Analysis
- max time kernel
148s - max time network
153s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
03/08/2026, 12:17
Static task
static1
Behavioral task
behavioral1
Sample
zoom.us.invite.msi
Resource
win10v2004-20260513-en
windows10-2004-x64
19 signatures
150 seconds
Behavioral task
behavioral2
Sample
zoom.us.invite.msi
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
18 signatures
150 seconds
General
- Target zoom.us.invite.msi
- Size 6.8MB
- Sample260803-pghbsshc86
- SHA256 2b462d51032bd76e4f2f9498546e1f18e1510af71231dabf34ac3d5b40a4743c
- MD5 4b4c09ecdcef26e6ba014c50162343fb
- SHA1 408e55ecafaa2691cd9f5567256dcdec53c7b711
- SHA512 eff40fb337cb5bdc657ce9c02ef3116679a50243811efc1ec8b6ee1ef7fb2e75e603069e4265a3aec3cc4578a3fa8e98734b9e0dfdc53d89616dc09a472c7ec6
- SSDEEP 98304:lqkMMwpD74kF+tyzKgQY0VUKOAj45vvC0eiWctSTNQaJu61VpLpZqtyra4V9eFvt:lvlc4kF+sKgQY3i85vV5tyNJu6BNow3
- TLSH T178761221B58E8C35D69A353076359EBEDA38BC345B948BCB938339ED19312C092FD752
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 2 IoCs
pid Process 4256 action1_agent.exe 2132 action1_agent.exe - Loads dropped DLL 8 IoCs
pid Process 1052 MsiExec.exe 1052 MsiExec.exe 1052 MsiExec.exe 1044 MsiExec.exe 3104 MsiExec.exe 3104 MsiExec.exe 3104 MsiExec.exe 3104 MsiExec.exe - Badlisted process makes network request 1 IoCs
Network request originating from process or tool commonly abused by malware.
flow pid Process 2 2608 msiexec.exe - Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\D: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\D: msiexec.exe - Drops file in System32 directory 12 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\572BF21E454637C9F000BE1AF9B1E1A9 action1_agent.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\1D3A6ADE28D2362383293C423AFF660E action1_agent.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3AA0DCD5A74331FBD6F344550EC48B87_FAB5A9F6C6BE3394975FF948CA40CA87 action1_agent.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft action1_agent.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\1D3A6ADE28D2362383293C423AFF660E action1_agent.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3AA0DCD5A74331FBD6F344550EC48B87_FAB5A9F6C6BE3394975FF948CA40CA87 action1_agent.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache action1_agent.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData action1_agent.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\572BF21E454637C9F000BE1AF9B1E1A9 action1_agent.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content action1_agent.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\SystemTemp\~DFBCE87D4E5FB2E200.TMP msiexec.exe File created C:\Windows\SystemTemp\~DFA816B795D4A39392.TMP msiexec.exe File created C:\Windows\Installer\SourceHash{400F3B96-927E-476D-860A-3C97BC860ADF} msiexec.exe File opened for modification C:\Windows\Installer\MSI7FE5.tmp msiexec.exe File opened for modification C:\Windows\Action1\7z.dll msiexec.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\69B3F004E729D67468A0C379CB68A0FD\5.255.658\action1_remote_exe msiexec.exe File created C:\Windows\SystemTemp\__PSScriptPolicyTest_droj14q1.gg1.ps1 powershell.exe File created C:\Windows\SystemTemp\~DFB27E839BD5CA13F9.TMP msiexec.exe File created C:\Windows\SystemTemp\~DF3598FEBF21B7F6A1.TMP msiexec.exe File created C:\Windows\SystemTemp\~DFD7EC78C798A11720.TMP msiexec.exe File created C:\Windows\SystemTemp\~DF84AD40F0C52183A4.TMP msiexec.exe File opened for modification C:\Windows\Installer\MSI7DDF.tmp msiexec.exe File created C:\Windows\Action1\7z.dll msiexec.exe File created C:\Windows\Action1\action1_agent.exe.connection action1_agent.exe File created C:\Windows\Installer\SourceHash{E6D8B066-2E74-458F-9111-24857C1C627A} msiexec.exe File created C:\Windows\SystemTemp\~DFC3BFBB3D75F7CBD7.TMP msiexec.exe File created C:\Windows\Installer\$PatchCache$\Managed\69B3F004E729D67468A0C379CB68A0FD\5.255.658\main_service_exe msiexec.exe File opened for modification C:\Windows\Installer\MSI8545.tmp msiexec.exe File created C:\Windows\Installer\$PatchCache$\Managed\69B3F004E729D67468A0C379CB68A0FD\CacheSize.txt msiexec.exe File created C:\Windows\Action1\sas.dll msiexec.exe File created C:\Windows\SystemTemp\__PSScriptPolicyTest_sn3oq5ur.hog.ps1 powershell.exe File opened for modification C:\Windows\Action1\logs\agent_install_1785759602.log msiexec.exe File created C:\Windows\SystemTemp\~DF8F31220532C8D93A.TMP msiexec.exe File opened for modification C:\Windows\Installer\MSI7B0E.tmp msiexec.exe File created C:\Windows\SystemTemp\~DF59DBC71742B02040.TMP msiexec.exe File created C:\Windows\Action1\action1_agent.exe.instance_lock action1_agent.exe File created C:\Windows\SystemTemp\~DF156D0B998B268702.TMP msiexec.exe File opened for modification C:\Windows\Installer\MSI7EEA.tmp msiexec.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\69B3F004E729D67468A0C379CB68A0FD msiexec.exe File opened for modification C:\Windows\Installer\MSI79C7.tmp msiexec.exe File opened for modification C:\Windows\Action1\logs\action1_log_2026-08-03_13-18-58~4256.log action1_agent.exe File created C:\Windows\Action1\first_install.tmp action1_agent.exe File created C:\Windows\Installer\{400F3B96-927E-476D-860A-3C97BC860ADF}\ProductIcon msiexec.exe File created C:\Windows\Action1\action1_agent.exe.update_state action1_agent.exe File created C:\Windows\SystemTemp\~DF88A3555E00AFA951.TMP msiexec.exe File opened for modification C:\Windows\Installer\MSI7DEE.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI782F.tmp msiexec.exe File created C:\Windows\Installer\wix{400F3B96-927E-476D-860A-3C97BC860ADF}.SchedServiceConfig.rmi MsiExec.exe File opened for modification C:\Windows\Action1\action1_agent.exe.update_state action1_agent.exe File opened for modification C:\Windows\Installer\MSI8469.tmp msiexec.exe File created C:\Windows\Installer\wix{E6D8B066-2E74-458F-9111-24857C1C627A}.SchedServiceConfig.rmi MsiExec.exe File created C:\Windows\SystemTemp\~DF414CBB9B70DFDE94.TMP msiexec.exe File created C:\Windows\SystemTemp\__PSScriptPolicyTest_immksasx.cad.psm1 powershell.exe File created C:\Windows\SystemTemp\~DF2C7B52F917F3C87B.TMP msiexec.exe File created C:\Windows\Action1\what_is_this.txt action1_agent.exe File created C:\Windows\Action1\installer_cache\action1_agent_6.0.msi action1_agent.exe File created C:\Windows\Installer\$PatchCache$\Managed\69B3F004E729D67468A0C379CB68A0FD\5.255.658\action1_remote_exe msiexec.exe File created C:\Windows\SystemTemp\~DF625A809F3B95801D.TMP msiexec.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\69B3F004E729D67468A0C379CB68A0FD\CacheSize.txt msiexec.exe File created C:\Windows\SystemTemp\~DF9AF5BA3ADE653B29.TMP msiexec.exe File created C:\Windows\SystemTemp\~DF23AB985661DCC95B.TMP msiexec.exe File created C:\Windows\Action1\logs\agent_install_1785759602.log msiexec.exe File created C:\Windows\SystemTemp\~DFB57CAF1088809E4E.TMP msiexec.exe File created C:\Windows\SystemTemp\~DFC57C0CAAE38A0058.TMP msiexec.exe File opened for modification C:\Windows\Installer\MSI7F28.tmp msiexec.exe File created C:\Windows\SystemTemp\__PSScriptPolicyTest_5cfspgqb.lsg.psm1 powershell.exe File created C:\Windows\Installer\e5a714c.msi msiexec.exe File opened for modification C:\Windows\Action1\action1_remote.exe msiexec.exe File opened for modification C:\Windows\Action1\logs\action1_log_2026-08-03_13-20-05~2132.log action1_agent.exe File opened for modification C:\Windows\Action1\what_is_this.txt action1_agent.exe File created C:\Windows\Action1\action1_remote.exe msiexec.exe File opened for modification C:\Windows\Installer\{400F3B96-927E-476D-860A-3C97BC860ADF}\ProductIcon msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe -
pid Process 4500 powershell.exe 1088 powershell.exe - Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
pid Process 2608 msiexec.exe - System Location Discovery: System Language Discovery 1 TTPs 6 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language action1_agent.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language action1_agent.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language msiexec.exe - Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 000000000400000067831fc6f5c7bf350000000000000000000000000000000000000000000000000000000000000000000000000000000000001071020000000000c012000000000000000000000000270101000088380167831fc60000000000001071020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d0830200000000006025c501000000000000000000000700010000e8410167831fc6000000000000d08302000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9c701000000000000050000000000000000000000070001000098d4e367831fc600000000000030a9c7010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9cc0100000000000005000000000000000000000007000100009854e667831fc600000000000030a9cc01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe - Modifies data under HKEY_USERS 64 IoCs
description ioc Process Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\SessionHash = 9da0d0f89560df30b8a24f0fa0ca3e37f42d94802f38f087d0b3d39697d54cdb msiexec.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0001\SessionHash = 08188b7496e8a12fc74ba77d3bd318e0e07c1935016d07999547a7ba79170ae8 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs action1_agent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2c\52C64B7E\@%SystemRoot%\system32\WindowsPowerShell\v1.0\powershell.exe,-124 = "Document Encryption" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA action1_agent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2c\52C64B7E\@%SystemRoot%\system32\NgcRecovery.dll,-100 = "Windows Hello Recovery Key Encryption" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs action1_agent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs action1_agent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28\52C64B7E\@%SystemRoot%\System32\wuaueng.dll,-400 = "Windows Update" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs action1_agent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates action1_agent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs action1_agent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot msiexec.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates action1_agent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs msiexec.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\Sequence = "1" msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2c msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs msiexec.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0001\Owner = e8100000f3252a254223dd01 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2b msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing action1_agent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs action1_agent.exe - Modifies registry class 46 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\69B3F004E729D67468A0C379CB68A0FD msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\69B3F004E729D67468A0C379CB68A0FD\PackageCode = "6BC2EE3040FE4E941998F5E3128E621C" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\69B3F004E729D67468A0C379CB68A0FD\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\" msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\69B3F004E729D67468A0C379CB68A0FD\SourceList msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\660B8D6E47E2F85419114258C7C126A7\Language = "1033" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\660B8D6E47E2F85419114258C7C126A7\Assignment = "1" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\660B8D6E47E2F85419114258C7C126A7\SourceList\LastUsedSource = "n;1;C:\\Windows\\Action1\\installer_cache\\" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\69B3F004E729D67468A0C379CB68A0FD\InstanceType = "0" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\3187685C39AD9D04484F43F57B7D8C2B msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\69B3F004E729D67468A0C379CB68A0FD\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\" msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\3187685C39AD9D04484F43F57B7D8C2B msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\660B8D6E47E2F85419114258C7C126A7\PackageCode = "919D3E7E9C8C211418ADC39A1BD1B1BF" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\660B8D6E47E2F85419114258C7C126A7\ProductIcon = "C:\\Windows\\Installer\\{E6D8B066-2E74-458F-9111-24857C1C627A}\\ProductIcon" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\660B8D6E47E2F85419114258C7C126A7\AuthorizedLUAApp = "0" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\3187685C39AD9D04484F43F57B7D8C2B\660B8D6E47E2F85419114258C7C126A7 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\660B8D6E47E2F85419114258C7C126A7\A1_Agent msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\660B8D6E47E2F85419114258C7C126A7\SourceList msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\660B8D6E47E2F85419114258C7C126A7\SourceList\PackageName = "action1_agent_6.0.msi" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\660B8D6E47E2F85419114258C7C126A7 msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\69B3F004E729D67468A0C379CB68A0FD\AdvertiseFlags = "388" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\69B3F004E729D67468A0C379CB68A0FD\DeploymentFlags = "3" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\69B3F004E729D67468A0C379CB68A0FD\SourceList msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\69B3F004E729D67468A0C379CB68A0FD\SourceList\PackageName = "zoom.us.invite.msi" msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\69B3F004E729D67468A0C379CB68A0FD\Clients = 3a0000000000 msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\660B8D6E47E2F85419114258C7C126A7\Version = "100663960" msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\660B8D6E47E2F85419114258C7C126A7\Clients = 3a0000000000 msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\69B3F004E729D67468A0C379CB68A0FD\Assignment = "1" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\69B3F004E729D67468A0C379CB68A0FD\AuthorizedLUAApp = "0" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\69B3F004E729D67468A0C379CB68A0FD\SourceList\Net msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\660B8D6E47E2F85419114258C7C126A7\DeploymentFlags = "3" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\69B3F004E729D67468A0C379CB68A0FD\Version = "100598418" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\3187685C39AD9D04484F43F57B7D8C2B\69B3F004E729D67468A0C379CB68A0FD msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\69B3F004E729D67468A0C379CB68A0FD\SourceList\Net msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\660B8D6E47E2F85419114258C7C126A7\ProductName = "Action1 Agent" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\660B8D6E47E2F85419114258C7C126A7\AdvertiseFlags = "388" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\69B3F004E729D67468A0C379CB68A0FD\A1_Agent msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\69B3F004E729D67468A0C379CB68A0FD\Language = "1033" msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\69B3F004E729D67468A0C379CB68A0FD msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\660B8D6E47E2F85419114258C7C126A7 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\660B8D6E47E2F85419114258C7C126A7\SourceList\Net msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\660B8D6E47E2F85419114258C7C126A7\SourceList\Net\1 = "C:\\Windows\\Action1\\installer_cache\\" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\69B3F004E729D67468A0C379CB68A0FD msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\69B3F004E729D67468A0C379CB68A0FD\ProductName = "Action1 Agent" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\69B3F004E729D67468A0C379CB68A0FD\ProductIcon = "C:\\Windows\\Installer\\{400F3B96-927E-476D-860A-3C97BC860ADF}\\ProductIcon" msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\69B3F004E729D67468A0C379CB68A0FD msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\660B8D6E47E2F85419114258C7C126A7\InstanceType = "0" msiexec.exe - Suspicious behavior: EnumeratesProcesses 20 IoCs
pid Process 4328 msiexec.exe 4328 msiexec.exe 4500 powershell.exe 4500 powershell.exe 4500 powershell.exe 4328 msiexec.exe 4328 msiexec.exe 4328 msiexec.exe 4328 msiexec.exe 4328 msiexec.exe 4328 msiexec.exe 4328 msiexec.exe 4328 msiexec.exe 4328 msiexec.exe 4328 msiexec.exe 4328 msiexec.exe 4328 msiexec.exe 1088 powershell.exe 1088 powershell.exe 1088 powershell.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 2608 msiexec.exe Token: SeIncreaseQuotaPrivilege 2608 msiexec.exe Token: SeSecurityPrivilege 4328 msiexec.exe Token: SeCreateTokenPrivilege 2608 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 2608 msiexec.exe Token: SeLockMemoryPrivilege 2608 msiexec.exe Token: SeIncreaseQuotaPrivilege 2608 msiexec.exe Token: SeMachineAccountPrivilege 2608 msiexec.exe Token: SeTcbPrivilege 2608 msiexec.exe Token: SeSecurityPrivilege 2608 msiexec.exe Token: SeTakeOwnershipPrivilege 2608 msiexec.exe Token: SeLoadDriverPrivilege 2608 msiexec.exe Token: SeSystemProfilePrivilege 2608 msiexec.exe Token: SeSystemtimePrivilege 2608 msiexec.exe Token: SeProfSingleProcessPrivilege 2608 msiexec.exe Token: SeIncBasePriorityPrivilege 2608 msiexec.exe Token: SeCreatePagefilePrivilege 2608 msiexec.exe Token: SeCreatePermanentPrivilege 2608 msiexec.exe Token: SeBackupPrivilege 2608 msiexec.exe Token: SeRestorePrivilege 2608 msiexec.exe Token: SeShutdownPrivilege 2608 msiexec.exe Token: SeDebugPrivilege 2608 msiexec.exe Token: SeAuditPrivilege 2608 msiexec.exe Token: SeSystemEnvironmentPrivilege 2608 msiexec.exe Token: SeChangeNotifyPrivilege 2608 msiexec.exe Token: SeRemoteShutdownPrivilege 2608 msiexec.exe Token: SeUndockPrivilege 2608 msiexec.exe Token: SeSyncAgentPrivilege 2608 msiexec.exe Token: SeEnableDelegationPrivilege 2608 msiexec.exe Token: SeManageVolumePrivilege 2608 msiexec.exe Token: SeImpersonatePrivilege 2608 msiexec.exe Token: SeCreateGlobalPrivilege 2608 msiexec.exe Token: SeBackupPrivilege 828 vssvc.exe Token: SeRestorePrivilege 828 vssvc.exe Token: SeAuditPrivilege 828 vssvc.exe Token: SeBackupPrivilege 4328 msiexec.exe Token: SeRestorePrivilege 4328 msiexec.exe Token: SeRestorePrivilege 4328 msiexec.exe Token: SeTakeOwnershipPrivilege 4328 msiexec.exe Token: SeRestorePrivilege 4328 msiexec.exe Token: SeTakeOwnershipPrivilege 4328 msiexec.exe Token: SeRestorePrivilege 4328 msiexec.exe Token: SeTakeOwnershipPrivilege 4328 msiexec.exe Token: SeRestorePrivilege 4328 msiexec.exe Token: SeTakeOwnershipPrivilege 4328 msiexec.exe Token: SeRestorePrivilege 4328 msiexec.exe Token: SeTakeOwnershipPrivilege 4328 msiexec.exe Token: SeRestorePrivilege 4328 msiexec.exe Token: SeTakeOwnershipPrivilege 4328 msiexec.exe Token: SeShutdownPrivilege 1044 MsiExec.exe Token: SeRestorePrivilege 4328 msiexec.exe Token: SeTakeOwnershipPrivilege 4328 msiexec.exe Token: SeRestorePrivilege 4328 msiexec.exe Token: SeTakeOwnershipPrivilege 4328 msiexec.exe Token: SeDebugPrivilege 4500 powershell.exe Token: SeBackupPrivilege 4256 action1_agent.exe Token: SeBackupPrivilege 4256 action1_agent.exe Token: SeRestorePrivilege 4328 msiexec.exe Token: SeTakeOwnershipPrivilege 4328 msiexec.exe Token: SeRestorePrivilege 4328 msiexec.exe Token: SeTakeOwnershipPrivilege 4328 msiexec.exe Token: SeRestorePrivilege 4328 msiexec.exe Token: SeTakeOwnershipPrivilege 4328 msiexec.exe Token: SeRestorePrivilege 4328 msiexec.exe - Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 2608 msiexec.exe 2608 msiexec.exe - Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2608 msiexec.exe 4328 msiexec.exe 1052 MsiExec.exe 1044 MsiExec.exe 5612 msiexec.exe 3104 MsiExec.exe - Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 4328 wrote to memory of 1468 4328 msiexec.exe 96 PID 4328 wrote to memory of 1052 4328 msiexec.exe 98 PID 4328 wrote to memory of 1044 4328 msiexec.exe 99 PID 4256 wrote to memory of 4500 4256 action1_agent.exe 101 PID 4256 wrote to memory of 5612 4256 action1_agent.exe 104 PID 4328 wrote to memory of 3104 4328 msiexec.exe 105 PID 2132 wrote to memory of 1088 2132 action1_agent.exe 107 - Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\zoom.us.invite.msi1⤵
- Badlisted process makes network request
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:2608
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4328 -
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵PID:1468
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 5E0B028890F9161EA7FE4668C55AA6EF2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1052
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 1BEF4AD3FE6E2FE11912173CE78E9B5B E Global\MSI00002⤵
- Loads dropped DLL
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1044
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding E9FD735E495CFB0900690BFC05E341F9 E Global\MSI00002⤵
- Loads dropped DLL
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3104
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵PID:1536
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:828
-
C:\Windows\Action1\action1_agent.exeC:\Windows\Action1\action1_agent.exe service1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4256 -
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -Command "$ExecutionContext.SessionState.LanguageMode"2⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Command and Scripting Interpreter: PowerShell
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4500
-
-
C:\Windows\SysWOW64\msiexec.exeC:\Windows\system32\msiexec.exe /I "C:\Windows\Action1\installer_cache\action1_agent_6.0.msi" /quiet /qn /norestart /lv* "C:\Windows\Action1\logs\agent_install_1785759602.log" REINSTALLMODE=amus ALLOWDOWNGRADE=12⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:5612
-
-
C:\Windows\Action1\action1_agent.exeC:\Windows\Action1\action1_agent.exe service1⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2132 -
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -Command "$ExecutionContext.SessionState.LanguageMode"2⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Command and Scripting Interpreter: PowerShell
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:1088
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Config.Msi\e5a714a.rbs
- Size 240KB
- SHA256 2eedb332fa29101f203b29fbc97abef3f36cf96f3a037f9fc398de0f8e348a46
- MD5 03657d9abaf239589ac5a9cb17803a81
- SHA1 4a5154819368aaae9125d3e62ce1208efa2cca68
- SHA512 b7db345fbc423286e585b1fcd8aee233e5a79883fcf7ce4fc7ee4940a3cd4ffa16595db79b1f2e16ef1172774d313240af9ff4769fd8d14e34e9f7ccbfa5fe11
- SSDEEP 3072:p9MIXiqyhTO8W0iEa8LW0bEC9hvZpC01v+eUKflQnZl+T+J7g6EsNr7wyy/IP3B:p9Bqhy8VKU3hvZUy+ppHEsuB/S
- TLSH T175349E217494547EEBFF0832953AD671AE3DF2380B90C56EC384581E5E618C1ABB7B27
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Config.Msi\e5a714b.rbs
- Size 7KB
- SHA256 2f3308efb15c85a7dccad0a5b64b068dd8536f23b86a242eb8cc991e706b3c20
- MD5 3dbd126adde5ad40c1990cd1f72a7f42
- SHA1 ef0b05f0c84831d4c9d63578ad0383200ce16408
- SHA512 892ad25c32c4f31f048386df9d32ceb99a127b652f0bf133545aeab0a36ec8f86d1dc3b5116ee6293ce7b0e45b01b301f372437a26ef288c30596c9abef5092e
- SSDEEP 96:UfHBPeW6eN6sHXkU8uf3jgnCsThqC+XkU8uf3jgnC6jD7696fdThqCLH+jV560yu:UpeizWCIYWCuOGS4wUfViVpT
- TLSH T186E110417B428AE3F9521B38C74717933BB2E2A9AB00635B84DD51309F17B4D1E9729F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Config.Msi\e5a7150.rbs
- Size 246KB
- SHA256 f05398ea619e07974a1042c2eee275202e9ab2156d4279c2d3693e1243809a8c
- MD5 622063c1db1a11b189baa308e3051aac
- SHA1 f115e970c59803c10370052f211fba965cc8f63b
- SHA512 cad0255dbe6a91641b1e826bc4fcfb6fac38d142984456ecb9fca28e248a7e0f6c0a5f1dcf7d0ca58c07859b55b4f16298bb4c76a0ce2e20f731089c40ae4d08
- SSDEEP 3072:k7gi2XiqyhTO8W0iEa8LW0bEC9hvZpC01v+eUKflQnZl+T+J7g6EsNr7wyy/IP3B:k7Sqhy8VKU3hvZUy+ppHEsuB/S
- TLSH T196349D217494547EEBFF0832953E9671AE3DF2380B50C56EC384981E5E618C1ABB7B27
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Config.Msi\e5a7157.rbs
- Size 8KB
- SHA256 89981fe6b987b8e8a57c5ed76e6df7fe5763873b92e49290dd3d391fa36928c6
- MD5 72f33e9d120c5c5a687f764daa7f682d
- SHA1 36d573faea44ab0ff3744628d282851c035a95e6
- SHA512 533804b3bf90036c6a3d813d295473af0e65586c6ee64c3f8e00bbedd49b13c930d0d17ee4f625808c5e5cf023b15140cbe77552d966ebc43ca77c2fad7f4db6
- SSDEEP 96:BfHR64r6fCF8Rvmv39SxCL7F8Rvyv39SCjFPUz63696fc6f8CLAVKALEBIYDs3rg:B4RMS3RQSsyDD7WwOOdmu6EA
- TLSH T19C0235032B1647E3EE261B35D65323A33BB3E1B5AB01825B90AD5174DF2BB451D831AE
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Config.Msi\e5a715a.rbf
- Size 3B
- SHA256 13bf7b3039c63bf5a50491fa3cfd8eb4e699d1ba1436315aef9cbe5711530354
- MD5 21438ef4b9ad4fc266b6129a2f60de29
- SHA1 5eb8e2242eeb4f5432beeec8b873f1ab0a6b71fd
- SHA512 37436ced85e5cd638973e716d6713257d692f9dd2e1975d5511ae3856a7b3b9f0d9e497315a058b516ab31d652ea9950938c77c1ad435ea8d4b49d73427d1237
- MD5 SHA1 SHA512
- Path C:\Config.Msi\e5a715b.rbs
- Size 1KB
- SHA256 89851268de32861e80ecec9df0a90c669d222c8b3d1690c332f3bd8c7072e0ca
- MD5 2428feb1e2ab6bcfa8b29c7f1d6bb50e
- SHA1 966a8aa7c88e71f81b36ad234e374d14349fa6ef
- SHA512 208750b688be6d13fab94714bdfb4364c9908be0594c9d4e6c79a2ef4a88e019628b2c08efc785827b4f47a8b229bd7eb4ec4ca00390680ededd17458fa44234
- TLSH T10621FD43EB0D96C3F9626F34C74322D33BE792764E044397149C26285E11B186FAB08E
- MD5 SHA1 SHA512 TLSH
- Path C:\Config.Msi\e5a715c.rbs
- Size 7KB
- SHA256 a20a633539db0f7937cada02e5cc3330bb6cda03a525907a3945fbaf50cc1d28
- MD5 c52568dd014c8f8f3d85280497d573c4
- SHA1 6e93cd2e65352ebb317f8d40e679fc3a8fbec16e
- SHA512 9bced709f7c11bb4372b03258f6045a2649c28d969a40845677f5314021a3f2945d2582151836b87e1c1613ac000f7711968400d43a22246264159c6275834de
- SSDEEP 96:ByHtPeiXv7XkUdAiOliCsThqxBXkUdAiOliC6jZS2dThqxaH+35fyG9tbktqZCyF:BkeqfGhI2GhM+YS0/po
- TLSH T11FE121017A1042F3FA6E0735D7470F9437B2D2DA53102B1B98CD6670AF6BB892F951CA
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Action1\7z.dll
- Size 1.3MB
- SHA256 872a7df979d45605d4247a9925871077ca84ed6cf78769037fb0d94ab788d9b5
- MD5 9c0ac3f52e342e752642622eda0a00ca
- SHA1 93a7762bb40c5e4c55d26451879510afc72593e1
- SHA512 b9468c8996cddc10c4a57924b812d8e0762ebf37fb66f1965c85d6857696e8cb08ec5254b69bf6ca987e42147adfa5f8dae6e6402e9d0a43e5b0ac3f3df146bd
- SSDEEP 24576:iNib1WFpYKnzLy1GOjaCMHO0v93Pqt0lamuAsggS2VsAhwRDgfeSh:iNibGpYKiGOjoHO89/18ugSo1d
- TLSH T13F559E11F7F1C074C58E5630862DBBBA50F8E729CA10A9D777C0BE6E6F319D2D225A09
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Action1\action1_agent.exe
- Size 8.9MB
- SHA256 f30ed43c6529409197a01e6b80b6438e23e32aba8cad3486dc079e995db0f0aa
- MD5 4055067f208a7a00d811017f24bd68c9
- SHA1 3391d271ea348ef2321c47a6dc92461bc59cb6fc
- SHA512 be64dd0d1ff8fd2e1efbc6bd5536dd9b8fd34e5ca22533b0c8d86a379585e1a5a41f51cfa0493d37e319177215f7c5f4a481dc16e6e69ecaf1164c4917a185d5
- SSDEEP 196608:4g1+AFuNTfzFvSKYd1wNd+Eww+2mHNcJ7IVK0UWvMd:4C2FS5y+jFNcJ7t0xvMd
- TLSH T164969D21F6518135F9A701B299BE4B7E852CBE30072855E3C3C858AE5AF15E33B37A17
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Action1\action1_agent.exe
- Size 8.9MB
- SHA256 941695d20d82dd5d62f74b0111feb23720637202f6c797df2a02e2cb6cb6e8e3
- MD5 e4f1f52a78f22dd2be17449ca6f8f0af
- SHA1 e9f385454fdddc7ae88431b8e02f4dfb7dd57b68
- SHA512 2d7ed519a9380e1574bbc55444420334bdd0792c7839a1be67607a4f81be79e52f6c4dd10141079a47dcf61552724c2b3f060f0f670bdea527dc130ba9aebac8
- SSDEEP 196608:KV1U3lnchqzhNpxSKyOBE2LeIzfAnOgOZ6aMkElWpRUn:KPoTVQYEseIzflZ6aMZORo
- TLSH T1D9968D21B641C135F9A301B29A7E4B6F853CBE30072555E7D3C858AE5AB19E33B32B17
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Action1\action1_agent.exe.update_state
- Size 1B
- SHA256 7902699be42c8a8e46fbbb4501726517e86b22c56a189f7625a6da49081b2451
- MD5 8f14e45fceea167a5a36dedd4bea2543
- SHA1 902ba3cda1883801594b6e1b452790cc53948fda
- SHA512 f05210c5b4263f0ec4c3995bdab458d81d3953f354a9109520f159db1e8800bcd45b97c56dce90a1fc27ab03e0b8a9af8673747023c406299374116d6f966981
- MD5 SHA1 SHA512
- Path C:\Windows\Action1\action1_remote.exe
- Size 1.5MB
- SHA256 d5d0c44dd03f1952d388d547e6e1ee021978bd1641b5b8ec49d49e8b7d53e909
- MD5 e20ba8bf8a8bc3b538c9a3dc73a2f8c3
- SHA1 0c765670e1e6886545ed9a0d6d0748ea9201d49c
- SHA512 de87cecb201a4cee16372afb82713eab1c9396cea6cc608cedcd4fe6e2508cdfed95f3a95de5d943d25e866b84e05ff48bfd9ab4b29f29460ddc59f46537b22a
- SSDEEP 24576:1g1cK0GFkiuX49F8LFNYYgWj5d51z9jCrUPopzFv73OZN0RTve8yOKNmST:1g1cHi+42J1zgrUPUhvVTm8yVN9T
- TLSH T15D757C2133978029E9B213307978D6BA593DBE754FB594CFA3D01AAD5C30AC25B35B23
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Action1\first_install
- Size 50B
- SHA256 0601676d25e84bc8e0a20a017673e17f476bd12ff4d42e98d16af04f455b7c25
- MD5 5f5082ba0ed91b07e2d621fa4452e331
- SHA1 8f30b1a6b0dace01df4412030a1468daa923cbd8
- SHA512 5688df86251c2b2745fce1797d09e5c9888a7b06966919fd42c53040793fbccb3665d8f2cbe7a8c68d53f2213a6d79b78681518eba9981ab5df44e067f6117b2
- TLSH T1B190044370D557F53C5D4375F44301D14F54F3D0DC4D5155154507450451013117F451
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\Action1\logs\agent_install_1785759602.log
- Size 1KB
- SHA256 3579fdf442a674a3654643b6a07f8d8b9bf6bbaf76784ad5294396ec88ccd349
- MD5 98ab18cd394cd56a5ba1611d49098209
- SHA1 84ea8bc8708e4c22b0f6ef67eeb6d93054e08e84
- SHA512 75f7d5d3856ade947121d1682f634b190a5b2d8f03ea9d595c79be42cf769becc8ac36c71f14a1854e7ef689eda2297cf4b17e38b361cb1d891cefd21c893bee
- TLSH T1D031876A1AF90804F1B69B47ADF7C1520A33FDDAA834CB4C23C48719066BD05BC683B7
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\Action1\sas.dll
- Size 8KB
- SHA256 996b01e15f85e165899630721a141b178a9c372b6e878012180ec9e9d4e7bd06
- MD5 969d1f85151e0156d51a664e59a50213
- SHA1 777735cf24fe880d00a205b5bcc79ca8df8d660b
- SHA512 73f9a14d297f7dddc9e3d9b0db6cd4160cd000f31f437ea8add7d95de2f704482fa891996f2df048def3371cc9245a2efa31b2d0647a7cc1e6848db7b809e711
- SSDEEP 192:l5UGq/4LYix0kmAEE8O5cTbOVT66o+1WX6wW/:nr5YiWXAjHGOVZP1WX6wW
- TLSH T13C02E60973A8067AE4FF1B76A06EA236462AB6205FF142EF195322D938355D15E307C6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Action1\what_is_this.txt
- Size 1KB
- SHA256 8aca9fa1362a99d9e88c0f7d116ed2ffd1b7f6011b690939e2e0c163a35b8e35
- MD5 088610370afce93b1ac5a6b157aacffa
- SHA1 ff781741b1ae19f518c7a09c34e4429f56206c6b
- SHA512 2594b63c5aa2289b2f859ae45c78ef99fff48df721d03582cb0607b0c2635bf360498393890000f8406ad33519190464b236ebfca8d46f1c7220372a52c3ce38
- TLSH T14A31615BF72823A40F8702823A5B04E1E739D46C3315A66418EF4218C3A3A4897777E9
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\Installer\MSI782F.tmp
- Size 385KB
- SHA256 23a1c772b870ffcef49e3b3a20d668f11753d3e52c696d787532af0c7eec43ba
- MD5 fd5bf1c8ba3e167d8fbd93ad80dec83e
- SHA1 dc1adedab432a1a38c938fb790af5adeffe420ac
- SHA512 1b6e20beea7ceb6227081ae059ef35a4547a27975cccdfd4f6cdae8bc2e140a32629630de2859cefc5b4aa169713c00b008f62a601c5bf5a376ea0ff14b5d491
- SSDEEP 6144:G3wTnFe4be1AgG6VRfex413e2xsflKjic/xWOV8FE:rTnFc1AgG6jfex4pe27/WhFE
- TLSH T143848D11B542C032D5AE05B0B634EFB5AABDA9704FA464DBB7D40E7B8D302C1A735B1B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\MSI79C7.tmp
- Size 234KB
- SHA256 78860e15e474cc2af7ad6e499a8971b6b8197afb8e49a1b9eaaa392e4378f3a5
- MD5 8edc1557e9fc7f25f89ad384d01bcec4
- SHA1 98e64d7f92b8254fe3f258e3238b9e0f033b5a9c
- SHA512 d26c9dce3c3d17583ffb5dbcd3989f93b096a7f64a37a2701a474c1bf4b8c8b1e922c352d33f24e411f1c793e1b4af11a3aec1de489087d481b1b636df2050cd
- SSDEEP 3072:5XiqyhTO8W0iEa8LW0bEC9hvZpC01v+eUKflQnZl+T+J7g6EsNr7wyy/IP3:5qhy8VKU3hvZUy+ppHEsuB/
- TLSH T159348D217494547EEBFF0832953AD671AE3DF2380B90C96EC384581E6D618C1A7B7B27
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\MSI7B0E.tmp
- Size 387KB
- SHA256 ca5f0275e70ec5ba65b74c3da74f489018bc143c4c405fd8bbc6519eadac2a22
- MD5 4112820180a36753089ee5c0fdba1538
- SHA1 6366de1c2930886892aabf4b8ac55fd0bb4b91bb
- SHA512 eac55d5a5c723fb5bd85bdd1ee71a13497d677d2b45e58b6eed2f7e42760d2ba3d07e0cb2b622f7866da8492f8d3fdb02b6288f95b761f5b2e20d2e2098233d3
- SSDEEP 6144:ijVmAOn9DqwokBL+097OsOmceIpOaEPbyHiDO9EAFw:CmAOnRokBL17OsONeIshZAFw
- TLSH T18B848D01B542C032D5AE05B0B535EFB5AABDA9704FB468DBB7D40E7B8D302C1A735A1B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\e5a7149.msi
- Size 6.8MB
- SHA256 2b462d51032bd76e4f2f9498546e1f18e1510af71231dabf34ac3d5b40a4743c
- MD5 4b4c09ecdcef26e6ba014c50162343fb
- SHA1 408e55ecafaa2691cd9f5567256dcdec53c7b711
- SHA512 eff40fb337cb5bdc657ce9c02ef3116679a50243811efc1ec8b6ee1ef7fb2e75e603069e4265a3aec3cc4578a3fa8e98734b9e0dfdc53d89616dc09a472c7ec6
- SSDEEP 98304:lqkMMwpD74kF+tyzKgQY0VUKOAj45vvC0eiWctSTNQaJu61VpLpZqtyra4V9eFvt:lvlc4kF+sKgQY3i85vV5tyNJu6BNow3
- TLSH T178761221B58E8C35D69A353076359EBEDA38BC345B948BCB938339ED19312C092FD752
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\{400F3B96-927E-476D-860A-3C97BC860ADF}\ProductIcon
- Size 32KB
- SHA256 7a214ccfe309e4c0c83f40d9b7c92e3d41206db734401e7227ef10b38064ca9d
- MD5 d37f7a439b9527f73e21311db17eaf00
- SHA1 d0f34b3c1368f28a419924560c282358703a8d35
- SHA512 3c1bcd38ed8d6bff8e071416cda90b0331b50903d9e4c9305bc36f9ccce23cb05424576b066485e76ee17e6fdc493fd25f8776d24b98de9d3941c181bb333569
- SSDEEP 96:JnbrlpScW1BwB/vmaOZaxdJVE8BEArPz578SSuQEmgo3/I:JnbrlpScW18Ued/E8f8KQEPo3/I
- TLSH T195E211067007D5DCDE28473CB0B6FCB539728A776EAC23DEF2A4B4E52882465147C6B2
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 64B
- SHA256 32042171c5e40edde1ce63496ff17125a2d3611676571eaae3a3af776b53763b
- MD5 6a2fa0cda8c14b0f5d3bea21fc9d3286
- SHA1 17bfa853b93ae9d305e48495ccec72102ee52fc8
- SHA512 9cbe5b0a1da1446c4a9712e338e155fedd90e6ee0fa253d51ef6b4f93e8a80de9ddba2bb9f591924e76e1cf72891e0fbf1905a6eaf8873e8dd58eb59595558d4
- MD5 SHA1 SHA512
- Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
- Size 26.1MB
- SHA256 257c574e3e5d423bb17c80ffbf825d6737c0f385d02424c8bfb663dd4e1aa46e
- MD5 7ab08d6367fc2b276dfe266a9c90eda4
- SHA1 e7fa8e2938dbc9648341e25650e986185f058e86
- SHA512 286b065ece51c5c066407208cad4c58d939d88a172f672b6fa5f90d1519bb77f0e39df79c0e55e8b960f78def46804f1b72004584c2af3a63458b9187af7252f
- SSDEEP 24576:+Fo3DMPHdoO/vvTL/SwyiCFAvre45LFB0vkwN/8qUn8aZ1jS8Ih2ibYDGu0:8HA
- TLSH T1DB57B42436F92100EBF7AE3CA8F06A274D397D57AC16DE8D45511B4D0822F71E872F6A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\Volume{c61f8367-0000-0000-0000-d08302000000}\System Volume Information\SPP\OnlineMetadataCache\{dd966da6-83ed-4fa6-ad50-74fe62f843bf}_OnDiskSnapshotProp
- Size 6KB
- SHA256 86bd4c0f9b4b84b7289dd94267ce51904c174fc6ef95933c88d7bf43c9fb84fd
- MD5 a9418642ea2304f5659e8760b678bfec
- SHA1 036c56885a38346760e2c24cf1ad92a1a38f6a7d
- SHA512 f2d16e6144b4c155984d988adb55b0935bb549bd96a84cd9404f4d85032f2d700dffc127ecc2484e4c209499982fcde6321d88607546896909b89d23d7e30c9c
- SSDEEP 96:Fl0LnlIvc6DD84LTHzbOHXOHBlBRQn8Sc9XE56tOSVQpuN:L0Cb++uVmN
- TLSH T1ACD187084AF54711E2B3AB3169F14557A837B912FF33CB8E0198238E2671910F835F6B
- MD5 SHA1 SHA512 SSDEEP TLSH