1571100ac7ed5c27e470225995828dd39e9760a6a03683ebf669658d15e0d18b

Analysis

max time kernel
148s
max time network
147s
platform
windows11-21h2_x64
resource
win11-20260911-en
resource tags

arch:x64arch:x86image:win11-20260911-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
24/09/2026, 14:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
setup_Z-_Mason_Street_Furniture_(Not_Supported_by_Group_IT).msi
Size 8.4MB
Sample260924-r4krjsfe22
SHA256 1571100ac7ed5c27e470225995828dd39e9760a6a03683ebf669658d15e0d18b
MD5 a6957328fd0cc86898f66a771ddd751e
SHA1 aed2ace1ceed45192f6df48484c19362e3686cd8
SHA512 b8f8a0bca0a4ac27583e06c00fc8f87893cb8465cd5d026f12cba071bab5380aeacd376371030899d758e51294e17bf328a8cd820083fd6d0c949e352b8b37a7
SSDEEP 196608:xWRnEqtLMMQNysvwZJtRrWsIMC7nW1A490CAvIjv:WEFNysWVWsbC7W1Ai0z
TLSH
T1BF963325F7F409AAE8638276C5638125EF7ABC496321D6AF0364B41D1F3B760A0BF714
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery execution persistence privilege_escalation ransomware

Malware Config

Signatures

Badlisted process makes network request 13 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
2	4896	msiexec.exe
3	4896	msiexec.exe
4	472	rundll32.exe
5	4476	rundll32.exe
6	3188	powershell.exe
7	3188	powershell.exe
8	2784	powershell.exe
9	2784	powershell.exe
10	2784	powershell.exe
11	2784	powershell.exe
12	2784	powershell.exe
13	2784	powershell.exe
15	2132	rundll32.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
3188	powershell.exe
2784	powershell.exe

Executes dropped EXE 3 IoCs

pid	Process
5624	AteraAgent.exe
5616	AteraAgent.exe
5632	dotnet.exe

Loads dropped DLL 24 IoCs

pid	Process
904	MsiExec.exe
4000	rundll32.exe
4000	rundll32.exe
4000	rundll32.exe
904	MsiExec.exe
472	rundll32.exe
472	rundll32.exe
472	rundll32.exe
904	MsiExec.exe
4476	rundll32.exe
4476	rundll32.exe
4476	rundll32.exe
904	MsiExec.exe
5584	rundll32.exe
5584	rundll32.exe
5584	rundll32.exe
5600	MsiExec.exe
5600	MsiExec.exe
5600	MsiExec.exe
5632	dotnet.exe
904	MsiExec.exe
2132	rundll32.exe
2132	rundll32.exe
2132	rundll32.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe

Drops file in System32 directory 6 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\BAD725C80F9E10846F35D039A996E4A8_88B6AE015495C1ECC395D19C1DD02894	AteraAgent.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\BAD725C80F9E10846F35D039A996E4A8_88B6AE015495C1ECC395D19C1DD02894	AteraAgent.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\75CA58072B9926F763A91F0CC2798706_3AD253ACA02D44EA5FD30683B8A5B5FA	AteraAgent.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\75CA58072B9926F763A91F0CC2798706_3AD253ACA02D44EA5FD30683B8A5B5FA	AteraAgent.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\D1BEC81CCAFDC823A062FF26A89A6B6D_D40E4E79DF388B984709B048EEAFD4E4	AteraAgent.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\D1BEC81CCAFDC823A062FF26A89A6B6D_D40E4E79DF388B984709B048EEAFD4E4	AteraAgent.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\8.0.31\System.Private.Xml.Linq.dll	powershell.exe
File created	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\8.0.31\System.Resources.Reader.dll	powershell.exe
File created	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\8.0.31\System.Web.dll	powershell.exe
File created	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\8.0.31\mscordbi.dll	powershell.exe
File created	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\8.0.31\System.Globalization.dll	powershell.exe
File created	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\8.0.31\System.IO.IsolatedStorage.dll	powershell.exe
File opened for modification	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\8.0.31\System.Net.Sockets.dll	powershell.exe
File opened for modification	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\8.0.31\System.Reflection.dll	powershell.exe
File opened for modification	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\8.0.31\System.Security.Principal.Windows.dll	powershell.exe
File created	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\8.0.31\System.Threading.Tasks.Parallel.dll	powershell.exe
File created	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\8.0.31\.version	powershell.exe
File opened for modification	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\8.0.31\System.Collections.Immutable.dll	powershell.exe
File opened for modification	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\8.0.31\System.Globalization.Extensions.dll	powershell.exe
File created	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\8.0.31\System.Net.NetworkInformation.dll	powershell.exe
File opened for modification	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\8.0.31\System.Security.Cryptography.Cng.dll	powershell.exe
File created	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\8.0.31\System.Core.dll	powershell.exe
File created	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\8.0.31\System.IO.MemoryMappedFiles.dll	powershell.exe
File created	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\8.0.31\System.Net.Quic.dll	powershell.exe
File created	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\8.0.31\System.ServiceProcess.dll	powershell.exe
File opened for modification	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\dotnet.exe	powershell.exe
File created	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\8.0.31\mscorlib.dll	powershell.exe
File created	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\8.0.31\System.ComponentModel.TypeConverter.dll	powershell.exe
File created	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\8.0.31\System.Memory.dll	powershell.exe
File opened for modification	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\8.0.31\System.Runtime.InteropServices.RuntimeInformation.dll	powershell.exe
File opened for modification	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\8.0.31\System.Runtime.Numerics.dll	powershell.exe
File created	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\8.0.31\System.Security.Cryptography.Primitives.dll	powershell.exe
File opened for modification	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\8.0.31\System.ValueTuple.dll	powershell.exe
File created	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\8.0.31\System.Xml.XmlSerializer.dll	powershell.exe
File opened for modification	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\31ae327c-c04c-4763-ae65-857d47d88b51	powershell.exe
File created	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\8.0.31\Microsoft.DiaSymReader.Native.amd64.dll	powershell.exe
File opened for modification	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\8.0.31\Microsoft.DiaSymReader.Native.amd64.dll	powershell.exe
File created	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\8.0.31\System.Buffers.dll	powershell.exe
File created	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\8.0.31\System.Configuration.dll	powershell.exe
File opened for modification	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\8.0.31\System.Data.dll	powershell.exe
File opened for modification	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\8.0.31\System.IO.Compression.Native.dll	powershell.exe
File opened for modification	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\8.0.31\System.Runtime.Intrinsics.dll	powershell.exe
File opened for modification	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\8.0.31\System.Drawing.dll	powershell.exe
File opened for modification	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\8.0.31\System.IO.FileSystem.AccessControl.dll	powershell.exe
File opened for modification	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\8.0.31\System.IO.FileSystem.DriveInfo.dll	powershell.exe
File opened for modification	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\8.0.31\System.IO.Pipes.AccessControl.dll	powershell.exe
File created	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\8.0.31\System.Linq.dll	powershell.exe
File opened for modification	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\8.0.31\System.Net.HttpListener.dll	powershell.exe
File created	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\8.0.31\System.Net.WebHeaderCollection.dll	powershell.exe
File created	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\8.0.31\System.Net.WebSockets.dll	powershell.exe
File opened for modification	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\8.0.31\System.AppContext.dll	powershell.exe
File opened for modification	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\8.0.31\System.ComponentModel.dll	powershell.exe
File opened for modification	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\8.0.31\System.ObjectModel.dll	powershell.exe
File created	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\8.0.31\System.Threading.Tasks.Extensions.dll	powershell.exe
File created	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\8.0.31\System.Transactions.dll	powershell.exe
File created	C:\Program Files\ATERA Networks\AteraAgent\Agent\.settings.json.tmp	AteraAgent.exe
File created	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\host\fxr\8.0.31\hostfxr.dll	powershell.exe
File created	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\8.0.31\System.IO.FileSystem.DriveInfo.dll	powershell.exe
File created	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\8.0.31\System.Net.Sockets.dll	powershell.exe
File opened for modification	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\8.0.31\System.Numerics.Vectors.dll	powershell.exe
File opened for modification	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\8.0.31\System.Resources.ResourceManager.dll	powershell.exe
File opened for modification	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\8.0.31\System.Security.Cryptography.dll	powershell.exe
File created	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\8.0.31\System.Security.SecureString.dll	powershell.exe
File created	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\8.0.31\System.Xml.XDocument.dll	powershell.exe
File opened for modification	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\8.0.31\mscordbi.dll	powershell.exe
File opened for modification	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\8.0.31\System.Runtime.Extensions.dll	powershell.exe
File created	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\8.0.31\System.Security.Claims.dll	powershell.exe
File opened for modification	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\8.0.31\System.Xml.XmlDocument.dll	powershell.exe
File created	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\8.0.31\System.Xml.XPath.XDocument.dll	powershell.exe
File opened for modification	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\8.0.31\WindowsBase.dll	powershell.exe

Drops file in Windows directory 36 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\MSI2E8.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DF284756229655C820.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DF11A20ECD2F8ED039.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI2A9.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\SFXCA43769558FB4A774A37A394E9B1C3FE45\WixToolset.Dtf.WindowsInstaller.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\SFXCA43769558FB4A774A37A394E9B1C3FE45\CustomAction.config	rundll32.exe
File opened for modification	C:\Windows\Installer\e58f661.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIF7A9.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIFB92.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DFF4FDFAF9BE829C31.TMP	msiexec.exe
File created	C:\Windows\Installer\SourceHash{2387F12B-5B54-4D0E-B136-EC163500CB44}	msiexec.exe
File opened for modification	C:\Windows\Installer\SFXCA9E9DB119C44AC07995B8017A0834B3C4\Atera.Agent.Installer.Msi.Ca.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI3AF4.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\SFXCAD981BC1B9A496048F0535082568BADA8\Atera.Agent.Installer.Msi.Ca.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\SFXCAD981BC1B9A496048F0535082568BADA8\CustomAction.config	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI480.tmp	msiexec.exe
File created	C:\Windows\Installer\e58f663.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIFFF8.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\SFXCA39F9F80F7947D648A60E9EADC6F675DB\WixToolset.Dtf.WindowsInstaller.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\SFXCA39F9F80F7947D648A60E9EADC6F675DB\CustomAction.config	rundll32.exe
File opened for modification	C:\Windows\Installer\SFXCA9E9DB119C44AC07995B8017A0834B3C4\WixToolset.Dtf.WindowsInstaller.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\SFXCA9E9DB119C44AC07995B8017A0834B3C4\CustomAction.config	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI15B8.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\SFXCA43769558FB4A774A37A394E9B1C3FE45\Atera.Agent.Installer.Msi.Ca.dll	rundll32.exe
File opened for modification	C:\Windows\SystemTemp\Tmp3D6D.tmp	AteraAgent.exe
File opened for modification	C:\Windows\Installer\SFXCAD981BC1B9A496048F0535082568BADA8\WixToolset.Dtf.WindowsInstaller.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\Installer\e58f661.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\SFXCAC37AC7015D4330EB306A3B36AEE7DC12\Atera.Agent.Installer.Msi.Ca.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\SFXCAC37AC7015D4330EB306A3B36AEE7DC12\WixToolset.Dtf.WindowsInstaller.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\SFXCAC37AC7015D4330EB306A3B36AEE7DC12\CustomAction.config	rundll32.exe
File opened for modification	C:\Windows\Installer\SFXCA39F9F80F7947D648A60E9EADC6F675DB\Atera.Agent.Installer.Msi.Ca.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSIDE7.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DF00D1173EFFB96239.TMP	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe

Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs

persistence privilege_escalation

Installer Packages

T1546.016

Msiexec

T1218.007

pid	Process
4896	msiexec.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5588	cmd.exe

System Time Discovery 1 TTPs 4 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5588	cmd.exe
5632	dotnet.exe
5584	rundll32.exe
2784	powershell.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 00000000040000004b6b342432efaf550000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff0000000027010100000800004b6b34240000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed35000000ffffffff0000000007000100006809004b6b3424000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff350000000000000005000000ffffffff000000000700010000f8ff1a4b6b3424000000000000f0ff350000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d4b6b3424000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28\52C64B7E\@%SystemRoot%\System32\wuaueng.dll,-400 = "Windows Update"	AteraAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28\52C64B7E	AteraAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28\52C64B7E\@%SystemRoot%\system32\NgcRecovery.dll,-100 = "Windows Hello Recovery Key Encryption"	AteraAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28\52C64B7E\@%SystemRoot%\System32\ci.dll,-100 = "Isolated User Mode (IUM)"	AteraAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPublisher\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPublisher	powershell.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPublisher\Certificates	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28\52C64B7E\@%SystemRoot%\System32\ci.dll,-101 = "Enclave"	AteraAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	AteraAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPublisher\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe

Modifies registry class 22 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\25F46F8180ECF4345A1FA7A8935DE9AE\B21F783245B5E0D41B63CE615300BC44	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B21F783245B5E0D41B63CE615300BC44\SourceList\PackageName = "setup_Z-_Mason_Street_Furniture_(Not_Supported_by_Group_IT).msi"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B21F783245B5E0D41B63CE615300BC44\SourceList\Net	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B21F783245B5E0D41B63CE615300BC44\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B21F783245B5E0D41B63CE615300BC44\Clients = 3a0000000000	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B21F783245B5E0D41B63CE615300BC44	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B21F783245B5E0D41B63CE615300BC44\Language = "1033"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B21F783245B5E0D41B63CE615300BC44\InstanceType = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B21F783245B5E0D41B63CE615300BC44\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B21F783245B5E0D41B63CE615300BC44\SourceList\Media\1 = ";"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\B21F783245B5E0D41B63CE615300BC44\AteraAgentFeature	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B21F783245B5E0D41B63CE615300BC44\AuthorizedLUAApp = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\25F46F8180ECF4345A1FA7A8935DE9AE	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B21F783245B5E0D41B63CE615300BC44\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\B21F783245B5E0D41B63CE615300BC44	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B21F783245B5E0D41B63CE615300BC44\Version = "33882146"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B21F783245B5E0D41B63CE615300BC44\Assignment = "1"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B21F783245B5E0D41B63CE615300BC44\AdvertiseFlags = "388"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B21F783245B5E0D41B63CE615300BC44\DeploymentFlags = "3"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B21F783245B5E0D41B63CE615300BC44\SourceList\Media	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B21F783245B5E0D41B63CE615300BC44\ProductName = "AteraAgent"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B21F783245B5E0D41B63CE615300BC44\PackageCode = "DE29C0996E833174C8DF8536CC633D4E"	msiexec.exe

Suspicious behavior: EnumeratesProcesses 34 IoCs

pid	Process
472	rundll32.exe
3368	msiexec.exe
3368	msiexec.exe
5624	AteraAgent.exe
5624	AteraAgent.exe
3188	powershell.exe
3188	powershell.exe
2784	powershell.exe
2784	powershell.exe
5616	AteraAgent.exe
5616	AteraAgent.exe
5616	AteraAgent.exe
5616	AteraAgent.exe
5616	AteraAgent.exe
5616	AteraAgent.exe
5616	AteraAgent.exe
5616	AteraAgent.exe
5616	AteraAgent.exe
5616	AteraAgent.exe
5616	AteraAgent.exe
5616	AteraAgent.exe
5616	AteraAgent.exe
5616	AteraAgent.exe
5616	AteraAgent.exe
5616	AteraAgent.exe
5616	AteraAgent.exe
5616	AteraAgent.exe
5616	AteraAgent.exe
5616	AteraAgent.exe
5616	AteraAgent.exe
5616	AteraAgent.exe
5616	AteraAgent.exe
5616	AteraAgent.exe
5616	AteraAgent.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4896	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4896	msiexec.exe
Token: SeSecurityPrivilege	3368	msiexec.exe
Token: SeCreateTokenPrivilege	4896	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	4896	msiexec.exe
Token: SeLockMemoryPrivilege	4896	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4896	msiexec.exe
Token: SeMachineAccountPrivilege	4896	msiexec.exe
Token: SeTcbPrivilege	4896	msiexec.exe
Token: SeSecurityPrivilege	4896	msiexec.exe
Token: SeTakeOwnershipPrivilege	4896	msiexec.exe
Token: SeLoadDriverPrivilege	4896	msiexec.exe
Token: SeSystemProfilePrivilege	4896	msiexec.exe
Token: SeSystemtimePrivilege	4896	msiexec.exe
Token: SeProfSingleProcessPrivilege	4896	msiexec.exe
Token: SeIncBasePriorityPrivilege	4896	msiexec.exe
Token: SeCreatePagefilePrivilege	4896	msiexec.exe
Token: SeCreatePermanentPrivilege	4896	msiexec.exe
Token: SeBackupPrivilege	4896	msiexec.exe
Token: SeRestorePrivilege	4896	msiexec.exe
Token: SeShutdownPrivilege	4896	msiexec.exe
Token: SeDebugPrivilege	4896	msiexec.exe
Token: SeAuditPrivilege	4896	msiexec.exe
Token: SeSystemEnvironmentPrivilege	4896	msiexec.exe
Token: SeChangeNotifyPrivilege	4896	msiexec.exe
Token: SeRemoteShutdownPrivilege	4896	msiexec.exe
Token: SeUndockPrivilege	4896	msiexec.exe
Token: SeSyncAgentPrivilege	4896	msiexec.exe
Token: SeEnableDelegationPrivilege	4896	msiexec.exe
Token: SeManageVolumePrivilege	4896	msiexec.exe
Token: SeImpersonatePrivilege	4896	msiexec.exe
Token: SeCreateGlobalPrivilege	4896	msiexec.exe
Token: SeBackupPrivilege	3668	vssvc.exe
Token: SeRestorePrivilege	3668	vssvc.exe
Token: SeAuditPrivilege	3668	vssvc.exe
Token: SeBackupPrivilege	3368	msiexec.exe
Token: SeRestorePrivilege	3368	msiexec.exe
Token: SeRestorePrivilege	3368	msiexec.exe
Token: SeTakeOwnershipPrivilege	3368	msiexec.exe
Token: SeRestorePrivilege	3368	msiexec.exe
Token: SeTakeOwnershipPrivilege	3368	msiexec.exe
Token: SeBackupPrivilege	4776	srtasks.exe
Token: SeRestorePrivilege	4776	srtasks.exe
Token: SeSecurityPrivilege	4776	srtasks.exe
Token: SeTakeOwnershipPrivilege	4776	srtasks.exe
Token: SeBackupPrivilege	4776	srtasks.exe
Token: SeRestorePrivilege	4776	srtasks.exe
Token: SeSecurityPrivilege	4776	srtasks.exe
Token: SeTakeOwnershipPrivilege	4776	srtasks.exe
Token: SeDebugPrivilege	4000	rundll32.exe
Token: SeRestorePrivilege	3368	msiexec.exe
Token: SeTakeOwnershipPrivilege	3368	msiexec.exe
Token: SeDebugPrivilege	472	rundll32.exe
Token: SeRestorePrivilege	3368	msiexec.exe
Token: SeTakeOwnershipPrivilege	3368	msiexec.exe
Token: SeDebugPrivilege	4476	rundll32.exe
Token: SeRestorePrivilege	3368	msiexec.exe
Token: SeTakeOwnershipPrivilege	3368	msiexec.exe
Token: SeRestorePrivilege	3368	msiexec.exe
Token: SeTakeOwnershipPrivilege	3368	msiexec.exe
Token: SeDebugPrivilege	5584	rundll32.exe
Token: SeRestorePrivilege	3368	msiexec.exe
Token: SeTakeOwnershipPrivilege	3368	msiexec.exe
Token: SeDebugPrivilege	5624	AteraAgent.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
4896	msiexec.exe
4896	msiexec.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 3368 wrote to memory of 4776	3368	msiexec.exe	85
PID 3368 wrote to memory of 904	3368	msiexec.exe	87
PID 904 wrote to memory of 4000	904	MsiExec.exe	88
PID 904 wrote to memory of 472	904	MsiExec.exe	89
PID 904 wrote to memory of 4476	904	MsiExec.exe	90
PID 904 wrote to memory of 5584	904	MsiExec.exe	91
PID 3368 wrote to memory of 5600	3368	msiexec.exe	92
PID 5600 wrote to memory of 5624	5600	MsiExec.exe	93
PID 5600 wrote to memory of 3188	5600	MsiExec.exe	95
PID 5600 wrote to memory of 2784	5600	MsiExec.exe	97
PID 5616 wrote to memory of 5588	5616	AteraAgent.exe	101
PID 5588 wrote to memory of 5632	5588	cmd.exe	103
PID 904 wrote to memory of 2132	904	MsiExec.exe	104

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\setup_Z-_Mason_Street_Furniture_(Not_Supported_by_Group_IT).msi
1⤵
- Badlisted process makes network request
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4896

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3368
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4776
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding 0DE0C19C6832EAC2D1A5FDB2E7B1968C
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:904
- - C:\Windows\system32\rundll32.exe
    rundll32.exe "C:\Windows\Installer\MSIF7A9.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240711656 2 Atera.Agent.Installer.Msi.Ca!Atera.Agent.Installer.Msi.Ca.CustomActions.GenerateAgentId
    3⤵
    - Loads dropped DLL
    - Drops file in Windows directory
    - Suspicious use of AdjustPrivilegeToken
    PID:4000
- - C:\Windows\system32\rundll32.exe
    rundll32.exe "C:\Windows\Installer\MSIFB92.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240712609 6 Atera.Agent.Installer.Msi.Ca!Atera.Agent.Installer.Msi.Ca.CustomActions.ShouldContinueInstallation
    3⤵
    - Badlisted process makes network request
    - Loads dropped DLL
    - Drops file in Windows directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:472
- - C:\Windows\system32\rundll32.exe
    rundll32.exe "C:\Windows\Installer\MSIFFF8.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240713718 10 Atera.Agent.Installer.Msi.Ca!Atera.Agent.Installer.Msi.Ca.CustomActions.ReportMsiInstallStart
    3⤵
    - Badlisted process makes network request
    - Loads dropped DLL
    - Drops file in Windows directory
    - Suspicious use of AdjustPrivilegeToken
    PID:4476
- - C:\Windows\system32\rundll32.exe
    rundll32.exe "C:\Windows\Installer\MSI2E8.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240714468 15 Atera.Agent.Installer.Msi.Ca!Atera.Agent.Installer.Msi.Ca.CustomActions.DetectDotNetFrameworkRuntime
    3⤵
    - Loads dropped DLL
    - Drops file in Windows directory
    - System Time Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5584
- - C:\Windows\system32\rundll32.exe
    rundll32.exe "C:\Windows\Installer\MSI3AF4.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240728875 31 Atera.Agent.Installer.Msi.Ca!Atera.Agent.Installer.Msi.Ca.CustomActions.ReportMsiInstallEnd
    3⤵
    - Badlisted process makes network request
    - Loads dropped DLL
    - Drops file in Windows directory
    PID:2132
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding B2ECDB5640131955E2CB747E92E6A66C E Global\MSI0000
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:5600
- - C:\Program Files\ATERA Networks\AteraAgent\Agent\AteraAgent.exe
    "C:\Program Files\ATERA Networks\AteraAgent\Agent\AteraAgent.exe" init-settings --agent-id "a0601e4f-d8bb-4731-a04a-d17cb7eb6427" --account-id "i3Ni+EOALl4FvwJcQroVhbrtT8HcJh6nP8Bf2147VP4=" --account-agent-installation-id "caf5a032c867462fbf577bc454480d04" --environment "Production" --customer-id "289" --folder-id ""
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5624
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" -ExecutionPolicy Bypass -NoProfile -Command "[Net.ServicePointManager]::SecurityProtocol=[Net.SecurityProtocolType]::Tls12;Invoke-WebRequest -Uri 'https://dot.net/v1/dotnet-install.ps1' -OutFile \"C:\Program Files\ATERA Networks\AteraAgent\Agent\dotnet-install.ps1\""
    3⤵
    - Badlisted process makes network request
    - Command and Scripting Interpreter: PowerShell
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    PID:3188
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" -ExecutionPolicy unrestricted -NoProfile -File "C:\Program Files\ATERA Networks\AteraAgent\Agent\dotnet-install.ps1" -Channel 8.0 -Runtime dotnet -InstallDir "C:\Program Files\ATERA Networks\AteraAgent\Agent\\.dotnet"
    3⤵
    - Badlisted process makes network request
    - Command and Scripting Interpreter: PowerShell
    - Drops file in Program Files directory
    - System Time Discovery
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    PID:2784

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:3668

C:\Program Files\ATERA Networks\AteraAgent\Agent\AteraAgent.exe
"C:\Program Files\ATERA Networks\AteraAgent\Agent\AteraAgent.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5616
- C:\Windows\system32\cmd.exe
  "cmd.exe" /c "C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\dotnet.exe" --list-runtimes
  2⤵
  - Executes a command shell one-liner
  - System Time Discovery
  - Suspicious use of WriteProcessMemory
  PID:5588
- - C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\dotnet.exe
    "C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\dotnet.exe" --list-runtimes
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Time Discovery
    PID:5632

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Event Triggered Execution

T1546

Installer Packages

T1546.016

Privilege Escalation

Event Triggered Execution

T1546

Installer Packages

T1546.016

Defense Evasion

System Binary Proxy Execution

T1218

Msiexec

T1218.007

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e58f662.rbs

Path C:\Config.Msi\e58f662.rbs
Size 7KB
SHA256 dc12a4baf873b4cc81ecf70c07a3d551e791c19bd93619e83ee9c57f7edd354b
MD5 feb77512dbf30e0765bccaf034a28606
SHA1 8450dad9204b612b5e1439261de3d72810d886ec
SHA512 d0a310cff41547e2d2f0e6b5ed1663a557bc0f66943f078f80143824b7fc28f6a205191f931038756256dd30fb9ed93a1d8633e2058bfd3758a8bc5841968258
SSDEEP 96:8mLaUu4zD1UsmCz5UtUIp9MxFCsTlLUIp9MxFC6jNu1n+TlFCV5c9Wf2jgCCiplC:ZeYzZwCuGmKx4IamKx4k7EAMBipLOX
TLSH
T1B0F11F05720345D2F99E6738CB072B5A3BB2D3D68386535B1E9E84706F573881FA829F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\dotnet.exe
Size 153KB
SHA256 111da7b604cd196b49167cfeecdaef4034b58cc7de71a91cbf9e162c9e8b0931
MD5 26aca7f84913f46171b1bbad3f30f110
SHA1 1a61b447c6ebdf49455dcaf6ff62e3212f028ad2
SHA512 1698fa7300a6f67146c737210b6023f2f7166fd4ada58243a9011e67762a9f71eecac11cc1b2f5a4864f5204b1bba22962f37a08dae3d6103755b0382c7e3db2
SSDEEP 1536:/yPL142WnQwPtrd4zAl8ZVVZh6e0dYt4aXMFG0vcCVhsRz7:/yP22WplaO8n0Wt4aXMSCVQH
TLSH
T1C8F3071AD65811AAD1AE9575CB518A41BB337C6587E0E3CB17C0FCBE0F326909EE9703
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hostfxr.dll

Path C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\host\fxr\8.0.31\hostfxr.dll
Size 357KB
SHA256 4f5a0500cd2a2439b0d5edbf242950233aec4539ec9a5e7ba9b8a9b0079f63af
MD5 b12f168ba86e7135e07168cfbec01aba
SHA1 d2d51f767d7e8306e890dd6a97ade93fb117d8a5
SHA512 b2d612c1383c2754fe54a1b433ebdd77cb1a48d3143a7c1406300d6a4a26a52baa0310a10648baeed687201a583132fe9c2326dd1a46ed74c7d69e46a6290f17
SSDEEP 6144:GE7Hjww5R1Gv0crJHeUtJ9NZFSKJ2nje/SnFNonJLSHDWHPDh+vJpmE0f0xcTZ6M:VMjrJnJaKGkriJ4E16tXZPp
TLSH
T1F5741916D6E8017CF0B7D679CAB28901EB727C494BB196CF139099661E73BD09E39323
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

.settings.json

Path C:\Program Files\ATERA Networks\AteraAgent\Agent\.settings.json
Size 245B
SHA256 899830c1747aa3530dbb645905ad086f56b8f56742211a92f72633f7a43f897e
MD5 766cd53dec637c53049f80f612824373
SHA1 0888f8e5c7f08bfad8e5170010ddac090f660e8d
SHA512 2458bcfe33bf1ab2b154d39fc4a90e602c71eb42d72aeb29c7773dc84b820cf46989d09e9c94516bef079fa88fcfb518c112a3a731e02e9dccaaec943aec612c
TLSH
T1ACD0A7D44A35DB241D205D61A11A5BADA433AA51FA870D0877C655250C70BD542AA1A7
MD5 SHA1 SHA512 TLSH

Submit Download

AteraAgent.exe

Path C:\Program Files\ATERA Networks\AteraAgent\Agent\AteraAgent.exe
Size 21.7MB
SHA256 40be79204b749b4fffa22339c056b43ef3624ddc213183a2579ce88dc8e148bf
MD5 44159769f2118debe61c3f8c33bdcceb
SHA1 657ade2228358458a1e9dcd793bc3018656151bc
SHA512 911101d27d3a1beca0403362fe17d55a4ce39d399d04d38894a7127a63ee1fc0ea1581c138043c9cba5605bc446bc0fa25648de82ad75a23eecdb2f6a7f2cfdc
SSDEEP 196608:TGuM9a0wrs541GnixeN+AO6qtDpER5BafJvJ/tkwyPLniYx0k/:TjlXInUPp2wyPL7
TLSH
T154379C11A3EC426AE5BF8338D4724516DBF278466721E7CF2548A5E92E33BC09E35363
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

agent.cert.pfx

Path C:\Program Files\ATERA Networks\AteraAgent\Agent\certificates\production\agent.cert.pfx
Size 2KB
SHA256 b0cd513450f7f5c6b6696569b3e8b24ceaf5d106d6002694e9b7433ac98b284c
MD5 6b3942fe5dab37c0c8befd28e7534c61
SHA1 c3fe330169b003425411e7a0bcd31678ab958670
SHA512 e136964072de3c9d5819e1ce1658e94b04460b35c53ab3fabfc2b9ea326436136b1cce6b830f0058f94af58d48b055679177b570bfb2399981ce91b0b2a8d0bb
TLSH
T1DE513A8611B3041E7D4FD9DC60896FAB4795EB5D0B9DA05370394DCE0D6CA6CE0A8420
MD5 SHA1 SHA512 TLSH

Submit Download

dotnet-install.ps1

Path C:\Program Files\ATERA Networks\AteraAgent\Agent\dotnet-install.ps1
Size 74KB
SHA256 e8b873e18a81e5c4cd8ab69d84dac8fead291d50b3c44633cd7fddad709a13d6
MD5 ce1e8af1ee38c40f594dd19f9cb988f5
SHA1 bc16517853592107970aae2d7c7d1546b1c6e960
SHA512 cf32ef77dcb0ba6b60da3ea3997746979844ebdc1db5470762c969bec2b3f5478bb348badbe2373e4eee7aea66e9c4db4f8b20919a6bf1b5e60345e5020f9ebe
SSDEEP 768:GQy0YIw0FI6Szz3G4yYijvbpyspGD2huFI1Fb2JPJFId4zT2C0U8qzqog7+XMhDF:GSY7PwYU1JPg8qzjUcn4f4Xsjh2Syy
TLSH
T152731A9EAD429032547363B8C96B1084FB374277524541A8F8DDD4887FB262D93A2FEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
Size 471B
SHA256 4181ff5096693f7ba0481c3851de5bb3e7c72129ab79d5ca7e86de8f4a3753b9
MD5 9cd0a87b9cc3d65a47a399280eb877fe
SHA1 3c7d1b79b59d9906eca093107eb2798ee52bc895
SHA512 0f0a66c349b0d729b468979ff722c50cf9d98e84ac569fd83466ca0a78a7c254f24097190659025350378149b2d1cba13e3b0851b3961b3570a2bd3f30e4f53d
TLSH
T110F0D43750BB73A331466C2C06E56E3034709B8F44C54972603554D1456F6EC214F45B
MD5 SHA1 SHA512 TLSH

Submit Download

8EC9B1D0ABBD7F98B401D425828828CE_6FBFBE34ABAF2109B411B965FB39009E

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_6FBFBE34ABAF2109B411B965FB39009E
Size 727B
SHA256 498fd46879cc823632307d3cde6225f5c3594e62ec3b1254062f0504415002e7
MD5 9099fa2c2be69c9eea13376c928e323c
SHA1 08610c3f94bfa124f266ef673b729122e22212cc
SHA512 eebf0d5625501298aadae83e493d7ef1f13a7c51ca60de9fdc1732b6f5f7a16ef22d1f2e050c437a033e4d657d2a68cc5be4e831421b90e4cd9997306f1b2c55
TLSH
T1630165060FA916407B219D2C5E9557B63E13D342795C061E066B11A5A78D3354F05931
MD5 SHA1 SHA512 TLSH

Submit Download

C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
Size 727B
SHA256 5f59c273582d1f7461890515bcdfcd0306152ac82e7b5129e9212fde0518d275
MD5 fc95b8627030850f8363f4e5ac74f5d0
SHA1 908f27aa06712a3095f49e41098218851dbf6b86
SHA512 dc7f9e6e2ce1d91935e327edf75104ab601d2781bf83974ee6605b7fe087a8ec3467f49abfdfa7a9dedc15b67d4bcfdfd53ce1709544b5210e290a2f38caa491
TLSH
T10001654245EC399574766840EBDC43B5347D47FB08DD426220112ACA19D1631FBD1406
MD5 SHA1 SHA512 TLSH

Submit Download

698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
Size 400B
SHA256 3598e5f9848e68675d70032ed245545f4c7add91a60e969d0c045ec0e02f590e
MD5 9c8f2b0b27555e0d814b0695afd4cd85
SHA1 700709c1035cdc4b21202666c40b429a21d99e32
SHA512 4a448130ea98e833d303a467905e62bfab907f55c9d43c2fd7438eb965ddb9cea0fa02e5432dedbbfe6e9f9c06a1b8533ea3cd18ef072f85980ea2bec390aada
TLSH
T12BE0D8341BFF501FF1645BB403D9D1DA6B29F1062C4462AD1E91546D591DD004CA2870
MD5 SHA1 SHA512 TLSH

Submit Download

8EC9B1D0ABBD7F98B401D425828828CE_6FBFBE34ABAF2109B411B965FB39009E

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_6FBFBE34ABAF2109B411B965FB39009E
Size 408B
SHA256 e59ceaacce83406ff3ca9bc3f73fabf8d5ebfd5407da9e48b180ac8d741f7bf1
MD5 fb357db020f0e7f0146334a51ddb32f1
SHA1 d92a700cf04bf502baad208e5aeeb1a06043495c
SHA512 b52912147e8d222a72bf66ef1d50c02f6e702efeaff7a06a473f5ae9721f3e476a8f73c3d3ace7934c81e53727ffa17ec6d1e36072c7811edb9395e999c3480b
TLSH
T1D3E0203431F5855DF0E0953442F6796664EDF34B154183651A90934AAF25A804CE5678
MD5 SHA1 SHA512 TLSH

Submit Download

C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
Size 412B
SHA256 fafb8301c2c3d1cb278ca416f9bf6a1ee8688d6829fabcff58e917e2a9a62b5f
MD5 c08d7a49c2f0f08dc1c11efd7983da03
SHA1 542ee3af91676bc13fd348505da9fc32a4d99f53
SHA512 21057d8d13050e02e04e1a5e3569d728d3d022349921e2facbfa478320c6d20fb11d7bce5f30ce7501759f5b315a4b3af7b97e79bdb595cbaee5617f9495bfd3
TLSH
T1A6E0D83825AF655EF090983586E6A1B61D99F6062444D77916D05319A74AE049C119B0
MD5 SHA1 SHA512 TLSH

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 d69b7d84970cb04cd069299fd8aa9cef8394999588bead979104dc3cb743b4f2
MD5 5f4c933102a824f41e258078e34165a7
SHA1 d2f9e997b2465d3ae7d91dad8d99b77a2332b6ee
SHA512 a7556b2be1a69dbc1f7ff4c1c25581a28cb885c7e1116632c535fee5facaa99067bcead8f02499980f1d999810157d0fc2f9e45c200dee7d379907ef98a6f034
TLSH
T15651CF323375B1D489163F07192C59C463BF8355FA94AF4CB698624ED92700B9F222F3
MD5 SHA1 SHA512 TLSH

Submit Download

rundll32.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\rundll32.exe.log
Size 847B
SHA256 16f4a7736a0c2aee54256d3d75ce4c0816fabf130b3b92340deca34c5f5fda43
MD5 2940b232afa412901f8ae5651c790f93
SHA1 f79bd5d1433c803515e2d9a016396344187beea2
SHA512 553d5491c9bc358c7ce8a95caa445e882ab4bf744a2f5be1b2131c20f27321f65121389fd076558ba415f322fdad6ed36a05902e5c55cbbeace371182890af27
TLSH
T1B6018E722371B2D589163F43194D5B8827FF43197550ED0CB999721ED92A01B6F223F3
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 cca996ce3a1fb9cc44bcacc9002798fc66eab27146004d38e65ef98539510f66
MD5 be40db6c8fd0d8b32dd97d14f10f8d1c
SHA1 b0f3a526f60d03ca3e0e6ecd5340358b0d345768
SHA512 0c595146fef4919951f9f04b2f13a03094d51c87063882ffe9beb1f1b0e36fb08ca3ff53bdf0bf1c234e02ac7f878fe5bf185ec8db2c437651e74a9a47414f4f
TLSH
T1B9117A33B79CC135C8D9117A1089AD01B2B4C3C7049EDE8F7A84C509E57F58ADB645E4
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_nrhr3z5d.0q1.psm1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_nrhr3z5d.0q1.psm1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

MSI480.tmp

Path C:\Windows\Installer\MSI480.tmp
Size 390KB
SHA256 7aacd4c18710e9bc4ff2034895a0a0c8f80f21809fb177d520e93f7688216e6d
MD5 e8dc682f2c486075c6aba658971a62cc
SHA1 7cd0a2b5047a4074aa06a6caa3bb69124851e95d
SHA512 a0a1f0f418bf2d4ffd079b840aeb0142c7faab7fa72b5e33b1841798569f55a25dfd305abf9c2ca89792f6499f695b69975882697dc53e99d5a975a9fa8c7d75
SSDEEP 6144:p2ET2+QBLh+MVy5DCRoRRvc181kaKN8MMLuG:p2ET2+cVXVyNhvcCkaKN8Me
TLSH
T10D846B29F7E408EDE4B78276C5A68530FF75748D3320D5AE47A8852D1F3AAA070BB701
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSIF7A9.tmp

Path C:\Windows\Installer\MSIF7A9.tmp
Size 347KB
SHA256 ba404962848d74940adc5b600ac84ce99eacfc951fe6271031da896d306ad667
MD5 26778893e7d19e9b76a1c39c87a81a1d
SHA1 f01bf5674082b0921bd277c36f08cf43ae81f871
SHA512 6a9961fbc1e20ee61859a421c8898031375c0ebd9dceea6cfafe60e2d9aa6fca87db86dea0d4915b18d9242f4485c723ab0a6218405a20459fccb76acb0e2faa
SSDEEP 3072:ap1TSTx9ug1jpOwO1WVWpJi+96rrPwSaOFZrk6BjGiR/8ENKn74olxX8RvcOWJrc:apUNpIx1IWpJHOrwIBaiRTivX8R7IOWy
TLSH
T1F374BF55B7F809B9FC7B563988630906D273BC515B71DB9F0360420A9F3B790E93AB22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CustomAction.config

Path C:\Windows\Installer\SFXCAC37AC7015D4330EB306A3B36AEE7DC12\CustomAction.config
Size 956B
SHA256 2dbc73a3bc444a9119c9b5e20276698384d9ad9535a8a7547c44d1b9a8d67346
MD5 a9088b24614c12b70af6ae9669a4a4b1
SHA1 d72efa4e0c7bd733ed3d51831ead7031175c27e0
SHA512 14090969a71b6c80023da29dc8582aded6d26ca349966767ce22102080abce118b846a47ea2b9abe2d5f6a788bc083031d27fdee4103e2e4b99d29c2ac494d7c
TLSH
T10811D00D4A946B7724312793BFACA1C4E76194BA3994411CB49BB9151F39938176338F
MD5 SHA1 SHA512 TLSH

Submit Download

WixToolset.Dtf.WindowsInstaller.dll

Path C:\Windows\Installer\SFXCAC37AC7015D4330EB306A3B36AEE7DC12\WixToolset.Dtf.WindowsInstaller.dll
Size 193KB
SHA256 a614884ea627da1925131ebf41e8ae202caeac0fe543b86384f5eb2bfaf1aa75
MD5 ef8d5785ac8669f5fd54e22f52770e6b
SHA1 4c94ae7ef233be33a56c0a5d9b8e2211d5d5792c
SHA512 ab3b140bd6531f22e994606820e6511442c23d9015b1e1a38aaed43aa42ba29a996511151d0b3a383c05c2b11f670e52cdd7f507ad1a1ad8cebea57fb22ade5a
SSDEEP 3072:8Of7tVL+l4lj19l4uDHYHj69UgoTqdda7CnfKlRUjW01KytaljYqCDPC:8gQQx54Hj6jomdrzalMqb
TLSH
T14A149C2A57F84B3ECEFF8778E2614252C7B1F1E67103DB1D9D8281A52163784B682397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Atera.Agent.Installer.Msi.Ca.dll

Path C:\Windows\Installer\SFXCAD981BC1B9A496048F0535082568BADA8\Atera.Agent.Installer.Msi.Ca.dll
Size 74KB
SHA256 46e6ea528969185cb3e663d48d00899f558a09078a9bc2a98b8a9dcf8c04fb79
MD5 04232dbe113e8c01ba28bea800eb677e
SHA1 270774fcbc633212d62be3406c7e7b26172f014e
SHA512 661461bd517eece02637cbc42571f961c362be50591625249752e75e5ece1b02373c937c663377268c89f83efcaf511094eb727921b7e225c18b2ef09504ac28
SSDEEP 1536:yV+re0WBSsp7G19QxAiMS6bFOKf9WD2oRMlr:yVIyBSsp7CM6b8KFWD2Fr
TLSH
T1EE73E44137F84619F2FF5F78BD70901589B3BC666D31DA8D2AA0244E0A76BC0DA60B77
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e58f661.msi

Path C:\Windows\Installer\e58f661.msi
Size 8.4MB
SHA256 1571100ac7ed5c27e470225995828dd39e9760a6a03683ebf669658d15e0d18b
MD5 a6957328fd0cc86898f66a771ddd751e
SHA1 aed2ace1ceed45192f6df48484c19362e3686cd8
SHA512 b8f8a0bca0a4ac27583e06c00fc8f87893cb8465cd5d026f12cba071bab5380aeacd376371030899d758e51294e17bf328a8cd820083fd6d0c949e352b8b37a7
SSDEEP 196608:xWRnEqtLMMQNysvwZJtRrWsIMC7nW1A490CAvIjv:WEFNysWVWsbC7W1Ai0z
TLSH
T1BF963325F7F409AAE8638276C5638125EF7ABC496321D6AF0364B41D1F3B760A0BF714
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Tmp3D6D.tmp

Path C:\Windows\SystemTemp\Tmp3D6D.tmp
Size 3KB
SHA256 94739ca46676bd602a78671257fbfce39feaabc9664c6326bf4970a0108e3429
MD5 560af444a6a7faa0b0ca94dc16ca2a58
SHA1 df31453fafde354870a0a9a8ca50b18e284c32e4
SHA512 7c853176c088d56a517e52c6687b6debf08f6f9726376720ade9d13fafc9be0ca72f0f2b35562a61ece653aeb789c838c60447f463b2bbe70c21bfc8c039b681
TLSH
T1B3616C88B10E28972CEECC504D495B40AEC3D754B390F25F68F4BCA64CA13E9A358C3C
MD5 SHA1 SHA512 TLSH

Submit Download

metadata-2

Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
Size 24.6MB
SHA256 f750d53c057b3a8c170516534f5ab6ba60f9d6e5fec87fd016bf111ad7584533
MD5 0564b0d9689f0d658cf2bc47271cf046
SHA1 f3cef4317ab4128a970eaf04d1c30a5ac6fe0671
SHA512 149dfd5ee91fee06294ab39707079551576238f375ece60e455877e5b9cb740ba670796fb015877224cad47cfd168bad6dde896330c96f3cde583645a6f58a57
SSDEEP 24576:b2gmSp1edoO/vvTLmGNexUXa/aJGwYpX2WONXJEt0264khJYI2sabgHqR:M
TLSH
T1C547052432F92111E7F79E3C68F06A634A3E7D5BAC15DE8C45411B4E0961FB0E872F6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{ac7d37cc-18a8-40ee-8c95-904afc862d39}_OnDiskSnapshotProp

Path \??\Volume{24346b4b-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{ac7d37cc-18a8-40ee-8c95-904afc862d39}_OnDiskSnapshotProp
Size 6KB
SHA256 9e0fef68aa275132563dce909f70c85b3bd89a8d4eb508f1b492bc3aee6d427f
MD5 b52ebd8c3856e447635dbda68a035efb
SHA1 21d89038df6da73c7f8a0bec9612cc9b45b1e403
SHA512 28ffd2bbe90ff6972121ded7c962ec5ee51181f054a49a72500070f8f4cbe150a9d98ad11bfec202610dd9575ad7b20682cfb7eb9e8153890b8da4e9f17b0414
SSDEEP 96:Fc+catMUkvc8DD84LTHzbOHXOHBlBRQ88Sc9XE56tOSVQpu:7lqb++ZVm
TLSH
T19AD198085AE54711E2B3AB3129F14553A877B911FF33CB8E0298638E6670910F875F6F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/472-66-0x00000205F7BE0000-0x00000205F7D2F000-memory.dmp

Download

memory/472-63-0x00000205F7B50000-0x00000205F7B8C000-memory.dmp

Download

memory/472-62-0x00000205F5F80000-0x00000205F5F92000-memory.dmp

Download

memory/2132-586-0x000001F144C70000-0x000001F144DBF000-memory.dmp

Download

memory/2784-159-0x000001EF59060000-0x000001EF59113000-memory.dmp

Download

memory/2784-160-0x000001EF58CC0000-0x000001EF58CCA000-memory.dmp

Download

memory/2784-161-0x000001EF58D20000-0x000001EF58D4A000-memory.dmp

Download

memory/2784-162-0x000001EF58D20000-0x000001EF58D44000-memory.dmp

Download

memory/2784-164-0x000001EF58D00000-0x000001EF58D0A000-memory.dmp

Download

memory/2784-165-0x000001EF58D30000-0x000001EF58D42000-memory.dmp

Download

memory/2784-158-0x000001EF58CD0000-0x000001EF58CEC000-memory.dmp

Download

memory/3188-134-0x000001EE3E150000-0x000001EE3E172000-memory.dmp

Download

memory/4000-44-0x000002A22E640000-0x000002A22E78F000-memory.dmp

Download

memory/4000-39-0x000002A214AB0000-0x000002A214AC8000-memory.dmp

Download

memory/4000-35-0x000002A214A70000-0x000002A214AA4000-memory.dmp

Download

memory/4476-84-0x000001BA2B0D0000-0x000001BA2B21F000-memory.dmp

Download

memory/5584-102-0x0000024622C60000-0x0000024622DAF000-memory.dmp

Download