CTRbdO8iUBYNzSbBC4P0:A6Cj6d4bNIZAwcGxiqLMtDK+gdO8hBSb
TLSH
T1AFF7339BB4046C63C6DD043E953F6B3AF6610EF3760005626463BE9EDD7124A4B9D3AC
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

persistence privilege_escalation ransomware

Malware Config

Signatures

Executes dropped EXE 8 IoCs

pid	Process
788	Boost Note.exe
4400	Boost Note.exe
1632	Boost Note.exe
5080	Boost Note.exe
4456	Boost Note.exe
5540	Boost Note.exe
4160	Boost Note.exe
5320	Boost Note.exe

Loads dropped DLL 14 IoCs

pid	Process
788	Boost Note.exe
4400	Boost Note.exe
4400	Boost Note.exe
4400	Boost Note.exe
4400	Boost Note.exe
1632	Boost Note.exe
5080	Boost Note.exe
4456	Boost Note.exe
4456	Boost Note.exe
4456	Boost Note.exe
4456	Boost Note.exe
5540	Boost Note.exe
4160	Boost Note.exe
5320	Boost Note.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1131776342-1023621610-2767477260-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\electron.app.Boost Note = "C:\\Users\\Admin\\AppData\\Local\\MegaSuitelyTechMaxx\\Boost Note.exe"	Boost Note.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1131776342-1023621610-2767477260-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\electron.app.Boost Note = "C:\\Users\\Admin\\AppData\\Local\\MegaSuitelyTechMaxx\\Boost Note.exe"	Boost Note.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe

Drops file in Windows directory 8 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\e58cbb7.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\SourceHash{FFB98429-A8F9-4371-A79E-522A72B1D19A}	msiexec.exe
File created	C:\Windows\Installer\e58cbb9.msi	msiexec.exe
File created	C:\Windows\Installer\e58cbb7.msi	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSID155.tmp	msiexec.exe

Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs

persistence privilege_escalation

Installer Packages

T1546.016

Msiexec

T1218.007

pid	Process
4812	msiexec.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 00000000040000009f4cc38cfb5b1d5f0000000000000000000000000000000000000000000000000000000000000000000000000000000000001071020000000000c01200000000ffffffff0000000027010100008838019f4cc38c0000000000001071020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d083020000000000c050dc000000ffffffff000000000700010000e841019f4cc38c000000000000d08302000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000090d4de0000000000000005000000ffffffff000000000700010000486a6f9f4cc38c00000000000090d4de000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000090d4e30000000000000005000000ffffffff00000000070001000048ea719f4cc38c00000000000090d4e300000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
4924	msiexec.exe
4924	msiexec.exe
1632	Boost Note.exe
1632	Boost Note.exe
5540	Boost Note.exe
5540	Boost Note.exe
4160	Boost Note.exe
4160	Boost Note.exe
4160	Boost Note.exe
4160	Boost Note.exe
5320	Boost Note.exe
5320	Boost Note.exe
5320	Boost Note.exe
5320	Boost Note.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4812	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4812	msiexec.exe
Token: SeSecurityPrivilege	4924	msiexec.exe
Token: SeCreateTokenPrivilege	4812	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	4812	msiexec.exe
Token: SeLockMemoryPrivilege	4812	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4812	msiexec.exe
Token: SeMachineAccountPrivilege	4812	msiexec.exe
Token: SeTcbPrivilege	4812	msiexec.exe
Token: SeSecurityPrivilege	4812	msiexec.exe
Token: SeTakeOwnershipPrivilege	4812	msiexec.exe
Token: SeLoadDriverPrivilege	4812	msiexec.exe
Token: SeSystemProfilePrivilege	4812	msiexec.exe
Token: SeSystemtimePrivilege	4812	msiexec.exe
Token: SeProfSingleProcessPrivilege	4812	msiexec.exe
Token: SeIncBasePriorityPrivilege	4812	msiexec.exe
Token: SeCreatePagefilePrivilege	4812	msiexec.exe
Token: SeCreatePermanentPrivilege	4812	msiexec.exe
Token: SeBackupPrivilege	4812	msiexec.exe
Token: SeRestorePrivilege	4812	msiexec.exe
Token: SeShutdownPrivilege	4812	msiexec.exe
Token: SeDebugPrivilege	4812	msiexec.exe
Token: SeAuditPrivilege	4812	msiexec.exe
Token: SeSystemEnvironmentPrivilege	4812	msiexec.exe
Token: SeChangeNotifyPrivilege	4812	msiexec.exe
Token: SeRemoteShutdownPrivilege	4812	msiexec.exe
Token: SeUndockPrivilege	4812	msiexec.exe
Token: SeSyncAgentPrivilege	4812	msiexec.exe
Token: SeEnableDelegationPrivilege	4812	msiexec.exe
Token: SeManageVolumePrivilege	4812	msiexec.exe
Token: SeImpersonatePrivilege	4812	msiexec.exe
Token: SeCreateGlobalPrivilege	4812	msiexec.exe
Token: SeBackupPrivilege	5088	vssvc.exe
Token: SeRestorePrivilege	5088	vssvc.exe
Token: SeAuditPrivilege	5088	vssvc.exe
Token: SeBackupPrivilege	4924	msiexec.exe
Token: SeRestorePrivilege	4924	msiexec.exe
Token: SeRestorePrivilege	4924	msiexec.exe
Token: SeTakeOwnershipPrivilege	4924	msiexec.exe
Token: SeRestorePrivilege	4924	msiexec.exe
Token: SeTakeOwnershipPrivilege	4924	msiexec.exe
Token: SeRestorePrivilege	4924	msiexec.exe
Token: SeTakeOwnershipPrivilege	4924	msiexec.exe
Token: SeRestorePrivilege	4924	msiexec.exe
Token: SeTakeOwnershipPrivilege	4924	msiexec.exe
Token: SeRestorePrivilege	4924	msiexec.exe
Token: SeTakeOwnershipPrivilege	4924	msiexec.exe
Token: SeRestorePrivilege	4924	msiexec.exe
Token: SeTakeOwnershipPrivilege	4924	msiexec.exe
Token: SeRestorePrivilege	4924	msiexec.exe
Token: SeTakeOwnershipPrivilege	4924	msiexec.exe
Token: SeRestorePrivilege	4924	msiexec.exe
Token: SeTakeOwnershipPrivilege	4924	msiexec.exe
Token: SeRestorePrivilege	4924	msiexec.exe
Token: SeTakeOwnershipPrivilege	4924	msiexec.exe
Token: SeRestorePrivilege	4924	msiexec.exe
Token: SeTakeOwnershipPrivilege	4924	msiexec.exe
Token: SeRestorePrivilege	4924	msiexec.exe
Token: SeTakeOwnershipPrivilege	4924	msiexec.exe
Token: SeRestorePrivilege	4924	msiexec.exe
Token: SeTakeOwnershipPrivilege	4924	msiexec.exe
Token: SeRestorePrivilege	4924	msiexec.exe
Token: SeTakeOwnershipPrivilege	4924	msiexec.exe
Token: SeRestorePrivilege	4924	msiexec.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
4812	msiexec.exe
4812	msiexec.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4924 wrote to memory of 752	4924	msiexec.exe	88
PID 4924 wrote to memory of 788	4924	msiexec.exe	90
PID 788 wrote to memory of 4400	788	Boost Note.exe	91
PID 788 wrote to memory of 1632	788	Boost Note.exe	93
PID 5080 wrote to memory of 4456	5080	Boost Note.exe	98
PID 5080 wrote to memory of 5540	5080	Boost Note.exe	99
PID 788 wrote to memory of 4160	788	Boost Note.exe	106
PID 5080 wrote to memory of 5320	5080	Boost Note.exe	107

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\EasySuiteSetup.msi
1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4812

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4924
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:752
- C:\Users\Admin\AppData\Local\MegaSuitelyTechMaxx\Boost Note.exe
  "C:\Users\Admin\AppData\Local\MegaSuitelyTechMaxx\Boost Note.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:788
- - C:\Users\Admin\AppData\Local\MegaSuitelyTechMaxx\Boost Note.exe
    "C:\Users\Admin\AppData\Local\MegaSuitelyTechMaxx\Boost Note.exe" --type=gpu-process --field-trial-handle=1728,17290628993931708018,2537712788516273542,131072 --enable-features=WebComponentsV0Enabled --disable-features=CertVerifierService,CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1736 /prefetch:2
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:4400
- - C:\Users\Admin\AppData\Local\MegaSuitelyTechMaxx\Boost Note.exe
    "C:\Users\Admin\AppData\Local\MegaSuitelyTechMaxx\Boost Note.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1728,17290628993931708018,2537712788516273542,131072 --enable-features=WebComponentsV0Enabled --disable-features=CertVerifierService,CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=2052 /prefetch:8
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    PID:1632
- - C:\Users\Admin\AppData\Local\MegaSuitelyTechMaxx\Boost Note.exe
    "C:\Users\Admin\AppData\Local\MegaSuitelyTechMaxx\Boost Note.exe" --type=gpu-process --field-trial-handle=1728,17290628993931708018,2537712788516273542,131072 --enable-features=WebComponentsV0Enabled --disable-features=CertVerifierService,CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.4355 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=692 /prefetch:2
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    PID:4160

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:5088

C:\Users\Admin\AppData\Local\MegaSuitelyTechMaxx\Boost Note.exe
"C:\Users\Admin\AppData\Local\MegaSuitelyTechMaxx\Boost Note.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:5080
- C:\Users\Admin\AppData\Local\MegaSuitelyTechMaxx\Boost Note.exe
  "C:\Users\Admin\AppData\Local\MegaSuitelyTechMaxx\Boost Note.exe" --type=gpu-process --field-trial-handle=1748,1825087655849806905,6180092219795172545,131072 --enable-features=WebComponentsV0Enabled --disable-features=CertVerifierService,CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1760 /prefetch:2
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:4456
- C:\Users\Admin\AppData\Local\MegaSuitelyTechMaxx\Boost Note.exe
  "C:\Users\Admin\AppData\Local\MegaSuitelyTechMaxx\Boost Note.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1748,1825087655849806905,6180092219795172545,131072 --enable-features=WebComponentsV0Enabled --disable-features=CertVerifierService,CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=2128 /prefetch:8
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  PID:5540
- C:\Users\Admin\AppData\Local\MegaSuitelyTechMaxx\Boost Note.exe
  "C:\Users\Admin\AppData\Local\MegaSuitelyTechMaxx\Boost Note.exe" --type=gpu-process --field-trial-handle=1748,1825087655849806905,6180092219795172545,131072 --enable-features=WebComponentsV0Enabled --disable-features=CertVerifierService,CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.4355 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1720 /prefetch:2
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  PID:5320

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Installer Packages

T1546.016

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Installer Packages

T1546.016

Defense Evasion

Modify Registry

T1112

System Binary Proxy Execution

T1218

Msiexec

T1218.007

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e58cbb8.rbs

Path C:\Config.Msi\e58cbb8.rbs
Size 144KB
SHA256 afef1445493cfe2b94db053001a75659e18fb272b59e4fe11b66f21ea5f4376b
MD5 9c96cb4cabdef7cbce13b380bdbcde1d
SHA1 62c71e7f471a7f9e667dd726e59762ebf8b9052a
SHA512 3bc1cd0aa397fddfc7f4cb34793e696629beea0889ad483aece165a5c2825c1015c522b845ce5345d4a5db8ca622d7dda2fd00b3c2b86312836b49da3f822b47
SSDEEP 1536:Mh7vGI7BNvGVKytG7cWyxFh8SEid7kce9R5/T46lnrQes0+S6PYxMWY:i5UG7wN7
TLSH
T117E3E0B752F5B7778D28457B72E3F43C85A40DAACA1D2B091138443F25D26EB7EC6A08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

D3DCompiler_47.dll

Path C:\Users\Admin\AppData\Local\MegaSuitelyTechMaxx\D3DCompiler_47.dll
Size 4.3MB
SHA256 44422e6936dc72b7ac5ed16bb8bcae164b7554513e52efb66a3e942cec328a47
MD5 7641e39b7da4077084d2afe7c31032e0
SHA1 2256644f69435ff2fee76deb04d918083960d1eb
SHA512 8010e1cb17fa18bbf72d8344e1d63ded7cef7be6e7c13434fa6d8e22ce1d58a4d426959bdcb031502d4b145e29cb111af929fcbc66001111fbc6d7a19e8800a5
SSDEEP 49152:aYlc/220PPiMLKam+VMrLi21f4i3jn5ZO3XUDmOZQwVd2uQpN3WsGVUWd55i/jrs:a6KD2Mrdaix4NQnLt
TLSH
T16F267D5677A840A9C27BC178CA574313EBB1781403349BEF55A0C665EF33BD26E3A728
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_100_percent.pak

Path C:\Users\Admin\AppData\Local\MegaSuitelyTechMaxx\chrome_100_percent.pak
Size 123KB
SHA256 f1a935db8236203cbc1dcbb9672d98e0bd2fa514429a3f2f82a26e0eb23a4ff9
MD5 a59ea69d64bf4f748401dc5a46a65854
SHA1 111c4cc792991faf947a33386a5862e3205b0cff
SHA512 12a1d953df00b6464ecc132a6e5b9ec3b301c7b3cefe12cbcad27a496d2d218f89e2087dd01d293d37f29391937fcbad937f7d5cf2a6f303539883e2afe3dacd
SSDEEP 3072:YerKzw9bpxlr+bEfF2DGb0+VvfGGY304F2DExm/KLQ2I:YeKzw9Vh90Gb0OveGe04mExhLY
TLSH
T187C3D0D373F0ED7DCF6756B7A52A41B1ECB302391A92034A469AD8356A27348DDC8393
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_200_percent.pak

Path C:\Users\Admin\AppData\Local\MegaSuitelyTechMaxx\chrome_200_percent.pak
Size 183KB
SHA256 7f9ded50d81c50f9c6ed89591fa621fabbd45cef150c8aabcceb3b7a9de5603b
MD5 1985b8fc603db4d83df72cfaeeac7c50
SHA1 5b02363de1c193827062bfa628261b1ec16bd8cf
SHA512 27e90dd18cbce0e27c70b395895ef60a8d2f2f3c3f2ca38f48b7ecf6b0d5e6fefbe88df7e7c98224222b34ff0fbd60268fdec17440f1055535a79002044c955b
SSDEEP 3072:yDfDQYaEM+9bslr+bEfEfRIGMR+F8fQnYw9pGbXGYoDd+qHqRxmeK/rIM0:6DQYaF+9bMhCWGMRe8InVXYopym74
TLSH
T12E04D1D7A3F49D3CDAB30A77553A01F1ECB6127516A3424A42DBAC347A5678C4CC9293
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ffmpeg.dll

Path C:\Users\Admin\AppData\Local\MegaSuitelyTechMaxx\ffmpeg.dll
Size 2.7MB
SHA256 8653b57b37618f11e358c93aad9dc9ef0193f0288f7e59147194e42b0842b50e
MD5 b34d74a152e1788532b0acfa8cfbdf1e
SHA1 e99e5a26d8b695b57cb1a1bb0d2c032d822d0461
SHA512 06f8def21101d8c899c321b3a445e6838f824d6d6305d569b49fb7ad14a197a57c601a8965c50057e7af1d5414b74dd2c79e2f27a58eedab31b3b36202947dd9
SSDEEP 49152:nSFoiJBtTcoQ9mjUBA6vXH4VjB0kxryYTK8gJ2EDE+oM0iloSa08UHdiVqAy6cTC:ijUBA656ryEpEdiVq4
TLSH
T1DFD59D0BF2A645DDC029C53083AFA233F934394A4725A6EF16A156252F3FFD0667EB05
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

icudtl.dat

Path C:\Users\Admin\AppData\Local\MegaSuitelyTechMaxx\icudtl.dat
Size 9.9MB
SHA256 02db39ba465fc8b7a4cd280732760f29911edde87b331bf7cea7677e94d483e0
MD5 70499b58dc18e7ee1d7452a1d7a8bc6e
SHA1 41c5382f08c6a88670ce73a20c0dcdb3822f19e9
SHA512 a80939e9809bb7d20f00ad685c94d5c182fa729616c975e605abf09afb58376be73a49fefa35b75ed1a284eccf208af7656c8df44c5959df7eaf51367d232dc6
SSDEEP 196608:uUGwSv9AAQnt6liXUxR0rHa93WhlU6t7CLhl:uoKlQnAliXUxR0rHa93WhlU6t+Ln
TLSH
T131A63947A2FB4DC2F9FBAF30D8F452679467BD496E32805A11042F3B5C373A096617A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

en-US.pak

Path C:\Users\Admin\AppData\Local\MegaSuitelyTechMaxx\locales\en-US.pak
Size 85KB
SHA256 ac1cdb4fb4d9fb27a908ed0e24cc9cc2bd885bc3ffba7e08b0b907fd4d1a8c4b
MD5 6bbeeb72daebc3b0cbd9c39e820c87a9
SHA1 bd9ebec2d3fc03a2b27f128cf2660b33a3344f43
SHA512 66944fb1abcc2a7e08e5fd8a2cee53eb9da57653d7880aea226f25879e26379f7d745ebf62a3518378fa503f3a31b3ea3716f49fe4c7db4f4af0228b81b53a10
SSDEEP 1536:MzBh0wu6Y90fYSKD0R4RlQ2trhWMJ5dBxgMSO0JedMVrBHhQYVfD3ggl+C/fpkwG:6hp1YSwhBxgrvQY3ggl+CGwG
TLSH
T1BB835E1BE3C41266099243227F06E3B6AB26D079936311663C6CC16C3777FA982777E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

resources.pak

Path C:\Users\Admin\AppData\Local\MegaSuitelyTechMaxx\resources.pak
Size 4.9MB
SHA256 367467609a389b67600628760c26732fc1a25f563f73263bc2c4bf6eec9033df
MD5 5507bc28022b806ea7a3c3bc65a1c256
SHA1 9f8d3a56fef7374c46cd3557f73855d585692b54
SHA512 ae698d4feacc3e908981ee44df3a9d76e42a39bf083eaf099442ace2b863f882b43232e26e2c18051ca7aec81dccef5742acc7b82fb0cda2e14086b14d5a9a26
SSDEEP 98304:1jMQZikLH2tMPwSGBNumogFJlFlh1wTJntwyqWBsCiLeD8crwrb:tMqimHmGfgfhyTh8YsCi6Qckrb
TLSH
T1FB362302F2E4283BC6DB31766C6BA161B73444471068BD2E7A9D52DCAF5492802FEFF5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index.js

Path C:\Users\Admin\AppData\Local\MegaSuitelyTechMaxx\resources\app\index.js
Size 240KB
SHA256 176f28d4929e80b0039851d31297cc3db98cfc2813216ecda880d7dc63668618
MD5 54e9cc07b1bf0158f749a741a23921fa
SHA1 d811807a19ae6d733b9cd902e700f7d836862b77
SHA512 26204d6fe601cf916d30cf3f984a8ab272a422f3b5bc99c65fee7bc56a8302e0e45a98dcfa9165ef19286c3ea8cd89a377b250726dea3ab2e56b430b13f325d9
SSDEEP 3072:/hprLsKuviSpbMECceMtJmCC4j9X1aQllVO1V:/hprLs7viShChMtVC4j9FU7
TLSH
T1303495843BCAA0D2421935F1063F3615B56E4D627A0CCA88D7FAB49EFDB930594B7E34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

license

Path C:\Users\Admin\AppData\Local\MegaSuitelyTechMaxx\resources\app\node_modules\file-type\license
Size 1KB
SHA256 5c932d88256b4ab958f64a856fa48e8bd1f55bc1d96b8149c65689e0c61789d3
MD5 d5f2a6dd0192dcc7c833e50bb9017337
SHA1 80674912e3033be358331910ba27d5812369c2fc
SHA512 d1f336ff272bc6b96dc9a04a7d0ef8f02936dd594f514060340478ee575fe01d55fc7a174df5814a4faf72c8462b012998eca7bb898e3f9a3e87205fb9135af2
TLSH
T18221931E7254136318BA13A0696A6CC4B32BB11F7DAF6B8418ADF244233B46CD4FB840
MD5 SHA1 SHA512 TLSH

Submit Download

license

Path C:\Users\Admin\AppData\Local\MegaSuitelyTechMaxx\resources\app\node_modules\normalize-url\license
Size 1KB
SHA256 48da2f39e100d4085767e94966b43f4fa95ff6a0698fba57ed460914e35f94a0
MD5 915042b5df33c31a6db2b37eadaa00e3
SHA1 5aaf48196ddd4d007a3067aa7f30303ca8e4b29c
SHA512 9c8b2def76ae5ffe4d636166bf9635d7abd69cdac4bf819a2145f7969646d39ae95c96364bc117f9fa544b98518c294233455d4f665af430c75d70798dd4ab13
TLSH
T1EC11931D7254136318BA13A069696CC4B32BB11F79AF6B8418AEF244233B46CD4FB840
MD5 SHA1 SHA512 TLSH

Submit Download

package.json

Path C:\Users\Admin\AppData\Local\MegaSuitelyTechMaxx\resources\app\package.json
Size 326B
SHA256 ed559a3a3027667ce6302f1debaed9aef5bef1c6d4236ec4da01199b398f78b2
MD5 48f234e36eba960bf0f66519a219e17e
SHA1 988d574c95e613f177e81417c590540f77ed9845
SHA512 08ac57c789dd209ceebdc73d5ee709ee141811f0955b982454c3459eeac9353eec08aac68646d18c55a181a1f5f64f56fcbebe203597dabef54f2deb40e5e276
TLSH
T128E08C18DC499E23129B888A3068014728612C079959F80DB79E930C1E5C96FB2FCAAD
MD5 SHA1 SHA512 TLSH

Submit Download

libEGL.dll

Path C:\Users\Admin\AppData\Local\MegaSuitelyTechMaxx\swiftshader\libEGL.dll
Size 458KB
SHA256 bfd1d3fb9e50a3d9a58d9c62663fbf46bedcac24744020b801c9bb4cdc55f977
MD5 21a07ee229edc5d8de61de97f1a65210
SHA1 a60f93adbad349e25cca0eca5a81c78fbf24f133
SHA512 6375d8bda8cc187f79f6ea0cfd8358ac0d85508327f44d0bbcca641a934fa2b690933eb1ab588821a2f63f6615b1926aa433bc759b787015170aff11e633d0e4
SSDEEP 6144:e6txlbRay7iVeTIM4gkZ8A9YfCmpmXZvrpeK8MbhGG+gwLuggcAgAeG4:ePZ4IM4u7BmXZXGuTcAD
TLSH
T13CA47C16B7A504A9D036C4348A574A43DA71B8DA0F74EBEF0294A27D2F7B7E05F39324
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libGLESv2.dll

Path C:\Users\Admin\AppData\Local\MegaSuitelyTechMaxx\swiftshader\libGLESv2.dll
Size 3.1MB
SHA256 54b6e787450bfcebed843ad1dafb31ca0904a908131d1005b567513ee8e2db46
MD5 07a0f70d8e06fcb7e9063f39c0ab8c68
SHA1 896f3401b019c31ab1de2a376a66829daceccadb
SHA512 f58e4b23eca4aa4eef435288fc4d3740ea700debe82e083167a68df709c383f8bb7393ee74558acae8804ed105536ac86c5657912a98d284a1fc57dcf25586ff
SSDEEP 49152:cgnhCIFndJN3alVO7hUADGoJJ5AtyPzaaujA84dvCilHS4E0JhHHRBHpJbftopLw:TYIFnXoLfauC1DeFR
TLSH
T1EFE55A43E08880D9E05DD5BC874BA62EE132BC856B7272DF12946B222E77BF0573DB54
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

v8_context_snapshot.bin

Path C:\Users\Admin\AppData\Local\MegaSuitelyTechMaxx\v8_context_snapshot.bin
Size 160KB
SHA256 31c3aa5645b5487bf484fd910379003786523f3063e946ef9b50d257d0ee5790
MD5 b64c1fc7d75234994012c86dc5af10a6
SHA1 d0d562b5735d28381d59d0d86078ff6b493a678e
SHA512 6218fcb74ef715030a2dd718c87b32f41e976dd4ce459c54a45341ee0f5ca5c927ad507d3afcffe7298b989e969885ed7fb72030ea59387609e8bd5c4b8eb60a
SSDEEP 3072:pBgpuz1xV9mRTUAnPH5lZw15qCy0CmiRNiA0hTBAzZs7q/JBXTPv:p4O1xoTPyqIRhTBAzZs7kJ1TPv
TLSH
T1F2F3121427D0829096ED4094A25B06E7C5D26C6D1E2CFF0A3BB5FD4C0AA3DCE55FE1B8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

daemon.log

Path C:\Users\Admin\AppData\Roaming\daemon.log
Size 8B
SHA256 fc12127110dd4ef04ccfb658ca5f76cc36ac2a6f240154ca8efc8aaf56d497f1
MD5 bce657e69cbb0fd12c2e4b0d45c4bab7
SHA1 7143af6d828173f1a633b61250d58824bf794f6b
SHA512 06a563c717168f86e17ba99c08bb786afadd7424566580229f5c3dc1fc68002e56fb5d452b3e15695e9535c99af2d0b8f1b7d2322ab77dd6b105cece6db44a4a
MD5 SHA1 SHA512

Submit Download

metadata-2

Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
Size 24.0MB
SHA256 0b9c902b6d73def50473f4b251d203b7aca3d66c82fb3f1c0925733d04e9076f
MD5 bcad1fe24de6ba9a3c0e1985005925bb
SHA1 78182c144cf13a357e189dff51bf7544e541200f
SHA512 4302fb371d3825de3376611e01ff258ee2934a9aae687a626bd1627b12ba9f5695912efbb429a7b21d650561c86bbca9b0e69711d869b9eebef81cb82b075057
SSDEEP 24576:tEpmg3MOdoO/vvTLz1netZm5vcbBaPoRbnothTr18y6DrWJX4ikGC7R8jM:gs
TLSH
T15B47B12476F92210E7B79E3CA8F16A234D3A7D5B9C15DE8D05411B8E0822F71EC72F66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{ead2cf91-a039-4da2-b8b1-70840514fc74}_OnDiskSnapshotProp

Path \??\Volume{8cc34c9f-0000-0000-0000-d08302000000}\System Volume Information\SPP\OnlineMetadataCache\{ead2cf91-a039-4da2-b8b1-70840514fc74}_OnDiskSnapshotProp
Size 6KB
SHA256 099bd080603f7886b0ebb58dcc42f99edd4ce6e1ca8074dfe22f31b199d4a077
MD5 de6ffbecdec52347d6e449d5d3d08a46
SHA1 1552ee59cfd216f2c579c85a0254a58bac39c7b9
SHA512 804d89593b4f35f7b6d7ea6c7d2bf51200706022d619756421e8ab82bd92f2dc75bb47c92506bcf988b9c5267f282582ad52492fc090376d4902c8993e54f7b5
SSDEEP 96:FJjONSvc8DD84LTHzbOHXOHBlBRQ88Sc9XE56tOSVQpuN:nrb++ZVmN
TLSH
T1ACD19A1C5AF54311E2B3AB7129F18557A877B811EF33CB8E0298638E2670910F936F5B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4400-625-0x00007FFB8EF40000-0x00007FFB8EF41000-memory.dmp

Download