ab941aef3d30bd16a3d8b423eee0f434f45f949c71e93d212fc60f2366df9ba2

Analysis

max time kernel
148s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
23/10/2026, 12:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Project%20specification%20document.msi
Size 8.7MB
Sample261023-pcjztscg86
SHA256 ab941aef3d30bd16a3d8b423eee0f434f45f949c71e93d212fc60f2366df9ba2
MD5 8ae3c3ce47ad4588c1e4d19192824b04
SHA1 b094d28cbdcd3f507557d9a35d2621b1e01834e1
SHA512 a2569d6cdc576b270c4c1a1b85f2c96ba8a2adf8a4e6595e419a16f2125cf7ae228be11787b130c0ad39b63282728c2ba1ab50d233baeda267e19f98b13dbe92
SSDEEP 196608:lWWDdyCV88IEa53XLbHfXNtsNSCYMsM/JTaAnuovyaH:ZpDu8kPHfXNmJsm5Moq6
TLSH
T1BD963319BBD009FDE977827688A38561EE367C883760C59F0364B1195F3BBA0B07B761
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery execution persistence privilege_escalation ransomware

Malware Config

Signatures

Badlisted process makes network request 12 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
5	1652	msiexec.exe
15	5624	rundll32.exe
16	4544	rundll32.exe
17	5616	powershell.exe
18	5616	powershell.exe
19	2808	powershell.exe
20	2808	powershell.exe
21	2808	powershell.exe
22	2808	powershell.exe
23	2808	powershell.exe
24	2808	powershell.exe
25	1484	rundll32.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
5616	powershell.exe
2808	powershell.exe

Executes dropped EXE 3 IoCs

pid	Process
1236	AteraAgent.exe
4604	AteraAgent.exe
2904	dotnet.exe

Loads dropped DLL 24 IoCs

pid	Process
1012	MsiExec.exe
3448	rundll32.exe
3448	rundll32.exe
3448	rundll32.exe
1012	MsiExec.exe
5624	rundll32.exe
5624	rundll32.exe
5624	rundll32.exe
1012	MsiExec.exe
4544	rundll32.exe
4544	rundll32.exe
4544	rundll32.exe
1012	MsiExec.exe
2468	rundll32.exe
2468	rundll32.exe
2468	rundll32.exe
3740	MsiExec.exe
3740	MsiExec.exe
3740	MsiExec.exe
2904	dotnet.exe
1012	MsiExec.exe
1484	rundll32.exe
1484	rundll32.exe
1484	rundll32.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe

Drops file in System32 directory 6 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\75CA58072B9926F763A91F0CC2798706_3AD253ACA02D44EA5FD30683B8A5B5FA	AteraAgent.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\D1BEC81CCAFDC823A062FF26A89A6B6D_D40E4E79DF388B984709B048EEAFD4E4	AteraAgent.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\D1BEC81CCAFDC823A062FF26A89A6B6D_D40E4E79DF388B984709B048EEAFD4E4	AteraAgent.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\BAD725C80F9E10846F35D039A996E4A8_88B6AE015495C1ECC395D19C1DD02894	AteraAgent.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\BAD725C80F9E10846F35D039A996E4A8_88B6AE015495C1ECC395D19C1DD02894	AteraAgent.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\75CA58072B9926F763A91F0CC2798706_3AD253ACA02D44EA5FD30683B8A5B5FA	AteraAgent.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\10.0.13\System.Security.Cryptography.Csp.dll	powershell.exe
File created	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\10.0.13\System.Diagnostics.DiagnosticSource.dll	powershell.exe
File opened for modification	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\10.0.13\System.Net.Sockets.dll	powershell.exe
File created	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\10.0.13\System.Private.CoreLib.dll	powershell.exe
File created	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\10.0.13\System.Security.Cryptography.Primitives.dll	powershell.exe
File created	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\10.0.13\System.Transactions.dll	powershell.exe
File created	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\10.0.13\WindowsBase.dll	powershell.exe
File opened for modification	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\10.0.13\System.Net.Requests.dll	powershell.exe
File created	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\10.0.13\System.Private.DataContractSerialization.dll	powershell.exe
File opened for modification	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\10.0.13\System.Private.DataContractSerialization.dll	powershell.exe
File created	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\10.0.13\System.Runtime.InteropServices.RuntimeInformation.dll	powershell.exe
File created	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\10.0.13\System.Private.Xml.dll	powershell.exe
File created	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\10.0.13\System.Runtime.Serialization.Xml.dll	powershell.exe
File opened for modification	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\10.0.13\System.ValueTuple.dll	powershell.exe
File opened for modification	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\10.0.13\System.Xml.Linq.dll	powershell.exe
File created	C:\Program Files\ATERA Networks\AteraAgent\Agent\packages\staging\AgentPackageUpgradeAgent.zip	AteraAgent.exe
File opened for modification	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\10.0.13\mscordaccore_amd64_amd64_10.0.1326.50504.dll	powershell.exe
File created	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\10.0.13\System.Collections.NonGeneric.dll	powershell.exe
File created	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\10.0.13\System.Diagnostics.Tracing.dll	powershell.exe
File opened for modification	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\10.0.13\System.Net.Http.Json.dll	powershell.exe
File created	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\10.0.13\System.Numerics.Vectors.dll	powershell.exe
File created	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\10.0.13\System.Runtime.CompilerServices.VisualC.dll	powershell.exe
File created	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\10.0.13\System.ServiceProcess.dll	powershell.exe
File created	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\10.0.13\System.Collections.Immutable.dll	powershell.exe
File opened for modification	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\10.0.13\System.Collections.Specialized.dll	powershell.exe
File opened for modification	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\10.0.13\System.Net.Http.dll	powershell.exe
File opened for modification	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\10.0.13\System.Net.ServicePoint.dll	powershell.exe
File created	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\10.0.13\System.ValueTuple.dll	powershell.exe
File created	C:\Program Files\ATERA Networks\AteraAgent\Agent\packages\staging\AgentPackageSystemTools.zip	AteraAgent.exe
File created	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\10.0.13\Microsoft.NETCore.App.deps.json	powershell.exe
File created	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\10.0.13\System.IO.FileSystem.DriveInfo.dll	powershell.exe
File created	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\10.0.13\System.IO.FileSystem.Watcher.dll	powershell.exe
File created	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\10.0.13\System.Runtime.InteropServices.dll	powershell.exe
File opened for modification	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\10.0.13\System.Security.Cryptography.Encoding.dll	powershell.exe
File opened for modification	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\10.0.13\System.Linq.Expressions.dll	powershell.exe
File opened for modification	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\10.0.13\System.Linq.Parallel.dll	powershell.exe
File opened for modification	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\10.0.13\System.Resources.ResourceManager.dll	powershell.exe
File opened for modification	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\10.0.13\System.Threading.Channels.dll	powershell.exe
File created	C:\Program Files\ATERA Networks\AteraAgent\Agent\packages\staging\AgentPackageCollectLogs.zip	AteraAgent.exe
File opened for modification	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\10.0.13\System.Data.dll	powershell.exe
File created	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\dotnet.exe	powershell.exe
File opened for modification	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\10.0.13\System.Data.DataSetExtensions.dll	powershell.exe
File created	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\10.0.13\System.Net.Ping.dll	powershell.exe
File opened for modification	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\10.0.13\System.Net.Ping.dll	powershell.exe
File opened for modification	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\10.0.13\System.Reflection.Emit.dll	powershell.exe
File opened for modification	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\10.0.13\System.Security.Cryptography.dll	powershell.exe
File opened for modification	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\10.0.13\coreclr.dll	powershell.exe
File opened for modification	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\10.0.13\System.Collections.Immutable.dll	powershell.exe
File opened for modification	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\10.0.13\System.IO.Compression.ZipFile.dll	powershell.exe
File created	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\10.0.13\System.Security.Principal.dll	powershell.exe
File created	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\10.0.13\System.Security.Principal.Windows.dll	powershell.exe
File opened for modification	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\10.0.13\System.Threading.Tasks.Dataflow.dll	powershell.exe
File opened for modification	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\10.0.13\Microsoft.DiaSymReader.Native.amd64.dll	powershell.exe
File created	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\10.0.13\System.Diagnostics.TraceSource.dll	powershell.exe
File created	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\10.0.13\System.Globalization.Calendars.dll	powershell.exe
File created	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\10.0.13\System.Globalization.dll	powershell.exe
File opened for modification	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\10.0.13\System.Linq.Queryable.dll	powershell.exe
File opened for modification	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\10.0.13\System.Reflection.Metadata.dll	powershell.exe
File created	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\10.0.13\System.Runtime.Serialization.Formatters.dll	powershell.exe
File created	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\10.0.13\System.Security.Cryptography.OpenSsl.dll	powershell.exe
File opened for modification	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\10.0.13\System.Net.Mail.dll	powershell.exe
File created	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\10.0.13\coreclr.dll	powershell.exe
File opened for modification	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\10.0.13\hostpolicy.dll	powershell.exe
File opened for modification	C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\10.0.13\Microsoft.VisualBasic.Core.dll	powershell.exe

Drops file in Windows directory 43 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\~DF5CE3E7BF0B0D02D0.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI53D4.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\SFXCAA431B2EC934A1979836487A99F4DE995\Atera.Agent.Installer.Msi.Ca.dll	rundll32.exe
File opened for modification	C:\Windows\SystemTemp\Tmp9898.tmp	AteraAgent.exe
File opened for modification	C:\Windows\Installer\MSI1A7E.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\SFXCAF57C1EF9EC4DD0FA924AD02B21B640D6\WixToolset.Dtf.WindowsInstaller.dll	rundll32.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_pl20aito.5vn.ps1	powershell.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_xvhwizdj.twc.psm1	powershell.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_n2ststck.mi3.ps1	powershell.exe
File created	C:\Windows\Installer\e5a159e.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\SFXCAA431B2EC934A1979836487A99F4DE995\WixToolset.Dtf.WindowsInstaller.dll	rundll32.exe
File created	C:\Windows\SystemTemp\~DF00114C70AA6E4E23.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI3C61.tmp	msiexec.exe
File created	C:\Windows\Installer\e5a159c.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\SFXCA47005FC29F466BA9624264FCEAB09679\WixToolset.Dtf.WindowsInstaller.dll	rundll32.exe
File created	C:\Windows\Installer\SourceHash{CFDAB197-8EA2-4290-AD55-9CF0D4175F9C}	msiexec.exe
File opened for modification	C:\Windows\Installer\SFXCA4273BFAFD14EECE9CFB679507397BBB4\WixToolset.Dtf.WindowsInstaller.dll	rundll32.exe
File created	C:\Windows\SystemTemp\~DFB94CD80C938FA697.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\e3lvoi1v.qmf	powershell.exe
File opened for modification	C:\Windows\Installer\SFXCAA431B2EC934A1979836487A99F4DE995\CustomAction.config	rundll32.exe
File opened for modification	C:\Windows\Installer\SFXCA4273BFAFD14EECE9CFB679507397BBB4\Atera.Agent.Installer.Msi.Ca.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\SFXCA1BEA600F2D48B55B2501AF7D056F2321\WixToolset.Dtf.WindowsInstaller.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\SFXCA47005FC29F466BA9624264FCEAB09679\CustomAction.config	rundll32.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_q3m0r2ut.tzu.ps1	powershell.exe
File opened for modification	C:\Windows\Installer\SFXCA1BEA600F2D48B55B2501AF7D056F2321\Atera.Agent.Installer.Msi.Ca.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\SFXCA47005FC29F466BA9624264FCEAB09679\Atera.Agent.Installer.Msi.Ca.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI3CB0.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI3F03.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DF4996699BFFF8EBAB.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI38A7.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\e5a159c.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\SFXCA1BEA600F2D48B55B2501AF7D056F2321\CustomAction.config	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI2405.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_xqlmswi5.zfw.psm1	powershell.exe
File opened for modification	C:\Windows\Installer\SFXCA4273BFAFD14EECE9CFB679507397BBB4\CustomAction.config	rundll32.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\SFXCAF57C1EF9EC4DD0FA924AD02B21B640D6\Atera.Agent.Installer.Msi.Ca.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\SFXCAF57C1EF9EC4DD0FA924AD02B21B640D6\CustomAction.config	rundll32.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_2aw1fgno.vux.psm1	powershell.exe
File opened for modification	C:\Windows\Installer\MSI5C03.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI8FE5.tmp	msiexec.exe

Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs

persistence privilege_escalation

Installer Packages

T1546.016

Msiexec

T1218.007

pid	Process
1652	msiexec.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1852	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 8 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	rundll32.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	rundll32.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	rundll32.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	rundll32.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	AteraAgent.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	rundll32.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	AteraAgent.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	rundll32.exe

System Time Discovery 1 TTPs 4 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2808	powershell.exe
1852	cmd.exe
2904	dotnet.exe
2468	rundll32.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000430d2ae4193eb5170000000000000000000000000000000000000000000000000000000000000000000000000000000000001071020000000000c0120000000000000000000000002701010000883801430d2ae40000000000001071020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d0830200000000006025c501000000000000000000000700010000e84101430d2ae4000000000000d08302000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9c701000000000000050000000000000000000000070001000098d4e3430d2ae400000000000030a9c7010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9cc0100000000000005000000000000000000000007000100009854e6430d2ae400000000000030a9cc01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	AteraAgent.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28\52C64B7E\@%SystemRoot%\System32\fveui.dll,-843 = "BitLocker Drive Encryption"	AteraAgent.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28\52C64B7E\@%SystemRoot%\System32\wuaueng.dll,-400 = "Windows Update"	AteraAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	AteraAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	AteraAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28\52C64B7E\@%SystemRoot%\system32\dnsapi.dll,-103 = "Domain Name System (DNS) Server Trust"	AteraAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	AteraAgent.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28\52C64B7E\@%SystemRoot%\system32\WindowsPowerShell\v1.0\powershell.exe,-124 = "Document Encryption"	AteraAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	AteraAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	AteraAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	powershell.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28\52C64B7E	AteraAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	AteraAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	AteraAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	AteraAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	AteraAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	AteraAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	powershell.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	AteraAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	AteraAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	AteraAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	AteraAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28\52C64B7E\@%SystemRoot%\System32\fveui.dll,-844 = "BitLocker Data Recovery Agent"	AteraAgent.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28\52C64B7E\@%SystemRoot%\system32\NgcRecovery.dll,-100 = "Windows Hello Recovery Key Encryption"	AteraAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	AteraAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	AteraAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	AteraAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe

Modifies registry class 22 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\791BADFC2AE80924DA55C90F4D71F5C9\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\791BADFC2AE80924DA55C90F4D71F5C9\SourceList\Media	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\791BADFC2AE80924DA55C90F4D71F5C9\AteraAgentFeature	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\791BADFC2AE80924DA55C90F4D71F5C9	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\791BADFC2AE80924DA55C90F4D71F5C9\PackageCode = "4AABD2A4DAE6F51479091627BD898F6F"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\791BADFC2AE80924DA55C90F4D71F5C9\InstanceType = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\791BADFC2AE80924DA55C90F4D71F5C9\SourceList\Net	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\791BADFC2AE80924DA55C90F4D71F5C9\ProductName = "AteraAgent"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\791BADFC2AE80924DA55C90F4D71F5C9\Version = "33882150"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\791BADFC2AE80924DA55C90F4D71F5C9\Assignment = "1"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\791BADFC2AE80924DA55C90F4D71F5C9\SourceList\PackageName = "Project%20specification%20document.msi"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\791BADFC2AE80924DA55C90F4D71F5C9\SourceList\Media\1 = ";"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\791BADFC2AE80924DA55C90F4D71F5C9\Clients = 3a0000000000	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\791BADFC2AE80924DA55C90F4D71F5C9\Language = "1033"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\791BADFC2AE80924DA55C90F4D71F5C9\AuthorizedLUAApp = "0"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\791BADFC2AE80924DA55C90F4D71F5C9\DeploymentFlags = "3"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\25F46F8180ECF4345A1FA7A8935DE9AE	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\25F46F8180ECF4345A1FA7A8935DE9AE\791BADFC2AE80924DA55C90F4D71F5C9	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\791BADFC2AE80924DA55C90F4D71F5C9\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\791BADFC2AE80924DA55C90F4D71F5C9\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\791BADFC2AE80924DA55C90F4D71F5C9	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\791BADFC2AE80924DA55C90F4D71F5C9\AdvertiseFlags = "388"	msiexec.exe

Suspicious behavior: EnumeratesProcesses 31 IoCs

pid	Process
5624	rundll32.exe
5624	rundll32.exe
3132	msiexec.exe
3132	msiexec.exe
1236	AteraAgent.exe
1236	AteraAgent.exe
5616	powershell.exe
5616	powershell.exe
5616	powershell.exe
2808	powershell.exe
2808	powershell.exe
2808	powershell.exe
4604	AteraAgent.exe
4604	AteraAgent.exe
4604	AteraAgent.exe
4604	AteraAgent.exe
4604	AteraAgent.exe
4604	AteraAgent.exe
4604	AteraAgent.exe
4604	AteraAgent.exe
4604	AteraAgent.exe
4604	AteraAgent.exe
4604	AteraAgent.exe
4604	AteraAgent.exe
4604	AteraAgent.exe
4604	AteraAgent.exe
4604	AteraAgent.exe
4604	AteraAgent.exe
4604	AteraAgent.exe
4604	AteraAgent.exe
4604	AteraAgent.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1652	msiexec.exe
Token: SeIncreaseQuotaPrivilege	1652	msiexec.exe
Token: SeSecurityPrivilege	3132	msiexec.exe
Token: SeCreateTokenPrivilege	1652	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	1652	msiexec.exe
Token: SeLockMemoryPrivilege	1652	msiexec.exe
Token: SeIncreaseQuotaPrivilege	1652	msiexec.exe
Token: SeMachineAccountPrivilege	1652	msiexec.exe
Token: SeTcbPrivilege	1652	msiexec.exe
Token: SeSecurityPrivilege	1652	msiexec.exe
Token: SeTakeOwnershipPrivilege	1652	msiexec.exe
Token: SeLoadDriverPrivilege	1652	msiexec.exe
Token: SeSystemProfilePrivilege	1652	msiexec.exe
Token: SeSystemtimePrivilege	1652	msiexec.exe
Token: SeProfSingleProcessPrivilege	1652	msiexec.exe
Token: SeIncBasePriorityPrivilege	1652	msiexec.exe
Token: SeCreatePagefilePrivilege	1652	msiexec.exe
Token: SeCreatePermanentPrivilege	1652	msiexec.exe
Token: SeBackupPrivilege	1652	msiexec.exe
Token: SeRestorePrivilege	1652	msiexec.exe
Token: SeShutdownPrivilege	1652	msiexec.exe
Token: SeDebugPrivilege	1652	msiexec.exe
Token: SeAuditPrivilege	1652	msiexec.exe
Token: SeSystemEnvironmentPrivilege	1652	msiexec.exe
Token: SeChangeNotifyPrivilege	1652	msiexec.exe
Token: SeRemoteShutdownPrivilege	1652	msiexec.exe
Token: SeUndockPrivilege	1652	msiexec.exe
Token: SeSyncAgentPrivilege	1652	msiexec.exe
Token: SeEnableDelegationPrivilege	1652	msiexec.exe
Token: SeManageVolumePrivilege	1652	msiexec.exe
Token: SeImpersonatePrivilege	1652	msiexec.exe
Token: SeCreateGlobalPrivilege	1652	msiexec.exe
Token: SeBackupPrivilege	4732	vssvc.exe
Token: SeRestorePrivilege	4732	vssvc.exe
Token: SeAuditPrivilege	4732	vssvc.exe
Token: SeBackupPrivilege	3132	msiexec.exe
Token: SeRestorePrivilege	3132	msiexec.exe
Token: SeRestorePrivilege	3132	msiexec.exe
Token: SeTakeOwnershipPrivilege	3132	msiexec.exe
Token: SeRestorePrivilege	3132	msiexec.exe
Token: SeTakeOwnershipPrivilege	3132	msiexec.exe
Token: SeDebugPrivilege	3448	rundll32.exe
Token: SeBackupPrivilege	5948	srtasks.exe
Token: SeRestorePrivilege	5948	srtasks.exe
Token: SeSecurityPrivilege	5948	srtasks.exe
Token: SeTakeOwnershipPrivilege	5948	srtasks.exe
Token: SeRestorePrivilege	3132	msiexec.exe
Token: SeTakeOwnershipPrivilege	3132	msiexec.exe
Token: SeDebugPrivilege	5624	rundll32.exe
Token: SeBackupPrivilege	5948	srtasks.exe
Token: SeRestorePrivilege	5948	srtasks.exe
Token: SeSecurityPrivilege	5948	srtasks.exe
Token: SeTakeOwnershipPrivilege	5948	srtasks.exe
Token: SeRestorePrivilege	3132	msiexec.exe
Token: SeTakeOwnershipPrivilege	3132	msiexec.exe
Token: SeDebugPrivilege	4544	rundll32.exe
Token: SeRestorePrivilege	3132	msiexec.exe
Token: SeTakeOwnershipPrivilege	3132	msiexec.exe
Token: SeRestorePrivilege	3132	msiexec.exe
Token: SeTakeOwnershipPrivilege	3132	msiexec.exe
Token: SeDebugPrivilege	2468	rundll32.exe
Token: SeRestorePrivilege	3132	msiexec.exe
Token: SeTakeOwnershipPrivilege	3132	msiexec.exe
Token: SeDebugPrivilege	1236	AteraAgent.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
1652	msiexec.exe
1652	msiexec.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
1652	msiexec.exe
3132	msiexec.exe
1012	MsiExec.exe
3740	MsiExec.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 3132 wrote to memory of 5948	3132	msiexec.exe	94
PID 3132 wrote to memory of 1012	3132	msiexec.exe	96
PID 1012 wrote to memory of 3448	1012	MsiExec.exe	97
PID 1012 wrote to memory of 5624	1012	MsiExec.exe	99
PID 1012 wrote to memory of 4544	1012	MsiExec.exe	100
PID 1012 wrote to memory of 2468	1012	MsiExec.exe	101
PID 3132 wrote to memory of 3740	3132	msiexec.exe	102
PID 3740 wrote to memory of 1236	3740	MsiExec.exe	103
PID 3740 wrote to memory of 5616	3740	MsiExec.exe	105
PID 3740 wrote to memory of 2808	3740	MsiExec.exe	107
PID 4604 wrote to memory of 1852	4604	AteraAgent.exe	111
PID 1852 wrote to memory of 2904	1852	cmd.exe	113
PID 1012 wrote to memory of 1484	1012	MsiExec.exe	114

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\Project%20specification%20document.msi
1⤵
- Badlisted process makes network request
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:1652

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3132
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:5948
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding 6D96E57DF5D8441C6B1524EFFBAFD723
  2⤵
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1012
- - C:\Windows\system32\rundll32.exe
    rundll32.exe "C:\Windows\Installer\MSI1A7E.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240786750 2 Atera.Agent.Installer.Msi.Ca!Atera.Agent.Installer.Msi.Ca.CustomActions.GenerateAgentId
    3⤵
    - Loads dropped DLL
    - Drops file in Windows directory
    - Suspicious use of AdjustPrivilegeToken
    PID:3448
- - C:\Windows\system32\rundll32.exe
    rundll32.exe "C:\Windows\Installer\MSI2405.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240788500 6 Atera.Agent.Installer.Msi.Ca!Atera.Agent.Installer.Msi.Ca.CustomActions.ShouldContinueInstallation
    3⤵
    - Badlisted process makes network request
    - Loads dropped DLL
    - Drops file in Windows directory
    - Reads the TCP/IP host and domain name from the registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5624
- - C:\Windows\system32\rundll32.exe
    rundll32.exe "C:\Windows\Installer\MSI38A7.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240793796 10 Atera.Agent.Installer.Msi.Ca!Atera.Agent.Installer.Msi.Ca.CustomActions.ReportMsiInstallStart
    3⤵
    - Badlisted process makes network request
    - Loads dropped DLL
    - Drops file in Windows directory
    - Reads the TCP/IP host and domain name from the registry
    - Suspicious use of AdjustPrivilegeToken
    PID:4544
- - C:\Windows\system32\rundll32.exe
    rundll32.exe "C:\Windows\Installer\MSI3CB0.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240794859 15 Atera.Agent.Installer.Msi.Ca!Atera.Agent.Installer.Msi.Ca.CustomActions.DetectDotNetFrameworkRuntime
    3⤵
    - Loads dropped DLL
    - Drops file in Windows directory
    - System Time Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2468
- - C:\Windows\system32\rundll32.exe
    rundll32.exe "C:\Windows\Installer\MSI8FE5.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240816187 31 Atera.Agent.Installer.Msi.Ca!Atera.Agent.Installer.Msi.Ca.CustomActions.ReportMsiInstallEnd
    3⤵
    - Badlisted process makes network request
    - Loads dropped DLL
    - Drops file in Windows directory
    - Reads the TCP/IP host and domain name from the registry
    PID:1484
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding 76657DED4708265487C12C4AE5108DD1 E Global\MSI0000
  2⤵
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3740
- - C:\Program Files\ATERA Networks\AteraAgent\Agent\AteraAgent.exe
    "C:\Program Files\ATERA Networks\AteraAgent\Agent\AteraAgent.exe" init-settings --agent-id "f04fc602-defe-482c-9a43-f064550274b2" --account-id "5QGPL4zjAIBgQFnvTNs26FiJppYCq0WzQOH29bqUDyM=" --account-agent-installation-id "2fcd1ed7d8e54882ad9c55b32a2b7490" --environment "Production" --customer-id "1" --folder-id ""
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1236
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" -ExecutionPolicy Bypass -NoProfile -Command "[Net.ServicePointManager]::SecurityProtocol=[Net.SecurityProtocolType]::Tls12;Invoke-WebRequest -Uri 'https://dot.net/v1/dotnet-install.ps1' -OutFile \"C:\Program Files\ATERA Networks\AteraAgent\Agent\dotnet-install.ps1\""
    3⤵
    - Badlisted process makes network request
    - Command and Scripting Interpreter: PowerShell
    - Drops file in Windows directory
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    PID:5616
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" -ExecutionPolicy unrestricted -NoProfile -File "C:\Program Files\ATERA Networks\AteraAgent\Agent\dotnet-install.ps1" -Channel 10.0 -Runtime dotnet -InstallDir "C:\Program Files\ATERA Networks\AteraAgent\Agent\\.dotnet"
    3⤵
    - Badlisted process makes network request
    - Command and Scripting Interpreter: PowerShell
    - Drops file in Program Files directory
    - Drops file in Windows directory
    - System Time Discovery
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    PID:2808

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:4732

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:2976

C:\Program Files\ATERA Networks\AteraAgent\Agent\AteraAgent.exe
"C:\Program Files\ATERA Networks\AteraAgent\Agent\AteraAgent.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4604
- C:\Windows\system32\cmd.exe
  "cmd.exe" /c "C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\dotnet.exe" --list-runtimes
  2⤵
  - Executes a command shell one-liner
  - System Time Discovery
  - Suspicious use of WriteProcessMemory
  PID:1852
- - C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\dotnet.exe
    "C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\dotnet.exe" --list-runtimes
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Time Discovery
    PID:2904

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Event Triggered Execution

T1546

Installer Packages

T1546.016

Privilege Escalation

Event Triggered Execution

T1546

Installer Packages

T1546.016

Defense Evasion

System Binary Proxy Execution

T1218

Msiexec

T1218.007

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e5a159d.rbs

Path C:\Config.Msi\e5a159d.rbs
Size 7KB
SHA256 077bc7960bcf4d108484e2505b95721d203a75fa19ba573e69512d44071a3801
MD5 dc4b99e6c30669d5f9378d88dd61d17d
SHA1 d7b9f5e049f02f3a3fead10975508c149f549825
SHA512 1c8d19bd347086a85f65e4fd2326d03463499942f6252f94c2309c31c825053db0b213fe10e71040bde85a980cbcc156b2144ee63d3bb10e58109204b3194ce1
SSDEEP 96:nmP4psz1UsmCrvbvmpUBTIuCsTl3UBTIuC6jNwvjvN+TlNC35vu9WvRvgvxIC9pd:mP4iz1wC+i6NI26NkVKKt9pLFf
TLSH
T19CF10046620081E6EA5B2B30C70B17673FF6D2DA8354235B09CD61B85F8738A6FA519F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\dotnet.exe
Size 163KB
SHA256 abce6623a6729059cf39bb0f728c4a7804f625895099c88c17e6e704661e09eb
MD5 21e071bada82a388f86bb9d7787cfa4b
SHA1 7f99765fcc1836b90b9dea74fb5e71c5c24ddcc1
SHA512 165cb61b61fd965b09f7df737ead653ddecc8a60893d40c1306e8a6230b6a50bcdaf5956dabc1639fe430857da38c36332ead1958cbe0caebc330a8645a6634e
SSDEEP 3072:4GgPMwruvTSBbQ/vp4SbDqIG/Kk7l55wKlE5Ey:4GUrubgbQJDvqIWtKiy
TLSH
T12BF3071AD65811AAD06E9575CB528941BB337C668BE0E3CB53C0F8BE0F726905EF9703
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hostfxr.dll

Path C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\host\fxr\10.0.13\hostfxr.dll
Size 370KB
SHA256 2e6bf792d54303a54467102fd873a7d7a993f828e8d19c040e13e428e5f2d9c8
MD5 02536bfc6928ad20d8e344ddf79eb9b6
SHA1 d509fedc26bb3f39fbd2b3a9417e50d2aa9b6fca
SHA512 51524309f927809d67ca3ce8c8978ec3f843750f0181bb418f7686c9e5eb27a11144e3b03ff7687d6138cf3913394d93914c52821aaf0b83314a0a9a7ccc2787
SSDEEP 6144:6alRvjNggqbRVhaUzIS64W+zz3Z0UCVvfpJEl0FsGxilKmkVAwBAc/UWo2CUHFhg:65V0iOnpq2TDNH9Bqb
TLSH
T1C2840816D3E8057CF0B79678DAB29902EB727C494BB0E5DF139088651E73BD09A39723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mscordaccore_amd64_amd64_10.0.1326.50504.dll

Path C:\Program Files\ATERA Networks\AteraAgent\Agent\.dotnet\shared\Microsoft.NETCore.App\10.0.13\mscordaccore_amd64_amd64_10.0.1326.50504.dll
Size 1.3MB
SHA256 4e2109c88298f0a614aac82b23310b13835673a8e192a6a8b75c25459e591169
MD5 65dcc460b122d3e82d4beacec5850d4d
SHA1 ee27a68705098105fd8b87f6206f787ac5d3bf17
SHA512 2f1283bcc1b0b4f082753923dc9325e7adb3bc19405c8db73c79804f84528990bd7f92e0b7e1a4d1f8d91d5fd3ef9fd72669f3f138ff09f7b7358dd6edbf7116
SSDEEP 24576:bDMXkJvfPhh6YuBeQeJBQeyLnO4AB61e+6mResmk7fdiYd:UXkJvfPhAuJBGLO4AB61e+FResmw
TLSH
T15F554A56D6BC4499CEA9D0F8C547491FEBB13811033466FF46A48B192F3BBE66ABC310
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

.settings.json

Path C:\Program Files\ATERA Networks\AteraAgent\Agent\.settings.json
Size 35KB
SHA256 ae935dbbd6df32feec085304500dc91014e1f004b57c620858d1b39ca74a5230
MD5 e83e97257c42f055e115ed8e41805c29
SHA1 56d033ed19763a4c444c68d481e899cfa4d50fa0
SHA512 8611f6792c7cda4b97842ebe684b6c874fbd48da4f299fd5171c93f86189995778719cd2a0a52cea708753d6f589a3f8178b607411936c1b498de2dbc5e4afe0
SSDEEP 768:LWy3G9Ze2RGn2RO6FMpRO6FM7Or/1b2/LQm/cnc4:L72XGn2ROlpROl7OxGOc4
TLSH
T142F2640B52E50621C3780F4D34EE3DB8621D7B9275C18CCFB6A5162AD92AC72D45F1BB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

.settings.json

Path C:\Program Files\ATERA Networks\AteraAgent\Agent\.settings.json
Size 243B
SHA256 91090665629f8ee1d72b295d98168377a6503a1859b2ea3f71b75e7ac9ceea2c
MD5 f22002a59a9426a0b71a71501c3b6e70
SHA1 4b7425023718d612a1ab72f7805201559f3af970
SHA512 2b8a6ab135f7a5f6dc5fb4c8415744e1414e76721db72e59242f9fa3d58a29d0f23ffc6e9705c2030ec22d3fe6ba6599850464574b8523554505f510740cae4b
TLSH
T1FFD097C46724E68028903F00061B07DEE821B001CDC20B0970CB22640630EE45287411
MD5 SHA1 SHA512 TLSH

Submit Download

AteraAgent.exe

Path C:\Program Files\ATERA Networks\AteraAgent\Agent\AteraAgent.exe
Size 22.5MB
SHA256 355936b7539fe07897dad6bca0490bade4940c7a9235b834c7a9a4cb7552d923
MD5 4d2f6d72e185de481698e48529a6208d
SHA1 9571ee8cf9258b7361c38c2370238c24204e0efd
SHA512 237f145010c681213dc16289811f0ebf0a864a5c348412d02ce6fccc5ae058116d481adf041f50a6ec97350f6c4aec5cf21867727a61b76ad137d46be60fc660
SSDEEP 196608:pd/A6kDzLPyiDVnZEyFTCoG+5ZpMIn6wna+uP9JPstmT1AKZPL/AmIIg:z/vs6kJFTqqZpMI6SET1AKBo
TLSH
T187379C11B3EC466AE5BF83389472451ADBF2B8462321E7CF1594A6E91E33BC05E35363
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

agent.cert.pfx

Path C:\Program Files\ATERA Networks\AteraAgent\Agent\certificates\production\agent.cert.pfx
Size 2KB
SHA256 f840a9086d0226e513fcbd31321e4d63dd999c60701a831be0e907825feba9ba
MD5 1050b95712cec6a1c9d5d09650480876
SHA1 2964603d4e6901833834396c6660df828004a441
SHA512 45ffe77c2eba0013455ea3b0f4219c2efc1143c0e69d673c799bff7909fc1449f656d6a59d07e627899237e0df84e9b7e22ef009c5b6dacbdd31d8a597d9d5cd
TLSH
T1FA511CEA5B52C65A3CD7E8AAC4BC590199E5EFCA4A2FDC173614459F0E1140D374C9C4
MD5 SHA1 SHA512 TLSH

Submit Download

dotnet-install.ps1

Path C:\Program Files\ATERA Networks\AteraAgent\Agent\dotnet-install.ps1
Size 74KB
SHA256 e8b873e18a81e5c4cd8ab69d84dac8fead291d50b3c44633cd7fddad709a13d6
MD5 ce1e8af1ee38c40f594dd19f9cb988f5
SHA1 bc16517853592107970aae2d7c7d1546b1c6e960
SHA512 cf32ef77dcb0ba6b60da3ea3997746979844ebdc1db5470762c969bec2b3f5478bb348badbe2373e4eee7aea66e9c4db4f8b20919a6bf1b5e60345e5020f9ebe
SSDEEP 768:GQy0YIw0FI6Szz3G4yYijvbpyspGD2huFI1Fb2JPJFId4zT2C0U8qzqog7+XMhDF:GSY7PwYU1JPg8qzjUcn4f4Xsjh2Syy
TLSH
T152731A9EAD429032547363B8C96B1084FB374277524541A8F8DDD4887FB262D93A2FEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 1585e6503cdb95cdf41d70d11f052ff234af239862bcc1fa9e0dbf7ca754db59
MD5 2466253d742fb8e47b1601ad67f80304
SHA1 5c161c78479ca89e151377b491c9de3b8adfe092
SHA512 5f8d96b9373f53702a1b5d4870774a4ea48297a2ae9310e6af717e17faa5fe07f6b5b287558c0b39c0c4b9a072ac20e4ea65f8b4c9675e9a152c20de7fc94fca
TLSH
T1DF115733B3CC8724DC9A403650CEAC1136B687DB409EDE6BBB84D548B42F299DEA1260
MD5 SHA1 SHA512 TLSH

Submit Download

MSI1A7E.tmp

Path C:\Windows\Installer\MSI1A7E.tmp
Size 347KB
SHA256 06663991953e1d06759e4f8abd7633119cacf674a0bd508b46028217ba984b75
MD5 f5877cbbb521db7d2bc52d62f6eab42d
SHA1 401c89c3b6b2ac41fa5194b131e52bc56d39b484
SHA512 95f93922a71f64a98f7fe9045e47a959e1324ebb107512e4be6c823014e2f1be44c3731888dcc42a6a837666fc6c56215575ae235be07151a133450a771a75bf
SSDEEP 6144:apUNpIx1IWpJHOrwIBaiRZ5bycX7EgfrU7NqnwDP+:BNp21IWpJkBdDyP8472/
TLSH
T1A174BE1977E80979FCBB567988730A05D673BC515771CB9F03A0421A9F3B390A93AF22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSI3F03.tmp

Path C:\Windows\Installer\MSI3F03.tmp
Size 390KB
SHA256 7aacd4c18710e9bc4ff2034895a0a0c8f80f21809fb177d520e93f7688216e6d
MD5 e8dc682f2c486075c6aba658971a62cc
SHA1 7cd0a2b5047a4074aa06a6caa3bb69124851e95d
SHA512 a0a1f0f418bf2d4ffd079b840aeb0142c7faab7fa72b5e33b1841798569f55a25dfd305abf9c2ca89792f6499f695b69975882697dc53e99d5a975a9fa8c7d75
SSDEEP 6144:p2ET2+QBLh+MVy5DCRoRRvc181kaKN8MMLuG:p2ET2+cVXVyNhvcCkaKN8Me
TLSH
T10D846B29F7E408EDE4B78276C5A68530FF75748D3320D5AE47A8852D1F3AAA070BB701
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Atera.Agent.Installer.Msi.Ca.dll

Path C:\Windows\Installer\SFXCA1BEA600F2D48B55B2501AF7D056F2321\Atera.Agent.Installer.Msi.Ca.dll
Size 75KB
SHA256 68aab5996b0970c4d100adaafd4d43473fa4bfdd85ac2233ce0a3bcfe67a0221
MD5 53f92d82163948d34a269fb85a18301e
SHA1 a867968946435fa18bdebd937ba086ade6e509fb
SHA512 9c2ce193c69dc60fa34ec8571de8853cfe4b379eec00d5bb032159fa226de14a2532ce93bd7e1ed6fe79c62bb58578c1420faa8795dbfdcdb034ad734c2e9b4c
SSDEEP 1536:DfjCRbOzg7NstWii4vkCZt8wAHk6bF3to5WD2oRMin4:Dfjub7NstriYLZaHHk6bBtUWD2+4
TLSH
T16D73E55177F84618F3FF5B79BD70950449B3BC266D31E68E1AA0244E0AB6BC0DA60B73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CustomAction.config

Path C:\Windows\Installer\SFXCA1BEA600F2D48B55B2501AF7D056F2321\CustomAction.config
Size 956B
SHA256 2dbc73a3bc444a9119c9b5e20276698384d9ad9535a8a7547c44d1b9a8d67346
MD5 a9088b24614c12b70af6ae9669a4a4b1
SHA1 d72efa4e0c7bd733ed3d51831ead7031175c27e0
SHA512 14090969a71b6c80023da29dc8582aded6d26ca349966767ce22102080abce118b846a47ea2b9abe2d5f6a788bc083031d27fdee4103e2e4b99d29c2ac494d7c
TLSH
T10811D00D4A946B7724312793BFACA1C4E76194BA3994411CB49BB9151F39938176338F
MD5 SHA1 SHA512 TLSH

Submit Download

WixToolset.Dtf.WindowsInstaller.dll

Path C:\Windows\Installer\SFXCA47005FC29F466BA9624264FCEAB09679\WixToolset.Dtf.WindowsInstaller.dll
Size 193KB
SHA256 a614884ea627da1925131ebf41e8ae202caeac0fe543b86384f5eb2bfaf1aa75
MD5 ef8d5785ac8669f5fd54e22f52770e6b
SHA1 4c94ae7ef233be33a56c0a5d9b8e2211d5d5792c
SHA512 ab3b140bd6531f22e994606820e6511442c23d9015b1e1a38aaed43aa42ba29a996511151d0b3a383c05c2b11f670e52cdd7f507ad1a1ad8cebea57fb22ade5a
SSDEEP 3072:8Of7tVL+l4lj19l4uDHYHj69UgoTqdda7CnfKlRUjW01KytaljYqCDPC:8gQQx54Hj6jomdrzalMqb
TLSH
T14A149C2A57F84B3ECEFF8778E2614252C7B1F1E67103DB1D9D8281A52163784B682397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5a159e.msi

Path C:\Windows\Installer\e5a159e.msi
Size 8.7MB
SHA256 ab941aef3d30bd16a3d8b423eee0f434f45f949c71e93d212fc60f2366df9ba2
MD5 8ae3c3ce47ad4588c1e4d19192824b04
SHA1 b094d28cbdcd3f507557d9a35d2621b1e01834e1
SHA512 a2569d6cdc576b270c4c1a1b85f2c96ba8a2adf8a4e6595e419a16f2125cf7ae228be11787b130c0ad39b63282728c2ba1ab50d233baeda267e19f98b13dbe92
SSDEEP 196608:lWWDdyCV88IEa53XLbHfXNtsNSCYMsM/JTaAnuovyaH:ZpDu8kPHfXNmJsm5Moq6
TLSH
T1BD963319BBD009FDE977827688A38561EE367C883760C59F0364B1195F3BBA0B07B761
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Tmp9898.tmp

Path C:\Windows\SystemTemp\Tmp9898.tmp
Size 3KB
SHA256 94739ca46676bd602a78671257fbfce39feaabc9664c6326bf4970a0108e3429
MD5 560af444a6a7faa0b0ca94dc16ca2a58
SHA1 df31453fafde354870a0a9a8ca50b18e284c32e4
SHA512 7c853176c088d56a517e52c6687b6debf08f6f9726376720ade9d13fafc9be0ca72f0f2b35562a61ece653aeb789c838c60447f463b2bbe70c21bfc8c039b681
TLSH
T1B3616C88B10E28972CEECC504D495B40AEC3D754B390F25F68F4BCA64CA13E9A358C3C
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_xvhwizdj.twc.psm1

Path C:\Windows\SystemTemp\__PSScriptPolicyTest_xvhwizdj.twc.psm1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

metadata-2

Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
Size 26.1MB
SHA256 ff52b8283ea211aaceddcf9e385b149fdadc8b00a6bd0863474b2da84d1ceac2
MD5 a740a0cbacb1650a01c126f44d244a07
SHA1 3079031abcab5dc6f4200f4292adc86ad23952aa
SHA512 f288366cae9c9911c4177949bc76fd2f4dab0aff2108a9fed0f7300c8ad20174cdfb077c3070a0c1f2f5351c754f87bba256fd5e31110a9fd6d39e0b3486d2f2
SSDEEP 24576:DFo3DMPPdoO/vvTL/SgDTiFQ/Lu5oLUAEulh9ut7lGN6J0yzMYR2TKpCX+3:xHE
TLSH
T1BD57B32936F92201E7F79E3CACF06A23493A7D5B9C15DE8D45411B4E0822F71E872F66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{f1dfaf7a-f614-4d3b-8d0e-6f9e4eff68f0}_OnDiskSnapshotProp

Path \??\Volume{e42a0d43-0000-0000-0000-d08302000000}\System Volume Information\SPP\OnlineMetadataCache\{f1dfaf7a-f614-4d3b-8d0e-6f9e4eff68f0}_OnDiskSnapshotProp
Size 6KB
SHA256 371eb079d441e7126a972f3995144e4965a19739c96f00ede0e1f8f7f81f0739
MD5 af0029d01e4643f6030521aff3792a9e
SHA1 471def8386bc542651c637ec64fa17e76d9f70a8
SHA512 76224ae92e3ce30a78b1fc590ff07100bd4b9b859b71e6d97d46009acfce4e5e3132b3af9d60fa9632b6992e2dcb7ae55cde25c4d6333db6113c5a9dfd0d21da
SSDEEP 96:Ff1P3ZGvc6DD84LTHzbOHXOHBlBRQn8Sc9XE56tOSVQpu:N1Psb++uVm
TLSH
T169D187085AF54711E2B3AB3128F18557A877B911EF33CB8E0198238E6670A10F975F6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2808-122-0x000001D16DFA0000-0x000001D16E052000-memory.dmp

Download

memory/2808-125-0x000001D16E090000-0x000001D16E0B4000-memory.dmp

Download

memory/2808-127-0x000001D16DF90000-0x000001D16DF9A000-memory.dmp

Download

memory/2808-128-0x000001D16E0A0000-0x000001D16E0B2000-memory.dmp

Download

memory/2808-123-0x000001D16DF70000-0x000001D16DF7A000-memory.dmp

Download

memory/2808-121-0x000001D16DF80000-0x000001D16DF9E000-memory.dmp

Download

memory/2808-124-0x000001D16E090000-0x000001D16E0BA000-memory.dmp

Download

memory/3448-23-0x000002ACA5A80000-0x000002ACA5A98000-memory.dmp

Download

memory/3448-19-0x000002ACA5AC0000-0x000002ACA5AF4000-memory.dmp

Download

memory/5616-106-0x00000290420E0000-0x0000029042102000-memory.dmp

Download

memory/5624-45-0x000001853A5E0000-0x000001853A61C000-memory.dmp

Download

memory/5624-44-0x000001853A580000-0x000001853A592000-memory.dmp

Download