2b462d51032bd76e4f2f9498546e1f18e1510af71231dabf34ac3d5b40a4743c

Analysis

max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
03/08/2026, 12:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
zoom.us.invite.msi
Size 6.8MB
Sample260803-pghbsshc86
SHA256 2b462d51032bd76e4f2f9498546e1f18e1510af71231dabf34ac3d5b40a4743c
MD5 4b4c09ecdcef26e6ba014c50162343fb
SHA1 408e55ecafaa2691cd9f5567256dcdec53c7b711
SHA512 eff40fb337cb5bdc657ce9c02ef3116679a50243811efc1ec8b6ee1ef7fb2e75e603069e4265a3aec3cc4578a3fa8e98734b9e0dfdc53d89616dc09a472c7ec6
SSDEEP 98304:lqkMMwpD74kF+tyzKgQY0VUKOAj45vvC0eiWctSTNQaJu61VpLpZqtyra4V9eFvt:lvlc4kF+sKgQY3i85vV5tyNJu6BNow3
TLSH
T178761221B58E8C35D69A353076359EBEDA38BC345B948BCB938339ED19312C092FD752
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence privilege_escalation ransomware

Malware Config

Signatures

Executes dropped EXE 3 IoCs

pid	Process
3336	action1_agent.exe
4524	action1_agent.exe
3528	action1_agent.exe

Loads dropped DLL 8 IoCs

pid	Process
544	MsiExec.exe
544	MsiExec.exe
544	MsiExec.exe
4940	MsiExec.exe
1960	MsiExec.exe
1960	MsiExec.exe
1960	MsiExec.exe
1960	MsiExec.exe

Badlisted process makes network request 7 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
4	2100	msiexec.exe
6	2100	msiexec.exe
8	2100	msiexec.exe
16	2100	msiexec.exe
20	2100	msiexec.exe
22	2100	msiexec.exe
33	2100	msiexec.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe

Drops file in System32 directory 14 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_93702E680A5530C052C8D2BA33A2225F	action1_agent.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content	action1_agent.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3AA0DCD5A74331FBD6F344550EC48B87_FAB5A9F6C6BE3394975FF948CA40CA87	action1_agent.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft	action1_agent.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache	action1_agent.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData	action1_agent.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B2FAF7692FD9FFBD64EDE317E42334BA_93702E680A5530C052C8D2BA33A2225F	action1_agent.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3AA0DCD5A74331FBD6F344550EC48B87_FAB5A9F6C6BE3394975FF948CA40CA87	action1_agent.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache	powershell.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Action1\7971f918-a847-4430-9279-4a52d1efe18d	powershell.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\{400F3B96-927E-476D-860A-3C97BC860ADF}\ProductIcon	msiexec.exe
File opened for modification	C:\Windows\Action1\logs\agent_install_1785759562.log	msiexec.exe
File opened for modification	C:\Windows\Action1\7z.dll	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI2ECD.tmp	msiexec.exe
File opened for modification	C:\Windows\Action1\action1_agent.exe.update_state	action1_agent.exe
File created	C:\Windows\Installer\e58ce9a.msi	msiexec.exe
File created	C:\Windows\Action1\rule_data\1008.suppress	action1_agent.exe
File opened for modification	C:\Windows\Installer\MSID127.tmp	msiexec.exe
File created	C:\Windows\Installer\wix{400F3B96-927E-476D-860A-3C97BC860ADF}.SchedServiceConfig.rmi	MsiExec.exe
File opened for modification	C:\Windows\Action1\action1_remote.exe	msiexec.exe
File opened for modification	C:\Windows\Action1\sas.dll	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\69B3F004E729D67468A0C379CB68A0FD\5.255.658\action1_remote_exe	msiexec.exe
File created	C:\Windows\Action1\action1_agent.exe.instance_lock	action1_agent.exe
File created	C:\Windows\Action1\sas.dll	msiexec.exe
File created	C:\Windows\Action1\action1_agent.exe.instance_lock	action1_agent.exe
File created	C:\Windows\Installer\{400F3B96-927E-476D-860A-3C97BC860ADF}\ProductIcon	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\69B3F004E729D67468A0C379CB68A0FD\CacheSize.txt	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\69B3F004E729D67468A0C379CB68A0FD\CacheSize.txt	msiexec.exe
File created	C:\Windows\Action1\datasource_data\1000.poll.tmp	action1_agent.exe
File opened for modification	C:\Windows\Installer\MSI3083.tmp	msiexec.exe
File created	C:\Windows\Action1\action1_agent.exe.connection	action1_agent.exe
File created	C:\Windows\Action1\action1_agent.msi	action1_agent.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\69B3F004E729D67468A0C379CB68A0FD	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI3653.tmp	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\Action1\action1_agent.exe	msiexec.exe
File opened for modification	C:\Windows\Action1\action1_agent.exe.update_state	action1_agent.exe
File opened for modification	C:\Windows\Action1\logs\action1_log_2026-08-03_13-19-25~4524.log	action1_agent.exe
File opened for modification	C:\Windows\Action1\action1_agent.exe.connection	action1_agent.exe
File created	C:\Windows\Action1\advanced_settings.json.tmp	action1_agent.exe
File created	C:\Windows\Action1\previousUser.txt	powershell.exe
File opened for modification	C:\Windows\Action1\logs\action1_log_2026-08-03_13-19-00~3336.log	action1_agent.exe
File created	C:\Windows\Installer\e58ce8a.msi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{E6D8B066-2E74-458F-9111-24857C1C627A}	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\69B3F004E729D67468A0C379CB68A0FD\5.255.658\main_service_exe	msiexec.exe
File created	C:\Windows\Installer\wix{E6D8B066-2E74-458F-9111-24857C1C627A}.SchedServiceConfig.rmi	MsiExec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\MSID8BC.tmp	msiexec.exe
File opened for modification	C:\Windows\Action1\action1_agent.exe	msiexec.exe
File created	C:\Windows\Installer\e58ce86.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI39E0.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\{E6D8B066-2E74-458F-9111-24857C1C627A}\ProductIcon	msiexec.exe
File created	C:\Windows\Action1\rule_data\1000.suppress	action1_agent.exe
File created	C:\Windows\Action1\agent_downgrade.version_pair.tmp	action1_agent.exe
File created	C:\Windows\Action1\logs\agent_install_1785759562.log	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI3111.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\69B3F004E729D67468A0C379CB68A0FD\5.255.658	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\69B3F004E729D67468A0C379CB68A0FD\5.255.658\action1_remote_exe	msiexec.exe
File created	C:\Windows\Action1\schedule.json	action1_agent.exe
File created	C:\Windows\Action1\datasource_data\1008.poll.tmp	action1_agent.exe
File opened for modification	C:\Windows\Installer\MSID1E3.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSID5EC.tmp	msiexec.exe
File created	C:\Windows\Installer\e58ce89.msi	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\69B3F004E729D67468A0C379CB68A0FD\5.255.658\main_service_exe	msiexec.exe
File created	C:\Windows\Installer\{E6D8B066-2E74-458F-9111-24857C1C627A}\ProductIcon	msiexec.exe
File created	C:\Windows\Action1\rules.json	action1_agent.exe
File opened for modification	C:\Windows\Installer\MSID82F.tmp	msiexec.exe
File created	C:\Windows\Action1\first_install.tmp	action1_agent.exe
File created	C:\Windows\Action1\what_is_this.txt	action1_agent.exe
File opened for modification	C:\Windows\Installer\MSICFCE.tmp	msiexec.exe
File opened for modification	C:\Windows\Action1\action1_agent.msi	action1_agent.exe
File opened for modification	C:\Windows\Installer\e58ce86.msi	msiexec.exe
File created	C:\Windows\Action1\installer_cache\action1_agent_6.0.msi	action1_agent.exe
File opened for modification	C:\Windows\Installer\e58ce8a.msi	msiexec.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
3844	powershell.exe
2676	powershell.exe
3428	powershell.exe
1880	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs

persistence privilege_escalation

Installer Packages

T1546.016

Msiexec

T1218.007

pid	Process
2100	msiexec.exe

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	action1_agent.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	action1_agent.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	action1_agent.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000aea20acdcfb7d9ac0000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000aea20acd0000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed35000000ffffffff000000000700010000680900aea20acd000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff350000000000000005000000ffffffff000000000700010000f8ff1aaea20acd000000000000f0ff350000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1daea20acd000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\Owner = ac060000c7615f2c4223dd01	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CProgram Files%5CWindowsApps%5CMicrosoft.WindowsSoundRecorder_10.1906.1972.0_x64__8wekyb3d8bbwe%5Cresources.pri	action1_agent.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CProgram Files%5CWindowsApps%5CMicrosoft.XboxIdentityProvider_12.50.6001.0_x64__8wekyb3d8bbwe%5Cresources.pri\1d5ace4be88d553\a37dfe62\@{C:\Program Files\WindowsApps\Microsoft.XboxIdentit = "Xbox Identity Provider"	action1_agent.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CProgram Files%5CWindowsApps%5CMicrosoft.XboxSpeechToTextOverlay_1.17.29001.0_x64__8wekyb3d8bbwe%5Cresources.pri\1d5ace4af3663bb\a37dfe62\@{C:\Program Files\WindowsApps\Microsoft.XboxSpee = "Xbox Game Speech Window"	action1_agent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	action1_agent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	action1_agent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2c\52C64B7E	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CProgram Files%5CWindowsApps%5CMicrosoft.YourPhone_0.19051.7.0_x64__8wekyb3d8bbwe%5Cresources.pri	action1_agent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28\52C64B7E\@%SystemRoot%\system32\dnsapi.dll,-103 = "Domain Name System (DNS) Server Trust"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CProgram Files%5CWindowsApps%5CMicrosoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe%5Cresources.pri	action1_agent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	action1_agent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	action1_agent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2c\52C64B7E\@%SystemRoot%\System32\wuaueng.dll,-400 = "Windows Update"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2d\52C64B7E\@%SystemRoot%\System32\ci.dll,-100 = "Isolated User Mode (IUM)"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	action1_agent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	action1_agent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	action1_agent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2d\52C64B7E\@%SystemRoot%\System32\fveui.dll,-844 = "BitLocker Data Recovery Agent"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2c\52C64B7E\@%SystemRoot%\system32\dnsapi.dll,-103 = "Domain Name System (DNS) Server Trust"	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CProgram Files%5CWindowsApps%5CMicrosoft.WebMediaExtensions_1.0.20875.0_x64__8wekyb3d8bbwe%5Cresources.pri\1d5ace4e498ca1a\a37dfe62\@{C:\Program Files\WindowsApps\Microsoft.WebMediaExtens = "Web Media Extensions"	action1_agent.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CProgram Files%5CWindowsApps%5CMicrosoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe%5Cresources.pri\1d5ace48ea9bf97\a37dfe62\@{C:\Program Files\WindowsApps\Microsoft.WindowsFeedb = "Feedback Hub"	action1_agent.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28\52C64B7E\@%SystemRoot%\System32\ci.dll,-100 = "Isolated User Mode (IUM)"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28\52C64B7E\@%SystemRoot%\system32\WindowsPowerShell\v1.0\powershell.exe,-124 = "Document Encryption"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2b	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe

Modifies registry class 46 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\660B8D6E47E2F85419114258C7C126A7\A1_Agent	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\69B3F004E729D67468A0C379CB68A0FD	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\69B3F004E729D67468A0C379CB68A0FD\PackageCode = "6BC2EE3040FE4E941998F5E3128E621C"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\69B3F004E729D67468A0C379CB68A0FD\Language = "1033"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\69B3F004E729D67468A0C379CB68A0FD\InstanceType = "0"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\69B3F004E729D67468A0C379CB68A0FD\Clients = 3a0000000000	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\660B8D6E47E2F85419114258C7C126A7\Assignment = "1"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\660B8D6E47E2F85419114258C7C126A7\ProductIcon = "C:\\Windows\\Installer\\{E6D8B066-2E74-458F-9111-24857C1C627A}\\ProductIcon"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\69B3F004E729D67468A0C379CB68A0FD\A1_Agent	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\69B3F004E729D67468A0C379CB68A0FD	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\3187685C39AD9D04484F43F57B7D8C2B\69B3F004E729D67468A0C379CB68A0FD	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\69B3F004E729D67468A0C379CB68A0FD\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\660B8D6E47E2F85419114258C7C126A7\Version = "100663960"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\660B8D6E47E2F85419114258C7C126A7\InstanceType = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\3187685C39AD9D04484F43F57B7D8C2B\660B8D6E47E2F85419114258C7C126A7	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\660B8D6E47E2F85419114258C7C126A7\SourceList\PackageName = "action1_agent_6.0.msi"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\69B3F004E729D67468A0C379CB68A0FD\Version = "100598418"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\69B3F004E729D67468A0C379CB68A0FD\AuthorizedLUAApp = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\69B3F004E729D67468A0C379CB68A0FD\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\660B8D6E47E2F85419114258C7C126A7\ProductName = "Action1 Agent"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\660B8D6E47E2F85419114258C7C126A7\AdvertiseFlags = "388"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\660B8D6E47E2F85419114258C7C126A7\SourceList\Net\1 = "C:\\Windows\\Action1\\installer_cache\\"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\660B8D6E47E2F85419114258C7C126A7\Clients = 3a0000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\660B8D6E47E2F85419114258C7C126A7\SourceList\LastUsedSource = "n;1;C:\\Windows\\Action1\\installer_cache\\"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\69B3F004E729D67468A0C379CB68A0FD\DeploymentFlags = "3"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\69B3F004E729D67468A0C379CB68A0FD\SourceList\PackageName = "zoom.us.invite.msi"	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\69B3F004E729D67468A0C379CB68A0FD\SourceList\Net	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\660B8D6E47E2F85419114258C7C126A7\PackageCode = "919D3E7E9C8C211418ADC39A1BD1B1BF"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\69B3F004E729D67468A0C379CB68A0FD\Assignment = "1"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\3187685C39AD9D04484F43F57B7D8C2B	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\69B3F004E729D67468A0C379CB68A0FD	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\660B8D6E47E2F85419114258C7C126A7	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\660B8D6E47E2F85419114258C7C126A7\SourceList	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\660B8D6E47E2F85419114258C7C126A7\SourceList\Net	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\69B3F004E729D67468A0C379CB68A0FD\SourceList	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\660B8D6E47E2F85419114258C7C126A7	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\660B8D6E47E2F85419114258C7C126A7\AuthorizedLUAApp = "0"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\660B8D6E47E2F85419114258C7C126A7\DeploymentFlags = "3"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\69B3F004E729D67468A0C379CB68A0FD\ProductName = "Action1 Agent"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\69B3F004E729D67468A0C379CB68A0FD\AdvertiseFlags = "388"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\69B3F004E729D67468A0C379CB68A0FD\ProductIcon = "C:\\Windows\\Installer\\{400F3B96-927E-476D-860A-3C97BC860ADF}\\ProductIcon"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\69B3F004E729D67468A0C379CB68A0FD\SourceList\Net	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\69B3F004E729D67468A0C379CB68A0FD\SourceList	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\69B3F004E729D67468A0C379CB68A0FD	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\3187685C39AD9D04484F43F57B7D8C2B	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\660B8D6E47E2F85419114258C7C126A7\Language = "1033"	msiexec.exe

Suspicious behavior: EnumeratesProcesses 26 IoCs

pid	Process
1708	msiexec.exe
1708	msiexec.exe
3844	powershell.exe
3844	powershell.exe
3844	powershell.exe
1708	msiexec.exe
1708	msiexec.exe
1708	msiexec.exe
1708	msiexec.exe
1708	msiexec.exe
1708	msiexec.exe
1708	msiexec.exe
1708	msiexec.exe
1708	msiexec.exe
1708	msiexec.exe
1708	msiexec.exe
1708	msiexec.exe
2676	powershell.exe
2676	powershell.exe
3428	powershell.exe
3428	powershell.exe
1880	powershell.exe
1880	powershell.exe
1880	powershell.exe
1880	powershell.exe
1880	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2100	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2100	msiexec.exe
Token: SeSecurityPrivilege	1708	msiexec.exe
Token: SeCreateTokenPrivilege	2100	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	2100	msiexec.exe
Token: SeLockMemoryPrivilege	2100	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2100	msiexec.exe
Token: SeMachineAccountPrivilege	2100	msiexec.exe
Token: SeTcbPrivilege	2100	msiexec.exe
Token: SeSecurityPrivilege	2100	msiexec.exe
Token: SeTakeOwnershipPrivilege	2100	msiexec.exe
Token: SeLoadDriverPrivilege	2100	msiexec.exe
Token: SeSystemProfilePrivilege	2100	msiexec.exe
Token: SeSystemtimePrivilege	2100	msiexec.exe
Token: SeProfSingleProcessPrivilege	2100	msiexec.exe
Token: SeIncBasePriorityPrivilege	2100	msiexec.exe
Token: SeCreatePagefilePrivilege	2100	msiexec.exe
Token: SeCreatePermanentPrivilege	2100	msiexec.exe
Token: SeBackupPrivilege	2100	msiexec.exe
Token: SeRestorePrivilege	2100	msiexec.exe
Token: SeShutdownPrivilege	2100	msiexec.exe
Token: SeDebugPrivilege	2100	msiexec.exe
Token: SeAuditPrivilege	2100	msiexec.exe
Token: SeSystemEnvironmentPrivilege	2100	msiexec.exe
Token: SeChangeNotifyPrivilege	2100	msiexec.exe
Token: SeRemoteShutdownPrivilege	2100	msiexec.exe
Token: SeUndockPrivilege	2100	msiexec.exe
Token: SeSyncAgentPrivilege	2100	msiexec.exe
Token: SeEnableDelegationPrivilege	2100	msiexec.exe
Token: SeManageVolumePrivilege	2100	msiexec.exe
Token: SeImpersonatePrivilege	2100	msiexec.exe
Token: SeCreateGlobalPrivilege	2100	msiexec.exe
Token: SeBackupPrivilege	5040	vssvc.exe
Token: SeRestorePrivilege	5040	vssvc.exe
Token: SeAuditPrivilege	5040	vssvc.exe
Token: SeBackupPrivilege	1708	msiexec.exe
Token: SeRestorePrivilege	1708	msiexec.exe
Token: SeRestorePrivilege	1708	msiexec.exe
Token: SeTakeOwnershipPrivilege	1708	msiexec.exe
Token: SeRestorePrivilege	1708	msiexec.exe
Token: SeTakeOwnershipPrivilege	1708	msiexec.exe
Token: SeRestorePrivilege	1708	msiexec.exe
Token: SeTakeOwnershipPrivilege	1708	msiexec.exe
Token: SeBackupPrivilege	976	srtasks.exe
Token: SeRestorePrivilege	976	srtasks.exe
Token: SeSecurityPrivilege	976	srtasks.exe
Token: SeTakeOwnershipPrivilege	976	srtasks.exe
Token: SeRestorePrivilege	1708	msiexec.exe
Token: SeTakeOwnershipPrivilege	1708	msiexec.exe
Token: SeBackupPrivilege	976	srtasks.exe
Token: SeRestorePrivilege	976	srtasks.exe
Token: SeSecurityPrivilege	976	srtasks.exe
Token: SeTakeOwnershipPrivilege	976	srtasks.exe
Token: SeRestorePrivilege	1708	msiexec.exe
Token: SeTakeOwnershipPrivilege	1708	msiexec.exe
Token: SeRestorePrivilege	1708	msiexec.exe
Token: SeTakeOwnershipPrivilege	1708	msiexec.exe
Token: SeShutdownPrivilege	4940	MsiExec.exe
Token: SeRestorePrivilege	1708	msiexec.exe
Token: SeTakeOwnershipPrivilege	1708	msiexec.exe
Token: SeRestorePrivilege	1708	msiexec.exe
Token: SeTakeOwnershipPrivilege	1708	msiexec.exe
Token: SeDebugPrivilege	3844	powershell.exe
Token: SeBackupPrivilege	3336	action1_agent.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
2100	msiexec.exe
2100	msiexec.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 1708 wrote to memory of 976	1708	msiexec.exe	96
PID 1708 wrote to memory of 544	1708	msiexec.exe	99
PID 1708 wrote to memory of 4940	1708	msiexec.exe	100
PID 3336 wrote to memory of 3844	3336	action1_agent.exe	102
PID 3336 wrote to memory of 4304	3336	action1_agent.exe	105
PID 1708 wrote to memory of 1960	1708	msiexec.exe	106
PID 4524 wrote to memory of 2676	4524	action1_agent.exe	108
PID 4524 wrote to memory of 3428	4524	action1_agent.exe	110
PID 3428 wrote to memory of 3528	3428	powershell.exe	114
PID 4524 wrote to memory of 1880	4524	action1_agent.exe	115

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\zoom.us.invite.msi
1⤵
- Badlisted process makes network request
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2100

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1708
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:976
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 0274D75FFEF1A5E9FD59E64FB034B53A
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:544
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding CDE29300374A40C09D6346A1CF9625F9 E Global\MSI0000
  2⤵
  - Loads dropped DLL
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:4940
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding A9E8937B3708857E086A5122E62547A3 E Global\MSI0000
  2⤵
  - Loads dropped DLL
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  PID:1960

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:5040

C:\Windows\Action1\action1_agent.exe
C:\Windows\Action1\action1_agent.exe service
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3336
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -Command "$ExecutionContext.SessionState.LanguageMode"
  2⤵
  - Drops file in System32 directory
  - Command and Scripting Interpreter: PowerShell
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3844
- C:\Windows\SysWOW64\msiexec.exe
  C:\Windows\system32\msiexec.exe /I "C:\Windows\Action1\installer_cache\action1_agent_6.0.msi" /quiet /qn /norestart /lv* "C:\Windows\Action1\logs\agent_install_1785759562.log" REINSTALLMODE=amus ALLOWDOWNGRADE=1
  2⤵
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  PID:4304

C:\Windows\Action1\action1_agent.exe
C:\Windows\Action1\action1_agent.exe service
1⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:4524
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -Command "$ExecutionContext.SessionState.LanguageMode"
  2⤵
  - Drops file in System32 directory
  - Command and Scripting Interpreter: PowerShell
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:2676
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -Command -
  2⤵
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Command and Scripting Interpreter: PowerShell
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:3428
- - C:\Windows\Action1\action1_agent.exe
    "C:\Windows\Action1\action1_agent.exe" loggedonuser
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:3528
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -Command -
  2⤵
  - Drops file in System32 directory
  - Command and Scripting Interpreter: PowerShell
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:1880

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Event Triggered Execution

T1546

Installer Packages

T1546.016

Privilege Escalation

Event Triggered Execution

T1546

Installer Packages

T1546.016

Defense Evasion

System Binary Proxy Execution

T1218

Msiexec

T1218.007

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e58ce87.rbs

Path C:\Config.Msi\e58ce87.rbs
Size 240KB
SHA256 d5f4f32c2ecf1d6151ba86b34c5ebcb46b61edb02b3493baf1a6d821e768a3a1
MD5 547ecb6aebebbdbf745fde4a594aa9dd
SHA1 a3b07058437ab6c969b03a1669a666f587809e7a
SHA512 5fc499247d1ded367e5665091b41d79b1d57bc0ce6372a3c0c71af3f78e198de8aba39818835319a3fed776ce0b5025a9d1a08e1eef84c85febd03cb3c20aa17
SSDEEP 3072:29MIXiqyhTO8W0iEa8LW0bEC9hvZpC01v+eUKflQnZl+T+J7g6EsNr7wyy/IP3B:29Bqhy8VKU3hvZUy+ppHEsuB/S
TLSH
T159349E217494547EEBFF0832953AD671AE3DF2380B90C56EC384581E5E618C1ABB7B27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e58ce88.rbs

Path C:\Config.Msi\e58ce88.rbs
Size 7KB
SHA256 fa4b1def95332b15fe226c4c762ebfc0b0f8096d21118fdd8df73f65e6ae5948
MD5 373bffac563c17c843fef0dc420b26b3
SHA1 04376eae8c90dd3076b63d2c9873480c3cf73598
SHA512 8ca99dc874289af7dc3ba9ce2c7d387b1ad2c07d29db8f9745e42cac7ef6def1fbfbaf93725fcc112ce0813d379048d83ebbc0e4798bfc32efc405c3ca7bee6a
SSDEEP 96:vfHBPeq6l6sHXkU8uf3jgnCsThqC+XkU8uf3jgnC6jD7696fdThqCLH+jV560yGH:vpe1zWCIYWCuOGS4wUfViVpT
TLSH
T1C7E110417B428AD3F9521B38C74717933BB2E2AAAB00635B84DD51309F17B4D1E9729F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e58ce8d.rbs

Path C:\Config.Msi\e58ce8d.rbs
Size 246KB
SHA256 4e753d2081d19f9e22a32464b0388204f9d83e8fe7e45da10d15628af00a975b
MD5 ba72a5e7d9a76f59af6d71f50bd70fa6
SHA1 1728ad36b276d9325df9545b095f2a3556380d91
SHA512 51a59cd8f0bf811431c893c7cc33b5bafd81ce4e8271b3aa4a40927e9b820ee01d50b9ab984f2081d713ec79483f08726857e21429a2631988a0e43126908ffc
SSDEEP 3072:S7gi2XiqyhTO8W0iEa8LW0bEC9hvZpC01v+eUKflQnZl+T+J7g6EsNr7wyy/IP3B:S7Sqhy8VKU3hvZUy+ppHEsuB/S
TLSH
T138349D217494547EEBFF0832953E9671AE3DF2380B50C56EC384981E5E618C1ABB7B27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e58ce94.rbs

Path C:\Config.Msi\e58ce94.rbs
Size 8KB
SHA256 10b0d5a2fc0031ad25b145402c48ccf01cba0cc90a7e3db86a8158178f5bef43
MD5 96cc209d08960fd710410bd3eb7dc937
SHA1 d1af9d185105dcb075766d7c3a4f60355dbef80f
SHA512 dbcb5b045840ff26380d00e5f31d1175332d536c3a79206d3ceafa14e797c69815c02f813a11e672848838b6533fe0e8c1b6ae72912bae39ddc3d36bcac788f4
SSDEEP 96:rfHR64i6fCF8RvFv39SxCL7F8Rvyv39SCjFPUz63696fc6f8CLAVKALEBIYDs3rm:rvRrS3RQSsyDD7WwOOdmuSKA
TLSH
T132024503271687E3EE221A35D25323A33BB3E5B56B01825B90AD5174DF2BB451D831AE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e58ce97.rbf

Path C:\Config.Msi\e58ce97.rbf
Size 3B
SHA256 13bf7b3039c63bf5a50491fa3cfd8eb4e699d1ba1436315aef9cbe5711530354
MD5 21438ef4b9ad4fc266b6129a2f60de29
SHA1 5eb8e2242eeb4f5432beeec8b873f1ab0a6b71fd
SHA512 37436ced85e5cd638973e716d6713257d692f9dd2e1975d5511ae3856a7b3b9f0d9e497315a058b516ab31d652ea9950938c77c1ad435ea8d4b49d73427d1237
MD5 SHA1 SHA512

Submit Download

e58ce98.rbs

Path C:\Config.Msi\e58ce98.rbs
Size 1KB
SHA256 be89c2bb4b174d45f8071403f5de23ec9c3ce31a2c114a40a2c66fdebc077453
MD5 86962bada40295d1f32b7934073282ae
SHA1 425e5229ffac5e62b4cf4849c9bf6b6d116618c5
SHA512 0a0a5dd27a42e9de1fa9dbf453f4edd45c21cfe578462ef11dbe181c1d00dcc855b42e1115a79cb81dffcd9341c848da7ecb285a2f7edb2efeb43acfba15acfc
TLSH
T17B21FD43EB0D96C3F9626F34C74322D33BEB92764E044397149C26285E11B186FAB08E
MD5 SHA1 SHA512 TLSH

Submit Download

e58ce99.rbs

Path C:\Config.Msi\e58ce99.rbs
Size 7KB
SHA256 40c9b6f586456272fffcdfdbbbf698664202d18c37d10089d013619509dabcc1
MD5 6107661b536fe77b0689c455805628da
SHA1 6200b3ef638f15c068bf32e26d5dde1aa7faf480
SHA512 8552c521f59b0eb1a679ca8c7212950263473555e2c81f56eae81bd09a5877e4c443c239fc81bc850f521eb19976464547ffd94a88c28487be6bcf4d82cff16e
SSDEEP 96:ryHtPeFcTv7XkUdAiOliCsThqxBXkUdAiOliC6jZS2dThqxaH+35fyG9tbktqZCa:rkeWfGhI2GhM+YS0/po
TLSH
T1ADE121017A1042F3FA6A0735D7471F9437B2D2DA43102B1B9CCD6670AF6BB892E951CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1D3A6ADE28D2362383293C423AFF660E

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\1D3A6ADE28D2362383293C423AFF660E
Size 751B
SHA256 1a2623a69128048a46f6cee2a0a3ec6953476cc9e94bd721d709188d449158a2
MD5 6ef5bf6c3811d8f2aead24faa33f628a
SHA1 25406cd68e58a5c65f08746d64c480becdb8fd2c
SHA512 8247424b9c913fce4a27566f3def7c442f839cc09dda793df45085e8824cb4eba08ed1d1836c098cc92a94d1cd7cfa3558c9bc68af59c982568233a1a7592253
TLSH
T1B60125D6E66E95723208654E5AC1E4717CF8F5F01AC309E720209A44D901EE5F50049D
MD5 SHA1 SHA512 TLSH

Submit Download

3AA0DCD5A74331FBD6F344550EC48B87_FAB5A9F6C6BE3394975FF948CA40CA87

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3AA0DCD5A74331FBD6F344550EC48B87_FAB5A9F6C6BE3394975FF948CA40CA87
Size 637B
SHA256 52d4a6aa6f06cde9f5c41cb68a301dcba69fc0e1a0baf4f0f78db793459f4ef5
MD5 1d38c0b39a8cc3d407f1f2b3eb6d4af8
SHA1 1bfee1fa48454b7b3d4ce2c80a1027bd389e7da4
SHA512 e4dbb0e86dbb0f4d12fce4cd004ed22eee871bab3ecacd448965c45fb42cc579cbe6916344b3e6a79c3a3e2a814608f21334f0a6fb7121a5a472b94df0d82818
TLSH
T186F00297CC60DA65BC11CC942CC9F446338515B37CE261B73D2D6E110791B1176CE97C
MD5 SHA1 SHA512 TLSH

Submit Download

B2FAF7692FD9FFBD64EDE317E42334BA_93702E680A5530C052C8D2BA33A2225F

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B2FAF7692FD9FFBD64EDE317E42334BA_93702E680A5530C052C8D2BA33A2225F
Size 1KB
SHA256 a0d6ce27684a757d37eab3719f249b191a0479b5e63a1ec2be4bd6779ff85ad4
MD5 c0b4f7a55f44500152fdf5d834e9b66e
SHA1 1d8608e3403296cc60a7685e22ad243d004a0138
SHA512 6e040d6531cf12ec13f9f902c161e3807b781ae8ae96e193e5391c22a7c4c597bc7303548ba8b2465f559829dcc3add5869347466926401a6f23a1196096d289
TLSH
T19C31C6D36EA87831ED088DC4585DCFF27CB025AAF45808743498C56AA9A3FE46C4A81D
MD5 SHA1 SHA512 TLSH

Submit Download

1D3A6ADE28D2362383293C423AFF660E

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\1D3A6ADE28D2362383293C423AFF660E
Size 320B
SHA256 0b264f1a43a0333c3e5ae3a764d3baa824935eef0e2e8d51b55e65e8f1568beb
MD5 c103ee00eaffb9c72bca28a7540dea39
SHA1 cb10d5fa636efdf8b477d46c630c0799b5968a34
SHA512 0320bb9e1efe7d034e49853880c05c46c9a8fbbe188b8d46a82dac01271a48199691f3aacf12b5701289fd4d702e899b085737fa352796017444d04b514a6822
TLSH
T14DE0172447FC560AF1A4467DACF10752FE26FD25BA82C60A5BA2060B2C2AF851C2271B
MD5 SHA1 SHA512 TLSH

Submit Download

3AA0DCD5A74331FBD6F344550EC48B87_FAB5A9F6C6BE3394975FF948CA40CA87

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3AA0DCD5A74331FBD6F344550EC48B87_FAB5A9F6C6BE3394975FF948CA40CA87
Size 488B
SHA256 67fe94dcb9323b66c847b71e7f4be6987a5beaa7ee3d0ecc26454210766f5617
MD5 a823eeb7e55c21eb245489b702323148
SHA1 ecba289f13b3df24a154756ac361f6d3f5f5c53b
SHA512 48128886156b3f14bc54731bc64b6b8a47b528f230b643e1c4c6d324b584bb68b391e49598afbd7d49367622ef28e20a0758b3a35cc37436432c81499a151a4b
TLSH
T178F05C2869F6003FE471887A43D8D2C3DC2AF11628000A5C51A11349A6077815DA1DB7
MD5 SHA1 SHA512 TLSH

Submit Download

B2FAF7692FD9FFBD64EDE317E42334BA_93702E680A5530C052C8D2BA33A2225F

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_93702E680A5530C052C8D2BA33A2225F
Size 482B
SHA256 1e70aa556a3845e75878486d904067d7eb81ecb3f0628c1176f32700c4a1d5f6
MD5 3a3570df22e06c70575c85c07ac763bd
SHA1 da460e943cae4f38303c90384a54daa134133649
SHA512 ea58fa686cd9abbfbea7a5c68bae0c20f94506c3de9d6f994a43fe6b17562fed5bebe00034a51923c4f8271dcd783b3760b8ff01e27e620bf6e55cb67e93191b
TLSH
T1F4F0AB282BBA902DE17B9A39CAD5A3275DBDF30568000176075103076F0B6C31E55573
MD5 SHA1 SHA512 TLSH

Submit Download

7z.dll

Path C:\Windows\Action1\7z.dll
Size 1.3MB
SHA256 872a7df979d45605d4247a9925871077ca84ed6cf78769037fb0d94ab788d9b5
MD5 9c0ac3f52e342e752642622eda0a00ca
SHA1 93a7762bb40c5e4c55d26451879510afc72593e1
SHA512 b9468c8996cddc10c4a57924b812d8e0762ebf37fb66f1965c85d6857696e8cb08ec5254b69bf6ca987e42147adfa5f8dae6e6402e9d0a43e5b0ac3f3df146bd
SSDEEP 24576:iNib1WFpYKnzLy1GOjaCMHO0v93Pqt0lamuAsggS2VsAhwRDgfeSh:iNibGpYKiGOjoHO89/18ugSo1d
TLSH
T13F559E11F7F1C074C58E5630862DBBBA50F8E729CA10A9D777C0BE6E6F319D2D225A09
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

action1_agent.exe

Path C:\Windows\Action1\action1_agent.exe
Size 8.9MB
SHA256 f30ed43c6529409197a01e6b80b6438e23e32aba8cad3486dc079e995db0f0aa
MD5 4055067f208a7a00d811017f24bd68c9
SHA1 3391d271ea348ef2321c47a6dc92461bc59cb6fc
SHA512 be64dd0d1ff8fd2e1efbc6bd5536dd9b8fd34e5ca22533b0c8d86a379585e1a5a41f51cfa0493d37e319177215f7c5f4a481dc16e6e69ecaf1164c4917a185d5
SSDEEP 196608:4g1+AFuNTfzFvSKYd1wNd+Eww+2mHNcJ7IVK0UWvMd:4C2FS5y+jFNcJ7t0xvMd
TLSH
T164969D21F6518135F9A701B299BE4B7E852CBE30072855E3C3C858AE5AF15E33B37A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

action1_agent.exe

Path C:\Windows\Action1\action1_agent.exe
Size 8.9MB
SHA256 941695d20d82dd5d62f74b0111feb23720637202f6c797df2a02e2cb6cb6e8e3
MD5 e4f1f52a78f22dd2be17449ca6f8f0af
SHA1 e9f385454fdddc7ae88431b8e02f4dfb7dd57b68
SHA512 2d7ed519a9380e1574bbc55444420334bdd0792c7839a1be67607a4f81be79e52f6c4dd10141079a47dcf61552724c2b3f060f0f670bdea527dc130ba9aebac8
SSDEEP 196608:KV1U3lnchqzhNpxSKyOBE2LeIzfAnOgOZ6aMkElWpRUn:KPoTVQYEseIzflZ6aMZORo
TLSH
T1D9968D21B641C135F9A301B29A7E4B6F853CBE30072555E7D3C858AE5AB19E33B32B17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

action1_agent.exe.connection

Path C:\Windows\Action1\action1_agent.exe.connection
Size 2B
SHA256 565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3
MD5 e0aa021e21dddbd6d8cecec71e9cf564
SHA1 9ce3bd4224c8c1780db56b4125ecf3f24bf748b7
SHA512 900110c951560eff857b440e89cc29f529416e0e3b3d7f0ad51651bfdbd8025b91768c5ed7db5352d1a5523354ce06ced2c42047e33a3e958a1bba5f742db874
MD5 SHA1 SHA512

Submit Download

action1_agent.exe.update_state

Path C:\Windows\Action1\action1_agent.exe.update_state
Size 1B
SHA256 7902699be42c8a8e46fbbb4501726517e86b22c56a189f7625a6da49081b2451
MD5 8f14e45fceea167a5a36dedd4bea2543
SHA1 902ba3cda1883801594b6e1b452790cc53948fda
SHA512 f05210c5b4263f0ec4c3995bdab458d81d3953f354a9109520f159db1e8800bcd45b97c56dce90a1fc27ab03e0b8a9af8673747023c406299374116d6f966981
MD5 SHA1 SHA512

Submit Download

action1_remote.exe

Path C:\Windows\Action1\action1_remote.exe
Size 1.5MB
SHA256 d5d0c44dd03f1952d388d547e6e1ee021978bd1641b5b8ec49d49e8b7d53e909
MD5 e20ba8bf8a8bc3b538c9a3dc73a2f8c3
SHA1 0c765670e1e6886545ed9a0d6d0748ea9201d49c
SHA512 de87cecb201a4cee16372afb82713eab1c9396cea6cc608cedcd4fe6e2508cdfed95f3a95de5d943d25e866b84e05ff48bfd9ab4b29f29460ddc59f46537b22a
SSDEEP 24576:1g1cK0GFkiuX49F8LFNYYgWj5d51z9jCrUPopzFv73OZN0RTve8yOKNmST:1g1cHi+42J1zgrUPUhvVTm8yVN9T
TLSH
T15D757C2133978029E9B213307978D6BA593DBE754FB594CFA3D01AAD5C30AC25B35B23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

advanced_settings.json

Path C:\Windows\Action1\advanced_settings.json
Size 54KB
SHA256 791e94f91d48f38bd18cbc61001edcef2edfbcd49524ce43b3cdd7d6e4fe9aed
MD5 d2cbe9209703c5f42af828ff96dc0a61
SHA1 31a392cfb0a4fbe261664fce345feb8940891828
SHA512 07a18829857253915e5e6803ef013848d76663409d64151ff704270e988fc6b5a6b4e38661f4004b3b78496e3ff089aab13b39f760c68606bce4959b0903de3f
SSDEEP 768:DXKnbhRgjUpQUfRQ3Lyhx48Utsp82qUgw6fCph8uP5K5DIK58EOKWbBoE3a+OQz1:SRoLE6x/+wkMdAe2hMBw
TLSH
T17943AE16E4757DB108C2188C5FDB1AF7DA4E019612D906DE870CEEBF99AF52C8102E9F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

agent_downgrade.version_pair

Path C:\Windows\Action1\agent_downgrade.version_pair
Size 71B
SHA256 74a0de7cf5cb91f0bde4eb93ddebd02f3c9b9580f6d473b4dabe7567395fda70
MD5 b888252f46f29ff633ab113871c1e5e6
SHA1 9266db673557e841266cf1ac39329ca1b21ea439
SHA512 c43ea01c433a58dd2c3d3adb1b4fccb112bb681eb259fe5bd2625a610e6c64050b3087b56c0d0b5675dfd042ab747f8eb2c065268d284665386af29e98e90756
TLSH
T1B1A022203200023320E38B00283332800B2C0082EF28CC2C808C0880020C38233CCB00
MD5 SHA1 SHA512 TLSH

Submit Download

first_install

Path C:\Windows\Action1\first_install
Size 50B
SHA256 04fd07a14659ab6a68437093f676d36bb159d46fc082212e1701cbd63ceb3fce
MD5 d900b7e754f28d69ee4784df0241f6ab
SHA1 772417cf48000561c43b9efc11b1e32a2489a091
SHA512 e028e76db585d1d2091d5edb5ffe78bbb2cdee021655b3efeed33d00f914727ebe4ad5cee59942f38fe7e8fa952a3788cc83fefb9b3449225d9927abad61fe65
TLSH
T1169004C170D55FF53C554775D44301D14751F340DC4DC141554D07C50411013115F571
MD5 SHA1 SHA512 TLSH

Submit Download

action1_agent_6.0.msi

Path C:\Windows\Action1\installer_cache\action1_agent_6.0.msi
Size 6.8MB
SHA256 4d5dc04c53e0ef25138e13559984491dce66e6661f0daf0705e3d425fc772a1c
MD5 1593362c252a5f704e8aba9a82da1205
SHA1 54c45523e5e8e124d129fc9c9d553cffa86feee8
SHA512 0ac6f43d686a7a60268a09bd1af6775dd144f67620009ee821f6e3ea6d49c731a8eae1608693ff6ec48df217cf397a757d725c65b0560a04a3419d3eb0964b0a
SSDEEP 98304:vkMMwpD74pOTxPjLHLgk92Rdxmk69pa5SUOsFekLS57JkmPMETphToy0seQvsm:slc4pkbLHLhObmXe/kdkmPDTs
TLSH
T1DF761221754E8C76C5AA363071769E7DDA7CBC305BA08BDB938339EE09315C052FDA92
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

agent_install_1785759562.log

Path C:\Windows\Action1\logs\agent_install_1785759562.log
Size 1KB
SHA256 fbed11a8391a0f2acdd947e9d02079fdcfa3da2b789ed3650722a0c4aa496903
MD5 5249fcb2390a962e70737fbc574f6954
SHA1 dcbfd93682d6280fe3cc461007b49cd119b9aac5
SHA512 95e07006841481637e2cc5fbf5c81c59af5a5a77fcf5b0699c5995d1df9dd96464a686fa6fcab3040f3c4b85f06746a4c027bad771bc542c772234b3fb904232
TLSH
T15C31955A1EE90D04F1B39B076AF3D5520E33BDC56934EB4C22C48359166BD09B87C3AB
MD5 SHA1 SHA512 TLSH

Submit Download

sas.dll

Path C:\Windows\Action1\sas.dll
Size 8KB
SHA256 996b01e15f85e165899630721a141b178a9c372b6e878012180ec9e9d4e7bd06
MD5 969d1f85151e0156d51a664e59a50213
SHA1 777735cf24fe880d00a205b5bcc79ca8df8d660b
SHA512 73f9a14d297f7dddc9e3d9b0db6cd4160cd000f31f437ea8add7d95de2f704482fa891996f2df048def3371cc9245a2efa31b2d0647a7cc1e6848db7b809e711
SSDEEP 192:l5UGq/4LYix0kmAEE8O5cTbOVT66o+1WX6wW/:nr5YiWXAjHGOVZP1WX6wW
TLSH
T13C02E60973A8067AE4FF1B76A06EA236462AB6205FF142EF195322D938355D15E307C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSI2ECD.tmp

Path C:\Windows\Installer\MSI2ECD.tmp
Size 387KB
SHA256 ca5f0275e70ec5ba65b74c3da74f489018bc143c4c405fd8bbc6519eadac2a22
MD5 4112820180a36753089ee5c0fdba1538
SHA1 6366de1c2930886892aabf4b8ac55fd0bb4b91bb
SHA512 eac55d5a5c723fb5bd85bdd1ee71a13497d677d2b45e58b6eed2f7e42760d2ba3d07e0cb2b622f7866da8492f8d3fdb02b6288f95b761f5b2e20d2e2098233d3
SSDEEP 6144:ijVmAOn9DqwokBL+097OsOmceIpOaEPbyHiDO9EAFw:CmAOnRokBL17OsONeIshZAFw
TLSH
T18B848D01B542C032D5AE05B0B535EFB5AABDA9704FB468DBB7D40E7B8D302C1A735A1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSICFCE.tmp

Path C:\Windows\Installer\MSICFCE.tmp
Size 385KB
SHA256 23a1c772b870ffcef49e3b3a20d668f11753d3e52c696d787532af0c7eec43ba
MD5 fd5bf1c8ba3e167d8fbd93ad80dec83e
SHA1 dc1adedab432a1a38c938fb790af5adeffe420ac
SHA512 1b6e20beea7ceb6227081ae059ef35a4547a27975cccdfd4f6cdae8bc2e140a32629630de2859cefc5b4aa169713c00b008f62a601c5bf5a376ea0ff14b5d491
SSDEEP 6144:G3wTnFe4be1AgG6VRfex413e2xsflKjic/xWOV8FE:rTnFc1AgG6jfex4pe27/WhFE
TLSH
T143848D11B542C032D5AE05B0B634EFB5AABDA9704FA464DBB7D40E7B8D302C1A735B1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSID1E3.tmp

Path C:\Windows\Installer\MSID1E3.tmp
Size 234KB
SHA256 78860e15e474cc2af7ad6e499a8971b6b8197afb8e49a1b9eaaa392e4378f3a5
MD5 8edc1557e9fc7f25f89ad384d01bcec4
SHA1 98e64d7f92b8254fe3f258e3238b9e0f033b5a9c
SHA512 d26c9dce3c3d17583ffb5dbcd3989f93b096a7f64a37a2701a474c1bf4b8c8b1e922c352d33f24e411f1c793e1b4af11a3aec1de489087d481b1b636df2050cd
SSDEEP 3072:5XiqyhTO8W0iEa8LW0bEC9hvZpC01v+eUKflQnZl+T+J7g6EsNr7wyy/IP3:5qhy8VKU3hvZUy+ppHEsuB/
TLSH
T159348D217494547EEBFF0832953AD671AE3DF2380B90C96EC384581E6D618C1A7B7B27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e58ce86.msi

Path C:\Windows\Installer\e58ce86.msi
Size 6.8MB
SHA256 2b462d51032bd76e4f2f9498546e1f18e1510af71231dabf34ac3d5b40a4743c
MD5 4b4c09ecdcef26e6ba014c50162343fb
SHA1 408e55ecafaa2691cd9f5567256dcdec53c7b711
SHA512 eff40fb337cb5bdc657ce9c02ef3116679a50243811efc1ec8b6ee1ef7fb2e75e603069e4265a3aec3cc4578a3fa8e98734b9e0dfdc53d89616dc09a472c7ec6
SSDEEP 98304:lqkMMwpD74kF+tyzKgQY0VUKOAj45vvC0eiWctSTNQaJu61VpLpZqtyra4V9eFvt:lvlc4kF+sKgQY3i85vV5tyNJu6BNow3
TLSH
T178761221B58E8C35D69A353076359EBEDA38BC345B948BCB938339ED19312C092FD752
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ProductIcon

Path C:\Windows\Installer\{400F3B96-927E-476D-860A-3C97BC860ADF}\ProductIcon
Size 32KB
SHA256 7a214ccfe309e4c0c83f40d9b7c92e3d41206db734401e7227ef10b38064ca9d
MD5 d37f7a439b9527f73e21311db17eaf00
SHA1 d0f34b3c1368f28a419924560c282358703a8d35
SHA512 3c1bcd38ed8d6bff8e071416cda90b0331b50903d9e4c9305bc36f9ccce23cb05424576b066485e76ee17e6fdc493fd25f8776d24b98de9d3941c181bb333569
SSDEEP 96:JnbrlpScW1BwB/vmaOZaxdJVE8BEArPz578SSuQEmgo3/I:JnbrlpScW18Ued/E8f8KQEPo3/I
TLSH
T195E211067007D5DCDE28473CB0B6FCB539728A776EAC23DEF2A4B4E52882465147C6B2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_w2l0zec2.0u5.ps1

Path C:\Windows\Temp\__PSScriptPolicyTest_w2l0zec2.0u5.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

powershell.exe.log

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 8ef7a682dfd99ff5b7e9de0e1be43f0016d68695a43c33c028af2635cc15ecfe
MD5 440cb38dbee06645cc8b74d51f6e5f71
SHA1 d7e61da91dc4502e9ae83281b88c1e48584edb7c
SHA512 3aab19578535e6ba0f6beb5690c87d970292100704209d2dcebddcdd46c6bead27588ef5d98729bfd50606a54cc1edf608b3d15bef42c13b9982aaaf15de7fd6
TLSH
T1A351EE323375B1E888167F071E681A8053BF4355EA94AF1CB698621ED93641B9F222F3
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 64B
SHA256 46e488628e5348c9c4dfcdeed5a91747eae3b3aa49ae1b94d37173b6609efa0e
MD5 50a8221b93fbd2628ac460dd408a9fc1
SHA1 7e99fe16a9b14079b6f0316c37cc473e1f83a7e6
SHA512 27dda53e7edcc1a12c61234e850fe73bf3923f5c3c19826b67f2faf9e0a14ba6658001a9d6a56a7036409feb9238dd452406e88e318919127b4a06c64dba86f0
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 64B
SHA256 a7de5177c68a64bd48b36d49e2853799f4ebcfa8e4761f7cc472f333dc5f65cf
MD5 446dd1cf97eaba21cf14d03aebc79f27
SHA1 36e4cc7367e0c7b40f4a8ace272941ea46373799
SHA512 a6d754709f30b122112ae30e5ab22486393c5021d33da4d1304c061863d2e1e79e8aeb029cae61261bb77d0e7becd53a7b0106d6ea4368b4c302464e3d941cf7
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 726d2b3a5003e478f61d3626a078477d2ce3caa24520bafefc1750edd68ef617
MD5 91bbf1113ed5ee5b5ca394415a183a07
SHA1 c3db7fead075105a6bc6ed8de9b206fd61c69aaf
SHA512 547e90736c71c0990eed9f24e071f4acbcb2d2fa99e0a13f70cb5d564c7ed084e78e631c8795e46778926118da82aec153bb6ab32439cb009a27153e5aeda1e4
TLSH
T16B218627B39C89A1CC86163A109D9C1076B393C7809ECFDF6BC4C600A0BF988CB21290
MD5 SHA1 SHA512 TLSH

Submit Download

metadata-2

Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
Size 24.1MB
SHA256 d76793394b9aabe8a451d5116129fc3d3586740ec54009de029e9b584b6b7f46
MD5 904a1d71fde6f9bb328c1a21c361fd28
SHA1 a66f7c8192f3d9f88584d677592a380b61b1dca0
SHA512 0b2b8a0fad154bc688511d7bb317bf627d6b869eed4097e987c776a6e0402302ea6948add7ac9a5003c67c67f45e163343f6f19c3b8d4933942cdf49a277c815
SSDEEP 24576:ku8m+1zadoO/vvTLLWceJma49F0zEVsCwqmteTtlUU6tOrFhov1Fk63Rp:l
TLSH
T15347C22836F92200F7F79E3D68F46A274D3A7D5B9C159E8D05811B4E0921FB0E872F5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{f9f00e6b-51e8-4246-921b-01ae34c81cbc}_OnDiskSnapshotProp

Path \??\Volume{cd0aa2ae-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{f9f00e6b-51e8-4246-921b-01ae34c81cbc}_OnDiskSnapshotProp
Size 6KB
SHA256 7e0182adee99e66efba03601fa959b197e3bc953c0ba7c6f1594fd85f2bb0c4a
MD5 61f29ccc0e66ae1daa30317a5687cb9d
SHA1 fd272242e252427e57030f047eb0e9ee9c94fdd4
SHA512 bac5e8e0b0f724529105052bb865c16c9252a0a97cf1ecce30648a57a22fce3fffbd7ebe45033b97fda467695d4676a17f92c93c423e8612a25be159196bff4b
SSDEEP 96:FED+ncEsnvc8DD84LTHzbOHXOHBlBRQ88Sc9XE56tOSVQpuN:SDrb++ZVmN
TLSH
T1B6D199085AF54711E2B3AB3229F54557A877B911EF33CB8E0298238E2670A14F935F5F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1880-357-0x0000020D9A440000-0x0000020D9A45C000-memory.dmp

Download

memory/1880-358-0x0000020D9A460000-0x0000020D9A515000-memory.dmp

Download

memory/1880-359-0x0000020D9A520000-0x0000020D9A52A000-memory.dmp

Download

memory/1880-360-0x0000020D9A6A0000-0x0000020D9A6CA000-memory.dmp

Download

memory/1880-361-0x0000020D9A6A0000-0x0000020D9A6C4000-memory.dmp

Download

memory/3844-62-0x000001711C080000-0x000001711C0A2000-memory.dmp

Download