45e71fb42e9fc51f5d8f6f6b2d5daf24f3b7f3e8850e6de1235dc78c60d7a8f5

Analysis

max time kernel
298s
max time network
279s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
02/08/2026, 14:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
EasySuiteSetup.msi
Size 71.6MB
Sample260802-renf5sbb42
SHA256 45e71fb42e9fc51f5d8f6f6b2d5daf24f3b7f3e8850e6de1235dc78c60d7a8f5
MD5 50b0b7d854f14594d419cce69a66b517
SHA1 9c7705850f70aa3af850dba47ea5a78de3077f57
SHA512 fd611022d53e630487670bd0e1923c7d301ec63a8c3dbea2b7b97ba19dc23c982372f2bc4943804fdf00bde74c416d0a2a2409d3f10af661f38750092adb6806
SSDEEP 1572864:pSZm7O3jPaLd4bN4LZAw5GGxITqLAVrPtDJw+CTRbdO8iUBYNzSbBC4P0:A6Cj6d4bNIZAwcGxiqLMtDK+gdO8hBSb
TLSH
T1AFF7339BB4046C63C6DD043E953F6B3AF6610EF3760005626463BE9EDD7124A4B9D3AC
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

persistence privilege_escalation ransomware

Malware Config

Signatures

Executes dropped EXE 8 IoCs

pid	Process
3472	Boost Note.exe
1716	Boost Note.exe
1032	Boost Note.exe
4568	Boost Note.exe
3888	Boost Note.exe
3732	Boost Note.exe
3364	Boost Note.exe
3260	Boost Note.exe

Loads dropped DLL 15 IoCs

pid	Process
3472	Boost Note.exe
3472	Boost Note.exe
1716	Boost Note.exe
1716	Boost Note.exe
1716	Boost Note.exe
1716	Boost Note.exe
1032	Boost Note.exe
4568	Boost Note.exe
3888	Boost Note.exe
3888	Boost Note.exe
3888	Boost Note.exe
3888	Boost Note.exe
3732	Boost Note.exe
3364	Boost Note.exe
3260	Boost Note.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000\Software\Microsoft\Windows\CurrentVersion\Run\electron.app.Boost Note = "C:\\Users\\Admin\\AppData\\Local\\MegaSuitelyTechMaxx\\Boost Note.exe"	Boost Note.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000\Software\Microsoft\Windows\CurrentVersion\Run\electron.app.Boost Note = "C:\\Users\\Admin\\AppData\\Local\\MegaSuitelyTechMaxx\\Boost Note.exe"	Boost Note.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe

Drops file in Windows directory 12 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\e585afc.msi	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\SystemTemp\~DF1E37F4B6629A4106.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DF3BB202AA050153A3.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DF1AC2AC15B92DA856.TMP	msiexec.exe
File created	C:\Windows\Installer\e585afc.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\SystemTemp\~DF65B04758CD2A4AC4.TMP	msiexec.exe
File created	C:\Windows\Installer\SourceHash{FFB98429-A8F9-4371-A79E-522A72B1D19A}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI600D.tmp	msiexec.exe
File created	C:\Windows\Installer\e585afe.msi	msiexec.exe

Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs

persistence privilege_escalation

Installer Packages

T1546.016

Msiexec

T1218.007

pid	Process
3940	msiexec.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 000000000400000027a96ea556b175d40000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff00000000270101000008000027a96ea50000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed35000000ffffffff00000000070001000068090027a96ea5000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff350000000000000005000000ffffffff000000000700010000f8ff1a27a96ea5000000000000f0ff350000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d27a96ea5000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
3652	msiexec.exe
3652	msiexec.exe
1032	Boost Note.exe
1032	Boost Note.exe
3732	Boost Note.exe
3732	Boost Note.exe
3364	Boost Note.exe
3364	Boost Note.exe
3364	Boost Note.exe
3364	Boost Note.exe
3260	Boost Note.exe
3260	Boost Note.exe
3260	Boost Note.exe
3260	Boost Note.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3940	msiexec.exe
Token: SeIncreaseQuotaPrivilege	3940	msiexec.exe
Token: SeSecurityPrivilege	3652	msiexec.exe
Token: SeCreateTokenPrivilege	3940	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	3940	msiexec.exe
Token: SeLockMemoryPrivilege	3940	msiexec.exe
Token: SeIncreaseQuotaPrivilege	3940	msiexec.exe
Token: SeMachineAccountPrivilege	3940	msiexec.exe
Token: SeTcbPrivilege	3940	msiexec.exe
Token: SeSecurityPrivilege	3940	msiexec.exe
Token: SeTakeOwnershipPrivilege	3940	msiexec.exe
Token: SeLoadDriverPrivilege	3940	msiexec.exe
Token: SeSystemProfilePrivilege	3940	msiexec.exe
Token: SeSystemtimePrivilege	3940	msiexec.exe
Token: SeProfSingleProcessPrivilege	3940	msiexec.exe
Token: SeIncBasePriorityPrivilege	3940	msiexec.exe
Token: SeCreatePagefilePrivilege	3940	msiexec.exe
Token: SeCreatePermanentPrivilege	3940	msiexec.exe
Token: SeBackupPrivilege	3940	msiexec.exe
Token: SeRestorePrivilege	3940	msiexec.exe
Token: SeShutdownPrivilege	3940	msiexec.exe
Token: SeDebugPrivilege	3940	msiexec.exe
Token: SeAuditPrivilege	3940	msiexec.exe
Token: SeSystemEnvironmentPrivilege	3940	msiexec.exe
Token: SeChangeNotifyPrivilege	3940	msiexec.exe
Token: SeRemoteShutdownPrivilege	3940	msiexec.exe
Token: SeUndockPrivilege	3940	msiexec.exe
Token: SeSyncAgentPrivilege	3940	msiexec.exe
Token: SeEnableDelegationPrivilege	3940	msiexec.exe
Token: SeManageVolumePrivilege	3940	msiexec.exe
Token: SeImpersonatePrivilege	3940	msiexec.exe
Token: SeCreateGlobalPrivilege	3940	msiexec.exe
Token: SeBackupPrivilege	2056	vssvc.exe
Token: SeRestorePrivilege	2056	vssvc.exe
Token: SeAuditPrivilege	2056	vssvc.exe
Token: SeBackupPrivilege	3652	msiexec.exe
Token: SeRestorePrivilege	3652	msiexec.exe
Token: SeRestorePrivilege	3652	msiexec.exe
Token: SeTakeOwnershipPrivilege	3652	msiexec.exe
Token: SeRestorePrivilege	3652	msiexec.exe
Token: SeTakeOwnershipPrivilege	3652	msiexec.exe
Token: SeRestorePrivilege	3652	msiexec.exe
Token: SeTakeOwnershipPrivilege	3652	msiexec.exe
Token: SeRestorePrivilege	3652	msiexec.exe
Token: SeTakeOwnershipPrivilege	3652	msiexec.exe
Token: SeRestorePrivilege	3652	msiexec.exe
Token: SeTakeOwnershipPrivilege	3652	msiexec.exe
Token: SeRestorePrivilege	3652	msiexec.exe
Token: SeTakeOwnershipPrivilege	3652	msiexec.exe
Token: SeRestorePrivilege	3652	msiexec.exe
Token: SeTakeOwnershipPrivilege	3652	msiexec.exe
Token: SeRestorePrivilege	3652	msiexec.exe
Token: SeTakeOwnershipPrivilege	3652	msiexec.exe
Token: SeRestorePrivilege	3652	msiexec.exe
Token: SeTakeOwnershipPrivilege	3652	msiexec.exe
Token: SeRestorePrivilege	3652	msiexec.exe
Token: SeTakeOwnershipPrivilege	3652	msiexec.exe
Token: SeRestorePrivilege	3652	msiexec.exe
Token: SeTakeOwnershipPrivilege	3652	msiexec.exe
Token: SeRestorePrivilege	3652	msiexec.exe
Token: SeTakeOwnershipPrivilege	3652	msiexec.exe
Token: SeRestorePrivilege	3652	msiexec.exe
Token: SeTakeOwnershipPrivilege	3652	msiexec.exe
Token: SeRestorePrivilege	3652	msiexec.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
3940	msiexec.exe
3940	msiexec.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 3652 wrote to memory of 1592	3652	msiexec.exe	84
PID 3652 wrote to memory of 3472	3652	msiexec.exe	86
PID 3472 wrote to memory of 1716	3472	Boost Note.exe	87
PID 3472 wrote to memory of 1032	3472	Boost Note.exe	88
PID 4568 wrote to memory of 3888	4568	Boost Note.exe	92
PID 4568 wrote to memory of 3732	4568	Boost Note.exe	93
PID 3472 wrote to memory of 3364	3472	Boost Note.exe	95
PID 4568 wrote to memory of 3260	4568	Boost Note.exe	96

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\EasySuiteSetup.msi
1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3940

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3652
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:1592
- C:\Users\Admin\AppData\Local\MegaSuitelyTechMaxx\Boost Note.exe
  "C:\Users\Admin\AppData\Local\MegaSuitelyTechMaxx\Boost Note.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:3472
- - C:\Users\Admin\AppData\Local\MegaSuitelyTechMaxx\Boost Note.exe
    "C:\Users\Admin\AppData\Local\MegaSuitelyTechMaxx\Boost Note.exe" --type=gpu-process --field-trial-handle=1616,16752268274654000073,16307602264746250662,131072 --enable-features=WebComponentsV0Enabled --disable-features=CertVerifierService,CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1628 /prefetch:2
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:1716
- - C:\Users\Admin\AppData\Local\MegaSuitelyTechMaxx\Boost Note.exe
    "C:\Users\Admin\AppData\Local\MegaSuitelyTechMaxx\Boost Note.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1616,16752268274654000073,16307602264746250662,131072 --enable-features=WebComponentsV0Enabled --disable-features=CertVerifierService,CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=2008 /prefetch:8
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    PID:1032
- - C:\Users\Admin\AppData\Local\MegaSuitelyTechMaxx\Boost Note.exe
    "C:\Users\Admin\AppData\Local\MegaSuitelyTechMaxx\Boost Note.exe" --type=gpu-process --field-trial-handle=1616,16752268274654000073,16307602264746250662,131072 --enable-features=WebComponentsV0Enabled --disable-features=CertVerifierService,CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1528 /prefetch:2
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    PID:3364

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:2056

C:\Users\Admin\AppData\Local\MegaSuitelyTechMaxx\Boost Note.exe
"C:\Users\Admin\AppData\Local\MegaSuitelyTechMaxx\Boost Note.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4568
- C:\Users\Admin\AppData\Local\MegaSuitelyTechMaxx\Boost Note.exe
  "C:\Users\Admin\AppData\Local\MegaSuitelyTechMaxx\Boost Note.exe" --type=gpu-process --field-trial-handle=1648,8439768629237893352,18043550895529553803,131072 --enable-features=WebComponentsV0Enabled --disable-features=CertVerifierService,CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1684 /prefetch:2
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:3888
- C:\Users\Admin\AppData\Local\MegaSuitelyTechMaxx\Boost Note.exe
  "C:\Users\Admin\AppData\Local\MegaSuitelyTechMaxx\Boost Note.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1648,8439768629237893352,18043550895529553803,131072 --enable-features=WebComponentsV0Enabled --disable-features=CertVerifierService,CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=2060 /prefetch:8
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  PID:3732
- C:\Users\Admin\AppData\Local\MegaSuitelyTechMaxx\Boost Note.exe
  "C:\Users\Admin\AppData\Local\MegaSuitelyTechMaxx\Boost Note.exe" --type=gpu-process --field-trial-handle=1648,8439768629237893352,18043550895529553803,131072 --enable-features=WebComponentsV0Enabled --disable-features=CertVerifierService,CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=2088 /prefetch:2
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  PID:3260

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Installer Packages

T1546.016

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Installer Packages

T1546.016

Defense Evasion

Modify Registry

T1112

System Binary Proxy Execution

T1218

Msiexec

T1218.007

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e585afd.rbs

Path C:\Config.Msi\e585afd.rbs
Size 144KB
SHA256 20aa21cbe3d2d6cd124ee2eeaf31ccc03712bf2ed5a663cac43d2aa447423dba
MD5 66bac532fc42f641a30f053962c90afc
SHA1 c9c3a0d779dd3e934b0016b663a48af72ffdc380
SHA512 eab7731cbde0904754e741e6f6aee2c80a95de0a0c14ec51df64b30e5e7bdfa4f1a0c37a9216e10a32d313a2b91364ea6025152fc35af514be337afd2bf2d748
SSDEEP 1536:vi7vGI7BNvGVKytG7cWsxFh8SEid7DT46lU:45UG7e6p
TLSH
T1BEE3EFB752F5B7778D28457B72E3F43C85A40DAACA1D2B091138443F25D26EB7EC6A08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

D3DCompiler_47.dll

Path C:\Users\Admin\AppData\Local\MegaSuitelyTechMaxx\D3DCompiler_47.dll
Size 4.3MB
SHA256 44422e6936dc72b7ac5ed16bb8bcae164b7554513e52efb66a3e942cec328a47
MD5 7641e39b7da4077084d2afe7c31032e0
SHA1 2256644f69435ff2fee76deb04d918083960d1eb
SHA512 8010e1cb17fa18bbf72d8344e1d63ded7cef7be6e7c13434fa6d8e22ce1d58a4d426959bdcb031502d4b145e29cb111af929fcbc66001111fbc6d7a19e8800a5
SSDEEP 49152:aYlc/220PPiMLKam+VMrLi21f4i3jn5ZO3XUDmOZQwVd2uQpN3WsGVUWd55i/jrs:a6KD2Mrdaix4NQnLt
TLSH
T16F267D5677A840A9C27BC178CA574313EBB1781403349BEF55A0C665EF33BD26E3A728
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_100_percent.pak

Path C:\Users\Admin\AppData\Local\MegaSuitelyTechMaxx\chrome_100_percent.pak
Size 123KB
SHA256 f1a935db8236203cbc1dcbb9672d98e0bd2fa514429a3f2f82a26e0eb23a4ff9
MD5 a59ea69d64bf4f748401dc5a46a65854
SHA1 111c4cc792991faf947a33386a5862e3205b0cff
SHA512 12a1d953df00b6464ecc132a6e5b9ec3b301c7b3cefe12cbcad27a496d2d218f89e2087dd01d293d37f29391937fcbad937f7d5cf2a6f303539883e2afe3dacd
SSDEEP 3072:YerKzw9bpxlr+bEfF2DGb0+VvfGGY304F2DExm/KLQ2I:YeKzw9Vh90Gb0OveGe04mExhLY
TLSH
T187C3D0D373F0ED7DCF6756B7A52A41B1ECB302391A92034A469AD8356A27348DDC8393
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_200_percent.pak

Path C:\Users\Admin\AppData\Local\MegaSuitelyTechMaxx\chrome_200_percent.pak
Size 183KB
SHA256 7f9ded50d81c50f9c6ed89591fa621fabbd45cef150c8aabcceb3b7a9de5603b
MD5 1985b8fc603db4d83df72cfaeeac7c50
SHA1 5b02363de1c193827062bfa628261b1ec16bd8cf
SHA512 27e90dd18cbce0e27c70b395895ef60a8d2f2f3c3f2ca38f48b7ecf6b0d5e6fefbe88df7e7c98224222b34ff0fbd60268fdec17440f1055535a79002044c955b
SSDEEP 3072:yDfDQYaEM+9bslr+bEfEfRIGMR+F8fQnYw9pGbXGYoDd+qHqRxmeK/rIM0:6DQYaF+9bMhCWGMRe8InVXYopym74
TLSH
T12E04D1D7A3F49D3CDAB30A77553A01F1ECB6127516A3424A42DBAC347A5678C4CC9293
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ffmpeg.dll

Path C:\Users\Admin\AppData\Local\MegaSuitelyTechMaxx\ffmpeg.dll
Size 2.7MB
SHA256 8653b57b37618f11e358c93aad9dc9ef0193f0288f7e59147194e42b0842b50e
MD5 b34d74a152e1788532b0acfa8cfbdf1e
SHA1 e99e5a26d8b695b57cb1a1bb0d2c032d822d0461
SHA512 06f8def21101d8c899c321b3a445e6838f824d6d6305d569b49fb7ad14a197a57c601a8965c50057e7af1d5414b74dd2c79e2f27a58eedab31b3b36202947dd9
SSDEEP 49152:nSFoiJBtTcoQ9mjUBA6vXH4VjB0kxryYTK8gJ2EDE+oM0iloSa08UHdiVqAy6cTC:ijUBA656ryEpEdiVq4
TLSH
T1DFD59D0BF2A645DDC029C53083AFA233F934394A4725A6EF16A156252F3FFD0667EB05
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

icudtl.dat

Path C:\Users\Admin\AppData\Local\MegaSuitelyTechMaxx\icudtl.dat
Size 9.9MB
SHA256 02db39ba465fc8b7a4cd280732760f29911edde87b331bf7cea7677e94d483e0
MD5 70499b58dc18e7ee1d7452a1d7a8bc6e
SHA1 41c5382f08c6a88670ce73a20c0dcdb3822f19e9
SHA512 a80939e9809bb7d20f00ad685c94d5c182fa729616c975e605abf09afb58376be73a49fefa35b75ed1a284eccf208af7656c8df44c5959df7eaf51367d232dc6
SSDEEP 196608:uUGwSv9AAQnt6liXUxR0rHa93WhlU6t7CLhl:uoKlQnAliXUxR0rHa93WhlU6t+Ln
TLSH
T131A63947A2FB4DC2F9FBAF30D8F452679467BD496E32805A11042F3B5C373A096617A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

en-US.pak

Path C:\Users\Admin\AppData\Local\MegaSuitelyTechMaxx\locales\en-US.pak
Size 85KB
SHA256 ac1cdb4fb4d9fb27a908ed0e24cc9cc2bd885bc3ffba7e08b0b907fd4d1a8c4b
MD5 6bbeeb72daebc3b0cbd9c39e820c87a9
SHA1 bd9ebec2d3fc03a2b27f128cf2660b33a3344f43
SHA512 66944fb1abcc2a7e08e5fd8a2cee53eb9da57653d7880aea226f25879e26379f7d745ebf62a3518378fa503f3a31b3ea3716f49fe4c7db4f4af0228b81b53a10
SSDEEP 1536:MzBh0wu6Y90fYSKD0R4RlQ2trhWMJ5dBxgMSO0JedMVrBHhQYVfD3ggl+C/fpkwG:6hp1YSwhBxgrvQY3ggl+CGwG
TLSH
T1BB835E1BE3C41266099243227F06E3B6AB26D079936311663C6CC16C3777FA982777E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

resources.pak

Path C:\Users\Admin\AppData\Local\MegaSuitelyTechMaxx\resources.pak
Size 4.9MB
SHA256 367467609a389b67600628760c26732fc1a25f563f73263bc2c4bf6eec9033df
MD5 5507bc28022b806ea7a3c3bc65a1c256
SHA1 9f8d3a56fef7374c46cd3557f73855d585692b54
SHA512 ae698d4feacc3e908981ee44df3a9d76e42a39bf083eaf099442ace2b863f882b43232e26e2c18051ca7aec81dccef5742acc7b82fb0cda2e14086b14d5a9a26
SSDEEP 98304:1jMQZikLH2tMPwSGBNumogFJlFlh1wTJntwyqWBsCiLeD8crwrb:tMqimHmGfgfhyTh8YsCi6Qckrb
TLSH
T1FB362302F2E4283BC6DB31766C6BA161B73444471068BD2E7A9D52DCAF5492802FEFF5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index.js

Path C:\Users\Admin\AppData\Local\MegaSuitelyTechMaxx\resources\app\index.js
Size 240KB
SHA256 176f28d4929e80b0039851d31297cc3db98cfc2813216ecda880d7dc63668618
MD5 54e9cc07b1bf0158f749a741a23921fa
SHA1 d811807a19ae6d733b9cd902e700f7d836862b77
SHA512 26204d6fe601cf916d30cf3f984a8ab272a422f3b5bc99c65fee7bc56a8302e0e45a98dcfa9165ef19286c3ea8cd89a377b250726dea3ab2e56b430b13f325d9
SSDEEP 3072:/hprLsKuviSpbMECceMtJmCC4j9X1aQllVO1V:/hprLs7viShChMtVC4j9FU7
TLSH
T1303495843BCAA0D2421935F1063F3615B56E4D627A0CCA88D7FAB49EFDB930594B7E34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

license

Path C:\Users\Admin\AppData\Local\MegaSuitelyTechMaxx\resources\app\node_modules\file-type\license
Size 1KB
SHA256 5c932d88256b4ab958f64a856fa48e8bd1f55bc1d96b8149c65689e0c61789d3
MD5 d5f2a6dd0192dcc7c833e50bb9017337
SHA1 80674912e3033be358331910ba27d5812369c2fc
SHA512 d1f336ff272bc6b96dc9a04a7d0ef8f02936dd594f514060340478ee575fe01d55fc7a174df5814a4faf72c8462b012998eca7bb898e3f9a3e87205fb9135af2
TLSH
T18221931E7254136318BA13A0696A6CC4B32BB11F7DAF6B8418ADF244233B46CD4FB840
MD5 SHA1 SHA512 TLSH

Submit Download

license

Path C:\Users\Admin\AppData\Local\MegaSuitelyTechMaxx\resources\app\node_modules\normalize-url\license
Size 1KB
SHA256 48da2f39e100d4085767e94966b43f4fa95ff6a0698fba57ed460914e35f94a0
MD5 915042b5df33c31a6db2b37eadaa00e3
SHA1 5aaf48196ddd4d007a3067aa7f30303ca8e4b29c
SHA512 9c8b2def76ae5ffe4d636166bf9635d7abd69cdac4bf819a2145f7969646d39ae95c96364bc117f9fa544b98518c294233455d4f665af430c75d70798dd4ab13
TLSH
T1EC11931D7254136318BA13A069696CC4B32BB11F79AF6B8418AEF244233B46CD4FB840
MD5 SHA1 SHA512 TLSH

Submit Download

package.json

Path C:\Users\Admin\AppData\Local\MegaSuitelyTechMaxx\resources\app\package.json
Size 326B
SHA256 ed559a3a3027667ce6302f1debaed9aef5bef1c6d4236ec4da01199b398f78b2
MD5 48f234e36eba960bf0f66519a219e17e
SHA1 988d574c95e613f177e81417c590540f77ed9845
SHA512 08ac57c789dd209ceebdc73d5ee709ee141811f0955b982454c3459eeac9353eec08aac68646d18c55a181a1f5f64f56fcbebe203597dabef54f2deb40e5e276
TLSH
T128E08C18DC499E23129B888A3068014728612C079959F80DB79E930C1E5C96FB2FCAAD
MD5 SHA1 SHA512 TLSH

Submit Download

libegl.dll

Path C:\Users\Admin\AppData\Local\MegaSuitelyTechMaxx\swiftshader\libegl.dll
Size 458KB
SHA256 bfd1d3fb9e50a3d9a58d9c62663fbf46bedcac24744020b801c9bb4cdc55f977
MD5 21a07ee229edc5d8de61de97f1a65210
SHA1 a60f93adbad349e25cca0eca5a81c78fbf24f133
SHA512 6375d8bda8cc187f79f6ea0cfd8358ac0d85508327f44d0bbcca641a934fa2b690933eb1ab588821a2f63f6615b1926aa433bc759b787015170aff11e633d0e4
SSDEEP 6144:e6txlbRay7iVeTIM4gkZ8A9YfCmpmXZvrpeK8MbhGG+gwLuggcAgAeG4:ePZ4IM4u7BmXZXGuTcAD
TLSH
T13CA47C16B7A504A9D036C4348A574A43DA71B8DA0F74EBEF0294A27D2F7B7E05F39324
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libglesv2.dll

Path C:\Users\Admin\AppData\Local\MegaSuitelyTechMaxx\swiftshader\libglesv2.dll
Size 3.1MB
SHA256 54b6e787450bfcebed843ad1dafb31ca0904a908131d1005b567513ee8e2db46
MD5 07a0f70d8e06fcb7e9063f39c0ab8c68
SHA1 896f3401b019c31ab1de2a376a66829daceccadb
SHA512 f58e4b23eca4aa4eef435288fc4d3740ea700debe82e083167a68df709c383f8bb7393ee74558acae8804ed105536ac86c5657912a98d284a1fc57dcf25586ff
SSDEEP 49152:cgnhCIFndJN3alVO7hUADGoJJ5AtyPzaaujA84dvCilHS4E0JhHHRBHpJbftopLw:TYIFnXoLfauC1DeFR
TLSH
T1EFE55A43E08880D9E05DD5BC874BA62EE132BC856B7272DF12946B222E77BF0573DB54
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

v8_context_snapshot.bin

Path C:\Users\Admin\AppData\Local\MegaSuitelyTechMaxx\v8_context_snapshot.bin
Size 160KB
SHA256 31c3aa5645b5487bf484fd910379003786523f3063e946ef9b50d257d0ee5790
MD5 b64c1fc7d75234994012c86dc5af10a6
SHA1 d0d562b5735d28381d59d0d86078ff6b493a678e
SHA512 6218fcb74ef715030a2dd718c87b32f41e976dd4ce459c54a45341ee0f5ca5c927ad507d3afcffe7298b989e969885ed7fb72030ea59387609e8bd5c4b8eb60a
SSDEEP 3072:pBgpuz1xV9mRTUAnPH5lZw15qCy0CmiRNiA0hTBAzZs7q/JBXTPv:p4O1xoTPyqIRhTBAzZs7kJ1TPv
TLSH
T1F2F3121427D0829096ED4094A25B06E7C5D26C6D1E2CFF0A3BB5FD4C0AA3DCE55FE1B8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

daemon.log

Path C:\Users\Admin\AppData\Roaming\daemon.log
Size 8B
SHA256 56eea17e3d0389e4ff661c41ecfbf05d691b291bfd6bb2418ab4275fc5b48dea
MD5 fbb249c561faf06d8bd244038f05c93f
SHA1 85b8433a3bcaf05bd58a58efbdaeee84e97b821b
SHA512 44ace1a9d7f954f370c400c7ffab0e2f6a81407b2f5c67e6cd04b29aad4512ab0395f361906d780025d9fd2c4fb2567f0901a52f72823f3968d4b51026ca0ff0
MD5 SHA1 SHA512

Submit Download

metadata-2

Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
Size 24.6MB
SHA256 9e73243a76e254aa0e496dc1d2c9e737c000277211859ef8b03a963a5c4a7030
MD5 209d22b73522ce6edf8b5165c074513a
SHA1 23cf5b598f802006febd9252e925ef3ac2cef29e
SHA512 8519330b7f8661ca38e1a3008c4f46456e713ff9a8bd4c4e6162b32812538a9753d695826329b1af89b76cbc5b647d569c2bd08878544e512ef1337d3bb32270
SSDEEP 24576:J2gmSp1+doO/vvTL3WcexEH6f653QIY222/t3pksV3aY0g4JoXt77Bm7B:O
TLSH
T18B47062436F92150E7F39E3CA8F4AA235A397D579C19DE8D05811B8D0921FB0E872F5B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{817d3487-c1bb-49d7-a48b-f9a5e41cfe4c}_OnDiskSnapshotProp

Path \??\Volume{a56ea927-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{817d3487-c1bb-49d7-a48b-f9a5e41cfe4c}_OnDiskSnapshotProp
Size 6KB
SHA256 1021b129ee702307ebe5a5d3ee9fc959871bfb3d3b66f1c7c69dbae3bc8186c3
MD5 6706c8269a1c4d60bab7841e01c2151b
SHA1 6001c7da366cf7d094429ab2d9f5a71b2200cc47
SHA512 b6cdd18d1d3446cebf6b11ab8c9b8e64d68a3240d5db5666bba8bc4f3677183be073e71986cbbf5f15649e092cc3865c9367890e7c37338ec2bdfbf02d79852a
SSDEEP 96:Fw6O1Gvc8DD84LTHzbOHXOHBlBRQ88Sc9XE56tOSVQpuN:bbb++ZVmN
TLSH
T195D189085AE54711E2F3AB3229F18557A877B911EF33CB8E0198638E6670910F876F5F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1716-626-0x00007FFD03DA0000-0x00007FFD03DA1000-memory.dmp

Download

memory/1716-653-0x000002E01D640000-0x000002E01D669000-memory.dmp

Download

memory/3472-652-0x0000015D64940000-0x0000015D64D14000-memory.dmp

Download

memory/3472-664-0x0000015D64940000-0x0000015D64D14000-memory.dmp

Download

memory/3472-695-0x0000015D64940000-0x0000015D64D14000-memory.dmp

Download

memory/3472-698-0x0000015D64940000-0x0000015D64D14000-memory.dmp

Download

memory/3472-701-0x0000015D64940000-0x0000015D64D14000-memory.dmp

Download

memory/3472-737-0x0000015D64940000-0x0000015D64D14000-memory.dmp

Download

memory/3888-654-0x000001FCEE820000-0x000001FCEE849000-memory.dmp

Download