ab941aef3d30bd16a3d8b423eee0f434f45f949c71e93d212fc60f2366df9ba2

Analysis

max time kernel
149s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
23/10/2026, 12:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Project%20specification%20document.msi
Size 8.7MB
Sample261023-pcjztscg86
SHA256 ab941aef3d30bd16a3d8b423eee0f434f45f949c71e93d212fc60f2366df9ba2
MD5 8ae3c3ce47ad4588c1e4d19192824b04
SHA1 b094d28cbdcd3f507557d9a35d2621b1e01834e1
SHA512 a2569d6cdc576b270c4c1a1b85f2c96ba8a2adf8a4e6595e419a16f2125cf7ae228be11787b130c0ad39b63282728c2ba1ab50d233baeda267e19f98b13dbe92
SSDEEP 196608:lWWDdyCV88IEa53XLbHfXNtsNSCYMsM/JTaAnuovyaH:ZpDu8kPHfXNmJsm5Moq6
TLSH
T1BD963319BBD009FDE977827688A38561EE367C883760C59F0364B1195F3BBA0B07B761
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery execution persistence privilege_escalation ransomware

Malware Config

Signatures

Badlisted process makes network request 13 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
4	1336	msiexec.exe
7	1336	msiexec.exe
25	4892	rundll32.exe
26	3032	rundll32.exe
30	4236	powershell.exe
32	4236	powershell.exe
39	2444	powershell.exe
40	2444	powershell.exe
41	2444	powershell.exe
42	2444	powershell.exe
43	2444	powershell.exe
49	2444	powershell.exe
53	4600	rundll32.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
4236	powershell.exe
2444	powershell.exe

Executes dropped EXE 3 IoCs

pid	Process
4852	AteraAgent.exe
4852	AteraAgent.exe
2424	dotnet.exe

Loads dropped DLL 24 IoCs

pid	Process
4580	MsiExec.exe
4844	rundll32.exe
4844	rundll32.exe
4844	rundll32.exe
4580	MsiExec.exe
4892	rundll32.exe
4892	rundll32.exe
4892	rundll32.exe
4580	MsiExec.exe
3032	rundll32.exe
3032	rundll32.exe
3032	rundll32.exe
4580	MsiExec.exe
4292	rundll32.exe
4292	rundll32.exe
4292	rundll32.exe
4772	MsiExec.exe
4772	MsiExec.exe
4772	MsiExec.exe
2424	dotnet.exe
4580	MsiExec.exe
4600	rundll32.exe
4600	rundll32.exe
4600	rundll32.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe

Drops file in System32 directory 8 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506	AteraAgent.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506	AteraAgent.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\75CA58072B9926F763A91F0CC2798706_3AD253ACA02D44EA5FD30683B8A5B5FA	AteraAgent.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\D1BEC81CCAFDC823A062FF26A89A6B6D_D40E4E79DF388B984709B048EEAFD4E4	AteraAgent.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\BAD725C80F9E10846F35D039A996E4A8_88B6AE015495C1ECC395D19C1DD02894	AteraAgent.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\BAD725C80F9E10846F35D039A996E4A8_88B6AE015495C1ECC395D19C1DD02894	AteraAgent.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\75CA58072B9926F763A91F0CC2798706_3AD253ACA02D44EA5FD30683B8A5B5FA	AteraAgent.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\D1BEC81CCAFDC823A062FF26A89A6B6D_D40E4E79DF388B984709B048EEAFD4E4	AteraAgent.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\10.0.13\mscorrc.dll	powershell.exe
File created	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\10.0.13\System.ComponentModel.Annotations.dll	powershell.exe
File created	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\10.0.13\System.Diagnostics.FileVersionInfo.dll	powershell.exe
File opened for modification	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\10.0.13\System.Diagnostics.Tracing.dll	powershell.exe
File opened for modification	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\10.0.13\System.IO.Compression.Brotli.dll	powershell.exe
File opened for modification	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\10.0.13\System.IO.FileSystem.DriveInfo.dll	powershell.exe
File created	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\10.0.13\System.Linq.Queryable.dll	powershell.exe
File opened for modification	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\10.0.13\System.Net.WebSockets.dll	powershell.exe
File opened for modification	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\10.0.13\System.Private.Xml.dll	powershell.exe
File opened for modification	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\10.0.13\System.Runtime.Numerics.dll	powershell.exe
File created	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\10.0.13\System.Security.Cryptography.Csp.dll	powershell.exe
File opened for modification	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\10.0.13\System.Text.Encodings.Web.dll	powershell.exe
File created	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\10.0.13\System.Web.HttpUtility.dll	powershell.exe
File created	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\10.0.13\mscordbi.dll	powershell.exe
File opened for modification	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\10.0.13\System.IO.Compression.dll	powershell.exe
File opened for modification	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\10.0.13\System.Reflection.TypeExtensions.dll	powershell.exe
File opened for modification	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\10.0.13\System.Security.AccessControl.dll	powershell.exe
File opened for modification	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\10.0.13\System.Collections.Concurrent.dll	powershell.exe
File opened for modification	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\10.0.13\System.Dynamic.Runtime.dll	powershell.exe
File created	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\10.0.13\System.Globalization.dll	powershell.exe
File created	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\10.0.13\System.Net.NetworkInformation.dll	powershell.exe
File opened for modification	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\10.0.13\System.Resources.Reader.dll	powershell.exe
File created	C:\Program Files\ATERA Networks\AteraAgent\Agent\packages\staging\AgentPackageTicketing.zip	AteraAgent.exe
File created	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\host\fxr\10.0.13\hostfxr.dll	powershell.exe
File opened for modification	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\10.0.13\netstandard.dll	powershell.exe
File created	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\10.0.13\System.Linq.AsyncEnumerable.dll	powershell.exe
File created	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\10.0.13\System.Net.Http.Json.dll	powershell.exe
File opened for modification	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\10.0.13\System.Text.RegularExpressions.dll	powershell.exe
File opened for modification	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\10.0.13\System.Transactions.dll	powershell.exe
File created	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\10.0.13\System.Xml.XmlDocument.dll	powershell.exe
File created	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\10.0.13\mscordaccore.dll	powershell.exe
File created	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\10.0.13\System.Globalization.Extensions.dll	powershell.exe
File created	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\10.0.13\System.Net.WebHeaderCollection.dll	powershell.exe
File opened for modification	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\10.0.13\System.Reflection.Primitives.dll	powershell.exe
File opened for modification	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\10.0.13\System.Security.Cryptography.Algorithms.dll	powershell.exe
File created	C:\Program Files\ATERA Networks\AteraAgent\Agent\.settings.json.tmp	AteraAgent.exe
File opened for modification	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\10.0.13\System.IO.Pipes.dll	powershell.exe
File created	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\10.0.13\System.Net.WebProxy.dll	powershell.exe
File opened for modification	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\10.0.13\System.Private.CoreLib.dll	powershell.exe
File created	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\10.0.13\System.Runtime.Serialization.Xml.dll	powershell.exe
File opened for modification	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\10.0.13\System.Security.Cryptography.Cng.dll	powershell.exe
File created	C:\Program Files\ATERA Networks\AteraAgent\Agent\packages\staging\Agent.Package.Watchdog.zip	AteraAgent.exe
File created	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\LICENSE.txt	powershell.exe
File opened for modification	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\10.0.13\System.Formats.Tar.dll	powershell.exe
File created	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\10.0.13\System.Net.ServerSentEvents.dll	powershell.exe
File created	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\10.0.13\System.Resources.Reader.dll	powershell.exe
File opened for modification	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\10.0.13\System.Runtime.Serialization.Formatters.dll	powershell.exe
File opened for modification	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\10.0.13\System.Threading.Channels.dll	powershell.exe
File opened for modification	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\10.0.13\System.Threading.Tasks.dll	powershell.exe
File created	C:\Program Files\ATERA Networks\AteraAgent\Agent\packages\staging\AgentPackageSystemTools.zip	AteraAgent.exe
File created	C:\Program Files\ATERA Networks\AteraAgent\Agent\.settings.json.tmp	AteraAgent.exe
File created	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\10.0.13\System.IO.FileSystem.Primitives.dll	powershell.exe
File created	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\10.0.13\System.ObjectModel.dll	powershell.exe
File opened for modification	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\10.0.13\System.Private.Xml.Linq.dll	powershell.exe
File created	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\10.0.13\System.Security.Cryptography.Encoding.dll	powershell.exe
File created	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\10.0.13\System.Threading.Tasks.Extensions.dll	powershell.exe
File created	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\10.0.13\System.Threading.Timer.dll	powershell.exe
File created	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\10.0.13\System.Transactions.dll	powershell.exe
File created	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\10.0.13\System.Formats.Asn1.dll	powershell.exe
File created	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\10.0.13\System.Text.Json.dll	powershell.exe
File created	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\10.0.13\System.Threading.Tasks.dll	powershell.exe
File opened for modification	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\10.0.13\System.Xml.Linq.dll	powershell.exe
File opened for modification	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\10.0.13\System.Xml.ReaderWriter.dll	powershell.exe
File created	C:\Program Files\ATERA Networks\AteraAgent\Agent\packages\staging\AgentPackageInternalPoller.zip	AteraAgent.exe

Drops file in Windows directory 31 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\MSI194F.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI349A.tmp	msiexec.exe
File created	C:\Windows\Installer\e58fd66.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e58fd66.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\SFXCADF58B1941C42CDAA9DF7745A3541A706\Atera.Agent.Installer.Msi.Ca.dll	rundll32.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\SFXCA77A559C46C48C248E3C41FCE20C5D879\WixToolset.Dtf.WindowsInstaller.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\SFXCA77A559C46C48C248E3C41FCE20C5D879\CustomAction.config	rundll32.exe
File opened for modification	C:\Windows\Installer\SFXCADF58B1941C42CDAA9DF7745A3541A706\CustomAction.config	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI15E2.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\SFXCA2D816CBE944A2BDAB9186280D90063C9\CustomAction.config	rundll32.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\Installer\SFXCAFA40D588E54C47D8373FFDECCA73E948\WixToolset.Dtf.WindowsInstaller.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\SFXCAFA40D588E54C47D8373FFDECCA73E948\CustomAction.config	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI1B53.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\SFXCAFA40D588E54C47D8373FFDECCA73E948\Atera.Agent.Installer.Msi.Ca.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI2E5F.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\SFXCA77A559C46C48C248E3C41FCE20C5D879\Atera.Agent.Installer.Msi.Ca.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\SFXCAB2528ACFA147DD499B4DA98F1065DBC2\Atera.Agent.Installer.Msi.Ca.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\SFXCAB2528ACFA147DD499B4DA98F1065DBC2\CustomAction.config	rundll32.exe
File opened for modification	C:\Windows\Installer\SFXCA2D816CBE944A2BDAB9186280D90063C9\WixToolset.Dtf.WindowsInstaller.dll	rundll32.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\SFXCAB2528ACFA147DD499B4DA98F1065DBC2\WixToolset.Dtf.WindowsInstaller.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\SFXCADF58B1941C42CDAA9DF7745A3541A706\WixToolset.Dtf.WindowsInstaller.dll	rundll32.exe
File created	C:\Windows\Installer\SourceHash{CFDAB197-8EA2-4290-AD55-9CF0D4175F9C}	msiexec.exe
File created	C:\Windows\Installer\e58fd68.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\SFXCA2D816CBE944A2BDAB9186280D90063C9\Atera.Agent.Installer.Msi.Ca.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI5AB1.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIFE12.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIFFA9.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI18E0.tmp	msiexec.exe

Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs

persistence privilege_escalation

Installer Packages

T1546.016

Msiexec

T1218.007

pid	Process
1336	msiexec.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3876	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 8 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	rundll32.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	rundll32.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	rundll32.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	AteraAgent.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	AteraAgent.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	rundll32.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	rundll32.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	rundll32.exe

System Time Discovery 1 TTPs 4 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4292	rundll32.exe
2444	powershell.exe
3876	cmd.exe
2424	dotnet.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000e01e56c99d3b8eb00000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000e01e56c90000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed35000000ffffffff000000000700010000680900e01e56c9000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff350000000000000005000000ffffffff000000000700010000f8ff1ae01e56c9000000000000f0ff350000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1de01e56c9000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28\52C64B7E	AteraAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	AteraAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	AteraAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	AteraAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	AteraAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	AteraAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	AteraAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	AteraAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28\52C64B7E\@%SystemRoot%\system32\WindowsPowerShell\v1.0\powershell.exe,-124 = "Document Encryption"	AteraAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	AteraAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	AteraAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	AteraAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	AteraAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28\52C64B7E\@%SystemRoot%\system32\dnsapi.dll,-103 = "Domain Name System (DNS) Server Trust"	AteraAgent.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28\52C64B7E\@%SystemRoot%\System32\wuaueng.dll,-400 = "Windows Update"	AteraAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	AteraAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	AteraAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	AteraAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	AteraAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28\52C64B7E\@%SystemRoot%\System32\ci.dll,-101 = "Enclave"	AteraAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	AteraAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	AteraAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPublisher	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPublisher	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28\52C64B7E\@%SystemRoot%\System32\ci.dll,-100 = "Isolated User Mode (IUM)"	AteraAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	AteraAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	AteraAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	AteraAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28\52C64B7E\@%SystemRoot%\System32\fveui.dll,-844 = "BitLocker Data Recovery Agent"	AteraAgent.exe

Modifies registry class 22 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\791BADFC2AE80924DA55C90F4D71F5C9\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\791BADFC2AE80924DA55C90F4D71F5C9\SourceList\PackageName = "Project%20specification%20document.msi"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\791BADFC2AE80924DA55C90F4D71F5C9\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\791BADFC2AE80924DA55C90F4D71F5C9\SourceList\Media	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\791BADFC2AE80924DA55C90F4D71F5C9\Clients = 3a0000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\791BADFC2AE80924DA55C90F4D71F5C9\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\25F46F8180ECF4345A1FA7A8935DE9AE\791BADFC2AE80924DA55C90F4D71F5C9	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\791BADFC2AE80924DA55C90F4D71F5C9	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\791BADFC2AE80924DA55C90F4D71F5C9\ProductName = "AteraAgent"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\791BADFC2AE80924DA55C90F4D71F5C9\PackageCode = "4AABD2A4DAE6F51479091627BD898F6F"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\791BADFC2AE80924DA55C90F4D71F5C9\Version = "33882150"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\791BADFC2AE80924DA55C90F4D71F5C9\AdvertiseFlags = "388"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\791BADFC2AE80924DA55C90F4D71F5C9\SourceList\Media\1 = ";"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\791BADFC2AE80924DA55C90F4D71F5C9\AteraAgentFeature	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\791BADFC2AE80924DA55C90F4D71F5C9\Assignment = "1"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\791BADFC2AE80924DA55C90F4D71F5C9\InstanceType = "0"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\791BADFC2AE80924DA55C90F4D71F5C9\AuthorizedLUAApp = "0"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\791BADFC2AE80924DA55C90F4D71F5C9\DeploymentFlags = "3"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\791BADFC2AE80924DA55C90F4D71F5C9	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\791BADFC2AE80924DA55C90F4D71F5C9\Language = "1033"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\25F46F8180ECF4345A1FA7A8935DE9AE	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\791BADFC2AE80924DA55C90F4D71F5C9\SourceList\Net	msiexec.exe

Suspicious behavior: EnumeratesProcesses 33 IoCs

pid	Process
4892	rundll32.exe
4892	rundll32.exe
4268	msiexec.exe
4268	msiexec.exe
4852	AteraAgent.exe
4852	AteraAgent.exe
4236	powershell.exe
4236	powershell.exe
4236	powershell.exe
2444	powershell.exe
2444	powershell.exe
2444	powershell.exe
4852	AteraAgent.exe
4852	AteraAgent.exe
4852	AteraAgent.exe
4852	AteraAgent.exe
4852	AteraAgent.exe
4852	AteraAgent.exe
4852	AteraAgent.exe
4852	AteraAgent.exe
4852	AteraAgent.exe
4852	AteraAgent.exe
4852	AteraAgent.exe
4852	AteraAgent.exe
4852	AteraAgent.exe
4852	AteraAgent.exe
4852	AteraAgent.exe
4852	AteraAgent.exe
4852	AteraAgent.exe
4852	AteraAgent.exe
4852	AteraAgent.exe
4852	AteraAgent.exe
4852	AteraAgent.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1336	msiexec.exe
Token: SeIncreaseQuotaPrivilege	1336	msiexec.exe
Token: SeSecurityPrivilege	4268	msiexec.exe
Token: SeCreateTokenPrivilege	1336	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	1336	msiexec.exe
Token: SeLockMemoryPrivilege	1336	msiexec.exe
Token: SeIncreaseQuotaPrivilege	1336	msiexec.exe
Token: SeMachineAccountPrivilege	1336	msiexec.exe
Token: SeTcbPrivilege	1336	msiexec.exe
Token: SeSecurityPrivilege	1336	msiexec.exe
Token: SeTakeOwnershipPrivilege	1336	msiexec.exe
Token: SeLoadDriverPrivilege	1336	msiexec.exe
Token: SeSystemProfilePrivilege	1336	msiexec.exe
Token: SeSystemtimePrivilege	1336	msiexec.exe
Token: SeProfSingleProcessPrivilege	1336	msiexec.exe
Token: SeIncBasePriorityPrivilege	1336	msiexec.exe
Token: SeCreatePagefilePrivilege	1336	msiexec.exe
Token: SeCreatePermanentPrivilege	1336	msiexec.exe
Token: SeBackupPrivilege	1336	msiexec.exe
Token: SeRestorePrivilege	1336	msiexec.exe
Token: SeShutdownPrivilege	1336	msiexec.exe
Token: SeDebugPrivilege	1336	msiexec.exe
Token: SeAuditPrivilege	1336	msiexec.exe
Token: SeSystemEnvironmentPrivilege	1336	msiexec.exe
Token: SeChangeNotifyPrivilege	1336	msiexec.exe
Token: SeRemoteShutdownPrivilege	1336	msiexec.exe
Token: SeUndockPrivilege	1336	msiexec.exe
Token: SeSyncAgentPrivilege	1336	msiexec.exe
Token: SeEnableDelegationPrivilege	1336	msiexec.exe
Token: SeManageVolumePrivilege	1336	msiexec.exe
Token: SeImpersonatePrivilege	1336	msiexec.exe
Token: SeCreateGlobalPrivilege	1336	msiexec.exe
Token: SeBackupPrivilege	4388	vssvc.exe
Token: SeRestorePrivilege	4388	vssvc.exe
Token: SeAuditPrivilege	4388	vssvc.exe
Token: SeBackupPrivilege	4268	msiexec.exe
Token: SeRestorePrivilege	4268	msiexec.exe
Token: SeRestorePrivilege	4268	msiexec.exe
Token: SeTakeOwnershipPrivilege	4268	msiexec.exe
Token: SeRestorePrivilege	4268	msiexec.exe
Token: SeTakeOwnershipPrivilege	4268	msiexec.exe
Token: SeDebugPrivilege	4844	rundll32.exe
Token: SeRestorePrivilege	4268	msiexec.exe
Token: SeTakeOwnershipPrivilege	4268	msiexec.exe
Token: SeDebugPrivilege	4892	rundll32.exe
Token: SeRestorePrivilege	4268	msiexec.exe
Token: SeTakeOwnershipPrivilege	4268	msiexec.exe
Token: SeDebugPrivilege	3032	rundll32.exe
Token: SeRestorePrivilege	4268	msiexec.exe
Token: SeTakeOwnershipPrivilege	4268	msiexec.exe
Token: SeRestorePrivilege	4268	msiexec.exe
Token: SeTakeOwnershipPrivilege	4268	msiexec.exe
Token: SeDebugPrivilege	4292	rundll32.exe
Token: SeRestorePrivilege	4268	msiexec.exe
Token: SeTakeOwnershipPrivilege	4268	msiexec.exe
Token: SeDebugPrivilege	4852	AteraAgent.exe
Token: SeBackupPrivilege	5080	srtasks.exe
Token: SeRestorePrivilege	5080	srtasks.exe
Token: SeSecurityPrivilege	5080	srtasks.exe
Token: SeTakeOwnershipPrivilege	5080	srtasks.exe
Token: SeBackupPrivilege	5080	srtasks.exe
Token: SeRestorePrivilege	5080	srtasks.exe
Token: SeSecurityPrivilege	5080	srtasks.exe
Token: SeTakeOwnershipPrivilege	5080	srtasks.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
1336	msiexec.exe
1336	msiexec.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 4268 wrote to memory of 5080	4268	msiexec.exe	97
PID 4268 wrote to memory of 4580	4268	msiexec.exe	99
PID 4580 wrote to memory of 4844	4580	MsiExec.exe	100
PID 4580 wrote to memory of 4892	4580	MsiExec.exe	101
PID 4580 wrote to memory of 3032	4580	MsiExec.exe	102
PID 4580 wrote to memory of 4292	4580	MsiExec.exe	103
PID 4268 wrote to memory of 4772	4268	msiexec.exe	104
PID 4772 wrote to memory of 4852	4772	MsiExec.exe	105
PID 4772 wrote to memory of 4236	4772	MsiExec.exe	107
PID 4772 wrote to memory of 2444	4772	MsiExec.exe	110
PID 4852 wrote to memory of 3876	4852	AteraAgent.exe	114
PID 3876 wrote to memory of 2424	3876	cmd.exe	116
PID 4580 wrote to memory of 4600	4580	MsiExec.exe	117

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\Project%20specification%20document.msi
1⤵
- Badlisted process makes network request
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1336

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4268
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:5080
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding 94ABCF7434CE130334C7AF01E33238AA
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:4580
- - C:\Windows\system32\rundll32.exe
    rundll32.exe "C:\Windows\Installer\MSIFE12.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240713343 2 Atera.Agent.Installer.Msi.Ca!Atera.Agent.Installer.Msi.Ca.CustomActions.GenerateAgentId
    3⤵
    - Loads dropped DLL
    - Drops file in Windows directory
    - Suspicious use of AdjustPrivilegeToken
    PID:4844
- - C:\Windows\system32\rundll32.exe
    rundll32.exe "C:\Windows\Installer\MSIFFA9.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240713703 6 Atera.Agent.Installer.Msi.Ca!Atera.Agent.Installer.Msi.Ca.CustomActions.ShouldContinueInstallation
    3⤵
    - Badlisted process makes network request
    - Loads dropped DLL
    - Drops file in Windows directory
    - Reads the TCP/IP host and domain name from the registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4892
- - C:\Windows\system32\rundll32.exe
    rundll32.exe "C:\Windows\Installer\MSI15E2.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240719359 10 Atera.Agent.Installer.Msi.Ca!Atera.Agent.Installer.Msi.Ca.CustomActions.ReportMsiInstallStart
    3⤵
    - Badlisted process makes network request
    - Loads dropped DLL
    - Drops file in Windows directory
    - Reads the TCP/IP host and domain name from the registry
    - Suspicious use of AdjustPrivilegeToken
    PID:3032
- - C:\Windows\system32\rundll32.exe
    rundll32.exe "C:\Windows\Installer\MSI194F.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240720203 15 Atera.Agent.Installer.Msi.Ca!Atera.Agent.Installer.Msi.Ca.CustomActions.DetectDotNetFrameworkRuntime
    3⤵
    - Loads dropped DLL
    - Drops file in Windows directory
    - System Time Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4292
- - C:\Windows\system32\rundll32.exe
    rundll32.exe "C:\Windows\Installer\MSI5AB1.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240736953 31 Atera.Agent.Installer.Msi.Ca!Atera.Agent.Installer.Msi.Ca.CustomActions.ReportMsiInstallEnd
    3⤵
    - Badlisted process makes network request
    - Loads dropped DLL
    - Drops file in Windows directory
    - Reads the TCP/IP host and domain name from the registry
    PID:4600
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding DBE4C132CE09EEA338AF089071672D33 E Global\MSI0000
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:4772
- - C:\Program Files\ATERA Networks\AteraAgent\Agent\AteraAgent.exe
    "C:\Program Files\ATERA Networks\AteraAgent\Agent\AteraAgent.exe" init-settings --agent-id "725060dd-724f-4b13-b59b-09413a73969b" --account-id "5QGPL4zjAIBgQFnvTNs26FiJppYCq0WzQOH29bqUDyM=" --account-agent-installation-id "2fcd1ed7d8e54882ad9c55b32a2b7490" --environment "Production" --customer-id "1" --folder-id ""
    3⤵
    - Executes dropped EXE
    - Drops file in Program Files directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4852
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" -ExecutionPolicy Bypass -NoProfile -Command "[Net.ServicePointManager]::SecurityProtocol=[Net.SecurityProtocolType]::Tls12;Invoke-WebRequest -Uri 'https://dot.net/v1/dotnet-install.ps1' -OutFile \"C:\Program Files\ATERA Networks\AteraAgent\Agent\dotnet-install.ps1\""
    3⤵
    - Badlisted process makes network request
    - Command and Scripting Interpreter: PowerShell
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    PID:4236
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" -ExecutionPolicy unrestricted -NoProfile -File "C:\Program Files\ATERA Networks\AteraAgent\Agent\dotnet-install.ps1" -Channel 10.0 -Runtime dotnet -InstallDir "C:\Program Files\ATERA Networks\AteraAgent\Agent\\.dotnet"
    3⤵
    - Badlisted process makes network request
    - Command and Scripting Interpreter: PowerShell
    - Drops file in Program Files directory
    - System Time Discovery
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    PID:2444

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:4388

C:\Program Files\ATERA Networks\AteraAgent\Agent\AteraAgent.exe
"C:\Program Files\ATERA Networks\AteraAgent\Agent\AteraAgent.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Reads the TCP/IP host and domain name from the registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4852
- C:\Windows\system32\cmd.exe
  "cmd.exe" /c "C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\dotnet.exe" --list-runtimes
  2⤵
  - Executes a command shell one-liner
  - System Time Discovery
  - Suspicious use of WriteProcessMemory
  PID:3876
- - C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\dotnet.exe
    "C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\dotnet.exe" --list-runtimes
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Time Discovery
    PID:2424

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Event Triggered Execution

T1546

Installer Packages

T1546.016

Privilege Escalation

Event Triggered Execution

T1546

Installer Packages

T1546.016

Defense Evasion

System Binary Proxy Execution

T1218

Msiexec

T1218.007

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e58fd67.rbs

Path C:\Config.Msi\e58fd67.rbs
Size 7KB
SHA256 8fcc4f2be6ac5f9377f81ece11e0ad9b9aa3d38270f2fa27b4c25eb714f2b4cd
MD5 29da9070e90a0bccbbf73ae467565977
SHA1 6237a2b52e363d082d2d7cfb9cf1807c38de84c7
SHA512 e7c0beb69bd2e2f1d79f39bb78355de3cb1492fd47e2aac0f30c8678854977ad5f8d0da38066fb05d7252aac7ff685de9bf0c530090bd76a3d16be5b69c2b056
SSDEEP 96:/mP4p1z1s3IreavgvmpUBTIuCsTl3UBTIuC6jNwvjvN+TlNQ35vu9WvRvgvxIC9f:+P4zz1M6eii6NI26NkV8Kt9pLFf
TLSH
T1EBF11346620081E6EA5B3F30C70B17673BF6D2DA8354235B09CD61B85F8338A6FA519F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\dotnet.exe
Size 163KB
SHA256 abce6623a6729059cf39bb0f728c4a7804f625895099c88c17e6e704661e09eb
MD5 21e071bada82a388f86bb9d7787cfa4b
SHA1 7f99765fcc1836b90b9dea74fb5e71c5c24ddcc1
SHA512 165cb61b61fd965b09f7df737ead653ddecc8a60893d40c1306e8a6230b6a50bcdaf5956dabc1639fe430857da38c36332ead1958cbe0caebc330a8645a6634e
SSDEEP 3072:4GgPMwruvTSBbQ/vp4SbDqIG/Kk7l55wKlE5Ey:4GUrubgbQJDvqIWtKiy
TLSH
T12BF3071AD65811AAD06E9575CB528941BB337C668BE0E3CB53C0F8BE0F726905EF9703
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hostfxr.dll

Path C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\host\fxr\10.0.13\hostfxr.dll
Size 370KB
SHA256 2e6bf792d54303a54467102fd873a7d7a993f828e8d19c040e13e428e5f2d9c8
MD5 02536bfc6928ad20d8e344ddf79eb9b6
SHA1 d509fedc26bb3f39fbd2b3a9417e50d2aa9b6fca
SHA512 51524309f927809d67ca3ce8c8978ec3f843750f0181bb418f7686c9e5eb27a11144e3b03ff7687d6138cf3913394d93914c52821aaf0b83314a0a9a7ccc2787
SSDEEP 6144:6alRvjNggqbRVhaUzIS64W+zz3Z0UCVvfpJEl0FsGxilKmkVAwBAc/UWo2CUHFhg:65V0iOnpq2TDNH9Bqb
TLSH
T1C2840816D3E8057CF0B79678DAB29902EB727C494BB0E5DF139088651E73BD09A39723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mscordaccore_amd64_amd64_10.0.1326.50504.dll

Path C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\10.0.13\mscordaccore_amd64_amd64_10.0.1326.50504.dll
Size 1.3MB
SHA256 4e2109c88298f0a614aac82b23310b13835673a8e192a6a8b75c25459e591169
MD5 65dcc460b122d3e82d4beacec5850d4d
SHA1 ee27a68705098105fd8b87f6206f787ac5d3bf17
SHA512 2f1283bcc1b0b4f082753923dc9325e7adb3bc19405c8db73c79804f84528990bd7f92e0b7e1a4d1f8d91d5fd3ef9fd72669f3f138ff09f7b7358dd6edbf7116
SSDEEP 24576:bDMXkJvfPhh6YuBeQeJBQeyLnO4AB61e+6mResmk7fdiYd:UXkJvfPhAuJBGLO4AB61e+FResmw
TLSH
T15F554A56D6BC4499CEA9D0F8C547491FEBB13811033466FF46A48B192F3BBE66ABC310
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

.settings.json

Path C:\Program Files\ATERA Networks\AteraAgent\Agent\.settings.json
Size 243B
SHA256 d54691d4c514b39d8c3e450b6313a8dcb1229290b38a593f77da35cadeb2699a
MD5 0a0f141d748864b8bf1be26dca9b1c51
SHA1 9d73a88ee86f9bce9c28831c763dd40922062487
SHA512 469dd44849489aed9326f5c5d371777693c04eab4465633a5a4ad5b3e54fe9b18f1ab2aa3dbbdd8024793918c2c8295205fe1f8400573f85cca43ef6409c58d7
TLSH
T1D7D0A7D96632978029852F5C5A671A8EB972B653DDCA0B04B0DB651418305951113095
MD5 SHA1 SHA512 TLSH

Submit Download

.settings.json

Path C:\Program Files\ATERA Networks\AteraAgent\Agent\.settings.json
Size 35KB
SHA256 3f1967f54c6db4eb0d0115338a8f632f1f114c51c274634602242968629bf701
MD5 32152e81acfca015203e24c3a164d636
SHA1 28905c186ed9a25e40c00013e77b1dab60765c22
SHA512 c8965d4e391945d64ad04ebf38916934e355144845b138db18ea0a6461a0a42a31bdc6e81ceb02d40c105f707a2b1b93d3c122f3aa79a20b040f4a3f22ecd018
SSDEEP 768:FWy3G9Ze2RGn2RO6FMpRO6FM7Or/1b2/LQm/cnc4:F72XGn2ROlpROl7OxGOc4
TLSH
T121F2640B52E50621C3780F4D34EE3DB8621D7B9275C18CCFB6A5162AD92AC72D45F1BB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AteraAgent.exe

Path C:\Program Files\ATERA Networks\AteraAgent\Agent\AteraAgent.exe
Size 22.5MB
SHA256 355936b7539fe07897dad6bca0490bade4940c7a9235b834c7a9a4cb7552d923
MD5 4d2f6d72e185de481698e48529a6208d
SHA1 9571ee8cf9258b7361c38c2370238c24204e0efd
SHA512 237f145010c681213dc16289811f0ebf0a864a5c348412d02ce6fccc5ae058116d481adf041f50a6ec97350f6c4aec5cf21867727a61b76ad137d46be60fc660
SSDEEP 196608:pd/A6kDzLPyiDVnZEyFTCoG+5ZpMIn6wna+uP9JPstmT1AKZPL/AmIIg:z/vs6kJFTqqZpMI6SET1AKBo
TLSH
T187379C11B3EC466AE5BF83389472451ADBF2B8462321E7CF1594A6E91E33BC05E35363
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

agent.cert.pfx

Path C:\Program Files\ATERA Networks\AteraAgent\Agent\certificates\production\agent.cert.pfx
Size 2KB
SHA256 8cbadb16f8b4a1ecdc247ec50409a9f98ccad457fb318cb286a536acc80df93a
MD5 a7f83bd9f6d0069cac54a83c60d15cf4
SHA1 0164055ab8efac89f23acb21d4ef3dc8f761cc63
SHA512 d74e16595211255e18500b2a953392550e87348ad5bdd1e978a58c563ce11ec3afed3383e1ff319dbc6e661dc12dd157d2223957ffae51af620b007c1503ea15
TLSH
T1E8511A50597B04493DA2FFDAF8BC1F90B9A1DE51A913347D64215A9419B1F3C328DA02
MD5 SHA1 SHA512 TLSH

Submit Download

dotnet-install.ps1

Path C:\Program Files\ATERA Networks\AteraAgent\Agent\dotnet-install.ps1
Size 74KB
SHA256 e8b873e18a81e5c4cd8ab69d84dac8fead291d50b3c44633cd7fddad709a13d6
MD5 ce1e8af1ee38c40f594dd19f9cb988f5
SHA1 bc16517853592107970aae2d7c7d1546b1c6e960
SHA512 cf32ef77dcb0ba6b60da3ea3997746979844ebdc1db5470762c969bec2b3f5478bb348badbe2373e4eee7aea66e9c4db4f8b20919a6bf1b5e60345e5020f9ebe
SSDEEP 768:GQy0YIw0FI6Szz3G4yYijvbpyspGD2huFI1Fb2JPJFId4zT2C0U8qzqog7+XMhDF:GSY7PwYU1JPg8qzjUcn4f4Xsjh2Syy
TLSH
T152731A9EAD429032547363B8C96B1084FB374277524541A8F8DDD4887FB262D93A2FEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentPackageHeartbeat.zip

Path C:\Program Files\ATERA Networks\AteraAgent\Agent\packages\staging\AgentPackageHeartbeat.zip
Size 711KB
SHA256 e5c114edbdda488c5a0ca225db96a3548e8ddb89d89a52fb83e37e3a55f645ae
MD5 bcc25cb7e5169ffaa75faa96b62cce08
SHA1 228940c54c816eb89ad5c64ab6c727a1835945ae
SHA512 8c6d37f362a781163ccbdc39adbeeb73d12f08ea810551ff30abef6967c92a538cf69896bad1221aa28140c11879354dc0051ed483f1e3a7e3c13c080d7ada5b
SSDEEP 12288:rAA9YWvycaeteeeF8elNAZ2i4GbUTxt6w94xzftnF3TaBw:LGoeF8ONni4YU1L94xzlxv
TLSH
T167F4337215B5276CCAC20EB9D498FBB8331A7B5138E5BF20F1F475112CE8946CE8E616
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
Size 471B
SHA256 7fa7c5749452bece2b7b3d5f0cae66dbf4de42dafebca2e1882d59ac93df0510
MD5 5e26df5ffc0e519e80f1d953b832644e
SHA1 a3af1e8998a2d031231a6c8bf3132af6c50891b3
SHA512 a84c5ccd791e1c1996743ebd7d25607ea6c00577d6bdbbcc7b75372596a85180fc0ee48f3626737f6f23df905b1ca4a5c4fb23bce7ddb6c96e509173b00fd4ff
TLSH
T128F0D4F3057E70E2220F5CB85BE887902496616C14E3885128757FF42D47BD1690EC2F
MD5 SHA1 SHA512 TLSH

Submit Download

8EC9B1D0ABBD7F98B401D425828828CE_6FBFBE34ABAF2109B411B965FB39009E

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_6FBFBE34ABAF2109B411B965FB39009E
Size 727B
SHA256 842c698b8117c7e11f30f260288e839f73af4f586d3cfe289af2c330cf570dfb
MD5 f3b7b3eb55753f36cb964968bb1be2c7
SHA1 5e1a6049bc4494ae85dcd6827c02f7f8176982a3
SHA512 428922116f98628cd3dcdfe5414bf0869b75e015ab99e424acbd0373b41c120277b369a37e7150f97ed7db842e02bc9fdd930487239c280790badfeae72334ad
TLSH
T194014457AD802694DD98CEE65F3862943F54D22106AF944F363DE0E7E98E3326C8160E
MD5 SHA1 SHA512 TLSH

Submit Download

C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
Size 727B
SHA256 bb02ff717d514309b00a0e83888658e919a0f576ef5784825de39335379eb6f3
MD5 d229ed0ceefaa236e9df121cbb5d099b
SHA1 f7692ad67ceb89fd72d8e66b1a1443a7bc216474
SHA512 c5c799c2e722b576ca3c8b820850a3e7d5ffaeba7d446ad858537fab8e9b82355f162b9eb57b8409f070a225c1264cb894c4a687ab9d93725ccbe1efd4df1633
TLSH
T1270199AE44793E8178309EDDC55D44D43379D6B509D01B82B69A01FD009DAF7EE53942
MD5 SHA1 SHA512 TLSH

Submit Download

698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
Size 400B
SHA256 208287b396f5ac344254b5349488f2c129efbcb451a5e1e7ccfbc6ddb9df9ac0
MD5 7f9db7c5f0c2c207a5b2920cf43a5702
SHA1 fd10c499ef7f85b5c7b1e223a09cfe928208247b
SHA512 6cf7e4ddc56b17862726df2fa4ef23afaa0309119b85aa09ec772868a5cd59fea5475cc1252e9d13080eebcd5e301e720b924d0ba4f17a74740c3f601d1b1fc9
TLSH
T1BEE0202827FA541EF274977843D5A09A5F36F1062C6552BE1D91146DE91EE005C62C32
MD5 SHA1 SHA512 TLSH

Submit Download

8EC9B1D0ABBD7F98B401D425828828CE_6FBFBE34ABAF2109B411B965FB39009E

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_6FBFBE34ABAF2109B411B965FB39009E
Size 408B
SHA256 b58a9dd1f1f1b97602defe6ee0359bdc7961308f92ae6b94cc92b78d4ba15407
MD5 059ea46e9e5ef60cb4b7fadd0483c47b
SHA1 1112df0a7615b38d7cd084dbf60aaa45c085a8cd
SHA512 2dfd4081faf3b76416371bb82e3fe7966ae669582c261fc1d304a24102021a025b97f2c8cdde1dabace010390029244935cd48810e25385dca0dd9cefc9d7ac0
TLSH
T128E0C03431F5454CF0E0E43442F5A933685AF34B0905827A15401341FB19E008CE1638
MD5 SHA1 SHA512 TLSH

Submit Download

C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
Size 412B
SHA256 1508e88a8162e055e579d9a8476cbb3427fa1994af8c1c563d29439e9d9604e3
MD5 496644bf125c9d674c72e439457cf206
SHA1 2f87ea412f4f52819e69745cd278cfb2ccdb3a76
SHA512 2746b2d50345cba2cecd3f71f51e35002907d8ed477c7fadb97b9b2dbed3d6f69faf0cb983446ae7ff3228e2284ef2777c31b741d0b306622426b5245ac13810
TLSH
T146E06F2C22EBB10EF090983243FAA07A0E4AF2052C00A3B906C1030CAB0AF005C24EB0
MD5 SHA1 SHA512 TLSH

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 3b0068d29ae4b20c447227fbf410aa2deedfef6220ccc3f698f3c7707c032c55
MD5 2f57fde6b33e89a63cf0dfdd6e60a351
SHA1 445bf1b07223a04f8a159581a3d37d630273010f
SHA512 42857c5f111bfa163e9f4ea6b81a42233d0bbb0836ecc703ce7e8011b6f8a8eca761f39adc3ed026c9a2f99206d88bab9bddb42da9113e478a31a6382af5c220
TLSH
T15F51EE323375B1D8C9167F071E68198053BF4355EAA4AF1CB69C625EDD2640B9F222F3
MD5 SHA1 SHA512 TLSH

Submit Download

rundll32.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\rundll32.exe.log
Size 847B
SHA256 f0ab05c32d6af3c2b559dbce4dec025ce3e730655a2430ade520e89a557cace8
MD5 66a0a4aa01208ed3d53a5e131a8d030a
SHA1 ef5312ba2b46b51a4d04b574ca1789ac4ff4a6b1
SHA512 626f0dcf0c6bcdc0fef25dc7da058003cf929fd9a39a9f447b79fb139a417532a46f8bca1ff2dbde09abfcd70f5fb4f8d059b1fe91977c377df2f5f751c84c5c
TLSH
T193018EB12361F1D589133F461D9C264407FF4728BA50EE1CB5A9625ED9260275F222F3
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 28249014b107341f6e37fe4e0bf4d70db7a1b7ba4aa64ec13beeac5119e0deab
MD5 8794f87b4e6cbbc85c86fb04ab2487f0
SHA1 337524b7327bccf5aad14f9db6d9281a5fec832c
SHA512 488c244d6eb56687c505e825d19d365ae34a1a16a873732ace1e41b8c268e35a3436b92e904536c6c2ddc784e17754097c36149d435f9678e56b48bc54054c9f
TLSH
T18F117637B39C8921CC96153A409DAC1172B683C781AEDF9F6FC4D215A1BF984CB712A4
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_5obv45nt.pgk.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_5obv45nt.pgk.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

MSI1B53.tmp

Path C:\Windows\Installer\MSI1B53.tmp
Size 390KB
SHA256 7aacd4c18710e9bc4ff2034895a0a0c8f80f21809fb177d520e93f7688216e6d
MD5 e8dc682f2c486075c6aba658971a62cc
SHA1 7cd0a2b5047a4074aa06a6caa3bb69124851e95d
SHA512 a0a1f0f418bf2d4ffd079b840aeb0142c7faab7fa72b5e33b1841798569f55a25dfd305abf9c2ca89792f6499f695b69975882697dc53e99d5a975a9fa8c7d75
SSDEEP 6144:p2ET2+QBLh+MVy5DCRoRRvc181kaKN8MMLuG:p2ET2+cVXVyNhvcCkaKN8Me
TLSH
T10D846B29F7E408EDE4B78276C5A68530FF75748D3320D5AE47A8852D1F3AAA070BB701
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSIFE12.tmp

Path C:\Windows\Installer\MSIFE12.tmp
Size 347KB
SHA256 06663991953e1d06759e4f8abd7633119cacf674a0bd508b46028217ba984b75
MD5 f5877cbbb521db7d2bc52d62f6eab42d
SHA1 401c89c3b6b2ac41fa5194b131e52bc56d39b484
SHA512 95f93922a71f64a98f7fe9045e47a959e1324ebb107512e4be6c823014e2f1be44c3731888dcc42a6a837666fc6c56215575ae235be07151a133450a771a75bf
SSDEEP 6144:apUNpIx1IWpJHOrwIBaiRZ5bycX7EgfrU7NqnwDP+:BNp21IWpJkBdDyP8472/
TLSH
T1A174BE1977E80979FCBB567988730A05D673BC515771CB9F03A0421A9F3B390A93AF22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Atera.Agent.Installer.Msi.Ca.dll

Path C:\Windows\Installer\SFXCAB2528ACFA147DD499B4DA98F1065DBC2\Atera.Agent.Installer.Msi.Ca.dll
Size 75KB
SHA256 68aab5996b0970c4d100adaafd4d43473fa4bfdd85ac2233ce0a3bcfe67a0221
MD5 53f92d82163948d34a269fb85a18301e
SHA1 a867968946435fa18bdebd937ba086ade6e509fb
SHA512 9c2ce193c69dc60fa34ec8571de8853cfe4b379eec00d5bb032159fa226de14a2532ce93bd7e1ed6fe79c62bb58578c1420faa8795dbfdcdb034ad734c2e9b4c
SSDEEP 1536:DfjCRbOzg7NstWii4vkCZt8wAHk6bF3to5WD2oRMin4:Dfjub7NstriYLZaHHk6bBtUWD2+4
TLSH
T16D73E55177F84618F3FF5B79BD70950449B3BC266D31E68E1AA0244E0AB6BC0DA60B73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CustomAction.config

Path C:\Windows\Installer\SFXCAB2528ACFA147DD499B4DA98F1065DBC2\CustomAction.config
Size 956B
SHA256 2dbc73a3bc444a9119c9b5e20276698384d9ad9535a8a7547c44d1b9a8d67346
MD5 a9088b24614c12b70af6ae9669a4a4b1
SHA1 d72efa4e0c7bd733ed3d51831ead7031175c27e0
SHA512 14090969a71b6c80023da29dc8582aded6d26ca349966767ce22102080abce118b846a47ea2b9abe2d5f6a788bc083031d27fdee4103e2e4b99d29c2ac494d7c
TLSH
T10811D00D4A946B7724312793BFACA1C4E76194BA3994411CB49BB9151F39938176338F
MD5 SHA1 SHA512 TLSH

Submit Download

WixToolset.Dtf.WindowsInstaller.dll

Path C:\Windows\Installer\SFXCADF58B1941C42CDAA9DF7745A3541A706\WixToolset.Dtf.WindowsInstaller.dll
Size 193KB
SHA256 a614884ea627da1925131ebf41e8ae202caeac0fe543b86384f5eb2bfaf1aa75
MD5 ef8d5785ac8669f5fd54e22f52770e6b
SHA1 4c94ae7ef233be33a56c0a5d9b8e2211d5d5792c
SHA512 ab3b140bd6531f22e994606820e6511442c23d9015b1e1a38aaed43aa42ba29a996511151d0b3a383c05c2b11f670e52cdd7f507ad1a1ad8cebea57fb22ade5a
SSDEEP 3072:8Of7tVL+l4lj19l4uDHYHj69UgoTqdda7CnfKlRUjW01KytaljYqCDPC:8gQQx54Hj6jomdrzalMqb
TLSH
T14A149C2A57F84B3ECEFF8778E2614252C7B1F1E67103DB1D9D8281A52163784B682397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e58fd68.msi

Path C:\Windows\Installer\e58fd68.msi
Size 8.7MB
SHA256 ab941aef3d30bd16a3d8b423eee0f434f45f949c71e93d212fc60f2366df9ba2
MD5 8ae3c3ce47ad4588c1e4d19192824b04
SHA1 b094d28cbdcd3f507557d9a35d2621b1e01834e1
SHA512 a2569d6cdc576b270c4c1a1b85f2c96ba8a2adf8a4e6595e419a16f2125cf7ae228be11787b130c0ad39b63282728c2ba1ab50d233baeda267e19f98b13dbe92
SSDEEP 196608:lWWDdyCV88IEa53XLbHfXNtsNSCYMsM/JTaAnuovyaH:ZpDu8kPHfXNmJsm5Moq6
TLSH
T1BD963319BBD009FDE977827688A38561EE367C883760C59F0364B1195F3BBA0B07B761
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Tmp5C30.tmp

Path C:\Windows\Temp\Tmp5C30.tmp
Size 3KB
SHA256 94739ca46676bd602a78671257fbfce39feaabc9664c6326bf4970a0108e3429
MD5 560af444a6a7faa0b0ca94dc16ca2a58
SHA1 df31453fafde354870a0a9a8ca50b18e284c32e4
SHA512 7c853176c088d56a517e52c6687b6debf08f6f9726376720ade9d13fafc9be0ca72f0f2b35562a61ece653aeb789c838c60447f463b2bbe70c21bfc8c039b681
TLSH
T1B3616C88B10E28972CEECC504D495B40AEC3D754B390F25F68F4BCA64CA13E9A358C3C
MD5 SHA1 SHA512 TLSH

Submit Download

metadata-2

Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
Size 24.1MB
SHA256 79a4b08c93ba41f13123b2b224e0c8c4e085b35e65f21d77d1d82fc11845d08b
MD5 823f5c12a97fd3bf52cdc5524f7d7998
SHA1 d518f2638a213a8fd861ef9d3510ee26ed443532
SHA512 9900a1ae391828cdb9d2455a2c009c89ae837615d2df69fb2daa77fcdcec919ac4b3ae52ebd15d7605684105ea5f39ecc0beb2c09cb453171d1a389d7ac92c87
SSDEEP 24576:tu8m+1zXdoO/vvTLb2t+oGqZc0UjVVdSBLGtPic1l0asOqEgIP1UlbGRI:p
TLSH
T1D347A3243AF92110E7B79E3C6CF0AA234D3A7D5B9C199E8D45411F4E0921FB0E972F5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{71b55832-6b3b-4fb4-b010-52ac70977bf3}_OnDiskSnapshotProp

Path \??\Volume{c9561ee0-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{71b55832-6b3b-4fb4-b010-52ac70977bf3}_OnDiskSnapshotProp
Size 6KB
SHA256 53a91874b0bccebeccdcce514a5e318fa54a8165897c790919ffb7b87d2dad86
MD5 863e4f40014c0d17a2b712e3be427c40
SHA1 f5a482515a500b84bbd435f20f53fd64d2887f8a
SHA512 b0aa4052f4fe2a43b658ebdfe691fa7db935eb7d7b18ce83a886724cd7b840297c73a017752a63d14c30b234e3853e424e487d3c46b8cf65a9c08679d82b63ba
SSDEEP 96:FRcIJpvc8DD84LTHzbOHXOHBlBRQ88Sc9XE56tOSVQpu:Hzjb++ZVm
TLSH
T19FD188085AE54711E2B3AB7129F18557A877B911EF33CB8E0298238E2670A10F975F5F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2444-155-0x000002289C060000-0x000002289C06A000-memory.dmp

Download

memory/2444-156-0x000002289C090000-0x000002289C0A2000-memory.dmp

Download

memory/2444-153-0x000002289C060000-0x000002289C084000-memory.dmp

Download

memory/2444-152-0x000002289C060000-0x000002289C08A000-memory.dmp

Download

memory/4236-132-0x0000016B26B20000-0x0000016B26B42000-memory.dmp

Download

memory/4844-37-0x0000017E796D0000-0x0000017E796E8000-memory.dmp

Download

memory/4844-33-0x0000017E79BA0000-0x0000017E79BD4000-memory.dmp

Download

memory/4892-60-0x0000017AFA6A0000-0x0000017AFA6DC000-memory.dmp

Download

memory/4892-59-0x0000017AE1510000-0x0000017AE1522000-memory.dmp

Download