1571100ac7ed5c27e470225995828dd39e9760a6a03683ebf669658d15e0d18b

Analysis

max time kernel
148s
max time network
147s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/09/2026, 14:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
setup_Z-_Mason_Street_Furniture_(Not_Supported_by_Group_IT).msi
Size 8.4MB
Sample260924-r4krjsfe22
SHA256 1571100ac7ed5c27e470225995828dd39e9760a6a03683ebf669658d15e0d18b
MD5 a6957328fd0cc86898f66a771ddd751e
SHA1 aed2ace1ceed45192f6df48484c19362e3686cd8
SHA512 b8f8a0bca0a4ac27583e06c00fc8f87893cb8465cd5d026f12cba071bab5380aeacd376371030899d758e51294e17bf328a8cd820083fd6d0c949e352b8b37a7
SSDEEP 196608:xWRnEqtLMMQNysvwZJtRrWsIMC7nW1A490CAvIjv:WEFNysWVWsbC7W1Ai0z
TLSH
T1BF963325F7F409AAE8638276C5638125EF7ABC496321D6AF0364B41D1F3B760A0BF714
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery execution persistence privilege_escalation ransomware

Malware Config

Signatures

Badlisted process makes network request 12 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
2	768	msiexec.exe
13	4968	rundll32.exe
14	2580	rundll32.exe
15	2752	powershell.exe
16	2752	powershell.exe
17	3524	powershell.exe
18	3524	powershell.exe
19	3524	powershell.exe
20	3524	powershell.exe
21	3524	powershell.exe
22	3524	powershell.exe
24	4492	rundll32.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
2752	powershell.exe
3524	powershell.exe

Executes dropped EXE 3 IoCs

pid	Process
1572	AteraAgent.exe
856	AteraAgent.exe
4300	dotnet.exe

Loads dropped DLL 24 IoCs

pid	Process
4476	MsiExec.exe
4660	rundll32.exe
4660	rundll32.exe
4660	rundll32.exe
4476	MsiExec.exe
4968	rundll32.exe
4968	rundll32.exe
4968	rundll32.exe
4476	MsiExec.exe
2580	rundll32.exe
2580	rundll32.exe
2580	rundll32.exe
4476	MsiExec.exe
4708	rundll32.exe
4708	rundll32.exe
4708	rundll32.exe
2244	MsiExec.exe
2244	MsiExec.exe
2244	MsiExec.exe
4300	dotnet.exe
4476	MsiExec.exe
4492	rundll32.exe
4492	rundll32.exe
4492	rundll32.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe

Drops file in System32 directory 6 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\75CA58072B9926F763A91F0CC2798706_3AD253ACA02D44EA5FD30683B8A5B5FA	AteraAgent.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\D1BEC81CCAFDC823A062FF26A89A6B6D_D40E4E79DF388B984709B048EEAFD4E4	AteraAgent.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\D1BEC81CCAFDC823A062FF26A89A6B6D_D40E4E79DF388B984709B048EEAFD4E4	AteraAgent.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\BAD725C80F9E10846F35D039A996E4A8_88B6AE015495C1ECC395D19C1DD02894	AteraAgent.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\BAD725C80F9E10846F35D039A996E4A8_88B6AE015495C1ECC395D19C1DD02894	AteraAgent.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\75CA58072B9926F763A91F0CC2798706_3AD253ACA02D44EA5FD30683B8A5B5FA	AteraAgent.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\8.0.31\System.dll	powershell.exe
File created	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\8.0.31\System.Threading.Tasks.dll	powershell.exe
File opened for modification	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\8.0.31\clrgc.dll	powershell.exe
File created	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\8.0.31\Microsoft.NETCore.App.deps.json	powershell.exe
File opened for modification	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\8.0.31\Microsoft.Win32.Primitives.dll	powershell.exe
File created	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\8.0.31\System.Collections.Concurrent.dll	powershell.exe
File opened for modification	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\8.0.31\System.Collections.Concurrent.dll	powershell.exe
File opened for modification	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\8.0.31\System.ComponentModel.dll	powershell.exe
File created	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\8.0.31\System.Diagnostics.TraceSource.dll	powershell.exe
File opened for modification	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\8.0.31\System.Runtime.CompilerServices.VisualC.dll	powershell.exe
File created	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\8.0.31\System.Collections.Specialized.dll	powershell.exe
File created	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\8.0.31\System.Core.dll	powershell.exe
File opened for modification	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\8.0.31\System.dll	powershell.exe
File opened for modification	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\8.0.31\System.IO.MemoryMappedFiles.dll	powershell.exe
File opened for modification	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\8.0.31\System.Memory.dll	powershell.exe
File created	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\8.0.31\System.Security.Cryptography.OpenSsl.dll	powershell.exe
File created	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\8.0.31\System.Security.Cryptography.X509Certificates.dll	powershell.exe
File created	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\8.0.31\System.Text.Encoding.Extensions.dll	powershell.exe
File opened for modification	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\8.0.31\mscordaccore.dll	powershell.exe
File opened for modification	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\8.0.31\System.ComponentModel.EventBasedAsync.dll	powershell.exe
File opened for modification	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\8.0.31\System.Net.WebHeaderCollection.dll	powershell.exe
File opened for modification	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\8.0.31\System.Security.Claims.dll	powershell.exe
File opened for modification	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\8.0.31\System.Security.Cryptography.Primitives.dll	powershell.exe
File created	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\8.0.31\System.Text.RegularExpressions.dll	powershell.exe
File opened for modification	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\8.0.31\System.Threading.Tasks.dll	powershell.exe
File opened for modification	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\8.0.31\System.ComponentModel.Annotations.dll	powershell.exe
File created	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\8.0.31\System.Private.CoreLib.dll	powershell.exe
File created	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\8.0.31\System.Reflection.TypeExtensions.dll	powershell.exe
File created	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\8.0.31\Microsoft.NETCore.App.runtimeconfig.json	powershell.exe
File created	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\8.0.31\System.ComponentModel.EventBasedAsync.dll	powershell.exe
File opened for modification	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\8.0.31\System.Diagnostics.FileVersionInfo.dll	powershell.exe
File opened for modification	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\8.0.31\System.IO.dll	powershell.exe
File opened for modification	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\8.0.31\System.Net.NameResolution.dll	powershell.exe
File created	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\8.0.31\System.Runtime.Serialization.Formatters.dll	powershell.exe
File opened for modification	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\8.0.31\System.Security.Cryptography.Algorithms.dll	powershell.exe
File opened for modification	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\8.0.31\System.Security.Cryptography.dll	powershell.exe
File opened for modification	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\8.0.31\System.Diagnostics.StackTrace.dll	powershell.exe
File created	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\8.0.31\System.Diagnostics.Tools.dll	powershell.exe
File opened for modification	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\8.0.31\System.Globalization.dll	powershell.exe
File created	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\8.0.31\System.Security.Cryptography.Algorithms.dll	powershell.exe
File opened for modification	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\8.0.31\System.Text.Encoding.dll	powershell.exe
File opened for modification	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\8.0.31\System.Text.Json.dll	powershell.exe
File created	C:\Program Files\ATERA Networks\AteraAgent\Agent\data\production\iot_conf.json	AteraAgent.exe
File created	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\host\fxr\8.0.31\hostfxr.dll	powershell.exe
File opened for modification	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\8.0.31\clretwrc.dll	powershell.exe
File created	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\8.0.31\System.Net.Ping.dll	powershell.exe
File opened for modification	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\8.0.31\System.Security.Principal.Windows.dll	powershell.exe
File created	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\8.0.31\Microsoft.Win32.Registry.dll	powershell.exe
File created	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\8.0.31\mscordaccore.dll	powershell.exe
File created	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\8.0.31\System.IO.MemoryMappedFiles.dll	powershell.exe
File created	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\8.0.31\System.Reflection.DispatchProxy.dll	powershell.exe
File created	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\8.0.31\System.Runtime.InteropServices.JavaScript.dll	powershell.exe
File created	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\8.0.31\System.Web.HttpUtility.dll	powershell.exe
File opened for modification	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\8.0.31\Microsoft.VisualBasic.Core.dll	powershell.exe
File opened for modification	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\8.0.31\System.Diagnostics.Contracts.dll	powershell.exe
File created	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\8.0.31\System.Diagnostics.Tracing.dll	powershell.exe
File created	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\8.0.31\System.IO.Compression.ZipFile.dll	powershell.exe
File opened for modification	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\8.0.31\System.IO.FileSystem.Primitives.dll	powershell.exe
File opened for modification	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\8.0.31\System.Net.Http.Json.dll	powershell.exe
File created	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\8.0.31\System.Reflection.dll	powershell.exe
File created	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\8.0.31\System.Security.Cryptography.Encoding.dll	powershell.exe
File opened for modification	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\host\fxr\8.0.31\hostfxr.dll	powershell.exe
File opened for modification	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\8.0.31\msquic.dll	powershell.exe
File created	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\8.0.31\System.Data.dll	powershell.exe

Drops file in Windows directory 43 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\SFXCA7EB59EE0B049BC9A60E9694CF5F1ECE7\Atera.Agent.Installer.Msi.Ca.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\SFXCA7EB59EE0B049BC9A60E9694CF5F1ECE7\CustomAction.config	rundll32.exe
File opened for modification	C:\Windows\SystemTemp\Tmp8E0D.tmp	AteraAgent.exe
File created	C:\Windows\SystemTemp\~DFC1D459A456704BDD.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI6270.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DFA21A80898A9825E2.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\SFXCA9ED2756FAA472618C27BF80C73E2D36D\WixToolset.Dtf.WindowsInstaller.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI4283.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI5475.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\SFXCA9E8D6A12F84BA41A747B6A8303FC597E\CustomAction.config	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI380F.tmp	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\e592c36.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\SFXCA9E8D6A12F84BA41A747B6A8303FC597E\Atera.Agent.Installer.Msi.Ca.dll	rundll32.exe
File created	C:\Windows\SystemTemp\~DFBEB46BDA3C1C3793.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_tn5jevur.i4z.ps1	powershell.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_a4zrlyua.myo.psm1	powershell.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_lfc2tyqd.p0q.psm1	powershell.exe
File opened for modification	C:\Windows\Installer\SFXCA42FDF13BC2409A5AAAC6BA37C80EFB52\CustomAction.config	rundll32.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\SystemTemp\wnjfez3a.mjl	powershell.exe
File opened for modification	C:\Windows\Installer\MSI88D6.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DF07AFB6BB2DAA9F70.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\SFXCAD74D4D93414C5158B0ED4D3F58EB32CC\WixToolset.Dtf.WindowsInstaller.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI3C17.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\SFXCA42FDF13BC2409A5AAAC6BA37C80EFB52\Atera.Agent.Installer.Msi.Ca.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\SFXCA42FDF13BC2409A5AAAC6BA37C80EFB52\WixToolset.Dtf.WindowsInstaller.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\SFXCA9ED2756FAA472618C27BF80C73E2D36D\Atera.Agent.Installer.Msi.Ca.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\SFXCA9ED2756FAA472618C27BF80C73E2D36D\CustomAction.config	rundll32.exe
File created	C:\Windows\Installer\e592c36.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\SFXCA9E8D6A12F84BA41A747B6A8303FC597E\WixToolset.Dtf.WindowsInstaller.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\SFXCAD74D4D93414C5158B0ED4D3F58EB32CC\CustomAction.config	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI3FE1.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\SFXCAD74D4D93414C5158B0ED4D3F58EB32CC\Atera.Agent.Installer.Msi.Ca.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI404F.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_naglznr4.1q0.psm1	powershell.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_afn4drjn.ufs.ps1	powershell.exe
File opened for modification	C:\Windows\Installer\SFXCA7EB59EE0B049BC9A60E9694CF5F1ECE7\WixToolset.Dtf.WindowsInstaller.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI3176.tmp	msiexec.exe
File created	C:\Windows\Installer\SourceHash{2387F12B-5B54-4D0E-B136-EC163500CB44}	msiexec.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_w1ocn253.1uv.ps1	powershell.exe
File created	C:\Windows\Installer\e592c38.msi	msiexec.exe

Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs

persistence privilege_escalation

Installer Packages

T1546.016

Msiexec

T1218.007

pid	Process
768	msiexec.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4116	cmd.exe

System Time Discovery 1 TTPs 4 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4116	cmd.exe
4300	dotnet.exe
4708	rundll32.exe
3524	powershell.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000430d2ae4193eb5170000000000000000000000000000000000000000000000000000000000000000000000000000000000001071020000000000c0120000000000000000000000002701010000883801430d2ae40000000000001071020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d0830200000000006025c501000000000000000000000700010000e84101430d2ae4000000000000d08302000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9c701000000000000050000000000000000000000070001000098d4e3430d2ae400000000000030a9c7010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9cc0100000000000005000000000000000000000007000100009854e6430d2ae400000000000030a9cc01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28\52C64B7E\@%SystemRoot%\System32\wuaueng.dll,-400 = "Windows Update"	AteraAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28\52C64B7E\@%SystemRoot%\system32\dnsapi.dll,-103 = "Domain Name System (DNS) Server Trust"	AteraAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28\52C64B7E\@%SystemRoot%\System32\ci.dll,-100 = "Isolated User Mode (IUM)"	AteraAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E	msiexec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28\52C64B7E\@%SystemRoot%\system32\WindowsPowerShell\v1.0\powershell.exe,-124 = "Document Encryption"	AteraAgent.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28\52C64B7E\@%SystemRoot%\system32\NgcRecovery.dll,-100 = "Windows Hello Recovery Key Encryption"	AteraAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	powershell.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe

Modifies registry class 22 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\B21F783245B5E0D41B63CE615300BC44\AteraAgentFeature	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B21F783245B5E0D41B63CE615300BC44\PackageCode = "DE29C0996E833174C8DF8536CC633D4E"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B21F783245B5E0D41B63CE615300BC44\Language = "1033"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\25F46F8180ECF4345A1FA7A8935DE9AE\B21F783245B5E0D41B63CE615300BC44	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B21F783245B5E0D41B63CE615300BC44\SourceList	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\B21F783245B5E0D41B63CE615300BC44	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B21F783245B5E0D41B63CE615300BC44\AdvertiseFlags = "388"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B21F783245B5E0D41B63CE615300BC44\AuthorizedLUAApp = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B21F783245B5E0D41B63CE615300BC44\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B21F783245B5E0D41B63CE615300BC44\SourceList\Media	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B21F783245B5E0D41B63CE615300BC44\SourceList\Media\1 = ";"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B21F783245B5E0D41B63CE615300BC44\Clients = 3a0000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B21F783245B5E0D41B63CE615300BC44\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B21F783245B5E0D41B63CE615300BC44	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B21F783245B5E0D41B63CE615300BC44\Version = "33882146"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B21F783245B5E0D41B63CE615300BC44\Assignment = "1"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B21F783245B5E0D41B63CE615300BC44\InstanceType = "0"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B21F783245B5E0D41B63CE615300BC44\DeploymentFlags = "3"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B21F783245B5E0D41B63CE615300BC44\SourceList\PackageName = "setup_Z-_Mason_Street_Furniture_(Not_Supported_by_Group_IT).msi"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B21F783245B5E0D41B63CE615300BC44\ProductName = "AteraAgent"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\25F46F8180ECF4345A1FA7A8935DE9AE	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B21F783245B5E0D41B63CE615300BC44\SourceList\Net	msiexec.exe

Suspicious behavior: EnumeratesProcesses 36 IoCs

pid	Process
4968	rundll32.exe
4968	rundll32.exe
3240	msiexec.exe
3240	msiexec.exe
1572	AteraAgent.exe
1572	AteraAgent.exe
2752	powershell.exe
2752	powershell.exe
2752	powershell.exe
3524	powershell.exe
3524	powershell.exe
3524	powershell.exe
856	AteraAgent.exe
856	AteraAgent.exe
856	AteraAgent.exe
856	AteraAgent.exe
856	AteraAgent.exe
856	AteraAgent.exe
856	AteraAgent.exe
856	AteraAgent.exe
856	AteraAgent.exe
856	AteraAgent.exe
856	AteraAgent.exe
856	AteraAgent.exe
856	AteraAgent.exe
856	AteraAgent.exe
856	AteraAgent.exe
856	AteraAgent.exe
856	AteraAgent.exe
856	AteraAgent.exe
856	AteraAgent.exe
856	AteraAgent.exe
856	AteraAgent.exe
856	AteraAgent.exe
856	AteraAgent.exe
856	AteraAgent.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	768	msiexec.exe
Token: SeIncreaseQuotaPrivilege	768	msiexec.exe
Token: SeSecurityPrivilege	3240	msiexec.exe
Token: SeCreateTokenPrivilege	768	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	768	msiexec.exe
Token: SeLockMemoryPrivilege	768	msiexec.exe
Token: SeIncreaseQuotaPrivilege	768	msiexec.exe
Token: SeMachineAccountPrivilege	768	msiexec.exe
Token: SeTcbPrivilege	768	msiexec.exe
Token: SeSecurityPrivilege	768	msiexec.exe
Token: SeTakeOwnershipPrivilege	768	msiexec.exe
Token: SeLoadDriverPrivilege	768	msiexec.exe
Token: SeSystemProfilePrivilege	768	msiexec.exe
Token: SeSystemtimePrivilege	768	msiexec.exe
Token: SeProfSingleProcessPrivilege	768	msiexec.exe
Token: SeIncBasePriorityPrivilege	768	msiexec.exe
Token: SeCreatePagefilePrivilege	768	msiexec.exe
Token: SeCreatePermanentPrivilege	768	msiexec.exe
Token: SeBackupPrivilege	768	msiexec.exe
Token: SeRestorePrivilege	768	msiexec.exe
Token: SeShutdownPrivilege	768	msiexec.exe
Token: SeDebugPrivilege	768	msiexec.exe
Token: SeAuditPrivilege	768	msiexec.exe
Token: SeSystemEnvironmentPrivilege	768	msiexec.exe
Token: SeChangeNotifyPrivilege	768	msiexec.exe
Token: SeRemoteShutdownPrivilege	768	msiexec.exe
Token: SeUndockPrivilege	768	msiexec.exe
Token: SeSyncAgentPrivilege	768	msiexec.exe
Token: SeEnableDelegationPrivilege	768	msiexec.exe
Token: SeManageVolumePrivilege	768	msiexec.exe
Token: SeImpersonatePrivilege	768	msiexec.exe
Token: SeCreateGlobalPrivilege	768	msiexec.exe
Token: SeBackupPrivilege	3052	vssvc.exe
Token: SeRestorePrivilege	3052	vssvc.exe
Token: SeAuditPrivilege	3052	vssvc.exe
Token: SeBackupPrivilege	3240	msiexec.exe
Token: SeRestorePrivilege	3240	msiexec.exe
Token: SeRestorePrivilege	3240	msiexec.exe
Token: SeTakeOwnershipPrivilege	3240	msiexec.exe
Token: SeRestorePrivilege	3240	msiexec.exe
Token: SeTakeOwnershipPrivilege	3240	msiexec.exe
Token: SeDebugPrivilege	4660	rundll32.exe
Token: SeRestorePrivilege	3240	msiexec.exe
Token: SeTakeOwnershipPrivilege	3240	msiexec.exe
Token: SeDebugPrivilege	4968	rundll32.exe
Token: SeRestorePrivilege	3240	msiexec.exe
Token: SeTakeOwnershipPrivilege	3240	msiexec.exe
Token: SeDebugPrivilege	2580	rundll32.exe
Token: SeRestorePrivilege	3240	msiexec.exe
Token: SeTakeOwnershipPrivilege	3240	msiexec.exe
Token: SeRestorePrivilege	3240	msiexec.exe
Token: SeTakeOwnershipPrivilege	3240	msiexec.exe
Token: SeDebugPrivilege	4708	rundll32.exe
Token: SeRestorePrivilege	3240	msiexec.exe
Token: SeTakeOwnershipPrivilege	3240	msiexec.exe
Token: SeDebugPrivilege	1572	AteraAgent.exe
Token: SeRestorePrivilege	3240	msiexec.exe
Token: SeTakeOwnershipPrivilege	3240	msiexec.exe
Token: SeDebugPrivilege	2752	powershell.exe
Token: SeBackupPrivilege	4972	srtasks.exe
Token: SeRestorePrivilege	4972	srtasks.exe
Token: SeSecurityPrivilege	4972	srtasks.exe
Token: SeTakeOwnershipPrivilege	4972	srtasks.exe
Token: SeBackupPrivilege	4972	srtasks.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
768	msiexec.exe
768	msiexec.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
768	msiexec.exe
3240	msiexec.exe
4476	MsiExec.exe
2244	MsiExec.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 3240 wrote to memory of 4972	3240	msiexec.exe	94
PID 3240 wrote to memory of 4476	3240	msiexec.exe	96
PID 4476 wrote to memory of 4660	4476	MsiExec.exe	97
PID 4476 wrote to memory of 4968	4476	MsiExec.exe	98
PID 4476 wrote to memory of 2580	4476	MsiExec.exe	99
PID 4476 wrote to memory of 4708	4476	MsiExec.exe	100
PID 3240 wrote to memory of 2244	3240	msiexec.exe	101
PID 2244 wrote to memory of 1572	2244	MsiExec.exe	102
PID 2244 wrote to memory of 2752	2244	MsiExec.exe	105
PID 2244 wrote to memory of 3524	2244	MsiExec.exe	107
PID 856 wrote to memory of 4116	856	AteraAgent.exe	111
PID 4116 wrote to memory of 4300	4116	cmd.exe	113
PID 4476 wrote to memory of 4492	4476	MsiExec.exe	114

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\setup_Z-_Mason_Street_Furniture_(Not_Supported_by_Group_IT).msi
1⤵
- Badlisted process makes network request
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:768

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3240
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4972
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding 5AFA0853ABE773C77234078FDD442F0A
  2⤵
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4476
- - C:\Windows\system32\rundll32.exe
    rundll32.exe "C:\Windows\Installer\MSI3176.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240726796 2 Atera.Agent.Installer.Msi.Ca!Atera.Agent.Installer.Msi.Ca.CustomActions.GenerateAgentId
    3⤵
    - Loads dropped DLL
    - Drops file in Windows directory
    - Suspicious use of AdjustPrivilegeToken
    PID:4660
- - C:\Windows\system32\rundll32.exe
    rundll32.exe "C:\Windows\Installer\MSI380F.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240728109 6 Atera.Agent.Installer.Msi.Ca!Atera.Agent.Installer.Msi.Ca.CustomActions.ShouldContinueInstallation
    3⤵
    - Badlisted process makes network request
    - Loads dropped DLL
    - Drops file in Windows directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4968
- - C:\Windows\system32\rundll32.exe
    rundll32.exe "C:\Windows\Installer\MSI3C17.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240729187 10 Atera.Agent.Installer.Msi.Ca!Atera.Agent.Installer.Msi.Ca.CustomActions.ReportMsiInstallStart
    3⤵
    - Badlisted process makes network request
    - Loads dropped DLL
    - Drops file in Windows directory
    - Suspicious use of AdjustPrivilegeToken
    PID:2580
- - C:\Windows\system32\rundll32.exe
    rundll32.exe "C:\Windows\Installer\MSI404F.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240730234 15 Atera.Agent.Installer.Msi.Ca!Atera.Agent.Installer.Msi.Ca.CustomActions.DetectDotNetFrameworkRuntime
    3⤵
    - Loads dropped DLL
    - Drops file in Windows directory
    - System Time Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4708
- - C:\Windows\system32\rundll32.exe
    rundll32.exe "C:\Windows\Installer\MSI88D6.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240748921 31 Atera.Agent.Installer.Msi.Ca!Atera.Agent.Installer.Msi.Ca.CustomActions.ReportMsiInstallEnd
    3⤵
    - Badlisted process makes network request
    - Loads dropped DLL
    - Drops file in Windows directory
    PID:4492
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding 676EF89D1E7FFD4EABE62A7EE14B80B3 E Global\MSI0000
  2⤵
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2244
- - C:\Program Files\ATERA Networks\AteraAgent\Agent\AteraAgent.exe
    "C:\Program Files\ATERA Networks\AteraAgent\Agent\AteraAgent.exe" init-settings --agent-id "8cd16d9f-b4e7-4042-9570-700a71604912" --account-id "i3Ni+EOALl4FvwJcQroVhbrtT8HcJh6nP8Bf2147VP4=" --account-agent-installation-id "caf5a032c867462fbf577bc454480d04" --environment "Production" --customer-id "289" --folder-id ""
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1572
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" -ExecutionPolicy Bypass -NoProfile -Command "[Net.ServicePointManager]::SecurityProtocol=[Net.SecurityProtocolType]::Tls12;Invoke-WebRequest -Uri 'https://dot.net/v1/dotnet-install.ps1' -OutFile \"C:\Program Files\ATERA Networks\AteraAgent\Agent\dotnet-install.ps1\""
    3⤵
    - Badlisted process makes network request
    - Command and Scripting Interpreter: PowerShell
    - Drops file in Windows directory
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2752
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" -ExecutionPolicy unrestricted -NoProfile -File "C:\Program Files\ATERA Networks\AteraAgent\Agent\dotnet-install.ps1" -Channel 8.0 -Runtime dotnet -InstallDir "C:\Program Files\ATERA Networks\AteraAgent\Agent\\.dotnet"
    3⤵
    - Badlisted process makes network request
    - Command and Scripting Interpreter: PowerShell
    - Drops file in Program Files directory
    - Drops file in Windows directory
    - System Time Discovery
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    PID:3524

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:3052

C:\Program Files\ATERA Networks\AteraAgent\Agent\AteraAgent.exe
"C:\Program Files\ATERA Networks\AteraAgent\Agent\AteraAgent.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:856
- C:\Windows\system32\cmd.exe
  "cmd.exe" /c "C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\dotnet.exe" --list-runtimes
  2⤵
  - Executes a command shell one-liner
  - System Time Discovery
  - Suspicious use of WriteProcessMemory
  PID:4116
- - C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\dotnet.exe
    "C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\dotnet.exe" --list-runtimes
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Time Discovery
    PID:4300

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Event Triggered Execution

T1546

Installer Packages

T1546.016

Privilege Escalation

Event Triggered Execution

T1546

Installer Packages

T1546.016

Defense Evasion

System Binary Proxy Execution

T1218

Msiexec

T1218.007

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e592c37.rbs

Path C:\Config.Msi\e592c37.rbs
Size 7KB
SHA256 3b83fa6a166a2d99937858970056b1a6b3d65428bae4dc43502997c1e92daa24
MD5 033bc838df642e20e75851e8c0f82a75
SHA1 bf98962cc4f3f9628945b6e70e664e17d511408f
SHA512 1335d714a2a9c7258f5a85d92aceead44a4bb5292275b5afe1e2731c8e149063d30119627f3576c28a39c4b6d2ef1c1ee2d938d71d93ddf66ed96af5a2551c83
SSDEEP 96:EmLaUu4zD1UsmC3lUtUIp9MxFCsTlLUIp9MxFC6jNu1n+TlFCV5c9Wf2jgCCiplC:BeYzZwCmGmKx4IamKx4k7EAMBipLOX
TLSH
T156F1FF05720345D2F99E6738CB072B5A3BB2D3D68386535B1E9E84706F573881FA829F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\dotnet.exe
Size 153KB
SHA256 111da7b604cd196b49167cfeecdaef4034b58cc7de71a91cbf9e162c9e8b0931
MD5 26aca7f84913f46171b1bbad3f30f110
SHA1 1a61b447c6ebdf49455dcaf6ff62e3212f028ad2
SHA512 1698fa7300a6f67146c737210b6023f2f7166fd4ada58243a9011e67762a9f71eecac11cc1b2f5a4864f5204b1bba22962f37a08dae3d6103755b0382c7e3db2
SSDEEP 1536:/yPL142WnQwPtrd4zAl8ZVVZh6e0dYt4aXMFG0vcCVhsRz7:/yP22WplaO8n0Wt4aXMSCVQH
TLSH
T1C8F3071AD65811AAD1AE9575CB518A41BB337C6587E0E3CB17C0FCBE0F326909EE9703
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hostfxr.dll

Path C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\host\fxr\8.0.31\hostfxr.dll
Size 357KB
SHA256 4f5a0500cd2a2439b0d5edbf242950233aec4539ec9a5e7ba9b8a9b0079f63af
MD5 b12f168ba86e7135e07168cfbec01aba
SHA1 d2d51f767d7e8306e890dd6a97ade93fb117d8a5
SHA512 b2d612c1383c2754fe54a1b433ebdd77cb1a48d3143a7c1406300d6a4a26a52baa0310a10648baeed687201a583132fe9c2326dd1a46ed74c7d69e46a6290f17
SSDEEP 6144:GE7Hjww5R1Gv0crJHeUtJ9NZFSKJ2nje/SnFNonJLSHDWHPDh+vJpmE0f0xcTZ6M:VMjrJnJaKGkriJ4E16tXZPp
TLSH
T1F5741916D6E8017CF0B7D679CAB28901EB727C494BB196CF139099661E73BD09E39323
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

.settings.json

Path C:\Program Files\ATERA Networks\AteraAgent\Agent\.settings.json
Size 245B
SHA256 bc3a29879d8cea5df2f12ad5d279f7981073c586d298392fe532236b23559640
MD5 97809f63c2c9eef5f1df46d8b5d43e2c
SHA1 038cb04fd7c8850dcdec005a784ff79ff6f71329
SHA512 9864454d67f2a526139a4c59d0273b1f23135e4a1cd0752508fc4443a2c68b32748af5adf1df5e029023068953aea7760780d289d498c8efea34fbfc7689374b
TLSH
T1D9D097E047308B542E042C05930BA35CB032F801FEC60C647ACB14220D7498042B6007
MD5 SHA1 SHA512 TLSH

Submit Download

AteraAgent.exe

Path C:\Program Files\ATERA Networks\AteraAgent\Agent\AteraAgent.exe
Size 21.7MB
SHA256 40be79204b749b4fffa22339c056b43ef3624ddc213183a2579ce88dc8e148bf
MD5 44159769f2118debe61c3f8c33bdcceb
SHA1 657ade2228358458a1e9dcd793bc3018656151bc
SHA512 911101d27d3a1beca0403362fe17d55a4ce39d399d04d38894a7127a63ee1fc0ea1581c138043c9cba5605bc446bc0fa25648de82ad75a23eecdb2f6a7f2cfdc
SSDEEP 196608:TGuM9a0wrs541GnixeN+AO6qtDpER5BafJvJ/tkwyPLniYx0k/:TjlXInUPp2wyPL7
TLSH
T154379C11A3EC426AE5BF8338D4724516DBF278466721E7CF2548A5E92E33BC09E35363
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

agent.cert.pfx

Path C:\Program Files\ATERA Networks\AteraAgent\Agent\certificates\production\agent.cert.pfx
Size 2KB
SHA256 d8414da3e076bcfaa2dd39620c722f8425a2f5bd09bd4ac771f5effe2ea37b10
MD5 06590d010fbc188c82d0d387e2f56d2e
SHA1 253512cf7ca4dbe795e2b6458de7815c37c6d499
SHA512 2ea586432ec729f0ed98f428dc5d2ddacfe5d0934318013cb6c21bc1b86fce4e96d75ca53c7834ebc563725056ccf0203dd9ca62d5a3d179b2849d202642301e
TLSH
T1FA513D4273BBE1103557894E6EB98A02EEF2BF186B5F900F753A585C3842B20350D611
MD5 SHA1 SHA512 TLSH

Submit Download

dotnet-install.ps1

Path C:\Program Files\ATERA Networks\AteraAgent\Agent\dotnet-install.ps1
Size 74KB
SHA256 e8b873e18a81e5c4cd8ab69d84dac8fead291d50b3c44633cd7fddad709a13d6
MD5 ce1e8af1ee38c40f594dd19f9cb988f5
SHA1 bc16517853592107970aae2d7c7d1546b1c6e960
SHA512 cf32ef77dcb0ba6b60da3ea3997746979844ebdc1db5470762c969bec2b3f5478bb348badbe2373e4eee7aea66e9c4db4f8b20919a6bf1b5e60345e5020f9ebe
SSDEEP 768:GQy0YIw0FI6Szz3G4yYijvbpyspGD2huFI1Fb2JPJFId4zT2C0U8qzqog7+XMhDF:GSY7PwYU1JPg8qzjUcn4f4Xsjh2Syy
TLSH
T152731A9EAD429032547363B8C96B1084FB374277524541A8F8DDD4887FB262D93A2FEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 b67191a152d4566d0194395342f55c6142d94005610603fdc92ac4d491519f82
MD5 836da308c17b18155d513895baff5404
SHA1 548067c779da32edfafb48a6f14e086ed6dac113
SHA512 178cf31b7fc6015878508f9727fbc9feeb029d245b759b27d74ce893732322acf0ecc0c3570ec7c87e62b9e6d58b374a4b529e3e47c42762cd1b8cfe74d73b6a
TLSH
T1AA115733B3CC8724DC9A403650CEAC1136B687DB409EDE6BBB84D549B82F299DE61160
MD5 SHA1 SHA512 TLSH

Submit Download

MSI3176.tmp

Path C:\Windows\Installer\MSI3176.tmp
Size 347KB
SHA256 ba404962848d74940adc5b600ac84ce99eacfc951fe6271031da896d306ad667
MD5 26778893e7d19e9b76a1c39c87a81a1d
SHA1 f01bf5674082b0921bd277c36f08cf43ae81f871
SHA512 6a9961fbc1e20ee61859a421c8898031375c0ebd9dceea6cfafe60e2d9aa6fca87db86dea0d4915b18d9242f4485c723ab0a6218405a20459fccb76acb0e2faa
SSDEEP 3072:ap1TSTx9ug1jpOwO1WVWpJi+96rrPwSaOFZrk6BjGiR/8ENKn74olxX8RvcOWJrc:apUNpIx1IWpJHOrwIBaiRTivX8R7IOWy
TLSH
T1F374BF55B7F809B9FC7B563988630906D273BC515B71DB9F0360420A9F3B790E93AB22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSI4283.tmp

Path C:\Windows\Installer\MSI4283.tmp
Size 390KB
SHA256 7aacd4c18710e9bc4ff2034895a0a0c8f80f21809fb177d520e93f7688216e6d
MD5 e8dc682f2c486075c6aba658971a62cc
SHA1 7cd0a2b5047a4074aa06a6caa3bb69124851e95d
SHA512 a0a1f0f418bf2d4ffd079b840aeb0142c7faab7fa72b5e33b1841798569f55a25dfd305abf9c2ca89792f6499f695b69975882697dc53e99d5a975a9fa8c7d75
SSDEEP 6144:p2ET2+QBLh+MVy5DCRoRRvc181kaKN8MMLuG:p2ET2+cVXVyNhvcCkaKN8Me
TLSH
T10D846B29F7E408EDE4B78276C5A68530FF75748D3320D5AE47A8852D1F3AAA070BB701
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Atera.Agent.Installer.Msi.Ca.dll

Path C:\Windows\Installer\SFXCA9E8D6A12F84BA41A747B6A8303FC597E\Atera.Agent.Installer.Msi.Ca.dll
Size 74KB
SHA256 46e6ea528969185cb3e663d48d00899f558a09078a9bc2a98b8a9dcf8c04fb79
MD5 04232dbe113e8c01ba28bea800eb677e
SHA1 270774fcbc633212d62be3406c7e7b26172f014e
SHA512 661461bd517eece02637cbc42571f961c362be50591625249752e75e5ece1b02373c937c663377268c89f83efcaf511094eb727921b7e225c18b2ef09504ac28
SSDEEP 1536:yV+re0WBSsp7G19QxAiMS6bFOKf9WD2oRMlr:yVIyBSsp7CM6b8KFWD2Fr
TLSH
T1EE73E44137F84619F2FF5F78BD70901589B3BC666D31DA8D2AA0244E0A76BC0DA60B77
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CustomAction.config

Path C:\Windows\Installer\SFXCAD74D4D93414C5158B0ED4D3F58EB32CC\CustomAction.config
Size 956B
SHA256 2dbc73a3bc444a9119c9b5e20276698384d9ad9535a8a7547c44d1b9a8d67346
MD5 a9088b24614c12b70af6ae9669a4a4b1
SHA1 d72efa4e0c7bd733ed3d51831ead7031175c27e0
SHA512 14090969a71b6c80023da29dc8582aded6d26ca349966767ce22102080abce118b846a47ea2b9abe2d5f6a788bc083031d27fdee4103e2e4b99d29c2ac494d7c
TLSH
T10811D00D4A946B7724312793BFACA1C4E76194BA3994411CB49BB9151F39938176338F
MD5 SHA1 SHA512 TLSH

Submit Download

WixToolset.Dtf.WindowsInstaller.dll

Path C:\Windows\Installer\SFXCAD74D4D93414C5158B0ED4D3F58EB32CC\WixToolset.Dtf.WindowsInstaller.dll
Size 193KB
SHA256 a614884ea627da1925131ebf41e8ae202caeac0fe543b86384f5eb2bfaf1aa75
MD5 ef8d5785ac8669f5fd54e22f52770e6b
SHA1 4c94ae7ef233be33a56c0a5d9b8e2211d5d5792c
SHA512 ab3b140bd6531f22e994606820e6511442c23d9015b1e1a38aaed43aa42ba29a996511151d0b3a383c05c2b11f670e52cdd7f507ad1a1ad8cebea57fb22ade5a
SSDEEP 3072:8Of7tVL+l4lj19l4uDHYHj69UgoTqdda7CnfKlRUjW01KytaljYqCDPC:8gQQx54Hj6jomdrzalMqb
TLSH
T14A149C2A57F84B3ECEFF8778E2614252C7B1F1E67103DB1D9D8281A52163784B682397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e592c36.msi

Path C:\Windows\Installer\e592c36.msi
Size 8.4MB
SHA256 1571100ac7ed5c27e470225995828dd39e9760a6a03683ebf669658d15e0d18b
MD5 a6957328fd0cc86898f66a771ddd751e
SHA1 aed2ace1ceed45192f6df48484c19362e3686cd8
SHA512 b8f8a0bca0a4ac27583e06c00fc8f87893cb8465cd5d026f12cba071bab5380aeacd376371030899d758e51294e17bf328a8cd820083fd6d0c949e352b8b37a7
SSDEEP 196608:xWRnEqtLMMQNysvwZJtRrWsIMC7nW1A490CAvIjv:WEFNysWVWsbC7W1Ai0z
TLSH
T1BF963325F7F409AAE8638276C5638125EF7ABC496321D6AF0364B41D1F3B760A0BF714
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Tmp8E0D.tmp

Path C:\Windows\SystemTemp\Tmp8E0D.tmp
Size 3KB
SHA256 94739ca46676bd602a78671257fbfce39feaabc9664c6326bf4970a0108e3429
MD5 560af444a6a7faa0b0ca94dc16ca2a58
SHA1 df31453fafde354870a0a9a8ca50b18e284c32e4
SHA512 7c853176c088d56a517e52c6687b6debf08f6f9726376720ade9d13fafc9be0ca72f0f2b35562a61ece653aeb789c838c60447f463b2bbe70c21bfc8c039b681
TLSH
T1B3616C88B10E28972CEECC504D495B40AEC3D754B390F25F68F4BCA64CA13E9A358C3C
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_w1ocn253.1uv.ps1

Path C:\Windows\SystemTemp\__PSScriptPolicyTest_w1ocn253.1uv.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

metadata-2

Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
Size 26.1MB
SHA256 bda232edba2d6995f344c2952cd93e689525f2289c0a6dc8a70a24ac7d996bac
MD5 f1ee6a28a3b740029e6922a3ebfa227c
SHA1 55e7fae6ec35fd1f5cd01eb72c1107bfffaf9026
SHA512 9cbe8fca8a93143f8285a6b5fcdcf51075929cf9b662536958cd2ae9d5e2f94c08597aa5045042b8d84f5dad69fd9c4a63d520d1205f774178cf638c11d44ef1
SSDEEP 24576:dFo3DMPWdoO/vvTL/SgDTiFQ/Lu5oLUAEulh9ut7lGN6J0yzMYR2TKpCX+z:uHo
TLSH
T12257B32936F92201E7F79E3CACF06A23493A7D5B9C15DE8D45411B4E0822F71E872F66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{3f6a4fe3-e7fe-4f61-ad03-15fd7f589efa}_OnDiskSnapshotProp

Path \??\Volume{e42a0d43-0000-0000-0000-d08302000000}\System Volume Information\SPP\OnlineMetadataCache\{3f6a4fe3-e7fe-4f61-ad03-15fd7f589efa}_OnDiskSnapshotProp
Size 6KB
SHA256 9f82e1748372448e8c7cea0d8a2aefc4dacec37baaf87b7198d86c31de8462e7
MD5 dfe2f563be9a8630947e967c1246e4d6
SHA1 ba326b264e3f56ef6474f9abc6c4189cc9ede54a
SHA512 7910a613e7ae1190c4025db819da7204ad2a2eea06307bd32d35330244f585656025498e73c9971bbfaec42b5cdf0b27e46c2b9846aa8265ea202ca0328e4a23
SSDEEP 96:FnP3Zivc6DD84LTHzbOHXOHBlBRQn8Sc9XE56tOSVQpu:9P4b++uVm
TLSH
T18DD1980C5AF54711E2B3AB3229F14557A477B911EF33CB8E0198238E2670A10F975F6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2752-105-0x000001AE37F60000-0x000001AE37F82000-memory.dmp

Download

memory/3240-100-0x000002262AF90000-0x000002262B934000-memory.dmp

Download

memory/3524-123-0x00000180F3B20000-0x00000180F3B4A000-memory.dmp

Download

memory/3524-122-0x00000180F36A0000-0x00000180F36AA000-memory.dmp

Download

memory/3524-124-0x00000180F3B20000-0x00000180F3B44000-memory.dmp

Download

memory/3524-126-0x00000180F36F0000-0x00000180F36FA000-memory.dmp

Download

memory/3524-127-0x00000180F3C40000-0x00000180F3C52000-memory.dmp

Download

memory/3524-121-0x00000180F3910000-0x00000180F39C2000-memory.dmp

Download

memory/3524-120-0x00000180F36C0000-0x00000180F36DE000-memory.dmp

Download

memory/4660-22-0x000002170C810000-0x000002170C828000-memory.dmp

Download

memory/4660-18-0x000002170BA80000-0x000002170BAB4000-memory.dmp

Download

memory/4968-43-0x000001AEF0B40000-0x000001AEF0B7C000-memory.dmp

Download

memory/4968-42-0x000001AEF0AE0000-0x000001AEF0AF2000-memory.dmp

Download