6746b18bd10aaf2ea21ad54f6a44e5aa1a63147f8d2a6e0e5b41d765433bb6f9

Analysis

max time kernel
74s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
29/09/2026, 12:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
cascadesapp.msi
Size 27.0MB
Sample260929-phebjazzfz
SHA256 6746b18bd10aaf2ea21ad54f6a44e5aa1a63147f8d2a6e0e5b41d765433bb6f9
MD5 09e090d3475d607921bd4f40c8f8afc1
SHA1 6987225c37d54bbc43c78fe94a830c66d6262187
SHA512 38ef0141923d04af5988aab2498eebe7d0d1744a08fb29dbb9c26789f3e5b33a4033bff8f693d10ecf3738e10a6cdded418d7b36cd3709a3dc621673f0be3fbe
SSDEEP 393216:5/qrxwEdjKwKpsEfgKh4Q4c8Fvo9EJpI/Q:5a2EdjKwKF4KR07u/Q
TLSH
T1AB57AD072670E416FA34D0B88D52C8F35A26B99F4610B5F776DC497527E2C632FBC8A8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence privilege_escalation ransomware

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
5544	OpsBridgeAgent.exe
5412	OpsBridgeAgent.exe

Loads dropped DLL 60 IoCs

pid	Process
5544	OpsBridgeAgent.exe
5544	OpsBridgeAgent.exe
5544	OpsBridgeAgent.exe
5544	OpsBridgeAgent.exe
5544	OpsBridgeAgent.exe
5544	OpsBridgeAgent.exe
5544	OpsBridgeAgent.exe
5544	OpsBridgeAgent.exe
5544	OpsBridgeAgent.exe
5544	OpsBridgeAgent.exe
5544	OpsBridgeAgent.exe
5544	OpsBridgeAgent.exe
5544	OpsBridgeAgent.exe
5544	OpsBridgeAgent.exe
5544	OpsBridgeAgent.exe
5544	OpsBridgeAgent.exe
5544	OpsBridgeAgent.exe
5544	OpsBridgeAgent.exe
5544	OpsBridgeAgent.exe
5544	OpsBridgeAgent.exe
5544	OpsBridgeAgent.exe
5544	OpsBridgeAgent.exe
5544	OpsBridgeAgent.exe
5544	OpsBridgeAgent.exe
5544	OpsBridgeAgent.exe
5544	OpsBridgeAgent.exe
5544	OpsBridgeAgent.exe
5544	OpsBridgeAgent.exe
5544	OpsBridgeAgent.exe
5544	OpsBridgeAgent.exe
5544	OpsBridgeAgent.exe
5412	OpsBridgeAgent.exe
5412	OpsBridgeAgent.exe
5412	OpsBridgeAgent.exe
5412	OpsBridgeAgent.exe
5412	OpsBridgeAgent.exe
5412	OpsBridgeAgent.exe
5412	OpsBridgeAgent.exe
5412	OpsBridgeAgent.exe
5412	OpsBridgeAgent.exe
5412	OpsBridgeAgent.exe
5412	OpsBridgeAgent.exe
5412	OpsBridgeAgent.exe
5412	OpsBridgeAgent.exe
5412	OpsBridgeAgent.exe
5412	OpsBridgeAgent.exe
5412	OpsBridgeAgent.exe
5412	OpsBridgeAgent.exe
5412	OpsBridgeAgent.exe
5412	OpsBridgeAgent.exe
5412	OpsBridgeAgent.exe
5412	OpsBridgeAgent.exe
5412	OpsBridgeAgent.exe
5412	OpsBridgeAgent.exe
5412	OpsBridgeAgent.exe
5412	OpsBridgeAgent.exe
5412	OpsBridgeAgent.exe
5412	OpsBridgeAgent.exe
5412	OpsBridgeAgent.exe
5412	OpsBridgeAgent.exe

Badlisted process makes network request 1 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
2	5776	msiexec.exe

Enumerates connected drives 3 TTPs 57 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
	\??\F:\	powershell.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
	\??\F:\	powershell.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
	\??\F:\	powershell.exe
File opened (read-only)	\??\W:	msiexec.exe
	\??\F:\	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
	\??\F:\	powershell.exe
	\??\F:\	powershell.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
	\??\F:\	powershell.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
	\??\F:\	powershell.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
	\??\F:\	powershell.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
	\??\F:\	powershell.exe
	\??\F:\	powershell.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe

Drops file in Program Files directory 39 IoCs

description	ioc	Process
File created	C:\Program Files\OpsBridge\pywintypes313.dll	msiexec.exe
File created	C:\Program Files\OpsBridge\select.pyd	msiexec.exe
File created	C:\Program Files\OpsBridge\win32service.pyd	msiexec.exe
File created	C:\Program Files\OpsBridge\psutil\_psutil_windows.pyd	msiexec.exe
File created	C:\Program Files\OpsBridge\_socket.pyd	msiexec.exe
File created	C:\Program Files\OpsBridge\_win32sysloader.pyd	msiexec.exe
File created	C:\Program Files\OpsBridge\_wmi.pyd	msiexec.exe
File created	C:\Program Files\OpsBridge\python3.dll	msiexec.exe
File created	C:\Program Files\OpsBridge\charset_normalizer\python3.dll	msiexec.exe
File created	C:\Program Files\OpsBridge\_hashlib.pyd	msiexec.exe
File created	C:\Program Files\OpsBridge\libssl-3.dll	msiexec.exe
File created	C:\Program Files\OpsBridge\unicodedata.pyd	msiexec.exe
File created	C:\Program Files\OpsBridge\_ssl.pyd	msiexec.exe
File created	C:\Program Files\OpsBridge\_uuid.pyd	msiexec.exe
File created	C:\Program Files\OpsBridge\libcrypto-3.dll	msiexec.exe
File created	C:\Program Files\OpsBridge\libffi-8.dll	msiexec.exe
File created	C:\Program Files\OpsBridge\servicemanager.pyd	msiexec.exe
File created	C:\Program Files\OpsBridge\vcruntime140.dll	msiexec.exe
File created	C:\Program Files\OpsBridge\win32evtlog.pyd	msiexec.exe
File created	C:\Program Files\OpsBridge\_queue.pyd	msiexec.exe
File created	C:\Program Files\OpsBridge\python313.dll	msiexec.exe
File created	C:\Program Files\OpsBridge\vcruntime140_1.dll	msiexec.exe
File created	C:\Program Files\OpsBridge\win32ui.pyd	msiexec.exe
File created	C:\Program Files\OpsBridge\charset_normalizer\md.pyd	msiexec.exe
File created	C:\Program Files\OpsBridge\OpsBridgeAgent.exe	msiexec.exe
File created	C:\Program Files\OpsBridge\_elementtree.pyd	msiexec.exe
File created	C:\Program Files\OpsBridge\pyexpat.pyd	msiexec.exe
File created	C:\Program Files\OpsBridge\win32event.pyd	msiexec.exe
File created	C:\Program Files\OpsBridge\charset_normalizer\md__mypyc.pyd	msiexec.exe
File created	C:\Program Files\OpsBridge\psutil\python3.dll	msiexec.exe
File created	C:\Program Files\OpsBridge\.write_probe	OpsBridgeAgent.exe
File created	C:\Program Files\OpsBridge\_decimal.pyd	msiexec.exe
File created	C:\Program Files\OpsBridge\perfmon.pyd	msiexec.exe
File created	C:\Program Files\OpsBridge\pythoncom313.dll	msiexec.exe
File created	C:\Program Files\OpsBridge\win32api.pyd	msiexec.exe
File created	C:\Program Files\OpsBridge\certifi\cacert.pem	msiexec.exe
File created	C:\Program Files\OpsBridge\_bz2.pyd	msiexec.exe
File created	C:\Program Files\OpsBridge\_ctypes.pyd	msiexec.exe
File created	C:\Program Files\OpsBridge\_lzma.pyd	msiexec.exe

Drops file in Windows directory 38 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_iqz15nz1.aaq.ps1	powershell.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_njbn2d4n.znj.ps1	powershell.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_bjt0xvax.zgx.ps1	powershell.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_ytf1ppfp.pdc.psm1	powershell.exe
File created	C:\Windows\Installer\{689AA284-8741-45A4-B8EA-0AD55DFF6D68}\OpsBridgeIcon.exe	msiexec.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_acrravtn.wyc.ps1	powershell.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_k4smxljn.2lx.psm1	powershell.exe
File created	C:\Windows\Installer\SourceHash{689AA284-8741-45A4-B8EA-0AD55DFF6D68}	msiexec.exe
File opened for modification	C:\Windows\Installer\{689AA284-8741-45A4-B8EA-0AD55DFF6D68}\OpsBridgeIcon.exe	msiexec.exe
File created	C:\Windows\SystemTemp\~DF72D7AA52342B96C2.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_sdhnsczz.jtm.psm1	powershell.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_t2rgd2fw.uxh.psm1	powershell.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_h1rsqrxy.gu4.ps1	powershell.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_ly2iekqh.sp1.ps1	powershell.exe
File opened for modification	C:\Windows\Installer\MSICFC9.tmp	msiexec.exe
File created	C:\Windows\Installer\e59c30a.msi	msiexec.exe
File created	C:\Windows\SystemTemp\~DFBB6E9E49D9C052CB.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_2dik2yji.zjz.ps1	powershell.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_hbwyopqf.4b4.psm1	powershell.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_s2qzelhq.v2c.psm1	powershell.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_3cmon3vb.cyf.psm1	powershell.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_3vqnnfim.c5n.psm1	powershell.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_nicv22qk.paf.psm1	powershell.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_u2mrnvlx.uut.ps1	powershell.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_eaq0aijn.3jl.ps1	powershell.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\SystemTemp\~DFF23B5D65D4BBF027.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_z5p5qrbw.gju.psm1	powershell.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_c3xzwsxt.qoa.psm1	powershell.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_bol2gcq2.t2e.ps1	powershell.exe
File created	C:\Windows\Installer\e59c308.msi	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\SystemTemp\~DFB888D3ED827A5E88.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_isorqnc0.2nz.psm1	powershell.exe
File opened for modification	C:\Windows\Installer\e59c308.msi	msiexec.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_fvetlet3.00x.ps1	powershell.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_e1j5bhk0.bih.ps1	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 20 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
2584	powershell.exe
1440	powershell.exe
4276	powershell.exe
4804	powershell.exe
2396	powershell.exe
4316	powershell.exe
5824	powershell.exe
5768	powershell.exe
2316	powershell.exe
4932	powershell.exe
2936	powershell.exe
2596	powershell.exe
2700	powershell.exe
2736	powershell.exe
4564	powershell.exe
2428	powershell.exe
3336	powershell.exe
1112	powershell.exe
5956	powershell.exe
1792	powershell.exe

Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs

persistence privilege_escalation

Installer Packages

T1546.016

Msiexec

T1218.007

pid	Process
5776	msiexec.exe

Event Triggered Execution: Netsh Helper DLL 1 TTPs 15 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
568	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	OpsBridgeAgent.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	OpsBridgeAgent.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	OpsBridgeAgent.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	OpsBridgeAgent.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000430d2ae4193eb5170000000000000000000000000000000000000000000000000000000000000000000000000000000000001071020000000000c0120000000000000000000000002701010000883801430d2ae40000000000001071020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d0830200000000006025c501000000000000000000000700010000e84101430d2ae4000000000000d08302000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9c701000000000000050000000000000000000000070001000098d4e3430d2ae400000000000030a9c7010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9cc0100000000000005000000000000000000000007000100009854e6430d2ae400000000000030a9cc01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28\52C64B7E\@%SystemRoot%\System32\fveui.dll,-843 = "BitLocker Drive Encryption"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28\52C64B7E\@%SystemRoot%\System32\ci.dll,-100 = "Isolated User Mode (IUM)"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe

Modifies registry class 23 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\482AA98614784A548BAEA05DD5FFD686\PackageCode = "C82AA82A484BAC444BB3567C34C68D89"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\482AA98614784A548BAEA05DD5FFD686\InstanceType = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\5E542C572D694D143B89E823897480C8	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\482AA98614784A548BAEA05DD5FFD686\SourceList\Net	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\482AA98614784A548BAEA05DD5FFD686\Complete	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\5E542C572D694D143B89E823897480C8\482AA98614784A548BAEA05DD5FFD686	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\482AA98614784A548BAEA05DD5FFD686\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\482AA98614784A548BAEA05DD5FFD686\SourceList\PackageName = "cascadesapp.msi"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\482AA98614784A548BAEA05DD5FFD686\SourceList\Media	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\482AA98614784A548BAEA05DD5FFD686\Clients = 3a0000000000	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\482AA98614784A548BAEA05DD5FFD686\Language = "0"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\482AA98614784A548BAEA05DD5FFD686\AdvertiseFlags = "388"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\482AA98614784A548BAEA05DD5FFD686\ProductIcon = "C:\\Windows\\Installer\\{689AA284-8741-45A4-B8EA-0AD55DFF6D68}\\OpsBridgeIcon.exe"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\482AA98614784A548BAEA05DD5FFD686\DeploymentFlags = "3"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\482AA98614784A548BAEA05DD5FFD686\SourceList\Media\1 = ";"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\482AA98614784A548BAEA05DD5FFD686\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\482AA98614784A548BAEA05DD5FFD686	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\482AA98614784A548BAEA05DD5FFD686	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\482AA98614784A548BAEA05DD5FFD686\Version = "50331657"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\482AA98614784A548BAEA05DD5FFD686\Assignment = "1"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\482AA98614784A548BAEA05DD5FFD686\AuthorizedLUAApp = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\482AA98614784A548BAEA05DD5FFD686\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\482AA98614784A548BAEA05DD5FFD686\ProductName = "OpsBridge Agent"	msiexec.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1144	schtasks.exe

Suspicious behavior: EnumeratesProcesses 40 IoCs

pid	Process
3124	msiexec.exe
3124	msiexec.exe
5544	OpsBridgeAgent.exe
5544	OpsBridgeAgent.exe
4804	powershell.exe
4804	powershell.exe
4804	powershell.exe
5412	OpsBridgeAgent.exe
5412	OpsBridgeAgent.exe
2428	powershell.exe
2428	powershell.exe
2428	powershell.exe
4932	powershell.exe
4932	powershell.exe
2596	powershell.exe
2596	powershell.exe
4932	powershell.exe
2596	powershell.exe
2396	powershell.exe
2396	powershell.exe
2396	powershell.exe
4316	powershell.exe
4316	powershell.exe
4316	powershell.exe
5768	powershell.exe
5768	powershell.exe
5824	powershell.exe
5824	powershell.exe
5768	powershell.exe
5824	powershell.exe
5412	OpsBridgeAgent.exe
5412	OpsBridgeAgent.exe
5544	OpsBridgeAgent.exe
5544	OpsBridgeAgent.exe
2316	powershell.exe
2316	powershell.exe
2316	powershell.exe
2700	powershell.exe
2700	powershell.exe
2700	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	5776	msiexec.exe
Token: SeIncreaseQuotaPrivilege	5776	msiexec.exe
Token: SeSecurityPrivilege	3124	msiexec.exe
Token: SeCreateTokenPrivilege	5776	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	5776	msiexec.exe
Token: SeLockMemoryPrivilege	5776	msiexec.exe
Token: SeIncreaseQuotaPrivilege	5776	msiexec.exe
Token: SeMachineAccountPrivilege	5776	msiexec.exe
Token: SeTcbPrivilege	5776	msiexec.exe
Token: SeSecurityPrivilege	5776	msiexec.exe
Token: SeTakeOwnershipPrivilege	5776	msiexec.exe
Token: SeLoadDriverPrivilege	5776	msiexec.exe
Token: SeSystemProfilePrivilege	5776	msiexec.exe
Token: SeSystemtimePrivilege	5776	msiexec.exe
Token: SeProfSingleProcessPrivilege	5776	msiexec.exe
Token: SeIncBasePriorityPrivilege	5776	msiexec.exe
Token: SeCreatePagefilePrivilege	5776	msiexec.exe
Token: SeCreatePermanentPrivilege	5776	msiexec.exe
Token: SeBackupPrivilege	5776	msiexec.exe
Token: SeRestorePrivilege	5776	msiexec.exe
Token: SeShutdownPrivilege	5776	msiexec.exe
Token: SeDebugPrivilege	5776	msiexec.exe
Token: SeAuditPrivilege	5776	msiexec.exe
Token: SeSystemEnvironmentPrivilege	5776	msiexec.exe
Token: SeChangeNotifyPrivilege	5776	msiexec.exe
Token: SeRemoteShutdownPrivilege	5776	msiexec.exe
Token: SeUndockPrivilege	5776	msiexec.exe
Token: SeSyncAgentPrivilege	5776	msiexec.exe
Token: SeEnableDelegationPrivilege	5776	msiexec.exe
Token: SeManageVolumePrivilege	5776	msiexec.exe
Token: SeImpersonatePrivilege	5776	msiexec.exe
Token: SeCreateGlobalPrivilege	5776	msiexec.exe
Token: SeBackupPrivilege	2852	vssvc.exe
Token: SeRestorePrivilege	2852	vssvc.exe
Token: SeAuditPrivilege	2852	vssvc.exe
Token: SeBackupPrivilege	3124	msiexec.exe
Token: SeRestorePrivilege	3124	msiexec.exe
Token: SeRestorePrivilege	3124	msiexec.exe
Token: SeTakeOwnershipPrivilege	3124	msiexec.exe
Token: SeRestorePrivilege	3124	msiexec.exe
Token: SeTakeOwnershipPrivilege	3124	msiexec.exe
Token: SeRestorePrivilege	3124	msiexec.exe
Token: SeTakeOwnershipPrivilege	3124	msiexec.exe
Token: SeRestorePrivilege	3124	msiexec.exe
Token: SeTakeOwnershipPrivilege	3124	msiexec.exe
Token: SeRestorePrivilege	3124	msiexec.exe
Token: SeTakeOwnershipPrivilege	3124	msiexec.exe
Token: SeRestorePrivilege	3124	msiexec.exe
Token: SeTakeOwnershipPrivilege	3124	msiexec.exe
Token: SeRestorePrivilege	3124	msiexec.exe
Token: SeTakeOwnershipPrivilege	3124	msiexec.exe
Token: SeRestorePrivilege	3124	msiexec.exe
Token: SeTakeOwnershipPrivilege	3124	msiexec.exe
Token: SeRestorePrivilege	3124	msiexec.exe
Token: SeTakeOwnershipPrivilege	3124	msiexec.exe
Token: SeRestorePrivilege	3124	msiexec.exe
Token: SeTakeOwnershipPrivilege	3124	msiexec.exe
Token: SeRestorePrivilege	3124	msiexec.exe
Token: SeTakeOwnershipPrivilege	3124	msiexec.exe
Token: SeRestorePrivilege	3124	msiexec.exe
Token: SeTakeOwnershipPrivilege	3124	msiexec.exe
Token: SeRestorePrivilege	3124	msiexec.exe
Token: SeTakeOwnershipPrivilege	3124	msiexec.exe
Token: SeRestorePrivilege	3124	msiexec.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
5776	msiexec.exe
5776	msiexec.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
5776	msiexec.exe
3124	msiexec.exe

Suspicious use of WriteProcessMemory 19 IoCs

description	pid	Process	procid_target
PID 3124 wrote to memory of 2480	3124	msiexec.exe	94
PID 3124 wrote to memory of 5544	3124	msiexec.exe	96
PID 5544 wrote to memory of 568	5544	OpsBridgeAgent.exe	99
PID 568 wrote to memory of 1144	568	cmd.exe	101
PID 5544 wrote to memory of 4804	5544	OpsBridgeAgent.exe	103
PID 5412 wrote to memory of 2428	5412	OpsBridgeAgent.exe	106
PID 5544 wrote to memory of 4932	5544	OpsBridgeAgent.exe	108
PID 5412 wrote to memory of 2596	5412	OpsBridgeAgent.exe	110
PID 5412 wrote to memory of 1232	5412	OpsBridgeAgent.exe	113
PID 5544 wrote to memory of 3528	5544	OpsBridgeAgent.exe	115
PID 5412 wrote to memory of 2396	5412	OpsBridgeAgent.exe	140
PID 5544 wrote to memory of 4316	5544	OpsBridgeAgent.exe	119
PID 5412 wrote to memory of 5824	5412	OpsBridgeAgent.exe	121
PID 5544 wrote to memory of 5768	5544	OpsBridgeAgent.exe	123
PID 5544 wrote to memory of 5804	5544	OpsBridgeAgent.exe	125
PID 5412 wrote to memory of 3152	5412	OpsBridgeAgent.exe	127
PID 5544 wrote to memory of 2316	5544	OpsBridgeAgent.exe	129
PID 5544 wrote to memory of 2700	5544	OpsBridgeAgent.exe	131
PID 5544 wrote to memory of 5084	5544	OpsBridgeAgent.exe	133

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\cascadesapp.msi
1⤵
- Badlisted process makes network request
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:5776

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3124
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:2480
- C:\Program Files\OpsBridge\OpsBridgeAgent.exe
  "C:\Program Files\OpsBridge\OpsBridgeAgent.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Program Files directory
  - Reads the TCP/IP host and domain name from the registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:5544
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "schtasks /Create /TN "OpsBridge Agent" /XML "C:\Users\Admin\AppData\Local\Temp\tmpl5qih83d.xml" /F"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:568
  - - C:\Windows\System32\schtasks.exe
      schtasks /Create /TN "OpsBridge Agent" /XML "C:\Users\Admin\AppData\Local\Temp\tmpl5qih83d.xml" /F
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:1144
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "(Get-NetRoute -DestinationPrefix '0.0.0.0/0' | Select-Object -First 1).NextHop"
    3⤵
    - Enumerates connected drives
    - Drops file in Windows directory
    - Command and Scripting Interpreter: PowerShell
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    PID:4804
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "(Get-DnsClientServerAddress -AddressFamily IPv4).ServerAddresses | Select-Object -Unique | ConvertTo-Json -Compress"
    3⤵
    - Enumerates connected drives
    - Drops file in Windows directory
    - Command and Scripting Interpreter: PowerShell
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    PID:4932
- - C:\Windows\system32\netsh.exe
    netsh wlan show interfaces
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:3528
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "(Get-NetRoute -DestinationPrefix '0.0.0.0/0' | Select-Object -First 1).NextHop"
    3⤵
    - Enumerates connected drives
    - Drops file in Windows directory
    - Command and Scripting Interpreter: PowerShell
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    PID:4316
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "(Get-DnsClientServerAddress -AddressFamily IPv4).ServerAddresses | Select-Object -Unique | ConvertTo-Json -Compress"
    3⤵
    - Enumerates connected drives
    - Drops file in Windows directory
    - Command and Scripting Interpreter: PowerShell
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    PID:5768
- - C:\Windows\system32\netsh.exe
    netsh wlan show interfaces
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:5804
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "(Get-NetRoute -DestinationPrefix '0.0.0.0/0' | Select-Object -First 1).NextHop"
    3⤵
    - Enumerates connected drives
    - Drops file in Windows directory
    - Command and Scripting Interpreter: PowerShell
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    PID:2316
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "(Get-DnsClientServerAddress -AddressFamily IPv4).ServerAddresses | Select-Object -Unique | ConvertTo-Json -Compress"
    3⤵
    - Enumerates connected drives
    - Drops file in Windows directory
    - Command and Scripting Interpreter: PowerShell
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    PID:2700
- - C:\Windows\system32\netsh.exe
    netsh wlan show interfaces
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:5084
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "(Get-NetRoute -DestinationPrefix '0.0.0.0/0' | Select-Object -First 1).NextHop"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:3336
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "(Get-DnsClientServerAddress -AddressFamily IPv4).ServerAddresses | Select-Object -Unique | ConvertTo-Json -Compress"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:1112
- - C:\Windows\system32\netsh.exe
    netsh wlan show interfaces
    3⤵
    PID:6128
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "(Get-NetRoute -DestinationPrefix '0.0.0.0/0' | Select-Object -First 1).NextHop"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:4564
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "(Get-DnsClientServerAddress -AddressFamily IPv4).ServerAddresses | Select-Object -Unique | ConvertTo-Json -Compress"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:1792
- - C:\Windows\system32\netsh.exe
    netsh wlan show interfaces
    3⤵
    PID:5916

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:2852

C:\Program Files\OpsBridge\OpsBridgeAgent.exe
"C:\Program Files\OpsBridge\OpsBridgeAgent.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5412
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -Command "(Get-NetRoute -DestinationPrefix '0.0.0.0/0' | Select-Object -First 1).NextHop"
  2⤵
  - Enumerates connected drives
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:2428
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -Command "(Get-DnsClientServerAddress -AddressFamily IPv4).ServerAddresses | Select-Object -Unique | ConvertTo-Json -Compress"
  2⤵
  - Enumerates connected drives
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:2596
- C:\Windows\SYSTEM32\netsh.exe
  netsh wlan show interfaces
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:1232
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -Command "(Get-NetRoute -DestinationPrefix '0.0.0.0/0' | Select-Object -First 1).NextHop"
  2⤵
  - Enumerates connected drives
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:2396
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -Command "(Get-DnsClientServerAddress -AddressFamily IPv4).ServerAddresses | Select-Object -Unique | ConvertTo-Json -Compress"
  2⤵
  - Enumerates connected drives
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:5824
- C:\Windows\SYSTEM32\netsh.exe
  netsh wlan show interfaces
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:3152
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -Command "(Get-NetRoute -DestinationPrefix '0.0.0.0/0' | Select-Object -First 1).NextHop"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:2936
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -Command "(Get-DnsClientServerAddress -AddressFamily IPv4).ServerAddresses | Select-Object -Unique | ConvertTo-Json -Compress"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:4276
- C:\Windows\SYSTEM32\netsh.exe
  netsh wlan show interfaces
  2⤵
  PID:2976
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:2396
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -Command "(Get-NetRoute -DestinationPrefix '0.0.0.0/0' | Select-Object -First 1).NextHop"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:2736
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -Command "(Get-DnsClientServerAddress -AddressFamily IPv4).ServerAddresses | Select-Object -Unique | ConvertTo-Json -Compress"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:5956
- C:\Windows\SYSTEM32\netsh.exe
  netsh wlan show interfaces
  2⤵
  PID:4860
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -Command "(Get-NetRoute -DestinationPrefix '0.0.0.0/0' | Select-Object -First 1).NextHop"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:2584
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -Command "(Get-DnsClientServerAddress -AddressFamily IPv4).ServerAddresses | Select-Object -Unique | ConvertTo-Json -Compress"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:1440
- C:\Windows\SYSTEM32\netsh.exe
  netsh wlan show interfaces
  2⤵
  PID:984

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Event Triggered Execution

T1546

Installer Packages

T1546.016

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Event Triggered Execution

T1546

Installer Packages

T1546.016

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

System Binary Proxy Execution

T1218

Msiexec

T1218.007

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e59c309.rbs

Path C:\Config.Msi\e59c309.rbs
Size 13KB
SHA256 ccccd11f8be8f3d86c5606ab62db31f4158770bdd75ccc0237e910a7322a5f17
MD5 f372061c2ee7deb25be0b4d90b97a593
SHA1 f2bc762192d09bc3cfab974e5395b26825b9efac
SHA512 3b4d0ac046e4e34dcb67da80754434d1d372342bc8c8f46cbdea5739883c3339e8f02cf96f52004b603d1c1f40067926e17ca4b43b9de6aafec0909ea06d88aa
SSDEEP 384:9NM4Ei1/F0mNMGmMtWRE8D5vnGqptfdpv7KoJ5vks5I0+UR0R+K4x8:9NVEi1/F0mNMGmMtWRE8NvnGqptfdpv6
TLSH
T1EE52469AC801C3D2E18A96F09FC26E0E7F95C79C5360131F6FCC86259E61B841FA56BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_hashlib.pyd

Path C:\PROGRA~1\OPSBRI~1\_hashlib.pyd
Size 63KB
SHA256 52f29aebe9886e830dedc363cd64eb53b6830d84b26e14f1b6faa655a0900b5d
MD5 3e540ef568215561590df215801b0f59
SHA1 3b6db31a97115c10c33266cce8ff80463763c7e6
SHA512 21497a4d1d999a420ed0e146544f4149c72ad4aca4b869a0ee83267d92afa07609ece76a4e95ec706a21580d6544146d0a58c0baa01aa2c242474a4816108527
SSDEEP 1536:GzQGcrVBtIMh2AZvgLbKwps4RdIgvIMytH/918fI38VM1:CSrVBtuWyWos4RdIgvIdlIW
TLSH
T129539E49A2844096CA6752B8CAD39E87F6B5F2525340ABDF0354C0CE2F237C3D77A766
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_queue.pyd

Path C:\PROGRA~1\OPSBRI~1\_queue.pyd
Size 34KB
SHA256 af8ac8ab8b39f53b5dc192fbf58ad704a709db34e69753b97b83d087202e3a36
MD5 cc0f4a77ccfe39efc8019fa8b74c06d0
SHA1 77a713cd5880d5254dd0d1cbfe0d6a45dfc869ce
SHA512 ffea0bd7f73b6c02df6ff37ef39b8e54e480a4cc734fb149adc5c7410f445effd1fdd4f24e4619f7158913a50c28cc73629524d1a7389101a75257d5652c7823
SSDEEP 768:gFJpl1K6rdzuds5Ig9Uz1OytxJEKrLy2Ip4ETxf1mlWZG8vzcrDZ1:gDrddzuds5Ig9UcytH/9YfIW44zcrD
TLSH
T133F28ECAAA584487EA53CA70C2E7EE52F835B7D35611479F3055D28D2E273C1F32A329
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_socket.pyd

Path C:\PROGRA~1\OPSBRI~1\_socket.pyd
Size 83KB
SHA256 bced17d6f081d81ea7cd92f1e071e38f8840e61ee0fe1524221b776bcfa78650
MD5 566cb4d39b700c19dbd7175bd4f2b649
SHA1 bede896259b6d52d538c2182aef87c334fc9c73c
SHA512 6a26fd59e2c2ec34b673ef257a00d5577f52286d78525d05efc8a88760fb575be65c3e94e83396f4978c8734b513afe7f09d3c49474169144f98add406530367
SSDEEP 1536:2xl/h+6SDo3OkB+ecI4xyJwAQlyJ+9+nzhjTm96tsJ4O05IgywpytH/9ofIbw:2xko35X4yJwAQlyJs+nzNq96yw5Igyw3
TLSH
T17C837C00A6A041FAEB63D0B5C2679E63FB74B5C11391A35F0066C55A1F337C2AF7AB46
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ssl.pyd

Path C:\PROGRA~1\OPSBRI~1\_ssl.pyd
Size 177KB
SHA256 3301ff340d26495c95108199b67fdf3402742d13070af8b6bf4eb2e0c5e13781
MD5 689f1abac772c9e4c2d3bad3758cb398
SHA1 fe829e05d9f7838d1426f6d4a2f97165c09fd0f7
SHA512 949404a76c731a92074b37ec0bba88d873e56327b335b6c300eff68c2b142e194b58df59158b9bb92a5984c768b474f5db5f80f6b610f6cca78763604041bd82
SSDEEP 3072:HTzN6X1nguzjfU6C3JEMyn6osf87vOifHZHmzisFIgL7RYt:HTzgX5gIU6C39yn+2sQt
TLSH
T1D5047C47B5842AFBD813E4B9C2234903EBB1F155331257DE48D6E6490F03B46AE6AB73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_win32sysloader.pyd

Path C:\PROGRA~1\OPSBRI~1\_win32sysloader.pyd
Size 25KB
SHA256 0ac205b8ecb01e573ac95f001a259ddf613f63d8358b04b90d13582666e34502
MD5 fb891224d98def8b0753bc6fdb70ac45
SHA1 b9889eaac696e558eb150dabd77e05a57aadf52a
SHA512 03625de561f2bba40123f2677a90dc06e4784bee785df18023ab1beb4940aed5e26a180b87533c4fd57dfe52383a21ae2a750dc4fcb28b276b76cb8a0127259e
SSDEEP 384:dqm8dKXx8Hkwly4Y3s/0uvVL7/iLdwFsEYwVJCBKmMwUaym/FP9m:d+d28Hkwlyx3s/Dv97/iWFdqARwLyKS
TLSH
T1D1B25AC2BF5940D6E8A3C638C0F31F57AE37B9A51721129F02B281151D9A7D07F2EA6C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

md.pyd

Path C:\PROGRA~1\OPSBRI~1\charset_normalizer\md.pyd
Size 20KB
SHA256 dfd405d475319202deccb16929177c641d62b44f27f5902874a21c1213cc62e3
MD5 4116680ae190c2a0108babb875cf7266
SHA1 3c08ac0816e5deb0a98d4cd8d3ba5ca0f3ee9222
SHA512 0a6ed3c62a4be42962ffd0365e2faf47a006e208632bc555f7cf656822b2b8f47ae3920cb8e1d4b36f00fc98d4e8aea86cf66066995bc1cf90675ede730aa549
SSDEEP 384:7zx4m446oDZuI8AeiLdwFsEYwVJCRbjKmMwUaym/F+9+E:7z6s6o1VJfWFdqRCRwLyK4
TLSH
T1E4926C9AEE2954E2EE828A34C0D25D17BD33BB81170576DF5334C0156EC67F27A3A22D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

md__mypyc.pyd

Path C:\PROGRA~1\OPSBRI~1\charset_normalizer\md__mypyc.pyd
Size 133KB
SHA256 4f4bc686dbc4d609f21155a567f3e569312dd9e672658b3c7dd1b87e3da6b229
MD5 bca51081cd46127b76962faf5840ae10
SHA1 776970b66e10cf0f2fb26bc18f0b0ff27218001e
SHA512 eab66aadd3f89a9b5c8b2c4b2fd803622feb15765a0fbe2470261f78fa452117b6a17fd0ae223028a65a2424805b8f78bc1248e334051d53ccebc1d68180913f
SSDEEP 3072:rdOHcsVOUm2jVPoV9wsBOYtvsHgFXYwbOUwkdqXo:Y8frBntIwbOm+o
TLSH
T19AD32A67529500B7CA634179CCB7A513DBF2B5510B3263CF04A4C69A6F03BD6AEBEB01
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libcrypto-3.dll

Path C:\PROGRA~1\OPSBRI~1\libcrypto-3.dll
Size 5.0MB
SHA256 ccfffddcd3defb8d899026298af9af43bc186130f8483d77e97c93233d5f27d7
MD5 ae5b2e9a3410839b31938f24b6fc5cd8
SHA1 9f9a14efc15c904f408a0d364d55a144427e4949
SHA512 36ea760a7b56ea74174882155eddfb8726828240fcfc6b34d90ecdb7e50a7e632374dcbc9b2889081c0973cc51f50967e7d692498c4abd1f2cba3f7fe8d659cc
SSDEEP 98304:M3+lrVT/8LpQmNPMRLuPWv1CPwDvt3uFlDCJ:6yrVT/8LvPMRLui1CPwDvt3uFlDCJ
TLSH
T1F8368B6AA7A80148E4BAC13CC9534617D2B1F85A57B097CF18A1967D0F37FDA2B3E740
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libffi-8.dll

Path C:\PROGRA~1\OPSBRI~1\libffi-8.dll
Size 38KB
SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
MD5 0f8e4992ca92baaf54cc0b43aaccce21
SHA1 c7300975df267b1d6adcbac0ac93fd7b1ab49bd2
SHA512 6e1b223462dc124279bfca74fd2c66fe18b368ffbca540c84e82e0f5bcbea0e10cc243975574fa95ace437b9d8b03a446ed5ee0c9b1b094147cefaf704dfe978
SSDEEP 768:NiQfxQemQJNrPN+moyijAc5YiSyvkIPxWEqG:dfxIQvPkmoyijP7SytPxF
TLSH
T10B037C0B458418A4E657D53D97A64A2AC335B9240B60F2CB03D4C2BA3F6B7D6FB7C358
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libssl-3.dll

Path C:\PROGRA~1\OPSBRI~1\libssl-3.dll
Size 776KB
SHA256 007142039f04d04e0ed607bda53de095e5bc6a8a10d26ecedde94ea7d2d7eefe
MD5 8d4805f0651186046c48d3e2356623db
SHA1 18c27c000384418abcf9c88a72f3d55d83beda91
SHA512 1c4895d912f7085d6e46f6776034c9e3d8d7bf934be858683bf6dedb13abca360ba816d8a5528ec7a3ac6e33010fdb6fc89b2699b5cfeedaabfdd5df143dffd1
SSDEEP 12288:SLN1sk7YJkC4IAXjdA372WWLmyhTs2bmFe9Xb:SLglJkC4IAhA372WWL3YBFe9Xb
TLSH
T1D8F44BAD73B8059CD8B6C17D86934623E3B6F4563330EBEB06518A790F277D51B3A248
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_psutil_windows.pyd

Path C:\PROGRA~1\OPSBRI~1\psutil\_psutil_windows.pyd
Size 78KB
SHA256 c5196da079f7d3b630e748fd7c23c5810a313cc7a5255a2ca05bd06d6ae32612
MD5 84b981872f66541695d9c499f84ea0d4
SHA1 95ef04c5124357a8b91983df0305ec7e42bdfa4f
SHA512 c2b19b69da8980968eda3ba06e825656d8865d7d6f20757aa9fe422b1faa2ff672b466931cd0dac2ae56bf561e06bbd9e099772074d6a74a08b19e1b57c945d1
SSDEEP 1536:MCZzwq2+SBRJdpZnJbPoPVM04YnUjHmCHWFdqFRRK+:jZzkBhpZn4M04qMmNdqFx
TLSH
T198733996B75800F8D95B913C9AF26A37EBB2B091132557DF0160C64A0FA3BD36E7DB01
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python3.dll

Path C:\PROGRA~1\OPSBRI~1\psutil\python3.dll
Size 69KB
SHA256 fdd54b6c495e9278e73d68203fff0c300e416e704852908cf5b06666cffead51
MD5 d6dfb6a9518a57e180980f7a07098d7d
SHA1 6026120461f5cbcd9255670b6a906fd8f5329073
SHA512 2a0195a5038d7530b64a506a70de3a6b9cb64ca9206006e03f726b4420304e3a76c10fdda12c8a51f4dbd63e7112fd7e7727a4ab94e7a111587e4248a6b26a62
SSDEEP 768:lQEotsskOv6pWVCB4p/uKlZPRQcFIc9qunV0Jku/YFI1Hu1wEBbCpVNyD6VdPxi1:jotssyKcunV8P65Igy0lytH/9QfIiAW
TLSH
T17E633BC25B5BF8A2D6F665FC78DDD9CD242B02CC57268D9FA47893920F1A310A22734D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pythoncom313.dll

Path C:\PROGRA~1\OPSBRI~1\pythoncom313.dll
Size 684KB
SHA256 458af34db6fa60d86a910ec72671045c45ce147557eca50f23d7dbc1adf8a786
MD5 d68774c8515fc5752ba095f0d8d0f949
SHA1 320ecf51becfbe642110a52371b21ab5d839fce3
SHA512 ff87d56631d3d50d9cd51075dbcb2559a35f6bac957667e28c56c246b4c7d8824b0cac987b780183c4cdf289d093fcc35e7309a5eff1a9c117d5000d910d496e
SSDEEP 6144:R6z7yv0/CpCn21m2K6Tl3bKaEDVJMH2ILDzrICOGxY3gpdpw0l04j5NsFUPN:R6KvKn6mqTl3OtV2z3fbXpdiO92FY
TLSH
T11FE43A56B3E50691F63AA1BEC9139B03D2A2B4511B42A7CF01A0C76F5FA73C5373A760
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pywintypes313.dll

Path C:\PROGRA~1\OPSBRI~1\pywintypes313.dll
Size 142KB
SHA256 468468d96d2131340cfa3904883f735cfd97b47bdcde810814558fc459036e6b
MD5 2651e404b252ecb6646d50f55a4133da
SHA1 f7df2f8095560f698478528fb54f5995d4e3e999
SHA512 f7758fbbd8d616f2aea4eb439f3fe42a856e6b48fd7199d8201e62361b69a9032f03c1831a072f4c2732cc2914d9d2a487729e5510c8bcdc1ceb430617d337a3
SSDEEP 3072:/dyqdYmyWa5br4d1qfGHrY/rZ6Yr2laFU4LGUgl4jptIaiTandqs0:/4aYlWa9r61LrY/rPbFU4NgOjptIip0
TLSH
T191E33A47374684DAE9669379CDB71A03D7A2B0000711E3CF46A1C28B6F63BE66D3B746
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

select.pyd

Path C:\PROGRA~1\OPSBRI~1\select.pyd
Size 31KB
SHA256 6393121130a3e85d0f6562948024d8614c4c144b84ab102af711c638344d1599
MD5 715a098175d3ca1c1da2dc5756b31860
SHA1 6b3ec06d679c48bfe4391535a822b58a02d79026
SHA512 e92edb98427f594badec592493469d45deab3b71e4598d544d0b9a1acffd5327a19c09029fb79d70971cb0ed0dba56056bef8455534d3f16ec35eac723062f3c
SSDEEP 768:kCOBHfjKe5Ig9GWOytxJEKrLy2Ip4gj6Cxf1mlY6Csr:kCOB/jKe5Ig9GJytH/9+fIii
TLSH
T1BCE27D8BAB745047FA63C671C6A6CE03F939B7A3971142CF30A5D1891E137C1A73A365
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

unicodedata.pyd

Path C:\PROGRA~1\OPSBRI~1\unicodedata.pyd
Size 695KB
SHA256 071494856fdad0042964769aa2fb1de4ea95c2cfcbe27cc7132293c68d13d710
MD5 503b3ffa6a5bf45ab34d6d74352f206b
SHA1 cc13b85281e5d52413784e0b65a61b1d037c60cc
SHA512 d20b860974161caa60a62268968af353ad8063589f57d71f57c91855eb83da78f40bae7aa745cc7a945d92ebe08cf244c9560ae93449de45b20a8b8fff9f5010
SSDEEP 12288:9YLdLI/X77mvfldCKGihH32W3cnPSqrUguJS:9YLW7qNxr3cnPXuJS
TLSH
T1FDE4F6D5BBCF8D26E69B363948E3710F5171C3735F0A863AB2182361D85B3B449D582E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

win32event.pyd

Path C:\PROGRA~1\OPSBRI~1\win32event.pyd
Size 39KB
SHA256 4699cb4d6b8500bebeb51fce248c63446c4eeb57197a38e7b1086beaa4e590df
MD5 52ca3e63d6e159ba4985a5fd0b5fed25
SHA1 f4e582be04c8ea70a1874a0e19c7292dfb12a015
SHA512 80472cf00a7ae9d67d2d4ab89e0429c5c1d7418c14c64c3b0acbe8a8454bc8b01f9fc6cade60bcb796ecb08c0a7f98982aff0e35d3d8305f566c1d7d3eb3cd2d
SSDEEP 768:eaWut7Goxs5Llg+Ebc/jhfWddbcrb8l/99mku36U4a4+WFdqMRwLyK:e8Rc/jhfWddbcH8l/99mku36U4a4+WFE
TLSH
T1D70328C727686096E967C53CD4961E07EA73B96003A0B3EF0222D51A1F663E17B3DB4D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

win32service.pyd

Path C:\PROGRA~1\OPSBRI~1\win32service.pyd
Size 68KB
SHA256 60a9a3ec8280aa911745199d7207dddfe2d4e030b4033a56917095591830086d
MD5 eb6ab7dbadb18dee2aa155ab2e25fff4
SHA1 a095934ce2ef1e2f89725fabef4c2df6623e364e
SHA512 05c9ed15ad71db8bb5c4e8a39440fb77d4ed3565d2e9c5c09df3d097407738ace7f5fd4ae9f78d2402dfb5c9ecc167db9bb5a26b6691753daf7358478bd8235f
SSDEEP 1536:3e7pZxWJERz66jkltv/vN66NuSs7jNYWFdqdRRK6:ibnW3166oSsvN9dqd5
TLSH
T1A0633A4BA35611D5E826C2BCC5A31F53EA72B804239076CF43D1C6491FA7BC47E3AA96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OpsBridgeAgent.exe

Path C:\Program Files\OpsBridge\OpsBridgeAgent.exe
Size 17.3MB
SHA256 bc334e5a541bbbb9edc410160882612aa6d8adfffc7482e60f3e97caa6d194c0
MD5 047b30f95472f0cea51d562880a8c775
SHA1 c4748571f44880c46a8bbade8632ece2f9a5e17a
SHA512 6a57459a145ced644874d3581de9cdf0eef1b2d0a368ea6ba76c63004c8bdb6d15b9817771da9ed71f75b407a72f4b448809e64b7b613025ef1c966855b18139
SSDEEP 98304:TTULVDpSB1Za/FU+gbT5+w9O172pB1w75at/3aKUsvm5WhrYnznoeztsLODRB4ud:u5at/H9+OYxXgXcYtMdjKLpVYiYb
TLSH
T1890759072670E416FA34D0B88D52C8F35A26B99F4610B5F376DD497627D2C632FBC8A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VCRUNTIME140.dll

Path C:\Program Files\OpsBridge\VCRUNTIME140.dll
Size 117KB
SHA256 052ad6a20d375957e82aa6a3c441ea548d89be0981516ca7eb306e063d5027f4
MD5 32da96115c9d783a0769312c0482a62d
SHA1 2ea840a5faa87a2fe8d7e5cb4367f2418077d66b
SHA512 616c78b4a24761d4640ae2377b873f7779322ef7bc26f8de7da0d880b227c577ed6f5ed794fc733468477b2fcdb7916def250e5dc63e79257616f99768419087
SSDEEP 1536:Z9TXF5YXWbj8qr51XlN+dULTCe1IGhKWyxLiyaXYaNxoecbdhUoaLjTz164zEd:ZEnsvReGsWyxLizXFkecbd1aPTzW
TLSH
T10DC38C8572A002FBD16AC274C1A36A17FB75B94487B0A7CF03B58A650F53BE09E3D356
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_bz2.pyd

Path C:\Program Files\OpsBridge\_bz2.pyd
Size 83KB
SHA256 449058efc99fccb9e24d640084d845c78f3f86dd34c5c126cf69e523d6320d75
MD5 684d656aada9f7d74f5a5bdcf16d0edb
SHA1 f7586da90d101b5ee3fa24f131ee93ab89606919
SHA512 27fb2eca382675316fb96d18a1aa6b2792077481bf899cbcc658d71f787876045c05c98abf129c9670b6a1d2654d57f59e17580139fa7f482ec27234e44d4235
SSDEEP 1536:Q5qJ1z7AwZG1xIdYxMpC76ROURNf/86bskFIgLVaytH/9bfIivj:iqTzwqdYrmrfk6wkFIgLVyGj
TLSH
T13E839E82E39857F6F45B81B986C00797F770BA91075053AFF298C2962F03F916E5C36A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ctypes.pyd

Path C:\Program Files\OpsBridge\_ctypes.pyd
Size 130KB
SHA256 5c0d5082fba1a2a3eb8d5e23073be25164c19f21304b09cecaab340dc7198815
MD5 29873384e13b0a78ee9857604161514b
SHA1 110f60f74b06b3972acd5908937a40e078636479
SHA512 ca826ff5403700e6d8822634e364e43b14ef829095d8fe365b49731236f696fe86ffa3853cd1801dc3b7800d005a032fe23bbc25befe3952ef37790d56dee3c5
SSDEEP 3072:k/QCY6XPLj8N4qvAQBhNf/FTmITIJ+B8sZ75IgyPUW4I3U:uQCXPLjNENBPf/FTXTy+B82l
TLSH
T169D37E0B736800AADAA79178C573AF47EBB1B453121147CF02E4C59A2F637E26E7E315
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_lzma.pyd

Path C:\Program Files\OpsBridge\_lzma.pyd
Size 155KB
SHA256 48f16b587c6faa44a9e073365b19599200b0f0a0ccb70121e76c2dac4ed53281
MD5 d63e2e743ea103626d33b3c1d882f419
SHA1 af8a162b43f99b943d1c87c9a9e8088816263373
SHA512 d3f1450b5def3c21f47c5133073e76d2ec05787eb6ae88bb70d3a34be84f6025540ac017e9415bb22ef36c2ffbfcea38a28842eefe366325f3d3cf2cca1a3cb1
SSDEEP 3072:D0Vfr5vC9v2J2dE2AomznfB9mNoVhDLaztJLFIg01twW:DSr5YBo5YOVEpJLEh
TLSH
T10EF35B86B794F0D6F7728C38D6624F57E7F5781A0320929A01CC936D2B1FB659A2E313
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_wmi.pyd

Path C:\Program Files\OpsBridge\_wmi.pyd
Size 38KB
SHA256 ebd252d21af9c84128fca04c994093a5bd6ee857f1581f06f4026fdd6a2c40e0
MD5 47e6fd132f44a4feb595bd0fda3c4e1c
SHA1 37c6c2c1ff309db7273afc9324a37b716c5cbfdb
SHA512 69c031d4ff2dac70739f9c188fca3c6969304f22782adf5a9c0ca303a3a712630541bda888ef25d3252b46d43df56f6e7e03c83d331840088c4224d1a1a512c4
SSDEEP 768:nEkKVVUWO0X1ctqDFIgLi6OytxJEKrLy2Ip4RsCxf1mljr8VMOj:nE9v3JctqDFIgLi1ytH/9R1fI38VMi
TLSH
T1AC037D8AE2640046E663DAB5C9A6CE53F571B7C36B11D38F365582990F233C0E73A336
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python313.dll

Path C:\Program Files\OpsBridge\python313.dll
Size 5.8MB
SHA256 69fd86ea29370697c203f7e12830084f920f490766a8e3045af52c036a9ad529
MD5 7387fe038ea75eb9a57b054fccfe37bf
SHA1 5c532cbdfd718b5e80afb2ee8dea991e84757712
SHA512 c46c982b04079ed0b13617b81168598632d6c58d29e23fcbfa064b08e5836866b74880e1a9c01c12670531f13521a21177aafb10be0abb329a79291d7bff08bd
SSDEEP 98304:+nN+czHO42c7SZerAItxv7HDMiExa0RB2d:Fc7O45mwCiP0RB2d
TLSH
T1E1568D16739D51ACC97B8078CA03864BFBB27C053E60934B61E6BB5D2F733624A6E705
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

servicemanager.pyd

Path C:\Program Files\OpsBridge\servicemanager.pyd
Size 51KB
SHA256 30457f89e6fc9f44670625b58f8b4266b8524001e7e596323cb966834bf914d2
MD5 1e7e53ec1b88f63e205576c38dc8d660
SHA1 f615323e7e044d95f1194d4baa2c6b4387e7a797
SHA512 569d0afa0b2f43015b7babbdd93a8cd2fd659976f50b2ee9eecaea9e31a76c6f92d39d3d73464205a2d95ac2fbf9f48019025b2a80a67a9e519e6a4c34bf5970
SSDEEP 1536:t0ldu4SMi6x1DDDRuuLCwhaXoCCPsWFdqvRRK/:tWg4SMVx1DDDEICwhaXoXPBdqv8
TLSH
T123333B4767A64059F573A638D4F306739A32B8811B75A2CF0260C50E3EB2BD47D35BAE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcruntime140_1.dll

Path C:\Program Files\OpsBridge\vcruntime140_1.dll
Size 48KB
SHA256 6a99bc0128e0c7d6cbbf615fcc26909565e17d4ca3451b97f8987f9c6acbc6c8
MD5 c0c0b4c611561f94798b62eb43097722
SHA1 523f515eed3af6d50e57a3eaeb906f4ccc1865fe
SHA512 35db454dbcc7ed89842c0440b92ce0b0b0db41dbd5432a36a0b7e1eddf51704b1f0d6cff5e3a3b0c3ff5db3d8632fed000471180ad72e39d8dbe68a757ccdfb0
SSDEEP 768:vzzO6ujT3MbR3v0Cz6Sz5q83ywug1HDV9zxfYbK9z:mq/oMx3hXHDnzxfYiz
TLSH
T1AE236BA453784486D4AB99B0C0DAEE577D7CFA964B10928F0BA0D15C1F637D0EB3D21B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

win32api.pyd

Path C:\Program Files\OpsBridge\win32api.pyd
Size 145KB
SHA256 77d31573dd7ae7bfd31320ae9d1b7b1a11827dd7329f4fb4ff1e511363149bd9
MD5 c616ce119be2969eb269923a07e8d75a
SHA1 4281ab2c00ed2fe2cf39334a493c5382be928a63
SHA512 3b50ef8f468dfc4dbd3c04bcf06980c7eaddde3d97bbac0571295ed6a030c3e277b786854c8fe662c68955feba279af2d9d167b513fd3fc5e76ae8205bce1939
SSDEEP 3072:K7AK00RjZk+uEIvPlRVlhLaN/PSexhlT9qTmP9bDm/GgUXJkeMdqLZO:uAF0fu73lRVsPSexhbqyvcGg0GOZO
TLSH
T18EE31783B35410C6D86AA37CC1675E23DB72B8240725A7CF06A0C68A1F63BE97D3D795
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

install.log

Path C:\ProgramData\OpsBridge\install.log
Size 630B
SHA256 28d0770351f5e352710eecb48d6c835588536d62bd0127056e9d7af72d17eb61
MD5 2cabff31219949e59c21b3d188002f4d
SHA1 b81d59621df5f84a532290f92b03caa219252a1d
SHA512 84538b67c136a3304c496095690f096084ea7bfacfaaa6ce30c75eccf4b923385b5ae22f4d5d69e7e1417cf48d96f1a83b7b4af393de9312a9800820b8d307af
TLSH
T1CDF0A2C1A4B48AE3B220E17443693F8E8A23F7089DC55E9477C675026C22C0C1AAA8B9
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_pmgv3n1z.jis.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_pmgv3n1z.jis.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

tmpl5qih83d.xml

Path C:\Users\Admin\AppData\Local\Temp\tmpl5qih83d.xml
Size 3KB
SHA256 8331dfd81e1d8913ba37c92f1e7d946df0ce114acb540c5a1d078d38a85c85f9
MD5 d7d923d8768ec3acabb9247da87aa544
SHA1 0f38a63c68bfe75919f9b6fdf22b749cddd2ecce
SHA512 a7b26d5f33fbe0d03d7a20e4066048f5b530b586c588f8827922fd51bdd14102d6b07abd2035cbf19f5ac7391fdd7c338a918f87a3daf0f70e88fe3c0350a857
TLSH
T187518B97ABFD1219F2F76B6CBFBA645289A6FD956E25C8AD0070040D0871A70C5B0737
MD5 SHA1 SHA512 TLSH

Submit Download

e59c308.msi

Path C:\Windows\Installer\e59c308.msi
Size 27.0MB
SHA256 6746b18bd10aaf2ea21ad54f6a44e5aa1a63147f8d2a6e0e5b41d765433bb6f9
MD5 09e090d3475d607921bd4f40c8f8afc1
SHA1 6987225c37d54bbc43c78fe94a830c66d6262187
SHA512 38ef0141923d04af5988aab2498eebe7d0d1744a08fb29dbb9c26789f3e5b33a4033bff8f693d10ecf3738e10a6cdded418d7b36cd3709a3dc621673f0be3fbe
SSDEEP 393216:5/qrxwEdjKwKpsEfgKh4Q4c8Fvo9EJpI/Q:5a2EdjKwKF4KR07u/Q
TLSH
T1AB57AD072670E416FA34D0B88D52C8F35A26B99F4610B5F776DC497527E2C632FBC8A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2316-199-0x00000229B0B50000-0x00000229B0C02000-memory.dmp

Download

memory/2584-250-0x000001DB49710000-0x000001DB497C2000-memory.dmp

Download

memory/2596-167-0x00000266EA2E0000-0x00000266EA4A2000-memory.dmp

Download

memory/2596-168-0x00000266EA9E0000-0x00000266EAF08000-memory.dmp

Download

memory/4804-148-0x000001ED31B20000-0x000001ED31BD2000-memory.dmp

Download

memory/4804-152-0x000001ED318C0000-0x000001ED318DE000-memory.dmp

Download

memory/4804-149-0x000001ED31890000-0x000001ED3189A000-memory.dmp

Download

memory/4804-147-0x000001ED31870000-0x000001ED3188E000-memory.dmp

Download

memory/4804-141-0x000001ED317E0000-0x000001ED31802000-memory.dmp

Download

memory/4932-165-0x0000027236F20000-0x0000027236F30000-memory.dmp

Download

memory/4932-166-0x0000027236F50000-0x0000027236F6A000-memory.dmp

Download