1571100ac7ed5c27e470225995828dd39e9760a6a03683ebf669658d15e0d18b

Analysis

max time kernel
148s
max time network
144s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260911-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260911-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
24/09/2026, 14:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
setup_Z-_Mason_Street_Furniture_(Not_Supported_by_Group_IT).msi
Size 8.4MB
Sample260924-r4krjsfe22
SHA256 1571100ac7ed5c27e470225995828dd39e9760a6a03683ebf669658d15e0d18b
MD5 a6957328fd0cc86898f66a771ddd751e
SHA1 aed2ace1ceed45192f6df48484c19362e3686cd8
SHA512 b8f8a0bca0a4ac27583e06c00fc8f87893cb8465cd5d026f12cba071bab5380aeacd376371030899d758e51294e17bf328a8cd820083fd6d0c949e352b8b37a7
SSDEEP 196608:xWRnEqtLMMQNysvwZJtRrWsIMC7nW1A490CAvIjv:WEFNysWVWsbC7W1Ai0z
TLSH
T1BF963325F7F409AAE8638276C5638125EF7ABC496321D6AF0364B41D1F3B760A0BF714
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery execution persistence privilege_escalation ransomware

Malware Config

Signatures

Badlisted process makes network request 13 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
5	2096	msiexec.exe
7	2096	msiexec.exe
26	3212	rundll32.exe
27	4780	rundll32.exe
29	1504	powershell.exe
31	1504	powershell.exe
33	4904	powershell.exe
34	4904	powershell.exe
35	4904	powershell.exe
36	4904	powershell.exe
37	4904	powershell.exe
46	4904	powershell.exe
51	3528	rundll32.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
1504	powershell.exe
4904	powershell.exe

Executes dropped EXE 3 IoCs

pid	Process
3516	AteraAgent.exe
2480	AteraAgent.exe
3400	dotnet.exe

Loads dropped DLL 24 IoCs

pid	Process
572	MsiExec.exe
3164	rundll32.exe
3164	rundll32.exe
3164	rundll32.exe
572	MsiExec.exe
3212	rundll32.exe
3212	rundll32.exe
3212	rundll32.exe
572	MsiExec.exe
4780	rundll32.exe
4780	rundll32.exe
4780	rundll32.exe
572	MsiExec.exe
5072	rundll32.exe
5072	rundll32.exe
5072	rundll32.exe
2224	MsiExec.exe
2224	MsiExec.exe
2224	MsiExec.exe
3400	dotnet.exe
572	MsiExec.exe
3528	rundll32.exe
3528	rundll32.exe
3528	rundll32.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe

Drops file in System32 directory 6 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\75CA58072B9926F763A91F0CC2798706_3AD253ACA02D44EA5FD30683B8A5B5FA	AteraAgent.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\75CA58072B9926F763A91F0CC2798706_3AD253ACA02D44EA5FD30683B8A5B5FA	AteraAgent.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\D1BEC81CCAFDC823A062FF26A89A6B6D_D40E4E79DF388B984709B048EEAFD4E4	AteraAgent.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\D1BEC81CCAFDC823A062FF26A89A6B6D_D40E4E79DF388B984709B048EEAFD4E4	AteraAgent.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\BAD725C80F9E10846F35D039A996E4A8_88B6AE015495C1ECC395D19C1DD02894	AteraAgent.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\BAD725C80F9E10846F35D039A996E4A8_88B6AE015495C1ECC395D19C1DD02894	AteraAgent.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\8.0.31\System.Drawing.Primitives.dll	powershell.exe
File opened for modification	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\8.0.31\System.Net.Http.dll	powershell.exe
File created	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\8.0.31\System.Reflection.Emit.Lightweight.dll	powershell.exe
File opened for modification	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\8.0.31\System.Xml.XmlSerializer.dll	powershell.exe
File created	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\8.0.31\mscordaccore.dll	powershell.exe
File opened for modification	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\8.0.31\System.IO.Compression.ZipFile.dll	powershell.exe
File opened for modification	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\8.0.31\System.IO.FileSystem.Primitives.dll	powershell.exe
File opened for modification	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\8.0.31\System.ServiceProcess.dll	powershell.exe
File opened for modification	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\8.0.31\System.IO.FileSystem.Watcher.dll	powershell.exe
File created	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\8.0.31\System.Runtime.InteropServices.JavaScript.dll	powershell.exe
File opened for modification	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\8.0.31\System.Threading.Timer.dll	powershell.exe
File created	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\8.0.31\System.AppContext.dll	powershell.exe
File opened for modification	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\8.0.31\System.ComponentModel.Primitives.dll	powershell.exe
File created	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\8.0.31\System.IO.Compression.ZipFile.dll	powershell.exe
File created	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\8.0.31\System.Net.dll	powershell.exe
File created	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\8.0.31\System.Runtime.Serialization.Json.dll	powershell.exe
File opened for modification	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\8.0.31\System.Runtime.Serialization.Xml.dll	powershell.exe
File created	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\8.0.31\System.Linq.Parallel.dll	powershell.exe
File opened for modification	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\8.0.31\System.Net.Security.dll	powershell.exe
File opened for modification	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\8.0.31\System.Security.Cryptography.dll	powershell.exe
File created	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\8.0.31\System.Security.Principal.dll	powershell.exe
File created	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\8.0.31\System.Transactions.Local.dll	powershell.exe
File created	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\8.0.31\createdump.exe	powershell.exe
File created	C:\Program Files\ATERA Networks\AteraAgent\Agent\.settings.backup.json	AteraAgent.exe
File created	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\8.0.31\System.Diagnostics.Tools.dll	powershell.exe
File opened for modification	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\8.0.31\System.Reflection.DispatchProxy.dll	powershell.exe
File created	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\8.0.31\System.Threading.Tasks.Extensions.dll	powershell.exe
File opened for modification	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\8.0.31\System.ValueTuple.dll	powershell.exe
File opened for modification	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\8.0.31\System.ComponentModel.Annotations.dll	powershell.exe
File opened for modification	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\8.0.31\System.Linq.dll	powershell.exe
File created	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\8.0.31\System.Numerics.dll	powershell.exe
File opened for modification	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\8.0.31\System.Text.RegularExpressions.dll	powershell.exe
File opened for modification	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\host\fxr\8.0.31\hostfxr.dll	powershell.exe
File opened for modification	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\8.0.31\mscordbi.dll	powershell.exe
File opened for modification	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\8.0.31\System.ComponentModel.dll	powershell.exe
File created	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\8.0.31\System.Net.ServicePoint.dll	powershell.exe
File created	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\8.0.31\System.Security.dll	powershell.exe
File created	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\8.0.31\System.Security.SecureString.dll	powershell.exe
File opened for modification	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\8.0.31\createdump.exe	powershell.exe
File created	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\8.0.31\System.Net.NameResolution.dll	powershell.exe
File created	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\8.0.31\System.Numerics.Vectors.dll	powershell.exe
File opened for modification	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\8.0.31\System.ObjectModel.dll	powershell.exe
File created	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\8.0.31\System.Security.Cryptography.Primitives.dll	powershell.exe
File opened for modification	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\8.0.31\System.Windows.dll	powershell.exe
File created	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\8.0.31\clretwrc.dll	powershell.exe
File created	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\8.0.31\System.Runtime.Serialization.Primitives.dll	powershell.exe
File created	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\8.0.31\Microsoft.Win32.Registry.dll	powershell.exe
File opened for modification	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\8.0.31\System.Collections.Immutable.dll	powershell.exe
File created	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\8.0.31\System.Data.dll	powershell.exe
File opened for modification	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\8.0.31\System.Net.dll	powershell.exe
File created	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\8.0.31\System.ServiceProcess.dll	powershell.exe
File opened for modification	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\8.0.31\System.Threading.Overlapped.dll	powershell.exe
File created	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\8.0.31\System.Collections.Concurrent.dll	powershell.exe
File opened for modification	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\8.0.31\System.ComponentModel.TypeConverter.dll	powershell.exe
File opened for modification	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\8.0.31\System.IO.dll	powershell.exe
File opened for modification	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\8.0.31\System.Net.Requests.dll	powershell.exe
File created	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\8.0.31\System.Runtime.dll	powershell.exe
File opened for modification	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\8.0.31\System.Runtime.InteropServices.JavaScript.dll	powershell.exe
File opened for modification	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\8.0.31\System.Threading.Channels.dll	powershell.exe
File opened for modification	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\8.0.31\System.Threading.Tasks.Parallel.dll	powershell.exe
File created	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\8.0.31\System.Net.Quic.dll	powershell.exe
File created	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\8.0.31\System.Net.WebProxy.dll	powershell.exe
File opened for modification	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\8.0.31\System.Runtime.InteropServices.RuntimeInformation.dll	powershell.exe
File created	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\8.0.31\System.Runtime.Loader.dll	powershell.exe

Drops file in Windows directory 31 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\Installer\SFXCA522C7441E94D3B7A14F8673A1A8AD7DA\WixToolset.Dtf.WindowsInstaller.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\SFXCA7DB929475A43C58AD6E49E2F21F69E32\Atera.Agent.Installer.Msi.Ca.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSIBC7B.tmp	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\SFXCAA72334D1F5413F19ACF5E7E6B55CF184\WixToolset.Dtf.WindowsInstaller.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\SFXCA703A005C1947B6F9DF713CCFFBF167FB\Atera.Agent.Installer.Msi.Ca.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSIAA96.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\SFXCA522C7441E94D3B7A14F8673A1A8AD7DA\Atera.Agent.Installer.Msi.Ca.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSIAD47.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI9FD5.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIA14D.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\SFXCA2B38E8A1CF4E51C8E2A17F4D729CE716\CustomAction.config	rundll32.exe
File opened for modification	C:\Windows\Installer\SFXCA7DB929475A43C58AD6E49E2F21F69E32\CustomAction.config	rundll32.exe
File created	C:\Windows\Installer\e589edb.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e589edb.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\SFXCAA72334D1F5413F19ACF5E7E6B55CF184\CustomAction.config	rundll32.exe
File opened for modification	C:\Windows\Installer\MSIA797.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\SFXCA522C7441E94D3B7A14F8673A1A8AD7DA\CustomAction.config	rundll32.exe
File opened for modification	C:\Windows\Installer\MSIF233.tmp	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIAB33.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIC3BF.tmp	msiexec.exe
File created	C:\Windows\Installer\e589edd.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\SFXCA2B38E8A1CF4E51C8E2A17F4D729CE716\Atera.Agent.Installer.Msi.Ca.dll	rundll32.exe
File created	C:\Windows\Installer\SourceHash{2387F12B-5B54-4D0E-B136-EC163500CB44}	msiexec.exe
File opened for modification	C:\Windows\Installer\SFXCA7DB929475A43C58AD6E49E2F21F69E32\WixToolset.Dtf.WindowsInstaller.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\SFXCAA72334D1F5413F19ACF5E7E6B55CF184\Atera.Agent.Installer.Msi.Ca.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\SFXCA2B38E8A1CF4E51C8E2A17F4D729CE716\WixToolset.Dtf.WindowsInstaller.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\SFXCA703A005C1947B6F9DF713CCFFBF167FB\WixToolset.Dtf.WindowsInstaller.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\SFXCA703A005C1947B6F9DF713CCFFBF167FB\CustomAction.config	rundll32.exe

Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs

persistence privilege_escalation

Installer Packages

T1546.016

Msiexec

T1218.007

pid	Process
2096	msiexec.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2408	cmd.exe

System Time Discovery 1 TTPs 4 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5072	rundll32.exe
4904	powershell.exe
2408	cmd.exe
3400	dotnet.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 000000000400000072aeb24c28fa2d9f0000000000000000000000000000000000000000000000000000000000000000000000000000000000001071020000000000c01200000000ffffffff00000000270101000088380172aeb24c0000000000001071020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d083020000000000c050dc000000ffffffff000000000700010000e8410172aeb24c000000000000d08302000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000090d4de0000000000000005000000ffffffff000000000700010000486a6f72aeb24c00000000000090d4de000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000090d4e30000000000000005000000ffffffff00000000070001000048ea7172aeb24c00000000000090d4e300000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPublisher\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPublisher\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPublisher	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPublisher\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28\52C64B7E	AteraAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPublisher\CRLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28\52C64B7E\@%SystemRoot%\system32\NgcRecovery.dll,-100 = "Windows Hello Recovery Key Encryption"	AteraAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28\52C64B7E\@%SystemRoot%\System32\fveui.dll,-844 = "BitLocker Data Recovery Agent"	AteraAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPublisher\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe

Modifies registry class 22 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B21F783245B5E0D41B63CE615300BC44\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B21F783245B5E0D41B63CE615300BC44\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B21F783245B5E0D41B63CE615300BC44\ProductName = "AteraAgent"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B21F783245B5E0D41B63CE615300BC44\PackageCode = "DE29C0996E833174C8DF8536CC633D4E"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\25F46F8180ECF4345A1FA7A8935DE9AE	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B21F783245B5E0D41B63CE615300BC44\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B21F783245B5E0D41B63CE615300BC44\SourceList\PackageName = "setup_Z-_Mason_Street_Furniture_(Not_Supported_by_Group_IT).msi"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B21F783245B5E0D41B63CE615300BC44\Clients = 3a0000000000	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B21F783245B5E0D41B63CE615300BC44\Language = "1033"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B21F783245B5E0D41B63CE615300BC44\InstanceType = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\25F46F8180ECF4345A1FA7A8935DE9AE\B21F783245B5E0D41B63CE615300BC44	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B21F783245B5E0D41B63CE615300BC44\SourceList\Media\1 = ";"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\B21F783245B5E0D41B63CE615300BC44	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B21F783245B5E0D41B63CE615300BC44	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B21F783245B5E0D41B63CE615300BC44\AdvertiseFlags = "388"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B21F783245B5E0D41B63CE615300BC44\SourceList\Net	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B21F783245B5E0D41B63CE615300BC44\SourceList\Media	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\B21F783245B5E0D41B63CE615300BC44\AteraAgentFeature	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B21F783245B5E0D41B63CE615300BC44\Version = "33882146"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B21F783245B5E0D41B63CE615300BC44\Assignment = "1"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B21F783245B5E0D41B63CE615300BC44\AuthorizedLUAApp = "0"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B21F783245B5E0D41B63CE615300BC44\DeploymentFlags = "3"	msiexec.exe

Suspicious behavior: EnumeratesProcesses 36 IoCs

pid	Process
3212	rundll32.exe
3212	rundll32.exe
4648	msiexec.exe
4648	msiexec.exe
3516	AteraAgent.exe
3516	AteraAgent.exe
1504	powershell.exe
1504	powershell.exe
1504	powershell.exe
4904	powershell.exe
4904	powershell.exe
4904	powershell.exe
2480	AteraAgent.exe
2480	AteraAgent.exe
2480	AteraAgent.exe
2480	AteraAgent.exe
2480	AteraAgent.exe
2480	AteraAgent.exe
2480	AteraAgent.exe
2480	AteraAgent.exe
2480	AteraAgent.exe
2480	AteraAgent.exe
2480	AteraAgent.exe
2480	AteraAgent.exe
2480	AteraAgent.exe
2480	AteraAgent.exe
2480	AteraAgent.exe
2480	AteraAgent.exe
2480	AteraAgent.exe
2480	AteraAgent.exe
2480	AteraAgent.exe
2480	AteraAgent.exe
2480	AteraAgent.exe
2480	AteraAgent.exe
2480	AteraAgent.exe
2480	AteraAgent.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2096	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2096	msiexec.exe
Token: SeSecurityPrivilege	4648	msiexec.exe
Token: SeCreateTokenPrivilege	2096	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	2096	msiexec.exe
Token: SeLockMemoryPrivilege	2096	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2096	msiexec.exe
Token: SeMachineAccountPrivilege	2096	msiexec.exe
Token: SeTcbPrivilege	2096	msiexec.exe
Token: SeSecurityPrivilege	2096	msiexec.exe
Token: SeTakeOwnershipPrivilege	2096	msiexec.exe
Token: SeLoadDriverPrivilege	2096	msiexec.exe
Token: SeSystemProfilePrivilege	2096	msiexec.exe
Token: SeSystemtimePrivilege	2096	msiexec.exe
Token: SeProfSingleProcessPrivilege	2096	msiexec.exe
Token: SeIncBasePriorityPrivilege	2096	msiexec.exe
Token: SeCreatePagefilePrivilege	2096	msiexec.exe
Token: SeCreatePermanentPrivilege	2096	msiexec.exe
Token: SeBackupPrivilege	2096	msiexec.exe
Token: SeRestorePrivilege	2096	msiexec.exe
Token: SeShutdownPrivilege	2096	msiexec.exe
Token: SeDebugPrivilege	2096	msiexec.exe
Token: SeAuditPrivilege	2096	msiexec.exe
Token: SeSystemEnvironmentPrivilege	2096	msiexec.exe
Token: SeChangeNotifyPrivilege	2096	msiexec.exe
Token: SeRemoteShutdownPrivilege	2096	msiexec.exe
Token: SeUndockPrivilege	2096	msiexec.exe
Token: SeSyncAgentPrivilege	2096	msiexec.exe
Token: SeEnableDelegationPrivilege	2096	msiexec.exe
Token: SeManageVolumePrivilege	2096	msiexec.exe
Token: SeImpersonatePrivilege	2096	msiexec.exe
Token: SeCreateGlobalPrivilege	2096	msiexec.exe
Token: SeBackupPrivilege	2692	vssvc.exe
Token: SeRestorePrivilege	2692	vssvc.exe
Token: SeAuditPrivilege	2692	vssvc.exe
Token: SeBackupPrivilege	4648	msiexec.exe
Token: SeRestorePrivilege	4648	msiexec.exe
Token: SeRestorePrivilege	4648	msiexec.exe
Token: SeTakeOwnershipPrivilege	4648	msiexec.exe
Token: SeRestorePrivilege	4648	msiexec.exe
Token: SeTakeOwnershipPrivilege	4648	msiexec.exe
Token: SeDebugPrivilege	3164	rundll32.exe
Token: SeRestorePrivilege	4648	msiexec.exe
Token: SeTakeOwnershipPrivilege	4648	msiexec.exe
Token: SeDebugPrivilege	3212	rundll32.exe
Token: SeRestorePrivilege	4648	msiexec.exe
Token: SeTakeOwnershipPrivilege	4648	msiexec.exe
Token: SeDebugPrivilege	4780	rundll32.exe
Token: SeRestorePrivilege	4648	msiexec.exe
Token: SeTakeOwnershipPrivilege	4648	msiexec.exe
Token: SeRestorePrivilege	4648	msiexec.exe
Token: SeTakeOwnershipPrivilege	4648	msiexec.exe
Token: SeDebugPrivilege	5072	rundll32.exe
Token: SeRestorePrivilege	4648	msiexec.exe
Token: SeTakeOwnershipPrivilege	4648	msiexec.exe
Token: SeDebugPrivilege	3516	AteraAgent.exe
Token: SeRestorePrivilege	4648	msiexec.exe
Token: SeTakeOwnershipPrivilege	4648	msiexec.exe
Token: SeDebugPrivilege	1504	powershell.exe
Token: SeRestorePrivilege	4648	msiexec.exe
Token: SeTakeOwnershipPrivilege	4648	msiexec.exe
Token: SeDebugPrivilege	4904	powershell.exe
Token: SeAssignPrimaryTokenPrivilege	4904	powershell.exe
Token: SeIncreaseQuotaPrivilege	4904	powershell.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
2096	msiexec.exe
2096	msiexec.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 4648 wrote to memory of 4460	4648	msiexec.exe	96
PID 4648 wrote to memory of 572	4648	msiexec.exe	98
PID 572 wrote to memory of 3164	572	MsiExec.exe	99
PID 572 wrote to memory of 3212	572	MsiExec.exe	100
PID 572 wrote to memory of 4780	572	MsiExec.exe	101
PID 572 wrote to memory of 5072	572	MsiExec.exe	102
PID 4648 wrote to memory of 2224	4648	msiexec.exe	103
PID 2224 wrote to memory of 3516	2224	MsiExec.exe	104
PID 2224 wrote to memory of 1504	2224	MsiExec.exe	106
PID 2224 wrote to memory of 4904	2224	MsiExec.exe	108
PID 2480 wrote to memory of 2408	2480	AteraAgent.exe	112
PID 2408 wrote to memory of 3400	2408	cmd.exe	114
PID 572 wrote to memory of 3528	572	MsiExec.exe	115

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\setup_Z-_Mason_Street_Furniture_(Not_Supported_by_Group_IT).msi
1⤵
- Badlisted process makes network request
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2096

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4648
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:4460
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding DCCFFD2157035794A62B504F7E2CBCB1
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:572
- - C:\Windows\system32\rundll32.exe
    rundll32.exe "C:\Windows\Installer\MSI9FD5.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240689171 2 Atera.Agent.Installer.Msi.Ca!Atera.Agent.Installer.Msi.Ca.CustomActions.GenerateAgentId
    3⤵
    - Loads dropped DLL
    - Drops file in Windows directory
    - Suspicious use of AdjustPrivilegeToken
    PID:3164
- - C:\Windows\system32\rundll32.exe
    rundll32.exe "C:\Windows\Installer\MSIA14D.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240689531 6 Atera.Agent.Installer.Msi.Ca!Atera.Agent.Installer.Msi.Ca.CustomActions.ShouldContinueInstallation
    3⤵
    - Badlisted process makes network request
    - Loads dropped DLL
    - Drops file in Windows directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3212
- - C:\Windows\system32\rundll32.exe
    rundll32.exe "C:\Windows\Installer\MSIA797.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240691093 10 Atera.Agent.Installer.Msi.Ca!Atera.Agent.Installer.Msi.Ca.CustomActions.ReportMsiInstallStart
    3⤵
    - Badlisted process makes network request
    - Loads dropped DLL
    - Drops file in Windows directory
    - Suspicious use of AdjustPrivilegeToken
    PID:4780
- - C:\Windows\system32\rundll32.exe
    rundll32.exe "C:\Windows\Installer\MSIAB33.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240692062 15 Atera.Agent.Installer.Msi.Ca!Atera.Agent.Installer.Msi.Ca.CustomActions.DetectDotNetFrameworkRuntime
    3⤵
    - Loads dropped DLL
    - Drops file in Windows directory
    - System Time Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5072
- - C:\Windows\system32\rundll32.exe
    rundll32.exe "C:\Windows\Installer\MSIF233.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240710203 31 Atera.Agent.Installer.Msi.Ca!Atera.Agent.Installer.Msi.Ca.CustomActions.ReportMsiInstallEnd
    3⤵
    - Badlisted process makes network request
    - Loads dropped DLL
    - Drops file in Windows directory
    PID:3528
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding B4D1C1CA5D3F85B6BD2E78B47EB5D3D3 E Global\MSI0000
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:2224
- - C:\Program Files\ATERA Networks\AteraAgent\Agent\AteraAgent.exe
    "C:\Program Files\ATERA Networks\AteraAgent\Agent\AteraAgent.exe" init-settings --agent-id "4ec3c3a4-1839-433d-9e1b-7fc084dbe27b" --account-id "i3Ni+EOALl4FvwJcQroVhbrtT8HcJh6nP8Bf2147VP4=" --account-agent-installation-id "caf5a032c867462fbf577bc454480d04" --environment "Production" --customer-id "289" --folder-id ""
    3⤵
    - Executes dropped EXE
    - Drops file in Program Files directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3516
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" -ExecutionPolicy Bypass -NoProfile -Command "[Net.ServicePointManager]::SecurityProtocol=[Net.SecurityProtocolType]::Tls12;Invoke-WebRequest -Uri 'https://dot.net/v1/dotnet-install.ps1' -OutFile \"C:\Program Files\ATERA Networks\AteraAgent\Agent\dotnet-install.ps1\""
    3⤵
    - Badlisted process makes network request
    - Command and Scripting Interpreter: PowerShell
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1504
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" -ExecutionPolicy unrestricted -NoProfile -File "C:\Program Files\ATERA Networks\AteraAgent\Agent\dotnet-install.ps1" -Channel 8.0 -Runtime dotnet -InstallDir "C:\Program Files\ATERA Networks\AteraAgent\Agent\\.dotnet"
    3⤵
    - Badlisted process makes network request
    - Command and Scripting Interpreter: PowerShell
    - Drops file in Program Files directory
    - System Time Discovery
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4904

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:2692

C:\Program Files\ATERA Networks\AteraAgent\Agent\AteraAgent.exe
"C:\Program Files\ATERA Networks\AteraAgent\Agent\AteraAgent.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2480
- C:\Windows\system32\cmd.exe
  "cmd.exe" /c "C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\dotnet.exe" --list-runtimes
  2⤵
  - Executes a command shell one-liner
  - System Time Discovery
  - Suspicious use of WriteProcessMemory
  PID:2408
- - C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\dotnet.exe
    "C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\dotnet.exe" --list-runtimes
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Time Discovery
    PID:3400

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Event Triggered Execution

T1546

Installer Packages

T1546.016

Privilege Escalation

Event Triggered Execution

T1546

Installer Packages

T1546.016

Defense Evasion

System Binary Proxy Execution

T1218

Msiexec

T1218.007

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e589edc.rbs

Path C:\Config.Msi\e589edc.rbs
Size 7KB
SHA256 ac85e778fe8e411498df73e7bc2314e4304703cb598a0a9d581854c637b5e367
MD5 ca08a167ff309371ffb960893f131f6d
SHA1 1200e19ecd841a105984a312fa7ca1c478711a1f
SHA512 af9744a1c5e1680eb2eccf10dd50fece58b302c0b2c3fcf17a357ececc8beac8c2b3c638d6aec17ddb6fb2320f05b1942da0128f7a4b2e3af13b30ef3d859a23
SSDEEP 96:8mLaUupzD1s3IreiAUtUIp9MxFCsTlLUIp9MxFC6jNu1n+TlFQV5c9Wf2jgCCips:ZeJzZM6e4GmKx4IamKx4k7+AMBipLOX
TLSH
T1BBF11005720344D2F99E6738CB072B5A3BB2D3D64286535B1E9E84706F5739C1FA829F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\dotnet.exe
Size 153KB
SHA256 111da7b604cd196b49167cfeecdaef4034b58cc7de71a91cbf9e162c9e8b0931
MD5 26aca7f84913f46171b1bbad3f30f110
SHA1 1a61b447c6ebdf49455dcaf6ff62e3212f028ad2
SHA512 1698fa7300a6f67146c737210b6023f2f7166fd4ada58243a9011e67762a9f71eecac11cc1b2f5a4864f5204b1bba22962f37a08dae3d6103755b0382c7e3db2
SSDEEP 1536:/yPL142WnQwPtrd4zAl8ZVVZh6e0dYt4aXMFG0vcCVhsRz7:/yP22WplaO8n0Wt4aXMSCVQH
TLSH
T1C8F3071AD65811AAD1AE9575CB518A41BB337C6587E0E3CB17C0FCBE0F326909EE9703
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hostfxr.dll

Path C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\host\fxr\8.0.31\hostfxr.dll
Size 357KB
SHA256 4f5a0500cd2a2439b0d5edbf242950233aec4539ec9a5e7ba9b8a9b0079f63af
MD5 b12f168ba86e7135e07168cfbec01aba
SHA1 d2d51f767d7e8306e890dd6a97ade93fb117d8a5
SHA512 b2d612c1383c2754fe54a1b433ebdd77cb1a48d3143a7c1406300d6a4a26a52baa0310a10648baeed687201a583132fe9c2326dd1a46ed74c7d69e46a6290f17
SSDEEP 6144:GE7Hjww5R1Gv0crJHeUtJ9NZFSKJ2nje/SnFNonJLSHDWHPDh+vJpmE0f0xcTZ6M:VMjrJnJaKGkriJ4E16tXZPp
TLSH
T1F5741916D6E8017CF0B7D679CAB28901EB727C494BB196CF139099661E73BD09E39323
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

.settings.json

Path C:\Program Files\ATERA Networks\AteraAgent\Agent\.settings.json
Size 245B
SHA256 59482238fda7a7204ab248d2c6bebc6dd59ed36107fabe6a1dede3f1ca8a2851
MD5 c47efc67577c4f8b7a411cd9949aba3c
SHA1 1bcc5efbd3fd58db415eea9e460f97d19c81fa17
SHA512 2a6d663803f5bc4833ae473d948981e218cbe4628cf5d4ed6721bd8072bdd6ce03ec23c80cc9a8eb38e21d3bd98f54242eeb7cda3a84fd5e3d18f925f7a12182
TLSH
T124D097E98B3A8F602E002DA0B51A2A5C2031B221FF430C05F5CA121208707C001A2097
MD5 SHA1 SHA512 TLSH

Submit Download

AteraAgent.exe

Path C:\Program Files\ATERA Networks\AteraAgent\Agent\AteraAgent.exe
Size 21.7MB
SHA256 40be79204b749b4fffa22339c056b43ef3624ddc213183a2579ce88dc8e148bf
MD5 44159769f2118debe61c3f8c33bdcceb
SHA1 657ade2228358458a1e9dcd793bc3018656151bc
SHA512 911101d27d3a1beca0403362fe17d55a4ce39d399d04d38894a7127a63ee1fc0ea1581c138043c9cba5605bc446bc0fa25648de82ad75a23eecdb2f6a7f2cfdc
SSDEEP 196608:TGuM9a0wrs541GnixeN+AO6qtDpER5BafJvJ/tkwyPLniYx0k/:TjlXInUPp2wyPL7
TLSH
T154379C11A3EC426AE5BF8338D4724516DBF278466721E7CF2548A5E92E33BC09E35363
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

agent.cert.pfx

Path C:\Program Files\ATERA Networks\AteraAgent\Agent\certificates\production\agent.cert.pfx
Size 2KB
SHA256 26649036939826f554d651b3791cb67c1c485e08d3a5e9243aa2cfba31047114
MD5 0fb313635e8ac02c8d7b0b0cf057b3e8
SHA1 815df712453c0334ce3c5f4d6e56e21903de418f
SHA512 7a36fe34e6a51a5f070c4e6413054ca657ef98b2f4ba406ca80f0254d623bc20951381edcb678139fead284fb91960dae983a66d1e7fd70bc76451ced70dde7f
TLSH
T17A512C0355768431F2DEDE5EF1AD1F669CD69B834B4C199F50F014B94DD1D14909CEC8
MD5 SHA1 SHA512 TLSH

Submit Download

dotnet-install.ps1

Path C:\Program Files\ATERA Networks\AteraAgent\Agent\dotnet-install.ps1
Size 74KB
SHA256 e8b873e18a81e5c4cd8ab69d84dac8fead291d50b3c44633cd7fddad709a13d6
MD5 ce1e8af1ee38c40f594dd19f9cb988f5
SHA1 bc16517853592107970aae2d7c7d1546b1c6e960
SHA512 cf32ef77dcb0ba6b60da3ea3997746979844ebdc1db5470762c969bec2b3f5478bb348badbe2373e4eee7aea66e9c4db4f8b20919a6bf1b5e60345e5020f9ebe
SSDEEP 768:GQy0YIw0FI6Szz3G4yYijvbpyspGD2huFI1Fb2JPJFId4zT2C0U8qzqog7+XMhDF:GSY7PwYU1JPg8qzjUcn4f4Xsjh2Syy
TLSH
T152731A9EAD429032547363B8C96B1084FB374277524541A8F8DDD4887FB262D93A2FEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
Size 471B
SHA256 4181ff5096693f7ba0481c3851de5bb3e7c72129ab79d5ca7e86de8f4a3753b9
MD5 9cd0a87b9cc3d65a47a399280eb877fe
SHA1 3c7d1b79b59d9906eca093107eb2798ee52bc895
SHA512 0f0a66c349b0d729b468979ff722c50cf9d98e84ac569fd83466ca0a78a7c254f24097190659025350378149b2d1cba13e3b0851b3961b3570a2bd3f30e4f53d
TLSH
T110F0D43750BB73A331466C2C06E56E3034709B8F44C54972603554D1456F6EC214F45B
MD5 SHA1 SHA512 TLSH

Submit Download

8EC9B1D0ABBD7F98B401D425828828CE_6FBFBE34ABAF2109B411B965FB39009E

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_6FBFBE34ABAF2109B411B965FB39009E
Size 727B
SHA256 498fd46879cc823632307d3cde6225f5c3594e62ec3b1254062f0504415002e7
MD5 9099fa2c2be69c9eea13376c928e323c
SHA1 08610c3f94bfa124f266ef673b729122e22212cc
SHA512 eebf0d5625501298aadae83e493d7ef1f13a7c51ca60de9fdc1732b6f5f7a16ef22d1f2e050c437a033e4d657d2a68cc5be4e831421b90e4cd9997306f1b2c55
TLSH
T1630165060FA916407B219D2C5E9557B63E13D342795C061E066B11A5A78D3354F05931
MD5 SHA1 SHA512 TLSH

Submit Download

C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
Size 727B
SHA256 5f59c273582d1f7461890515bcdfcd0306152ac82e7b5129e9212fde0518d275
MD5 fc95b8627030850f8363f4e5ac74f5d0
SHA1 908f27aa06712a3095f49e41098218851dbf6b86
SHA512 dc7f9e6e2ce1d91935e327edf75104ab601d2781bf83974ee6605b7fe087a8ec3467f49abfdfa7a9dedc15b67d4bcfdfd53ce1709544b5210e290a2f38caa491
TLSH
T10001654245EC399574766840EBDC43B5347D47FB08DD426220112ACA19D1631FBD1406
MD5 SHA1 SHA512 TLSH

Submit Download

698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
Size 400B
SHA256 2bfa98870d15854e699385f8757e883a6d8411a5af0e41cda27078fa2f4e6198
MD5 be3d10b2ded1a52cea291c86a770a57a
SHA1 e838590511f828af767b121d024ed2b6447a7471
SHA512 dd4d72c3c3779abe0f727fd4f4bce8bb8a6021e7258fac03deed768e926c956a9adae47257e79528025cbf00e569e56a0bdbe65f933b190d06dd635849d4bea1
TLSH
T10FE020342BFE502FF1705B7403D9D1DA6F35F1172C4466BD1E81145D591DD005C92D70
MD5 SHA1 SHA512 TLSH

Submit Download

8EC9B1D0ABBD7F98B401D425828828CE_6FBFBE34ABAF2109B411B965FB39009E

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_6FBFBE34ABAF2109B411B965FB39009E
Size 408B
SHA256 b94c889b28c3231a202aa9440b3a6df7b588fd8db0e09fe58df73e9aba54ab3f
MD5 49d582465823e3a1df0ddf113ec6961c
SHA1 c060508134331dbc174ff3b5cd8389543dbfe5de
SHA512 058411cde4e56edcb94e97a1b1faed97ca8d50d7b1049dc286c2976e615e48ae00087d93dc4ad72cbfb451dd575f9172136ac593b91ae29b1b91ba89cbf01099
TLSH
T150E0203831F6854DF0E0943442F57D6659EDF34B194182651A905349AF25A408CA6678
MD5 SHA1 SHA512 TLSH

Submit Download

C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
Size 412B
SHA256 14edc45528c6a951b1d1ace29a6e659a1904e3bf4b4b4c0a9493c1344563f3df
MD5 e7a9cb0d482117439db15e22087f1bc6
SHA1 1b86ff945e03e369229075a4d07282046f532c47
SHA512 e9bfb2a20b43a24138ca0fab034a72760a1f61cbd15451933275c5585a703a7db7d09c0b5f31efd1f55864ebccde97b063fc754930cd35ea9b8af25efeb3e83f
TLSH
T1F0E0683861AB601EF490983086E6A1B91D4CF2061400837A06D04309AB0AE009C129B0
MD5 SHA1 SHA512 TLSH

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 81fc6cfe81caf86f84e1285cb854082ac5e127335b5946da154a73f7aa9c2122
MD5 ed30ca9187bf5593affb3dc9276309a6
SHA1 c63757897a6c43a44102b221fe8dc36355e99359
SHA512 1df4f44b207bb30fecee119a2f7f7ab7a0a0aed4d58eeabbec5791d5a6d9443cccffa5479ad4da094e6b88c871720d2e4bcf14ebec45a587ee4ec5e572f37810
TLSH
T1C051DA313275A1E4C91A3F47192819C023BF8355FA98AF5CB65C521EE92740B9B222F3
MD5 SHA1 SHA512 TLSH

Submit Download

rundll32.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\rundll32.exe.log
Size 847B
SHA256 ec084a6c6ecd7d31f1927b0cd926ec03ce346a469f24e5a860e05f2241bd7bf4
MD5 37544b654facecb83555afec67d08b33
SHA1 4dc0f5db034801784b01befef5c1d3304145e1dc
SHA512 4af827ead52c8769672f58a69fca18484aeba1e59b7ec0527e200f8e3d893bcbc1063ea820260fc0b922985ee3b26c3a6f79b4044fb34f1b58f2e3379971b5f9
TLSH
T141018E7122A1B2D589073F57196C258417FF4718B990AE1C7AA8625ED82B4175F323F3
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 fc6f46e4591eb772e8cbfba1c50d02e3670b444bd3e4802173d072e0bc3ac25e
MD5 d0bc6d9729346a550d0f51268635b24d
SHA1 42042125424ba085eb3ae19ae21ce4772d108acd
SHA512 f5db5ed29559a6cadcfe60d94d80eedcba015e1e02daee96785350a1e81bd2dacf0b3a9021ae465fda8bb8915bd66d5bd3f9d910612b95d2277d0cb5965b0d34
TLSH
T1C2115723B79CC961CC85453B509D9D6176B2D7C7819EDE9F6FC4C209A07F598CB211A0
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_c5py45cb.tqo.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_c5py45cb.tqo.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

MSI9FD5.tmp

Path C:\Windows\Installer\MSI9FD5.tmp
Size 347KB
SHA256 ba404962848d74940adc5b600ac84ce99eacfc951fe6271031da896d306ad667
MD5 26778893e7d19e9b76a1c39c87a81a1d
SHA1 f01bf5674082b0921bd277c36f08cf43ae81f871
SHA512 6a9961fbc1e20ee61859a421c8898031375c0ebd9dceea6cfafe60e2d9aa6fca87db86dea0d4915b18d9242f4485c723ab0a6218405a20459fccb76acb0e2faa
SSDEEP 3072:ap1TSTx9ug1jpOwO1WVWpJi+96rrPwSaOFZrk6BjGiR/8ENKn74olxX8RvcOWJrc:apUNpIx1IWpJHOrwIBaiRTivX8R7IOWy
TLSH
T1F374BF55B7F809B9FC7B563988630906D273BC515B71DB9F0360420A9F3B790E93AB22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSIAD47.tmp

Path C:\Windows\Installer\MSIAD47.tmp
Size 390KB
SHA256 7aacd4c18710e9bc4ff2034895a0a0c8f80f21809fb177d520e93f7688216e6d
MD5 e8dc682f2c486075c6aba658971a62cc
SHA1 7cd0a2b5047a4074aa06a6caa3bb69124851e95d
SHA512 a0a1f0f418bf2d4ffd079b840aeb0142c7faab7fa72b5e33b1841798569f55a25dfd305abf9c2ca89792f6499f695b69975882697dc53e99d5a975a9fa8c7d75
SSDEEP 6144:p2ET2+QBLh+MVy5DCRoRRvc181kaKN8MMLuG:p2ET2+cVXVyNhvcCkaKN8Me
TLSH
T10D846B29F7E408EDE4B78276C5A68530FF75748D3320D5AE47A8852D1F3AAA070BB701
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CustomAction.config

Path C:\Windows\Installer\SFXCA2B38E8A1CF4E51C8E2A17F4D729CE716\CustomAction.config
Size 956B
SHA256 2dbc73a3bc444a9119c9b5e20276698384d9ad9535a8a7547c44d1b9a8d67346
MD5 a9088b24614c12b70af6ae9669a4a4b1
SHA1 d72efa4e0c7bd733ed3d51831ead7031175c27e0
SHA512 14090969a71b6c80023da29dc8582aded6d26ca349966767ce22102080abce118b846a47ea2b9abe2d5f6a788bc083031d27fdee4103e2e4b99d29c2ac494d7c
TLSH
T10811D00D4A946B7724312793BFACA1C4E76194BA3994411CB49BB9151F39938176338F
MD5 SHA1 SHA512 TLSH

Submit Download

WixToolset.Dtf.WindowsInstaller.dll

Path C:\Windows\Installer\SFXCA2B38E8A1CF4E51C8E2A17F4D729CE716\WixToolset.Dtf.WindowsInstaller.dll
Size 193KB
SHA256 a614884ea627da1925131ebf41e8ae202caeac0fe543b86384f5eb2bfaf1aa75
MD5 ef8d5785ac8669f5fd54e22f52770e6b
SHA1 4c94ae7ef233be33a56c0a5d9b8e2211d5d5792c
SHA512 ab3b140bd6531f22e994606820e6511442c23d9015b1e1a38aaed43aa42ba29a996511151d0b3a383c05c2b11f670e52cdd7f507ad1a1ad8cebea57fb22ade5a
SSDEEP 3072:8Of7tVL+l4lj19l4uDHYHj69UgoTqdda7CnfKlRUjW01KytaljYqCDPC:8gQQx54Hj6jomdrzalMqb
TLSH
T14A149C2A57F84B3ECEFF8778E2614252C7B1F1E67103DB1D9D8281A52163784B682397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Atera.Agent.Installer.Msi.Ca.dll

Path C:\Windows\Installer\SFXCAA72334D1F5413F19ACF5E7E6B55CF184\Atera.Agent.Installer.Msi.Ca.dll
Size 74KB
SHA256 46e6ea528969185cb3e663d48d00899f558a09078a9bc2a98b8a9dcf8c04fb79
MD5 04232dbe113e8c01ba28bea800eb677e
SHA1 270774fcbc633212d62be3406c7e7b26172f014e
SHA512 661461bd517eece02637cbc42571f961c362be50591625249752e75e5ece1b02373c937c663377268c89f83efcaf511094eb727921b7e225c18b2ef09504ac28
SSDEEP 1536:yV+re0WBSsp7G19QxAiMS6bFOKf9WD2oRMlr:yVIyBSsp7CM6b8KFWD2Fr
TLSH
T1EE73E44137F84619F2FF5F78BD70901589B3BC666D31DA8D2AA0244E0A76BC0DA60B77
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e589edb.msi

Path C:\Windows\Installer\e589edb.msi
Size 8.4MB
SHA256 1571100ac7ed5c27e470225995828dd39e9760a6a03683ebf669658d15e0d18b
MD5 a6957328fd0cc86898f66a771ddd751e
SHA1 aed2ace1ceed45192f6df48484c19362e3686cd8
SHA512 b8f8a0bca0a4ac27583e06c00fc8f87893cb8465cd5d026f12cba071bab5380aeacd376371030899d758e51294e17bf328a8cd820083fd6d0c949e352b8b37a7
SSDEEP 196608:xWRnEqtLMMQNysvwZJtRrWsIMC7nW1A490CAvIjv:WEFNysWVWsbC7W1Ai0z
TLSH
T1BF963325F7F409AAE8638276C5638125EF7ABC496321D6AF0364B41D1F3B760A0BF714
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TmpF5D5.tmp

Path C:\Windows\Temp\TmpF5D5.tmp
Size 3KB
SHA256 94739ca46676bd602a78671257fbfce39feaabc9664c6326bf4970a0108e3429
MD5 560af444a6a7faa0b0ca94dc16ca2a58
SHA1 df31453fafde354870a0a9a8ca50b18e284c32e4
SHA512 7c853176c088d56a517e52c6687b6debf08f6f9726376720ade9d13fafc9be0ca72f0f2b35562a61ece653aeb789c838c60447f463b2bbe70c21bfc8c039b681
TLSH
T1B3616C88B10E28972CEECC504D495B40AEC3D754B390F25F68F4BCA64CA13E9A358C3C
MD5 SHA1 SHA512 TLSH

Submit Download

metadata-2

Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
Size 24.0MB
SHA256 f264cb677d46cb8a720cf71e1bdb2c69674b988fd8a774d3424eec130abd439e
MD5 bafe1676645bff3e975e2ebff2bb8ee9
SHA1 05d94ca9f3efe3086f81aafaccce321b3c00677e
SHA512 8893cf9055ffbd695b5112a49871669274f1e70670cdd8aeb986044562b0b336f2a6d61d135159548ca07228d1aefad5b6dc4af6ed439c15d7bf23ddea905dda
SSDEEP 24576:aEpmg3MVdoO/vvTLjAyO4ZWMKcLxPqNkeCYdUTeA83qDumcyo3hGneBZjr:44
TLSH
T1E147B12836F92100E7B7DE3DA8F0AA234D397D5B9C15DE8D45851B4E0821F71E8B2F66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{1848162b-bdff-4dbf-933d-ea78521ffd92}_OnDiskSnapshotProp

Path \??\Volume{4cb2ae72-0000-0000-0000-d08302000000}\System Volume Information\SPP\OnlineMetadataCache\{1848162b-bdff-4dbf-933d-ea78521ffd92}_OnDiskSnapshotProp
Size 6KB
SHA256 3e04ed30daaddfa5cbcf737f0564d2f73bf71d6bb2b6c7549e27bebdd21000a9
MD5 629870f9d20264bea4e269041763c33e
SHA1 5727ba216dac758ae2e01ef0227ba9a61d114cf8
SHA512 747b6fd3a0e62af498e5083fe3197bf09644a6835ad6441cb5508e42e6a6a84afbbadfdfd7166816320398d9d81ce5c3ca98fd603ce578609e24bae91f5b9c09
SSDEEP 96:FPkcOVB/vc8DD84LTHzbOHXOHBlBRQ88Sc9XE56tOSVQpu:1kZb++ZVm
TLSH
T184D1990C5AF54311E2B3AB7229F18557A837B911EF33CB8E0298238E2670910F875F5B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1504-119-0x000001ED758B0000-0x000001ED758D2000-memory.dmp

Download

memory/3164-37-0x00000275592E0000-0x00000275592F8000-memory.dmp

Download

memory/3164-33-0x0000027559350000-0x0000027559384000-memory.dmp

Download

memory/3212-60-0x0000022AA32D0000-0x0000022AA330C000-memory.dmp

Download

memory/3212-59-0x0000022A8A010000-0x0000022A8A022000-memory.dmp

Download

memory/4904-151-0x000001C2EBA90000-0x000001C2EBAA2000-memory.dmp

Download

memory/4904-150-0x000001C2EBA60000-0x000001C2EBA6A000-memory.dmp

Download

memory/4904-145-0x000001C2EBA60000-0x000001C2EBA84000-memory.dmp

Download

memory/4904-144-0x000001C2EBA60000-0x000001C2EBA8A000-memory.dmp

Download