Analysis
- user interaction
yes - max time kernel
339s - max time network
601s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-ja - resource tags
- submitted
06/08/2026, 07:56
General
- Target 6ea3d8d0.iso
- Size 90KB
- Sample260806-js1pmage94
- SHA256 2e1cd6ed59c790965ea60b124397703258f50fa6c4dd6c605179f92849ce5306
Score
9/10
Malware Config
Signatures
- Checks for common network interception software 1 TTPs
Looks in the registry for tools like Wireshark or Fiddler commonly used to analyze network activity.
- Badlisted process makes network request 4 IoCs
Network request originating from process or tool commonly abused by malware.
- Drops file in Drivers directory 2 IoCs
- Looks for VMWare Tools registry key 2 TTPs 2 IoCs
- Sets service image path in registry 3 TTPs 2 IoCs
This determines the executable launched when a service starts. It can be used to establish persistence.
- Executes dropped EXE 64 IoCs
- Loads dropped DLL 64 IoCs
- Modifies file permissions 1 TTPs 5 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Enumerates connected drives 3 TTPs 22 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Power Settings 1 TTPs 1 IoCs
powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.
- Drops file in System32 directory 42 IoCs
- Executes a VBScript file via the Windows Script Host. 1 TTPs 4 IoCs
- Drops file in Program Files directory 64 IoCs
- Drops file in Windows directory 29 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 23 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- Modifies trusted root certificate store through registry 1 TTPs 30 IoCs
A root certificate was added, modified, or removed in the trusted certificate store registry paths.
- System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs
Adversaries may check for Internet connectivity on compromised systems.
- Checks SCSI registry key(s) 3 TTPs 64 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 2 IoCs
- Gathers system information 1 TTPs 1 IoCs
Runs systeminfo.exe.
- Modifies data under HKEY_USERS 64 IoCs
- Modifies registry class 36 IoCs
- Modifies system certificate store 2 TTPs 64 IoCs
- Runs net.exe
- Runs ping.exe 1 TTPs 1 IoCs
- Script User-Agent 1 IoCs
Uses user-agent string associated with script host/environment.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: LoadsDriver 1 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of FindShellTrayWindow 57 IoCs
- Suspicious use of SendNotifyMessage 56 IoCs
- Suspicious use of SetWindowsHookEx 4 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\6ea3d8d0.iso1⤵
- Executes a command shell one-liner
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "D:\Click to open the file.vbs"1⤵
- Executes a VBScript file via the Windows Script Host.
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" "D:\Click to open the file.vbs" /elevated2⤵
- Badlisted process makes network request
- Executes a VBScript file via the Windows Script Host.
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\msiexec.exe"C:\Windows\System32\msiexec.exe" /i "C:\ProgramData\2CAF6582082A4AFB826\UEMSAgent.msi" /quiet TRANSFORMS="C:\ProgramData\2CAF6582082A4AFB826\UEMSAgent.mst" ENABLESILENT="yes" REBOOT="ReallySuppress" INSTALLSOURCE="Manual" SERVER_ROOT_CRT="C:\ProgramData\2CAF6582082A4AFB826\DMRootCA-Server.crt" DS_ROOT_CRT="C:\ProgramData\2CAF6582082A4AFB826\DMRootCA.crt"3⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 -n 3 > nul & del /f /q "D:\Click to open the file.vbs"3⤵
- Executes a command shell one-liner
- System Network Configuration Discovery: Internet Connection Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 34⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\Click to open the file.vbs"1⤵
- Executes a VBScript file via the Windows Script Host.
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 80AD07B589F4C6987556E32BCFCA5C6C2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagentregister.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagentregister.exe" -i dc2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies trusted root certificate store through registry
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Modifies registry class
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\ManageEngine\UEMS_Agent\scripts\setAppPermission_Internal.bat" "C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs""3⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net.exenet session4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 session5⤵
-
-
-
C:\Windows\SysWOW64\icacls.exe"C:\Windows\system32\icacls.exe" "C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs" /grant *S-1-5-18:(OI)(CI)F /T /Q /grant *S-1-5-32-544:(OI)(CI)F /T /Q4⤵
- Modifies file permissions
-
-
C:\Windows\SysWOW64\icacls.exe"C:\Windows\system32\icacls.exe" "C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs" /grant:r "DLAWBTBF\Admin":(OI)(CI)F /T /Q4⤵
- Modifies file permissions
-
-
C:\Windows\SysWOW64\icacls.exe"C:\Windows\system32\icacls.exe" "C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs" /inheritance:r4⤵
- Modifies file permissions
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\icacls.exe"C:\Windows\system32\icacls.exe" "C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs" /remove:g "CREATOR OWNER" /T /Q /remove:g "BUILTIN\Users" /T /Q /remove:g *S-1-15-2-1 /T /Q4⤵
- Modifies file permissions
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\icacls.exe"C:\Windows\system32\icacls.exe" "C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs" /remove:g *S-1-5-11 /T /Q /remove:g *S-1-15-2-2 /T /Q4⤵
- Modifies file permissions
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c "7za.exe e "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\data\OSDetection.json.gz" -so>"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\data\OSDetection.json""3⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe7za.exe e "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\data\OSDetection.json.gz" -so4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe7za e -mx9 "C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\agent_binaries.7z" -o"C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\" -y3⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcpatchscan.exebin\dcpatchscan.exe -y 13⤵
- Looks for VMWare Tools registry key
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Modifies trusted root certificate store through registry
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Modifies system certificate store
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\dcdriverupdates.dll.gz" *4⤵
- Executes dropped EXE
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\dcdriverupdates.dll.gz" dcdriverupdates.dll4⤵
- Executes dropped EXE
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\drvforceupdate.exe.gz" *4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\drvforceupdate.exe.gz" drvforceupdate.exe4⤵
- Executes dropped EXE
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\dcpatchutils.dll.gz" *4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\dcpatchutils.dll.gz" dcpatchutils.dll4⤵
- Executes dropped EXE
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\patch-scan-data.xml.gz" *4⤵
- Executes dropped EXE
- Drops file in Program Files directory
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\patchutils.json.gz" *4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "superseded-tree-scan-data.7z" superseded-tree-scan-data.xml4⤵
- Executes dropped EXE
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\applications.xml.gz" *4⤵
- Executes dropped EXE
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\hardware.json.gz" *4⤵
- Executes dropped EXE
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\patchresource.xml.gz" *4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\patchtodepfiles.xml.gz" *4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\EPMErrorCodes.xml.gz" *4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\patch-dependency-details.xml.gz" *4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\ud-supported-patch-details.json.gz" *4⤵
- Executes dropped EXE
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\patchresource.json.gz" *4⤵
- Executes dropped EXE
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\applications.json.gz" *4⤵
- Executes dropped EXE
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\eol-service-packs.json.gz" *4⤵
- Executes dropped EXE
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\os-servicing-data.json.gz" *4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\vulnerable-resources\misconfig-scan-data.xml.gz" *4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\vulnerable-resources\ServerDetectionChecks.dll.gz" *4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\vulnerable-resources\ServerDetectionChecks.dll.gz" ServerDetectionChecks.dll4⤵
- Executes dropped EXE
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\vulnerable-resources\component-scan-data\windows-component-details.zip" *4⤵
- Executes dropped EXE
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c "7za.exe e "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data/vulnerable-resources/component-scan-data\component-details.json.gz" -so>"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data/vulnerable-resources/component-scan-data\component-details.json""4⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe7za.exe e "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data/vulnerable-resources/component-scan-data\component-details.json.gz" -so5⤵
- Executes dropped EXE
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c "7za.exe e "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data/vulnerable-resources/component-scan-data\component-meta-data.json.gz" -so>"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data/vulnerable-resources/component-scan-data\component-meta-data.json""4⤵
- Executes a command shell one-liner
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe7za.exe e "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data/vulnerable-resources/component-scan-data\component-meta-data.json.gz" -so5⤵
- Executes dropped EXE
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c "7za.exe e "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data/vulnerable-resources/component-scan-data\npm-component-details.json.gz" -so>"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data/vulnerable-resources/component-scan-data\npm-component-details.json""4⤵
- Executes a command shell one-liner
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe7za.exe e "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data/vulnerable-resources/component-scan-data\npm-component-details.json.gz" -so5⤵
- Executes dropped EXE
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c "7za.exe e "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data/vulnerable-resources/component-scan-data\php-component-details.json.gz" -so>"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data/vulnerable-resources/component-scan-data\php-component-details.json""4⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe7za.exe e "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data/vulnerable-resources/component-scan-data\php-component-details.json.gz" -so5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c "7za.exe e "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data/vulnerable-resources/component-scan-data\python-component-details.json.gz" -so>"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data/vulnerable-resources/component-scan-data\python-component-details.json""4⤵
- Drops file in Program Files directory
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe7za.exe e "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data/vulnerable-resources/component-scan-data\python-component-details.json.gz" -so5⤵
- Executes dropped EXE
-
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\vulnerable-resources\MisconfigEngine.dll.gz" *4⤵
- Executes dropped EXE
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV15⤵
-
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\vulnerable-resources\MisconfigEngine.dll.gz" MisconfigEngine.dll4⤵
- Executes dropped EXE
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\vulnerable-resources\coveragex.exe.gz" *4⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\vulnerable-resources\coveragex.exe.gz" coveragex.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\vulnerable-resources\component-details.json.gz" *4⤵
- Executes dropped EXE
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\vulnerable-resources\vulnerable-patch-scan-data.xml.gz" *4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\vulnerable-resources\patchresource-vul.xml.gz" *4⤵
- Executes dropped EXE
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV15⤵
-
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\vulnerable-resources\applications-vul.xml.gz" *4⤵
- System Location Discovery: System Language Discovery
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\vulnerable-resources\vulnerable-scan-data.xml.gz" *4⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV15⤵
-
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\meaap.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\meaap.exe" -m 1 -a 7093261d-e605-4137-be02-f2a185eeaad24⤵
- Modifies data under HKEY_USERS
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\patch-scan-data\pr100316-sp100392.xml.gz" *4⤵
- System Location Discovery: System Language Discovery
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\patch-scan-data\pr100397-sp100474.xml.gz" *4⤵
- System Location Discovery: System Language Discovery
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\patch-scan-data\pr1906-sp3076.xml.gz" *4⤵
- System Location Discovery: System Language Discovery
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\patch-scan-data\pr1939-sp3120.xml.gz" *4⤵
- System Location Discovery: System Language Discovery
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\patch-scan-data\pr1949-sp3133.xml.gz" *4⤵
- System Location Discovery: System Language Discovery
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\patch-scan-data\pr1110-sp2137.xml.gz" *4⤵
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\patch-scan-data\pr100226-sp100296.xml.gz" *4⤵
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\patch-scan-data\pr100208-sp100270.xml.gz" *4⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV15⤵
-
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\patch-scan-data\pr1148-sp2169.xml.gz" *4⤵
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\patch-scan-data\pr100241-sp100311.xml.gz" *4⤵
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\patch-scan-data\pr81-sp2171.xml.gz" *4⤵
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\patch-scan-data\pr1201-sp2213.xml.gz" *4⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV15⤵
-
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\patch-scan-data\pr1200-sp2211.xml.gz" *4⤵
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\patch-scan-data\pr1259-sp2288.xml.gz" *4⤵
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\patch-scan-data\pr1258-sp2287.xml.gz" *4⤵
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\patch-scan-data\pr102221-sp102329.xml.gz" *4⤵
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\patch-scan-data\pr1596-sp2707.xml.gz" *4⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV15⤵
-
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\patch-scan-data\pr2073-sp3270.xml.gz" *4⤵
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\patch-scan-data\pr1652-sp2964.xml.gz" *4⤵
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\patch-scan-data\pr101483-sp101584.xml.gz" *4⤵
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\patch-scan-data\pr100183-sp100239.xml.gz" *4⤵
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\patch-scan-data\pr1791-sp2902.xml.gz" *4⤵
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\patch-scan-data\pr1804-sp2932.xml.gz" *4⤵
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\patch-scan-data\pr1817-sp2968.xml.gz" *4⤵
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\patch-scan-data\pr1814-sp2952.xml.gz" *4⤵
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\patch-scan-data\pr1828-sp2985.xml.gz" *4⤵
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\patch-scan-data\pr1846-sp3000.xml.gz" *4⤵
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\patch-scan-data\pr1845-sp2999.xml.gz" *4⤵
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c "7za.exe e "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\hardware-scan-data\realtek.network.json.gz" -so>"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data/patch-resources/hardware-scan-data/realtek.network.json""4⤵
- Executes a command shell one-liner
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe7za.exe e "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\hardware-scan-data\realtek.network.json.gz" -so5⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /C wevtutil epl application "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\logs\application.evtx"4⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\wevtutil.exewevtutil epl application "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\logs\application.evtx"5⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /C wevtutil epl system "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\logs\system.evtx"4⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\wevtutil.exewevtutil epl system "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\logs\system.evtx"5⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /C wevtutil epl setup "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\logs\setup.evtx"4⤵
- Executes a command shell one-liner
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV15⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil epl setup "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\logs\setup.evtx"5⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c powershell.exe -Command "Get-WmiObject -Class Win32_QuickFixEngineering -Filter \"HotFixID!='File 1'\" | Select-Object Description, HotFixID, InstalledOn, InstalledBy" > "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\logs\updates.log"4⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell.exe -Command "Get-WmiObject -Class Win32_QuickFixEngineering -Filter \"HotFixID!='File 1'\" | Select-Object Description, HotFixID, InstalledOn, InstalledBy"5⤵
- Command and Scripting Interpreter: PowerShell
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /C C:\Windows\system32\reg.exe export HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\logs\uninstall32.reg"4⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\reg.exeC:\Windows\system32\reg.exe export HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\logs\uninstall32.reg"5⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /C C:\Windows\system32\reg.exe export HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\logs\uninstall.reg"4⤵
- Executes a command shell one-liner
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe export HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\logs\uninstall.reg"5⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /C C:\Windows\system32\reg.exe export HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Patches "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\logs\patchuserdata.reg"4⤵
- Executes a command shell one-liner
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe export HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Patches "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\logs\patchuserdata.reg"5⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /C C:\Windows\system32\reg.exe export HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\logs\productuserdata.reg"4⤵
- Executes a command shell one-liner
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe export HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\logs\productuserdata.reg"5⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /C C:\Windows\system32\reg.exe export HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\logs\components.reg"4⤵
- Executes a command shell one-liner
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe export HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\logs\components.reg"5⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /C C:\Windows\system32\reg.exe export "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Component Based Servicing" "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\logs\CBS.reg"4⤵
- Executes a command shell one-liner
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe export "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Component Based Servicing" "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\logs\CBS.reg"5⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /C C:\Windows\system32\reg.exe export HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\SideBySide "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\logs\SBS.reg"4⤵
- Executes a command shell one-liner
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe export HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\SideBySide "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\logs\SBS.reg"5⤵
-
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe" a updatedetails.7z uninstall32.reg uninstall.reg patchuserdata.reg productuserdata.reg components.reg CBS.reg SBS.reg CBS.log4⤵
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe" a updatedetails.7z ..\logs\application.evtx4⤵
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe" a updatedetails.7z ..\logs\system.evtx4⤵
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe" a updatedetails.7z ..\logs\setup.evtx4⤵
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe" a updatedetails.7z ..\History\latestpatchscan.xml4⤵
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe" a updatedetails.7z ..\data\latestvulnerablescandata.json4⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /C systeminfo.exe > "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\logs\systeminfo.log"3⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\systeminfo.exesysteminfo.exe4⤵
- System Location Discovery: System Language Discovery
- Gathers system information
-
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcstatusutil.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcstatusutil.exe" -install 223⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcinventory.exebin\dcinventory.exe -i postinstallation 0 13⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies trusted root certificate store through registry
- System Location Discovery: System Language Discovery
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
- Modifies system certificate store
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcmetroapps.exedcmetroapps.exe4⤵
- Executes dropped EXE
-
-
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\UEMSAgentHealthChecker.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\UEMSAgentHealthChecker.exe"1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\UEMSAgentHCHelper.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\UEMSAgentHCHelper.exe" UEMSAgent 12⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\UEMSAgentHCHelper.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\UEMSAgentHCHelper.exe" UEMSAgent 22⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\UEMSAgentHCHelper.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\UEMSAgentHCHelper.exe" UEMSAgent 42⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagentservice.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagentservice.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagentservice.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagentservice.exe"1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\CRU_Reporter.exeCRU_Reporter.exe -RegisterCRU2⤵
- Executes dropped EXE
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcusbsummary.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcusbsummary.exe" -s ET_ENUM 9 2 "Unknown"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcusb64.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcusb64.exe" -s 93⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
-
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\dcconfig.exe7 0 02⤵
- Badlisted process makes network request
- Executes dropped EXE
- Drops file in Program Files directory
- Modifies data under HKEY_USERS
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcstatusutil.exebin\dcstatusutil.exe RequestAgentSlotFromServer2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcondemand.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcondemand.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcswmeter.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\dcswmeter.exe" -s ET_COL2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcinventory.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\dcinventory.exe" -s prenotify2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\dcconfig.exe3 0 02⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Modifies trusted root certificate store through registry
- System Location Discovery: System Language Discovery
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Modifies system certificate store
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcinventory.exebin\dcinventory.exe -p processor compatibility3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcuploadlogs.exerefresh3⤵
- Executes dropped EXE
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\data\\OSDetection.json.gz" OSDetection.json3⤵
- Executes dropped EXE
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c "7za.exe e "C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\deployment-policies.xml2740.tmp" -so>"C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\deployment-policies.xml2740.tmpnew""3⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe7za.exe e "C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\deployment-policies.xml2740.tmp" -so4⤵
- Executes dropped EXE
-
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\dcdriverupdates.dll.gz" dcdriverupdates.dll3⤵
- Executes dropped EXE
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\drvforceupdate.exe.gz" drvforceupdate.exe3⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\patch-resources\dcpatchutils.dll.gz" dcpatchutils.dll3⤵
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\vulnerable-resources\ServerDetectionChecks.dll.gz" ServerDetectionChecks.dll3⤵
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\vulnerable-resources\MisconfigEngine.dll.gz" MisconfigEngine.dll3⤵
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\client-data\vulnerable-resources\coveragex.exe.gz" coveragex.exe3⤵
- System Location Discovery: System Language Discovery
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcnacprocess.exe33⤵
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\meaap.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\meaap.exe" -m 1 -c Refresh3⤵
- Drops file in Program Files directory
- Modifies trusted root certificate store through registry
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Modifies system certificate store
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\meaaphelper.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\meaaphelper.exe" -n a8171afd-f23a-419b-9bb8-146a20bb61fd -f "C:\Program Files (x86)\ManageEngine\UEMS_Agent\temp\BitLockerMgmt.zip" -c blm -m "C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\BitLocker-metadata.json" -a 24⤵
- Modifies data under HKEY_USERS
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\temp\BitLockerMgmt.zip" -o"C:\Program Files (x86)\ManageEngine\UEMS_Agent\"5⤵
- Drops file in Program Files directory
-
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\meaaphelper.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\meaaphelper.exe" -n d57c4dc4-daa3-496d-85ce-28fc06cd5c6e -f "C:\Program Files (x86)\ManageEngine\UEMS_Agent\temp\DeviceControl.zip" -c dcm-win -m "C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\DeviceControl-metadata.json" -a 24⤵
- Modifies data under HKEY_USERS
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagenttrayicon.exedcagenttrayicon.exe -r5⤵
- Drops file in System32 directory
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagenttrayicon.exedcagenttrayicon.exe5⤵
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\temp\DeviceControl.zip" -o"C:\Program Files (x86)\ManageEngine\UEMS_Agent\"5⤵
- Drops file in Program Files directory
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagenttrayicon.exedcagenttrayicon.exe -r5⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
-
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\meaaphelper.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\meaaphelper.exe" -n 50a5c86a-eafc-11ed-a05b-0242ac120003 -f "C:\Program Files (x86)\ManageEngine\UEMS_Agent\temp\ECEASetup.zip" -c ei_win_64 -m "C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\EndpointIntelligence-metadata.json" -a 14⤵
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\temp\ECEASetup.zip" -o"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\EndpointIntelligence\installer\"5⤵
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\EndpointIntelligence\installer\ECEASetup.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\EndpointIntelligence\installer\ECEASetup.exe" -install5⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV16⤵
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe" x -y "C:\Program Files (x86)\ManageEngine\UEMS_Agent\EndpointIntelligence\Root\Public\Bin\ECEABundle.7z"6⤵
- Drops file in Program Files directory
-
-
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\meaaphelper.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\meaaphelper.exe" -n d57c4dc4-daa3-496d-85ce-28fc06cd5c6e -c dcm-win -m "C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\DeviceControl-metadata.json" -a 04⤵
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\DeviceControl\bin\devctrlaction64.exe-c 45⤵
- Checks SCSI registry key(s)
-
C:\Windows\system32\gpupdate.exeC:\Windows\system32\gpupdate.exe /Target:Computer /Force6⤵
-
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagenttrayicon.exedcagenttrayicon.exe -r5⤵
- Drops file in System32 directory
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagenttrayicon.exedcagenttrayicon.exe5⤵
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\meaaphelper.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\meaaphelper.exe" -n a8171afd-f23a-419b-9bb8-146a20bb61fd -c blm -m "C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\BitLocker-metadata.json" -a 04⤵
- Drops file in Program Files directory
- Modifies data under HKEY_USERS
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\meaaphelper.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\meaaphelper.exe" -n 50a5c86a-eafc-11ed-a05b-0242ac120003 -c ei_win_64 -m "C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\EndpointIntelligence-metadata.json" -e enabled -a 34⤵
-
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcwolsettings.exebin\dcwolsettings.exe3⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cscript.exeC:\Windows\system32\cscript.exe DisableEnableEthernet.vbs3⤵
- Executes a VBScript file via the Windows Script Host.
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\powercfg.exepowercfg -devicequery wake_from_any4⤵
- Power Settings
- Checks SCSI registry key(s)
-
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe7za x -mx9 "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\driverfiles.7z" -o"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\" -y3⤵
- Drops file in Program Files directory
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\DCFAService64.exeDCFAService64.exe -install DFMFilter3⤵
- Drops file in Drivers directory
- Sets service image path in registry
-
C:\Windows\system32\fltmc.exeC:\Windows\system32\fltmc.exe unload DFMFilter4⤵
-
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\DCFAService64.exeDCFAService64.exe -install DRMFilter3⤵
- Drops file in Drivers directory
- Sets service image path in registry
-
C:\Windows\system32\fltmc.exeC:\Windows\system32\fltmc.exe unload DRMFilter4⤵
-
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\DCFAService64.exeDCFAService64.exe -start DRMFilter3⤵
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagenttrayicon.exedcagenttrayicon.exe -r3⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagenttrayicon.exedcagenttrayicon.exe -s3⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\mdmregistrationhandler_64.exemdmregistrationhandler_64.exe -c3⤵
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcpatchscan.exebin\dcpatchscan.exe -y 113⤵
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\UEMSMdmEnroll.exeUEMSMdmEnroll.exe3⤵
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\mdmregistrationhandler_64.exemdmregistrationhandler_64.exe -c4⤵
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\mdmregistrationhandler_64.exemdmregistrationhandler_64.exe -u "Admin" "https://jpword.cc:8443/mdm/client/v1/enroll?encapiKey=f0ea57cb&templateToken=41ae00152df79ad241ece5e27d605713&action=discover" "798" "d9fc69fd"4⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV15⤵
-
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcstatusutil.exedcstatusutil.exe -mdm 0 04⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV15⤵
-
-
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcuninstallsw.exebin\dcuninstallsw.exe3⤵
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcusbsummary.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcusbsummary.exe" -s ET_SUM3⤵
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\secaddoncrashanalyser.exebin\secaddoncrashanalyser.exe3⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV14⤵
-
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\CRU_Reporter.exe-FetchCRUReport3⤵
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe7za x -mx9 "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\driverfiles.7z" -o"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\" -y3⤵
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\DCFAService64.exeDCFAService64.exe -install DFMFilter3⤵
-
C:\Windows\system32\fltmc.exeC:\Windows\system32\fltmc.exe unload DFMFilter4⤵
-
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\DCFAService64.exeDCFAService64.exe -install DRMFilter3⤵
-
C:\Windows\system32\fltmc.exeC:\Windows\system32\fltmc.exe unload DRMFilter4⤵
-
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\DCFAService64.exeDCFAService64.exe -start DRMFilter3⤵
-
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\DCProcessMonitor.exeDCProcessMonitor.exe2⤵
- Executes dropped EXE
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\DeviceControl\bin\uesAgentService.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\DeviceControl\bin\uesAgentService.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\BitLockerMgmt\bin\4\BitlockerMgmt.exeBitlockerMgmt.exe -svd -lff "C:\Program Files (x86)\ManageEngine\UEMS_Agent\DeviceControl\..\data\GlobalVariables.json"2⤵
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\DeviceControl\bin\uesDevCtrlSummary.exe-s ET_ENUM 9 2 "Unknown"2⤵
- Drops file in Program Files directory
- Modifies data under HKEY_USERS
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\BitLockerMgmt\bin\4\BitlockerMgmt.exeBitlockerMgmt.exe -genblrk -lff "C:\Program Files (x86)\ManageEngine\UEMS_Agent\DeviceControl\..\data\GlobalVariables.json"2⤵
- Drops file in Program Files directory
- Modifies data under HKEY_USERS
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\DeviceControl\bin\driversetup64.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\DeviceControl\\bin\driversetup64.exe" -stop2⤵
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\EndpointIntelligence\Root\Public\Bin\ECEAService.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\EndpointIntelligence\Root\Public\Bin\ECEAService.exe"1⤵
- Drops file in System32 directory
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\EndpointIntelligence\Root\Public\Bin\ECEAReplication.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\EndpointIntelligence\Root\Public\Bin\ECEAReplication.exe" --version_manager_db_size=10485760 --ea_replication_root_path=client-data/intelligence/v1/ei-meta-data.json2⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\EndpointIntelligence\Root\Public\Bin\ECEAWebRequestHandler.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\EndpointIntelligence\Root\Public\Bin\ECEAWebRequestHandler.exe" --method=get --url="client-data/intelligence/v1/ei-meta-data.json" --file-path="C:\Program Files (x86)\ManageEngine\UEMS_Agent\EndpointIntelligence\Root\Public\Data\client-data\intelligence\v1\temp\ei-meta-data.json" --registry-key=ECEAConf_ei-meta-data --reporting-server=03⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Modifies data under HKEY_USERS
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\EndpointIntelligence\Root\Public\Bin\ECEAWebRequestHandler.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\EndpointIntelligence\Root\Public\Bin\ECEAWebRequestHandler.exe" --method=get --url="client-data\intelligence\v1\alertprofiles-meta.json" --file-path="C:\Program Files (x86)\ManageEngine\UEMS_Agent\EndpointIntelligence\Root\Public\Data\client-data\intelligence\v1\alertprofiles-meta.json" --reporting-server=03⤵
- Drops file in Program Files directory
- Modifies data under HKEY_USERS
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\EndpointIntelligence\Root\Public\Bin\ECEAWebRequestHandler.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\EndpointIntelligence\Root\Public\Bin\ECEAWebRequestHandler.exe" --method=get --url="client-data\intelligence\v1\target-meta.json" --file-path="C:\Program Files (x86)\ManageEngine\UEMS_Agent\EndpointIntelligence\Root\Public\Data\client-data\intelligence\v1\target-meta.json" --reporting-server=03⤵
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\EndpointIntelligence\Root\Public\Bin\ECEAWebRequestHandler.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\EndpointIntelligence\Root\Public\Bin\ECEAWebRequestHandler.exe" --method=get --url="client-data\intelligence\v1\emitter-policies.json" --file-path="C:\Program Files (x86)\ManageEngine\UEMS_Agent\EndpointIntelligence\Root\Public\Data\client-data\intelligence\v1\emitter-policies.json" --reporting-server=03⤵
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\EndpointIntelligence\Root\Public\Bin\ECEAWebRequestHandler.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\EndpointIntelligence\Root\Public\Bin\ECEAWebRequestHandler.exe" --method=get --url="client-data\intelligence\v1\rule-templates.json" --file-path="C:\Program Files (x86)\ManageEngine\UEMS_Agent\EndpointIntelligence\Root\Public\Data\client-data\intelligence\v1\rule-templates.json" --reporting-server=03⤵
- Drops file in Program Files directory
- Modifies data under HKEY_USERS
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\EndpointIntelligence\Root\Public\Bin\ECEAWebRequestHandler.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\EndpointIntelligence\Root\Public\Bin\ECEAWebRequestHandler.exe" --method=get --url="client-data\intelligence\v1\rulesets-meta.json" --file-path="C:\Program Files (x86)\ManageEngine\UEMS_Agent\EndpointIntelligence\Root\Public\Data\client-data\intelligence\v1\rulesets-meta.json" --reporting-server=03⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\EndpointIntelligence\Root\Public\Bin\ECEAWebRequestHandler.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\EndpointIntelligence\Root\Public\Bin\ECEAWebRequestHandler.exe" --method=get --url="client-data\intelligence\v1\rulesets\1.json" --file-path="C:\Program Files (x86)\ManageEngine\UEMS_Agent\EndpointIntelligence\Root\Public\Data\client-data\intelligence\v1\rulesets\1.json" --reporting-server=03⤵
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\EndpointIntelligence\Root\Public\Bin\ECEAWebRequestHandler.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\EndpointIntelligence\Root\Public\Bin\ECEAWebRequestHandler.exe" --method=get --url="client-data\intelligence\v1\telemetry-definition-agent.json" --file-path="C:\Program Files (x86)\ManageEngine\UEMS_Agent\EndpointIntelligence\Root\Public\Data\client-data\intelligence\v1\telemetry-definition-agent.json" --reporting-server=03⤵
- Modifies data under HKEY_USERS
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\EndpointIntelligence\Root\Public\Bin\ECEAWebRequestHandler.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\EndpointIntelligence\Root\Public\Bin\ECEAWebRequestHandler.exe" --method=get --url="client-data\intelligence\v1\criteria-meta.json" --file-path="C:\Program Files (x86)\ManageEngine\UEMS_Agent\EndpointIntelligence\Root\Public\Data\client-data\intelligence\v1\criteria-meta.json" --reporting-server=03⤵
- Modifies data under HKEY_USERS
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\EndpointIntelligence\Root\Public\Bin\ECEAWebRequestHandler.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\EndpointIntelligence\Root\Public\Bin\ECEAWebRequestHandler.exe" --method=get --url="client-data\intelligence\v1\agent-config.json" --file-path="C:\Program Files (x86)\ManageEngine\UEMS_Agent\EndpointIntelligence\Root\Public\Data\client-data\intelligence\v1\agent-config.json" --reporting-server=03⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\EndpointIntelligence\Root\Public\Bin\ECEAWebRequestHandler.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\EndpointIntelligence\Root\Public\Bin\ECEAWebRequestHandler.exe" --method=get --url="client-data\intelligence\v1\score-profiles.json" --file-path="C:\Program Files (x86)\ManageEngine\UEMS_Agent\EndpointIntelligence\Root\Public\Data\client-data\intelligence\v1\score-profiles.json" --reporting-server=03⤵
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\EndpointIntelligence\Root\Public\Bin\ECEAWebRequestHandler.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\EndpointIntelligence\Root\Public\Bin\ECEAWebRequestHandler.exe" --method=get --url="client-data\intelligence\v1\score_profiles\1.json" --file-path="C:\Program Files (x86)\ManageEngine\UEMS_Agent\EndpointIntelligence\Root\Public\Data\client-data\intelligence\v1\score_profiles\1.json" --reporting-server=03⤵
- Modifies data under HKEY_USERS
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\EndpointIntelligence\Root\Public\Bin\ECEAWebRequestHandler.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\EndpointIntelligence\Root\Public\Bin\ECEAWebRequestHandler.exe" --method=get --url="client-data\intelligence\v1\cg-meta.json" --file-path="C:\Program Files (x86)\ManageEngine\UEMS_Agent\EndpointIntelligence\Root\Public\Data\client-data\intelligence\v1\cg-meta.json" --reporting-server=03⤵
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\EndpointIntelligence\Root\Public\Bin\ECEAWebRequestHandler.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\EndpointIntelligence\Root\Public\Bin\ECEAWebRequestHandler.exe" --method=get --url="client-data\intelligence\v1\deployment-meta.json" --file-path="C:\Program Files (x86)\ManageEngine\UEMS_Agent\EndpointIntelligence\Root\Public\Data\client-data\intelligence\v1\deployment-meta.json" --reporting-server=03⤵
-
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\EndpointIntelligence\Root\Public\Bin\ECEADataManager.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\EndpointIntelligence\Root\Public\Bin\ECEADataManager.exe"2⤵
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\EndpointIntelligence\Root\Public\Bin\ECEAWebRequestHandler.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\EndpointIntelligence\Root\Public\Bin\ECEAWebRequestHandler.exe" --method=send --url="/intelligence/telemetry?customerId=1" --file-path="C:\Program Files (x86)\ManageEngine\UEMS_Agent\EndpointIntelligence\Root\Public\Summary\DataPost.json"3⤵
-
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\EndpointIntelligence\Root\Public\Bin\ECEATelemetry.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\EndpointIntelligence\Root\Public\Bin\ECEATelemetry.exe" --telemetry_ids=0 --mode=record2⤵
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\EndpointIntelligence\Root\Public\Bin\ECEAAlerts.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\EndpointIntelligence\Root\Public\Bin\ECEAAlerts.exe" --type=02⤵
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\EndpointIntelligence\Root\Public\Bin\ECEAEventTracer.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\EndpointIntelligence\Root\Public\Bin\ECEAEventTracer.exe" --conf_path="C:\Program Files (x86)\ManageEngine\UEMS_Agent\EndpointIntelligence\Root\Public\Bin\ECEAEventTracer.json"2⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\EndpointIntelligence\Root\Public\Bin\ECEAPerfmon.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\EndpointIntelligence\Root\Public\Bin\ECEAPerfmon.exe" --conf_path="C:\Program Files (x86)\ManageEngine\UEMS_Agent\EndpointIntelligence\Root\Public\Bin\ECEAPerfmon.json"2⤵
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\EndpointIntelligence\Root\Public\Bin\ECEAScore.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\EndpointIntelligence\Root\Public\Bin\ECEAScore.exe" --file-path="C:\Program Files (x86)\ManageEngine\UEMS_Agent\EndpointIntelligence\Root\Public\Data\client-data\intelligence\v1\score_profiles"2⤵
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\EndpointIntelligence\Root\Public\Bin\ECEATelemetry.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\EndpointIntelligence\Root\Public\Bin\ECEATelemetry.exe" --telemetry_ids=113,114,115,116,206,213,304,406,410,504,505,601,602,611,612,613,621,631 --telemetry_params=113:aggregationType:1,113:endTime:1786003358306,113:startTime:1785916958306,114:aggregationType:1,114:endTime:1786003358306,114:startTime:1785916958306,115:aggregationType:1,115:endTime:1786003358306,115:startTime:1785916958306,116:aggregationType:1,116:endTime:1786003358306,116:startTime:1785916958306,213:aggregationType:1,213:endTime:1786003358306,213:startTime:1785916958306,406:aggregationType:1,406:offset:604800000,410:aggregationType:1,410:offset:604800000,504:aggregationType:2,504:offset:604800000,505:aggregationType:2,505:offset:604800000,601:aggregationType:1,601:endTime:1786003358306,601:startTime:1785916958306,602:aggregationType:1,602:endTime:1786003358306,602:startTime:1785398558306,611:aggregationType:1,611:endTime:1786003358306,611:startTime:1785916958306,612:aggregationType:1,612:endTime:1786003358306,612:startTime:1785398558306,613:aggregationType:1,613:endTime:1786003358306,613:startTime:1785398558306,621:aggregationType:1,621:endTime:1786003358306,621:startTime:1785916958306,631:aggregationType:1,631:endTime:1786003358304,631:startTime:1785398558304 --mode=query3⤵
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\EndpointIntelligence\Root\Public\Bin\ECEAWebRequestHandler.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\EndpointIntelligence\Root\Public\Bin\ECEAWebRequestHandler.exe" --method=send --url="/intelligence/telemetry?actionToCall=metricScores" --file-path="C:\Program Files (x86)\ManageEngine\UEMS_Agent\EndpointIntelligence\Root\Public\FileUpload\EAScore\temp_1.json"3⤵
-
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\EndpointIntelligence\Root\Public\Bin\ECEAScanner.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\EndpointIntelligence\Root\Public\Bin\ECEAScanner.exe" --scan_type=Disk --file_path=intelligence\diskspace/3-Disk.json --filter=12⤵
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\EndpointIntelligence\Root\Public\Bin\ECEAScanner.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\EndpointIntelligence\Root\Public\Bin\ECEAScanner.exe" --scan_type=Disk --file_path=intelligence\diskspace/2-Disk.json --filter=02⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
-
-
C:\Program Files (x86)\ManageEngine\UEMS_Agent\EndpointIntelligence\Root\Public\Bin\ECEAScanner.exe"C:\Program Files (x86)\ManageEngine\UEMS_Agent\EndpointIntelligence\Root\Public\Bin\ECEAScanner.exe" --scan_type=EventViewerQuery2⤵
-
-
C:\Windows\system32\drivers\DFMFilter.sysC:\Windows\system32\drivers\DFMFilter.sys1⤵
-
C:\Windows\system32\drivers\DRMFilter.sysC:\Windows\system32\drivers\DRMFilter.sys1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s WManSvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p1⤵
-
C:\Windows\system32\deviceenroller.exe"C:\Windows\system32\deviceenroller.exe" /o "9C6D749A-8B75-4A05-B890-C6D4BDC492E1" /c1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k appmodel -p -s EntAppSvc1⤵
-
C:\Windows\system32\DeviceEnroller.exeC:\Windows\system32\deviceenroller.exe1⤵
-
C:\Windows\system32\omadmclient.exeC:\Windows\system32\omadmclient.exe1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵
-
C:\Windows\System32\SecurityHealthHost.exe\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding1⤵
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
3PowerShell
1Visual Basic
1Windows Command Shell
1Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Power Settings
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Defense Evasion
File and Directory Permissions Modification
1Modify Registry
2Subvert Trust Controls
2Install Root Certificate
2Virtualization/Sandbox Evasion
1Discovery
Peripheral Device Discovery
2Query Registry
6Remote System Discovery
1Software Discovery
1System Information Discovery
5System Location Discovery
1System Language Discovery
1System Network Configuration Discovery
1Internet Connection Discovery
1Virtualization/Sandbox Evasion
1Replay Monitor
Loading Replay Monitor...
Downloads
e5c0a9a.rbs
e5c0aa0.rbs
client.p12
7za.exe
ClientAuthHandler.dll
UEMSAgentCryptoHandler.dll
UEMSAgentHCHelper.exe
UEMSAgentHealthChecker_Temp.exe
agent_binaries.7z
dcagentregister.exe
dcagentservice.exe
dcagentupgrader_temp.exe
dcstatusutil.exe
component-details.json.gz1148.tmp
OSDetection.json
OSDetection.json.gz2740.tmp
OSDetection.json
agent-settings.xml
configuration-settings-dc-win10.xml
customer-meta-data.json3352.tmp
data-dictionary-framework.xml
data-dictionary-onpremise.xml
data-dictionary.xml
dynamic-variables.xml
inv-common-settings.xml
meta-data.xml4852.tmp
dcagent.dll
Lato.woff
dcmsghandler.ico
drop_down_icon.png
info.png
minimize_icon.svg
ECHttpHandler.log
EAHttpHandler.log
Network_Connection.log
UEMSAgentHCHelper.log
UEMSAgentHCHelper.log
dcClientAuthAccess.log
dcClientAuthAccess.log
dcClientAuthAccess.log
dcagentinstaller.log
dccomponentregister.log
dcdriver.log
dcpatchcpu.log
dcpatchcpu.log
dcrotatelog.log
dcrotatelog.log
dcrotatelog.log
devicepatchaccess.log
ecdatatransfer_access.log
meaaphelper.log
ues_BitLockerToGoRecKeyScan.log
ues_BitLockerToGoRecKeyScan.log
ues_BitLockerToGoRecKeyScan.log
ues_BitLockerToGoRecKeyScan.log
ues_BitLockerToGoVolScan.log
ues_BitLockerToGoVolScan.log
ues_BitLockerToGoVolScan.log
setAppPermission_Internal.bat
DMRootCA-Server.crt
DMRootCA.crt
DCAgentServerInfo.json
UEMSAgent.mst
setup.zip
c_volume.PNF
MSIFD6.tmp
dcagenttrayicon.log
dcagentlibxml2.dll
c_swdevice.PNF
machine.PNF
CM28467.tmp
186FF63A5A63259203FEFE810DE95CC4BC961785
186FF63A5A63259203FEFE810DE95CC4BC961785
memory/988-6209-0x0000000006E20000-0x0000000006EB6000-memory.dmp
memory/988-6205-0x00000000058C0000-0x0000000005C1B000-memory.dmp
memory/988-6212-0x00000000080C0000-0x000000000873C000-memory.dmp
memory/988-6211-0x0000000006200000-0x0000000006222000-memory.dmp
memory/988-6210-0x00000000061B0000-0x00000000061CA000-memory.dmp
memory/988-6207-0x0000000005CA0000-0x0000000005CEC000-memory.dmp
memory/988-6206-0x0000000005C60000-0x0000000005C7E000-memory.dmp
memory/988-6200-0x0000000004750000-0x0000000004786000-memory.dmp
memory/988-6201-0x0000000004EB0000-0x00000000054FA000-memory.dmp
memory/988-6202-0x00000000056D0000-0x0000000005736000-memory.dmp
memory/2060-3734-0x0000000005BC0000-0x0000000005BE2000-memory.dmp
memory/2060-3735-0x0000000005EB0000-0x000000000620B000-memory.dmp
memory/2060-3658-0x00000000047A0000-0x000000000480E000-memory.dmp
memory/2060-3732-0x0000000005C10000-0x0000000005CA4000-memory.dmp
memory/2060-3672-0x0000000005770000-0x00000000057D6000-memory.dmp
memory/2060-3671-0x0000000004BB0000-0x0000000004C42000-memory.dmp
memory/2060-3657-0x0000000004D60000-0x000000000531A000-memory.dmp
memory/2060-3656-0x0000000000EF0000-0x0000000000F7C000-memory.dmp
memory/4696-3814-0x0000000005150000-0x00000000054AB000-memory.dmp