52dd8b2f9145907477a6ebc4ad406c1e4b221ea967f1c2ce8bc23faa83b663d8

Resubmissions

09/08/2026, 06:55

260809-hpxm5abk318

09/08/2026, 06:47

260809-hkfttahc598

Analysis

max time kernel
108s
max time network
155s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/08/2026, 06:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Secure Viewer ([email protected]).msi
Size 27.3MB
Sample260809-hkfttahc59
SHA256 52dd8b2f9145907477a6ebc4ad406c1e4b221ea967f1c2ce8bc23faa83b663d8
MD5 2d5b101db58c7073cec364269388f334
SHA1 3e8f112c5370e823fd098407872c1a08c8be927c
SHA512 72b8c4fd5fb476948904c531e41cb0dbba185c30d98cf654a974ca291773933a7294e9d625fe494fd7ceb04c1bfb6700fefe9daded2bf9417f40167984ec0d5d
SSDEEP 786432:wpXnspKNBccxOckFiUPL6VHFb/J8HNg6R+v:0XnspMyFfUUPWZZBKnw
TLSH
T15C573319628B1671F7EBC2B101586BBE5A328CDE76F08831164974782578F733BFA9C1
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery execution ransomware spyware trojan

Malware Config

Signatures

Executes dropped EXE 15 IoCs

pid	Process
4060	breeze-agent.exe
5944	breeze-agent.exe
5524	breeze-watchdog.exe
3236	breeze-agent.exe
964	breeze-agent.exe
4372	breeze-agent.exe
3384	breeze-agent.exe
2272	breeze-agent.exe
2840	breeze-agent.exe
3012	breeze-agent.exe
5760	breeze-agent.exe
5440	breeze-agent.exe
4728	breeze-agent.exe
4940	breeze-agent.exe
964	breeze-watchdog.exe

Loads dropped DLL 1 IoCs

pid	Process
5944	breeze-agent.exe

Modifies file permissions 1 TTPs 3 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
956	icacls.exe
4028	icacls.exe
4276	icacls.exe

Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Badlisted process makes network request 1 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
2	5796	msiexec.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Command and Scripting Interpreter: PowerShell 1 TTPs 10 IoCs

Run Powershell to get system information.

execution

PowerShell

T1059.001

pid	Process
2204	powershell.exe
4392	powershell.exe
2720	powershell.exe
5836	powershell.exe
4520	powershell.exe
2928	powershell.exe
3192	powershell.exe
5552	powershell.exe
6004	powershell.exe
6116	powershell.exe

Enumerates connected drives 3 TTPs 47 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\F:	breeze-agent.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe

Drops file in Program Files directory 7 IoCs

description	ioc	Process
File created	C:\Program Files\Breeze\breeze-watchdog.exe	msiexec.exe
File created	C:\Program Files\Breeze\scripts\install\install-windows.ps1	msiexec.exe
File created	C:\Program Files\Breeze\scripts\install\remove-windows-task.ps1	msiexec.exe
File created	C:\Program Files\Breeze\service\windows\breeze-agent-user-task.xml	msiexec.exe
File created	C:\Program Files\Breeze\breeze-agent.exe	msiexec.exe
File created	C:\Program Files\Breeze\breeze-backup.exe	msiexec.exe
File created	C:\Program Files\Breeze\breeze-user-helper.exe	msiexec.exe

Drops file in Windows directory 17 IoCs

description	ioc	Process
File created	C:\Windows\Installer\e59b83a.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e59b83a.msi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{95686F40-BA92-4CE8-9A48-9830D2AF4FA1}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIC78C.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_b4fcafhw.rz1.psm1	powershell.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\SystemTemp\~DF81FC7F849AD5CC8C.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_rvb3ndj0.ens.ps1	powershell.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_e41iu2v1.qo3.psm1	powershell.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_m4cgwari.01x.ps1	powershell.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_4dbu1egf.dqd.ps1	powershell.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_5fdgmtjv.r55.psm1	powershell.exe
File created	C:\Windows\SystemTemp\~DFE88F3BB2036119CA.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_1vp4nqan.5ww.ps1	powershell.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_xdgmj0sq.pa3.psm1	powershell.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe

Hide Artifacts: Ignore Process Interrupts 1 TTPs 16 IoCs

Command interpreters often include specific commands/flags that ignore errors and other hangups.

defense_evasion

Ignore Process Interrupts

T1564.011

pid	Process
4980	powershell.exe
4044	powershell.exe
788	powershell.exe
3556	powershell.exe
712	powershell.exe
4392	powershell.exe
2716	powershell.exe
5836	powershell.exe
2204	powershell.exe
1428	powershell.exe
1736	powershell.exe
4520	powershell.exe
5772	powershell.exe
5052	powershell.exe
1204	powershell.exe
2928	powershell.exe

Launches sc.exe 11 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4376	sc.exe
3828	sc.exe
2100	sc.exe
2880	sc.exe
4244	sc.exe
2376	sc.exe
4368	sc.exe
4200	sc.exe
2672	sc.exe
5980	sc.exe
3300	sc.exe

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5804	cmd.exe
4428	cmd.exe
5332	cmd.exe
2268	cmd.exe

Modifies trusted root certificate store through registry 1 TTPs 2 IoCs

A root certificate was added, modified, or removed in the trusted certificate store registry paths.

defense_evasion

Install Root Certificate

T1553.004

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 6b000000010000002000000096bcec06264976f37460779acf28c5a7cfe8a3c0aae11a8ffcee05c0bddf08c614000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	breeze-agent.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 5c0000000100000004000000001000001900000001000000100000002fe1f70bb05d7c92335bc5e05b984da60f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f63030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e814000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e6b000000010000002000000096bcec06264976f37460779acf28c5a7cfe8a3c0aae11a8ffcee05c0bddf08c620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	breeze-agent.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
5332	cmd.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 00000000040000002fab76c52da068360000000000000000000000000000000000000000000000000000000000000000000000000000000000001071020000000000c01200000000000000000000000027010100008838012fab76c50000000000001071020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d0830200000000006025c501000000000000000000000700010000e841012fab76c5000000000000d08302000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9c701000000000000050000000000000000000000070001000098d4e32fab76c500000000000030a9c7010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9cc0100000000000005000000000000000000000007000100009854e62fab76c500000000000030a9cc01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	breeze-agent.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	breeze-agent.exe

GoLang User-Agent 1 IoCs

Uses default user-agent string defined by GoLang HTTP packages.

description	flow	ioc
HTTP User-Agent header	6	Go-http-client/1.1

Kills process with taskkill 1 IoCs

defense_evasion

pid	Process
5772	taskkill.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	breeze-agent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	breeze-agent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	breeze-agent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	breeze-agent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	breeze-agent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	breeze-agent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	breeze-agent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	breeze-agent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	breeze-agent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	breeze-agent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	breeze-agent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	breeze-agent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	breeze-agent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	breeze-agent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	breeze-agent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	breeze-agent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	breeze-agent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	breeze-agent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	breeze-agent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	breeze-agent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	breeze-agent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	breeze-agent.exe

Modifies system certificate store 2 TTPs 1 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8	breeze-agent.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2924	msiexec.exe
2924	msiexec.exe
4060	breeze-agent.exe
4060	breeze-agent.exe
4060	breeze-agent.exe
4060	breeze-agent.exe
4060	breeze-agent.exe
4060	breeze-agent.exe
5128	wmic.exe
5128	wmic.exe
5128	wmic.exe
5128	wmic.exe
2204	powershell.exe
2204	powershell.exe
2204	powershell.exe
3192	powershell.exe
3192	powershell.exe
3192	powershell.exe
5944	breeze-agent.exe
5944	breeze-agent.exe
5944	breeze-agent.exe
5944	breeze-agent.exe
5944	breeze-agent.exe
5944	breeze-agent.exe
5944	breeze-agent.exe
5524	breeze-watchdog.exe
5524	breeze-watchdog.exe
5524	breeze-watchdog.exe
5524	breeze-watchdog.exe
5524	breeze-watchdog.exe
5944	breeze-agent.exe
5944	breeze-agent.exe
5944	breeze-agent.exe
5552	powershell.exe
5552	powershell.exe
5552	powershell.exe
2528	wmic.exe
2528	wmic.exe
2528	wmic.exe
2528	wmic.exe
4392	powershell.exe
4392	powershell.exe
4392	powershell.exe
3236	breeze-agent.exe
3236	breeze-agent.exe
3236	breeze-agent.exe
3236	breeze-agent.exe
3236	breeze-agent.exe
3236	breeze-agent.exe
3236	breeze-agent.exe
964	breeze-agent.exe
964	breeze-agent.exe
964	breeze-agent.exe
964	breeze-agent.exe
964	breeze-agent.exe
964	breeze-agent.exe
964	breeze-agent.exe
4372	breeze-agent.exe
4372	breeze-agent.exe
4372	breeze-agent.exe
4372	breeze-agent.exe
4372	breeze-agent.exe
4372	breeze-agent.exe
4372	breeze-agent.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	5796	msiexec.exe
Token: SeIncreaseQuotaPrivilege	5796	msiexec.exe
Token: SeSecurityPrivilege	2924	msiexec.exe
Token: SeCreateTokenPrivilege	5796	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	5796	msiexec.exe
Token: SeLockMemoryPrivilege	5796	msiexec.exe
Token: SeIncreaseQuotaPrivilege	5796	msiexec.exe
Token: SeMachineAccountPrivilege	5796	msiexec.exe
Token: SeTcbPrivilege	5796	msiexec.exe
Token: SeSecurityPrivilege	5796	msiexec.exe
Token: SeTakeOwnershipPrivilege	5796	msiexec.exe
Token: SeLoadDriverPrivilege	5796	msiexec.exe
Token: SeSystemProfilePrivilege	5796	msiexec.exe
Token: SeSystemtimePrivilege	5796	msiexec.exe
Token: SeProfSingleProcessPrivilege	5796	msiexec.exe
Token: SeIncBasePriorityPrivilege	5796	msiexec.exe
Token: SeCreatePagefilePrivilege	5796	msiexec.exe
Token: SeCreatePermanentPrivilege	5796	msiexec.exe
Token: SeBackupPrivilege	5796	msiexec.exe
Token: SeRestorePrivilege	5796	msiexec.exe
Token: SeShutdownPrivilege	5796	msiexec.exe
Token: SeDebugPrivilege	5796	msiexec.exe
Token: SeAuditPrivilege	5796	msiexec.exe
Token: SeSystemEnvironmentPrivilege	5796	msiexec.exe
Token: SeChangeNotifyPrivilege	5796	msiexec.exe
Token: SeRemoteShutdownPrivilege	5796	msiexec.exe
Token: SeUndockPrivilege	5796	msiexec.exe
Token: SeSyncAgentPrivilege	5796	msiexec.exe
Token: SeEnableDelegationPrivilege	5796	msiexec.exe
Token: SeManageVolumePrivilege	5796	msiexec.exe
Token: SeImpersonatePrivilege	5796	msiexec.exe
Token: SeCreateGlobalPrivilege	5796	msiexec.exe
Token: SeBackupPrivilege	4340	vssvc.exe
Token: SeRestorePrivilege	4340	vssvc.exe
Token: SeAuditPrivilege	4340	vssvc.exe
Token: SeBackupPrivilege	2924	msiexec.exe
Token: SeRestorePrivilege	2924	msiexec.exe
Token: SeRestorePrivilege	2924	msiexec.exe
Token: SeTakeOwnershipPrivilege	2924	msiexec.exe
Token: SeDebugPrivilege	5772	taskkill.exe
Token: SeBackupPrivilege	5644	srtasks.exe
Token: SeRestorePrivilege	5644	srtasks.exe
Token: SeSecurityPrivilege	5644	srtasks.exe
Token: SeTakeOwnershipPrivilege	5644	srtasks.exe
Token: SeRestorePrivilege	2924	msiexec.exe
Token: SeTakeOwnershipPrivilege	2924	msiexec.exe
Token: SeBackupPrivilege	5644	srtasks.exe
Token: SeRestorePrivilege	5644	srtasks.exe
Token: SeSecurityPrivilege	5644	srtasks.exe
Token: SeTakeOwnershipPrivilege	5644	srtasks.exe
Token: SeDebugPrivilege	4060	breeze-agent.exe
Token: SeAssignPrimaryTokenPrivilege	5128	wmic.exe
Token: SeIncreaseQuotaPrivilege	5128	wmic.exe
Token: SeSecurityPrivilege	5128	wmic.exe
Token: SeTakeOwnershipPrivilege	5128	wmic.exe
Token: SeLoadDriverPrivilege	5128	wmic.exe
Token: SeBackupPrivilege	5128	wmic.exe
Token: SeRestorePrivilege	5128	wmic.exe
Token: SeShutdownPrivilege	5128	wmic.exe
Token: SeAssignPrimaryTokenPrivilege	5128	wmic.exe
Token: SeIncreaseQuotaPrivilege	5128	wmic.exe
Token: SeSecurityPrivilege	5128	wmic.exe
Token: SeTakeOwnershipPrivilege	5128	wmic.exe
Token: SeLoadDriverPrivilege	5128	wmic.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
5796	msiexec.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
5796	msiexec.exe
2924	msiexec.exe

Suspicious use of WriteProcessMemory 42 IoCs

description	pid	Process	procid_target
PID 2924 wrote to memory of 5644	2924	msiexec.exe	94
PID 2924 wrote to memory of 5332	2924	msiexec.exe	96
PID 5332 wrote to memory of 4200	5332	cmd.exe	98
PID 5332 wrote to memory of 2672	5332	cmd.exe	99
PID 5332 wrote to memory of 4376	5332	cmd.exe	100
PID 5332 wrote to memory of 5980	5332	cmd.exe	101
PID 5332 wrote to memory of 3828	5332	cmd.exe	102
PID 5332 wrote to memory of 3860	5332	cmd.exe	103
PID 5332 wrote to memory of 5772	5332	cmd.exe	104
PID 2924 wrote to memory of 2268	2924	msiexec.exe	106
PID 2268 wrote to memory of 2100	2268	cmd.exe	132
PID 2268 wrote to memory of 2880	2268	cmd.exe	109
PID 2268 wrote to memory of 3300	2268	cmd.exe	110
PID 2924 wrote to memory of 5804	2924	msiexec.exe	111
PID 5804 wrote to memory of 956	5804	cmd.exe	114
PID 5804 wrote to memory of 4028	5804	cmd.exe	115
PID 5804 wrote to memory of 4276	5804	cmd.exe	116
PID 2924 wrote to memory of 4060	2924	msiexec.exe	117
PID 4060 wrote to memory of 5128	4060	breeze-agent.exe	119
PID 4060 wrote to memory of 2204	4060	breeze-agent.exe	120
PID 4060 wrote to memory of 4244	4060	breeze-agent.exe	121
PID 2924 wrote to memory of 3192	2924	msiexec.exe	122
PID 5944 wrote to memory of 5552	5944	breeze-agent.exe	128
PID 2924 wrote to memory of 4428	2924	msiexec.exe	129
PID 5944 wrote to memory of 2528	5944	breeze-agent.exe	131
PID 4428 wrote to memory of 2376	4428	cmd.exe	133
PID 4428 wrote to memory of 4368	4428	cmd.exe	134
PID 5944 wrote to memory of 4392	5944	breeze-agent.exe	135
PID 5944 wrote to memory of 1428	5944	breeze-agent.exe	147
PID 5944 wrote to memory of 5052	5944	breeze-agent.exe	150
PID 5944 wrote to memory of 4980	5944	breeze-agent.exe	151
PID 5944 wrote to memory of 964	5944	breeze-agent.exe	152
PID 5944 wrote to memory of 1736	5944	breeze-agent.exe	153
PID 5944 wrote to memory of 1204	5944	breeze-agent.exe	154
PID 5944 wrote to memory of 6004	5944	breeze-agent.exe	155
PID 5944 wrote to memory of 4044	5944	breeze-agent.exe	157
PID 5944 wrote to memory of 788	5944	breeze-agent.exe	158
PID 5944 wrote to memory of 3556	5944	breeze-agent.exe	159
PID 5944 wrote to memory of 2720	5944	breeze-agent.exe	160
PID 5944 wrote to memory of 2928	5944	breeze-agent.exe	161
PID 5944 wrote to memory of 712	5944	breeze-agent.exe	162
PID 5944 wrote to memory of 2716	5944	breeze-agent.exe	163

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I "C:\Users\Admin\AppData\Local\Temp\Secure Viewer ([email protected]).msi"
1⤵
- Badlisted process makes network request
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:5796

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2924
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:5644
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd.exe" /c sc failure BreezeWatchdog reset= 0 actions= "" >nul 2>&1 & sc failure BreezeAgent reset= 0 actions= "" >nul 2>&1 & sc stop BreezeWatchdog >nul 2>&1 & sc stop BreezeAgent >nul 2>&1 & (sc query BreezeAgent | findstr "PENDING RUNNING" >nul 2>&1 && ping -n 4 127.0.0.1 >nul) & taskkill /F /IM breeze-agent.exe /IM breeze-user-helper.exe /IM breeze-watchdog.exe /IM breeze-desktop-helper.exe /IM breeze-backup.exe >nul 2>&1 & exit /b 0
  2⤵
  - Executes a command shell one-liner
  - System Network Configuration Discovery: Internet Connection Discovery
  - Suspicious use of WriteProcessMemory
  PID:5332
- - C:\Windows\System32\sc.exe
    sc failure BreezeWatchdog reset= 0 actions= ""
    3⤵
    - Launches sc.exe
    PID:4200
- - C:\Windows\System32\sc.exe
    sc failure BreezeAgent reset= 0 actions= ""
    3⤵
    - Launches sc.exe
    PID:2672
- - C:\Windows\System32\sc.exe
    sc stop BreezeWatchdog
    3⤵
    - Launches sc.exe
    PID:4376
- - C:\Windows\System32\sc.exe
    sc stop BreezeAgent
    3⤵
    - Launches sc.exe
    PID:5980
- - C:\Windows\System32\sc.exe
    sc query BreezeAgent
    3⤵
    - Launches sc.exe
    PID:3828
- - C:\Windows\System32\findstr.exe
    findstr "PENDING RUNNING"
    3⤵
    PID:3860
- - C:\Windows\System32\taskkill.exe
    taskkill /F /IM breeze-agent.exe /IM breeze-user-helper.exe /IM breeze-watchdog.exe /IM breeze-desktop-helper.exe /IM breeze-backup.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5772
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd.exe" /c sc failure BreezeWatchdog reset= 0 actions= "" >nul 2>&1 & sc failure BreezeAgent reset= 0 actions= "" >nul 2>&1 & sc stop BreezeWatchdog >nul 2>&1 & exit /b 0
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2268
- - C:\Windows\System32\sc.exe
    sc failure BreezeWatchdog reset= 0 actions= ""
    3⤵
    - Launches sc.exe
    PID:2100
- - C:\Windows\System32\sc.exe
    sc failure BreezeAgent reset= 0 actions= ""
    3⤵
    - Launches sc.exe
    PID:2880
- - C:\Windows\System32\sc.exe
    sc stop BreezeWatchdog
    3⤵
    - Launches sc.exe
    PID:3300
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd.exe" /c (if not exist "C:\ProgramData\Breeze\." mkdir "C:\ProgramData\Breeze\.") && (if not exist "C:\ProgramData\Breeze\data\." mkdir "C:\ProgramData\Breeze\data\.") && (if not exist "C:\ProgramData\Breeze\logs\." mkdir "C:\ProgramData\Breeze\logs\.") && icacls "C:\ProgramData\Breeze\." /inheritance:r /grant:r *S-1-5-18:(OI)(CI)F *S-1-5-32-544:(OI)(CI)F && icacls "C:\ProgramData\Breeze\data\." /inheritance:r /grant:r *S-1-5-18:(OI)(CI)F *S-1-5-32-544:(OI)(CI)F && icacls "C:\ProgramData\Breeze\logs\." /inheritance:r /grant:r *S-1-5-18:(OI)(CI)F *S-1-5-32-544:(OI)(CI)F
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5804
- - C:\Windows\System32\icacls.exe
    icacls "C:\ProgramData\Breeze\." /inheritance:r /grant:r *S-1-5-18:(OI)(CI)F *S-1-5-32-544:(OI)(CI)F
    3⤵
    - Modifies file permissions
    PID:956
- - C:\Windows\System32\icacls.exe
    icacls "C:\ProgramData\Breeze\data\." /inheritance:r /grant:r *S-1-5-18:(OI)(CI)F *S-1-5-32-544:(OI)(CI)F
    3⤵
    - Modifies file permissions
    PID:4028
- - C:\Windows\System32\icacls.exe
    icacls "C:\ProgramData\Breeze\logs\." /inheritance:r /grant:r *S-1-5-18:(OI)(CI)F *S-1-5-32-544:(OI)(CI)F
    3⤵
    - Modifies file permissions
    PID:4276
- C:\Program Files\Breeze\breeze-agent.exe
  "C:\Program Files\Breeze\breeze-agent.exe" bootstrap --install-data "C:\Users\Admin\AppData\Local\Temp\Secure Viewer ([email protected]).msi||" --quiet
  2⤵
  - Executes dropped EXE
  - Modifies trusted root certificate store through registry
  - Modifies data under HKEY_USERS
  - Modifies system certificate store
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4060
- - C:\Windows\System32\Wbem\wmic.exe
    wmic systemenclosure get ChassisTypes /format:list
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5128
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -NonInteractive -Command "[Console]::OutputEncoding=[System.Text.Encoding]::UTF8; $ErrorActionPreference = 'SilentlyContinue' function Get-WmiSafe($ClassName) { $r = $null if (Get-Command Get-CimInstance -ErrorAction SilentlyContinue) { try { $r = Get-CimInstance -ClassName $ClassName -ErrorAction Stop } catch {} } if ($null -eq $r -and (Get-Command Get-WmiObject -ErrorAction SilentlyContinue)) { try { $r = Get-WmiObject -Class $ClassName -ErrorAction Stop } catch {} } $r } $bios = @(Get-WmiSafe 'Win32_BIOS') | Select-Object -First 1 $board = @(Get-WmiSafe 'Win32_BaseBoard') | Select-Object -First 1 $sys = @(Get-WmiSafe 'Win32_ComputerSystem') | Select-Object -First 1 $gpus = @(@(Get-WmiSafe 'Win32_VideoController') | Where-Object { $_ -and $_.Name } | Select-Object -ExpandProperty Name | ForEach-Object { ([string]$_).Trim() } | Where-Object { $_ -ne '' } | Select-Object -Unique) [PSCustomObject]@{ BiosSerial = if ($bios) { ([string]$bios.SerialNumber).Trim() } else { '' } BiosVersion = if ($bios) { ([string]$bios.SMBIOSBIOSVersion).Trim() } else { '' } BoardSerial = if ($board) { ([string]$board.SerialNumber).Trim() } else { '' } BoardManufacturer = if ($board) { ([string]$board.Manufacturer).Trim() } else { '' } BoardProduct = if ($board) { ([string]$board.Product).Trim() } else { '' } BoardVersion = if ($board) { ([string]$board.Version).Trim() } else { '' } SysManufacturer = if ($sys) { ([string]$sys.Manufacturer).Trim() } else { '' } SysModel = if ($sys) { ([string]$sys.Model).Trim() } else { '' } GPUNames = $gpus } | ConvertTo-Json -Compress "
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Drops file in Windows directory
    - Hide Artifacts: Ignore Process Interrupts
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    PID:2204
- - C:\Windows\system32\sc.exe
    sc query BreezeAgent
    3⤵
    - Launches sc.exe
    PID:4244
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Bypass -File "C:\Program Files\Breeze\scripts\install\install-windows.ps1"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Drops file in Windows directory
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:3192
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd.exe" /c "sc failure BreezeAgent reset= 86400 actions= restart/5000/restart/10000/restart/30000 & sc failure BreezeWatchdog reset= 86400 actions= restart/5000/restart/10000/restart/30000"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4428
- - C:\Windows\System32\sc.exe
    sc failure BreezeAgent reset= 86400 actions= restart/5000/restart/10000/restart/30000
    3⤵
    - Launches sc.exe
    PID:2376
- - C:\Windows\System32\sc.exe
    sc failure BreezeWatchdog reset= 86400 actions= restart/5000/restart/10000/restart/30000
    3⤵
    - Launches sc.exe
    PID:4368

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:4340

C:\Program Files\Breeze\breeze-agent.exe
"C:\Program Files\Breeze\breeze-agent.exe" run
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5944
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -NonInteractive -Command "Get-Command Add-AppxProvisionedPackage -ErrorAction Stop"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:5552
- C:\Windows\System32\Wbem\wmic.exe
  wmic systemenclosure get ChassisTypes /format:list
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2528
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -NonInteractive -Command "[Console]::OutputEncoding=[System.Text.Encoding]::UTF8; $ErrorActionPreference = 'SilentlyContinue' function Get-WmiSafe($ClassName) { $r = $null if (Get-Command Get-CimInstance -ErrorAction SilentlyContinue) { try { $r = Get-CimInstance -ClassName $ClassName -ErrorAction Stop } catch {} } if ($null -eq $r -and (Get-Command Get-WmiObject -ErrorAction SilentlyContinue)) { try { $r = Get-WmiObject -Class $ClassName -ErrorAction Stop } catch {} } $r } $bios = @(Get-WmiSafe 'Win32_BIOS') | Select-Object -First 1 $board = @(Get-WmiSafe 'Win32_BaseBoard') | Select-Object -First 1 $sys = @(Get-WmiSafe 'Win32_ComputerSystem') | Select-Object -First 1 $gpus = @(@(Get-WmiSafe 'Win32_VideoController') | Where-Object { $_ -and $_.Name } | Select-Object -ExpandProperty Name | ForEach-Object { ([string]$_).Trim() } | Where-Object { $_ -ne '' } | Select-Object -Unique) [PSCustomObject]@{ BiosSerial = if ($bios) { ([string]$bios.SerialNumber).Trim() } else { '' } BiosVersion = if ($bios) { ([string]$bios.SMBIOSBIOSVersion).Trim() } else { '' } BoardSerial = if ($board) { ([string]$board.SerialNumber).Trim() } else { '' } BoardManufacturer = if ($board) { ([string]$board.Manufacturer).Trim() } else { '' } BoardProduct = if ($board) { ([string]$board.Product).Trim() } else { '' } BoardVersion = if ($board) { ([string]$board.Version).Trim() } else { '' } SysManufacturer = if ($sys) { ([string]$sys.Manufacturer).Trim() } else { '' } SysModel = if ($sys) { ([string]$sys.Model).Trim() } else { '' } GPUNames = $gpus } | ConvertTo-Json -Compress "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Hide Artifacts: Ignore Process Interrupts
  - Suspicious behavior: EnumeratesProcesses
  PID:4392
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -NonInteractive -Command "Get-NetAdapter -Name 'Ethernet' -ErrorAction SilentlyContinue | Select-Object -ExpandProperty ReceiveLinkSpeed"
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  PID:1428
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -NonInteractive -Command "Get-NetAdapter -Name 'Loopback Pseudo-Interface 1' -ErrorAction SilentlyContinue | Select-Object -ExpandProperty ReceiveLinkSpeed"
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  PID:5052
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -NonInteractive -Command "Get-NetAdapter -InterfaceDescription 'Loopback Pseudo-Interface 1' -ErrorAction SilentlyContinue | Select-Object -ExpandProperty ReceiveLinkSpeed"
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  PID:4980
- C:\Program Files\Breeze\breeze-watchdog.exe
  "C:\Program Files\Breeze\breeze-watchdog.exe" status
  2⤵
  - Executes dropped EXE
  PID:964
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -NonInteractive -Command "Get-NetIPInterface -AddressFamily IPv4 -ErrorAction SilentlyContinue | Where-Object { $_.Dhcp -eq 'Enabled' } | Select-Object -ExpandProperty InterfaceAlias"
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  PID:1736
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -NonInteractive -Command "[Console]::OutputEncoding=[System.Text.Encoding]::UTF8;Get-WinEvent -FilterHashtable @{LogName='System'; Id=41,1074,6005,6006,6008,6009; StartTime='2026-08-08T06:48:26Z'} -MaxEvents 50 -ErrorAction SilentlyContinue | Select-Object RecordId, LogName, Level, LevelDisplayName, @{N='TimeCreated';E={$_.TimeCreated.ToString('o')}}, ProviderName, Id, Message | ConvertTo-Json -Depth 2 -Compress"
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  PID:1204
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -ExecutionPolicy Bypass -Command "[Console]::InputEncoding = [Console]::OutputEncoding = [System.Text.Encoding]::UTF8; & 'C:\Users\Admin\AppData\Local\Temp\breeze-scripts\breeze_31355446df39c226.ps1'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:6004
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -NonInteractive -Command "[Console]::OutputEncoding=[System.Text.Encoding]::UTF8;Get-WinEvent -FilterHashtable @{LogName='Security'; Level=1,2,3; StartTime='2026-08-08T06:48:26Z'} -MaxEvents 50 -ErrorAction SilentlyContinue | Select-Object RecordId, LogName, Level, LevelDisplayName, @{N='TimeCreated';E={$_.TimeCreated.ToString('o')}}, ProviderName, Id, Message | ConvertTo-Json -Depth 2 -Compress"
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  PID:4044
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -NonInteractive -Command "[Console]::OutputEncoding=[System.Text.Encoding]::UTF8;Get-WinEvent -FilterHashtable @{LogName='System'; Level=1,2; StartTime='2026-08-08T06:48:26Z'} -MaxEvents 50 -ErrorAction SilentlyContinue | Select-Object RecordId, LogName, Level, LevelDisplayName, @{N='TimeCreated';E={$_.TimeCreated.ToString('o')}}, ProviderName, Id, Message | ConvertTo-Json -Depth 2 -Compress"
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  PID:788
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -NonInteractive -Command "[Console]::OutputEncoding=[System.Text.Encoding]::UTF8;Get-WinEvent -FilterHashtable @{LogName='Application'; Level=1,2; StartTime='2026-08-08T06:48:26Z'} -MaxEvents 50 -ErrorAction SilentlyContinue | Select-Object RecordId, LogName, Level, LevelDisplayName, @{N='TimeCreated';E={$_.TimeCreated.ToString('o')}}, ProviderName, Id, Message | ConvertTo-Json -Depth 2 -Compress"
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  PID:3556
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -NonInteractive -Command " Get-CimInstance -ClassName Win32_Service -ErrorAction Stop | Select-Object Name, DisplayName, State, StartMode, StartName | ConvertTo-Json -Compress -Depth 2 "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:2720
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -NonInteractive -Command " $items = @() $paths = @( @{ Hive='HKLM'; Path='HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' }, @{ Hive='HKCU'; Path='HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' } ) foreach ($p in $paths) { $props = Get-ItemProperty -Path $p.Path -ErrorAction SilentlyContinue if ($props) { $props.PSObject.Properties | Where-Object { $_.Name -notlike 'PS*' -and $_.Name -ne '(default)' } | ForEach-Object { $items += @{ Name = $_.Name Value = [string]$_.Value Hive = $p.Hive } } } } $items | ConvertTo-Json -Compress -Depth 2 "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Hide Artifacts: Ignore Process Interrupts
  PID:2928
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -NonInteractive -Command " $tasks = Get-ScheduledTask -ErrorAction SilentlyContinue | ForEach-Object { $actions = @($_.Actions | ForEach-Object { $exec = [string]$_.Execute $args = [string]$_.Arguments if ($args) { \"$exec $args\" } else { $exec } }) -join '; ' $triggers = @($_.Triggers | ForEach-Object { if ($_.StartBoundary) { [string]$_.StartBoundary } else { $_.ToString() } }) -join '; ' [PSCustomObject]@{ Name = [string]$_.TaskName Path = [string]$_.TaskPath Status = [string]$_.State Schedule = [string]$triggers Command = [string]$actions } } $tasks | ConvertTo-Json -Compress -Depth 4 "
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  PID:712
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -NonInteractive -Command " Get-CimInstance Win32_UserAccount -Filter \"LocalAccount=True\" -ErrorAction SilentlyContinue | Select-Object Name, FullName, Disabled, Lockout | ConvertTo-Json -Compress -Depth 2 "
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  PID:2716
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -NonInteractive -Command "[Console]::OutputEncoding=[System.Text.Encoding]::UTF8;Get-Service | Where-Object {$_.Status -eq 'Running'} | Select-Object -ExpandProperty Name"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:6116
- C:\Windows\System32\Wbem\wmic.exe
  wmic systemenclosure get ChassisTypes /format:list
  2⤵
  PID:4104
- C:\Windows\System32\Wbem\wmic.exe
  wmic systemenclosure get ChassisTypes /format:list
  2⤵
  PID:2080
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -NonInteractive -Command "[Console]::OutputEncoding=[System.Text.Encoding]::UTF8; $ErrorActionPreference = 'SilentlyContinue' function Get-WmiSafe($ClassName) { $r = $null if (Get-Command Get-CimInstance -ErrorAction SilentlyContinue) { try { $r = Get-CimInstance -ClassName $ClassName -ErrorAction Stop } catch {} } if ($null -eq $r -and (Get-Command Get-WmiObject -ErrorAction SilentlyContinue)) { try { $r = Get-WmiObject -Class $ClassName -ErrorAction Stop } catch {} } $r } $bios = @(Get-WmiSafe 'Win32_BIOS') | Select-Object -First 1 $board = @(Get-WmiSafe 'Win32_BaseBoard') | Select-Object -First 1 $sys = @(Get-WmiSafe 'Win32_ComputerSystem') | Select-Object -First 1 $gpus = @(@(Get-WmiSafe 'Win32_VideoController') | Where-Object { $_ -and $_.Name } | Select-Object -ExpandProperty Name | ForEach-Object { ([string]$_).Trim() } | Where-Object { $_ -ne '' } | Select-Object -Unique) [PSCustomObject]@{ BiosSerial = if ($bios) { ([string]$bios.SerialNumber).Trim() } else { '' } BiosVersion = if ($bios) { ([string]$bios.SMBIOSBIOSVersion).Trim() } else { '' } BoardSerial = if ($board) { ([string]$board.SerialNumber).Trim() } else { '' } BoardManufacturer = if ($board) { ([string]$board.Manufacturer).Trim() } else { '' } BoardProduct = if ($board) { ([string]$board.Product).Trim() } else { '' } BoardVersion = if ($board) { ([string]$board.Version).Trim() } else { '' } SysManufacturer = if ($sys) { ([string]$sys.Manufacturer).Trim() } else { '' } SysModel = if ($sys) { ([string]$sys.Model).Trim() } else { '' } GPUNames = $gpus } | ConvertTo-Json -Compress "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Hide Artifacts: Ignore Process Interrupts
  PID:5836
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -NonInteractive -Command "[Console]::OutputEncoding=[System.Text.Encoding]::UTF8; $ErrorActionPreference = 'SilentlyContinue' function Get-WmiSafe($ClassName) { $r = $null if (Get-Command Get-CimInstance -ErrorAction SilentlyContinue) { try { $r = Get-CimInstance -ClassName $ClassName -ErrorAction Stop } catch {} } if ($null -eq $r -and (Get-Command Get-WmiObject -ErrorAction SilentlyContinue)) { try { $r = Get-WmiObject -Class $ClassName -ErrorAction Stop } catch {} } $r } $bios = @(Get-WmiSafe 'Win32_BIOS') | Select-Object -First 1 $board = @(Get-WmiSafe 'Win32_BaseBoard') | Select-Object -First 1 $sys = @(Get-WmiSafe 'Win32_ComputerSystem') | Select-Object -First 1 $gpus = @(@(Get-WmiSafe 'Win32_VideoController') | Where-Object { $_ -and $_.Name } | Select-Object -ExpandProperty Name | ForEach-Object { ([string]$_).Trim() } | Where-Object { $_ -ne '' } | Select-Object -Unique) [PSCustomObject]@{ BiosSerial = if ($bios) { ([string]$bios.SerialNumber).Trim() } else { '' } BiosVersion = if ($bios) { ([string]$bios.SMBIOSBIOSVersion).Trim() } else { '' } BoardSerial = if ($board) { ([string]$board.SerialNumber).Trim() } else { '' } BoardManufacturer = if ($board) { ([string]$board.Manufacturer).Trim() } else { '' } BoardProduct = if ($board) { ([string]$board.Product).Trim() } else { '' } BoardVersion = if ($board) { ([string]$board.Version).Trim() } else { '' } SysManufacturer = if ($sys) { ([string]$sys.Manufacturer).Trim() } else { '' } SysModel = if ($sys) { ([string]$sys.Model).Trim() } else { '' } GPUNames = $gpus } | ConvertTo-Json -Compress "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Hide Artifacts: Ignore Process Interrupts
  PID:4520
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -NonInteractive -Command "Get-NetIPInterface -AddressFamily IPv4 -ErrorAction SilentlyContinue | Where-Object { $_.Dhcp -eq 'Enabled' } | Select-Object -ExpandProperty InterfaceAlias"
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  PID:5772

C:\Program Files\Breeze\breeze-watchdog.exe
"C:\Program Files\Breeze\breeze-watchdog.exe" run
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:5524

C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\wbem\wmiprvse.exe -Embedding
1⤵
PID:2100

C:\Program Files\Breeze\breeze-agent.exe
"C:\Program Files\Breeze\breeze-agent.exe" run
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:3236

C:\Program Files\Breeze\breeze-agent.exe
"C:\Program Files\Breeze\breeze-agent.exe" run
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:964

C:\Program Files\Breeze\breeze-agent.exe
"C:\Program Files\Breeze\breeze-agent.exe" run
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:4372

C:\Program Files\Breeze\breeze-agent.exe
"C:\Program Files\Breeze\breeze-agent.exe" run
1⤵
- Executes dropped EXE
PID:3384

C:\Program Files\Breeze\breeze-agent.exe
"C:\Program Files\Breeze\breeze-agent.exe" run
1⤵
- Executes dropped EXE
PID:2272

C:\Program Files\Breeze\breeze-agent.exe
"C:\Program Files\Breeze\breeze-agent.exe" run
1⤵
- Executes dropped EXE
PID:2840

C:\Program Files\Breeze\breeze-agent.exe
"C:\Program Files\Breeze\breeze-agent.exe" run
1⤵
- Executes dropped EXE
PID:3012

C:\Program Files\Breeze\breeze-agent.exe
"C:\Program Files\Breeze\breeze-agent.exe" run
1⤵
- Executes dropped EXE
PID:5760

C:\Program Files\Breeze\breeze-agent.exe
"C:\Program Files\Breeze\breeze-agent.exe" run
1⤵
- Executes dropped EXE
PID:5440

C:\Program Files\Breeze\breeze-agent.exe
"C:\Program Files\Breeze\breeze-agent.exe" run
1⤵
- Executes dropped EXE
PID:4728

C:\Program Files\Breeze\breeze-agent.exe
"C:\Program Files\Breeze\breeze-agent.exe" run
1⤵
- Executes dropped EXE
PID:4940

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

System Services

T1569

Service Execution

T1569.002

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

File and Directory Permissions Modification

T1222

Hide Artifacts

T1564

Ignore Process Interrupts

T1564.011

Impair Defenses

T1562

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

breeze-agent.exe

Path C:\Program Files\Breeze\breeze-agent.exe
Size 20.1MB
SHA256 150966ed783d26816ea5faf44e79664c5d020eb42185dcd673602a300c4149d0
MD5 a2474b8417fa58bcad45a274a29b2499
SHA1 f794c8a2aab4eaa9b6684dc1daa6ca563b9381be
SHA512 8cb9cd4ac6de710917d3ce8b6505ae00db05ada0a97ca1e90e2609e0a13bf802ee8cd09f7eb33ff18901a9c0cd733626f35a1d34f27fc50450096f85dc0dd4ab
SSDEEP 196608:RKKByZU4iir0QgPJwMVlp3E9dGdxcX0ykegMrwNr83J:RjByZOhdxcXHw98
TLSH
T122272A13E9A545E4C5AAE630CA769223BB717C484B2027D76F60F7243F76BD0AE79310
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

breeze-watchdog.exe

Path C:\Program Files\Breeze\breeze-watchdog.exe
Size 8.4MB
SHA256 a3cd7a1f724940f1b5c4c52af3edbf511fe3c78f6db281cbf9be0732b413f574
MD5 8981bb1ff72cb910477c76961eb6706b
SHA1 28d572afba4f5f8f160685b4f4e79b3b0ef024f1
SHA512 06913c80d3562fd3d02a18409868e7148652954864d6ceb06c5a68c2ed19b043f2de968632443cc47988f290322487c51538ab9f92c9cc9e711a400f12d1b311
SSDEEP 98304:SIPi3RSHhlPn5jh3zpMEWtM92FIclneo8NEeDE:SZRSHhBn5PMEWtM92FIclekeQ
TLSH
T199963A43ECA545E4C1A9D13589669213BBB17C491B3123D73FA0F7282F76BD0AEB9390
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

install-windows.ps1

Path C:\Program Files\Breeze\scripts\install\install-windows.ps1
Size 5KB
SHA256 789d1b0de9a29f8f51d7dc4379d8f2e89f4eb502c9c98f2b416185779d17d23e
MD5 52606ddf19e3613032b57265f68da343
SHA1 b2df9212e193fb60932ea99fbe0575327c4cbc00
SHA512 0116ee09b21fabf2e9eec0d7732b1af823aa59dd2fc17394a94c7bde8ac8ef569ae585a8890b4a5beb7b8586a9a2d3200972d9d857e8c950709c584783a6fb39
SSDEEP 96:M/OGhojmAgrdU+n7RwiPQezUUJkyed8aRTMDZLLxwoD3o323qbGA:kOQojtSNwiIbUJleeiYDZ/xwoD3o323M
TLSH
T1FCC1B764A94102352DB117B9FE85A390FA56507F4F1A3118F0AC42CB6F78C2D8BB6FC9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

breeze-agent-user-task.xml

Path C:\Program Files\Breeze\service\windows\breeze-agent-user-task.xml
Size 1KB
SHA256 6955c4e5db12cb6fbff58d070cf45d42841ddf177df6aebb5ae597e38c9e862a
MD5 67726b959c8bbb555345816f5e3857f9
SHA1 7dacc461882ecf2bbc6526941ac4b1d2335ea88a
SHA512 728bb647d4a1acf6b66583f63bb3d81922f706ac749d0fc1a8ca00be74865438683112b8a4601d48d94387fff730ef6250cb2fcf1a8471c6df121541c9f64199
TLSH
T11331FE689CC0B30376724626EB41A383EF3A87174BAB4034F4DC466B2FFD5586163A5A
MD5 SHA1 SHA512 TLSH

Submit Download

agent.state.tmp

Path C:\ProgramData\Breeze\agent.state.tmp
Size 160B
SHA256 fc8fbbe97f4437f3e5255551cc8c1122572e2b2a43fcc8cd08547f40b3063ba9
MD5 d48e9fc874af60f7ab3a5e47f1ab6342
SHA1 968fc7fa275f74c88a6b0b93c12b2d553a234394
SHA512 412ac239a6b6c4fbd5ce5576c74068e50244d2ab23eb8a672846009ab45aaf12ace1e919002846915fb7788b04fd040349301cd1f20adb8e2088a803121c2b23
TLSH
T136C08C0092A6206638D307368C38BA894F00EF0B95883086AB0F0A18061C57EB53263B
MD5 SHA1 SHA512 TLSH

Submit Download

agent.state.tmp

Path C:\ProgramData\Breeze\agent.state.tmp
Size 159B
SHA256 5219a8be46380330b695e29fd4798507b8e11254f027d401fbb19d5b299d2302
MD5 2c978bc0ff7be179b4d27fed3d016218
SHA1 8db548220ee1c8aa066ca2fc21b254daa1494045
SHA512 3a0e330818d61fee556de5d3a1db33c31d6323641d03c2f2a740d763a5e045568bafc272bae99976d1caaf9c1e6ae40d14da005efcddcdb72e2ffd51d4ee9598
TLSH
T19DC08C08A28BE05338E34B21486B86A5AF00FD0745443283EF4FDE20130807744B3BAB
MD5 SHA1 SHA512 TLSH

Submit Download

agent.state.tmp

Path C:\ProgramData\Breeze\agent.state.tmp
Size 161B
SHA256 a7848e4b790db39006159cbdae6e06b4b7cfdadc0bfe0c31b8ea62a1648c9887
MD5 85cbf233917c34748b358bad762c3034
SHA1 fafeca3a63e6badceeb8f52f83750218832560f7
SHA512 42b1895f3249ed943da704102e908daa188f041b5a87d3fa363da33d1db34c1b3a5294427f8401f49ab19e3782efecb29f3d1dd45760780eda5fe8f7b41db18b
TLSH
T196C08C00A2B1106678C31731883877888F00DE075688309A6B0F4A1806684BEA532A3F
MD5 SHA1 SHA512 TLSH

Submit Download

agent.yaml

Path C:\ProgramData\Breeze\agent.yaml
Size 825B
SHA256 ed60d957736e049053b005a3c6a4ef55dba1d5564552f8d0cccbc225c4b929d3
MD5 28105a4a06ba39e3be1c73623bd07af9
SHA1 60480569da168843482f93c5fa2ac50a4885c8e4
SHA512 077f69150e293966c589e1ab1f5fbbeb36f9c8a97fded7fd08ef37486eaf83ae57a9f17ad423e2476f2830d8864fceed803bcd203a60cc4a78fb53deeb4cd3a6
TLSH
T1BF018695FF57B48658F0153A48EE76972C09674300D31919ADEE03D007C2818977ED6B
MD5 SHA1 SHA512 TLSH

Submit Download

dns-cache.json

Path C:\ProgramData\Breeze\data\dns-cache.json
Size 83B
SHA256 28a9e87452d0d08962ea719409617c6b9294a3a1c26624fcc1d2b63b9663de60
MD5 d7002924e8c6d05c8bde57a4070fccdf
SHA1 84cab773b0584b8bf54a82076641aff344b86167
SHA512 783c6f41a84a4fe05a33bb4043aad8aaf1de738041baa3b1743e376d6e1276ea2fc399e5ed3539f7d471f926bacfdaa97f1a9f12268b6a32eccc13419e0aa42a
TLSH
T166A0243503D40D3114D04433F5C0DC0540504C43D4C3414510410154D1C0CCDF0707CF
MD5 SHA1 SHA512 TLSH

Submit Download

openh264-2.4.1-win64.dll

Path C:\ProgramData\Breeze\data\openh264-2.4.1-win64.dll
Size 952KB
SHA256 081b0c081480d177cbfddfbc90b1613640e702f875897b30d8de195cde73dd34
MD5 c85406e6b73812ec3fb9da5f898c6a9e
SHA1 cd6b460b9990814fb1d8e48affe6f09542d4ad14
SHA512 953340695c573d14e554866a5ea26997be9bc61596acf0a7df293c20c1270a4ce148c92b04bf3208f15b282ce0936071c484f8e39c29236c288afedb8e3c3317
SSDEEP 24576:AUOX+ZErX4vCP6DIFhm93/V1SV/hJ/n3tQHhb7:Azbi5/V1OhJ4R
TLSH
T1D9259E46E2A601E8D97BD078C97E462BF7B9304E13208AFB19E0C6155F27BE4573EB14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

agent.log

Path C:\ProgramData\Breeze\logs\agent.log
Size 943B
SHA256 4b7e619c69bdf53cc4fef774ff49a2e961e2b7c736c239583cc267b841d0333e
MD5 aab276071351ff0994c75a63d85eaa89
SHA1 aba41b0ca8437ba91360b85c21f32059b6f3a0fd
SHA512 42d8733d24de4f90ed7ba8c83af82b9fbb70cb92f89b8232c23d5cb8bdff7c5efd96986e181484fec0988fd459ee3d3c761056243971df31da4e030d6fc10f0f
TLSH
T19D11D47233F1116170D73865CBAC3E9A59402405C9D321EF3AC91EBC4A89F5989362D5
MD5 SHA1 SHA512 TLSH

Submit Download

agent.lock

Path C:\ProgramData\Breeze\run\agent.lock
Size 288B
SHA256 686ec9656a223d83690e3af140eae58eeea83d9dfa0cedb9ff151a21e0d1882e
MD5 d86b1e37aedc6e4328d22d4be9d4488a
SHA1 fcdbad6f84c50d8abcfedfbc82310fe16ba70f43
SHA512 d2365f9864ee1888834312d76af93279206005827d4b253e66f6fbcdb28480d94154f928dfb95bc06cb30944d685aaaa8b925e51cbe0cefddddfe6a888dd3e69
TLSH
T1EED072D40BD2A034A8002F80E20A2BC3A29F85082B80214AA61B030EA2201AA282A043
MD5 SHA1 SHA512 TLSH

Submit Download

secrets.yaml

Path C:\ProgramData\Breeze\secrets.yaml
Size 452B
SHA256 2d9c415f381eaff0a0ceca278dfa6c6a327d76740a255170abb5c39b6bd3f008
MD5 52106bbf288aa397b0362d2b029f70fa
SHA1 99e826936e1cce368c777a61324313f00992326a
SHA512 af9d70fdc7dcf3295e3096f4b117d547cd08780138bd2b5b7b6efe748081150dc5c4b26bd6a6afa5c9d5217b6c858dc08546091af4fcea5aefefe642e5d8ec0a
TLSH
T1DBF05C7B51D1A88F6AC16771F04F3BE918439433D088487F19EE6D860A24E25E44F715
MD5 SHA1 SHA512 TLSH

Submit Download

ModuleAnalysisCache

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
Size 67KB
SHA256 0f57c6ef4f062e398afd897db02f67d987e3e600973e8f450001f4e6d249b0fe
MD5 07eb30064ce437898674846e08a80887
SHA1 1e26e3ffc7c74016d094ec318f9a0ff94019fabe
SHA512 8a6d441cc00f74b63f40d24126774ee41ee620918cd20c4a5685ab4119d66dd45b7d55f78d6ac6c8be585bc06f66677a53ed9ceda520c59a6ed62bf2f4180530
SSDEEP 1536:mKLg0mYo2hOovpfKQVGflJdpHYWh4iUx9R40i71Yi9MQyPcMrxoV3CNBQkj2Va5Z:mKLg0mYo2hOovpfKQVGflJd9YWqiU9RF
TLSH
T137636192E9204E75E1A66F3EF15622627C30394690F8113211DC25EFA987D970B1FBFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download