6746b18bd10aaf2ea21ad54f6a44e5aa1a63147f8d2a6e0e5b41d765433bb6f9

Analysis

max time kernel
148s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
29/09/2026, 12:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
cascadesapp.msi
Size 27.0MB
Sample260929-phebjazzfz
SHA256 6746b18bd10aaf2ea21ad54f6a44e5aa1a63147f8d2a6e0e5b41d765433bb6f9
MD5 09e090d3475d607921bd4f40c8f8afc1
SHA1 6987225c37d54bbc43c78fe94a830c66d6262187
SHA512 38ef0141923d04af5988aab2498eebe7d0d1744a08fb29dbb9c26789f3e5b33a4033bff8f693d10ecf3738e10a6cdded418d7b36cd3709a3dc621673f0be3fbe
SSDEEP 393216:5/qrxwEdjKwKpsEfgKh4Q4c8Fvo9EJpI/Q:5a2EdjKwKF4KR07u/Q
TLSH
T1AB57AD072670E416FA34D0B88D52C8F35A26B99F4610B5F776DC497527E2C632FBC8A8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence privilege_escalation ransomware

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
4292	OpsBridgeAgent.exe
1500	OpsBridgeAgent.exe

Loads dropped DLL 60 IoCs

pid	Process
4292	OpsBridgeAgent.exe
4292	OpsBridgeAgent.exe
4292	OpsBridgeAgent.exe
4292	OpsBridgeAgent.exe
4292	OpsBridgeAgent.exe
4292	OpsBridgeAgent.exe
4292	OpsBridgeAgent.exe
4292	OpsBridgeAgent.exe
4292	OpsBridgeAgent.exe
4292	OpsBridgeAgent.exe
4292	OpsBridgeAgent.exe
4292	OpsBridgeAgent.exe
4292	OpsBridgeAgent.exe
4292	OpsBridgeAgent.exe
4292	OpsBridgeAgent.exe
4292	OpsBridgeAgent.exe
4292	OpsBridgeAgent.exe
4292	OpsBridgeAgent.exe
4292	OpsBridgeAgent.exe
4292	OpsBridgeAgent.exe
4292	OpsBridgeAgent.exe
4292	OpsBridgeAgent.exe
4292	OpsBridgeAgent.exe
4292	OpsBridgeAgent.exe
4292	OpsBridgeAgent.exe
4292	OpsBridgeAgent.exe
4292	OpsBridgeAgent.exe
4292	OpsBridgeAgent.exe
4292	OpsBridgeAgent.exe
4292	OpsBridgeAgent.exe
4292	OpsBridgeAgent.exe
1500	OpsBridgeAgent.exe
1500	OpsBridgeAgent.exe
1500	OpsBridgeAgent.exe
1500	OpsBridgeAgent.exe
1500	OpsBridgeAgent.exe
1500	OpsBridgeAgent.exe
1500	OpsBridgeAgent.exe
1500	OpsBridgeAgent.exe
1500	OpsBridgeAgent.exe
1500	OpsBridgeAgent.exe
1500	OpsBridgeAgent.exe
1500	OpsBridgeAgent.exe
1500	OpsBridgeAgent.exe
1500	OpsBridgeAgent.exe
1500	OpsBridgeAgent.exe
1500	OpsBridgeAgent.exe
1500	OpsBridgeAgent.exe
1500	OpsBridgeAgent.exe
1500	OpsBridgeAgent.exe
1500	OpsBridgeAgent.exe
1500	OpsBridgeAgent.exe
1500	OpsBridgeAgent.exe
1500	OpsBridgeAgent.exe
1500	OpsBridgeAgent.exe
1500	OpsBridgeAgent.exe
1500	OpsBridgeAgent.exe
1500	OpsBridgeAgent.exe
1500	OpsBridgeAgent.exe
1500	OpsBridgeAgent.exe

Badlisted process makes network request 2 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
5	4452	msiexec.exe
7	4452	msiexec.exe

Enumerates connected drives 3 TTPs 64 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
	\??\F:\	powershell.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
	\??\F:\	powershell.exe
File opened (read-only)	\??\S:	msiexec.exe
	\??\F:\	powershell.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
	\??\F:\	powershell.exe
	\??\F:\	powershell.exe
	\??\F:\	powershell.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
	\??\F:\	powershell.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
	\??\F:\	powershell.exe
	\??\F:\	powershell.exe
	\??\F:\	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
	\??\F:\	powershell.exe
	\??\F:\	powershell.exe
File opened (read-only)	\??\X:	msiexec.exe
	\??\F:\	powershell.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
	\??\F:\	powershell.exe
	\??\F:\	powershell.exe
	\??\F:\	powershell.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
	\??\F:\	powershell.exe
File opened (read-only)	\??\X:	msiexec.exe
	\??\F:\	powershell.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
	\??\F:\	powershell.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
	\??\F:\	powershell.exe

Drops file in Program Files directory 39 IoCs

description	ioc	Process
File created	C:\Program Files\OpsBridge\_ssl.pyd	msiexec.exe
File created	C:\Program Files\OpsBridge\libffi-8.dll	msiexec.exe
File created	C:\Program Files\OpsBridge\win32event.pyd	msiexec.exe
File created	C:\Program Files\OpsBridge\win32ui.pyd	msiexec.exe
File created	C:\Program Files\OpsBridge\psutil\_psutil_windows.pyd	msiexec.exe
File created	C:\Program Files\OpsBridge\pythoncom313.dll	msiexec.exe
File created	C:\Program Files\OpsBridge\_hashlib.pyd	msiexec.exe
File created	C:\Program Files\OpsBridge\_wmi.pyd	msiexec.exe
File created	C:\Program Files\OpsBridge\charset_normalizer\md.pyd	msiexec.exe
File created	C:\Program Files\OpsBridge\certifi\cacert.pem	msiexec.exe
File created	C:\Program Files\OpsBridge\_lzma.pyd	msiexec.exe
File created	C:\Program Files\OpsBridge\vcruntime140_1.dll	msiexec.exe
File created	C:\Program Files\OpsBridge\charset_normalizer\md__mypyc.pyd	msiexec.exe
File created	C:\Program Files\OpsBridge\psutil\python3.dll	msiexec.exe
File created	C:\Program Files\OpsBridge\unicodedata.pyd	msiexec.exe
File created	C:\Program Files\OpsBridge\OpsBridgeAgent.exe	msiexec.exe
File created	C:\Program Files\OpsBridge\_decimal.pyd	msiexec.exe
File created	C:\Program Files\OpsBridge\_elementtree.pyd	msiexec.exe
File created	C:\Program Files\OpsBridge\_socket.pyd	msiexec.exe
File created	C:\Program Files\OpsBridge\_uuid.pyd	msiexec.exe
File created	C:\Program Files\OpsBridge\pyexpat.pyd	msiexec.exe
File created	C:\Program Files\OpsBridge\charset_normalizer\python3.dll	msiexec.exe
File created	C:\Program Files\OpsBridge\pywintypes313.dll	msiexec.exe
File created	C:\Program Files\OpsBridge\vcruntime140.dll	msiexec.exe
File created	C:\Program Files\OpsBridge\_ctypes.pyd	msiexec.exe
File created	C:\Program Files\OpsBridge\_queue.pyd	msiexec.exe
File created	C:\Program Files\OpsBridge\_win32sysloader.pyd	msiexec.exe
File created	C:\Program Files\OpsBridge\libcrypto-3.dll	msiexec.exe
File created	C:\Program Files\OpsBridge\libssl-3.dll	msiexec.exe
File created	C:\Program Files\OpsBridge\python3.dll	msiexec.exe
File created	C:\Program Files\OpsBridge\_bz2.pyd	msiexec.exe
File created	C:\Program Files\OpsBridge\perfmon.pyd	msiexec.exe
File created	C:\Program Files\OpsBridge\select.pyd	msiexec.exe
File created	C:\Program Files\OpsBridge\win32evtlog.pyd	msiexec.exe
File created	C:\Program Files\OpsBridge\python313.dll	msiexec.exe
File created	C:\Program Files\OpsBridge\servicemanager.pyd	msiexec.exe
File created	C:\Program Files\OpsBridge\win32service.pyd	msiexec.exe
File created	C:\Program Files\OpsBridge\.write_probe	OpsBridgeAgent.exe
File created	C:\Program Files\OpsBridge\win32api.pyd	msiexec.exe

Drops file in Windows directory 10 IoCs

description	ioc	Process
File created	C:\Windows\Installer\e58bb4c.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e58bb4c.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File created	C:\Windows\Installer\SourceHash{689AA284-8741-45A4-B8EA-0AD55DFF6D68}	msiexec.exe
File created	C:\Windows\Installer\e58bb4e.msi	msiexec.exe
File created	C:\Windows\Installer\{689AA284-8741-45A4-B8EA-0AD55DFF6D68}\OpsBridgeIcon.exe	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIBD50.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\{689AA284-8741-45A4-B8EA-0AD55DFF6D68}\OpsBridgeIcon.exe	msiexec.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 20 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
4240	powershell.exe
4384	powershell.exe
3020	powershell.exe
4864	powershell.exe
3716	powershell.exe
388	powershell.exe
3612	powershell.exe
3020	powershell.exe
4832	powershell.exe
4448	powershell.exe
4452	powershell.exe
3284	powershell.exe
2060	powershell.exe
1612	powershell.exe
2460	powershell.exe
4596	powershell.exe
2248	powershell.exe
3372	powershell.exe
3356	powershell.exe
4056	powershell.exe

Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs

persistence privilege_escalation

Installer Packages

T1546.016

Msiexec

T1218.007

pid	Process
4452	msiexec.exe

Event Triggered Execution: Netsh Helper DLL 1 TTPs 30 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
796	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	OpsBridgeAgent.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	OpsBridgeAgent.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	OpsBridgeAgent.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	OpsBridgeAgent.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000e01e56c99d3b8eb00000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000e01e56c90000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed35000000ffffffff000000000700010000680900e01e56c9000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff350000000000000005000000ffffffff000000000700010000f8ff1ae01e56c9000000000000f0ff350000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1de01e56c9000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28\52C64B7E\@%SystemRoot%\System32\fveui.dll,-844 = "BitLocker Data Recovery Agent"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe

Modifies registry class 23 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\482AA98614784A548BAEA05DD5FFD686	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\482AA98614784A548BAEA05DD5FFD686\SourceList\Media	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\482AA98614784A548BAEA05DD5FFD686\SourceList\Media\1 = ";"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\482AA98614784A548BAEA05DD5FFD686\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\482AA98614784A548BAEA05DD5FFD686	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\482AA98614784A548BAEA05DD5FFD686\PackageCode = "C82AA82A484BAC444BB3567C34C68D89"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\482AA98614784A548BAEA05DD5FFD686\Version = "50331657"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\482AA98614784A548BAEA05DD5FFD686\AdvertiseFlags = "388"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\482AA98614784A548BAEA05DD5FFD686\SourceList	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\482AA98614784A548BAEA05DD5FFD686\SourceList\Net	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\482AA98614784A548BAEA05DD5FFD686\Complete	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\482AA98614784A548BAEA05DD5FFD686\ProductName = "OpsBridge Agent"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\5E542C572D694D143B89E823897480C8	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\5E542C572D694D143B89E823897480C8\482AA98614784A548BAEA05DD5FFD686	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\482AA98614784A548BAEA05DD5FFD686\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\482AA98614784A548BAEA05DD5FFD686\Clients = 3a0000000000	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\482AA98614784A548BAEA05DD5FFD686\Language = "0"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\482AA98614784A548BAEA05DD5FFD686\Assignment = "1"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\482AA98614784A548BAEA05DD5FFD686\ProductIcon = "C:\\Windows\\Installer\\{689AA284-8741-45A4-B8EA-0AD55DFF6D68}\\OpsBridgeIcon.exe"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\482AA98614784A548BAEA05DD5FFD686\InstanceType = "0"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\482AA98614784A548BAEA05DD5FFD686\AuthorizedLUAApp = "0"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\482AA98614784A548BAEA05DD5FFD686\DeploymentFlags = "3"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\482AA98614784A548BAEA05DD5FFD686\SourceList\PackageName = "cascadesapp.msi"	msiexec.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4288	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2276	msiexec.exe
2276	msiexec.exe
4292	OpsBridgeAgent.exe
4292	OpsBridgeAgent.exe
4448	powershell.exe
4448	powershell.exe
4448	powershell.exe
1500	OpsBridgeAgent.exe
1500	OpsBridgeAgent.exe
4452	powershell.exe
4452	powershell.exe
4452	powershell.exe
3284	powershell.exe
3284	powershell.exe
3284	powershell.exe
4864	powershell.exe
4864	powershell.exe
4864	powershell.exe
3372	powershell.exe
3372	powershell.exe
3372	powershell.exe
3716	powershell.exe
3716	powershell.exe
3716	powershell.exe
388	powershell.exe
388	powershell.exe
388	powershell.exe
2060	powershell.exe
2060	powershell.exe
2060	powershell.exe
1500	OpsBridgeAgent.exe
1500	OpsBridgeAgent.exe
4292	OpsBridgeAgent.exe
4292	OpsBridgeAgent.exe
1612	powershell.exe
1612	powershell.exe
1612	powershell.exe
2460	powershell.exe
2460	powershell.exe
2460	powershell.exe
3356	powershell.exe
3356	powershell.exe
3356	powershell.exe
4384	powershell.exe
4384	powershell.exe
4384	powershell.exe
4292	OpsBridgeAgent.exe
4292	OpsBridgeAgent.exe
1500	OpsBridgeAgent.exe
1500	OpsBridgeAgent.exe
3612	powershell.exe
3612	powershell.exe
3612	powershell.exe
3020	powershell.exe
3020	powershell.exe
3020	powershell.exe
4292	OpsBridgeAgent.exe
4292	OpsBridgeAgent.exe
4596	powershell.exe
4596	powershell.exe
4596	powershell.exe
2248	powershell.exe
2248	powershell.exe
2248	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4452	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4452	msiexec.exe
Token: SeSecurityPrivilege	2276	msiexec.exe
Token: SeCreateTokenPrivilege	4452	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	4452	msiexec.exe
Token: SeLockMemoryPrivilege	4452	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4452	msiexec.exe
Token: SeMachineAccountPrivilege	4452	msiexec.exe
Token: SeTcbPrivilege	4452	msiexec.exe
Token: SeSecurityPrivilege	4452	msiexec.exe
Token: SeTakeOwnershipPrivilege	4452	msiexec.exe
Token: SeLoadDriverPrivilege	4452	msiexec.exe
Token: SeSystemProfilePrivilege	4452	msiexec.exe
Token: SeSystemtimePrivilege	4452	msiexec.exe
Token: SeProfSingleProcessPrivilege	4452	msiexec.exe
Token: SeIncBasePriorityPrivilege	4452	msiexec.exe
Token: SeCreatePagefilePrivilege	4452	msiexec.exe
Token: SeCreatePermanentPrivilege	4452	msiexec.exe
Token: SeBackupPrivilege	4452	msiexec.exe
Token: SeRestorePrivilege	4452	msiexec.exe
Token: SeShutdownPrivilege	4452	msiexec.exe
Token: SeDebugPrivilege	4452	msiexec.exe
Token: SeAuditPrivilege	4452	msiexec.exe
Token: SeSystemEnvironmentPrivilege	4452	msiexec.exe
Token: SeChangeNotifyPrivilege	4452	msiexec.exe
Token: SeRemoteShutdownPrivilege	4452	msiexec.exe
Token: SeUndockPrivilege	4452	msiexec.exe
Token: SeSyncAgentPrivilege	4452	msiexec.exe
Token: SeEnableDelegationPrivilege	4452	msiexec.exe
Token: SeManageVolumePrivilege	4452	msiexec.exe
Token: SeImpersonatePrivilege	4452	msiexec.exe
Token: SeCreateGlobalPrivilege	4452	msiexec.exe
Token: SeBackupPrivilege	4112	vssvc.exe
Token: SeRestorePrivilege	4112	vssvc.exe
Token: SeAuditPrivilege	4112	vssvc.exe
Token: SeBackupPrivilege	2276	msiexec.exe
Token: SeRestorePrivilege	2276	msiexec.exe
Token: SeRestorePrivilege	2276	msiexec.exe
Token: SeTakeOwnershipPrivilege	2276	msiexec.exe
Token: SeRestorePrivilege	2276	msiexec.exe
Token: SeTakeOwnershipPrivilege	2276	msiexec.exe
Token: SeBackupPrivilege	4088	srtasks.exe
Token: SeRestorePrivilege	4088	srtasks.exe
Token: SeSecurityPrivilege	4088	srtasks.exe
Token: SeTakeOwnershipPrivilege	4088	srtasks.exe
Token: SeRestorePrivilege	2276	msiexec.exe
Token: SeTakeOwnershipPrivilege	2276	msiexec.exe
Token: SeRestorePrivilege	2276	msiexec.exe
Token: SeTakeOwnershipPrivilege	2276	msiexec.exe
Token: SeRestorePrivilege	2276	msiexec.exe
Token: SeTakeOwnershipPrivilege	2276	msiexec.exe
Token: SeRestorePrivilege	2276	msiexec.exe
Token: SeTakeOwnershipPrivilege	2276	msiexec.exe
Token: SeRestorePrivilege	2276	msiexec.exe
Token: SeTakeOwnershipPrivilege	2276	msiexec.exe
Token: SeRestorePrivilege	2276	msiexec.exe
Token: SeTakeOwnershipPrivilege	2276	msiexec.exe
Token: SeRestorePrivilege	2276	msiexec.exe
Token: SeTakeOwnershipPrivilege	2276	msiexec.exe
Token: SeRestorePrivilege	2276	msiexec.exe
Token: SeTakeOwnershipPrivilege	2276	msiexec.exe
Token: SeRestorePrivilege	2276	msiexec.exe
Token: SeTakeOwnershipPrivilege	2276	msiexec.exe
Token: SeRestorePrivilege	2276	msiexec.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
4452	msiexec.exe
4452	msiexec.exe

Suspicious use of WriteProcessMemory 34 IoCs

description	pid	Process	procid_target
PID 2276 wrote to memory of 4088	2276	msiexec.exe	103
PID 2276 wrote to memory of 4292	2276	msiexec.exe	105
PID 4292 wrote to memory of 796	4292	OpsBridgeAgent.exe	106
PID 796 wrote to memory of 4288	796	cmd.exe	118
PID 4292 wrote to memory of 4448	4292	OpsBridgeAgent.exe	110
PID 1500 wrote to memory of 4452	1500	OpsBridgeAgent.exe	113
PID 4292 wrote to memory of 3284	4292	OpsBridgeAgent.exe	137
PID 1500 wrote to memory of 4864	1500	OpsBridgeAgent.exe	117
PID 4292 wrote to memory of 2984	4292	OpsBridgeAgent.exe	120
PID 1500 wrote to memory of 1704	1500	OpsBridgeAgent.exe	122
PID 4292 wrote to memory of 3372	4292	OpsBridgeAgent.exe	124
PID 1500 wrote to memory of 3716	1500	OpsBridgeAgent.exe	126
PID 4292 wrote to memory of 388	4292	OpsBridgeAgent.exe	128
PID 1500 wrote to memory of 2060	1500	OpsBridgeAgent.exe	150
PID 4292 wrote to memory of 2416	4292	OpsBridgeAgent.exe	133
PID 1500 wrote to memory of 4584	1500	OpsBridgeAgent.exe	136
PID 4292 wrote to memory of 1612	4292	OpsBridgeAgent.exe	143
PID 1500 wrote to memory of 2460	1500	OpsBridgeAgent.exe	145
PID 4292 wrote to memory of 3356	4292	OpsBridgeAgent.exe	147
PID 1500 wrote to memory of 4384	1500	OpsBridgeAgent.exe	149
PID 4292 wrote to memory of 2504	4292	OpsBridgeAgent.exe	151
PID 1500 wrote to memory of 1716	1500	OpsBridgeAgent.exe	153
PID 4292 wrote to memory of 3612	4292	OpsBridgeAgent.exe	156
PID 4292 wrote to memory of 3020	4292	OpsBridgeAgent.exe	158
PID 4292 wrote to memory of 1064	4292	OpsBridgeAgent.exe	160
PID 1500 wrote to memory of 4596	1500	OpsBridgeAgent.exe	162
PID 1500 wrote to memory of 2248	1500	OpsBridgeAgent.exe	164
PID 1500 wrote to memory of 3716	1500	OpsBridgeAgent.exe	166
PID 4292 wrote to memory of 4056	4292	OpsBridgeAgent.exe	171
PID 4292 wrote to memory of 3020	4292	OpsBridgeAgent.exe	173
PID 4292 wrote to memory of 2656	4292	OpsBridgeAgent.exe	175
PID 1500 wrote to memory of 4240	1500	OpsBridgeAgent.exe	177
PID 1500 wrote to memory of 4832	1500	OpsBridgeAgent.exe	179
PID 1500 wrote to memory of 4640	1500	OpsBridgeAgent.exe	181

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\cascadesapp.msi
1⤵
- Badlisted process makes network request
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4452

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2276
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4088
- C:\Program Files\OpsBridge\OpsBridgeAgent.exe
  "C:\Program Files\OpsBridge\OpsBridgeAgent.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Program Files directory
  - Reads the TCP/IP host and domain name from the registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4292
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "schtasks /Create /TN "OpsBridge Agent" /XML "C:\Users\Admin\AppData\Local\Temp\tmplcxrhvh2.xml" /F"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:796
  - - C:\Windows\system32\schtasks.exe
      schtasks /Create /TN "OpsBridge Agent" /XML "C:\Users\Admin\AppData\Local\Temp\tmplcxrhvh2.xml" /F
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:4288
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "(Get-NetRoute -DestinationPrefix '0.0.0.0/0' | Select-Object -First 1).NextHop"
    3⤵
    - Enumerates connected drives
    - Command and Scripting Interpreter: PowerShell
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    PID:4448
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "(Get-DnsClientServerAddress -AddressFamily IPv4).ServerAddresses | Select-Object -Unique | ConvertTo-Json -Compress"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    PID:3284
- - C:\Windows\system32\netsh.exe
    netsh wlan show interfaces
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:2984
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "(Get-NetRoute -DestinationPrefix '0.0.0.0/0' | Select-Object -First 1).NextHop"
    3⤵
    - Enumerates connected drives
    - Command and Scripting Interpreter: PowerShell
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    PID:3372
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "(Get-DnsClientServerAddress -AddressFamily IPv4).ServerAddresses | Select-Object -Unique | ConvertTo-Json -Compress"
    3⤵
    - Enumerates connected drives
    - Command and Scripting Interpreter: PowerShell
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    PID:388
- - C:\Windows\system32\netsh.exe
    netsh wlan show interfaces
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:2416
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "(Get-NetRoute -DestinationPrefix '0.0.0.0/0' | Select-Object -First 1).NextHop"
    3⤵
    - Enumerates connected drives
    - Command and Scripting Interpreter: PowerShell
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    PID:1612
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "(Get-DnsClientServerAddress -AddressFamily IPv4).ServerAddresses | Select-Object -Unique | ConvertTo-Json -Compress"
    3⤵
    - Enumerates connected drives
    - Command and Scripting Interpreter: PowerShell
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    PID:3356
- - C:\Windows\system32\netsh.exe
    netsh wlan show interfaces
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:2504
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "(Get-NetRoute -DestinationPrefix '0.0.0.0/0' | Select-Object -First 1).NextHop"
    3⤵
    - Enumerates connected drives
    - Command and Scripting Interpreter: PowerShell
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    PID:3612
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "(Get-DnsClientServerAddress -AddressFamily IPv4).ServerAddresses | Select-Object -Unique | ConvertTo-Json -Compress"
    3⤵
    - Enumerates connected drives
    - Command and Scripting Interpreter: PowerShell
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    PID:3020
- - C:\Windows\system32\netsh.exe
    netsh wlan show interfaces
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:1064
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "(Get-NetRoute -DestinationPrefix '0.0.0.0/0' | Select-Object -First 1).NextHop"
    3⤵
    - Enumerates connected drives
    - Command and Scripting Interpreter: PowerShell
    - Modifies data under HKEY_USERS
    PID:4056
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "(Get-DnsClientServerAddress -AddressFamily IPv4).ServerAddresses | Select-Object -Unique | ConvertTo-Json -Compress"
    3⤵
    - Enumerates connected drives
    - Command and Scripting Interpreter: PowerShell
    - Modifies data under HKEY_USERS
    PID:3020
- - C:\Windows\system32\netsh.exe
    netsh wlan show interfaces
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:2656

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:4112

C:\Program Files\OpsBridge\OpsBridgeAgent.exe
"C:\Program Files\OpsBridge\OpsBridgeAgent.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1500
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -Command "(Get-NetRoute -DestinationPrefix '0.0.0.0/0' | Select-Object -First 1).NextHop"
  2⤵
  - Enumerates connected drives
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:4452
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -Command "(Get-DnsClientServerAddress -AddressFamily IPv4).ServerAddresses | Select-Object -Unique | ConvertTo-Json -Compress"
  2⤵
  - Enumerates connected drives
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:4864
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:4288
- C:\Windows\system32\netsh.exe
  netsh wlan show interfaces
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:1704
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -Command "(Get-NetRoute -DestinationPrefix '0.0.0.0/0' | Select-Object -First 1).NextHop"
  2⤵
  - Enumerates connected drives
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:3716
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -Command "(Get-DnsClientServerAddress -AddressFamily IPv4).ServerAddresses | Select-Object -Unique | ConvertTo-Json -Compress"
  2⤵
  - Enumerates connected drives
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:2060
- C:\Windows\system32\netsh.exe
  netsh wlan show interfaces
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:4584
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:3284
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -Command "(Get-NetRoute -DestinationPrefix '0.0.0.0/0' | Select-Object -First 1).NextHop"
  2⤵
  - Enumerates connected drives
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:2460
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -Command "(Get-DnsClientServerAddress -AddressFamily IPv4).ServerAddresses | Select-Object -Unique | ConvertTo-Json -Compress"
  2⤵
  - Enumerates connected drives
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:4384
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:2060
- C:\Windows\system32\netsh.exe
  netsh wlan show interfaces
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:1716
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -Command "(Get-NetRoute -DestinationPrefix '0.0.0.0/0' | Select-Object -First 1).NextHop"
  2⤵
  - Enumerates connected drives
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:4596
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -Command "(Get-DnsClientServerAddress -AddressFamily IPv4).ServerAddresses | Select-Object -Unique | ConvertTo-Json -Compress"
  2⤵
  - Enumerates connected drives
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:2248
- C:\Windows\system32\netsh.exe
  netsh wlan show interfaces
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:3716
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -Command "(Get-NetRoute -DestinationPrefix '0.0.0.0/0' | Select-Object -First 1).NextHop"
  2⤵
  - Enumerates connected drives
  - Command and Scripting Interpreter: PowerShell
  PID:4240
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -Command "(Get-DnsClientServerAddress -AddressFamily IPv4).ServerAddresses | Select-Object -Unique | ConvertTo-Json -Compress"
  2⤵
  - Enumerates connected drives
  - Command and Scripting Interpreter: PowerShell
  PID:4832
- C:\Windows\system32\netsh.exe
  netsh wlan show interfaces
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:4640

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Event Triggered Execution

T1546

Installer Packages

T1546.016

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Event Triggered Execution

T1546

Installer Packages

T1546.016

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

System Binary Proxy Execution

T1218

Msiexec

T1218.007

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e58bb4d.rbs

Path C:\Config.Msi\e58bb4d.rbs
Size 13KB
SHA256 9bb8b9f800555631f03c8f7454fdf93eec34eca357c540904f0241884912d649
MD5 8c78bfcc8f90e5987967bcd4b0193e3b
SHA1 93597c0a7c5054412e54d1c48377a1196a57814d
SHA512 e840f5ace2286c0f2490daf70579c2b3209eb38067e12eea8f73239c8771e041b07a93c5177fccf93d364b4a37ea63f7a7977e90fdaaf9b265060e23a739159e
SSDEEP 384:ZkM4Ei1/F0mNMGmMtWRE8D5vnGqptfdpv7KoJ5vks5I0wtR0R+a4x8:ZkVEi1/F0mNMGmMtWRE8NvnGqptfdpvl
TLSH
T165524699C801C3D2E18A96F09FC26A0E7F95C79C5360231F6FCC8625DE61B841FA56BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_socket.pyd

Path C:\PROGRA~1\OPSBRI~1\_socket.pyd
Size 83KB
SHA256 bced17d6f081d81ea7cd92f1e071e38f8840e61ee0fe1524221b776bcfa78650
MD5 566cb4d39b700c19dbd7175bd4f2b649
SHA1 bede896259b6d52d538c2182aef87c334fc9c73c
SHA512 6a26fd59e2c2ec34b673ef257a00d5577f52286d78525d05efc8a88760fb575be65c3e94e83396f4978c8734b513afe7f09d3c49474169144f98add406530367
SSDEEP 1536:2xl/h+6SDo3OkB+ecI4xyJwAQlyJ+9+nzhjTm96tsJ4O05IgywpytH/9ofIbw:2xko35X4yJwAQlyJs+nzNq96yw5Igyw3
TLSH
T17C837C00A6A041FAEB63D0B5C2679E63FB74B5C11391A35F0066C55A1F337C2AF7AB46
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

win32api.pyd

Path C:\PROGRA~1\OPSBRI~1\win32api.pyd
Size 145KB
SHA256 77d31573dd7ae7bfd31320ae9d1b7b1a11827dd7329f4fb4ff1e511363149bd9
MD5 c616ce119be2969eb269923a07e8d75a
SHA1 4281ab2c00ed2fe2cf39334a493c5382be928a63
SHA512 3b50ef8f468dfc4dbd3c04bcf06980c7eaddde3d97bbac0571295ed6a030c3e277b786854c8fe662c68955feba279af2d9d167b513fd3fc5e76ae8205bce1939
SSDEEP 3072:K7AK00RjZk+uEIvPlRVlhLaN/PSexhlT9qTmP9bDm/GgUXJkeMdqLZO:uAF0fu73lRVsPSexhbqyvcGg0GOZO
TLSH
T18EE31783B35410C6D86AA37CC1675E23DB72B8240725A7CF06A0C68A1F63BE97D3D795
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OpsBridgeAgent.exe

Path C:\Program Files\OpsBridge\OpsBridgeAgent.exe
Size 17.3MB
SHA256 bc334e5a541bbbb9edc410160882612aa6d8adfffc7482e60f3e97caa6d194c0
MD5 047b30f95472f0cea51d562880a8c775
SHA1 c4748571f44880c46a8bbade8632ece2f9a5e17a
SHA512 6a57459a145ced644874d3581de9cdf0eef1b2d0a368ea6ba76c63004c8bdb6d15b9817771da9ed71f75b407a72f4b448809e64b7b613025ef1c966855b18139
SSDEEP 98304:TTULVDpSB1Za/FU+gbT5+w9O172pB1w75at/3aKUsvm5WhrYnznoeztsLODRB4ud:u5at/H9+OYxXgXcYtMdjKLpVYiYb
TLSH
T1890759072670E416FA34D0B88D52C8F35A26B99F4610B5F376DD497627D2C632FBC8A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VCRUNTIME140.dll

Path C:\Program Files\OpsBridge\VCRUNTIME140.dll
Size 117KB
SHA256 052ad6a20d375957e82aa6a3c441ea548d89be0981516ca7eb306e063d5027f4
MD5 32da96115c9d783a0769312c0482a62d
SHA1 2ea840a5faa87a2fe8d7e5cb4367f2418077d66b
SHA512 616c78b4a24761d4640ae2377b873f7779322ef7bc26f8de7da0d880b227c577ed6f5ed794fc733468477b2fcdb7916def250e5dc63e79257616f99768419087
SSDEEP 1536:Z9TXF5YXWbj8qr51XlN+dULTCe1IGhKWyxLiyaXYaNxoecbdhUoaLjTz164zEd:ZEnsvReGsWyxLizXFkecbd1aPTzW
TLSH
T10DC38C8572A002FBD16AC274C1A36A17FB75B94487B0A7CF03B58A650F53BE09E3D356
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_bz2.pyd

Path C:\Program Files\OpsBridge\_bz2.pyd
Size 83KB
SHA256 449058efc99fccb9e24d640084d845c78f3f86dd34c5c126cf69e523d6320d75
MD5 684d656aada9f7d74f5a5bdcf16d0edb
SHA1 f7586da90d101b5ee3fa24f131ee93ab89606919
SHA512 27fb2eca382675316fb96d18a1aa6b2792077481bf899cbcc658d71f787876045c05c98abf129c9670b6a1d2654d57f59e17580139fa7f482ec27234e44d4235
SSDEEP 1536:Q5qJ1z7AwZG1xIdYxMpC76ROURNf/86bskFIgLVaytH/9bfIivj:iqTzwqdYrmrfk6wkFIgLVyGj
TLSH
T13E839E82E39857F6F45B81B986C00797F770BA91075053AFF298C2962F03F916E5C36A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ctypes.pyd

Path C:\Program Files\OpsBridge\_ctypes.pyd
Size 130KB
SHA256 5c0d5082fba1a2a3eb8d5e23073be25164c19f21304b09cecaab340dc7198815
MD5 29873384e13b0a78ee9857604161514b
SHA1 110f60f74b06b3972acd5908937a40e078636479
SHA512 ca826ff5403700e6d8822634e364e43b14ef829095d8fe365b49731236f696fe86ffa3853cd1801dc3b7800d005a032fe23bbc25befe3952ef37790d56dee3c5
SSDEEP 3072:k/QCY6XPLj8N4qvAQBhNf/FTmITIJ+B8sZ75IgyPUW4I3U:uQCXPLjNENBPf/FTXTy+B82l
TLSH
T169D37E0B736800AADAA79178C573AF47EBB1B453121147CF02E4C59A2F637E26E7E315
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_hashlib.pyd

Path C:\Program Files\OpsBridge\_hashlib.pyd
Size 63KB
SHA256 52f29aebe9886e830dedc363cd64eb53b6830d84b26e14f1b6faa655a0900b5d
MD5 3e540ef568215561590df215801b0f59
SHA1 3b6db31a97115c10c33266cce8ff80463763c7e6
SHA512 21497a4d1d999a420ed0e146544f4149c72ad4aca4b869a0ee83267d92afa07609ece76a4e95ec706a21580d6544146d0a58c0baa01aa2c242474a4816108527
SSDEEP 1536:GzQGcrVBtIMh2AZvgLbKwps4RdIgvIMytH/918fI38VM1:CSrVBtuWyWos4RdIgvIdlIW
TLSH
T129539E49A2844096CA6752B8CAD39E87F6B5F2525340ABDF0354C0CE2F237C3D77A766
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_lzma.pyd

Path C:\Program Files\OpsBridge\_lzma.pyd
Size 155KB
SHA256 48f16b587c6faa44a9e073365b19599200b0f0a0ccb70121e76c2dac4ed53281
MD5 d63e2e743ea103626d33b3c1d882f419
SHA1 af8a162b43f99b943d1c87c9a9e8088816263373
SHA512 d3f1450b5def3c21f47c5133073e76d2ec05787eb6ae88bb70d3a34be84f6025540ac017e9415bb22ef36c2ffbfcea38a28842eefe366325f3d3cf2cca1a3cb1
SSDEEP 3072:D0Vfr5vC9v2J2dE2AomznfB9mNoVhDLaztJLFIg01twW:DSr5YBo5YOVEpJLEh
TLSH
T10EF35B86B794F0D6F7728C38D6624F57E7F5781A0320929A01CC936D2B1FB659A2E313
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_queue.pyd

Path C:\Program Files\OpsBridge\_queue.pyd
Size 34KB
SHA256 af8ac8ab8b39f53b5dc192fbf58ad704a709db34e69753b97b83d087202e3a36
MD5 cc0f4a77ccfe39efc8019fa8b74c06d0
SHA1 77a713cd5880d5254dd0d1cbfe0d6a45dfc869ce
SHA512 ffea0bd7f73b6c02df6ff37ef39b8e54e480a4cc734fb149adc5c7410f445effd1fdd4f24e4619f7158913a50c28cc73629524d1a7389101a75257d5652c7823
SSDEEP 768:gFJpl1K6rdzuds5Ig9Uz1OytxJEKrLy2Ip4ETxf1mlWZG8vzcrDZ1:gDrddzuds5Ig9UcytH/9YfIW44zcrD
TLSH
T133F28ECAAA584487EA53CA70C2E7EE52F835B7D35611479F3055D28D2E273C1F32A329
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ssl.pyd

Path C:\Program Files\OpsBridge\_ssl.pyd
Size 177KB
SHA256 3301ff340d26495c95108199b67fdf3402742d13070af8b6bf4eb2e0c5e13781
MD5 689f1abac772c9e4c2d3bad3758cb398
SHA1 fe829e05d9f7838d1426f6d4a2f97165c09fd0f7
SHA512 949404a76c731a92074b37ec0bba88d873e56327b335b6c300eff68c2b142e194b58df59158b9bb92a5984c768b474f5db5f80f6b610f6cca78763604041bd82
SSDEEP 3072:HTzN6X1nguzjfU6C3JEMyn6osf87vOifHZHmzisFIgL7RYt:HTzgX5gIU6C39yn+2sQt
TLSH
T1D5047C47B5842AFBD813E4B9C2234903EBB1F155331257DE48D6E6490F03B46AE6AB73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_win32sysloader.pyd

Path C:\Program Files\OpsBridge\_win32sysloader.pyd
Size 25KB
SHA256 0ac205b8ecb01e573ac95f001a259ddf613f63d8358b04b90d13582666e34502
MD5 fb891224d98def8b0753bc6fdb70ac45
SHA1 b9889eaac696e558eb150dabd77e05a57aadf52a
SHA512 03625de561f2bba40123f2677a90dc06e4784bee785df18023ab1beb4940aed5e26a180b87533c4fd57dfe52383a21ae2a750dc4fcb28b276b76cb8a0127259e
SSDEEP 384:dqm8dKXx8Hkwly4Y3s/0uvVL7/iLdwFsEYwVJCBKmMwUaym/FP9m:d+d28Hkwlyx3s/Dv97/iWFdqARwLyKS
TLSH
T1D1B25AC2BF5940D6E8A3C638C0F31F57AE37B9A51721129F02B281151D9A7D07F2EA6C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_wmi.pyd

Path C:\Program Files\OpsBridge\_wmi.pyd
Size 38KB
SHA256 ebd252d21af9c84128fca04c994093a5bd6ee857f1581f06f4026fdd6a2c40e0
MD5 47e6fd132f44a4feb595bd0fda3c4e1c
SHA1 37c6c2c1ff309db7273afc9324a37b716c5cbfdb
SHA512 69c031d4ff2dac70739f9c188fca3c6969304f22782adf5a9c0ca303a3a712630541bda888ef25d3252b46d43df56f6e7e03c83d331840088c4224d1a1a512c4
SSDEEP 768:nEkKVVUWO0X1ctqDFIgLi6OytxJEKrLy2Ip4RsCxf1mljr8VMOj:nE9v3JctqDFIgLi1ytH/9R1fI38VMi
TLSH
T1AC037D8AE2640046E663DAB5C9A6CE53F571B7C36B11D38F365582990F233C0E73A336
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

md.pyd

Path C:\Program Files\OpsBridge\charset_normalizer\md.pyd
Size 20KB
SHA256 dfd405d475319202deccb16929177c641d62b44f27f5902874a21c1213cc62e3
MD5 4116680ae190c2a0108babb875cf7266
SHA1 3c08ac0816e5deb0a98d4cd8d3ba5ca0f3ee9222
SHA512 0a6ed3c62a4be42962ffd0365e2faf47a006e208632bc555f7cf656822b2b8f47ae3920cb8e1d4b36f00fc98d4e8aea86cf66066995bc1cf90675ede730aa549
SSDEEP 384:7zx4m446oDZuI8AeiLdwFsEYwVJCRbjKmMwUaym/F+9+E:7z6s6o1VJfWFdqRCRwLyK4
TLSH
T1E4926C9AEE2954E2EE828A34C0D25D17BD33BB81170576DF5334C0156EC67F27A3A22D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

md__mypyc.pyd

Path C:\Program Files\OpsBridge\charset_normalizer\md__mypyc.pyd
Size 133KB
SHA256 4f4bc686dbc4d609f21155a567f3e569312dd9e672658b3c7dd1b87e3da6b229
MD5 bca51081cd46127b76962faf5840ae10
SHA1 776970b66e10cf0f2fb26bc18f0b0ff27218001e
SHA512 eab66aadd3f89a9b5c8b2c4b2fd803622feb15765a0fbe2470261f78fa452117b6a17fd0ae223028a65a2424805b8f78bc1248e334051d53ccebc1d68180913f
SSDEEP 3072:rdOHcsVOUm2jVPoV9wsBOYtvsHgFXYwbOUwkdqXo:Y8frBntIwbOm+o
TLSH
T19AD32A67529500B7CA634179CCB7A513DBF2B5510B3263CF04A4C69A6F03BD6AEBEB01
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libcrypto-3.dll

Path C:\Program Files\OpsBridge\libcrypto-3.dll
Size 5.0MB
SHA256 ccfffddcd3defb8d899026298af9af43bc186130f8483d77e97c93233d5f27d7
MD5 ae5b2e9a3410839b31938f24b6fc5cd8
SHA1 9f9a14efc15c904f408a0d364d55a144427e4949
SHA512 36ea760a7b56ea74174882155eddfb8726828240fcfc6b34d90ecdb7e50a7e632374dcbc9b2889081c0973cc51f50967e7d692498c4abd1f2cba3f7fe8d659cc
SSDEEP 98304:M3+lrVT/8LpQmNPMRLuPWv1CPwDvt3uFlDCJ:6yrVT/8LvPMRLui1CPwDvt3uFlDCJ
TLSH
T1F8368B6AA7A80148E4BAC13CC9534617D2B1F85A57B097CF18A1967D0F37FDA2B3E740
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libffi-8.dll

Path C:\Program Files\OpsBridge\libffi-8.dll
Size 38KB
SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
MD5 0f8e4992ca92baaf54cc0b43aaccce21
SHA1 c7300975df267b1d6adcbac0ac93fd7b1ab49bd2
SHA512 6e1b223462dc124279bfca74fd2c66fe18b368ffbca540c84e82e0f5bcbea0e10cc243975574fa95ace437b9d8b03a446ed5ee0c9b1b094147cefaf704dfe978
SSDEEP 768:NiQfxQemQJNrPN+moyijAc5YiSyvkIPxWEqG:dfxIQvPkmoyijP7SytPxF
TLSH
T10B037C0B458418A4E657D53D97A64A2AC335B9240B60F2CB03D4C2BA3F6B7D6FB7C358
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libssl-3.dll

Path C:\Program Files\OpsBridge\libssl-3.dll
Size 776KB
SHA256 007142039f04d04e0ed607bda53de095e5bc6a8a10d26ecedde94ea7d2d7eefe
MD5 8d4805f0651186046c48d3e2356623db
SHA1 18c27c000384418abcf9c88a72f3d55d83beda91
SHA512 1c4895d912f7085d6e46f6776034c9e3d8d7bf934be858683bf6dedb13abca360ba816d8a5528ec7a3ac6e33010fdb6fc89b2699b5cfeedaabfdd5df143dffd1
SSDEEP 12288:SLN1sk7YJkC4IAXjdA372WWLmyhTs2bmFe9Xb:SLglJkC4IAhA372WWL3YBFe9Xb
TLSH
T1D8F44BAD73B8059CD8B6C17D86934623E3B6F4563330EBEB06518A790F277D51B3A248
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_psutil_windows.pyd

Path C:\Program Files\OpsBridge\psutil\_psutil_windows.pyd
Size 78KB
SHA256 c5196da079f7d3b630e748fd7c23c5810a313cc7a5255a2ca05bd06d6ae32612
MD5 84b981872f66541695d9c499f84ea0d4
SHA1 95ef04c5124357a8b91983df0305ec7e42bdfa4f
SHA512 c2b19b69da8980968eda3ba06e825656d8865d7d6f20757aa9fe422b1faa2ff672b466931cd0dac2ae56bf561e06bbd9e099772074d6a74a08b19e1b57c945d1
SSDEEP 1536:MCZzwq2+SBRJdpZnJbPoPVM04YnUjHmCHWFdqFRRK+:jZzkBhpZn4M04qMmNdqFx
TLSH
T198733996B75800F8D95B913C9AF26A37EBB2B091132557DF0160C64A0FA3BD36E7DB01
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python3.dll

Path C:\Program Files\OpsBridge\psutil\python3.dll
Size 69KB
SHA256 fdd54b6c495e9278e73d68203fff0c300e416e704852908cf5b06666cffead51
MD5 d6dfb6a9518a57e180980f7a07098d7d
SHA1 6026120461f5cbcd9255670b6a906fd8f5329073
SHA512 2a0195a5038d7530b64a506a70de3a6b9cb64ca9206006e03f726b4420304e3a76c10fdda12c8a51f4dbd63e7112fd7e7727a4ab94e7a111587e4248a6b26a62
SSDEEP 768:lQEotsskOv6pWVCB4p/uKlZPRQcFIc9qunV0Jku/YFI1Hu1wEBbCpVNyD6VdPxi1:jotssyKcunV8P65Igy0lytH/9QfIiAW
TLSH
T17E633BC25B5BF8A2D6F665FC78DDD9CD242B02CC57268D9FA47893920F1A310A22734D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python313.dll

Path C:\Program Files\OpsBridge\python313.dll
Size 5.8MB
SHA256 69fd86ea29370697c203f7e12830084f920f490766a8e3045af52c036a9ad529
MD5 7387fe038ea75eb9a57b054fccfe37bf
SHA1 5c532cbdfd718b5e80afb2ee8dea991e84757712
SHA512 c46c982b04079ed0b13617b81168598632d6c58d29e23fcbfa064b08e5836866b74880e1a9c01c12670531f13521a21177aafb10be0abb329a79291d7bff08bd
SSDEEP 98304:+nN+czHO42c7SZerAItxv7HDMiExa0RB2d:Fc7O45mwCiP0RB2d
TLSH
T1E1568D16739D51ACC97B8078CA03864BFBB27C053E60934B61E6BB5D2F733624A6E705
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pywintypes313.dll

Path C:\Program Files\OpsBridge\pywintypes313.dll
Size 142KB
SHA256 468468d96d2131340cfa3904883f735cfd97b47bdcde810814558fc459036e6b
MD5 2651e404b252ecb6646d50f55a4133da
SHA1 f7df2f8095560f698478528fb54f5995d4e3e999
SHA512 f7758fbbd8d616f2aea4eb439f3fe42a856e6b48fd7199d8201e62361b69a9032f03c1831a072f4c2732cc2914d9d2a487729e5510c8bcdc1ceb430617d337a3
SSDEEP 3072:/dyqdYmyWa5br4d1qfGHrY/rZ6Yr2laFU4LGUgl4jptIaiTandqs0:/4aYlWa9r61LrY/rPbFU4NgOjptIip0
TLSH
T191E33A47374684DAE9669379CDB71A03D7A2B0000711E3CF46A1C28B6F63BE66D3B746
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

select.pyd

Path C:\Program Files\OpsBridge\select.pyd
Size 31KB
SHA256 6393121130a3e85d0f6562948024d8614c4c144b84ab102af711c638344d1599
MD5 715a098175d3ca1c1da2dc5756b31860
SHA1 6b3ec06d679c48bfe4391535a822b58a02d79026
SHA512 e92edb98427f594badec592493469d45deab3b71e4598d544d0b9a1acffd5327a19c09029fb79d70971cb0ed0dba56056bef8455534d3f16ec35eac723062f3c
SSDEEP 768:kCOBHfjKe5Ig9GWOytxJEKrLy2Ip4gj6Cxf1mlY6Csr:kCOB/jKe5Ig9GJytH/9+fIii
TLSH
T1BCE27D8BAB745047FA63C671C6A6CE03F939B7A3971142CF30A5D1891E137C1A73A365
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

servicemanager.pyd

Path C:\Program Files\OpsBridge\servicemanager.pyd
Size 51KB
SHA256 30457f89e6fc9f44670625b58f8b4266b8524001e7e596323cb966834bf914d2
MD5 1e7e53ec1b88f63e205576c38dc8d660
SHA1 f615323e7e044d95f1194d4baa2c6b4387e7a797
SHA512 569d0afa0b2f43015b7babbdd93a8cd2fd659976f50b2ee9eecaea9e31a76c6f92d39d3d73464205a2d95ac2fbf9f48019025b2a80a67a9e519e6a4c34bf5970
SSDEEP 1536:t0ldu4SMi6x1DDDRuuLCwhaXoCCPsWFdqvRRK/:tWg4SMVx1DDDEICwhaXoXPBdqv8
TLSH
T123333B4767A64059F573A638D4F306739A32B8811B75A2CF0260C50E3EB2BD47D35BAE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

unicodedata.pyd

Path C:\Program Files\OpsBridge\unicodedata.pyd
Size 695KB
SHA256 071494856fdad0042964769aa2fb1de4ea95c2cfcbe27cc7132293c68d13d710
MD5 503b3ffa6a5bf45ab34d6d74352f206b
SHA1 cc13b85281e5d52413784e0b65a61b1d037c60cc
SHA512 d20b860974161caa60a62268968af353ad8063589f57d71f57c91855eb83da78f40bae7aa745cc7a945d92ebe08cf244c9560ae93449de45b20a8b8fff9f5010
SSDEEP 12288:9YLdLI/X77mvfldCKGihH32W3cnPSqrUguJS:9YLW7qNxr3cnPXuJS
TLSH
T1FDE4F6D5BBCF8D26E69B363948E3710F5171C3735F0A863AB2182361D85B3B449D582E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcruntime140_1.dll

Path C:\Program Files\OpsBridge\vcruntime140_1.dll
Size 48KB
SHA256 6a99bc0128e0c7d6cbbf615fcc26909565e17d4ca3451b97f8987f9c6acbc6c8
MD5 c0c0b4c611561f94798b62eb43097722
SHA1 523f515eed3af6d50e57a3eaeb906f4ccc1865fe
SHA512 35db454dbcc7ed89842c0440b92ce0b0b0db41dbd5432a36a0b7e1eddf51704b1f0d6cff5e3a3b0c3ff5db3d8632fed000471180ad72e39d8dbe68a757ccdfb0
SSDEEP 768:vzzO6ujT3MbR3v0Cz6Sz5q83ywug1HDV9zxfYbK9z:mq/oMx3hXHDnzxfYiz
TLSH
T1AE236BA453784486D4AB99B0C0DAEE577D7CFA964B10928F0BA0D15C1F637D0EB3D21B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

win32event.pyd

Path C:\Program Files\OpsBridge\win32event.pyd
Size 39KB
SHA256 4699cb4d6b8500bebeb51fce248c63446c4eeb57197a38e7b1086beaa4e590df
MD5 52ca3e63d6e159ba4985a5fd0b5fed25
SHA1 f4e582be04c8ea70a1874a0e19c7292dfb12a015
SHA512 80472cf00a7ae9d67d2d4ab89e0429c5c1d7418c14c64c3b0acbe8a8454bc8b01f9fc6cade60bcb796ecb08c0a7f98982aff0e35d3d8305f566c1d7d3eb3cd2d
SSDEEP 768:eaWut7Goxs5Llg+Ebc/jhfWddbcrb8l/99mku36U4a4+WFdqMRwLyK:e8Rc/jhfWddbcH8l/99mku36U4a4+WFE
TLSH
T1D70328C727686096E967C53CD4961E07EA73B96003A0B3EF0222D51A1F663E17B3DB4D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

win32service.pyd

Path C:\Program Files\OpsBridge\win32service.pyd
Size 68KB
SHA256 60a9a3ec8280aa911745199d7207dddfe2d4e030b4033a56917095591830086d
MD5 eb6ab7dbadb18dee2aa155ab2e25fff4
SHA1 a095934ce2ef1e2f89725fabef4c2df6623e364e
SHA512 05c9ed15ad71db8bb5c4e8a39440fb77d4ed3565d2e9c5c09df3d097407738ace7f5fd4ae9f78d2402dfb5c9ecc167db9bb5a26b6691753daf7358478bd8235f
SSDEEP 1536:3e7pZxWJERz66jkltv/vN66NuSs7jNYWFdqdRRK6:ibnW3166oSsvN9dqd5
TLSH
T1A0633A4BA35611D5E826C2BCC5A31F53EA72B804239076CF43D1C6491FA7BC47E3AA96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

install.log

Path C:\ProgramData\OpsBridge\install.log
Size 563B
SHA256 fcc43b7a0ad8122a2bbc2d8709e625cf163dd8a686f9afe45d8875674c71ec3e
MD5 61dd9c94cbf1d057ea07e9c338dc3dce
SHA1 2cb75b3d2b3b3e43d918e5fbc477aa61517e6581
SHA512 0f7910c8953cda5eb52d9b53fdb158f15d38e7bcb82539c3529d27066970d27008dbc58a13426a40ae2acc8d9a1f5812493a0fa3a10c1227eb4355381cee9fcc
TLSH
T142F0AFC1A0F489E2A600E63143AD2F9D0AB3E7099AC45F947BC652226D12D1C19A5879
MD5 SHA1 SHA512 TLSH

Submit Download

248DDD9FCF61002E219645695E3FFC98_8917492CE75464A1248BEB74B8323916

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\248DDD9FCF61002E219645695E3FFC98_8917492CE75464A1248BEB74B8323916
Size 751B
SHA256 61fae37ccdd62e1c9472b20161f359fb90f8c1ed119eabf7c0d06c2c8400c4d5
MD5 5a7a269cae2deb60c45879993d73df04
SHA1 dba4c3ad8711fa77b2d2b790cb6de4c33eb39894
SHA512 e13df3e0f395f11d39787ae1dc2c2211f1c093d598feb455cca4a6ec3721e878bf9721ee2dae4d610399b3a7686f1d6b1d6b8e0fb389039422bf6e4fcbad3b2c
TLSH
T1C901250717740C6129598D56DAF6552D123D24A868F0D65A2BA1C5C2E610BB43CD6411
MD5 SHA1 SHA512 TLSH

Submit Download

FE17BEC2A573BC9AE36869D0274FFA19_6DA81F04C5F9EAD2CD0268808FCE61E1

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\FE17BEC2A573BC9AE36869D0274FFA19_6DA81F04C5F9EAD2CD0268808FCE61E1
Size 727B
SHA256 788eba4674436a2eba66c6c7553867183a9d38fed91910df2b4e659a95314374
MD5 f0296583f576398f3ac7a59cd3c4e000
SHA1 f52e510556c1da8ea0cee5caa25d3fd9339a9e18
SHA512 6e3ce3633a071b0cd21cf409467fdc245fa7d1f6daed2ca7a1e89d2f521eff63c430bc7c126060211b7d95b592671a58af733bcbed04ad5eb887e9ef4ad4e0c4
TLSH
T16201D823CD2F097C9C43CC49CAA5C3787B68DC574CCA188FF65038667484A7D9709021
MD5 SHA1 SHA512 TLSH

Submit Download

248DDD9FCF61002E219645695E3FFC98_8917492CE75464A1248BEB74B8323916

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\248DDD9FCF61002E219645695E3FFC98_8917492CE75464A1248BEB74B8323916
Size 478B
SHA256 bd3ca6f2e99a92801aeaffceeef79d18d13bd9af012284a5508ae7ba2bef429d
MD5 35c7f3637f339340540e624f36258fa0
SHA1 3c5c94294bc7209b4efea3aa2d020b74fb4bdd65
SHA512 42ae8eecd5de5bda3498be1b41184bb47cb2fa55385bd11e967d242cd4ef783cb71f62e9c19f7669f6f683a65f940dc3854ab5cff5c87b76ed1e4782727d4999
TLSH
T18BF0A3243EF94A6EE1B6DDBC4DC5E9D655897207380587F90D510208C903F01CCB19B9
MD5 SHA1 SHA512 TLSH

Submit Download

FE17BEC2A573BC9AE36869D0274FFA19_6DA81F04C5F9EAD2CD0268808FCE61E1

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\FE17BEC2A573BC9AE36869D0274FFA19_6DA81F04C5F9EAD2CD0268808FCE61E1
Size 478B
SHA256 06ae2902c736b631415e5febbd7eb53cf89454581ea7c5ad275fd656b35ac9c9
MD5 d3b3f6a221e946345c3abc1fe3e5acde
SHA1 857352550bf7fb5d36e95bb9e32acc907023a09b
SHA512 199db5645dc840b00105bfe3e2421d53c32ae740414b573a88d05e732bad4b8240517b9224b5503efc7b6ef4d4a17b495c975b12b0bd03ba3c40e1dbe3106f20
TLSH
T177F05C1411FB0479D0379CB59ED661368E58F023260D9B6432E253116F41B418D7205C
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_3k20p0xt.j3e.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_3k20p0xt.j3e.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

e58bb4c.msi

Path C:\Windows\Installer\e58bb4c.msi
Size 27.0MB
SHA256 6746b18bd10aaf2ea21ad54f6a44e5aa1a63147f8d2a6e0e5b41d765433bb6f9
MD5 09e090d3475d607921bd4f40c8f8afc1
SHA1 6987225c37d54bbc43c78fe94a830c66d6262187
SHA512 38ef0141923d04af5988aab2498eebe7d0d1744a08fb29dbb9c26789f3e5b33a4033bff8f693d10ecf3738e10a6cdded418d7b36cd3709a3dc621673f0be3fbe
SSDEEP 393216:5/qrxwEdjKwKpsEfgKh4Q4c8Fvo9EJpI/Q:5a2EdjKwKF4KR07u/Q
TLSH
T1AB57AD072670E416FA34D0B88D52C8F35A26B99F4610B5F776DC497527E2C632FBC8A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata-2

Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
Size 24.1MB
SHA256 c4d49ab22fa3d360fac2b3f6d7e38bf798698b9fdeaebc9f80dc25d518b2fbeb
MD5 c04b29a343757ac6f1de82c5d4ce5ae5
SHA1 b005dc4701bf07e1d250919eb58f9454d40397d6
SHA512 7c6f42c0ec7c53ad25fb9bd837fdffe198f420c8f7e639a322559724dcd7b3b213fd2aef9fa001afabb1f8d446bb7485d5568eeaf4bed8dce814004a92709aa3
SSDEEP 24576:Lu8m+1zVdoO/vvTLb2t+oGqZc0UjVVdSBLGtPic1l0asOqEgIP1UlbGRI:1
TLSH
T10847A3243AF92110E7B79E3C6CF0AA234D3A7D5B9C199E8D45411F4E0921FB0E972F5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{d27c355f-8193-4eca-b093-678289e916d0}_OnDiskSnapshotProp

Path \??\Volume{c9561ee0-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{d27c355f-8193-4eca-b093-678289e916d0}_OnDiskSnapshotProp
Size 6KB
SHA256 284b989095f7f88c19b412af73ad0390a263342a8a4c3baf63a0f9c177c15695
MD5 42530920cc2b19842ecb086e556ab989
SHA1 55f150c71b7add603c8183e736f749beeeee0470
SHA512 defb6b00754862b0367feea5cf8e6b494e2b3d67219a0dd0805fbda21df7f10358d0139ca361b972db58e43a78d02f0a54f648809e1414ca3574a4e44b46c9db
SSDEEP 96:FQkItvc8DD84LTHzbOHXOHBlBRQ88Sc9XE56tOSVQpu:Odb++ZVm
TLSH
T1ECD189085AE54711E2F3AB3129F18557A877B811EF33CB8E0298638E2671A10F975F5F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2060-225-0x000001A6E4CA0000-0x000001A6E4CA9000-memory.dmp

Download

memory/3284-183-0x00000291FCF30000-0x00000291FCF40000-memory.dmp

Download

memory/3284-184-0x00000291FD1D0000-0x00000291FD1EA000-memory.dmp

Download

memory/3284-186-0x00000291FDD20000-0x00000291FE248000-memory.dmp

Download

memory/3284-190-0x00000291FD1B0000-0x00000291FD1B9000-memory.dmp

Download

memory/4448-153-0x00000183FB910000-0x00000183FB932000-memory.dmp

Download

memory/4448-166-0x00000183FBA80000-0x00000183FBA89000-memory.dmp

Download

memory/4452-168-0x0000021EF2380000-0x0000021EF2389000-memory.dmp

Download

memory/4864-185-0x0000021125E40000-0x0000021126002000-memory.dmp

Download

memory/4864-188-0x0000021125890000-0x0000021125899000-memory.dmp

Download