52dd8b2f9145907477a6ebc4ad406c1e4b221ea967f1c2ce8bc23faa83b663d8

Resubmissions

09/08/2026, 06:55

260809-hpxm5abk318

09/08/2026, 06:47

260809-hkfttahc598

Analysis

max time kernel
39s
max time network
98s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/08/2026, 06:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Secure Viewer ([email protected]).msi
Size 27.3MB
Sample260809-hpxm5abk31
SHA256 52dd8b2f9145907477a6ebc4ad406c1e4b221ea967f1c2ce8bc23faa83b663d8
MD5 2d5b101db58c7073cec364269388f334
SHA1 3e8f112c5370e823fd098407872c1a08c8be927c
SHA512 72b8c4fd5fb476948904c531e41cb0dbba185c30d98cf654a974ca291773933a7294e9d625fe494fd7ceb04c1bfb6700fefe9daded2bf9417f40167984ec0d5d
SSDEEP 786432:wpXnspKNBccxOckFiUPL6VHFb/J8HNg6R+v:0XnspMyFfUUPWZZBKnw
TLSH
T15C573319628B1671F7EBC2B101586BBE5A328CDE76F08831164974782578F733BFA9C1
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery execution ransomware spyware trojan

Malware Config

Signatures

Badlisted process makes network request 2 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
2	4900	msiexec.exe
9	2028	powershell.exe

Executes dropped EXE 7 IoCs

pid	Process
5104	breeze-agent.exe
6052	breeze-agent.exe
3572	breeze-watchdog.exe
5768	breeze-agent.exe
2644	breeze-agent.exe
2568	breeze-agent.exe
1900	breeze-agent.exe

Modifies file permissions 1 TTPs 3 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
6012	icacls.exe
1504	icacls.exe
1620	icacls.exe

Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Command and Scripting Interpreter: PowerShell 1 TTPs 10 IoCs

Run Powershell to get system information.

execution

PowerShell

T1059.001

pid	Process
1704	powershell.exe
5080	powershell.exe
4988	powershell.exe
244	powershell.exe
3484	powershell.exe
1488	powershell.exe
1940	powershell.exe
2028	powershell.exe
3168	powershell.exe
3956	powershell.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe

Drops file in Program Files directory 7 IoCs

description	ioc	Process
File created	C:\Program Files\Breeze\scripts\install\install-windows.ps1	msiexec.exe
File created	C:\Program Files\Breeze\scripts\install\remove-windows-task.ps1	msiexec.exe
File created	C:\Program Files\Breeze\service\windows\breeze-agent-user-task.xml	msiexec.exe
File created	C:\Program Files\Breeze\breeze-agent.exe	msiexec.exe
File created	C:\Program Files\Breeze\breeze-backup.exe	msiexec.exe
File created	C:\Program Files\Breeze\breeze-user-helper.exe	msiexec.exe
File created	C:\Program Files\Breeze\breeze-watchdog.exe	msiexec.exe

Drops file in Windows directory 17 IoCs

description	ioc	Process
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_oj55drgd.yik.ps1	powershell.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_4lwvut1m.rfu.ps1	powershell.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_zqfy101r.hre.ps1	powershell.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_1qokoxxh.hxa.psm1	powershell.exe
File created	C:\Windows\SystemTemp\~DFF1923D6EA3C4F85A.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIB3A6.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_2tej4e2d.pmr.psm1	powershell.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_3vgo02ry.nbz.psm1	powershell.exe
File created	C:\Windows\Installer\e59a733.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e59a733.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File created	C:\Windows\SystemTemp\~DF5C7570E609A0B599.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\SourceHash{95686F40-BA92-4CE8-9A48-9830D2AF4FA1}	msiexec.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_v2bl1epg.hyn.psm1	powershell.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_fqbhuiei.1n1.ps1	powershell.exe

Hide Artifacts: Ignore Process Interrupts 1 TTPs 15 IoCs

Command interpreters often include specific commands/flags that ignore errors and other hangups.

defense_evasion

Ignore Process Interrupts

T1564.011

pid	Process
5176	powershell.exe
2984	powershell.exe
3248	powershell.exe
2860	powershell.exe
3956	powershell.exe
1780	powershell.exe
4988	powershell.exe
3484	powershell.exe
5228	powershell.exe
1704	powershell.exe
624	powershell.exe
6044	powershell.exe
1188	powershell.exe
244	powershell.exe
1392	powershell.exe

Launches sc.exe 11 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1908	sc.exe
1096	sc.exe
1520	sc.exe
1384	sc.exe
1300	sc.exe
1284	sc.exe
1032	sc.exe
5228	sc.exe
1200	sc.exe
1512	sc.exe
4772	sc.exe

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5932	cmd.exe
2116	cmd.exe
1492	cmd.exe
5648	cmd.exe

Modifies trusted root certificate store through registry 1 TTPs 2 IoCs

A root certificate was added, modified, or removed in the trusted certificate store registry paths.

defense_evasion

Install Root Certificate

T1553.004

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 5c0000000100000004000000001000001900000001000000100000002fe1f70bb05d7c92335bc5e05b984da60f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f63030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e814000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e6b000000010000002000000096bcec06264976f37460779acf28c5a7cfe8a3c0aae11a8ffcee05c0bddf08c620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	breeze-agent.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 6b000000010000002000000096bcec06264976f37460779acf28c5a7cfe8a3c0aae11a8ffcee05c0bddf08c614000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	breeze-agent.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
1492	cmd.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 000000000400000067831fc6f5c7bf350000000000000000000000000000000000000000000000000000000000000000000000000000000000001071020000000000c012000000000000000000000000270101000088380167831fc60000000000001071020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d0830200000000006025c501000000000000000000000700010000e8410167831fc6000000000000d08302000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9c701000000000000050000000000000000000000070001000098d4e367831fc600000000000030a9c7010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9cc0100000000000005000000000000000000000007000100009854e667831fc600000000000030a9cc01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe

GoLang User-Agent 1 IoCs

Uses default user-agent string defined by GoLang HTTP packages.

description	flow	ioc
HTTP User-Agent header	12	Go-http-client/1.1

Kills process with taskkill 1 IoCs

defense_evasion

pid	Process
3616	taskkill.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	breeze-agent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	breeze-agent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	breeze-agent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	breeze-agent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	breeze-agent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	breeze-agent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	breeze-agent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	breeze-agent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	breeze-agent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	breeze-agent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	breeze-agent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	breeze-agent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	breeze-agent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	breeze-agent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	breeze-agent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	breeze-agent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	breeze-agent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	breeze-agent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	breeze-agent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	breeze-agent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	breeze-agent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	breeze-agent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	breeze-agent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe

Modifies system certificate store 2 TTPs 1 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8	breeze-agent.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5224	msiexec.exe
5224	msiexec.exe
5104	breeze-agent.exe
5104	breeze-agent.exe
5104	breeze-agent.exe
5104	breeze-agent.exe
5104	breeze-agent.exe
5104	breeze-agent.exe
1284	wmic.exe
1284	wmic.exe
1284	wmic.exe
1284	wmic.exe
3484	powershell.exe
3484	powershell.exe
3484	powershell.exe
1488	powershell.exe
1488	powershell.exe
1488	powershell.exe
3572	breeze-watchdog.exe
3572	breeze-watchdog.exe
3572	breeze-watchdog.exe
3572	breeze-watchdog.exe
3572	breeze-watchdog.exe
6052	breeze-agent.exe
6052	breeze-agent.exe
6052	breeze-agent.exe
6052	breeze-agent.exe
6052	breeze-agent.exe
6052	breeze-agent.exe
6052	breeze-agent.exe
6052	breeze-agent.exe
6052	breeze-agent.exe
6052	breeze-agent.exe
1940	powershell.exe
1940	powershell.exe
1940	powershell.exe
4800	wmic.exe
4800	wmic.exe
4800	wmic.exe
4800	wmic.exe
1704	powershell.exe
1704	powershell.exe
1704	powershell.exe
2028	powershell.exe
2028	powershell.exe
2028	powershell.exe
5768	breeze-agent.exe
5768	breeze-agent.exe
5768	breeze-agent.exe
5768	breeze-agent.exe
5768	breeze-agent.exe
5768	breeze-agent.exe
5768	breeze-agent.exe
2644	breeze-agent.exe
2644	breeze-agent.exe
2644	breeze-agent.exe
2644	breeze-agent.exe
2644	breeze-agent.exe
2644	breeze-agent.exe
2644	breeze-agent.exe
2568	breeze-agent.exe
2568	breeze-agent.exe
2568	breeze-agent.exe
2568	breeze-agent.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4900	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4900	msiexec.exe
Token: SeSecurityPrivilege	5224	msiexec.exe
Token: SeCreateTokenPrivilege	4900	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	4900	msiexec.exe
Token: SeLockMemoryPrivilege	4900	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4900	msiexec.exe
Token: SeMachineAccountPrivilege	4900	msiexec.exe
Token: SeTcbPrivilege	4900	msiexec.exe
Token: SeSecurityPrivilege	4900	msiexec.exe
Token: SeTakeOwnershipPrivilege	4900	msiexec.exe
Token: SeLoadDriverPrivilege	4900	msiexec.exe
Token: SeSystemProfilePrivilege	4900	msiexec.exe
Token: SeSystemtimePrivilege	4900	msiexec.exe
Token: SeProfSingleProcessPrivilege	4900	msiexec.exe
Token: SeIncBasePriorityPrivilege	4900	msiexec.exe
Token: SeCreatePagefilePrivilege	4900	msiexec.exe
Token: SeCreatePermanentPrivilege	4900	msiexec.exe
Token: SeBackupPrivilege	4900	msiexec.exe
Token: SeRestorePrivilege	4900	msiexec.exe
Token: SeShutdownPrivilege	4900	msiexec.exe
Token: SeDebugPrivilege	4900	msiexec.exe
Token: SeAuditPrivilege	4900	msiexec.exe
Token: SeSystemEnvironmentPrivilege	4900	msiexec.exe
Token: SeChangeNotifyPrivilege	4900	msiexec.exe
Token: SeRemoteShutdownPrivilege	4900	msiexec.exe
Token: SeUndockPrivilege	4900	msiexec.exe
Token: SeSyncAgentPrivilege	4900	msiexec.exe
Token: SeEnableDelegationPrivilege	4900	msiexec.exe
Token: SeManageVolumePrivilege	4900	msiexec.exe
Token: SeImpersonatePrivilege	4900	msiexec.exe
Token: SeCreateGlobalPrivilege	4900	msiexec.exe
Token: SeBackupPrivilege	1472	vssvc.exe
Token: SeRestorePrivilege	1472	vssvc.exe
Token: SeAuditPrivilege	1472	vssvc.exe
Token: SeBackupPrivilege	5224	msiexec.exe
Token: SeRestorePrivilege	5224	msiexec.exe
Token: SeRestorePrivilege	5224	msiexec.exe
Token: SeTakeOwnershipPrivilege	5224	msiexec.exe
Token: SeDebugPrivilege	3616	taskkill.exe
Token: SeBackupPrivilege	2748	srtasks.exe
Token: SeRestorePrivilege	2748	srtasks.exe
Token: SeSecurityPrivilege	2748	srtasks.exe
Token: SeTakeOwnershipPrivilege	2748	srtasks.exe
Token: SeRestorePrivilege	5224	msiexec.exe
Token: SeTakeOwnershipPrivilege	5224	msiexec.exe
Token: SeBackupPrivilege	2748	srtasks.exe
Token: SeRestorePrivilege	2748	srtasks.exe
Token: SeSecurityPrivilege	2748	srtasks.exe
Token: SeTakeOwnershipPrivilege	2748	srtasks.exe
Token: SeDebugPrivilege	5104	breeze-agent.exe
Token: SeAssignPrimaryTokenPrivilege	1284	wmic.exe
Token: SeIncreaseQuotaPrivilege	1284	wmic.exe
Token: SeSecurityPrivilege	1284	wmic.exe
Token: SeTakeOwnershipPrivilege	1284	wmic.exe
Token: SeLoadDriverPrivilege	1284	wmic.exe
Token: SeBackupPrivilege	1284	wmic.exe
Token: SeRestorePrivilege	1284	wmic.exe
Token: SeShutdownPrivilege	1284	wmic.exe
Token: SeAssignPrimaryTokenPrivilege	1284	wmic.exe
Token: SeIncreaseQuotaPrivilege	1284	wmic.exe
Token: SeSecurityPrivilege	1284	wmic.exe
Token: SeTakeOwnershipPrivilege	1284	wmic.exe
Token: SeLoadDriverPrivilege	1284	wmic.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4900	msiexec.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4900	msiexec.exe
5224	msiexec.exe

Suspicious use of WriteProcessMemory 29 IoCs

description	pid	Process	procid_target
PID 5224 wrote to memory of 2748	5224	msiexec.exe	95
PID 5224 wrote to memory of 1492	5224	msiexec.exe	97
PID 1492 wrote to memory of 1096	1492	cmd.exe	144
PID 1492 wrote to memory of 1520	1492	cmd.exe	100
PID 1492 wrote to memory of 1032	1492	cmd.exe	101
PID 1492 wrote to memory of 5228	1492	cmd.exe	158
PID 1492 wrote to memory of 1200	1492	cmd.exe	103
PID 1492 wrote to memory of 1632	1492	cmd.exe	104
PID 1492 wrote to memory of 3616	1492	cmd.exe	105
PID 5224 wrote to memory of 5648	5224	msiexec.exe	106
PID 5648 wrote to memory of 1384	5648	cmd.exe	108
PID 5648 wrote to memory of 1512	5648	cmd.exe	109
PID 5648 wrote to memory of 4772	5648	cmd.exe	131
PID 5224 wrote to memory of 5932	5224	msiexec.exe	111
PID 5932 wrote to memory of 6012	5932	cmd.exe	113
PID 5932 wrote to memory of 1504	5932	cmd.exe	114
PID 5932 wrote to memory of 1620	5932	cmd.exe	115
PID 5224 wrote to memory of 5104	5224	msiexec.exe	116
PID 5104 wrote to memory of 1284	5104	breeze-agent.exe	136
PID 5104 wrote to memory of 3484	5104	breeze-agent.exe	119
PID 5104 wrote to memory of 1300	5104	breeze-agent.exe	120
PID 5224 wrote to memory of 1488	5224	msiexec.exe	165
PID 6052 wrote to memory of 1940	6052	breeze-agent.exe	127
PID 6052 wrote to memory of 4800	6052	breeze-agent.exe	129
PID 6052 wrote to memory of 1704	6052	breeze-agent.exe	130
PID 5224 wrote to memory of 2116	5224	msiexec.exe	132
PID 6052 wrote to memory of 2028	6052	breeze-agent.exe	134
PID 2116 wrote to memory of 1284	2116	cmd.exe	136
PID 2116 wrote to memory of 1908	2116	cmd.exe	137

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I "C:\Users\Admin\AppData\Local\Temp\Secure Viewer ([email protected]).msi"
1⤵
- Badlisted process makes network request
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:4900

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5224
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2748
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd.exe" /c sc failure BreezeWatchdog reset= 0 actions= "" >nul 2>&1 & sc failure BreezeAgent reset= 0 actions= "" >nul 2>&1 & sc stop BreezeWatchdog >nul 2>&1 & sc stop BreezeAgent >nul 2>&1 & (sc query BreezeAgent | findstr "PENDING RUNNING" >nul 2>&1 && ping -n 4 127.0.0.1 >nul) & taskkill /F /IM breeze-agent.exe /IM breeze-user-helper.exe /IM breeze-watchdog.exe /IM breeze-desktop-helper.exe /IM breeze-backup.exe >nul 2>&1 & exit /b 0
  2⤵
  - Executes a command shell one-liner
  - System Network Configuration Discovery: Internet Connection Discovery
  - Suspicious use of WriteProcessMemory
  PID:1492
- - C:\Windows\System32\sc.exe
    sc failure BreezeWatchdog reset= 0 actions= ""
    3⤵
    - Launches sc.exe
    PID:1096
- - C:\Windows\System32\sc.exe
    sc failure BreezeAgent reset= 0 actions= ""
    3⤵
    - Launches sc.exe
    PID:1520
- - C:\Windows\System32\sc.exe
    sc stop BreezeWatchdog
    3⤵
    - Launches sc.exe
    PID:1032
- - C:\Windows\System32\sc.exe
    sc stop BreezeAgent
    3⤵
    - Launches sc.exe
    PID:5228
- - C:\Windows\System32\sc.exe
    sc query BreezeAgent
    3⤵
    - Launches sc.exe
    PID:1200
- - C:\Windows\System32\findstr.exe
    findstr "PENDING RUNNING"
    3⤵
    PID:1632
- - C:\Windows\System32\taskkill.exe
    taskkill /F /IM breeze-agent.exe /IM breeze-user-helper.exe /IM breeze-watchdog.exe /IM breeze-desktop-helper.exe /IM breeze-backup.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3616
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd.exe" /c sc failure BreezeWatchdog reset= 0 actions= "" >nul 2>&1 & sc failure BreezeAgent reset= 0 actions= "" >nul 2>&1 & sc stop BreezeWatchdog >nul 2>&1 & exit /b 0
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5648
- - C:\Windows\System32\sc.exe
    sc failure BreezeWatchdog reset= 0 actions= ""
    3⤵
    - Launches sc.exe
    PID:1384
- - C:\Windows\System32\sc.exe
    sc failure BreezeAgent reset= 0 actions= ""
    3⤵
    - Launches sc.exe
    PID:1512
- - C:\Windows\System32\sc.exe
    sc stop BreezeWatchdog
    3⤵
    - Launches sc.exe
    PID:4772
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd.exe" /c (if not exist "C:\ProgramData\Breeze\." mkdir "C:\ProgramData\Breeze\.") && (if not exist "C:\ProgramData\Breeze\data\." mkdir "C:\ProgramData\Breeze\data\.") && (if not exist "C:\ProgramData\Breeze\logs\." mkdir "C:\ProgramData\Breeze\logs\.") && icacls "C:\ProgramData\Breeze\." /inheritance:r /grant:r *S-1-5-18:(OI)(CI)F *S-1-5-32-544:(OI)(CI)F && icacls "C:\ProgramData\Breeze\data\." /inheritance:r /grant:r *S-1-5-18:(OI)(CI)F *S-1-5-32-544:(OI)(CI)F && icacls "C:\ProgramData\Breeze\logs\." /inheritance:r /grant:r *S-1-5-18:(OI)(CI)F *S-1-5-32-544:(OI)(CI)F
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5932
- - C:\Windows\System32\icacls.exe
    icacls "C:\ProgramData\Breeze\." /inheritance:r /grant:r *S-1-5-18:(OI)(CI)F *S-1-5-32-544:(OI)(CI)F
    3⤵
    - Modifies file permissions
    PID:6012
- - C:\Windows\System32\icacls.exe
    icacls "C:\ProgramData\Breeze\data\." /inheritance:r /grant:r *S-1-5-18:(OI)(CI)F *S-1-5-32-544:(OI)(CI)F
    3⤵
    - Modifies file permissions
    PID:1504
- - C:\Windows\System32\icacls.exe
    icacls "C:\ProgramData\Breeze\logs\." /inheritance:r /grant:r *S-1-5-18:(OI)(CI)F *S-1-5-32-544:(OI)(CI)F
    3⤵
    - Modifies file permissions
    PID:1620
- C:\Program Files\Breeze\breeze-agent.exe
  "C:\Program Files\Breeze\breeze-agent.exe" bootstrap --install-data "C:\Users\Admin\AppData\Local\Temp\Secure Viewer ([email protected]).msi||" --quiet
  2⤵
  - Executes dropped EXE
  - Modifies trusted root certificate store through registry
  - Modifies data under HKEY_USERS
  - Modifies system certificate store
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:5104
- - C:\Windows\System32\Wbem\wmic.exe
    wmic systemenclosure get ChassisTypes /format:list
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1284
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -NonInteractive -Command "[Console]::OutputEncoding=[System.Text.Encoding]::UTF8; $ErrorActionPreference = 'SilentlyContinue' function Get-WmiSafe($ClassName) { $r = $null if (Get-Command Get-CimInstance -ErrorAction SilentlyContinue) { try { $r = Get-CimInstance -ClassName $ClassName -ErrorAction Stop } catch {} } if ($null -eq $r -and (Get-Command Get-WmiObject -ErrorAction SilentlyContinue)) { try { $r = Get-WmiObject -Class $ClassName -ErrorAction Stop } catch {} } $r } $bios = @(Get-WmiSafe 'Win32_BIOS') | Select-Object -First 1 $board = @(Get-WmiSafe 'Win32_BaseBoard') | Select-Object -First 1 $sys = @(Get-WmiSafe 'Win32_ComputerSystem') | Select-Object -First 1 $gpus = @(@(Get-WmiSafe 'Win32_VideoController') | Where-Object { $_ -and $_.Name } | Select-Object -ExpandProperty Name | ForEach-Object { ([string]$_).Trim() } | Where-Object { $_ -ne '' } | Select-Object -Unique) [PSCustomObject]@{ BiosSerial = if ($bios) { ([string]$bios.SerialNumber).Trim() } else { '' } BiosVersion = if ($bios) { ([string]$bios.SMBIOSBIOSVersion).Trim() } else { '' } BoardSerial = if ($board) { ([string]$board.SerialNumber).Trim() } else { '' } BoardManufacturer = if ($board) { ([string]$board.Manufacturer).Trim() } else { '' } BoardProduct = if ($board) { ([string]$board.Product).Trim() } else { '' } BoardVersion = if ($board) { ([string]$board.Version).Trim() } else { '' } SysManufacturer = if ($sys) { ([string]$sys.Manufacturer).Trim() } else { '' } SysModel = if ($sys) { ([string]$sys.Model).Trim() } else { '' } GPUNames = $gpus } | ConvertTo-Json -Compress "
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Drops file in Windows directory
    - Hide Artifacts: Ignore Process Interrupts
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    PID:3484
- - C:\Windows\system32\sc.exe
    sc query BreezeAgent
    3⤵
    - Launches sc.exe
    PID:1300
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Bypass -File "C:\Program Files\Breeze\scripts\install\install-windows.ps1"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Drops file in Windows directory
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:1488
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd.exe" /c "sc failure BreezeAgent reset= 86400 actions= restart/5000/restart/10000/restart/30000 & sc failure BreezeWatchdog reset= 86400 actions= restart/5000/restart/10000/restart/30000"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2116
- - C:\Windows\System32\sc.exe
    sc failure BreezeAgent reset= 86400 actions= restart/5000/restart/10000/restart/30000
    3⤵
    - Launches sc.exe
    PID:1284
- - C:\Windows\System32\sc.exe
    sc failure BreezeWatchdog reset= 86400 actions= restart/5000/restart/10000/restart/30000
    3⤵
    - Launches sc.exe
    PID:1908

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:1472

C:\Program Files\Breeze\breeze-agent.exe
"C:\Program Files\Breeze\breeze-agent.exe" run
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:6052
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -NonInteractive -Command "Get-Command Add-AppxProvisionedPackage -ErrorAction Stop"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:1940
- C:\Windows\System32\Wbem\wmic.exe
  wmic systemenclosure get ChassisTypes /format:list
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4800
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -NonInteractive -Command "[Console]::OutputEncoding=[System.Text.Encoding]::UTF8; $ErrorActionPreference = 'SilentlyContinue' function Get-WmiSafe($ClassName) { $r = $null if (Get-Command Get-CimInstance -ErrorAction SilentlyContinue) { try { $r = Get-CimInstance -ClassName $ClassName -ErrorAction Stop } catch {} } if ($null -eq $r -and (Get-Command Get-WmiObject -ErrorAction SilentlyContinue)) { try { $r = Get-WmiObject -Class $ClassName -ErrorAction Stop } catch {} } $r } $bios = @(Get-WmiSafe 'Win32_BIOS') | Select-Object -First 1 $board = @(Get-WmiSafe 'Win32_BaseBoard') | Select-Object -First 1 $sys = @(Get-WmiSafe 'Win32_ComputerSystem') | Select-Object -First 1 $gpus = @(@(Get-WmiSafe 'Win32_VideoController') | Where-Object { $_ -and $_.Name } | Select-Object -ExpandProperty Name | ForEach-Object { ([string]$_).Trim() } | Where-Object { $_ -ne '' } | Select-Object -Unique) [PSCustomObject]@{ BiosSerial = if ($bios) { ([string]$bios.SerialNumber).Trim() } else { '' } BiosVersion = if ($bios) { ([string]$bios.SMBIOSBIOSVersion).Trim() } else { '' } BoardSerial = if ($board) { ([string]$board.SerialNumber).Trim() } else { '' } BoardManufacturer = if ($board) { ([string]$board.Manufacturer).Trim() } else { '' } BoardProduct = if ($board) { ([string]$board.Product).Trim() } else { '' } BoardVersion = if ($board) { ([string]$board.Version).Trim() } else { '' } SysManufacturer = if ($sys) { ([string]$sys.Manufacturer).Trim() } else { '' } SysModel = if ($sys) { ([string]$sys.Model).Trim() } else { '' } GPUNames = $gpus } | ConvertTo-Json -Compress "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Hide Artifacts: Ignore Process Interrupts
  - Suspicious behavior: EnumeratesProcesses
  PID:1704
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -ExecutionPolicy Bypass -Command "[Console]::InputEncoding = [Console]::OutputEncoding = [System.Text.Encoding]::UTF8; & 'C:\Users\Admin\AppData\Local\Temp\breeze-scripts\breeze_867873f912654e6c.ps1'"
  2⤵
  - Badlisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:2028
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -NonInteractive -Command "Get-NetAdapter -Name 'Ethernet' -ErrorAction SilentlyContinue | Select-Object -ExpandProperty ReceiveLinkSpeed"
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  PID:5176
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -NonInteractive -Command "Get-NetAdapter -Name 'Loopback Pseudo-Interface 1' -ErrorAction SilentlyContinue | Select-Object -ExpandProperty ReceiveLinkSpeed"
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  PID:2984
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -NonInteractive -Command "Get-NetAdapter -InterfaceDescription 'Loopback Pseudo-Interface 1' -ErrorAction SilentlyContinue | Select-Object -ExpandProperty ReceiveLinkSpeed"
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  PID:624
- C:\Program Files\Breeze\breeze-watchdog.exe
  "C:\Program Files\Breeze\breeze-watchdog.exe" status
  2⤵
  PID:2496
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -NonInteractive -Command "Get-NetIPInterface -AddressFamily IPv4 -ErrorAction SilentlyContinue | Where-Object { $_.Dhcp -eq 'Enabled' } | Select-Object -ExpandProperty InterfaceAlias"
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  PID:3248
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -NonInteractive -Command "[Console]::OutputEncoding=[System.Text.Encoding]::UTF8;Get-WinEvent -FilterHashtable @{LogName='System'; Id=41,1074,6005,6006,6008,6009; StartTime='2026-08-08T06:56:02Z'} -MaxEvents 50 -ErrorAction SilentlyContinue | Select-Object RecordId, LogName, Level, LevelDisplayName, @{N='TimeCreated';E={$_.TimeCreated.ToString('o')}}, ProviderName, Id, Message | ConvertTo-Json -Depth 2 -Compress"
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  PID:6044
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -NonInteractive -Command "[Console]::OutputEncoding=[System.Text.Encoding]::UTF8;Get-WinEvent -FilterHashtable @{LogName='Security'; Level=1,2,3; StartTime='2026-08-08T06:56:02Z'} -MaxEvents 50 -ErrorAction SilentlyContinue | Select-Object RecordId, LogName, Level, LevelDisplayName, @{N='TimeCreated';E={$_.TimeCreated.ToString('o')}}, ProviderName, Id, Message | ConvertTo-Json -Depth 2 -Compress"
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  PID:2860
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -NonInteractive -Command "[Console]::OutputEncoding=[System.Text.Encoding]::UTF8;Get-WinEvent -FilterHashtable @{LogName='System'; Level=1,2; StartTime='2026-08-08T06:56:02Z'} -MaxEvents 50 -ErrorAction SilentlyContinue | Select-Object RecordId, LogName, Level, LevelDisplayName, @{N='TimeCreated';E={$_.TimeCreated.ToString('o')}}, ProviderName, Id, Message | ConvertTo-Json -Depth 2 -Compress"
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  PID:1188
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -NonInteractive -Command "[Console]::OutputEncoding=[System.Text.Encoding]::UTF8;Get-WinEvent -FilterHashtable @{LogName='Application'; Level=1,2; StartTime='2026-08-08T06:56:02Z'} -MaxEvents 50 -ErrorAction SilentlyContinue | Select-Object RecordId, LogName, Level, LevelDisplayName, @{N='TimeCreated';E={$_.TimeCreated.ToString('o')}}, ProviderName, Id, Message | ConvertTo-Json -Depth 2 -Compress"
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  PID:5228
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -NonInteractive -Command " Get-CimInstance -ClassName Win32_Service -ErrorAction Stop | Select-Object Name, DisplayName, State, StartMode, StartName | ConvertTo-Json -Compress -Depth 2 "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:5080
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -NonInteractive -Command " $items = @() $paths = @( @{ Hive='HKLM'; Path='HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' }, @{ Hive='HKCU'; Path='HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' } ) foreach ($p in $paths) { $props = Get-ItemProperty -Path $p.Path -ErrorAction SilentlyContinue if ($props) { $props.PSObject.Properties | Where-Object { $_.Name -notlike 'PS*' -and $_.Name -ne '(default)' } | ForEach-Object { $items += @{ Name = $_.Name Value = [string]$_.Value Hive = $p.Hive } } } } $items | ConvertTo-Json -Compress -Depth 2 "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Hide Artifacts: Ignore Process Interrupts
  PID:3956
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -NonInteractive -Command " $tasks = Get-ScheduledTask -ErrorAction SilentlyContinue | ForEach-Object { $actions = @($_.Actions | ForEach-Object { $exec = [string]$_.Execute $args = [string]$_.Arguments if ($args) { \"$exec $args\" } else { $exec } }) -join '; ' $triggers = @($_.Triggers | ForEach-Object { if ($_.StartBoundary) { [string]$_.StartBoundary } else { $_.ToString() } }) -join '; ' [PSCustomObject]@{ Name = [string]$_.TaskName Path = [string]$_.TaskPath Status = [string]$_.State Schedule = [string]$triggers Command = [string]$actions } } $tasks | ConvertTo-Json -Compress -Depth 4 "
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  PID:1392
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -NonInteractive -Command " Get-CimInstance Win32_UserAccount -Filter \"LocalAccount=True\" -ErrorAction SilentlyContinue | Select-Object Name, FullName, Disabled, Lockout | ConvertTo-Json -Compress -Depth 2 "
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  PID:1780
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -NonInteractive -Command "[Console]::OutputEncoding=[System.Text.Encoding]::UTF8;Get-Service | Where-Object {$_.Status -eq 'Running'} | Select-Object -ExpandProperty Name"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:3168
- C:\Windows\System32\Wbem\wmic.exe
  wmic systemenclosure get ChassisTypes /format:list
  2⤵
  PID:1488
- C:\Windows\System32\Wbem\wmic.exe
  wmic systemenclosure get ChassisTypes /format:list
  2⤵
  PID:4232
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -NonInteractive -Command "[Console]::OutputEncoding=[System.Text.Encoding]::UTF8; $ErrorActionPreference = 'SilentlyContinue' function Get-WmiSafe($ClassName) { $r = $null if (Get-Command Get-CimInstance -ErrorAction SilentlyContinue) { try { $r = Get-CimInstance -ClassName $ClassName -ErrorAction Stop } catch {} } if ($null -eq $r -and (Get-Command Get-WmiObject -ErrorAction SilentlyContinue)) { try { $r = Get-WmiObject -Class $ClassName -ErrorAction Stop } catch {} } $r } $bios = @(Get-WmiSafe 'Win32_BIOS') | Select-Object -First 1 $board = @(Get-WmiSafe 'Win32_BaseBoard') | Select-Object -First 1 $sys = @(Get-WmiSafe 'Win32_ComputerSystem') | Select-Object -First 1 $gpus = @(@(Get-WmiSafe 'Win32_VideoController') | Where-Object { $_ -and $_.Name } | Select-Object -ExpandProperty Name | ForEach-Object { ([string]$_).Trim() } | Where-Object { $_ -ne '' } | Select-Object -Unique) [PSCustomObject]@{ BiosSerial = if ($bios) { ([string]$bios.SerialNumber).Trim() } else { '' } BiosVersion = if ($bios) { ([string]$bios.SMBIOSBIOSVersion).Trim() } else { '' } BoardSerial = if ($board) { ([string]$board.SerialNumber).Trim() } else { '' } BoardManufacturer = if ($board) { ([string]$board.Manufacturer).Trim() } else { '' } BoardProduct = if ($board) { ([string]$board.Product).Trim() } else { '' } BoardVersion = if ($board) { ([string]$board.Version).Trim() } else { '' } SysManufacturer = if ($sys) { ([string]$sys.Manufacturer).Trim() } else { '' } SysModel = if ($sys) { ([string]$sys.Model).Trim() } else { '' } GPUNames = $gpus } | ConvertTo-Json -Compress "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Hide Artifacts: Ignore Process Interrupts
  PID:4988
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -NonInteractive -Command "[Console]::OutputEncoding=[System.Text.Encoding]::UTF8; $ErrorActionPreference = 'SilentlyContinue' function Get-WmiSafe($ClassName) { $r = $null if (Get-Command Get-CimInstance -ErrorAction SilentlyContinue) { try { $r = Get-CimInstance -ClassName $ClassName -ErrorAction Stop } catch {} } if ($null -eq $r -and (Get-Command Get-WmiObject -ErrorAction SilentlyContinue)) { try { $r = Get-WmiObject -Class $ClassName -ErrorAction Stop } catch {} } $r } $bios = @(Get-WmiSafe 'Win32_BIOS') | Select-Object -First 1 $board = @(Get-WmiSafe 'Win32_BaseBoard') | Select-Object -First 1 $sys = @(Get-WmiSafe 'Win32_ComputerSystem') | Select-Object -First 1 $gpus = @(@(Get-WmiSafe 'Win32_VideoController') | Where-Object { $_ -and $_.Name } | Select-Object -ExpandProperty Name | ForEach-Object { ([string]$_).Trim() } | Where-Object { $_ -ne '' } | Select-Object -Unique) [PSCustomObject]@{ BiosSerial = if ($bios) { ([string]$bios.SerialNumber).Trim() } else { '' } BiosVersion = if ($bios) { ([string]$bios.SMBIOSBIOSVersion).Trim() } else { '' } BoardSerial = if ($board) { ([string]$board.SerialNumber).Trim() } else { '' } BoardManufacturer = if ($board) { ([string]$board.Manufacturer).Trim() } else { '' } BoardProduct = if ($board) { ([string]$board.Product).Trim() } else { '' } BoardVersion = if ($board) { ([string]$board.Version).Trim() } else { '' } SysManufacturer = if ($sys) { ([string]$sys.Manufacturer).Trim() } else { '' } SysModel = if ($sys) { ([string]$sys.Model).Trim() } else { '' } GPUNames = $gpus } | ConvertTo-Json -Compress "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Hide Artifacts: Ignore Process Interrupts
  PID:244

C:\Program Files\Breeze\breeze-watchdog.exe
"C:\Program Files\Breeze\breeze-watchdog.exe" run
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:3572

C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\wbem\wmiprvse.exe -Embedding
1⤵
PID:4772

C:\Program Files\Breeze\breeze-agent.exe
"C:\Program Files\Breeze\breeze-agent.exe" run
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:5768

C:\Program Files\Breeze\breeze-agent.exe
"C:\Program Files\Breeze\breeze-agent.exe" run
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:2644

C:\Program Files\Breeze\breeze-agent.exe
"C:\Program Files\Breeze\breeze-agent.exe" run
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:2568

C:\Program Files\Breeze\breeze-agent.exe
"C:\Program Files\Breeze\breeze-agent.exe" run
1⤵
- Executes dropped EXE
PID:1900

C:\Program Files\Breeze\breeze-agent.exe
"C:\Program Files\Breeze\breeze-agent.exe" run
1⤵
PID:5360

C:\Program Files\Breeze\breeze-agent.exe
"C:\Program Files\Breeze\breeze-agent.exe" run
1⤵
PID:3284

C:\Program Files\Breeze\breeze-agent.exe
"C:\Program Files\Breeze\breeze-agent.exe" run
1⤵
PID:1096

C:\Program Files\Breeze\breeze-agent.exe
"C:\Program Files\Breeze\breeze-agent.exe" run
1⤵
PID:4304

C:\Program Files\Breeze\breeze-agent.exe
"C:\Program Files\Breeze\breeze-agent.exe" run
1⤵
PID:4276

C:\Program Files\Breeze\breeze-agent.exe
"C:\Program Files\Breeze\breeze-agent.exe" run
1⤵
PID:2844

C:\Program Files\Breeze\breeze-agent.exe
"C:\Program Files\Breeze\breeze-agent.exe" run
1⤵
PID:2864

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

System Services

T1569

Service Execution

T1569.002

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

File and Directory Permissions Modification

T1222

Hide Artifacts

T1564

Ignore Process Interrupts

T1564.011

Impair Defenses

T1562

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

breeze-agent.exe

Path C:\Program Files\Breeze\breeze-agent.exe
Size 20.1MB
SHA256 150966ed783d26816ea5faf44e79664c5d020eb42185dcd673602a300c4149d0
MD5 a2474b8417fa58bcad45a274a29b2499
SHA1 f794c8a2aab4eaa9b6684dc1daa6ca563b9381be
SHA512 8cb9cd4ac6de710917d3ce8b6505ae00db05ada0a97ca1e90e2609e0a13bf802ee8cd09f7eb33ff18901a9c0cd733626f35a1d34f27fc50450096f85dc0dd4ab
SSDEEP 196608:RKKByZU4iir0QgPJwMVlp3E9dGdxcX0ykegMrwNr83J:RjByZOhdxcXHw98
TLSH
T122272A13E9A545E4C5AAE630CA769223BB717C484B2027D76F60F7243F76BD0AE79310
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

breeze-watchdog.exe

Path C:\Program Files\Breeze\breeze-watchdog.exe
Size 8.4MB
SHA256 a3cd7a1f724940f1b5c4c52af3edbf511fe3c78f6db281cbf9be0732b413f574
MD5 8981bb1ff72cb910477c76961eb6706b
SHA1 28d572afba4f5f8f160685b4f4e79b3b0ef024f1
SHA512 06913c80d3562fd3d02a18409868e7148652954864d6ceb06c5a68c2ed19b043f2de968632443cc47988f290322487c51538ab9f92c9cc9e711a400f12d1b311
SSDEEP 98304:SIPi3RSHhlPn5jh3zpMEWtM92FIclneo8NEeDE:SZRSHhBn5PMEWtM92FIclekeQ
TLSH
T199963A43ECA545E4C1A9D13589669213BBB17C491B3123D73FA0F7282F76BD0AEB9390
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

install-windows.ps1

Path C:\Program Files\Breeze\scripts\install\install-windows.ps1
Size 5KB
SHA256 789d1b0de9a29f8f51d7dc4379d8f2e89f4eb502c9c98f2b416185779d17d23e
MD5 52606ddf19e3613032b57265f68da343
SHA1 b2df9212e193fb60932ea99fbe0575327c4cbc00
SHA512 0116ee09b21fabf2e9eec0d7732b1af823aa59dd2fc17394a94c7bde8ac8ef569ae585a8890b4a5beb7b8586a9a2d3200972d9d857e8c950709c584783a6fb39
SSDEEP 96:M/OGhojmAgrdU+n7RwiPQezUUJkyed8aRTMDZLLxwoD3o323qbGA:kOQojtSNwiIbUJleeiYDZ/xwoD3o323M
TLSH
T1FCC1B764A94102352DB117B9FE85A390FA56507F4F1A3118F0AC42CB6F78C2D8BB6FC9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

breeze-agent-user-task.xml

Path C:\Program Files\Breeze\service\windows\breeze-agent-user-task.xml
Size 1KB
SHA256 6955c4e5db12cb6fbff58d070cf45d42841ddf177df6aebb5ae597e38c9e862a
MD5 67726b959c8bbb555345816f5e3857f9
SHA1 7dacc461882ecf2bbc6526941ac4b1d2335ea88a
SHA512 728bb647d4a1acf6b66583f63bb3d81922f706ac749d0fc1a8ca00be74865438683112b8a4601d48d94387fff730ef6250cb2fcf1a8471c6df121541c9f64199
TLSH
T11331FE689CC0B30376724626EB41A383EF3A87174BAB4034F4DC466B2FFD5586163A5A
MD5 SHA1 SHA512 TLSH

Submit Download

agent.state.tmp

Path C:\ProgramData\Breeze\agent.state.tmp
Size 160B
SHA256 c0334fa84dacf4c36b28ab65bfe092de2bb2ad2a72e02284ff3fc9188e7cdbd6
MD5 4502c2a112f286dcf3496a70c6a0c8ba
SHA1 8ee22f2dcf9897bec41c0a0becbede316d91535d
SHA512 99240e97f6b4640e94e5b0a891748904b7092aa62d9378d75adeffb9529fe6c866abede69f6fc4d5c9982391a4063d6e976b60a52723c3d836546bdbc3f86718
TLSH
T147C08C40A1A5006638D317629938B69A9F01EE0B998C74527B4F0A00062867FB87152A
MD5 SHA1 SHA512 TLSH

Submit Download

agent.state.tmp

Path C:\ProgramData\Breeze\agent.state.tmp
Size 161B
SHA256 d4899e697e0b93f6a72301868e23fbee64452a63f01d86a339f09ab8d0fc1a53
MD5 24ebe2d030f121aa76fe78dc1c2b6cdd
SHA1 5ce331efb4a87af1259dfe6fa498bd6cb9bc9bc2
SHA512 ef97ae5b409b294505db21321cbf6364289b20053c82cd187cbba7faec5f8ff82faac0226b6b5d6c416d0d00bdd0776beb0ef70085fd89e239e437a5bf3ea3f3
TLSH
T1E3C08C4051A1003638D303609838BBC98F00EE4B6A8C20562B4F0A048A689BFA83552E
MD5 SHA1 SHA512 TLSH

Submit Download

agent.state.tmp

Path C:\ProgramData\Breeze\agent.state.tmp
Size 159B
SHA256 d589dcf4b171f1965ac146efc22506fc464214ce0442192109882ca6c74b5a2d
MD5 3122d78627c4d35753b09258594a9972
SHA1 6fe8747f655e550ddd697776865bd4ba27f5c407
SHA512 b5da8f5592272c47cf3bb7a817019a9c582f40d5cfcede27d94950715e701091e902e3fc68b48158e96836cdd14a62a4aaff8c29bb9519dc6e22accb967a508d
TLSH
T126C08C6030C2902228D20A684A5AC6C0DF50AF0F490D20819FCF1F2043180770CB3E29
MD5 SHA1 SHA512 TLSH

Submit Download

agent.yaml

Path C:\ProgramData\Breeze\agent.yaml
Size 825B
SHA256 38e0130d9239bd793a02f3eb466b0320b6c282bad4759b0951a579c1892ca555
MD5 c14f7d6c3cc9732bb02fa7c79bcd114a
SHA1 e7e32216a05188159a2f34e3833658b4fc30b216
SHA512 82f1c78a3ad58b94e73c57830683a5db53d3d4ba4a9d368a397ce2bfdac53bcf43d7533f39b9130965516ea4d30c1ed176a4aea8d97e4b8e7cab608563ad08a1
TLSH
T1A30146C0FE6A901F18A005BF49EB65472425474386C32A99DDDC03D117D3418877FA6F
MD5 SHA1 SHA512 TLSH

Submit Download

dns-cache.json

Path C:\ProgramData\Breeze\data\dns-cache.json
Size 83B
SHA256 bad3572c98e74a0609e5d68b56a06adce9069e9d004caeb5a63ea72cf19697b5
MD5 bcdb0274923db8c220d6dc31706b0aed
SHA1 ab1d73557755e38b2614a9748ae8a766c6ef73ad
SHA512 5e087347a74c536b17013511c3baf0ce90566ac807f398e25b05bda89307824722d01e4e50bd22104e1b12c9f61d856c34987d0f54f19e68705cf254f64ee8bd
TLSH
T1CCA0243503D45D311450407371C05C1540010CC3C4C3014510410355D1C0CF5D0717CF
MD5 SHA1 SHA512 TLSH

Submit Download

openh264-2.4.1-win64.dll

Path C:\ProgramData\Breeze\data\openh264-2.4.1-win64.dll
Size 952KB
SHA256 081b0c081480d177cbfddfbc90b1613640e702f875897b30d8de195cde73dd34
MD5 c85406e6b73812ec3fb9da5f898c6a9e
SHA1 cd6b460b9990814fb1d8e48affe6f09542d4ad14
SHA512 953340695c573d14e554866a5ea26997be9bc61596acf0a7df293c20c1270a4ce148c92b04bf3208f15b282ce0936071c484f8e39c29236c288afedb8e3c3317
SSDEEP 24576:AUOX+ZErX4vCP6DIFhm93/V1SV/hJ/n3tQHhb7:Azbi5/V1OhJ4R
TLSH
T1D9259E46E2A601E8D97BD078C97E462BF7B9304E13208AFB19E0C6155F27BE4573EB14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

agent.log

Path C:\ProgramData\Breeze\logs\agent.log
Size 943B
SHA256 38c6ed61c6e4ad046d7de0d0bbf07d4715ef5d85d2efefbda18df743209ad602
MD5 32db69c9678e44656a0c16ba74cfd945
SHA1 e18cee6586f4d003f72d8b8dc34b915b4d7e6b3f
SHA512 a36610551da88f55ccd5ef2c8eeade2da54e0f3f6465dfff79779a31529335c43bbab9021221e52378102d6f6a290a4fbb66c51db76d76d4a2b80273765e11e0
TLSH
T1FB11D47220F5017010D33AC5CAAC3E4A6654651DCED312FF36891F9C5E59E6E86313D7
MD5 SHA1 SHA512 TLSH

Submit Download

agent.lock

Path C:\ProgramData\Breeze\run\agent.lock
Size 287B
SHA256 81987b7baf670aee87cf79c8195becbffa9c3d11b7a8cf6c5c81a121c76ce0e9
MD5 b33b72cd3f78277264ae0a268e060d0a
SHA1 40f238d12fcc1680cd2e8c8ff8573ab1306a6244
SHA512 3d2b4295da1a2ae00e0a16e2e1e42158a0babbb3ed28f0ce26e53e5fbb41d80902a643b6952acbc9cc981e4c312060b7af43b6f6879a0a0e7c4ad163de028101
TLSH
T10CD02BD45AE1A074A4027FC5E65E3BC3A39FC5086B982546B61B030EE6109EA6C6E643
MD5 SHA1 SHA512 TLSH

Submit Download

secrets.yaml

Path C:\ProgramData\Breeze\secrets.yaml
Size 452B
SHA256 bd07f8a7fb486040a46136b2221598b149bb73a01dca6e371c9b765b9004a497
MD5 f438c85a8406255cffcd01fed84e94f6
SHA1 5e643bf1e54389dd0f3628bf414e19ddc0ba1206
SHA512 af481cb34fcbd831da21d9bfbc01ecf10b24bf907d761ff80410560b2df41349216a42c36efb33b306049612797e0dda7ef4e8f0a2f0d4eb72d4227d81e472bd
TLSH
T121F05CB685E0650EBAC02AB5E18E223558036526D080C53F797E5C925F22F24B59E721
MD5 SHA1 SHA512 TLSH

Submit Download

ModuleAnalysisCache

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
Size 67KB
SHA256 0f57c6ef4f062e398afd897db02f67d987e3e600973e8f450001f4e6d249b0fe
MD5 07eb30064ce437898674846e08a80887
SHA1 1e26e3ffc7c74016d094ec318f9a0ff94019fabe
SHA512 8a6d441cc00f74b63f40d24126774ee41ee620918cd20c4a5685ab4119d66dd45b7d55f78d6ac6c8be585bc06f66677a53ed9ceda520c59a6ed62bf2f4180530
SSDEEP 1536:mKLg0mYo2hOovpfKQVGflJdpHYWh4iUx9R40i71Yi9MQyPcMrxoV3CNBQkj2Va5Z:mKLg0mYo2hOovpfKQVGflJd9YWqiU9RF
TLSH
T137636192E9204E75E1A66F3EF15622627C30394690F8113211DC25EFA987D970B1FBFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download