meshagent | 99a7abad0f4e79fc9120f2ae250bb716d57e8b130c9f81f403cba0839aeed216

Analysis

user interaction
yes
max time kernel
1049s
max time network
1052s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
25/09/2026, 14:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
meshagent64-Test.exe
Size 3.3MB
Sample260925-rb7evaxfpc
SHA256 99a7abad0f4e79fc9120f2ae250bb716d57e8b130c9f81f403cba0839aeed216
MD5 87a2b0957bcc2cf4706213ad94ac0bec
SHA1 736df824f4ec1b9b9c996fdbb7ef9cf2b599e41e
SHA512 f3a2575641f0f88600909242f00ef7b09c55431c039228de3c68f6d98f8c1ccabda4c63534fd8dcd18fdf12e1d3f5af05cda06396a98faab53d921ef8c7a759f
SSDEEP 49152:EMSGj9zai9bsddr7AaPcZumeRQyKpzSPQBcnMFvf8AC4Z78bRwlI5fT:xd9AddBcryO3cICgI9T
TLSH
T162F57CD2A7A600E8E977F23CC9568517E7F2B81713709BCF25A44A660F236D12B3E741
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware backdoor test discovery execution meshagent persistence ransomware rat spyware trojan

Malware Config

Extracted

Family

meshagent

Version

Botnet

Test

http://mesh.jg06.co.uk:443/agent.ashx

Attributes

mesh_id
0xBCACAEAD1E358BB626ED64FDF4EA953400CC32F703DDDDAA2DA33E9AE05D662AF5F7EA37A3C3CC2A6638BF6A61C28B0E
server_id
D241BFC678764C9FEBD3AD2123403458CBF5BD98B68ACA8521259D5B81235AFCCA8EA237967B03E277680E5FB8224827
wss
wss://mesh.jg06.co.uk:443/agent.ashx

Signatures

Family: MeshAgent
MeshAgent is an open source remote access trojan written in C++.
rat trojan backdoor meshagent

Detects MeshAgent payload 1 IoCs

resource	yara_rule
behavioral2/files/0x000e00000001c4e4-1.dat	family_meshagent

Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000\Software\Microsoft\Active Setup\Installed Components	explorer.exe

Sets service image path in registry 3 TTPs 2 IoCs

This determines the executable launched when a service starts. It can be used to establish persistence.

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Windows Service

T1543.003

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Mesh Agent\ImagePath = "\"C:\\Program Files\\Mesh Agent\\MeshAgent.exe\" "	meshagent64-Test.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Mesh Agent\ImagePath = "\"C:\\Program Files\\Mesh Agent\\MeshAgent.exe\" "	MeshAgent.exe

Executes dropped EXE 20 IoCs

pid	Process
5572	MeshAgent.exe
432	MeshAgent.exe
1964	MeshAgent.exe
632	MeshAgent.exe
4240	MeshAgent.exe
1248	MeshAgent.exe
4048	MeshAgent.exe
3580	MeshAgent.exe
2544	MeshAgent.exe
3900	MeshAgent.exe
1208	MeshAgent.exe
3328	MeshAgent.exe
4740	MeshAgent.exe
3440	MeshAgent.exe
1260	MeshAgent.exe
3880	MeshAgent.exe
3036	MeshAgent.exe
4792	MeshAgent.exe
2452	MeshAgent.exe
4540	MeshAgent.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 2 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\E:	explorer.exe
File opened (read-only)	\??\F:	explorer.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\exe\MeshService64.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\dll\bcryptprimitives.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\ole32.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\dll\Kernel.Appcore.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\symbols\dll\ws2_32.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\dll\dbghelp.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\bcryptprimitives.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\symbols\dll\msvcrt.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\ntasn1.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\symbols\dll\msvcrt.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\DLL\iphlpapi.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\symbols\dll\advapi32.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\symbols\dll\user32.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\symbols\dll\apphelp.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\symbols\DLL\bcrypt.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\dll\gdi32.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\ntasn1.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\sechost.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\symbols\dll\bcryptprimitives.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\symbols\dll\msvcrt.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\symbols\dll\combase.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\dll\crypt32.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\dll\comctl32.pdb	MeshAgent.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File opened for modification	C:\Windows\System32\oleaut32.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\symbols\dll\ws2_32.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\bcrypt.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\symbols\dll\advapi32.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\symbols\dll\bcryptprimitives.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\symbols\dll\bcryptprimitives.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\dll\shell32.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\dll\dbghelp.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\dbghelp.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\symbols\dll\crypt32.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\dll\ucrtbase.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\symbols\dll\shell32.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\dll\crypt32.pdb	MeshAgent.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File opened for modification	C:\Windows\System32\dll\rpcrt4.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\dll\msvcrt.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\dbghelp.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\msvcp_win.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\ole32.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\DLL\bcrypt.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\symbols\dll\ncrypt.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\symbols\exe\MeshService64.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\dll\comctl32.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\dll\ucrtbase.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\symbols\dll\gdi32.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\symbols\dll\sechost.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\dll\ws2_32.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\symbols\dll\ole32.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\bcrypt.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\dll\win32u.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\comctl32.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\symbols\dll\gdi32.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\shell32.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\symbols\exe\MeshService64.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\dll\shell32.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\dll\win32u.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\symbols\DLL\bcrypt.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\dll\gdiplus.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\dll\comctl32.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\dll\advapi32.pdb	MeshAgent.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Mesh Agent\symbols\dll\ntdll.pdb	MeshAgent.exe
File opened for modification	C:\Program Files\Mesh Agent\gdiplus.pdb	MeshAgent.exe
File opened for modification	C:\Program Files\Mesh Agent\ncrypt.pdb	MeshAgent.exe
File opened for modification	C:\Program Files\Mesh Agent\symbols\dll\rpcrt4.pdb	MeshAgent.exe
File opened for modification	C:\Program Files\Mesh Agent\dll\ole32.pdb	MeshAgent.exe
File opened for modification	C:\Program Files\Mesh Agent\bcrypt.pdb	MeshAgent.exe
File opened for modification	C:\Program Files\Mesh Agent\dll\dbghelp.pdb	MeshAgent.exe
File opened for modification	C:\Program Files\Mesh Agent\symbols\dll\gdi32.pdb	MeshAgent.exe
File opened for modification	C:\Program Files\Mesh Agent\symbols\dll\ole32.pdb	MeshAgent.exe
File opened for modification	C:\Program Files\Mesh Agent\oleaut32.pdb	MeshAgent.exe
File opened for modification	C:\Program Files\Mesh Agent\msvcp_win.pdb	MeshAgent.exe
File opened for modification	C:\Program Files\Mesh Agent\dll\user32.pdb	MeshAgent.exe
File opened for modification	C:\Program Files\Mesh Agent\symbols\dll\dbghelp.pdb	MeshAgent.exe
File opened for modification	C:\Program Files\Mesh Agent\dll\msvcp_win.pdb	MeshAgent.exe
File opened for modification	C:\Program Files\Mesh Agent\bcrypt.pdb	MeshAgent.exe
File opened for modification	C:\Program Files\Mesh Agent\MeshAgent.db	MeshAgent.exe
File opened for modification	C:\Program Files\Mesh Agent\gdi32full.pdb	MeshAgent.exe
File opened for modification	C:\Program Files\Mesh Agent\symbols\dll\win32u.pdb	MeshAgent.exe
File opened for modification	C:\Program Files\Mesh Agent\dll\advapi32.pdb	MeshAgent.exe
File opened for modification	C:\Program Files\Mesh Agent\DLL\bcrypt.pdb	MeshAgent.exe
File opened for modification	C:\Program Files\Mesh Agent\rpcrt4.pdb	MeshAgent.exe
File opened for modification	C:\Program Files\Mesh Agent\bcryptprimitives.pdb	MeshAgent.exe
File opened for modification	C:\Program Files\Mesh Agent\ntdll.pdb	MeshAgent.exe
File opened for modification	C:\Program Files\Mesh Agent\symbols\dll\bcryptprimitives.pdb	MeshAgent.exe
File opened for modification	C:\Program Files\Mesh Agent\MeshAgent.db	MeshAgent.exe
File opened for modification	C:\Program Files\Mesh Agent\dll\ntdll.pdb	MeshAgent.exe
File opened for modification	C:\Program Files\Mesh Agent\rpcrt4.pdb	MeshAgent.exe
File opened for modification	C:\Program Files\Mesh Agent\dll\gdi32.pdb	MeshAgent.exe
File opened for modification	C:\Program Files\Mesh Agent\symbols\dll\ole32.pdb	MeshAgent.exe
File opened for modification	C:\Program Files\Mesh Agent\symbols\dll\user32.pdb	MeshAgent.exe
File opened for modification	C:\Program Files\Mesh Agent\msvcrt.pdb	MeshAgent.exe
File opened for modification	C:\Program Files\Mesh Agent\imm32.pdb	MeshAgent.exe
File opened for modification	C:\Program Files\Mesh Agent\DLL\kernel32.pdb	MeshAgent.exe
File opened for modification	C:\Program Files\Mesh Agent\ntasn1.pdb	MeshAgent.exe
File opened for modification	C:\Program Files\Mesh Agent\ntdll.pdb	MeshAgent.exe
File opened for modification	C:\Program Files\Mesh Agent\symbols\dll\dbghelp.pdb	MeshAgent.exe
File opened for modification	C:\Program Files\Mesh Agent\symbols\dll\ucrtbase.pdb	MeshAgent.exe
File opened for modification	C:\Program Files\Mesh Agent\symbols\dll\ncrypt.pdb	MeshAgent.exe
File opened for modification	C:\Program Files\Mesh Agent\MeshAgent.log	MeshAgent.exe
File opened for modification	C:\Program Files\Mesh Agent\dll\ntdll.pdb	MeshAgent.exe
File opened for modification	C:\Program Files\Mesh Agent\dll\ucrtbase.pdb	MeshAgent.exe
File opened for modification	C:\Program Files\Mesh Agent\dll\ntasn1.pdb	MeshAgent.exe
File opened for modification	C:\Program Files\Mesh Agent\DLL\bcrypt.pdb	MeshAgent.exe
File opened for modification	C:\Program Files\Mesh Agent\symbols\dll\msvcrt.pdb	MeshAgent.exe
File opened for modification	C:\Program Files\Mesh Agent\bcrypt.pdb	MeshAgent.exe
File opened for modification	C:\Program Files\Mesh Agent\comctl32.pdb	MeshAgent.exe
File opened for modification	C:\Program Files\Mesh Agent\DLL\kernel32.pdb	MeshAgent.exe
File opened for modification	C:\Program Files\Mesh Agent\symbols\dll\ncrypt.pdb	MeshAgent.exe
File opened for modification	C:\Program Files\Mesh Agent\dll\ucrtbase.pdb	MeshAgent.exe
File opened for modification	C:\Program Files\Mesh Agent\symbols\dll\ucrtbase.pdb	MeshAgent.exe
File opened for modification	C:\Program Files\Mesh Agent\shell32.pdb	MeshAgent.exe
File opened for modification	C:\Program Files\Mesh Agent\symbols\dll\crypt32.pdb	MeshAgent.exe
File opened for modification	C:\Program Files\Mesh Agent\symbols\dll\gdi32full.pdb	MeshAgent.exe
File opened for modification	C:\Program Files\Mesh Agent\dll\gdi32full.pdb	MeshAgent.exe
File opened for modification	C:\Program Files\Mesh Agent\dll\gdiplus.pdb	MeshAgent.exe
File opened for modification	C:\Program Files\Mesh Agent\dll\ole32.pdb	MeshAgent.exe
File opened for modification	C:\Program Files\Mesh Agent\dll\comctl32.pdb	MeshAgent.exe
File opened for modification	C:\Program Files\Mesh Agent\bcrypt.pdb	MeshAgent.exe
File opened for modification	C:\Program Files\Mesh Agent\symbols\dll\advapi32.pdb	MeshAgent.exe
File opened for modification	C:\Program Files\Mesh Agent\dll\shell32.pdb	MeshAgent.exe
File opened for modification	C:\Program Files\Mesh Agent\symbols\DLL\dbgcore.pdb	MeshAgent.exe
File opened for modification	C:\Program Files\Mesh Agent\symbols\dll\msvcp_win.pdb	MeshAgent.exe
File opened for modification	C:\Program Files\Mesh Agent\dll\msvcp_win.pdb	MeshAgent.exe
File opened for modification	C:\Program Files\Mesh Agent\dll\advapi32.pdb	MeshAgent.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\dll\bcryptprimitives.pdb	MeshAgent.exe
File opened for modification	C:\Windows\symbols\dll\msvcp_win.pdb	MeshAgent.exe
File opened for modification	C:\Windows\symbols\dll\advapi32.pdb	MeshAgent.exe
File opened for modification	C:\Windows\symbols\dll\gdi32.pdb	MeshAgent.exe
File opened for modification	C:\Windows\symbols\dll\gdiplus.pdb	MeshAgent.exe
File opened for modification	C:\Windows\symbols\dll\ncrypt.pdb	MeshAgent.exe
File opened for modification	C:\Windows\dbgcore.pdb	MeshAgent.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_ptk1j104.wz4.psm1	powershell.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_stpop1s5.wru.ps1	powershell.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_scait1ui.byv.psm1	powershell.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_rnwzqvqe.imh.psm1	powershell.exe
File opened for modification	C:\Windows\dll\rpcrt4.pdb	MeshAgent.exe
File opened for modification	C:\Windows\dbghelp.pdb	MeshAgent.exe
File opened for modification	C:\Windows\symbols\dll\dbghelp.pdb	MeshAgent.exe
File opened for modification	C:\Windows\symbols\dll\gdiplus.pdb	MeshAgent.exe
File opened for modification	C:\Windows\dll\gdi32.pdb	MeshAgent.exe
File opened for modification	C:\Windows\gdiplus.pdb	MeshAgent.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_lb5zbjh0.s03.psm1	powershell.exe
File opened for modification	C:\Windows\crypt32.pdb	MeshAgent.exe
File opened for modification	C:\Windows\symbols\dll\gdi32full.pdb	MeshAgent.exe
File opened for modification	C:\Windows\msvcp_win.pdb	MeshAgent.exe
File opened for modification	C:\Windows\ws2_32.pdb	MeshAgent.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_4d25mujf.zdi.ps1	powershell.exe
File opened for modification	C:\Windows\kernel32.pdb	MeshAgent.exe
File opened for modification	C:\Windows\kernelbase.pdb	MeshAgent.exe
File opened for modification	C:\Windows\symbols\dll\gdi32.pdb	MeshAgent.exe
File opened for modification	C:\Windows\symbols\dll\combase.pdb	MeshAgent.exe
File opened for modification	C:\Windows\symbols\dll\comctl32.pdb	MeshAgent.exe
File opened for modification	C:\Windows\dbgcore.pdb	MeshAgent.exe
File opened for modification	C:\Windows\imm32.pdb	MeshAgent.exe
File opened for modification	C:\Windows\symbols\dll\kernelbase.pdb	MeshAgent.exe
File opened for modification	C:\Windows\dll\crypt32.pdb	MeshAgent.exe
File opened for modification	C:\Windows\dll\sechost.pdb	MeshAgent.exe
File opened for modification	C:\Windows\oleaut32.pdb	MeshAgent.exe
File opened for modification	C:\Windows\dll\user32.pdb	MeshAgent.exe
File opened for modification	C:\Windows\symbols\dll\oleaut32.pdb	MeshAgent.exe
File opened for modification	C:\Windows\dll\ntasn1.pdb	MeshAgent.exe
File opened for modification	C:\Windows\symbols\dll\shcore.pdb	MeshAgent.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_hpox1mfm.cet.psm1	powershell.exe
File opened for modification	C:\Windows\DLL\kernel32.pdb	MeshAgent.exe
File opened for modification	C:\Windows\dll\user32.pdb	MeshAgent.exe
File opened for modification	C:\Windows\gdi32.pdb	MeshAgent.exe
File opened for modification	C:\Windows\symbols\dll\shell32.pdb	MeshAgent.exe
File opened for modification	C:\Windows\ntdll.pdb	MeshAgent.exe
File opened for modification	C:\Windows\dll\advapi32.pdb	MeshAgent.exe
File opened for modification	C:\Windows\ole32.pdb	MeshAgent.exe
File opened for modification	C:\Windows\shcore.pdb	MeshAgent.exe
File opened for modification	C:\Windows\dll\ws2_32.pdb	MeshAgent.exe
File opened for modification	C:\Windows\symbols\dll\win32u.pdb	MeshAgent.exe
File opened for modification	C:\Windows\symbols\dll\advapi32.pdb	MeshAgent.exe
File opened for modification	C:\Windows\crypt32.pdb	MeshAgent.exe
File opened for modification	C:\Windows\gdi32full.pdb	MeshAgent.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_db4rmx15.qf3.ps1	powershell.exe
File opened for modification	C:\Windows\dll\dbghelp.pdb	MeshAgent.exe
File opened for modification	C:\Windows\dll\Kernel.Appcore.pdb	MeshAgent.exe
File opened for modification	C:\Windows\dll\dbghelp.pdb	MeshAgent.exe
File opened for modification	C:\Windows\dll\ntdll.pdb	MeshAgent.exe
File opened for modification	C:\Windows\symbols\dll\ntdll.pdb	MeshAgent.exe
File opened for modification	C:\Windows\symbols\dll\kernelbase.pdb	MeshAgent.exe
File opened for modification	C:\Windows\dll\gdi32.pdb	MeshAgent.exe
File opened for modification	C:\Windows\symbols\dll\msvcp_win.pdb	MeshAgent.exe
File opened for modification	C:\Windows\symbols\dll\msvcrt.pdb	MeshAgent.exe
File opened for modification	C:\Windows\sechost.pdb	MeshAgent.exe
File opened for modification	C:\Windows\symbols\dll\crypt32.pdb	MeshAgent.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 10 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
2336	powershell.exe
4312	powershell.exe
4148	powershell.exe
4068	powershell.exe
5668	powershell.exe
6020	powershell.exe
2908	powershell.exe
3544	powershell.exe
252	powershell.exe
3892	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 62 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Capabilities	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000\Software\Microsoft\Internet Explorer\Main	explorer.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\ROOT	MeshAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	MeshAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	MeshAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	MeshAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	MeshAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	MeshAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	MeshAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe

Modifies registry class 40 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\microsoftwindows.client.cbs	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\Total	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2251218687-1689653882-3767565116-1000\{B2FF7F26-83C8-4DD3-A782-DF6C592CECE0}	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\NotificationData	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix	SearchHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DomStorageState	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs\Total = "56"	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs\Total = "23"	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs	SearchHost.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2251218687-1689653882-3767565116-1000\{08E1A250-478E-4AA4-9A82-FA0FDD1D29FE}	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix	StartMenuExperienceHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\client.cbs	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "56"	SearchHost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:"	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs\ = "56"	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs\ = "23"	SearchHost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\Local Settings\MuiCache	SearchHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:"	StartMenuExperienceHost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotify	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	StartMenuExperienceHost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "23"	SearchHost.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\Local Settings\MuiCache	StartMenuExperienceHost.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\NotificationData\0D83063EA3B8FCF5 = 0100000000000002	explorer.exe

Suspicious behavior: EnumeratesProcesses 28 IoCs

pid	Process
2908	powershell.exe
2908	powershell.exe
2908	powershell.exe
3544	powershell.exe
3544	powershell.exe
3544	powershell.exe
4312	powershell.exe
4312	powershell.exe
4312	powershell.exe
4148	powershell.exe
4148	powershell.exe
4148	powershell.exe
252	powershell.exe
252	powershell.exe
252	powershell.exe
4068	powershell.exe
4068	powershell.exe
4068	powershell.exe
5668	powershell.exe
5668	powershell.exe
5668	powershell.exe
3892	powershell.exe
3892	powershell.exe
3892	powershell.exe
6020	powershell.exe
6020	powershell.exe
4388	explorer.exe
4388	explorer.exe

Suspicious use of AdjustPrivilegeToken 53 IoCs

description	pid	Process
Token: SeDebugPrivilege	2908	powershell.exe
Token: SeDebugPrivilege	3544	powershell.exe
Token: SeDebugPrivilege	4312	powershell.exe
Token: SeDebugPrivilege	4148	powershell.exe
Token: SeDebugPrivilege	252	powershell.exe
Token: SeDebugPrivilege	4068	powershell.exe
Token: SeDebugPrivilege	5668	powershell.exe
Token: SeDebugPrivilege	3892	powershell.exe
Token: SeDebugPrivilege	6020	powershell.exe
Token: SeShutdownPrivilege	4388	explorer.exe
Token: SeCreatePagefilePrivilege	4388	explorer.exe
Token: SeShutdownPrivilege	4388	explorer.exe
Token: SeCreatePagefilePrivilege	4388	explorer.exe
Token: SeShutdownPrivilege	4388	explorer.exe
Token: SeCreatePagefilePrivilege	4388	explorer.exe
Token: SeShutdownPrivilege	4388	explorer.exe
Token: SeCreatePagefilePrivilege	4388	explorer.exe
Token: SeShutdownPrivilege	4388	explorer.exe
Token: SeCreatePagefilePrivilege	4388	explorer.exe
Token: SeShutdownPrivilege	4388	explorer.exe
Token: SeCreatePagefilePrivilege	4388	explorer.exe
Token: SeShutdownPrivilege	4388	explorer.exe
Token: SeCreatePagefilePrivilege	4388	explorer.exe
Token: SeShutdownPrivilege	4388	explorer.exe
Token: SeCreatePagefilePrivilege	4388	explorer.exe
Token: SeShutdownPrivilege	4388	explorer.exe
Token: SeCreatePagefilePrivilege	4388	explorer.exe
Token: SeShutdownPrivilege	4388	explorer.exe
Token: SeCreatePagefilePrivilege	4388	explorer.exe
Token: SeShutdownPrivilege	4388	explorer.exe
Token: SeCreatePagefilePrivilege	4388	explorer.exe
Token: SeShutdownPrivilege	4388	explorer.exe
Token: SeCreatePagefilePrivilege	4388	explorer.exe
Token: SeShutdownPrivilege	4388	explorer.exe
Token: SeCreatePagefilePrivilege	4388	explorer.exe
Token: SeShutdownPrivilege	4388	explorer.exe
Token: SeCreatePagefilePrivilege	4388	explorer.exe
Token: SeShutdownPrivilege	4388	explorer.exe
Token: SeCreatePagefilePrivilege	4388	explorer.exe
Token: SeShutdownPrivilege	4388	explorer.exe
Token: SeCreatePagefilePrivilege	4388	explorer.exe
Token: SeShutdownPrivilege	4388	explorer.exe
Token: SeCreatePagefilePrivilege	4388	explorer.exe
Token: SeShutdownPrivilege	4388	explorer.exe
Token: SeCreatePagefilePrivilege	4388	explorer.exe
Token: SeShutdownPrivilege	4388	explorer.exe
Token: SeCreatePagefilePrivilege	4388	explorer.exe
Token: SeShutdownPrivilege	4388	explorer.exe
Token: SeCreatePagefilePrivilege	4388	explorer.exe
Token: SeShutdownPrivilege	4388	explorer.exe
Token: SeCreatePagefilePrivilege	4388	explorer.exe
Token: SeShutdownPrivilege	4388	explorer.exe
Token: SeCreatePagefilePrivilege	4388	explorer.exe

Suspicious use of FindShellTrayWindow 52 IoCs

pid	Process
2828	sihost.exe
4388	explorer.exe
4388	explorer.exe
4388	explorer.exe
4388	explorer.exe
4388	explorer.exe
4388	explorer.exe
4388	explorer.exe
4388	explorer.exe
4388	explorer.exe
4388	explorer.exe
4388	explorer.exe
4388	explorer.exe
4388	explorer.exe
4388	explorer.exe
4388	explorer.exe
4388	explorer.exe
4388	explorer.exe
4388	explorer.exe
4388	explorer.exe
4388	explorer.exe
4388	explorer.exe
4388	explorer.exe
4388	explorer.exe
4388	explorer.exe
4388	explorer.exe
4388	explorer.exe
4388	explorer.exe
4388	explorer.exe
4388	explorer.exe
4388	explorer.exe
4388	explorer.exe
4388	explorer.exe
4388	explorer.exe
4388	explorer.exe
4388	explorer.exe
4388	explorer.exe
4388	explorer.exe
4388	explorer.exe
4388	explorer.exe
4388	explorer.exe
4388	explorer.exe
4388	explorer.exe
4388	explorer.exe
4388	explorer.exe
4388	explorer.exe
4388	explorer.exe
4388	explorer.exe
4388	explorer.exe
4388	explorer.exe
4388	explorer.exe
4388	explorer.exe

Suspicious use of SendNotifyMessage 40 IoCs

pid	Process
4388	explorer.exe
4388	explorer.exe
4388	explorer.exe
4388	explorer.exe
4388	explorer.exe
4388	explorer.exe
4388	explorer.exe
4388	explorer.exe
4388	explorer.exe
4388	explorer.exe
4388	explorer.exe
4388	explorer.exe
4388	explorer.exe
4388	explorer.exe
4388	explorer.exe
4388	explorer.exe
4388	explorer.exe
4388	explorer.exe
4388	explorer.exe
4388	explorer.exe
4388	explorer.exe
4388	explorer.exe
4388	explorer.exe
4388	explorer.exe
4388	explorer.exe
4388	explorer.exe
4388	explorer.exe
4388	explorer.exe
4388	explorer.exe
4388	explorer.exe
4388	explorer.exe
4388	explorer.exe
4388	explorer.exe
4388	explorer.exe
4388	explorer.exe
4388	explorer.exe
4388	explorer.exe
4388	explorer.exe
4388	explorer.exe
4388	explorer.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2324	StartMenuExperienceHost.exe
4388	explorer.exe
1176	SearchHost.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 5588 wrote to memory of 3612	5588	meshagent64-Test.exe	91
PID 432 wrote to memory of 1964	432	MeshAgent.exe	96
PID 5572 wrote to memory of 2336	5572	MeshAgent.exe	98
PID 632 wrote to memory of 2908	632	MeshAgent.exe	100
PID 632 wrote to memory of 4240	632	MeshAgent.exe	103
PID 1248 wrote to memory of 3544	1248	MeshAgent.exe	106
PID 1248 wrote to memory of 4048	1248	MeshAgent.exe	109
PID 3580 wrote to memory of 4312	3580	MeshAgent.exe	112
PID 3580 wrote to memory of 2544	3580	MeshAgent.exe	114
PID 3900 wrote to memory of 4148	3900	MeshAgent.exe	117
PID 3900 wrote to memory of 1208	3900	MeshAgent.exe	119
PID 3328 wrote to memory of 252	3328	MeshAgent.exe	122
PID 3328 wrote to memory of 4740	3328	MeshAgent.exe	124
PID 3440 wrote to memory of 4068	3440	MeshAgent.exe	127
PID 3440 wrote to memory of 1260	3440	MeshAgent.exe	129
PID 3880 wrote to memory of 5668	3880	MeshAgent.exe	132
PID 3880 wrote to memory of 3036	3880	MeshAgent.exe	134
PID 4792 wrote to memory of 3892	4792	MeshAgent.exe	137
PID 4792 wrote to memory of 2452	4792	MeshAgent.exe	139
PID 4540 wrote to memory of 6020	4540	MeshAgent.exe	142
PID 2828 wrote to memory of 4388	2828	sihost.exe	155

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\meshagent64-Test.exe
"C:\Users\Admin\AppData\Local\Temp\meshagent64-Test.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5588
- C:\Users\Admin\AppData\Local\Temp\meshagent64-Test.exe
  "C:\Users\Admin\AppData\Local\Temp\meshagent64-Test.exe" -fullinstall
  2⤵
  - Sets service image path in registry
  PID:3612

C:\Program Files\Mesh Agent\MeshAgent.exe
"C:\Program Files\Mesh Agent\MeshAgent.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:5572
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -noprofile -nologo -command -
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:2336

C:\Program Files\Mesh Agent\MeshAgent.exe
"C:\Program Files\Mesh Agent\MeshAgent.exe"
1⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:432
- C:\Program Files\Mesh Agent\MeshAgent.exe
  "C:\Program Files\Mesh Agent\MeshAgent.exe" -fullinstall
  2⤵
  - Sets service image path in registry
  - Executes dropped EXE
  - Drops file in Windows directory
  PID:1964

C:\Program Files\Mesh Agent\MeshAgent.exe
"C:\Program Files\Mesh Agent\MeshAgent.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:632
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -noprofile -nologo -command -
  2⤵
  - Drops file in Windows directory
  - Command and Scripting Interpreter: PowerShell
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2908
- C:\Program Files\Mesh Agent\MeshAgent.exe
  MeshAgent.exe -b64exec dHJ5IHsgYWRkTW9kdWxlKCd3aW4tZGVza3V0aWxzJywgcHJvY2Vzcy5lbnZbJ3dpbl9kZXNrdXRpbHMnXSk7fSBjYXRjaCAoeCkgeyB9IHZhciB4O3RyeXt4PXJlcXVpcmUoJ3dpbi1kZXNrdXRpbHMnKS5kaXNwYXRjaCgnaWRsZScsICdnZXRTZWNvbmRzJywgW10pO2NvbnNvbGUubG9nKHgpO31jYXRjaCh6KXtjb25zb2xlLmxvZyh6KTtwcm9jZXNzLmV4aXQoMSk7fXByb2Nlc3MuZXhpdCgwKTs=
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  PID:4240

C:\Program Files\Mesh Agent\MeshAgent.exe
"C:\Program Files\Mesh Agent\MeshAgent.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:1248
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -noprofile -nologo -command -
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3544
- C:\Program Files\Mesh Agent\MeshAgent.exe
  MeshAgent.exe -b64exec dHJ5IHsgYWRkTW9kdWxlKCd3aW4tZGVza3V0aWxzJywgcHJvY2Vzcy5lbnZbJ3dpbl9kZXNrdXRpbHMnXSk7fSBjYXRjaCAoeCkgeyB9IHZhciB4O3RyeXt4PXJlcXVpcmUoJ3dpbi1kZXNrdXRpbHMnKS5kaXNwYXRjaCgnaWRsZScsICdnZXRTZWNvbmRzJywgW10pO2NvbnNvbGUubG9nKHgpO31jYXRjaCh6KXtjb25zb2xlLmxvZyh6KTtwcm9jZXNzLmV4aXQoMSk7fXByb2Nlc3MuZXhpdCgwKTs=
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  PID:4048

C:\Program Files\Mesh Agent\MeshAgent.exe
"C:\Program Files\Mesh Agent\MeshAgent.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:3580
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -noprofile -nologo -command -
  2⤵
  - Drops file in Windows directory
  - Command and Scripting Interpreter: PowerShell
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4312
- C:\Program Files\Mesh Agent\MeshAgent.exe
  MeshAgent.exe -b64exec dHJ5IHsgYWRkTW9kdWxlKCd3aW4tZGVza3V0aWxzJywgcHJvY2Vzcy5lbnZbJ3dpbl9kZXNrdXRpbHMnXSk7fSBjYXRjaCAoeCkgeyB9IHZhciB4O3RyeXt4PXJlcXVpcmUoJ3dpbi1kZXNrdXRpbHMnKS5kaXNwYXRjaCgnaWRsZScsICdnZXRTZWNvbmRzJywgW10pO2NvbnNvbGUubG9nKHgpO31jYXRjaCh6KXtjb25zb2xlLmxvZyh6KTtwcm9jZXNzLmV4aXQoMSk7fXByb2Nlc3MuZXhpdCgwKTs=
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  PID:2544

C:\Program Files\Mesh Agent\MeshAgent.exe
"C:\Program Files\Mesh Agent\MeshAgent.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:3900
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -noprofile -nologo -command -
  2⤵
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Command and Scripting Interpreter: PowerShell
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4148
- C:\Program Files\Mesh Agent\MeshAgent.exe
  MeshAgent.exe -b64exec dHJ5IHsgYWRkTW9kdWxlKCd3aW4tZGVza3V0aWxzJywgcHJvY2Vzcy5lbnZbJ3dpbl9kZXNrdXRpbHMnXSk7fSBjYXRjaCAoeCkgeyB9IHZhciB4O3RyeXt4PXJlcXVpcmUoJ3dpbi1kZXNrdXRpbHMnKS5kaXNwYXRjaCgnaWRsZScsICdnZXRTZWNvbmRzJywgW10pO2NvbnNvbGUubG9nKHgpO31jYXRjaCh6KXtjb25zb2xlLmxvZyh6KTtwcm9jZXNzLmV4aXQoMSk7fXByb2Nlc3MuZXhpdCgwKTs=
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  PID:1208

C:\Program Files\Mesh Agent\MeshAgent.exe
"C:\Program Files\Mesh Agent\MeshAgent.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:3328
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -noprofile -nologo -command -
  2⤵
  - Drops file in Windows directory
  - Command and Scripting Interpreter: PowerShell
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:252
- C:\Program Files\Mesh Agent\MeshAgent.exe
  MeshAgent.exe -b64exec dHJ5IHsgYWRkTW9kdWxlKCd3aW4tZGVza3V0aWxzJywgcHJvY2Vzcy5lbnZbJ3dpbl9kZXNrdXRpbHMnXSk7fSBjYXRjaCAoeCkgeyB9IHZhciB4O3RyeXt4PXJlcXVpcmUoJ3dpbi1kZXNrdXRpbHMnKS5kaXNwYXRjaCgnaWRsZScsICdnZXRTZWNvbmRzJywgW10pO2NvbnNvbGUubG9nKHgpO31jYXRjaCh6KXtjb25zb2xlLmxvZyh6KTtwcm9jZXNzLmV4aXQoMSk7fXByb2Nlc3MuZXhpdCgwKTs=
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  PID:4740

C:\Program Files\Mesh Agent\MeshAgent.exe
"C:\Program Files\Mesh Agent\MeshAgent.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:3440
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -noprofile -nologo -command -
  2⤵
  - Drops file in Windows directory
  - Command and Scripting Interpreter: PowerShell
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4068
- C:\Program Files\Mesh Agent\MeshAgent.exe
  MeshAgent.exe -b64exec dHJ5IHsgYWRkTW9kdWxlKCd3aW4tZGVza3V0aWxzJywgcHJvY2Vzcy5lbnZbJ3dpbl9kZXNrdXRpbHMnXSk7fSBjYXRjaCAoeCkgeyB9IHZhciB4O3RyeXt4PXJlcXVpcmUoJ3dpbi1kZXNrdXRpbHMnKS5kaXNwYXRjaCgnaWRsZScsICdnZXRTZWNvbmRzJywgW10pO2NvbnNvbGUubG9nKHgpO31jYXRjaCh6KXtjb25zb2xlLmxvZyh6KTtwcm9jZXNzLmV4aXQoMSk7fXByb2Nlc3MuZXhpdCgwKTs=
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  PID:1260

C:\Program Files\Mesh Agent\MeshAgent.exe
"C:\Program Files\Mesh Agent\MeshAgent.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:3880
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -noprofile -nologo -command -
  2⤵
  - Drops file in Windows directory
  - Command and Scripting Interpreter: PowerShell
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5668
- C:\Program Files\Mesh Agent\MeshAgent.exe
  MeshAgent.exe -b64exec dHJ5IHsgYWRkTW9kdWxlKCd3aW4tZGVza3V0aWxzJywgcHJvY2Vzcy5lbnZbJ3dpbl9kZXNrdXRpbHMnXSk7fSBjYXRjaCAoeCkgeyB9IHZhciB4O3RyeXt4PXJlcXVpcmUoJ3dpbi1kZXNrdXRpbHMnKS5kaXNwYXRjaCgnaWRsZScsICdnZXRTZWNvbmRzJywgW10pO2NvbnNvbGUubG9nKHgpO31jYXRjaCh6KXtjb25zb2xlLmxvZyh6KTtwcm9jZXNzLmV4aXQoMSk7fXByb2Nlc3MuZXhpdCgwKTs=
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  PID:3036

C:\Program Files\Mesh Agent\MeshAgent.exe
"C:\Program Files\Mesh Agent\MeshAgent.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:4792
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -noprofile -nologo -command -
  2⤵
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Command and Scripting Interpreter: PowerShell
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3892
- C:\Program Files\Mesh Agent\MeshAgent.exe
  MeshAgent.exe -b64exec dHJ5IHsgYWRkTW9kdWxlKCd3aW4tZGVza3V0aWxzJywgcHJvY2Vzcy5lbnZbJ3dpbl9kZXNrdXRpbHMnXSk7fSBjYXRjaCAoeCkgeyB9IHZhciB4O3RyeXt4PXJlcXVpcmUoJ3dpbi1kZXNrdXRpbHMnKS5kaXNwYXRjaCgnaWRsZScsICdnZXRTZWNvbmRzJywgW10pO2NvbnNvbGUubG9nKHgpO31jYXRjaCh6KXtjb25zb2xlLmxvZyh6KTtwcm9jZXNzLmV4aXQoMSk7fXByb2Nlc3MuZXhpdCgwKTs=
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  PID:2452

C:\Program Files\Mesh Agent\MeshAgent.exe
"C:\Program Files\Mesh Agent\MeshAgent.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:4540
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -noprofile -nologo -command -
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:6020

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2828
- C:\Windows\explorer.exe
  explorer.exe /LOADSAVEDWINDOWS
  2⤵
  - Boot or Logon Autostart Execution: Active Setup
  - Enumerates connected drives
  - Checks SCSI registry key(s)
  - Modifies Internet Explorer settings
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:4388

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2324

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1176

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:5308

C:\Windows\System32\SecurityHealthHost.exe
\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding
1⤵
PID:1288

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

MeshAgent.db

Path C:\Program Files\Mesh Agent\MeshAgent.db
Size 35KB
SHA256 6652fcda9bfc1bea19f5e10ca9e6e4c6376cedd35c9380f616dc9065faf4009a
MD5 907896d675f8aaf8b02fe0d5df583591
SHA1 abf97dfba8ff53b1f0ba8e9627a4065ca79a36f6
SHA512 92cf6aea55b5e1169b76176193520aea7176b2cb507bbbaad771ddc831a37ca3eaf3249190ebd901e34ab5c62f6f51669c489e3f1bc9b923c3bf03d5c189a520
SSDEEP 768:1PaCVrh6/Zyo1zrQCJwR99BWFa3Em0Wti:1cvzrw9uWti
TLSH
T107F2E71D8FADB03F2F8623952C0B4D317BE80B38935248516DEF442A417A79DD97F1A6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MeshAgent.db

Path C:\Program Files\Mesh Agent\MeshAgent.db
Size 39KB
SHA256 17292ef54d491ddb8a558467902efe78137470a31e4651f571862f72d5cb1ba6
MD5 28b01f4072f3f92cfeae244c7d6aaab7
SHA1 3d54d455810ce57acbfbc0786da72485441fae4f
SHA512 9fde2065f63e43404eae76f417bd795a1123a6814dc3122f045b813a14a87c68fd995a459a982c848b0b6839808c21ed8dfb7bea16b44841dd9eef9f30351229
SSDEEP 768:1PaCVrh6/Zyo1zrQCJwR99BWFa3Em0Wtwgg8EPEU0:1cvzrw9uWtwxQJ
TLSH
T11C03081D8FADB03E2F8623952C0F4D317BE80B38935248516DEF482A417A79DD97F1A6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MeshAgent.db

Path C:\Program Files\Mesh Agent\MeshAgent.db
Size 200KB
SHA256 5fecc8c831397690cd53cfb471b95b36260b9bb7339bae084ffb2566841399a1
MD5 88098a8a87b13df3c80462f45b2c120d
SHA1 c5f23436b459301da82fef160b670c3e3fbbfbb7
SHA512 384352d1e1f02c45b018fe65d52033bb0be4f60a20b37cd782c33ecb8ffdcb0946b662de5be5e7ec7e610e000e4d1287aee15211e36d9480c9e93b33858a9afd
SSDEEP 3072:Yw9lwxQ/1dznYNa3IzsWSldE9nkn5GmCs8HEKl/mIsREtH40cGy82Z:D9l+QbEY3IzVSA5kwmCfEv8YyG
TLSH
T1F014F21AEF7EB07E2F8523952C0B4931A7D80738936245426CEF0C29D2797D4DA3F5A6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MeshAgent.db.tmp

Path C:\Program Files\Mesh Agent\MeshAgent.db.tmp
Size 200KB
SHA256 8df1b3c20c9342f225185f612590f06e664776eec64c5bdb3edc532030ada529
MD5 53cb43f8febc704d598f19edb7516be1
SHA1 10ed4168863fe4d6a58db70c68601e6b25ac0b64
SHA512 f210e8534b804304da63c44c8f14b549d3d834fd3a7cc9c244ab2a36a68a89ffbc07eff57dad0b9f95341a7664bf1fdf4956a71d01b0ec87741e13b3c4ba9403
SSDEEP 3072:DPx6w9lb1dznYNa3IzsWSldE9nkn5GmCs8HEKl/mIsREtH40cGy82Z:DJl9l3EY3IzVSA5kwmCfEv8YyG
TLSH
T1D614F21AEF7EB07E2F8523952C0B4931A7D80738936245426CEF0C29D2797D4DA3F5A6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MeshAgent.exe

Path C:\Program Files\Mesh Agent\MeshAgent.exe
Size 3.3MB
SHA256 99a7abad0f4e79fc9120f2ae250bb716d57e8b130c9f81f403cba0839aeed216
MD5 87a2b0957bcc2cf4706213ad94ac0bec
SHA1 736df824f4ec1b9b9c996fdbb7ef9cf2b599e41e
SHA512 f3a2575641f0f88600909242f00ef7b09c55431c039228de3c68f6d98f8c1ccabda4c63534fd8dcd18fdf12e1d3f5af05cda06396a98faab53d921ef8c7a759f
SSDEEP 49152:EMSGj9zai9bsddr7AaPcZumeRQyKpzSPQBcnMFvf8AC4Z78bRwlI5fT:xd9AddBcryO3cICgI9T
TLSH
T162F57CD2A7A600E8E977F23CC9568517E7F2B81713709BCF25A44A660F236D12B3E741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MeshAgent.log

Path C:\Program Files\Mesh Agent\MeshAgent.log
Size 1KB
SHA256 6a331a8c09f191fe75fecbb678eff7135dc63ac2cd29796393f2cc347f05cbe5
MD5 da9e477973b1af3fd1745d16761ac1ca
SHA1 9ef33cc4d10dc19a5b835811dd7a4a78a10e8f79
SHA512 858bd0102d5916f4b7d7de53b42b7e5a3865b674eefa43ac3a69e3b7aa02cb410eaa925f9d6422eaeea3839454c61023224e35e32d22c427ecce54529e8b47d9
TLSH
T147219D4FFA98052FF226B19D7EF87F5641A5370005D49E1322D45804999284FFD63AED
MD5 SHA1 SHA512 TLSH

Submit Download

MeshAgent.log

Path C:\Program Files\Mesh Agent\MeshAgent.log
Size 1KB
SHA256 d2225a103af5eb61baf446937758f159bdab6643df5ea1aead815e7e0687dd18
MD5 36e78866fb7e42ac75dc63358dda2de9
SHA1 f9a186e6a95853cb20abd46dde56bb64522fda07
SHA512 cda412695298201596423e3834080b9151a7ffe0c59bf37e19bb77fc8ce25e72752d7a22264a76d807f9939564eda7e5fb2a4770de0aae684a1fd1e6f6e5d40b
TLSH
T1F931BE8FFA98052FF226B19D7EF87F5641A5370001D09E1322D45804989284FFD63AED
MD5 SHA1 SHA512 TLSH

Submit Download

MeshAgent.log

Path C:\Program Files\Mesh Agent\MeshAgent.log
Size 362B
SHA256 98a36bd6c7059c4d2ffe0d3fb1fa8839368a4e96adb9cf440514bf3d9e3a58da
MD5 f6c29bced5986ca0e75fe1ffff70d82a
SHA1 349386dfeb5831db58899b40207c897cc1c7def1
SHA512 32b7de3281287037cb10ea71dc6c23198a0046999c53b0d305b14a0b8ed4a510eddd7c4ed140248d4cb147a00d679147ab92639bfb12ec31206463ed02b7852d
TLSH
T170E0204FFA98052FF225B19D7DF86F5641A5370005D49E1322D85804889184FFD53EED
MD5 SHA1 SHA512 TLSH

Submit Download

MeshAgent.log

Path C:\Program Files\Mesh Agent\MeshAgent.log
Size 543B
SHA256 23dd5d30bfc457cf92232aeff20ef74f894aec6cab599cdab858f695531c5e7e
MD5 8e1224783ef9086f8f75d602ff7fc049
SHA1 1cd03509d8ecabeb03b9f31036cba9d65d9ea544
SHA512 0c678ecb391373bcbc542794161aad5c7fc68061349172b2956a576ac49e1a580e0659a8bd141fa9efbad882a960dbbe7084a291380bc63b066e8cbfc0f88d6f
TLSH
T13CF0BB4FFA98052FF225B19D7DF86F5641A5370005D49E1322D45808989184FFD53AED
MD5 SHA1 SHA512 TLSH

Submit Download

MeshAgent.log

Path C:\Program Files\Mesh Agent\MeshAgent.log
Size 724B
SHA256 488cd73b6ef6ea06d8d837c7f4ad515ef81795bc91e26064eeb7206ecea92b81
MD5 d8989bcfb485b4f94ab7ec1e394fb26d
SHA1 b466485c62224e9d593e8b1ee7a261da952b27c5
SHA512 edc3c97d2fc1f7c880e562b9519d56f1ee1ca4cfbf78c7882aa81ed4cd11ef871a65657db84d73ee70fc674d7e75a05619c5de1839cbddcf3e16d983421fba4d
TLSH
T1AB01AC4FFA98052FF225B19D7DF87F5641A5370005D49E1322D45808989184FFD53AED
MD5 SHA1 SHA512 TLSH

Submit Download

MeshAgent.log

Path C:\Program Files\Mesh Agent\MeshAgent.log
Size 905B
SHA256 1bb320554c30fb787fae6747e78a90dd38732ba5b867620bec51b3b3a9c7be0a
MD5 1d1d5dde10dce2471199b101a1711d5b
SHA1 aba638a13436b7309376447080885a0050a83a87
SHA512 a2709d3264b21ef72b7f5dc4dfc14bdb5c8a4f473e53fd08ff600a04ea2c434330512e9f688f5527b9b5b08e11bdf914355d3adf812c068617bee7f2e9e98d28
TLSH
T13C11AC4FFA98052FF226B19D7EF87F5641A5370005D49E1322D45808989184FFD53AED
MD5 SHA1 SHA512 TLSH

Submit Download

MeshAgent.log

Path C:\Program Files\Mesh Agent\MeshAgent.log
Size 1KB
SHA256 30e88c5dbfa3a33cc256b323ae7177c72bf2a2691252f707f9961b63f4ae7582
MD5 69b77f94f623b46c1bc6c541d86e6dcc
SHA1 9bf613f0cc270c9dccb47cce6d86e0c42561a561
SHA512 859cbf262e32a383e3512010b9beb386fb60edf8abdf066913b265bcacb515f9dedab7c6d5fb7de1450eb491d03141cb3abba05b6adba9d7e296f4bbfe144dd9
TLSH
T146119D4FFA98052FF226B19D7EF87F5641A5370005D49E1322D45808999284FFD53AED
MD5 SHA1 SHA512 TLSH

Submit Download

MeshAgent.msh

Path C:\Program Files\Mesh Agent\MeshAgent.msh
Size 35KB
SHA256 13432f73b74247f817a5b31116fad9d38606ad9ed289c4894deaff2bc5a5959a
MD5 5c9965b444e60f6a36dc0741ef09fa6d
SHA1 7b43344b42d783823c87001ed9a06ab55a93be3e
SHA512 af72dc2cd16a3ad8d06c5fc26aa99e2d6ec24b755f6faef4c692082fba1cf6ace366bcedc990f2cf26c6769b4d6204e4111e5c5e07b5659d794626d29d55d48e
SSDEEP 384:TT8rCFryXKhhlW/zNc3XRJ3PoNSpyjSUzrnQCJwZVx9K6rvja3qj7ZiZFa3EB8PN:/aCVrh6/Zyo1zrQCJwR99BWFa3Em0Wth
TLSH
T1A4F2E61D8FADB03F2F8623952C0B4D317BE80B38935209516DEF481A427A79DD97F1A6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prep_Activatable Class_Hermes_perf.cache

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
Size 599B
SHA256 b536a3dae9ea5c69081f0491eed829e3b57e32401fdf49a63031bcd6b20e6fdb
MD5 658ab8c32d4cc5deb36ac5f63da4658b
SHA1 30c12cd871ff0c2c4098d794e9ae4f2540586813
SHA512 a73030c008ef3c2e274f11c90bfe79fa8ae402f76801c710bed8cc1ab1218a84858ea566b772be4bade8ef639a019c57d297028df15b64b3753482cf0f3c8f85
TLSH
T12AF05C83EB6A1B72C456123DC8EE56E47B31D1846EC11367A2107B1D3C2B7192D174BD
MD5 SHA1 SHA512 TLSH

Submit Download

prep_Activatable Class_Hermes_perf.cache

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
Size 595B
SHA256 d4e60617c2afab8263febabe7f14f18595715078d71307a8cefe0707dae76dee
MD5 4454c8e578515db43fadd90604ae7675
SHA1 3912ffa00c3a5c86fae6500a0074284d9f668976
SHA512 b17559d466cb6954554c4f879b396ff8431c730f837205547ab46329c6517cd35a719378efa55d78c01b739414dd320157f120feb12e28e1ae90ce7c53a0c75c
TLSH
T117F0DC47E7B15216C926123CC89724E1B730F5917DD1162341056F5D2C373101F17CB8
MD5 SHA1 SHA512 TLSH

Submit Download

D7A51205FA388779612C60646645F2A3D0331E64

Path C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\SystemCertificates\My\Certificates\D7A51205FA388779612C60646645F2A3D0331E64
Size 1KB
SHA256 5c1fe1f1d6cc186a871a60de5a4eccbd381675c6029e0b05faa4a4544c693a9d
MD5 c6b91252a2bff0986e7b755dab069e40
SHA1 90076d221cebe88977224a29e64a1eee1ea2a410
SHA512 c86c617b153ce1dbfe1e6351f692b0963c9bc68bb8f65b486b2650b8310693284adaec2b7cfc17034ba451ccbcb49e559f7b925ca41212f935d9aa752a7de231
TLSH
T13721871397F49652FC827EB06DFA596BF9B4E9A04C10CA1F5406C0DD5B22769B362307
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_stpop1s5.wru.ps1

Path C:\Windows\SystemTemp\__PSScriptPolicyTest_stpop1s5.wru.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download