1571100ac7ed5c27e470225995828dd39e9760a6a03683ebf669658d15e0d18b

Analysis

max time kernel
148s
max time network
145s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260911-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260911-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
24/09/2026, 14:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
setup_Z-_Mason_Street_Furniture_(Not_Supported_by_Group_IT).msi
Size 8.4MB
Sample260924-r4v8aafe28
SHA256 1571100ac7ed5c27e470225995828dd39e9760a6a03683ebf669658d15e0d18b
MD5 a6957328fd0cc86898f66a771ddd751e
SHA1 aed2ace1ceed45192f6df48484c19362e3686cd8
SHA512 b8f8a0bca0a4ac27583e06c00fc8f87893cb8465cd5d026f12cba071bab5380aeacd376371030899d758e51294e17bf328a8cd820083fd6d0c949e352b8b37a7
SSDEEP 196608:xWRnEqtLMMQNysvwZJtRrWsIMC7nW1A490CAvIjv:WEFNysWVWsbC7W1Ai0z
TLSH
T1BF963325F7F409AAE8638276C5638125EF7ABC496321D6AF0364B41D1F3B760A0BF714
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery execution persistence privilege_escalation ransomware

Malware Config

Signatures

Badlisted process makes network request 12 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
6	5084	msiexec.exe
25	4420	rundll32.exe
26	4928	rundll32.exe
28	2944	powershell.exe
30	2944	powershell.exe
36	5748	powershell.exe
42	5748	powershell.exe
43	5748	powershell.exe
44	5748	powershell.exe
46	5748	powershell.exe
47	5748	powershell.exe
50	4900	rundll32.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
2944	powershell.exe
5748	powershell.exe

Executes dropped EXE 3 IoCs

pid	Process
5464	AteraAgent.exe
4456	AteraAgent.exe
5696	dotnet.exe

Loads dropped DLL 24 IoCs

pid	Process
2640	MsiExec.exe
3720	rundll32.exe
3720	rundll32.exe
3720	rundll32.exe
2640	MsiExec.exe
4420	rundll32.exe
4420	rundll32.exe
4420	rundll32.exe
2640	MsiExec.exe
4928	rundll32.exe
4928	rundll32.exe
4928	rundll32.exe
2640	MsiExec.exe
6136	rundll32.exe
6136	rundll32.exe
6136	rundll32.exe
5692	MsiExec.exe
5692	MsiExec.exe
5692	MsiExec.exe
5696	dotnet.exe
2640	MsiExec.exe
4900	rundll32.exe
4900	rundll32.exe
4900	rundll32.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe

Drops file in System32 directory 6 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\D1BEC81CCAFDC823A062FF26A89A6B6D_D40E4E79DF388B984709B048EEAFD4E4	AteraAgent.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\BAD725C80F9E10846F35D039A996E4A8_88B6AE015495C1ECC395D19C1DD02894	AteraAgent.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\BAD725C80F9E10846F35D039A996E4A8_88B6AE015495C1ECC395D19C1DD02894	AteraAgent.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\75CA58072B9926F763A91F0CC2798706_3AD253ACA02D44EA5FD30683B8A5B5FA	AteraAgent.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\75CA58072B9926F763A91F0CC2798706_3AD253ACA02D44EA5FD30683B8A5B5FA	AteraAgent.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\D1BEC81CCAFDC823A062FF26A89A6B6D_D40E4E79DF388B984709B048EEAFD4E4	AteraAgent.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\8.0.31\System.Data.DataSetExtensions.dll	powershell.exe
File opened for modification	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\8.0.31\System.Diagnostics.DiagnosticSource.dll	powershell.exe
File created	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\8.0.31\System.IO.FileSystem.Watcher.dll	powershell.exe
File created	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\8.0.31\System.Net.Primitives.dll	powershell.exe
File opened for modification	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\8.0.31\System.Security.Cryptography.Algorithms.dll	powershell.exe
File created	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\8.0.31\System.Threading.Overlapped.dll	powershell.exe
File created	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\8.0.31\System.IO.FileSystem.AccessControl.dll	powershell.exe
File created	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\8.0.31\System.Runtime.Numerics.dll	powershell.exe
File opened for modification	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\8.0.31\System.Runtime.Serialization.Json.dll	powershell.exe
File opened for modification	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\8.0.31\System.Security.Claims.dll	powershell.exe
File created	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\8.0.31\System.Xml.Linq.dll	powershell.exe
File opened for modification	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\8.0.31\System.Xml.XDocument.dll	powershell.exe
File opened for modification	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\8.0.31\System.Xml.XPath.XDocument.dll	powershell.exe
File created	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\8.0.31\System.AppContext.dll	powershell.exe
File opened for modification	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\8.0.31\System.Configuration.dll	powershell.exe
File opened for modification	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\8.0.31\System.Console.dll	powershell.exe
File opened for modification	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\8.0.31\System.IO.dll	powershell.exe
File opened for modification	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\8.0.31\System.IO.Pipes.dll	powershell.exe
File opened for modification	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\8.0.31\System.Security.AccessControl.dll	powershell.exe
File created	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\8.0.31\System.IO.dll	powershell.exe
File created	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\8.0.31\System.Net.HttpListener.dll	powershell.exe
File created	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\8.0.31\System.Net.NameResolution.dll	powershell.exe
File created	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\8.0.31\System.Net.NetworkInformation.dll	powershell.exe
File opened for modification	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\8.0.31\System.Text.Encodings.Web.dll	powershell.exe
File opened for modification	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\8.0.31\System.ComponentModel.DataAnnotations.dll	powershell.exe
File created	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\8.0.31\System.Net.WebSockets.dll	powershell.exe
File opened for modification	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\8.0.31\System.Xml.Linq.dll	powershell.exe
File opened for modification	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\8.0.31\clrjit.dll	powershell.exe
File created	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\8.0.31\hostpolicy.dll	powershell.exe
File opened for modification	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\8.0.31\Microsoft.VisualBasic.dll	powershell.exe
File created	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\8.0.31\System.Diagnostics.StackTrace.dll	powershell.exe
File opened for modification	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\8.0.31\System.Net.WebSockets.dll	powershell.exe
File created	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\8.0.31\System.Runtime.Serialization.Json.dll	powershell.exe
File opened for modification	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\8.0.31\System.Security.Cryptography.dll	powershell.exe
File created	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\8.0.31\mscordaccore_amd64_amd64_8.0.3126.42015.dll	powershell.exe
File created	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\ThirdPartyNotices.txt	powershell.exe
File opened for modification	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\8.0.31\.version	powershell.exe
File created	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\8.0.31\Microsoft.NETCore.App.runtimeconfig.json	powershell.exe
File opened for modification	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\8.0.31\System.Memory.dll	powershell.exe
File opened for modification	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\8.0.31\System.Net.WebProxy.dll	powershell.exe
File created	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\8.0.31\System.Numerics.dll	powershell.exe
File created	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\8.0.31\System.Runtime.Serialization.Primitives.dll	powershell.exe
File created	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\8.0.31\Microsoft.NETCore.App.deps.json	powershell.exe
File created	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\8.0.31\System.Diagnostics.FileVersionInfo.dll	powershell.exe
File created	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\8.0.31\System.Net.Quic.dll	powershell.exe
File opened for modification	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\8.0.31\System.Threading.Overlapped.dll	powershell.exe
File opened for modification	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\8.0.31\System.Threading.ThreadPool.dll	powershell.exe
File opened for modification	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\8.0.31\System.Transactions.dll	powershell.exe
File created	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\8.0.31\System.Windows.dll	powershell.exe
File created	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\8.0.31\System.Xml.XDocument.dll	powershell.exe
File opened for modification	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\8.0.31\System.Diagnostics.Debug.dll	powershell.exe
File created	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\8.0.31\System.IO.Compression.FileSystem.dll	powershell.exe
File opened for modification	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\8.0.31\System.ObjectModel.dll	powershell.exe
File created	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\8.0.31\System.Private.Xml.dll	powershell.exe
File opened for modification	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\8.0.31\System.Drawing.Primitives.dll	powershell.exe
File opened for modification	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\8.0.31\System.Net.Ping.dll	powershell.exe
File created	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\8.0.31\System.Reflection.Extensions.dll	powershell.exe
File created	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\8.0.31\System.Security.Cryptography.Csp.dll	powershell.exe
File opened for modification	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\8.0.31\System.Text.Json.dll	powershell.exe
File created	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\8.0.31\System.Web.dll	powershell.exe
File created	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\8.0.31\System.Console.dll	powershell.exe
File opened for modification	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\8.0.31\System.dll	powershell.exe
File created	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\8.0.31\System.IO.FileSystem.Primitives.dll	powershell.exe
File opened for modification	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\8.0.31\System.Resources.Writer.dll	powershell.exe

Drops file in Windows directory 31 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\MSIF633.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\SFXCA3C1F471651446DB9CE7E91F74CED173C\WixToolset.Dtf.WindowsInstaller.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\SFXCA3C1F471651446DB9CE7E91F74CED173C\CustomAction.config	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI88.tmp	msiexec.exe
File created	C:\Windows\Installer\e58f373.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\SFXCA877C420ADE4C56DAD3A7B8F5AD7214D4\CustomAction.config	rundll32.exe
File opened for modification	C:\Windows\Installer\SFXCA9A8300A161409C085AAD816DDEE2BEDD\WixToolset.Dtf.WindowsInstaller.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\SFXCA9A8300A161409C085AAD816DDEE2BEDD\CustomAction.config	rundll32.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\SFXCA5E0C0635B348F6A82FDBC5DD4759756F\WixToolset.Dtf.WindowsInstaller.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\SFXCA877C420ADE4C56DAD3A7B8F5AD7214D4\Atera.Agent.Installer.Msi.Ca.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\SFXCA9A8300A161409C085AAD816DDEE2BEDD\Atera.Agent.Installer.Msi.Ca.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSIFDE6.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\SFXCA67520FE028459A5825BC28E973146427\CustomAction.config	rundll32.exe
File opened for modification	C:\Windows\Installer\SFXCA877C420ADE4C56DAD3A7B8F5AD7214D4\WixToolset.Dtf.WindowsInstaller.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\SFXCA3C1F471651446DB9CE7E91F74CED173C\Atera.Agent.Installer.Msi.Ca.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\Installer\SFXCA5E0C0635B348F6A82FDBC5DD4759756F\Atera.Agent.Installer.Msi.Ca.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSIFAD8.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIFE83.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\SFXCA5E0C0635B348F6A82FDBC5DD4759756F\CustomAction.config	rundll32.exe
File created	C:\Windows\Installer\SourceHash{2387F12B-5B54-4D0E-B136-EC163500CB44}	msiexec.exe
File opened for modification	C:\Windows\Installer\SFXCA67520FE028459A5825BC28E973146427\WixToolset.Dtf.WindowsInstaller.dll	rundll32.exe
File created	C:\Windows\Installer\e58f375.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI1AC9.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI469C.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\SFXCA67520FE028459A5825BC28E973146427\Atera.Agent.Installer.Msi.Ca.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI12F8.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\e58f373.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIF44E.tmp	msiexec.exe

Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs

persistence privilege_escalation

Installer Packages

T1546.016

Msiexec

T1218.007

pid	Process
5084	msiexec.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1228	cmd.exe

System Time Discovery 1 TTPs 4 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
6136	rundll32.exe
5748	powershell.exe
1228	cmd.exe
5696	dotnet.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000689725983211bb530000000000000000000000000000000000000000000000000000000000000000000000000000000000001071020000000000c01200000000ffffffff000000002701010000883801689725980000000000001071020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d083020000000000c050dc000000ffffffff000000000700010000e8410168972598000000000000d08302000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000090d4de0000000000000005000000ffffffff000000000700010000486a6f6897259800000000000090d4de000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000090d4e30000000000000005000000ffffffff00000000070001000048ea716897259800000000000090d4e300000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28\52C64B7E	AteraAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28\52C64B7E\@%SystemRoot%\system32\NgcRecovery.dll,-100 = "Windows Hello Recovery Key Encryption"	AteraAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28\52C64B7E\@%SystemRoot%\System32\ci.dll,-100 = "Isolated User Mode (IUM)"	AteraAgent.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28\52C64B7E\@%SystemRoot%\system32\dnsapi.dll,-103 = "Domain Name System (DNS) Server Trust"	AteraAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28\52C64B7E\@%SystemRoot%\System32\ci.dll,-101 = "Enclave"	AteraAgent.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28\52C64B7E\@%SystemRoot%\System32\wuaueng.dll,-400 = "Windows Update"	AteraAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPublisher\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPublisher	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	AteraAgent.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28\52C64B7E\@%SystemRoot%\System32\fveui.dll,-844 = "BitLocker Data Recovery Agent"	AteraAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	powershell.exe

Modifies registry class 22 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B21F783245B5E0D41B63CE615300BC44\PackageCode = "DE29C0996E833174C8DF8536CC633D4E"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B21F783245B5E0D41B63CE615300BC44\Version = "33882146"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B21F783245B5E0D41B63CE615300BC44\DeploymentFlags = "3"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B21F783245B5E0D41B63CE615300BC44\SourceList	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B21F783245B5E0D41B63CE615300BC44\SourceList\Media	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\B21F783245B5E0D41B63CE615300BC44\AteraAgentFeature	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B21F783245B5E0D41B63CE615300BC44	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B21F783245B5E0D41B63CE615300BC44\ProductName = "AteraAgent"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B21F783245B5E0D41B63CE615300BC44\Language = "1033"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B21F783245B5E0D41B63CE615300BC44\AdvertiseFlags = "388"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\25F46F8180ECF4345A1FA7A8935DE9AE	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B21F783245B5E0D41B63CE615300BC44\SourceList\Net	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\B21F783245B5E0D41B63CE615300BC44	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B21F783245B5E0D41B63CE615300BC44\InstanceType = "0"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B21F783245B5E0D41B63CE615300BC44\AuthorizedLUAApp = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\25F46F8180ECF4345A1FA7A8935DE9AE\B21F783245B5E0D41B63CE615300BC44	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B21F783245B5E0D41B63CE615300BC44\SourceList\PackageName = "setup_Z-_Mason_Street_Furniture_(Not_Supported_by_Group_IT).msi"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B21F783245B5E0D41B63CE615300BC44\Assignment = "1"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B21F783245B5E0D41B63CE615300BC44\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B21F783245B5E0D41B63CE615300BC44\SourceList\Media\1 = ";"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B21F783245B5E0D41B63CE615300BC44\Clients = 3a0000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B21F783245B5E0D41B63CE615300BC44\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe

Suspicious behavior: EnumeratesProcesses 36 IoCs

pid	Process
4420	rundll32.exe
4420	rundll32.exe
4600	msiexec.exe
4600	msiexec.exe
5464	AteraAgent.exe
5464	AteraAgent.exe
2944	powershell.exe
2944	powershell.exe
2944	powershell.exe
5748	powershell.exe
5748	powershell.exe
5748	powershell.exe
4456	AteraAgent.exe
4456	AteraAgent.exe
4456	AteraAgent.exe
4456	AteraAgent.exe
4456	AteraAgent.exe
4456	AteraAgent.exe
4456	AteraAgent.exe
4456	AteraAgent.exe
4456	AteraAgent.exe
4456	AteraAgent.exe
4456	AteraAgent.exe
4456	AteraAgent.exe
4456	AteraAgent.exe
4456	AteraAgent.exe
4456	AteraAgent.exe
4456	AteraAgent.exe
4456	AteraAgent.exe
4456	AteraAgent.exe
4456	AteraAgent.exe
4456	AteraAgent.exe
4456	AteraAgent.exe
4456	AteraAgent.exe
4456	AteraAgent.exe
4456	AteraAgent.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	5084	msiexec.exe
Token: SeIncreaseQuotaPrivilege	5084	msiexec.exe
Token: SeSecurityPrivilege	4600	msiexec.exe
Token: SeCreateTokenPrivilege	5084	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	5084	msiexec.exe
Token: SeLockMemoryPrivilege	5084	msiexec.exe
Token: SeIncreaseQuotaPrivilege	5084	msiexec.exe
Token: SeMachineAccountPrivilege	5084	msiexec.exe
Token: SeTcbPrivilege	5084	msiexec.exe
Token: SeSecurityPrivilege	5084	msiexec.exe
Token: SeTakeOwnershipPrivilege	5084	msiexec.exe
Token: SeLoadDriverPrivilege	5084	msiexec.exe
Token: SeSystemProfilePrivilege	5084	msiexec.exe
Token: SeSystemtimePrivilege	5084	msiexec.exe
Token: SeProfSingleProcessPrivilege	5084	msiexec.exe
Token: SeIncBasePriorityPrivilege	5084	msiexec.exe
Token: SeCreatePagefilePrivilege	5084	msiexec.exe
Token: SeCreatePermanentPrivilege	5084	msiexec.exe
Token: SeBackupPrivilege	5084	msiexec.exe
Token: SeRestorePrivilege	5084	msiexec.exe
Token: SeShutdownPrivilege	5084	msiexec.exe
Token: SeDebugPrivilege	5084	msiexec.exe
Token: SeAuditPrivilege	5084	msiexec.exe
Token: SeSystemEnvironmentPrivilege	5084	msiexec.exe
Token: SeChangeNotifyPrivilege	5084	msiexec.exe
Token: SeRemoteShutdownPrivilege	5084	msiexec.exe
Token: SeUndockPrivilege	5084	msiexec.exe
Token: SeSyncAgentPrivilege	5084	msiexec.exe
Token: SeEnableDelegationPrivilege	5084	msiexec.exe
Token: SeManageVolumePrivilege	5084	msiexec.exe
Token: SeImpersonatePrivilege	5084	msiexec.exe
Token: SeCreateGlobalPrivilege	5084	msiexec.exe
Token: SeBackupPrivilege	5736	vssvc.exe
Token: SeRestorePrivilege	5736	vssvc.exe
Token: SeAuditPrivilege	5736	vssvc.exe
Token: SeBackupPrivilege	4600	msiexec.exe
Token: SeRestorePrivilege	4600	msiexec.exe
Token: SeRestorePrivilege	4600	msiexec.exe
Token: SeTakeOwnershipPrivilege	4600	msiexec.exe
Token: SeRestorePrivilege	4600	msiexec.exe
Token: SeTakeOwnershipPrivilege	4600	msiexec.exe
Token: SeDebugPrivilege	3720	rundll32.exe
Token: SeRestorePrivilege	4600	msiexec.exe
Token: SeTakeOwnershipPrivilege	4600	msiexec.exe
Token: SeDebugPrivilege	4420	rundll32.exe
Token: SeRestorePrivilege	4600	msiexec.exe
Token: SeTakeOwnershipPrivilege	4600	msiexec.exe
Token: SeDebugPrivilege	4928	rundll32.exe
Token: SeRestorePrivilege	4600	msiexec.exe
Token: SeTakeOwnershipPrivilege	4600	msiexec.exe
Token: SeRestorePrivilege	4600	msiexec.exe
Token: SeTakeOwnershipPrivilege	4600	msiexec.exe
Token: SeDebugPrivilege	6136	rundll32.exe
Token: SeRestorePrivilege	4600	msiexec.exe
Token: SeTakeOwnershipPrivilege	4600	msiexec.exe
Token: SeDebugPrivilege	5464	AteraAgent.exe
Token: SeRestorePrivilege	4600	msiexec.exe
Token: SeTakeOwnershipPrivilege	4600	msiexec.exe
Token: SeDebugPrivilege	2944	powershell.exe
Token: SeRestorePrivilege	4600	msiexec.exe
Token: SeTakeOwnershipPrivilege	4600	msiexec.exe
Token: SeDebugPrivilege	5748	powershell.exe
Token: SeBackupPrivilege	872	srtasks.exe
Token: SeRestorePrivilege	872	srtasks.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
5084	msiexec.exe
5084	msiexec.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 4600 wrote to memory of 872	4600	msiexec.exe	94
PID 4600 wrote to memory of 2640	4600	msiexec.exe	96
PID 2640 wrote to memory of 3720	2640	MsiExec.exe	97
PID 2640 wrote to memory of 4420	2640	MsiExec.exe	98
PID 2640 wrote to memory of 4928	2640	MsiExec.exe	99
PID 2640 wrote to memory of 6136	2640	MsiExec.exe	100
PID 4600 wrote to memory of 5692	4600	msiexec.exe	101
PID 5692 wrote to memory of 5464	5692	MsiExec.exe	102
PID 5692 wrote to memory of 2944	5692	MsiExec.exe	104
PID 5692 wrote to memory of 5748	5692	MsiExec.exe	106
PID 4456 wrote to memory of 1228	4456	AteraAgent.exe	110
PID 1228 wrote to memory of 5696	1228	cmd.exe	112
PID 2640 wrote to memory of 4900	2640	MsiExec.exe	113

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\setup_Z-_Mason_Street_Furniture_(Not_Supported_by_Group_IT).msi
1⤵
- Badlisted process makes network request
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:5084

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4600
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:872
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding EFA05043CAD2BDC21CB5192EE4FCB031
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:2640
- - C:\Windows\system32\rundll32.exe
    rundll32.exe "C:\Windows\Installer\MSIF44E.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240710875 2 Atera.Agent.Installer.Msi.Ca!Atera.Agent.Installer.Msi.Ca.CustomActions.GenerateAgentId
    3⤵
    - Loads dropped DLL
    - Drops file in Windows directory
    - Suspicious use of AdjustPrivilegeToken
    PID:3720
- - C:\Windows\system32\rundll32.exe
    rundll32.exe "C:\Windows\Installer\MSIF633.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240711218 6 Atera.Agent.Installer.Msi.Ca!Atera.Agent.Installer.Msi.Ca.CustomActions.ShouldContinueInstallation
    3⤵
    - Badlisted process makes network request
    - Loads dropped DLL
    - Drops file in Windows directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4420
- - C:\Windows\system32\rundll32.exe
    rundll32.exe "C:\Windows\Installer\MSIFAD8.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240712406 10 Atera.Agent.Installer.Msi.Ca!Atera.Agent.Installer.Msi.Ca.CustomActions.ReportMsiInstallStart
    3⤵
    - Badlisted process makes network request
    - Loads dropped DLL
    - Drops file in Windows directory
    - Suspicious use of AdjustPrivilegeToken
    PID:4928
- - C:\Windows\system32\rundll32.exe
    rundll32.exe "C:\Windows\Installer\MSIFE83.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240713343 15 Atera.Agent.Installer.Msi.Ca!Atera.Agent.Installer.Msi.Ca.CustomActions.DetectDotNetFrameworkRuntime
    3⤵
    - Loads dropped DLL
    - Drops file in Windows directory
    - System Time Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:6136
- - C:\Windows\system32\rundll32.exe
    rundll32.exe "C:\Windows\Installer\MSI469C.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240731828 31 Atera.Agent.Installer.Msi.Ca!Atera.Agent.Installer.Msi.Ca.CustomActions.ReportMsiInstallEnd
    3⤵
    - Badlisted process makes network request
    - Loads dropped DLL
    - Drops file in Windows directory
    PID:4900
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding 7C82B144D8AE42BFAA0EBD17C219172C E Global\MSI0000
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:5692
- - C:\Program Files\ATERA Networks\AteraAgent\Agent\AteraAgent.exe
    "C:\Program Files\ATERA Networks\AteraAgent\Agent\AteraAgent.exe" init-settings --agent-id "200fb04e-49c0-4b28-b691-3c63f0a97c79" --account-id "i3Ni+EOALl4FvwJcQroVhbrtT8HcJh6nP8Bf2147VP4=" --account-agent-installation-id "caf5a032c867462fbf577bc454480d04" --environment "Production" --customer-id "289" --folder-id ""
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5464
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" -ExecutionPolicy Bypass -NoProfile -Command "[Net.ServicePointManager]::SecurityProtocol=[Net.SecurityProtocolType]::Tls12;Invoke-WebRequest -Uri 'https://dot.net/v1/dotnet-install.ps1' -OutFile \"C:\Program Files\ATERA Networks\AteraAgent\Agent\dotnet-install.ps1\""
    3⤵
    - Badlisted process makes network request
    - Command and Scripting Interpreter: PowerShell
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2944
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" -ExecutionPolicy unrestricted -NoProfile -File "C:\Program Files\ATERA Networks\AteraAgent\Agent\dotnet-install.ps1" -Channel 8.0 -Runtime dotnet -InstallDir "C:\Program Files\ATERA Networks\AteraAgent\Agent\\.dotnet"
    3⤵
    - Badlisted process makes network request
    - Command and Scripting Interpreter: PowerShell
    - Drops file in Program Files directory
    - System Time Discovery
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5748

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:5736

C:\Program Files\ATERA Networks\AteraAgent\Agent\AteraAgent.exe
"C:\Program Files\ATERA Networks\AteraAgent\Agent\AteraAgent.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4456
- C:\Windows\system32\cmd.exe
  "cmd.exe" /c "C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\dotnet.exe" --list-runtimes
  2⤵
  - Executes a command shell one-liner
  - System Time Discovery
  - Suspicious use of WriteProcessMemory
  PID:1228
- - C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\dotnet.exe
    "C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\dotnet.exe" --list-runtimes
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Time Discovery
    PID:5696

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Event Triggered Execution

T1546

Installer Packages

T1546.016

Privilege Escalation

Event Triggered Execution

T1546

Installer Packages

T1546.016

Defense Evasion

System Binary Proxy Execution

T1218

Msiexec

T1218.007

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e58f374.rbs

Path C:\Config.Msi\e58f374.rbs
Size 7KB
SHA256 57065a3c30e26a1c480b8ed4cd413f417644e7ecca8457042e4b142a6c0a323a
MD5 65a130284ac39973420c41b1d7e4cbc5
SHA1 7ce8ca731a739f4e0fef19c830c04e60e6302f04
SHA512 a6354a860de9e9c5edda2a730977e96126dc7263af2cf6d378da7af609fed628d1d6a320c9b34bbb49949825c082cb1a4b178464daf4e724e293c98f91f16ab9
SSDEEP 96:amLaUupzD1s3Ire6tUtUIp9MxFCsTlLUIp9MxFC6jNu1n+TlFQV5c9Wf2jgCCips:7eJzZM6eDGmKx4IamKx4k7+AMBipLOX
TLSH
T1B4F12005720344D2F99E6738CB072B5A3BB2E3D64286535B1E9E84706F573981F6829F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\dotnet.exe
Size 153KB
SHA256 111da7b604cd196b49167cfeecdaef4034b58cc7de71a91cbf9e162c9e8b0931
MD5 26aca7f84913f46171b1bbad3f30f110
SHA1 1a61b447c6ebdf49455dcaf6ff62e3212f028ad2
SHA512 1698fa7300a6f67146c737210b6023f2f7166fd4ada58243a9011e67762a9f71eecac11cc1b2f5a4864f5204b1bba22962f37a08dae3d6103755b0382c7e3db2
SSDEEP 1536:/yPL142WnQwPtrd4zAl8ZVVZh6e0dYt4aXMFG0vcCVhsRz7:/yP22WplaO8n0Wt4aXMSCVQH
TLSH
T1C8F3071AD65811AAD1AE9575CB518A41BB337C6587E0E3CB17C0FCBE0F326909EE9703
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hostfxr.dll

Path C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\host\fxr\8.0.31\hostfxr.dll
Size 357KB
SHA256 4f5a0500cd2a2439b0d5edbf242950233aec4539ec9a5e7ba9b8a9b0079f63af
MD5 b12f168ba86e7135e07168cfbec01aba
SHA1 d2d51f767d7e8306e890dd6a97ade93fb117d8a5
SHA512 b2d612c1383c2754fe54a1b433ebdd77cb1a48d3143a7c1406300d6a4a26a52baa0310a10648baeed687201a583132fe9c2326dd1a46ed74c7d69e46a6290f17
SSDEEP 6144:GE7Hjww5R1Gv0crJHeUtJ9NZFSKJ2nje/SnFNonJLSHDWHPDh+vJpmE0f0xcTZ6M:VMjrJnJaKGkriJ4E16tXZPp
TLSH
T1F5741916D6E8017CF0B7D679CAB28901EB727C494BB196CF139099661E73BD09E39323
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

.settings.json

Path C:\Program Files\ATERA Networks\AteraAgent\Agent\.settings.json
Size 245B
SHA256 7e36116673a9ecb8958f5511bef4ce465900bfb26a04b53a26a052fbbe2b8df3
MD5 f645022a95e49da6d56860f1ea66ed8d
SHA1 76dbaec4268177f5e0f62edfa7182d2f5778d388
SHA512 e7474215a55f4c1b05242d532ec4de32bd3c8957d043c1fbf6ae45b7976a597ce867f85c940958a9696d8c378e9a6dc751a84e1aa7c37c7a32726748b2305cd3
TLSH
T16DD0A7D1C7359E6079045C56B60F269CE133E680FD820D5974CA11211CA4ED552A7097
MD5 SHA1 SHA512 TLSH

Submit Download

AteraAgent.exe

Path C:\Program Files\ATERA Networks\AteraAgent\Agent\AteraAgent.exe
Size 21.7MB
SHA256 40be79204b749b4fffa22339c056b43ef3624ddc213183a2579ce88dc8e148bf
MD5 44159769f2118debe61c3f8c33bdcceb
SHA1 657ade2228358458a1e9dcd793bc3018656151bc
SHA512 911101d27d3a1beca0403362fe17d55a4ce39d399d04d38894a7127a63ee1fc0ea1581c138043c9cba5605bc446bc0fa25648de82ad75a23eecdb2f6a7f2cfdc
SSDEEP 196608:TGuM9a0wrs541GnixeN+AO6qtDpER5BafJvJ/tkwyPLniYx0k/:TjlXInUPp2wyPL7
TLSH
T154379C11A3EC426AE5BF8338D4724516DBF278466721E7CF2548A5E92E33BC09E35363
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

agent.cert.pfx

Path C:\Program Files\ATERA Networks\AteraAgent\Agent\certificates\production\agent.cert.pfx
Size 2KB
SHA256 54756e7433e253d43596332021accbd601ef4f74c80d2fc08de250af3169af38
MD5 3dd2c22090ee1abe7966a33c3ef57d0a
SHA1 822772f2f995fed73d1179997bea369cc5ec1335
SHA512 7619d543ddc40670902cfc8f94553c1512ec3503d4c49ac8bd5c47493398d43e8ebb4076466b832d0c1dba44a7af32e537dc40d3ec3029799be8c2f11917f1a2
TLSH
T11851191782FB496634E6FCEE34340E56B4C067F03AA4612BB7FD6AD54432D20553E223
MD5 SHA1 SHA512 TLSH

Submit Download

dotnet-install.ps1

Path C:\Program Files\ATERA Networks\AteraAgent\Agent\dotnet-install.ps1
Size 74KB
SHA256 e8b873e18a81e5c4cd8ab69d84dac8fead291d50b3c44633cd7fddad709a13d6
MD5 ce1e8af1ee38c40f594dd19f9cb988f5
SHA1 bc16517853592107970aae2d7c7d1546b1c6e960
SHA512 cf32ef77dcb0ba6b60da3ea3997746979844ebdc1db5470762c969bec2b3f5478bb348badbe2373e4eee7aea66e9c4db4f8b20919a6bf1b5e60345e5020f9ebe
SSDEEP 768:GQy0YIw0FI6Szz3G4yYijvbpyspGD2huFI1Fb2JPJFId4zT2C0U8qzqog7+XMhDF:GSY7PwYU1JPg8qzjUcn4f4Xsjh2Syy
TLSH
T152731A9EAD429032547363B8C96B1084FB374277524541A8F8DDD4887FB262D93A2FEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
Size 471B
SHA256 4181ff5096693f7ba0481c3851de5bb3e7c72129ab79d5ca7e86de8f4a3753b9
MD5 9cd0a87b9cc3d65a47a399280eb877fe
SHA1 3c7d1b79b59d9906eca093107eb2798ee52bc895
SHA512 0f0a66c349b0d729b468979ff722c50cf9d98e84ac569fd83466ca0a78a7c254f24097190659025350378149b2d1cba13e3b0851b3961b3570a2bd3f30e4f53d
TLSH
T110F0D43750BB73A331466C2C06E56E3034709B8F44C54972603554D1456F6EC214F45B
MD5 SHA1 SHA512 TLSH

Submit Download

8EC9B1D0ABBD7F98B401D425828828CE_6FBFBE34ABAF2109B411B965FB39009E

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_6FBFBE34ABAF2109B411B965FB39009E
Size 727B
SHA256 498fd46879cc823632307d3cde6225f5c3594e62ec3b1254062f0504415002e7
MD5 9099fa2c2be69c9eea13376c928e323c
SHA1 08610c3f94bfa124f266ef673b729122e22212cc
SHA512 eebf0d5625501298aadae83e493d7ef1f13a7c51ca60de9fdc1732b6f5f7a16ef22d1f2e050c437a033e4d657d2a68cc5be4e831421b90e4cd9997306f1b2c55
TLSH
T1630165060FA916407B219D2C5E9557B63E13D342795C061E066B11A5A78D3354F05931
MD5 SHA1 SHA512 TLSH

Submit Download

C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
Size 727B
SHA256 5f59c273582d1f7461890515bcdfcd0306152ac82e7b5129e9212fde0518d275
MD5 fc95b8627030850f8363f4e5ac74f5d0
SHA1 908f27aa06712a3095f49e41098218851dbf6b86
SHA512 dc7f9e6e2ce1d91935e327edf75104ab601d2781bf83974ee6605b7fe087a8ec3467f49abfdfa7a9dedc15b67d4bcfdfd53ce1709544b5210e290a2f38caa491
TLSH
T10001654245EC399574766840EBDC43B5347D47FB08DD426220112ACA19D1631FBD1406
MD5 SHA1 SHA512 TLSH

Submit Download

698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
Size 400B
SHA256 11f378f0d30caf4adce4e6b84677c4d14714d0299de5196fa185ff52485417f8
MD5 7622711adc2ec4bb9dd99c9e52a67cf6
SHA1 1a40f6857d4b63ca8f51aa5e17ab9007e76d6ed5
SHA512 6aed068d415ffe7bcebc671a25a99b7367e79522a51016c855da896570bb4affdfaa703bec9d593ccdc2ce2f651544146a0871d080a3f3581f16ee25d8381951
TLSH
T125E0D8341BFE501FF5609B7503D9D1DA6B25F1066C5562AE1E81146D591DD005C92870
MD5 SHA1 SHA512 TLSH

Submit Download

8EC9B1D0ABBD7F98B401D425828828CE_6FBFBE34ABAF2109B411B965FB39009E

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_6FBFBE34ABAF2109B411B965FB39009E
Size 408B
SHA256 35a3a9e02510bd04c50bd4491fa9842f1eb04e4d5a6a4ac837cea866e830145a
MD5 85230695bb448706b38884967774d7dd
SHA1 93aaf1d752780114b67f4a63ed6439604dfcb083
SHA512 391046ef90ad2c44d63d2e5289c1564cd0846c978581af03e8758eed58bab83066bcd797bedfc78fbd857acd3792a3b4935c8ee9655111a45808c2a4ad5c3db9
TLSH
T188E0203431F5855DF0E0D43442F6796654EDF34B454182691A90534BAF25A804CE1678
MD5 SHA1 SHA512 TLSH

Submit Download

C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
Size 412B
SHA256 b830d92ee361542d4ea113a8f857863777918376bab2ba08f6615fc2fe807460
MD5 a53dfba2fb4db44c9f723b783d6fd4fe
SHA1 133fd4778f554f35e5df892628b71b35e73ae1d7
SHA512 c763faef9a9e90b0767951a85f411184c102b9eda5b5c8da6792c0eb13adbbad509c6708f84333556bb2e51961ef21af34042ede9bd4446ef64548043621f5c5
TLSH
T1BBE0683821AB600EF090983086E6A1B61D4DF2065404877906D04309B70BE009C619B0
MD5 SHA1 SHA512 TLSH

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 81fc6cfe81caf86f84e1285cb854082ac5e127335b5946da154a73f7aa9c2122
MD5 ed30ca9187bf5593affb3dc9276309a6
SHA1 c63757897a6c43a44102b221fe8dc36355e99359
SHA512 1df4f44b207bb30fecee119a2f7f7ab7a0a0aed4d58eeabbec5791d5a6d9443cccffa5479ad4da094e6b88c871720d2e4bcf14ebec45a587ee4ec5e572f37810
TLSH
T1C051DA313275A1E4C91A3F47192819C023BF8355FA98AF5CB65C521EE92740B9B222F3
MD5 SHA1 SHA512 TLSH

Submit Download

rundll32.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\rundll32.exe.log
Size 847B
SHA256 ec084a6c6ecd7d31f1927b0cd926ec03ce346a469f24e5a860e05f2241bd7bf4
MD5 37544b654facecb83555afec67d08b33
SHA1 4dc0f5db034801784b01befef5c1d3304145e1dc
SHA512 4af827ead52c8769672f58a69fca18484aeba1e59b7ec0527e200f8e3d893bcbc1063ea820260fc0b922985ee3b26c3a6f79b4044fb34f1b58f2e3379971b5f9
TLSH
T141018E7122A1B2D589073F57196C258417FF4718B990AE1C7AA8625ED82B4175F323F3
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 dd164b6966f857069eef6a8277408a0a1d5495cffbf7519e4bd743739081d318
MD5 8c5cf469f169dccd43f04412f87b0745
SHA1 3c6e2c7bcadd03c89fc955b8213f0188884c32f2
SHA512 77d6e576ccc2adddf7a7f32826f881347fc3cfb7eea741fd9c50a0618e2545e147b67818b9a66e95e4bc4f220635142d2a282591b5750a404e6057ce6f2a1010
TLSH
T116119723B79CC961CC85413B409C9D6136B2D7C7809EDE9F2FC4C208A07F588CB211A0
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_0vfakzqb.ss2.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_0vfakzqb.ss2.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

MSI88.tmp

Path C:\Windows\Installer\MSI88.tmp
Size 390KB
SHA256 7aacd4c18710e9bc4ff2034895a0a0c8f80f21809fb177d520e93f7688216e6d
MD5 e8dc682f2c486075c6aba658971a62cc
SHA1 7cd0a2b5047a4074aa06a6caa3bb69124851e95d
SHA512 a0a1f0f418bf2d4ffd079b840aeb0142c7faab7fa72b5e33b1841798569f55a25dfd305abf9c2ca89792f6499f695b69975882697dc53e99d5a975a9fa8c7d75
SSDEEP 6144:p2ET2+QBLh+MVy5DCRoRRvc181kaKN8MMLuG:p2ET2+cVXVyNhvcCkaKN8Me
TLSH
T10D846B29F7E408EDE4B78276C5A68530FF75748D3320D5AE47A8852D1F3AAA070BB701
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSIF44E.tmp

Path C:\Windows\Installer\MSIF44E.tmp
Size 347KB
SHA256 ba404962848d74940adc5b600ac84ce99eacfc951fe6271031da896d306ad667
MD5 26778893e7d19e9b76a1c39c87a81a1d
SHA1 f01bf5674082b0921bd277c36f08cf43ae81f871
SHA512 6a9961fbc1e20ee61859a421c8898031375c0ebd9dceea6cfafe60e2d9aa6fca87db86dea0d4915b18d9242f4485c723ab0a6218405a20459fccb76acb0e2faa
SSDEEP 3072:ap1TSTx9ug1jpOwO1WVWpJi+96rrPwSaOFZrk6BjGiR/8ENKn74olxX8RvcOWJrc:apUNpIx1IWpJHOrwIBaiRTivX8R7IOWy
TLSH
T1F374BF55B7F809B9FC7B563988630906D273BC515B71DB9F0360420A9F3B790E93AB22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CustomAction.config

Path C:\Windows\Installer\SFXCA3C1F471651446DB9CE7E91F74CED173C\CustomAction.config
Size 956B
SHA256 2dbc73a3bc444a9119c9b5e20276698384d9ad9535a8a7547c44d1b9a8d67346
MD5 a9088b24614c12b70af6ae9669a4a4b1
SHA1 d72efa4e0c7bd733ed3d51831ead7031175c27e0
SHA512 14090969a71b6c80023da29dc8582aded6d26ca349966767ce22102080abce118b846a47ea2b9abe2d5f6a788bc083031d27fdee4103e2e4b99d29c2ac494d7c
TLSH
T10811D00D4A946B7724312793BFACA1C4E76194BA3994411CB49BB9151F39938176338F
MD5 SHA1 SHA512 TLSH

Submit Download

WixToolset.Dtf.WindowsInstaller.dll

Path C:\Windows\Installer\SFXCA3C1F471651446DB9CE7E91F74CED173C\WixToolset.Dtf.WindowsInstaller.dll
Size 193KB
SHA256 a614884ea627da1925131ebf41e8ae202caeac0fe543b86384f5eb2bfaf1aa75
MD5 ef8d5785ac8669f5fd54e22f52770e6b
SHA1 4c94ae7ef233be33a56c0a5d9b8e2211d5d5792c
SHA512 ab3b140bd6531f22e994606820e6511442c23d9015b1e1a38aaed43aa42ba29a996511151d0b3a383c05c2b11f670e52cdd7f507ad1a1ad8cebea57fb22ade5a
SSDEEP 3072:8Of7tVL+l4lj19l4uDHYHj69UgoTqdda7CnfKlRUjW01KytaljYqCDPC:8gQQx54Hj6jomdrzalMqb
TLSH
T14A149C2A57F84B3ECEFF8778E2614252C7B1F1E67103DB1D9D8281A52163784B682397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Atera.Agent.Installer.Msi.Ca.dll

Path C:\Windows\Installer\SFXCA877C420ADE4C56DAD3A7B8F5AD7214D4\Atera.Agent.Installer.Msi.Ca.dll
Size 74KB
SHA256 46e6ea528969185cb3e663d48d00899f558a09078a9bc2a98b8a9dcf8c04fb79
MD5 04232dbe113e8c01ba28bea800eb677e
SHA1 270774fcbc633212d62be3406c7e7b26172f014e
SHA512 661461bd517eece02637cbc42571f961c362be50591625249752e75e5ece1b02373c937c663377268c89f83efcaf511094eb727921b7e225c18b2ef09504ac28
SSDEEP 1536:yV+re0WBSsp7G19QxAiMS6bFOKf9WD2oRMlr:yVIyBSsp7CM6b8KFWD2Fr
TLSH
T1EE73E44137F84619F2FF5F78BD70901589B3BC666D31DA8D2AA0244E0A76BC0DA60B77
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e58f373.msi

Path C:\Windows\Installer\e58f373.msi
Size 8.4MB
SHA256 1571100ac7ed5c27e470225995828dd39e9760a6a03683ebf669658d15e0d18b
MD5 a6957328fd0cc86898f66a771ddd751e
SHA1 aed2ace1ceed45192f6df48484c19362e3686cd8
SHA512 b8f8a0bca0a4ac27583e06c00fc8f87893cb8465cd5d026f12cba071bab5380aeacd376371030899d758e51294e17bf328a8cd820083fd6d0c949e352b8b37a7
SSDEEP 196608:xWRnEqtLMMQNysvwZJtRrWsIMC7nW1A490CAvIjv:WEFNysWVWsbC7W1Ai0z
TLSH
T1BF963325F7F409AAE8638276C5638125EF7ABC496321D6AF0364B41D1F3B760A0BF714
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Tmp4CBF.tmp

Path C:\Windows\Temp\Tmp4CBF.tmp
Size 3KB
SHA256 94739ca46676bd602a78671257fbfce39feaabc9664c6326bf4970a0108e3429
MD5 560af444a6a7faa0b0ca94dc16ca2a58
SHA1 df31453fafde354870a0a9a8ca50b18e284c32e4
SHA512 7c853176c088d56a517e52c6687b6debf08f6f9726376720ade9d13fafc9be0ca72f0f2b35562a61ece653aeb789c838c60447f463b2bbe70c21bfc8c039b681
TLSH
T1B3616C88B10E28972CEECC504D495B40AEC3D754B390F25F68F4BCA64CA13E9A358C3C
MD5 SHA1 SHA512 TLSH

Submit Download

metadata-2

Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
Size 24.0MB
SHA256 4fea3522ce7b5e09b012bd999b7470fcc1ecfc4f9e7b85613abca3f282581f8b
MD5 4df6193d4a80d724dc9ff6044cfdf2c0
SHA1 5d21a97036689aa1895d02405f61da3d637435ce
SHA512 8413a48772f8eb3ae85d227a612eb27f68542c3b9dc97385c62750bb8c178477869ac81bb4c8502e769cfc867a103410ebdd7cceef80746f187c03f97fb7ae11
SSDEEP 24576:+Epmg3MndoO/vvTLjASOY52MqcLxPqNE+C4dUz+g83KDOGcyoXBmH+B5D/:u0
TLSH
T1AD47D52836F92110F7F79E3CB8F06A2349397D5B9C15DE8D05415B8E0922B71E872F6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{f6b647bb-7a9c-42a6-90fb-ad71f8e06bd5}_OnDiskSnapshotProp

Path \??\Volume{98259768-0000-0000-0000-d08302000000}\System Volume Information\SPP\OnlineMetadataCache\{f6b647bb-7a9c-42a6-90fb-ad71f8e06bd5}_OnDiskSnapshotProp
Size 6KB
SHA256 5af66e405875daa74b02b8baaeee50a70299d103ce15cc42602367a57861aa77
MD5 9a0d268c188e2bfe6b4300ba8fa5832b
SHA1 7b6019265eeaa4598e7aeba6f315b9360fdd300e
SHA512 0f33ceb41a65e3de369d1b9bdb0512280249c7e3fa0a865f12e875fb210d64d4ac81f172d383ecbc0f19dc3ca3a1f05c1024d3036ce29d82a0a2d141c4e579f8
SSDEEP 96:FRDcruivc8DD84LTHzbOHXOHBlBRQ88Sc9XE56tOSVQpu:/yb++ZVm
TLSH
T1BBD1990C5AF54311E2B3AB3229F14557A477B911EF33CB8E0198638E2670A10F875F6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2944-118-0x00000288C8EB0000-0x00000288C8ED2000-memory.dmp

Download

memory/2944-128-0x00000288C9A30000-0x00000288C9C4D000-memory.dmp

Download

memory/3720-35-0x0000023832A20000-0x0000023832A38000-memory.dmp

Download

memory/3720-31-0x0000023832AF0000-0x0000023832B24000-memory.dmp

Download

memory/4420-57-0x0000019813580000-0x0000019813592000-memory.dmp

Download

memory/4420-58-0x0000019813860000-0x000001981389C000-memory.dmp

Download

memory/5748-144-0x00000133A5870000-0x00000133A589A000-memory.dmp

Download

memory/5748-149-0x00000133A58A0000-0x00000133A58B2000-memory.dmp

Download

memory/5748-148-0x00000133A5870000-0x00000133A587A000-memory.dmp

Download

memory/5748-146-0x00000133A5870000-0x00000133A5894000-memory.dmp

Download