abb9decacf6925cc39d9626b8cf925ee4518b8ff0f8c66885847c6c74c690b16

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
24/08/2026, 02:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
setup.exe
Size 58.6MB
Sample260824-c53lessdmg
SHA256 abb9decacf6925cc39d9626b8cf925ee4518b8ff0f8c66885847c6c74c690b16
MD5 e2fe7d1e45100c861e5775d120c53ecf
SHA1 03f59387741fadd7d8294cc1717960211bace3ec
SHA512 436468a6f495797f8df65d8851acce9c6c90ed3cb1f73896ea1e9d40058248cb60a9f8485ad7e54a793918ad1f8a76ca567eda28a0b3401023bb49b4a657ab54
SSDEEP 1572864:4ACf3ZC8CpuGpBt8XNRhsOgkgED+SvwM2VzK/7:4l3ZrCpuGpBt8RsOOEfvb7
TLSH
T1A0D73319D6720C7CEA205674CA12852473AB38C0176BD7D74391A6A74E3F5A8EF3B3E1
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery execution spyware trojan

Malware Config

Signatures

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\Control Panel\International\Geo\Nation	setup.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\Control Panel\International\Geo\Nation	WScript.exe

Executes dropped EXE 20 IoCs

pid	Process
1124	dcagentregister.exe
1004	dcagentservice.exe
4864	7za.exe
2516	7za.exe
2060	dcagentservice.exe
4728	CRU_Reporter.exe
2164	dcconfig.exe
3884	dcusbsummary.exe
2216	dcusb64.exe
620	dcstatusutil.exe
3476	dcondemand.exe
900	dcswmeter.exe
1904	dcinventory.exe
1800	dcconfig.exe
3264	dcconfig.exe
3188	dcagentregister.exe
552	UEMSAgentHealthChecker.exe
1676	UEMSAgentHCHelper.exe
1084	UEMSAgentHCHelper.exe
4328	UEMSAgentHCHelper.exe

Loads dropped DLL 64 IoCs

pid	Process
4852	MsiExec.exe
1124	dcagentregister.exe
1124	dcagentregister.exe
1124	dcagentregister.exe
1124	dcagentregister.exe
1124	dcagentregister.exe
1124	dcagentregister.exe
1124	dcagentregister.exe
1124	dcagentregister.exe
1124	dcagentregister.exe
1124	dcagentregister.exe
1124	dcagentregister.exe
1124	dcagentregister.exe
1124	dcagentregister.exe
1124	dcagentregister.exe
1124	dcagentregister.exe
1124	dcagentregister.exe
1124	dcagentregister.exe
1124	dcagentregister.exe
1124	dcagentregister.exe
1124	dcagentregister.exe
1124	dcagentregister.exe
1124	dcagentregister.exe
1124	dcagentregister.exe
1124	dcagentregister.exe
1124	dcagentregister.exe
1124	dcagentregister.exe
1004	dcagentservice.exe
1124	dcagentregister.exe
1124	dcagentregister.exe
2060	dcagentservice.exe
3884	dcusbsummary.exe
2164	dcconfig.exe
2164	dcconfig.exe
2164	dcconfig.exe
2164	dcconfig.exe
620	dcstatusutil.exe
3476	dcondemand.exe
900	dcswmeter.exe
2164	dcconfig.exe
1904	dcinventory.exe
3476	dcondemand.exe
1800	dcconfig.exe
3476	dcondemand.exe
3476	dcondemand.exe
3264	dcconfig.exe
3264	dcconfig.exe
3188	dcagentregister.exe
3188	dcagentregister.exe
1904	dcinventory.exe
1904	dcinventory.exe
3188	dcagentregister.exe
3188	dcagentregister.exe
1904	dcinventory.exe
3188	dcagentregister.exe
2164	dcconfig.exe
3476	dcondemand.exe
3188	dcagentregister.exe
1904	dcinventory.exe
1904	dcinventory.exe
1904	dcinventory.exe
2164	dcconfig.exe
3264	dcconfig.exe
3476	dcondemand.exe

Modifies file permissions 1 TTPs 5 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
1668	icacls.exe
2800	icacls.exe
2484	icacls.exe
1520	icacls.exe
3684	icacls.exe

Badlisted process makes network request 1 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
7	3304	msiexec.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\dclibxml2.dll	msiexec.exe
File created	C:\Windows\SysWOW64\dcagentlibxml2.dll	msiexec.exe

Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs

execution

Visual Basic

T1059.005

pid	Process
4312	WScript.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\selfserviceexe.exe	7za.exe
File opened for modification	C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcprereqhandler.log	dcconfig.exe
File opened for modification	C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcagentaccess.log	dcconfig.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\ca-certs.zip	7za.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcscreenrec.exe.config	7za.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\ui-icons_ffffff_256x240.png	7za.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcutilhelper.dll	7za.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcwol.exe	7za.exe
File opened for modification	C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\UEMS_Agent_CommonUtilDll.dll	7za.exe
File opened for modification	C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\resources\AgentApplicationResources_pt_BR.properties	7za.exe
File opened for modification	C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\ues_deviceaccess.log	dcconfig.exe
File opened for modification	C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcrdsagentwindow.exe.config	7za.exe
File opened for modification	C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\secaddoncrashanalyser.exe	7za.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\resources\AgentApplicationResources_zh_TW.properties	7za.exe
File opened for modification	C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\devaccess.log	dcconfig.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\detected.png	msiexec.exe
File opened for modification	C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\NativeUIHandler.exe	7za.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\UEMS_Agent_TSToolUtil.exe	7za.exe
File opened for modification	C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcmisconfigaccess.log	dcconfig.exe
File opened for modification	C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcprepostaccess.csv	dcconfig.exe
File opened for modification	C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\UEMSRemoteInstallerService.log	dcconfig.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\otp-lock.png	msiexec.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\remind.gif	msiexec.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\scripts\generalAlerts.vbs	msiexec.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\OSDetection.json	dcagentregister.exe
File opened for modification	C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcondemand.exe	7za.exe
File opened for modification	C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dc_cad.exe	7za.exe
File opened for modification	C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\rdsrunasuser.exe	7za.exe
File opened for modification	C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\UEMSLogCollector.exe	7za.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\Globe.svg	msiexec.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\Btn_requested.svg	msiexec.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\Btn_uninstall.svg	msiexec.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\ChatFrame.ico	msiexec.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcaddonsevaluator.dll	7za.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcappcontrol.exe	7za.exe
File opened for modification	C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcinventory.exe	7za.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\file_system_watcher.exe	7za.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\Btn_install_all.svg	msiexec.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\CompVulnDetection.exe	7za.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcconfigexec.exe	7za.exe
File opened for modification	C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\resources\AgentApplicationResources.properties	7za.exe
File opened for modification	C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcswmeteraccess.log	dcconfig.exe
File opened for modification	C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\Network_Connection.log	dcconfig.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\Find.svg	msiexec.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\icon_alert.png	msiexec.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\rds\ZChangeNotifier.dll	msiexec.exe
File opened for modification	C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcrotatelog.log	dcagentregister.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dccomponentregister.dll	7za.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcmsghandler.exe	7za.exe
File opened for modification	C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\meaap.exe	7za.exe
File opened for modification	C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcusbaccess.log	dcconfig.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\Find.png	msiexec.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\agent_binaries.7z	msiexec.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\temp\DMRootCA.crt	dcagentregister.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\ohotfix.ini	7za.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcparsehandler.exe	7za.exe
File opened for modification	C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\devaction_user.log	dcconfig.exe
File opened for modification	C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\installationSource.log	dcconfig.exe
File opened for modification	C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcdriver.log	dcconfig.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\reboot_alert.png	msiexec.exe
File opened for modification	C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcondemandtasks.dll	7za.exe
File opened for modification	C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\meaaphelper.exe	7za.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\UEMSGpo.exe	7za.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\resources\AgentApplicationResources_sl_SI.properties	7za.exe

Drops file in Windows directory 19 IoCs

description	ioc	Process
File created	C:\Windows\Installer\e580e92.mst	msiexec.exe
File opened for modification	C:\Windows\Installer\e580e92.mst	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI1A6A.tmp	msiexec.exe
File created	C:\Windows\Installer\{6AD2231F-FF48-4D59-AC26-405AFAE23DB7}\UEMSAgent.mst	msiexec.exe
File opened for modification	C:\Windows\Installer\{6AD2231F-FF48-4D59-AC26-405AFAE23DB7}\UEMSAgent.mst	msiexec.exe
File opened for modification	C:\Windows\Tasks\UEMSLogCollector.job	dcagentregister.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI7E55.tmp	msiexec.exe
File created	C:\Windows\Tasks\DCAgentUpdater.job	dcagentregister.exe
File opened for modification	C:\Windows\Tasks\DCAgentUpdater.job	dcagentregister.exe
File created	C:\Windows\Installer\e580e91.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI13A2.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\e580e9a.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e580e91.msi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{6AD2231F-FF48-4D59-AC26-405AFAE23DB7}	msiexec.exe
File created	C:\Windows\Installer\{6AD2231F-FF48-4D59-AC26-405AFAE23DB7}\DCAgentServerInfo.json	dcagentregister.exe
File created	C:\Windows\Tasks\UEMSLogCollector.job	dcagentregister.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4572	cmd.exe
1672	cmd.exe

Modifies trusted root certificate store through registry 1 TTPs 8 IoCs

A root certificate was added, modified, or removed in the trusted certificate store registry paths.

defense_evasion

Install Root Certificate

T1553.004

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\BEDBC5793A531CFA71A3BB24409732AFCC27EA4B\Blob = 19000000010000001000000011df7644305698c587a5768a33c684130f00000001000000200000000bfc449bd8b54be98c7ff7f68070d79e574dffd3f4c9e416ca9f11248aa0ed98030000000100000014000000bedbc5793a531cfa71a3bb24409732afcc27ea4b14000000010000001400000020a029e73bd3725022541310e73eee2834b128912000000001000000f0030000308203ec308202d4a003020102020872c1dd21bed2063f300d06092a864886f70d01010b05003071310b3009060355040613025553310b300906035504080c024341311b3019060355040b0c124d616e616765456e67696e652d44532d434131193017060355040a0c105a6f686f20436f72706f726174696f6e311d301b06035504030c144d616e616765456e67696e6543412d44532d43413022180f32303236303831363136313733305a180f32303531303831363136313733305a3071310b3009060355040613025553310b300906035504080c024341311b3019060355040b0c124d616e616765456e67696e652d44532d434131193017060355040a0c105a6f686f20436f72706f726174696f6e311d301b06035504030c144d616e616765456e67696e6543412d44532d434130820122300d06092a864886f70d01010105000382010f003082010a0282010100e19b08c5fc89c0cfc6334304a15746a796e791080e3a383a66e4331f1d6c05ab25ce6462368528ac2d46afbc7bed73881947d26f86028cfdf5d0673cbf619c961811387df588ed8f180e2c8889940465c7933b4cc82bbb22b619c96cf6507196a5843108dc741b1763c8fe626bb98bf8ad4ee6a01c230634b085f98c1ca53037aae67433cae45591ff9e56054cbde46d286eadb1b648b81efd9a060225c25e228c1e46105140a06fbe3f0bb7318eb589e2c37f6afedc7902f19185fa41966bfcde017b75b836a43e77d17f5351213488db69cd5ab203a897d61a00cacc6a50d3cce7fc98332dba19c9feb07371355b55d43f4fb37f73667d4c47e252baae53810203010001a3818330818030120603551d130101ff040830060101ff020100301d0603551d0e0416041420a029e73bd3725022541310e73eee2834b12891301f0603551d2304183016801420a029e73bd3725022541310e73eee2834b12891300b0603551d0f0404030201a6301d0603551d250416301406082b0601050507030106082b06010505070302300d06092a864886f70d01010b05000382010100de4080e98c0af5dbf2a8208e64aacdb018f8d47ea1dad7b17fd99a8121cf3eabe8a2cfc88a87578a0d4ad788d89dc536388bfe790559eb606caa3c41875de3bf52bc28d40876eb7624b2c8cb81a878ea21a6442047066f1c203fbdc4824c0c92e6d96c9904970880fec82205640f33e99fe5c75e05893d47155b25b756b593ac9057376bcffa48692334ee1b03a406fcdcadfb553f9f2e3756869110deb2b3f7a76b2bb343133f5f989c48e531a2a64283b93134d36a18a06412c6fd81688214f58d25ebc9a5fe5dcb40a13edb3b78837e96a6ffffe547513e18b7789f2a491a63da15c69460b8a4dc04c22a0edb421441d1bfe2d6bfeaefdb138e688ec807fe	dcagentregister.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3778106BE3782E7EA143398E76B132D6A592AF74\Blob = 19000000010000001000000007ccc3ef391680ec6939187cca6e37850f0000000100000020000000361bdbf3256be50f85c72ae17eaef45f10ded660a1c7cbe1b977fbfb47ce2bfc0300000001000000140000003778106be3782e7ea143398e76b132d6a592af7414000000010000001400000013ce14b474373804ea37bd7a339e5b41bbc32e3c2000000001000000d8030000308203d4308202bca003020102020867270976b51696ff300d06092a864886f70d01010b05003065310b3009060355040613025553310b300906035504080c02434131153013060355040b0c0c4d616e616765456e67696e6531193017060355040a0c105a6f686f20436f72706f726174696f6e3117301506035504030c0e4d616e616765456e67696e6543413022180f32303236303831363136313732395a180f32303531303831363136313732395a3065310b3009060355040613025553310b300906035504080c02434131153013060355040b0c0c4d616e616765456e67696e6531193017060355040a0c105a6f686f20436f72706f726174696f6e3117301506035504030c0e4d616e616765456e67696e65434130820122300d06092a864886f70d01010105000382010f003082010a0282010100a74ff63d48ef15675621c0e032a8f28d6bd3d56f793abdb8b94156ac46b20aabfbc4fc85084ebda68a9aced43908d9338ff6c4f0fd1e379b5ceab01b8d36d325c05d5dfdc62a4da0146a4fa6c000a11ee0a4bd3c49334e9989fc288b75d429fbecdcc9057fd72915e86db39183d9fffd40e0b24683014022b0a858f5d9c22aeb617b053f2495923df0083b43f68a44ad0ef212a10e3dd13ec22793e2f9ebd383bd3f679ea88e7a8d3d22d36122541064fa99003a2232722ce9887fc83b7b68df6b33bf60af56d5fa035f293863bfe795f60825b3f4ed601fbf67b86df640b263492641ddec6926822dd47b792fbe042f0434d77a83c3c9690c08855f7eff2b010203010001a3818330818030120603551d130101ff040830060101ff020100301d0603551d0e0416041413ce14b474373804ea37bd7a339e5b41bbc32e3c301f0603551d2304183016801413ce14b474373804ea37bd7a339e5b41bbc32e3c300b0603551d0f0404030201a6301d0603551d250416301406082b0601050507030106082b06010505070302300d06092a864886f70d01010b0500038201010047a07b524fcda05322c2db0e13aed99c9688c6a0ed5678f696cc2ac0f8e37378f336a5fe88dc5f68658dd4ff4c8f361e00b6a43ab633f80381b230bccac3b740e9b213b7de1f8a98ab7617319b109efb57fd16d2b9bea6f2a56be8fc5825717faa8c25368162b330f23292d0b4a9cbc90eda56fcf7d6acd734a032b111b1fb62804b2227735e834046f916fcae126d6b00bb0dc3a32b4ff4b290257fd25e54a2176961fe6b6651e17d4f2b0feb13113f9c83e02a79ecce611c7b80053513c1f2ff60f082b30023086b55cf4083b4bed215b7c641ca38e1f2669e3b89685e748b75aaa3f81dd6b3ad45da020f0f658e360f7d5e44177dd4ff813804f24f254d7f	dcagentregister.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3778106BE3782E7EA143398E76B132D6A592AF74\Blob = 0300000001000000140000003778106be3782e7ea143398e76b132d6a592af742000000001000000d8030000308203d4308202bca003020102020867270976b51696ff300d06092a864886f70d01010b05003065310b3009060355040613025553310b300906035504080c02434131153013060355040b0c0c4d616e616765456e67696e6531193017060355040a0c105a6f686f20436f72706f726174696f6e3117301506035504030c0e4d616e616765456e67696e6543413022180f32303236303831363136313732395a180f32303531303831363136313732395a3065310b3009060355040613025553310b300906035504080c02434131153013060355040b0c0c4d616e616765456e67696e6531193017060355040a0c105a6f686f20436f72706f726174696f6e3117301506035504030c0e4d616e616765456e67696e65434130820122300d06092a864886f70d01010105000382010f003082010a0282010100a74ff63d48ef15675621c0e032a8f28d6bd3d56f793abdb8b94156ac46b20aabfbc4fc85084ebda68a9aced43908d9338ff6c4f0fd1e379b5ceab01b8d36d325c05d5dfdc62a4da0146a4fa6c000a11ee0a4bd3c49334e9989fc288b75d429fbecdcc9057fd72915e86db39183d9fffd40e0b24683014022b0a858f5d9c22aeb617b053f2495923df0083b43f68a44ad0ef212a10e3dd13ec22793e2f9ebd383bd3f679ea88e7a8d3d22d36122541064fa99003a2232722ce9887fc83b7b68df6b33bf60af56d5fa035f293863bfe795f60825b3f4ed601fbf67b86df640b263492641ddec6926822dd47b792fbe042f0434d77a83c3c9690c08855f7eff2b010203010001a3818330818030120603551d130101ff040830060101ff020100301d0603551d0e0416041413ce14b474373804ea37bd7a339e5b41bbc32e3c301f0603551d2304183016801413ce14b474373804ea37bd7a339e5b41bbc32e3c300b0603551d0f0404030201a6301d0603551d250416301406082b0601050507030106082b06010505070302300d06092a864886f70d01010b0500038201010047a07b524fcda05322c2db0e13aed99c9688c6a0ed5678f696cc2ac0f8e37378f336a5fe88dc5f68658dd4ff4c8f361e00b6a43ab633f80381b230bccac3b740e9b213b7de1f8a98ab7617319b109efb57fd16d2b9bea6f2a56be8fc5825717faa8c25368162b330f23292d0b4a9cbc90eda56fcf7d6acd734a032b111b1fb62804b2227735e834046f916fcae126d6b00bb0dc3a32b4ff4b290257fd25e54a2176961fe6b6651e17d4f2b0feb13113f9c83e02a79ecce611c7b80053513c1f2ff60f082b30023086b55cf4083b4bed215b7c641ca38e1f2669e3b89685e748b75aaa3f81dd6b3ad45da020f0f658e360f7d5e44177dd4ff813804f24f254d7f	dcagentregister.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\BEDBC5793A531CFA71A3BB24409732AFCC27EA4B\Blob = 030000000100000014000000bedbc5793a531cfa71a3bb24409732afcc27ea4b2000000001000000f0030000308203ec308202d4a003020102020872c1dd21bed2063f300d06092a864886f70d01010b05003071310b3009060355040613025553310b300906035504080c024341311b3019060355040b0c124d616e616765456e67696e652d44532d434131193017060355040a0c105a6f686f20436f72706f726174696f6e311d301b06035504030c144d616e616765456e67696e6543412d44532d43413022180f32303236303831363136313733305a180f32303531303831363136313733305a3071310b3009060355040613025553310b300906035504080c024341311b3019060355040b0c124d616e616765456e67696e652d44532d434131193017060355040a0c105a6f686f20436f72706f726174696f6e311d301b06035504030c144d616e616765456e67696e6543412d44532d434130820122300d06092a864886f70d01010105000382010f003082010a0282010100e19b08c5fc89c0cfc6334304a15746a796e791080e3a383a66e4331f1d6c05ab25ce6462368528ac2d46afbc7bed73881947d26f86028cfdf5d0673cbf619c961811387df588ed8f180e2c8889940465c7933b4cc82bbb22b619c96cf6507196a5843108dc741b1763c8fe626bb98bf8ad4ee6a01c230634b085f98c1ca53037aae67433cae45591ff9e56054cbde46d286eadb1b648b81efd9a060225c25e228c1e46105140a06fbe3f0bb7318eb589e2c37f6afedc7902f19185fa41966bfcde017b75b836a43e77d17f5351213488db69cd5ab203a897d61a00cacc6a50d3cce7fc98332dba19c9feb07371355b55d43f4fb37f73667d4c47e252baae53810203010001a3818330818030120603551d130101ff040830060101ff020100301d0603551d0e0416041420a029e73bd3725022541310e73eee2834b12891301f0603551d2304183016801420a029e73bd3725022541310e73eee2834b12891300b0603551d0f0404030201a6301d0603551d250416301406082b0601050507030106082b06010505070302300d06092a864886f70d01010b05000382010100de4080e98c0af5dbf2a8208e64aacdb018f8d47ea1dad7b17fd99a8121cf3eabe8a2cfc88a87578a0d4ad788d89dc536388bfe790559eb606caa3c41875de3bf52bc28d40876eb7624b2c8cb81a878ea21a6442047066f1c203fbdc4824c0c92e6d96c9904970880fec82205640f33e99fe5c75e05893d47155b25b756b593ac9057376bcffa48692334ee1b03a406fcdcadfb553f9f2e3756869110deb2b3f7a76b2bb343133f5f989c48e531a2a64283b93134d36a18a06412c6fd81688214f58d25ebc9a5fe5dcb40a13edb3b78837e96a6ffffe547513e18b7789f2a491a63da15c69460b8a4dc04c22a0edb421441d1bfe2d6bfeaefdb138e688ec807fe	dcagentregister.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\BEDBC5793A531CFA71A3BB24409732AFCC27EA4B\Blob = 0f00000001000000200000000bfc449bd8b54be98c7ff7f68070d79e574dffd3f4c9e416ca9f11248aa0ed98030000000100000014000000bedbc5793a531cfa71a3bb24409732afcc27ea4b2000000001000000f0030000308203ec308202d4a003020102020872c1dd21bed2063f300d06092a864886f70d01010b05003071310b3009060355040613025553310b300906035504080c024341311b3019060355040b0c124d616e616765456e67696e652d44532d434131193017060355040a0c105a6f686f20436f72706f726174696f6e311d301b06035504030c144d616e616765456e67696e6543412d44532d43413022180f32303236303831363136313733305a180f32303531303831363136313733305a3071310b3009060355040613025553310b300906035504080c024341311b3019060355040b0c124d616e616765456e67696e652d44532d434131193017060355040a0c105a6f686f20436f72706f726174696f6e311d301b06035504030c144d616e616765456e67696e6543412d44532d434130820122300d06092a864886f70d01010105000382010f003082010a0282010100e19b08c5fc89c0cfc6334304a15746a796e791080e3a383a66e4331f1d6c05ab25ce6462368528ac2d46afbc7bed73881947d26f86028cfdf5d0673cbf619c961811387df588ed8f180e2c8889940465c7933b4cc82bbb22b619c96cf6507196a5843108dc741b1763c8fe626bb98bf8ad4ee6a01c230634b085f98c1ca53037aae67433cae45591ff9e56054cbde46d286eadb1b648b81efd9a060225c25e228c1e46105140a06fbe3f0bb7318eb589e2c37f6afedc7902f19185fa41966bfcde017b75b836a43e77d17f5351213488db69cd5ab203a897d61a00cacc6a50d3cce7fc98332dba19c9feb07371355b55d43f4fb37f73667d4c47e252baae53810203010001a3818330818030120603551d130101ff040830060101ff020100301d0603551d0e0416041420a029e73bd3725022541310e73eee2834b12891301f0603551d2304183016801420a029e73bd3725022541310e73eee2834b12891300b0603551d0f0404030201a6301d0603551d250416301406082b0601050507030106082b06010505070302300d06092a864886f70d01010b05000382010100de4080e98c0af5dbf2a8208e64aacdb018f8d47ea1dad7b17fd99a8121cf3eabe8a2cfc88a87578a0d4ad788d89dc536388bfe790559eb606caa3c41875de3bf52bc28d40876eb7624b2c8cb81a878ea21a6442047066f1c203fbdc4824c0c92e6d96c9904970880fec82205640f33e99fe5c75e05893d47155b25b756b593ac9057376bcffa48692334ee1b03a406fcdcadfb553f9f2e3756869110deb2b3f7a76b2bb343133f5f989c48e531a2a64283b93134d36a18a06412c6fd81688214f58d25ebc9a5fe5dcb40a13edb3b78837e96a6ffffe547513e18b7789f2a491a63da15c69460b8a4dc04c22a0edb421441d1bfe2d6bfeaefdb138e688ec807fe	dcagentregister.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3778106BE3782E7EA143398E76B132D6A592AF74\Blob = 0f0000000100000020000000361bdbf3256be50f85c72ae17eaef45f10ded660a1c7cbe1b977fbfb47ce2bfc0300000001000000140000003778106be3782e7ea143398e76b132d6a592af742000000001000000d8030000308203d4308202bca003020102020867270976b51696ff300d06092a864886f70d01010b05003065310b3009060355040613025553310b300906035504080c02434131153013060355040b0c0c4d616e616765456e67696e6531193017060355040a0c105a6f686f20436f72706f726174696f6e3117301506035504030c0e4d616e616765456e67696e6543413022180f32303236303831363136313732395a180f32303531303831363136313732395a3065310b3009060355040613025553310b300906035504080c02434131153013060355040b0c0c4d616e616765456e67696e6531193017060355040a0c105a6f686f20436f72706f726174696f6e3117301506035504030c0e4d616e616765456e67696e65434130820122300d06092a864886f70d01010105000382010f003082010a0282010100a74ff63d48ef15675621c0e032a8f28d6bd3d56f793abdb8b94156ac46b20aabfbc4fc85084ebda68a9aced43908d9338ff6c4f0fd1e379b5ceab01b8d36d325c05d5dfdc62a4da0146a4fa6c000a11ee0a4bd3c49334e9989fc288b75d429fbecdcc9057fd72915e86db39183d9fffd40e0b24683014022b0a858f5d9c22aeb617b053f2495923df0083b43f68a44ad0ef212a10e3dd13ec22793e2f9ebd383bd3f679ea88e7a8d3d22d36122541064fa99003a2232722ce9887fc83b7b68df6b33bf60af56d5fa035f293863bfe795f60825b3f4ed601fbf67b86df640b263492641ddec6926822dd47b792fbe042f0434d77a83c3c9690c08855f7eff2b010203010001a3818330818030120603551d130101ff040830060101ff020100301d0603551d0e0416041413ce14b474373804ea37bd7a339e5b41bbc32e3c301f0603551d2304183016801413ce14b474373804ea37bd7a339e5b41bbc32e3c300b0603551d0f0404030201a6301d0603551d250416301406082b0601050507030106082b06010505070302300d06092a864886f70d01010b0500038201010047a07b524fcda05322c2db0e13aed99c9688c6a0ed5678f696cc2ac0f8e37378f336a5fe88dc5f68658dd4ff4c8f361e00b6a43ab633f80381b230bccac3b740e9b213b7de1f8a98ab7617319b109efb57fd16d2b9bea6f2a56be8fc5825717faa8c25368162b330f23292d0b4a9cbc90eda56fcf7d6acd734a032b111b1fb62804b2227735e834046f916fcae126d6b00bb0dc3a32b4ff4b290257fd25e54a2176961fe6b6651e17d4f2b0feb13113f9c83e02a79ecce611c7b80053513c1f2ff60f082b30023086b55cf4083b4bed215b7c641ca38e1f2669e3b89685e748b75aaa3f81dd6b3ad45da020f0f658e360f7d5e44177dd4ff813804f24f254d7f	dcagentregister.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\BEDBC5793A531CFA71A3BB24409732AFCC27EA4B\Blob = 14000000010000001400000020a029e73bd3725022541310e73eee2834b12891030000000100000014000000bedbc5793a531cfa71a3bb24409732afcc27ea4b0f00000001000000200000000bfc449bd8b54be98c7ff7f68070d79e574dffd3f4c9e416ca9f11248aa0ed982000000001000000f0030000308203ec308202d4a003020102020872c1dd21bed2063f300d06092a864886f70d01010b05003071310b3009060355040613025553310b300906035504080c024341311b3019060355040b0c124d616e616765456e67696e652d44532d434131193017060355040a0c105a6f686f20436f72706f726174696f6e311d301b06035504030c144d616e616765456e67696e6543412d44532d43413022180f32303236303831363136313733305a180f32303531303831363136313733305a3071310b3009060355040613025553310b300906035504080c024341311b3019060355040b0c124d616e616765456e67696e652d44532d434131193017060355040a0c105a6f686f20436f72706f726174696f6e311d301b06035504030c144d616e616765456e67696e6543412d44532d434130820122300d06092a864886f70d01010105000382010f003082010a0282010100e19b08c5fc89c0cfc6334304a15746a796e791080e3a383a66e4331f1d6c05ab25ce6462368528ac2d46afbc7bed73881947d26f86028cfdf5d0673cbf619c961811387df588ed8f180e2c8889940465c7933b4cc82bbb22b619c96cf6507196a5843108dc741b1763c8fe626bb98bf8ad4ee6a01c230634b085f98c1ca53037aae67433cae45591ff9e56054cbde46d286eadb1b648b81efd9a060225c25e228c1e46105140a06fbe3f0bb7318eb589e2c37f6afedc7902f19185fa41966bfcde017b75b836a43e77d17f5351213488db69cd5ab203a897d61a00cacc6a50d3cce7fc98332dba19c9feb07371355b55d43f4fb37f73667d4c47e252baae53810203010001a3818330818030120603551d130101ff040830060101ff020100301d0603551d0e0416041420a029e73bd3725022541310e73eee2834b12891301f0603551d2304183016801420a029e73bd3725022541310e73eee2834b12891300b0603551d0f0404030201a6301d0603551d250416301406082b0601050507030106082b06010505070302300d06092a864886f70d01010b05000382010100de4080e98c0af5dbf2a8208e64aacdb018f8d47ea1dad7b17fd99a8121cf3eabe8a2cfc88a87578a0d4ad788d89dc536388bfe790559eb606caa3c41875de3bf52bc28d40876eb7624b2c8cb81a878ea21a6442047066f1c203fbdc4824c0c92e6d96c9904970880fec82205640f33e99fe5c75e05893d47155b25b756b593ac9057376bcffa48692334ee1b03a406fcdcadfb553f9f2e3756869110deb2b3f7a76b2bb343133f5f989c48e531a2a64283b93134d36a18a06412c6fd81688214f58d25ebc9a5fe5dcb40a13edb3b78837e96a6ffffe547513e18b7789f2a491a63da15c69460b8a4dc04c22a0edb421441d1bfe2d6bfeaefdb138e688ec807fe	dcagentregister.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3778106BE3782E7EA143398E76B132D6A592AF74\Blob = 14000000010000001400000013ce14b474373804ea37bd7a339e5b41bbc32e3c0300000001000000140000003778106be3782e7ea143398e76b132d6a592af740f0000000100000020000000361bdbf3256be50f85c72ae17eaef45f10ded660a1c7cbe1b977fbfb47ce2bfc2000000001000000d8030000308203d4308202bca003020102020867270976b51696ff300d06092a864886f70d01010b05003065310b3009060355040613025553310b300906035504080c02434131153013060355040b0c0c4d616e616765456e67696e6531193017060355040a0c105a6f686f20436f72706f726174696f6e3117301506035504030c0e4d616e616765456e67696e6543413022180f32303236303831363136313732395a180f32303531303831363136313732395a3065310b3009060355040613025553310b300906035504080c02434131153013060355040b0c0c4d616e616765456e67696e6531193017060355040a0c105a6f686f20436f72706f726174696f6e3117301506035504030c0e4d616e616765456e67696e65434130820122300d06092a864886f70d01010105000382010f003082010a0282010100a74ff63d48ef15675621c0e032a8f28d6bd3d56f793abdb8b94156ac46b20aabfbc4fc85084ebda68a9aced43908d9338ff6c4f0fd1e379b5ceab01b8d36d325c05d5dfdc62a4da0146a4fa6c000a11ee0a4bd3c49334e9989fc288b75d429fbecdcc9057fd72915e86db39183d9fffd40e0b24683014022b0a858f5d9c22aeb617b053f2495923df0083b43f68a44ad0ef212a10e3dd13ec22793e2f9ebd383bd3f679ea88e7a8d3d22d36122541064fa99003a2232722ce9887fc83b7b68df6b33bf60af56d5fa035f293863bfe795f60825b3f4ed601fbf67b86df640b263492641ddec6926822dd47b792fbe042f0434d77a83c3c9690c08855f7eff2b010203010001a3818330818030120603551d130101ff040830060101ff020100301d0603551d0e0416041413ce14b474373804ea37bd7a339e5b41bbc32e3c301f0603551d2304183016801413ce14b474373804ea37bd7a339e5b41bbc32e3c300b0603551d0f0404030201a6301d0603551d250416301406082b0601050507030106082b06010505070302300d06092a864886f70d01010b0500038201010047a07b524fcda05322c2db0e13aed99c9688c6a0ed5678f696cc2ac0f8e37378f336a5fe88dc5f68658dd4ff4c8f361e00b6a43ab633f80381b230bccac3b740e9b213b7de1f8a98ab7617319b109efb57fd16d2b9bea6f2a56be8fc5825717faa8c25368162b330f23292d0b4a9cbc90eda56fcf7d6acd734a032b111b1fb62804b2227735e834046f916fcae126d6b00bb0dc3a32b4ff4b290257fd25e54a2176961fe6b6651e17d4f2b0feb13113f9c83e02a79ecce611c7b80053513c1f2ff60f082b30023086b55cf4083b4bed215b7c641ca38e1f2669e3b89685e748b75aaa3f81dd6b3ad45da020f0f658e360f7d5e44177dd4ff813804f24f254d7f	dcagentregister.exe

System Location Discovery: System Language Discovery 1 TTPs 38 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language\InstallLanguage	dcinventory.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dcagentservice.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dcswmeter.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dcinventory.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language	dcinventory.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dcagentregister.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	systeminfo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language	dcconfig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7za.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language	dcagentregister.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CRU_Reporter.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language\InstallLanguage	dcconfig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language\InstallLanguage	dcagentregister.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dcondemand.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	UEMSAgentHCHelper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dcagentregister.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dcagentservice.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dcusbsummary.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language\InstallLanguage	dcagentregister.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	UEMSAgentHealthChecker.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	UEMSAgentHCHelper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language	dcagentregister.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dcstatusutil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dcconfig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	UEMSAgentHCHelper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dcconfig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dcconfig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7za.exe

Checks SCSI registry key(s) 3 TTPs 10 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\DeviceDesc	dcusb64.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Capabilities	dcusb64.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	dcusbsummary.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	dcusbsummary.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	dcusb64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	dcusb64.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\DeviceDesc	dcusb64.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Capabilities	dcusb64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	dcusbsummary.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	dcusbsummary.exe

Gathers system information 1 TTPs 1 IoCs

Runs systeminfo.exe.

System Information Discovery

T1082

pid	Process
3004	systeminfo.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	dcagentregister.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dcagentservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	dcagentservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	dcconfig.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	dcconfig.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	dcinventory.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dcconfig.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dcondemand.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	dcondemand.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	dcconfig.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	dcinventory.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	dcagentregister.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	dcagentregister.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	dcconfig.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	dcagentregister.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dcconfig.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	dcconfig.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	dcconfig.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	dcagentregister.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	dcagentservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	dcondemand.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	dcconfig.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	dcconfig.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	dcconfig.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dcconfig.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	dcagentregister.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	dcagentservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	dcconfig.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dcondemand.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	dcagentregister.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	dcconfig.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dcagentregister.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	dcconfig.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	dcinventory.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	dcagentregister.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	dcconfig.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dcinventory.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dcinventory.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	dcagentregister.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dcagentregister.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	dcconfig.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	dcondemand.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	dcondemand.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dcconfig.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	dcconfig.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	dcconfig.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dcondemand.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	dcondemand.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	dcconfig.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	dcconfig.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	dcconfig.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dcondemand.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dcinventory.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	dcagentregister.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	dcagentregister.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	dcconfig.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dcconfig.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	dcconfig.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	dcconfig.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	dcinventory.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dcconfig.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	dcconfig.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	dcconfig.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	dcconfig.exe

Modifies registry class 36 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\DeploymentFlags = "3"	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\SourceList\Net	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B	dcagentservice.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\SourceList\Net\2 = "C:\\Program Files (x86)\\ManageEngine\\UEMS_Agent\\Updates\\Healer\\"	dcagentservice.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\F1322DA684FF95D4CA6204A5AF2ED37B	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\Language = "1033"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\Assignment = "1"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\RarSFX0\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\SourceList\Net	dcagentservice.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer	dcagentservice.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\AdvertiseFlags = "388"	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\SourceList	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\SourceList	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\Clients = 3a0000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\RarSFX0\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\SourceList\Net	dcagentregister.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\PackageCode = "7C3FEC54F6DB2754AA34EB273B9C5915"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\InstanceType = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\SourceList\Media\1 = ";"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products	dcagentservice.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\SourceList	dcagentservice.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\SourceList\PackageName = "UEMSAgent.msi"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\Version = "184879683"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\D8A2F4839B95CB04BA7F5CC68357B333\F1322DA684FF95D4CA6204A5AF2ED37B	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\SourceList\Net	dcconfig.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\SourceList\Net\2 = "C:\\Program Files (x86)\\ManageEngine\\UEMS_Agent\\Updates\\Healer\\"	dcagentregister.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\AuthorizedLUAApp = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\D8A2F4839B95CB04BA7F5CC68357B333	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\SourceList\Net	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\SourceList\Media	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\SourceList\Net\2 = "C:\\Program Files (x86)\\ManageEngine\\UEMS_Agent\\Updates\\Healer\\"	dcconfig.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\F1322DA684FF95D4CA6204A5AF2ED37B\DefaultFeature	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\ProductName = "ManageEngine UEMS - Agent"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F1322DA684FF95D4CA6204A5AF2ED37B\Transforms = "C:\\Windows\\Installer\\{6AD2231F-FF48-4D59-AC26-405AFAE23DB7}\\UEMSAgent.mst"	msiexec.exe

Modifies system certificate store 2 TTPs 2 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\BEDBC5793A531CFA71A3BB24409732AFCC27EA4B	dcagentregister.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3778106BE3782E7EA143398E76B132D6A592AF74	dcagentregister.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1124	dcagentregister.exe
1124	dcagentregister.exe
1124	dcagentregister.exe
1124	dcagentregister.exe
1124	dcagentregister.exe
1124	dcagentregister.exe
1124	dcagentregister.exe
1124	dcagentregister.exe
1124	dcagentregister.exe
1124	dcagentregister.exe
1124	dcagentregister.exe
1124	dcagentregister.exe
1124	dcagentregister.exe
1124	dcagentregister.exe
1124	dcagentregister.exe
1124	dcagentregister.exe
1124	dcagentregister.exe
1124	dcagentregister.exe
1124	dcagentregister.exe
1124	dcagentregister.exe
1124	dcagentregister.exe
1124	dcagentregister.exe
1124	dcagentregister.exe
1124	dcagentregister.exe
1124	dcagentregister.exe
1124	dcagentregister.exe
1124	dcagentregister.exe
1124	dcagentregister.exe
1124	dcagentregister.exe
1124	dcagentregister.exe
1124	dcagentregister.exe
1124	dcagentregister.exe
1124	dcagentregister.exe
1124	dcagentregister.exe
1124	dcagentregister.exe
1124	dcagentregister.exe
1124	dcagentregister.exe
1124	dcagentregister.exe
1124	dcagentregister.exe
1124	dcagentregister.exe
1124	dcagentregister.exe
1124	dcagentregister.exe
1124	dcagentregister.exe
1124	dcagentregister.exe
1124	dcagentregister.exe
1124	dcagentregister.exe
1124	dcagentregister.exe
1124	dcagentregister.exe
1124	dcagentregister.exe
1124	dcagentregister.exe
1124	dcagentregister.exe
1124	dcagentregister.exe
1124	dcagentregister.exe
1124	dcagentregister.exe
1124	dcagentregister.exe
1124	dcagentregister.exe
1124	dcagentregister.exe
1124	dcagentregister.exe
1124	dcagentregister.exe
1124	dcagentregister.exe
1124	dcagentregister.exe
1124	dcagentregister.exe
1124	dcagentregister.exe
1124	dcagentregister.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2660	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2660	msiexec.exe
Token: SeSecurityPrivilege	3304	msiexec.exe
Token: SeCreateTokenPrivilege	2660	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	2660	msiexec.exe
Token: SeLockMemoryPrivilege	2660	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2660	msiexec.exe
Token: SeMachineAccountPrivilege	2660	msiexec.exe
Token: SeTcbPrivilege	2660	msiexec.exe
Token: SeSecurityPrivilege	2660	msiexec.exe
Token: SeTakeOwnershipPrivilege	2660	msiexec.exe
Token: SeLoadDriverPrivilege	2660	msiexec.exe
Token: SeSystemProfilePrivilege	2660	msiexec.exe
Token: SeSystemtimePrivilege	2660	msiexec.exe
Token: SeProfSingleProcessPrivilege	2660	msiexec.exe
Token: SeIncBasePriorityPrivilege	2660	msiexec.exe
Token: SeCreatePagefilePrivilege	2660	msiexec.exe
Token: SeCreatePermanentPrivilege	2660	msiexec.exe
Token: SeBackupPrivilege	2660	msiexec.exe
Token: SeRestorePrivilege	2660	msiexec.exe
Token: SeShutdownPrivilege	2660	msiexec.exe
Token: SeDebugPrivilege	2660	msiexec.exe
Token: SeAuditPrivilege	2660	msiexec.exe
Token: SeSystemEnvironmentPrivilege	2660	msiexec.exe
Token: SeChangeNotifyPrivilege	2660	msiexec.exe
Token: SeRemoteShutdownPrivilege	2660	msiexec.exe
Token: SeUndockPrivilege	2660	msiexec.exe
Token: SeSyncAgentPrivilege	2660	msiexec.exe
Token: SeEnableDelegationPrivilege	2660	msiexec.exe
Token: SeManageVolumePrivilege	2660	msiexec.exe
Token: SeImpersonatePrivilege	2660	msiexec.exe
Token: SeCreateGlobalPrivilege	2660	msiexec.exe
Token: SeRestorePrivilege	3304	msiexec.exe
Token: SeTakeOwnershipPrivilege	3304	msiexec.exe
Token: SeRestorePrivilege	3304	msiexec.exe
Token: SeTakeOwnershipPrivilege	3304	msiexec.exe
Token: SeRestorePrivilege	3304	msiexec.exe
Token: SeTakeOwnershipPrivilege	3304	msiexec.exe
Token: SeRestorePrivilege	3304	msiexec.exe
Token: SeTakeOwnershipPrivilege	3304	msiexec.exe
Token: SeRestorePrivilege	3304	msiexec.exe
Token: SeTakeOwnershipPrivilege	3304	msiexec.exe
Token: SeRestorePrivilege	3304	msiexec.exe
Token: SeTakeOwnershipPrivilege	3304	msiexec.exe
Token: SeRestorePrivilege	3304	msiexec.exe
Token: SeTakeOwnershipPrivilege	3304	msiexec.exe
Token: SeRestorePrivilege	3304	msiexec.exe
Token: SeTakeOwnershipPrivilege	3304	msiexec.exe
Token: SeRestorePrivilege	4864	7za.exe
Token: 35	4864	7za.exe
Token: SeSecurityPrivilege	4864	7za.exe
Token: SeSecurityPrivilege	4864	7za.exe
Token: SeRestorePrivilege	2516	7za.exe
Token: 35	2516	7za.exe
Token: SeSecurityPrivilege	2516	7za.exe
Token: SeSecurityPrivilege	2516	7za.exe
Token: SeDebugPrivilege	3884	dcusbsummary.exe
Token: SeRestorePrivilege	3304	msiexec.exe
Token: SeTakeOwnershipPrivilege	3304	msiexec.exe
Token: SeRestorePrivilege	3304	msiexec.exe
Token: SeTakeOwnershipPrivilege	3304	msiexec.exe
Token: SeRestorePrivilege	3304	msiexec.exe
Token: SeTakeOwnershipPrivilege	3304	msiexec.exe
Token: SeRestorePrivilege	3304	msiexec.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3884	dcusbsummary.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 1104 wrote to memory of 4312	1104	setup.exe	84
PID 4312 wrote to memory of 2660	4312	WScript.exe	85
PID 3304 wrote to memory of 4852	3304	msiexec.exe	88
PID 3304 wrote to memory of 1124	3304	msiexec.exe	93
PID 1124 wrote to memory of 1672	1124	dcagentregister.exe	94
PID 1672 wrote to memory of 4136	1672	cmd.exe	96
PID 4136 wrote to memory of 3904	4136	net.exe	97
PID 1672 wrote to memory of 1668	1672	cmd.exe	98
PID 1672 wrote to memory of 2800	1672	cmd.exe	99
PID 1672 wrote to memory of 2484	1672	cmd.exe	100
PID 1672 wrote to memory of 1520	1672	cmd.exe	101
PID 1672 wrote to memory of 3684	1672	cmd.exe	102
PID 1124 wrote to memory of 4864	1124	dcagentregister.exe	112
PID 1124 wrote to memory of 2516	1124	dcagentregister.exe	114
PID 2060 wrote to memory of 4728	2060	dcagentservice.exe	117
PID 2060 wrote to memory of 2164	2060	dcagentservice.exe	119
PID 2060 wrote to memory of 3884	2060	dcagentservice.exe	121
PID 3884 wrote to memory of 2216	3884	dcusbsummary.exe	122
PID 2060 wrote to memory of 620	2060	dcagentservice.exe	124
PID 2060 wrote to memory of 3476	2060	dcagentservice.exe	125
PID 2060 wrote to memory of 900	2060	dcagentservice.exe	126
PID 2060 wrote to memory of 1904	2060	dcagentservice.exe	130
PID 2060 wrote to memory of 1800	2060	dcagentservice.exe	132
PID 1800 wrote to memory of 3264	1800	dcconfig.exe	134
PID 1124 wrote to memory of 3188	1124	dcagentregister.exe	136
PID 3188 wrote to memory of 4572	3188	dcagentregister.exe	139
PID 4572 wrote to memory of 3004	4572	cmd.exe	141
PID 552 wrote to memory of 1676	552	UEMSAgentHealthChecker.exe	146
PID 552 wrote to memory of 1084	552	UEMSAgentHealthChecker.exe	148
PID 552 wrote to memory of 4328	552	UEMSAgentHealthChecker.exe	150

C:\Users\Admin\AppData\Local\Temp\setup.exe
"C:\Users\Admin\AppData\Local\Temp\setup.exe"
1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1104
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\RarSFX0\SetUP.VBS"
  2⤵
  - Checks computer location settings
  - Executes a VBScript file via the Windows Script Host.
  - Suspicious use of WriteProcessMemory
  PID:4312
- - C:\Windows\System32\msiexec.exe
    "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\RarSFX0\UEMSAgent.msi" TRANSFORMS="C:\Users\Admin\AppData\Local\Temp\RarSFX0\UEMSAgent.mst" ENABLESILENT=yes REBOOT=ReallySuppress INSTALLSOURCE=Manual SERVER_ROOT_CRT="C:\Users\Admin\AppData\Local\Temp\RarSFX0\DMRootCA-Server.crt" DS_ROOT_CRT="C:\Users\Admin\AppData\Local\Temp\RarSFX0\DMRootCA.crt" /qn /norestart /lv "C:\Users\Admin\AppData\Local\Temp\RarSFX0\Agentinstalllog.txt"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2660

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Badlisted process makes network request
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3304
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding B50D49910D7DEDE3309DEAEBD7921133
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:4852
- C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagentregister.exe
  "C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagentregister.exe" -i dc
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - Modifies trusted root certificate store through registry
  - System Location Discovery: System Language Discovery
  - Modifies data under HKEY_USERS
  - Modifies system certificate store
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1124
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\ManageEngine\UEMS_Agent\scripts\setAppPermission_Internal.bat" "C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\""
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1672
  - - C:\Windows\SysWOW64\net.exe
      net session
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4136
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 session
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3904
  - - C:\Windows\SysWOW64\icacls.exe
      "C:\Windows\system32\icacls.exe" "C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\" /grant *S-1-5-18:(OI)(CI)F /T /Q /grant *S-1-5-32-544:(OI)(CI)F /T /Q
      4⤵
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:1668
  - - C:\Windows\SysWOW64\icacls.exe
      "C:\Windows\system32\icacls.exe" "C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\" /grant:r "RYSBVXZE\Admin":(OI)(CI)F /T /Q
      4⤵
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:2800
  - - C:\Windows\SysWOW64\icacls.exe
      "C:\Windows\system32\icacls.exe" "C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\" /inheritance:r
      4⤵
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:2484
  - - C:\Windows\SysWOW64\icacls.exe
      "C:\Windows\system32\icacls.exe" "C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\" /remove:g "CREATOR OWNER" /T /Q /remove:g "BUILTIN\Users" /T /Q /remove:g *S-1-15-2-1 /T /Q
      4⤵
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:1520
  - - C:\Windows\SysWOW64\icacls.exe
      "C:\Windows\system32\icacls.exe" "C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\" /remove:g *S-1-5-11 /T /Q /remove:g *S-1-15-2-2 /T /Q
      4⤵
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:3684
- - C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
    7za e -mx9 "C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\agent_binaries.7z" -o"C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\" -y
    3⤵
    - Executes dropped EXE
    - Drops file in Program Files directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4864
- - C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
    7za.exe e -aoa "C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\locale_resources.zip" -o"C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\resources\"
    3⤵
    - Executes dropped EXE
    - Drops file in Program Files directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2516
- - C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagentregister.exe
    "C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagentregister.exe" -p dc
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:3188
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /C systeminfo.exe > "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\logs\systeminfo.log"
      4⤵
      Executes a command shell one-liner
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4572
    - - C:\Windows\SysWOW64\systeminfo.exe
        
        systeminfo.exe
        5⤵
        System Location Discovery: System Language Discovery
        Gathers system information
        
        PID:3004

C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagentservice.exe
"C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagentservice.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1004

C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagentservice.exe
"C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagentservice.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2060
- C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\CRU_Reporter.exe
  CRU_Reporter.exe -RegisterCRU
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4728
- C:\Program Files (x86)\ManageEngine\UEMS_Agent\dcconfig.exe
  7 0 0
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Modifies data under HKEY_USERS
  - Modifies registry class
  PID:2164
- C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcusbsummary.exe
  "C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcusbsummary.exe" -s ET_ENUM 9 2 "Unknown"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Checks SCSI registry key(s)
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3884
- - C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcusb64.exe
    "C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcusb64.exe" -s 9
    3⤵
    - Executes dropped EXE
    - Checks SCSI registry key(s)
    PID:2216
- C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcstatusutil.exe
  bin\dcstatusutil.exe RequestAgentSlotFromServer
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:620
- C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcondemand.exe
  "C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcondemand.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Modifies data under HKEY_USERS
  PID:3476
- C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcswmeter.exe
  "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\dcswmeter.exe" -s ET_COL
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:900
- C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcinventory.exe
  "C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\dcinventory.exe" -s prenotify
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Modifies data under HKEY_USERS
  PID:1904
- C:\Program Files (x86)\ManageEngine\UEMS_Agent\dcconfig.exe
  3 0 0
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Modifies data under HKEY_USERS
  - Suspicious use of WriteProcessMemory
  PID:1800
- - C:\Program Files (x86)\ManageEngine\UEMS_Agent\dcconfig.exe
    16
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in Program Files directory
    - System Location Discovery: System Language Discovery
    - Modifies data under HKEY_USERS
    PID:3264

C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\UEMSAgentHealthChecker.exe
"C:\Program Files (x86)\ManageEngine\UEMS_Agent\\bin\UEMSAgentHealthChecker.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:552
- C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\UEMSAgentHCHelper.exe
  "C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\UEMSAgentHCHelper.exe" UEMSAgent 1
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1676
- C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\UEMSAgentHCHelper.exe
  "C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\UEMSAgentHCHelper.exe" UEMSAgent 2
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1084
- C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\UEMSAgentHCHelper.exe
  "C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\UEMSAgentHCHelper.exe" UEMSAgent 4
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4328

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Visual Basic

T1059.005

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e580e95.rbs

Path C:\Config.Msi\e580e95.rbs
Size 63KB
SHA256 5f32b5547aa993990c62b1da8b2df4fccbe0e2da15f04d911335b4a6ca11a152
MD5 e6a7582ac493087346982e0cc2f8c0a0
SHA1 48233000109d89a8de03b7657c906802f8c16e33
SHA512 56a9226668654c6b3389a4aaeeabf23c5375cfc5ceebc0825d0873f6f4ab2b07bb3ca270aedd5142f1eaf53f32deb677abb3510281afd30e3affaf2c3dce688b
SSDEEP 768:32vw1oOjyhMzY7yjDO+GLnt5OwAu4OWemwBwM4ImBVbG:G8oGyh7UDO+Vv7kOzbG
TLSH
T171537266DB26E2CBD1152AF63382AD1806098C7B66F0C47E13186D37C4DBB457EBF858
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e580e9b.rbs

Path C:\Config.Msi\e580e9b.rbs
Size 546B
SHA256 3b4d12b2be91dfa86412b7ab33a12ad32254a822e33402f531f15d6d2a22f751
MD5 19dd1fb4a23a50a5da4027f1d3ff47b8
SHA1 704ec3d11ebf404af7a242ca0ef3501b7df0bf06
SHA512 7f5ececdd9bc95b708c72dbf2ee33ccc145d61aec8bacc6ff8bfce9c7159b19ccfd93f1b1f4ce34107d9c9b1c233eb43469f86473b5f8418a8d77d9f488d7a0f
TLSH
T136F09ED3A70C46D2D5907A3612036F541A2BE17A815447762E846274BE2621E5EBA0DC
MD5 SHA1 SHA512 TLSH

Submit Download

client.p12

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\Certificates\client.p12
Size 1KB
SHA256 6ed41c7ff916d658bc06e6af7f433e0663d67e9a19630025dc41d4882d55127c
MD5 3bd04b744beff49a2a7630efb3ac25e7
SHA1 59e2c47881ea2b79a251a66b0835ed2739d03b44
SHA512 76e34b75bf4336211dce401e0e8d58072f62bd6e1e20321770c4b08ce5ab063a90a59f4266783db1592c9c25ef7b4033a9b363a6a191195f5c0e616e72615e4a
TLSH
T18821B4874EA7C0C0BE3E9BB04CDCAC2F7801C704E989B41F32B054865F6142BF74A0A6
MD5 SHA1 SHA512 TLSH

Submit Download

7za.exe

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
Size 839KB
SHA256 bfb34635f295df13ea1677c0d51d08fafd2da21a1c0bea252df6342d40e511a0
MD5 a5efe54df4f28f6d12adf840dc931b36
SHA1 dc9f5baecfc6cb27e8fd3ec56faafa1e007bf743
SHA512 274fe37ae37397efa5425759bc55d6dd53fcd1b76c1472d8d952ff4bb72f5c8ec0f0f28a712e350a2025292851e483f7334463cf2920388c81b238223c9e434a
SSDEEP 24576:fIgB4BNEPZ0m2uTH35dmvTAQkWUnNwjiKSYOojDuR1uwe:fIfBNM2uT5MM/xejJqe
TLSH
T19805AE127BE5D0BBD2420132CB1CABF591F993680B2148C767848F6D7B359D1DA3AA1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ClientAuthHandler.dll

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\ClientAuthHandler.dll
Size 3.1MB
SHA256 83213e2eaf59ae51dae43ef745211cfec11fc2f2cdddcf12e60e876cb31432a2
MD5 44cd42312f8ef1ff272cc404cee42076
SHA1 8c293f4faa0e4ff97565e1464ee29a1fdb2a2c21
SHA512 78039f0b5451408330d13228956a772ce8577c830b6f6908f1afa3dd3c067c7c5b5e6d5b5c27c4ff4c8ee9bf38e6d809dddbf972cf89a84da150752cd82768d4
SSDEEP 49152:Xg2pzZ21QzJJC9d/ImYL5lYbyMffECDYBPkPzUVGoXvPU5BLBjAKnbwk1e:XgE1PJo9d/ImYNlYbyMffE8nwl
TLSH
T16EE59E07FB83D5B1DD8E027801B79B7F5D3A8D184B2089E39B9029ADA8761D0563F36D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Lato-Bold.eot

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\Lato-Bold.eot
Size 250KB
SHA256 b91fc1ca55df440dc11354b32a39b45db663d24bb17b16dcb2e706330955b0d1
MD5 a2fb219c999a8fa6b95ad7c24890072e
SHA1 d0a396e49e4a5cca88e454e3463b7b6b4d57cddb
SHA512 aca3eaa61261f2bf3d1da691b2d6e48e70efb139238d7b885559573d325449aff9a21452903553799b47c8bdfefe242b1b29b31225e94871767acdd8257066a2
SSDEEP 6144:7gdw3WS+AcP021JmpP4D5NFhW9FNOj23RHbu6wtAadMYAm/o:7gOm2pgNFhQy29buHt//W
TLSH
T13544123CE5D727C68951C1A34D18A3DE329CF8AE5C56FBA5349AF8BC8CC15130B5EA81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Lato-Medium.eot

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\Lato-Medium.eot
Size 245KB
SHA256 1727853b9469a665c3a5573e39503bc592a794d810aed5d03e9a8940f507823c
MD5 cecc32d267ee07ce3413637314b66ca0
SHA1 627b584f88033791f427091fff74c9310bdc2ef1
SHA512 b2f21a38ba5608b4851ee8404abb7ce752388b0b9dfcb24c10f4a1961048ce3d4f811f92b7fb7f2040a1f79243b99760e17ed34c4f0f24a5c2031db47322026e
SSDEEP 6144:SOcdcK8q3U1SniBmXCCCBT6vTy8bV5O+M059N:nOcWEtkCCCBT6Ly8bfM059N
TLSH
T12D341201EAF9036FE595D2CB68056B269517891049B0ECAEE1FF1B3E0CDCEFC46815E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UEMSAgentCryptoHandler.dll

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\UEMSAgentCryptoHandler.dll
Size 480KB
SHA256 1350d993df746987d9f73a5f16bbbcfc007b973b47aae002b896e9d8de1d1db1
MD5 45cb15ecac73aaee280a266da5ae9f16
SHA1 69ff47fcbc3bb10b39577928a407fb7c49e0b816
SHA512 6d42216d65331c810a6f92961fc3f7d8c5d559051a4fca5183c05322d023fb47a4b7ab3c643f7b628af0e638eb09ca7d2acc37ee702880475788a9d609b648ac
SSDEEP 6144:P0hLWB2aHCI0IAnwVMtO0/kcPT6dbJu6ktbAi4suVL90PQdIQA7LHPNwJzQyGVQb:PkKB2NPd4sEL90IdI1PbylPP7
TLSH
T197A49E127545C032E6AE01B15A39EFBA66BDFD200F7648CB53C45A3F59B01C27736E2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

agent_binaries.7z

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\agent_binaries.7z
Size 29.1MB
SHA256 14ae05d3e056207fa991ede24704f76bfb6a7c329993769e78374113c4ac0193
MD5 7cb254ffe00821b17585487c2fdd8bb9
SHA1 e224df4a24a8d7886b3799a5934e7999a090368e
SHA512 b5daa042af9843f08ad0922b7506595f35f5e419099bd1c0368a27606d2c4a9e576c5e43819e790c62e6380e6277b37dd04ba932b7385d991a5246700d83eea7
SSDEEP 786432:83NdazNRz1l+az5PdEKYu+FoWf4WHiNMJ741oj:83NdyNRz1YIdmqWAWHN941oj
TLSH
T105673372A01DE23ED713607FACAFCD75D8254F485DBCD97B13EEA80186462A39B22435
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dcagentregister.exe

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagentregister.exe
Size 244KB
SHA256 46532137b794eee1e1b1459bd74d8b4dd79e05533076a4b30e78105c9ce0acd9
MD5 9357d00934d3b4c2f2a3e1876ccb67bc
SHA1 e9225f0c769057a01ee70906b0a3ef63277d5a90
SHA512 12f87b3255ed9b682ba6a37de30d65ac8fb351fae7f51c3dc8984d5ed8b6fd0260a940de876b05e7863ee8b158948a2da0bb029936320894b248a516ec3ee9b9
SSDEEP 3072:QR7kVnRpyFf8ZFpwez3EcmHw2Rpa42/pKwfigDucpXfHtF37nOqsYrmXkZcphTAq:QR7kVn5weorw3RrDpfNtnVCXkZosuW1o
TLSH
T175348E6175D0C072D9A304369CB8DBB6597EF8200F71A5DB63980A7FDE206C29B71B1E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dcagentservice.exe

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagentservice.exe
Size 1.5MB
SHA256 9df7a780cd51de4467f55c8553ba361b1207de9f6073aa5eab5368154041bf2c
MD5 f959f54f1eadb9edbb8c3817712cbb04
SHA1 b29d1779b1f366c1fd4ce58f3215af02eb8f5cec
SHA512 ca25a0bb1a74ccc120ddacdcd64f8eee80563403bc4e9e598f299a9ad69daba9a439eb811d1fc3fcac256cfab0f3ca41d5092deb11b3d5d692452ad151ddf87d
SSDEEP 24576:QMooJgy1mleByM1eWqjNIGeRCWbBodAMJBUY5ZGMUlqLaWVsqxmPttYf1x:zNmMPUzEpbBJ0dtRVsqD9x
TLSH
T19B75AF2376428031D2A100B19D29AB75AF7DA9680B71C4F3E3C49D7DC5E09D29A3E77E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dcstatusutil.exe

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcstatusutil.exe
Size 1.3MB
SHA256 ad2ef8e8cd6d18a93aaa5daea434c1c3b48bf3da5cc7f7af728a53da2b3d8881
MD5 c6ca1931d4f49bde0c80279582840b63
SHA1 9eaf965db61191b1cf6951d219dcaf5d527d5e7b
SHA512 4965c4bdeeac4db8250155d4e648e1514e3cb302e23eea8809d9549997b22c4bc28ada7f05fa5241af102c81a30552085d212062cd9e44ea969bf20acb5a0978
SSDEEP 24576:32CG2B3vBdWRXVnSxUltFN2TRv47moJhFGVqP2IPtNgEk576:mUd8FnDP2TRvkCqP2S
TLSH
T1EE55AE1372528031D2B0C1F19929FB76AB6C99681B6294F3A2C48FBD01E45D26B3F71E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

resources.zip

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\resources.zip
Size 119KB
SHA256 790e4cc4c928b2055f625056e5e98a1ac6059ac54dd30f4126ed01f506b0f23f
MD5 4902b1cadcb92eaa717a922d2815bbcb
SHA1 564be25bf2541881f9ebfb8609654db0385f1798
SHA512 02cf0aac0433c17a7e0aa9561452d32ecd83c19700fc282adec9dd5aa55c6bf10ff37c9176fb004c1ba7aeb25dfa77124b668daa815464aeae54768b115aaa89
SSDEEP 3072:B0nkqDUaOF2LX9P8Oq7EnHPZJUWv9jWHXcxI3GDYK01+x57:BokqoaOFkX9P8T+HxJUlXcxAGDYK01g7
TLSH
T172C312AD87CF104AAC8DD5F22B7AD5D4A896306A334C032C4B05EFD6D5D2F862B8109B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSDetection.json

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\OSJsonfromMSI\OSDetection.json
Size 15KB
SHA256 217d16bf822447ca72c25b81927c8f45eb654beccba6363819e582e98860d33e
MD5 cf5799838289c42502297f17ca89b49b
SHA1 fedc0c8cfb1f9776e096511f8adcd0be5309ca8c
SHA512 98eb1c47b5d10093e202c6259ace58d2e7ef4957c20892fbd067eaf0c88baba994337c2f1bd802191a0e31ca2b3fee72508559acf54a4653b8c2544b440f7556
SSDEEP 96:q0SOJbHBAO8bID3O0seObxtEr5r/Qn2sTLnnmI:q0BhBAO8b0Obx9nFLnnmI
TLSH
T19362D593A51D099F0222039999DF7AD3A1BC94384C7328FEF8C259256FDAC1923737B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

agent-settings.xml

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\agent-settings.xml
Size 5KB
SHA256 f483839509d0b48247c6e6b6ac903dd1843252ae396b0de1b2564830e4a6e28d
MD5 05a75533a8eeab2770fd1d23d028fd53
SHA1 8000e0f9b0a9b70e196f14ba892588af181155b7
SHA512 c4108226bcd3611585bd5f4a4886070c7b90bd23e5d0026658aa40890798a5279262a01a8193e8e3578ab76a681057669f96c1d01da7ebc4e48e636dbdaae742
SSDEEP 96:TWdv4W+Ep6S4cVF6cNZcGRD8wjFbTiahCK/EAA:3UGHElZh+gLzA
TLSH
T123B13110A0A2CF6813B1775C999AEA45CD1506A6361A1E05F02D39A70F3EFC379B74F6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

configuration-settings-dc-win10.xml

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\configuration-settings-dc-win10.xml
Size 247KB
SHA256 4a84d8cc08ffa3e45d7e350550fd32d4a0416788eabe3fba77c8c2df2dc1fe6c
MD5 ff5c89c88fe59a341aa4fe80b6f58215
SHA1 82f86c6bde49bef92565d6f23e79f84bcdc14e20
SHA512 16f1a2208c4c9af43635c676a3e2cad98f8d4fcac0facb91cb3d5b9f5e144c45e42978454783abbadd3f29d3d3d02b9f1a455b0ca0f59cd21bcfeaf3a777a3dd
SSDEEP 768:HtMVQuZ14/++C1TFgSNwbEO6oHJfIb5+qXBi+kpWc2twcIugeIbMjnK8jUEAavAR:HtMzZZ1uSNABIpkIU1
TLSH
T1584417969DFEAC53A2D4091D8E921C087D9A4B874DC91CA035BC7BE4FF634C341A72B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data-dictionary-framework.xml

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\data-dictionary-framework.xml
Size 413KB
SHA256 aa6ab6b406e71bd5f5f4f220de29c8ff8104b318e9e92d8ce74b2755e80b8e22
MD5 a450789f0d23503c895bafaed3d4be27
SHA1 459cfaa1cae6090bb8d98b75452e54a3d85f42e5
SHA512 4d2983551e8de9a883ca7efcf555c5a5e83d32a17fcdabdcc36db7ee16c8b895d2b593b4717cc5fe476b9d9ca7ccbcbdd50aa453a5decbd844beeaa05718892d
SSDEEP 6144:Zs0Hwax5v/yuOusdCCuRugtQiiNJY7tYaCDDZnxFYYh:6fufQiiNJY7tYFSYh
TLSH
T13694B81A2EDDFED4044AD4648C9471942E7B5A3BE19550C0BCDFEE35BB04ADB2C33A62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data-dictionary-onpremise.xml

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\data-dictionary-onpremise.xml
Size 109KB
SHA256 08d8186f45e7586351c3c345b0bd85d9ca6df33032277a4952255825cc7bd428
MD5 b39316c180a11c7cbefd08019ad9c97d
SHA1 4f260146ee9e60043f26d21e11d98629b3ca099b
SHA512 b51a56cfaf4aa324f6343de0bf0595523a9889761bb2813e32e49608678c91d45e09fdc56514e8ba8580a217f8a230b4014a2780fc4a7b0c3948070c7a53811e
SSDEEP 384:zfR0qVBkP/pCrbHPDwWmatziuPYkErF7Koej0:jpBMpCHP0WPRi77Ko
TLSH
T161B3861B2DFAFAE5048AD8644CA071985EA06377F1815594B8CECE75AF01BCBBC33B15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data-dictionary.xml

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\data-dictionary.xml
Size 1.6MB
SHA256 223fc4388d7e54a0a27395911535adc0cf8b26f7e992dc6f0d189b77331b5137
MD5 ac79e017281cd633fb90c06a19a180fc
SHA1 32f8af8ab7c9a9752e7e09b28bba08eb23e8fbd1
SHA512 68e39d64aabf8be54ca43ed34618da249f3869c33822cb09f3c121cad8bf7640b5533c1cc0f77cb5a1a9bd0e8e079339b609fbd29d2a597204b70b01b071ae8c
SSDEEP 49152:pIvq3iwEAiWbHTKRU0YCNDZK+/0KoEDKtKzK5xFKOQFKNoDKlW83wKFC+KFE20:2vqSwEPWbHTKi0YChZK+/0KoEDKtKzKd
TLSH
T1FF75AA1B2EF9F6E1044AD8548CA061982E605377E28562D4BCCEDE75AF01BCBBC33B55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

on_demand_connection_config.json2272.tmp

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\on_demand_connection_config.json2272.tmp
Size 651B
SHA256 4f61d56afe70c3ce25a61e3e17873df2c9c518425c63d1d61fb494c8c92f6e70
MD5 725087d70a8e693d7613500887dd3d1f
SHA1 ae8bcf03c0bba4f3db64c5dae1913350deebe196
SHA512 555ea098dbe490c214340e99635223bfbfc86a6a13064284cf8df4f1c7f77261d84f2b32dd9ac8177b01547b1be1c093401df069d652d2b7ff971ce2dc5cd119
TLSH
T1D0F02600568E2CA725FBD0887772B41B375C18E6D5E2FC90E57B46ED1BC53B08207A26
MD5 SHA1 SHA512 TLSH

Submit Download

dcagent.dll

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\dcagent.dll
Size 4.6MB
SHA256 bec4bd6a1744b0a8c8856f9f779db2eb3bdba081a489adb19000de7a52ccefa4
MD5 1e6a5bdef1a764c8676b2c1563bc0e41
SHA1 feb8ce2e0dcd27bf98f1b636d3fd634497aadadd
SHA512 c66a6850bc36fd8bd882e9b5feb51a6af030ed606ea4f200079259e5712ac89b6af02cc7e821291e8fa62f52360bf806c79f04321e510e86e19980c89ae1f9d5
SSDEEP 49152:n5oZdDXQ4AlZWNVXSr8iVlssssqkffbq32u6dr0zrEGYlLlyYs0wO4TDa1yIoaWD:n5gd3wdbqt6dr0cGYlx1ymyO4YIbj
TLSH
T13D36BF27BF43C070D99E02B815BA9B7B5D3D89248B3188E397D028BD88B54D1663F76D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Lato.woff

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\Lato.woff
Size 36KB
SHA256 8587742fa147f288638345f101fe58bd8a426a22c33cf92dc286e928203ef019
MD5 171937a8fad6a1c8a37344d09d4fc20c
SHA1 834ef4f8bdf16e94383272f7024070cebc002cfe
SHA512 c65909a920b6de0b19e083bab695e8e2dc812c143910ee1e0e69e7141a85e9fae0b2332795d52957aba5829609cd66bcbd4045eddde4df98c0a20c306a64aa3c
SSDEEP 768:2vevzUxNXpUN3RRTe5fF7leCB8EumP7M+e265Cz7NIpYIOi+SLyyS:2vevKNZUtRRfCBXF2HCHmpY3i3OL
TLSH
T10303E1795E45653DC4B283B7A1D8E3AF340F0A087A50653C13A3C36D6ABC7083F529EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dcmsghandler.ico

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\dcmsghandler.ico
Size 14KB
SHA256 2d92583e576b380e3d8246a5bdced4a205860d49d9ef66e4acde5007caefac24
MD5 3f93e0ea97079b1f5b356166db334740
SHA1 ea3022d31459c8904df1e8f406741960fe9ce653
SHA512 24584bb387c1981ac08f4266f7312444ee922486f1d20a3d9f655df09048e347c8c2df8be64e3ec99b8d603e4e088296a2abb3e68fc2e85eb5431efba3971c36
SSDEEP 384:1w////ncRy/wUwRRR0RRZRXUuPPPPPP3opSLhRRwyRRWFRRyRDRRjRRRRRKRRRR+:5C
TLSH
T182624886C4054ACDCADA9B33C6EE56BF8A9508B88007504503FC3DF5EB53B19FE6A14E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

drop_down_icon.png

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\drop_down_icon.png
Size 449B
SHA256 159e7193e72731b16a6516403ff192be20e836a4d06becee474a46ac57e2ce59
MD5 60bd20b51eb0483e93aa6f4cb0a84288
SHA1 35ef5eed1eb03f4c5ce8b6314d5457fd6984d7a4
SHA512 f359e72fc17bebaeaf7ac520667f300213fa1c10775a6fee1d0af05573a610bbbb2dc7050644ddb5610c05873adbfb90042d8d3694c3038792127c982c77425f
TLSH
T1C3F023062DA90252D34DA62704FC8022DE9B89045AC0381CBB07DC7D2F4059555C9BDF
MD5 SHA1 SHA512 TLSH

Submit Download

info.png

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\info.png
Size 2KB
SHA256 5042147fddc3c27e346a4145a7448a4199265e12cfced518871f2a318476cb7a
MD5 d4893659007e98de701a47cd39991be3
SHA1 536c49e5da960171320d4df6c9e6b573bdf2d030
SHA512 6d1812768eaae453512e4b47f190ea7ecc4bd5a535bd9f5c168e770f1c88291a74f95947199be8468127e7756260c94e28b6430556da65170537c384cba0bc29
TLSH
T1EF41A58272C4BFFD10035713B01FF395161AE902CEADF6D32135B6A4AC11614436687B
MD5 SHA1 SHA512 TLSH

Submit Download

minimize_icon.svg

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\minimize_icon.svg
Size 161B
SHA256 08615c639994bf55e78c4dc10bf2b69a505cc1f1e3802f21a809a434daf651fe
MD5 10006715631c28cd1cca4302987b6371
SHA1 6a69a91b69b7cf310bbb4295496d3314211de6f9
SHA512 6c43259b84e93b7ed9d6a7202fde26482b934bc8fc67f6963e55788a8cbb08116535b266c07821bb2835058102baf3831d838fff00efc84e9cbc57fd881cc0e5
TLSH
T19DC08C26C2ACCB594322C6B0AA28A220946E4092A884D0A595E34B245173872FD8D8DA
MD5 SHA1 SHA512 TLSH

Submit Download

dcClientAuthAccess.log

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcClientAuthAccess.log
Size 2KB
SHA256 1e52f2564e608b25bdfa9d16d77e8eb7285273d3507d9ae0943a4974d8c1e5a9
MD5 26287a1217759983c5cf201289891b6d
SHA1 bab5c4582c2ce0debf80bf398cfbc9fd992d82d3
SHA512 cae024e955f889a02daa279ca72bc5ef0cdfe35415e05d98d67632e2b85c874fa530c407adacd79ed290c071f31e5a0490458e55f3e4b4647ac077f87e90bdcd
TLSH
T11C4195039D8DCD45485FF66F1675DC44E8831446188F98E1326D067EAB7B608FADCAAC
MD5 SHA1 SHA512 TLSH

Submit Download

dcClientAuthAccess.log

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcClientAuthAccess.log
Size 4KB
SHA256 eaf576ec392bc5a40dedc9871b456ea239403490f560f2ba188ac1c4f477b1a7
MD5 0ede706abd85555be121f81a93d761f8
SHA1 cf0c99f41111aa7b72ac53e25eddf4da3ffd2b74
SHA512 77fb009345c1f3ff188feab47182b1248a0670fce9c3db0e0ae1fd1f16a6bac005e4cecabc59e9449e15c319eed4d05a96973b05e467cfea9e0f3005f66ab4fb
SSDEEP 96:eY0ItoXTX4XtlpxXsXpaPKXsXpkX7XykX7XykX7XyOXY:90ItoXTX4XPXsX9XsXaX7XXX7XXX7Xho
TLSH
T10191DA129D8ECD45491FF5AF1675DC44A8831487148F98E2322D027EEBB7508FADCAAC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dcagentinstaller.log

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcagentinstaller.log
Size 11KB
SHA256 e3d7813300ec5de956413539bcc910d889597dc4281e27c997538c4f4a6210b1
MD5 4ac46432aee7a26a9b8694d1af593f27
SHA1 91fa50ac2ff97349c1da0236e415bb64db6f5842
SHA512 d31e12d263183fe238c759508f766fe7882de450e3dd7a30e2b04ad6d715bf7cc945f5fee74089bf1862673dcb5b4b9770cbf9361ac8131ec55c206faa77c4ef
SSDEEP 192:WchLLXNh8XCzIcIctcPco5cpc2wTwKMcmTco5ccHaoBtoar/mtVUQVV85/oSIoKk:/hLLdCZw2xuIcxrwcT
TLSH
T13E327F016FF1A85089AE5AD9A4522B8ABE8F741C0C4328B83778B5C277ED45B0FDF254
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dcrotatelog.log

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcrotatelog.log
Size 1KB
SHA256 73fedb8f9b752933ece73f947929f3e2656a7042b7c7e4059a8583e95cfccb2d
MD5 c31a9edba10f06d7d2de2149ee04e792
SHA1 431a9d6606a4f95d1232d2b476cd8f999f48be5a
SHA512 34e8de5f45a72f10806b80c2a7b11bc98aa1287ffb73588c797aa244742fa3d03bb9d9b6bc58e2ca46c8cb174e13e336a8977a6db43d4126d5e41a588d7adea7
TLSH
T191216B015BF868A05AAF99C4A5022767FE86F85804136CB023E9F58677EC4575FDE234
MD5 SHA1 SHA512 TLSH

Submit Download

setAppPermission_Internal.bat

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\scripts\setAppPermission_Internal.bat
Size 957B
SHA256 8b78e103d656d873fa2a5377dbef7fd92877005dad78fd3521556158453d8ab9
MD5 e300d6f5c088aee55f0b91f4efc72035
SHA1 97d081d6ea84780f8f556cc6dde8dadd10f09e63
SHA512 366f99f7c3387c5b45daf7d3875ddc246ed00d49bb846b5e21dcf3208b910a65d56cce5a211e13a8f10c698d44b4a814069b6ca06fb28a8614dbfdaf952bdea2
TLSH
T14611DC1EF610053C09AE7AD47BB00D66BA29E0E770151A5E3E06135DDF84A80BFB53DB
MD5 SHA1 SHA512 TLSH

Submit Download

DMRootCA-Server.crt

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\temp\DMRootCA-Server.crt
Size 1KB
SHA256 32b04c296998752e382484eb8986e886805934e461edc611051575e355600d1c
MD5 72b07ef6b919ebaa1afcee604a1d48f2
SHA1 c85dd7b774d888ee83bc5e04251ea124526bd8ae
SHA512 88337a59f35a37c3dd899e4e071e756a8fdbef0ded9b88ba4937bbbde2f04c8ab7b895c3c49a70971a98e33eca662153b55842d536ef4387cdd7ff96ef399525
TLSH
T15C21E6A45D413119E83BF1DCE5E9AC956D7606BF6CF47B21082AAD1B4B83D8001FC8DA
MD5 SHA1 SHA512 TLSH

Submit Download

DMRootCA.crt

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\temp\DMRootCA.crt
Size 1KB
SHA256 6b6935462dc5232dd152f4b380e34e0c7f5678b443e1ea0e2811c2b21a49c55c
MD5 c2d0915933841cefdafa5b7c9b830ca9
SHA1 5761be1bd66b4783d7f4e812507ad4829dab3a99
SHA512 a37db5809ca56b7983b987fd92e17743fecfb3a49349c6ca221c46864d08330fca978a4d4736bf78589df62227e5d63db919aa52e0d26c6fc8c9ed381434bd7f
TLSH
T12121C96A2E4534E0F4BFC1C9CB8EB4791C7B47565CCD63E3217A2E1105552F0758D945
MD5 SHA1 SHA512 TLSH

Submit Download

0DA515F703BB9B49479E8697ADB0B955_4136D3715888E22D65EBE484B233D81B

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\0DA515F703BB9B49479E8697ADB0B955_4136D3715888E22D65EBE484B233D81B
Size 1KB
SHA256 bf41d3a8dffe406457c10cb75b4a5cc5aa372a4ff8393efd68faa26a520bc9c7
MD5 a4592b336d131a31cf673c9967c0b27f
SHA1 515f946ecc0ff344d2b5e8cc98ce1e579742d29c
SHA512 5d1d16ddfeffc37df7d086873b3953b36f2723dd55e9e6423ec1b26fd4a80a8e5a866f33a999fa8fa98334494ed6633171e150daefd9078cb026fbb187213f26
TLSH
T1A521E9AB8EB614C0BFC16D8336C4D9376EEA67C04CBD006B9139E4E51500376BB6744D
MD5 SHA1 SHA512 TLSH

Submit Download

9CB4373A4252DE8D2212929836304EC5_6C354C532D063DF5607A63BA827F5164

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\9CB4373A4252DE8D2212929836304EC5_6C354C532D063DF5607A63BA827F5164
Size 1KB
SHA256 c44598daa139f1b117b55540c4c8bd60c71127a5fdfc19967661a401be869aac
MD5 d04e17f1761b80ef1bd87c7def2b95d2
SHA1 29676f21b3ed45f0e22343019e7ab8efbbb07781
SHA512 19669cc24de9f0d8c8dad1183bdb2e81a6fe2d84c9be2e6c31d22c6ee65fedd74bbf09b38b92eedb8888e70713cc432e6931518637cea10cb1e009c90178fdf9
TLSH
T1D331D626DA7C36838E80A9D81AEAF137ECD475806CD93103A631452731D07337F46D8E
MD5 SHA1 SHA512 TLSH

Submit Download

A1D627669EFC8CD4F21BCF387D97F9B5_7B944868459E0B8AA3F81222C6396988

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\A1D627669EFC8CD4F21BCF387D97F9B5_7B944868459E0B8AA3F81222C6396988
Size 1KB
SHA256 2e88f7df3670c3fce91c8d350a5935fe97610bac1162cdf51e030630501ddc7f
MD5 490c0423e6fc25fdff6128ba3e42ed8b
SHA1 99b12bbbbf0ea5bd809c3b334449ea548bc4a9a1
SHA512 f6b98e185c4fd4136659d60b3e421209aaac64210f6637f63d56d0fc9f7e58730664b20b5048c3f1ee970d77ddb088c1deba8213898811d99accf38db2433df4
TLSH
T153311A0F01343903BF469F8876D6DD321CB02BE085E56D2FA6BF240C94503F19E65A40
MD5 SHA1 SHA512 TLSH

Submit Download

B039FEA45CB4CC4BBACFC013C7C55604_50385F8EB1F713E33924A830D7A2A41C

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B039FEA45CB4CC4BBACFC013C7C55604_50385F8EB1F713E33924A830D7A2A41C
Size 1KB
SHA256 2a1e0ed29b2598565ff75cbf5b26f97bfd7214b57fa432f8b58a062772b9e5f5
MD5 6857bf31353cce5493aa4af14363b73d
SHA1 f1b947377ec6b7b72ca1553702a999f1a9b150d9
SHA512 71d7a8b2aff055ff583b528354c1cb3fcefafbf792752afaaa289f8d4219655491db983e748182ad77650bc8905a16bfcfecab1cd47d12e9cd80febd5b56491e
TLSH
T10321949717A52062A792CE4919D8BD736CE4B2D275DD0819F01FC2E608013EAF94D2AA
MD5 SHA1 SHA512 TLSH

Submit Download

0DA515F703BB9B49479E8697ADB0B955_4136D3715888E22D65EBE484B233D81B

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\0DA515F703BB9B49479E8697ADB0B955_4136D3715888E22D65EBE484B233D81B
Size 508B
SHA256 1e093cdbeb277420b915d252b0df67aeb2804ac62a796133f4ae5ce6c8586bda
MD5 ce38fd3d6a690381a3314bb6142ae82d
SHA1 74ce838c71a0f46442abb87ee1be6b4817edeef1
SHA512 10103221316cb686385a8174bdf91823e9d1a1a435ea24f9d20ad33e69d9d9663cfc2ee50b94d39edf93ffe2af6f123e67bd35c24668b11eb19b80fc3bbaf4bc
TLSH
T18FF0971C99F8822AF131CE3A96CD2225897BF6102009457923E0CB0CA956D486C02679
MD5 SHA1 SHA512 TLSH

Submit Download

9CB4373A4252DE8D2212929836304EC5_6C354C532D063DF5607A63BA827F5164

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\9CB4373A4252DE8D2212929836304EC5_6C354C532D063DF5607A63BA827F5164
Size 532B
SHA256 8833da3ddcc338f14014654acaa301e577495f77044373c8bb83fa9884cc3471
MD5 4ec686ffd3b751473bcbcbae315353eb
SHA1 799bf47112ddb78a138d308e03c92b613a4c2f6a
SHA512 86b939e44082ba061e5f2827bbd3b1a2a1d20f92bbcbd95d53dad458ec7b3b18c00b70500b4362ece220d71c86f261d3238df08b76be86845ec058306ce851b9
TLSH
T1F5F0DC2901F8002DF47BDE7A4FC09AB2A469FD133C4196691344070D8621D00DDA353E
MD5 SHA1 SHA512 TLSH

Submit Download

A1D627669EFC8CD4F21BCF387D97F9B5_7B944868459E0B8AA3F81222C6396988

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\A1D627669EFC8CD4F21BCF387D97F9B5_7B944868459E0B8AA3F81222C6396988
Size 544B
SHA256 76f31e738a4cffded4ef5feee3edc211c8afb2832701e8b1824c3d7d09f5e8d3
MD5 c04772d0e4600c8a3ebef146f7ee1af9
SHA1 c4d4c54666509563a9da3d3b333108ca45b0c28c
SHA512 d959370e39d328fe6fa73525585059bada4909d3cff3562106f1a3331c19099644628cbd2b39491d260fb197d2e70cdca2ce7d76525347fc9b09a651a8d9d6e5
TLSH
T14FF02E2C1DF6012FF136DEB546D415D68965FD073C065A9C1B95930CB553E04FE12A39
MD5 SHA1 SHA512 TLSH

Submit Download

B039FEA45CB4CC4BBACFC013C7C55604_50385F8EB1F713E33924A830D7A2A41C

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B039FEA45CB4CC4BBACFC013C7C55604_50385F8EB1F713E33924A830D7A2A41C
Size 508B
SHA256 f9adb74a1327511552e7f527ea6b16615897c1915e4d0cc99071c5befe9d77ee
MD5 261e26f56a51708ffdec807479308c2c
SHA1 8f3994bb196f5aa20e7b3ece9fba40edc7ce1865
SHA512 7b6b2ab5f58a618fbb8fad9eb6b82ebcc0e8c0374658ce45287ec702dd07d3428cbd634f8fd3fd012d63de7ef4b89858c0f1494fb3a6b0b1edf73ec63435047d
TLSH
T16AF0DC302CB89038F332CE3806D02AFA4A9FBE03240501BA1B5A43145764F002C83739
MD5 SHA1 SHA512 TLSH

Submit Download

Agentinstalllog.txt

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\Agentinstalllog.txt
Size 1KB
SHA256 62b7ca07b3cfb4bde8a30d76a90d50800aeca8f5c9bca2b6d64025e99bcecc15
MD5 d44da02132469a22e9d9b2cb8f5436b2
SHA1 84ca51656f12204635340d31b297a18b1629d9e1
SHA512 1a4d2da2b522e5d88edb49ffc48429d2cff5f92fdaf4d1ca0ca626ebb9ae9abc73effeccd194c9b393aaa0ec932335c7bdeee38a2477ad136078d4cda52c6d56
TLSH
T18C31066E1BF4084AB1B2A7079DF3C0521B33BDC06834970C63C89A5E466AD05FDB93A3
MD5 SHA1 SHA512 TLSH

Submit Download

DCAgentServerInfo.json

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\DCAgentServerInfo.json
Size 4KB
SHA256 2d906fc376010ab0f3145b58e4e5d3b73540ae361d7222509bdef10293871a4a
MD5 08a9973a507d3cafb638513541227e82
SHA1 d36cce823fbe3c549ffaca2d61acce31be0c4da5
SHA512 1177b1d81c4feb138e38993bed96a3b98df812a19d11f97101307d2a92c2c1e1d791d90df9e7464d1f71233740c1e63b77382d822e1cd7d6a3cbdc6df78f0e44
SSDEEP 96:vTl0mBbwaRtwKOWTh8GZ7JIg/RozN2wkdMZpYGlYPcL6w:vWeb57wKnSzN2LIaG6U6w
TLSH
T1B3A14B758B433C7499EFC18DD698B87718BE02141ED5A34209BE7E86E8CA280039E875
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SetUP.VBS

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\SetUP.VBS
Size 824B
SHA256 6053c83865de1fe0f527608a3cff4d1689bfebc4047d81187fb78e8dbbbbb74c
MD5 97b3de6696541abe6384970ae8c9901c
SHA1 01db6b9685d45b2dc410f01001ff928c12e34895
SHA512 6a26d774d5a141cf09bc5b0cb589a1452cc655c6fe5839e3c297089228f8c6fa50c99ed8ff4d5e296ef0fbb72857401d00fc515deecc0d928f10fe595f4d8527
TLSH
T1E5018901B43DC7328AB0239150022DDDDEA3431A240852E6B99D8CFECF9C4389A35211
MD5 SHA1 SHA512 TLSH

Submit Download

UEMSAgent.mst

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\UEMSAgent.mst
Size 20KB
SHA256 8dd93f43089a682cbac39c0a1f364057dcb7d08e9b1480c088f15a5dd56d8be4
MD5 0273976d2ecf588a5514b0f5069968e5
SHA1 b906399f51bffff670d20c5f5d66800a78b1e638
SHA512 da06fe4cf771c3a4840ced5b95a421cbec98023766d0d382b44798fefdf04f794119d3c17eb2165f35df1745bf3ffad600af10b7f89cce24f788a57f6e67a809
SSDEEP 24:J+U2p5gxBuP2xjl/Zd8pJPSgHiHJoxIzxhK:IU2p4gI7dyJaz
TLSH
T109927202FBA1EA16D0490A358E96C3DC0B36FC81DD42836B35E6776FBD721C54D62AA0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSI13A2.tmp

Path C:\Windows\Installer\MSI13A2.tmp
Size 429KB
SHA256 f78db8103f85debda13f93feafdb903823f8751640885492c6aeef938d7b09a6
MD5 6a6ead9b264363f887b5bfc0a61b2d64
SHA1 6cf6b43b3b2f1ad888612aa9c8bf6de9770c2c81
SHA512 53d351045fa87fa913bec53606a142a53caa37edfecfc010780fb97f9120a9c26f6f5c890a666fb6a0fd5efdf7657c8c608d4c793cb1161c940ea23e70be84f3
SSDEEP 12288:kpqSpvhUEaxBOJBesypR2wd/8Vyup7NTN:kJhUZxBOWsc1yFNh
TLSH
T15C94BF1135C9C031E1AE5170ADB5AF76AE7DBD200F2858CBD3C84D3B1A645C2AB76F1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dcagentlibxml2.dll

Path C:\Windows\SysWOW64\dcagentlibxml2.dll
Size 2.0MB
SHA256 fffcb7b3ea73b35ee4cbbe137f40b84fd6799f762cdb2a29f40b07c60cecdde2
MD5 53e10ebd6aefdd16e412074a5af40c50
SHA1 4bcf491358776ef08970a1c7bb61d3d1a4240a8e
SHA512 556a30d43897f17f99f84d250440f16e3e7c513ef08472fe2f5fc5da80a2cf62c13c600e12320ae648a28ff94cdae42069a30922d897298d8a2ff611a3c5ad6c
SSDEEP 49152:m1fOkYtuKEoTHy9uizLBAUZLY6tPT8FGaXQ9:AfOk4rwLBAUZLv9
TLSH
T12EA5BF04B980C532F4EB01F0CAFE5BFB982DCD26672554E767D578D889301E162BEB19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download