3be3e7a45994dffd41af96f3b8852674272e6dbaaca2dcd0b84296e136a9c6c5

Analysis

max time kernel
150s
max time network
126s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
30/10/2026, 06:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Approved%20Document%23D53LU.msi
Size 6.8MB
Sample261030-gzedvsdd63
SHA256 3be3e7a45994dffd41af96f3b8852674272e6dbaaca2dcd0b84296e136a9c6c5
MD5 259b42d13d40a8dd91674a74949dcaab
SHA1 523be7799476cde550b49422edc31ed43c0d5ce9
SHA512 b2218c1fcfc4dd9e52cfa64843f03fc0ca6ec31015d2bf2d56420412b906c1dff850568acffc2bfb8fae312fe71e89a6ae749e3365e9774da4487bfebfc54204
SSDEEP 196608:flc4PxNgvXPtj+zc5il1FiaRg9MRuGWRHZB:drr+/tj+QITFic+MRRWRn
TLSH
T1ED662321BA838036E95B1E30753D9A759B3DFE345F64B0CFA784382D5E316C05B72A92
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery execution persistence privilege_escalation ransomware

Malware Config

Signatures

Badlisted process makes network request 2 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
4	4404	msiexec.exe
6	4404	msiexec.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe

Drops file in System32 directory 15 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft	action1_agent.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData	action1_agent.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content	action1_agent.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3AA0DCD5A74331FBD6F344550EC48B87_FAB5A9F6C6BE3394975FF948CA40CA87	action1_agent.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\18E6B4A57A6BC7EC9B861CDF2D6D0D02_EF52C1EC85F21F31CC0157A5C8803013	action1_agent.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3AA0DCD5A74331FBD6F344550EC48B87_FAB5A9F6C6BE3394975FF948CA40CA87	action1_agent.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Action1\7971f918-a847-4430-9279-4a52d1efe18d	powershell.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache	action1_agent.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\18E6B4A57A6BC7EC9B861CDF2D6D0D02_EF52C1EC85F21F31CC0157A5C8803013	action1_agent.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Windows directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Action1\sas.dll	msiexec.exe
File opened for modification	C:\Windows\Action1\logs\action1_log_2026-10-30_06-15-13~2000.log	action1_agent.exe
File created	C:\Windows\Installer\{E6D8B066-2E74-458F-9111-24857C1C627A}\ProductIcon	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI6E24.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI7096.tmp	msiexec.exe
File created	C:\Windows\Action1\action1_agent.exe.connection	action1_agent.exe
File opened for modification	C:\Windows\Action1\action1_agent.exe	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI90D5.tmp	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\ED561CEF53981DE418C2AD69CE714711\CacheSize.txt	msiexec.exe
File created	C:\Windows\Action1\action1_agent.exe.instance_lock	action1_agent.exe
File created	C:\Windows\Installer\SourceHash{FEC165DE-8935-4ED1-812C-DA96EC177411}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI7191.tmp	msiexec.exe
File opened for modification	C:\Windows\Action1\logs\action1_log_2026-10-30_06-15-02~512.log	action1_agent.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\ED561CEF53981DE418C2AD69CE714711\5.251.654	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI8EDF.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\e59694f.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Action1\action1_agent.exe.update_state	action1_agent.exe
File opened for modification	C:\Windows\Installer\{FEC165DE-8935-4ED1-812C-DA96EC177411}\ProductIcon	msiexec.exe
File created	C:\Windows\Action1\action1_agent.msi	action1_agent.exe
File opened for modification	C:\Windows\Action1\logs\agent_install_1793340907.log	msiexec.exe
File created	C:\Windows\Installer\e59694f.msi	msiexec.exe
File opened for modification	C:\Windows\Action1\action1_agent.msi	action1_agent.exe
File opened for modification	C:\Windows\Action1\action1_agent.exe.update_state	action1_agent.exe
File opened for modification	C:\Windows\Action1\action1_remote.exe	msiexec.exe
File opened for modification	C:\Windows\Action1\7z.dll	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\ED561CEF53981DE418C2AD69CE714711\CacheSize.txt	msiexec.exe
File created	C:\Windows\Action1\schedule.json	action1_agent.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\Installer\e596961.msi	msiexec.exe
File created	C:\Windows\Action1\datasource_data\1004.poll.tmp	action1_agent.exe
File opened for modification	C:\Windows\Installer\MSI6D97.tmp	msiexec.exe
File created	C:\Windows\Action1\sas.dll	msiexec.exe
File created	C:\Windows\Installer\e596952.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\ED561CEF53981DE418C2AD69CE714711\5.251.654\main_service_exe	msiexec.exe
File opened for modification	C:\Windows\Action1\action1_agent.exe.update_state	action1_agent.exe
File created	C:\Windows\Installer\e596953.msi	msiexec.exe
File created	C:\Windows\Installer\wix{E6D8B066-2E74-458F-9111-24857C1C627A}.SchedServiceConfig.rmi	MsiExec.exe
File opened for modification	C:\Windows\Installer\MSI9D5D.tmp	msiexec.exe
File opened for modification	C:\Windows\Action1\action1_agent.exe.connection	action1_agent.exe
File opened for modification	C:\Windows\Installer\MSI6AE5.tmp	msiexec.exe
File created	C:\Windows\Installer\{FEC165DE-8935-4ED1-812C-DA96EC177411}\ProductIcon	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\ED561CEF53981DE418C2AD69CE714711\5.251.654\action1_remote_exe	msiexec.exe
File created	C:\Windows\Action1\datasource_data\1000.poll.tmp	action1_agent.exe
File created	C:\Windows\Action1\rule_data\1000.suppress	action1_agent.exe
File created	C:\Windows\Action1\action1_agent.exe.instance_lock	action1_agent.exe
File created	C:\Windows\Action1\what_is_this.txt	action1_agent.exe
File opened for modification	C:\Windows\Installer\MSI8DE4.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI9029.tmp	msiexec.exe
File opened for modification	C:\Windows\Action1\what_is_this.txt	action1_agent.exe
File created	C:\Windows\Action1\rules.json	action1_agent.exe
File created	C:\Windows\Action1\rule_data\1004.suppress	action1_agent.exe
File created	C:\Windows\Installer\SourceHash{E6D8B066-2E74-458F-9111-24857C1C627A}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI975E.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI9869.tmp	msiexec.exe
File created	C:\Windows\Action1\7z.dll	msiexec.exe
File opened for modification	C:\Windows\Installer\e596953.msi	msiexec.exe
File created	C:\Windows\Action1\advanced_settings.json.tmp	action1_agent.exe
File opened for modification	C:\Windows\Installer\MSI6C5D.tmp	msiexec.exe
File created	C:\Windows\Action1\action1_agent.exe	msiexec.exe
File created	C:\Windows\Action1\first_install.tmp	action1_agent.exe
File created	C:\Windows\Action1\logs\agent_install_1793340907.log	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\ED561CEF53981DE418C2AD69CE714711\5.251.654\main_service_exe	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI9A9C.tmp	msiexec.exe

Executes dropped EXE 3 IoCs

pid	Process
512	action1_agent.exe
2000	action1_agent.exe
720	action1_agent.exe

Loads dropped DLL 8 IoCs

pid	Process
4312	MsiExec.exe
4312	MsiExec.exe
4312	MsiExec.exe
3288	MsiExec.exe
4036	MsiExec.exe
4036	MsiExec.exe
4036	MsiExec.exe
4036	MsiExec.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
3404	powershell.exe
1412	powershell.exe
3756	powershell.exe
2516	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs

persistence privilege_escalation

Installer Packages

T1546.016

Msiexec

T1218.007

pid	Process
4404	msiexec.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	action1_agent.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	action1_agent.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	action1_agent.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	action1_agent.exe

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	action1_agent.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	action1_agent.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	action1_agent.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 00000000040000001302849f6a5860da0000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff0000000027010100000800001302849f0000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed35000000ffffffff0000000007000100006809001302849f000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff350000000000000005000000ffffffff000000000700010000f8ff1a1302849f000000000000f0ff350000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d1302849f000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\29\52C64B7E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CProgram Files%5CWindowsApps%5CMicrosoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe%5Cresources.pri	action1_agent.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CProgram Files%5CWindowsApps%5CMicrosoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe%5Cresources.pri\1d5ace4c5ed6b63\a37dfe62\@{C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0 = "Microsoft Tips"	action1_agent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	action1_agent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	action1_agent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	action1_agent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CProgram Files%5CWindowsApps%5CMicrosoft.MixedReality.Portal_2000.19081.1301.0_x64__8wekyb3d8bbwe%5Cresources.pri	action1_agent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CProgram Files%5CWindowsApps%5CMicrosoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe%5Cresources.pri	action1_agent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	action1_agent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CProgram Files%5CWindowsApps%5CMicrosoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe%5Cresources.pri	action1_agent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	action1_agent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	action1_agent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	action1_agent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CProgram Files%5CWindowsApps%5CMicrosoft.Edge.GameAssist_1.0.3456.0_x64__8wekyb3d8bbwe%5Cresources.pri	action1_agent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CProgram Files%5CWindowsApps%5CMicrosoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe%5Cresources.pri	action1_agent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2c\52C64B7E\@%SystemRoot%\System32\ci.dll,-100 = "Isolated User Mode (IUM)"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CProgram Files%5CWindowsApps%5CMicrosoft.StorePurchaseApp_11811.1001.18.0_x64__8wekyb3d8bbwe%5Cresources.pri	action1_agent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2c\52C64B7E\@%SystemRoot%\System32\fveui.dll,-844 = "BitLocker Data Recovery Agent"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\RegFiles0000 = 43003a005c00570069006e0064006f00770073005c0041006300740069006f006e0031005c0061006300740069006f006e0031005f006100670065006e0074002e0065007800650000000000	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2c\52C64B7E\@%SystemRoot%\System32\fveui.dll,-843 = "BitLocker Drive Encryption"	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2d\52C64B7E\@%SystemRoot%\System32\ci.dll,-100 = "Isolated User Mode (IUM)"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\29	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28\52C64B7E	msiexec.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0001\Owner = cc0500002c35b0e63568dd01	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2c\52C64B7E	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CProgram Files%5CWindowsApps%5CMicrosoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe%5Cresources.pri\1d5ace475a1c57b\a37dfe62\@{C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.202 = "MSN Weather"	action1_agent.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CProgram Files%5CWindowsApps%5CMicrosoft.WindowsAlarms_10.1906.2182.0_x64__8wekyb3d8bbwe%5Cresources.pri\1d5ace48672e4e2\a37dfe62\@{C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10 = "Windows Alarms & Clock"	action1_agent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	action1_agent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CProgram Files%5CWindowsApps%5CMicrosoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe%5Cresources.pri\1d5ace48a557267\a37dfe62\@{C:\Program Files\WindowsApps\Microsoft.WindowsCalcula = "Windows Calculator"	action1_agent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	action1_agent.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CProgram Files%5CWindowsApps%5CMicrosoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe%5Cresources.pri\1d5ace482634f6d\a37dfe62\@{C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071 = "Movies & TV"	action1_agent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	action1_agent.exe

Modifies registry class 46 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\ED561CEF53981DE418C2AD69CE714711\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\3187685C39AD9D04484F43F57B7D8C2B	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\660B8D6E47E2F85419114258C7C126A7	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\660B8D6E47E2F85419114258C7C126A7\Version = "100663960"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\660B8D6E47E2F85419114258C7C126A7\InstanceType = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\ED561CEF53981DE418C2AD69CE714711\ProductIcon = "C:\\Windows\\Installer\\{FEC165DE-8935-4ED1-812C-DA96EC177411}\\ProductIcon"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\ED561CEF53981DE418C2AD69CE714711\DeploymentFlags = "3"	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\ED561CEF53981DE418C2AD69CE714711	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\660B8D6E47E2F85419114258C7C126A7\AuthorizedLUAApp = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\660B8D6E47E2F85419114258C7C126A7\SourceList	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\660B8D6E47E2F85419114258C7C126A7\SourceList\Net	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\660B8D6E47E2F85419114258C7C126A7\Clients = 3a0000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\ED561CEF53981DE418C2AD69CE714711\PackageCode = "6995E120F132981499FCADE6FAD82951"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\ED561CEF53981DE418C2AD69CE714711\Language = "1033"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\3187685C39AD9D04484F43F57B7D8C2B\ED561CEF53981DE418C2AD69CE714711	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\ED561CEF53981DE418C2AD69CE714711	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\660B8D6E47E2F85419114258C7C126A7\PackageCode = "919D3E7E9C8C211418ADC39A1BD1B1BF"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\660B8D6E47E2F85419114258C7C126A7\SourceList\Net\1 = "C:\\Windows\\Action1\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\ED561CEF53981DE418C2AD69CE714711\A1_Agent	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\ED561CEF53981DE418C2AD69CE714711\Assignment = "1"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\ED561CEF53981DE418C2AD69CE714711\SourceList\Net	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\660B8D6E47E2F85419114258C7C126A7\Language = "1033"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\660B8D6E47E2F85419114258C7C126A7\AdvertiseFlags = "388"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\660B8D6E47E2F85419114258C7C126A7\ProductIcon = "C:\\Windows\\Installer\\{E6D8B066-2E74-458F-9111-24857C1C627A}\\ProductIcon"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\3187685C39AD9D04484F43F57B7D8C2B\660B8D6E47E2F85419114258C7C126A7	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\660B8D6E47E2F85419114258C7C126A7\SourceList\LastUsedSource = "n;1;C:\\Windows\\Action1\\"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\ED561CEF53981DE418C2AD69CE714711\InstanceType = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\3187685C39AD9D04484F43F57B7D8C2B	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\660B8D6E47E2F85419114258C7C126A7	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\660B8D6E47E2F85419114258C7C126A7\DeploymentFlags = "3"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\660B8D6E47E2F85419114258C7C126A7\SourceList\PackageName = "action1_agent.msi"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\ED561CEF53981DE418C2AD69CE714711	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\ED561CEF53981DE418C2AD69CE714711\ProductName = "Action1 Agent"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\ED561CEF53981DE418C2AD69CE714711\Clients = 3a0000000000	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\ED561CEF53981DE418C2AD69CE714711\SourceList\Net	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\ED561CEF53981DE418C2AD69CE714711\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\660B8D6E47E2F85419114258C7C126A7\A1_Agent	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\660B8D6E47E2F85419114258C7C126A7\ProductName = "Action1 Agent"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\660B8D6E47E2F85419114258C7C126A7\Assignment = "1"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\ED561CEF53981DE418C2AD69CE714711\AuthorizedLUAApp = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\ED561CEF53981DE418C2AD69CE714711\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\ED561CEF53981DE418C2AD69CE714711\SourceList\PackageName = "Approved%20Document%23D53LU.msi"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\ED561CEF53981DE418C2AD69CE714711\Version = "100336270"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\ED561CEF53981DE418C2AD69CE714711	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\ED561CEF53981DE418C2AD69CE714711\AdvertiseFlags = "388"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\ED561CEF53981DE418C2AD69CE714711\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe

Suspicious behavior: EnumeratesProcesses 31 IoCs

pid	Process
1484	msiexec.exe
1484	msiexec.exe
2516	powershell.exe
2516	powershell.exe
2516	powershell.exe
1484	msiexec.exe
1484	msiexec.exe
1484	msiexec.exe
1484	msiexec.exe
1484	msiexec.exe
1484	msiexec.exe
1484	msiexec.exe
1484	msiexec.exe
1484	msiexec.exe
1484	msiexec.exe
1484	msiexec.exe
1484	msiexec.exe
3404	powershell.exe
3404	powershell.exe
3404	powershell.exe
1412	powershell.exe
1412	powershell.exe
1412	powershell.exe
3756	powershell.exe
3756	powershell.exe
3756	powershell.exe
3756	powershell.exe
3756	powershell.exe
3756	powershell.exe
2000	action1_agent.exe
2000	action1_agent.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4404	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4404	msiexec.exe
Token: SeSecurityPrivilege	1484	msiexec.exe
Token: SeCreateTokenPrivilege	4404	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	4404	msiexec.exe
Token: SeLockMemoryPrivilege	4404	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4404	msiexec.exe
Token: SeMachineAccountPrivilege	4404	msiexec.exe
Token: SeTcbPrivilege	4404	msiexec.exe
Token: SeSecurityPrivilege	4404	msiexec.exe
Token: SeTakeOwnershipPrivilege	4404	msiexec.exe
Token: SeLoadDriverPrivilege	4404	msiexec.exe
Token: SeSystemProfilePrivilege	4404	msiexec.exe
Token: SeSystemtimePrivilege	4404	msiexec.exe
Token: SeProfSingleProcessPrivilege	4404	msiexec.exe
Token: SeIncBasePriorityPrivilege	4404	msiexec.exe
Token: SeCreatePagefilePrivilege	4404	msiexec.exe
Token: SeCreatePermanentPrivilege	4404	msiexec.exe
Token: SeBackupPrivilege	4404	msiexec.exe
Token: SeRestorePrivilege	4404	msiexec.exe
Token: SeShutdownPrivilege	4404	msiexec.exe
Token: SeDebugPrivilege	4404	msiexec.exe
Token: SeAuditPrivilege	4404	msiexec.exe
Token: SeSystemEnvironmentPrivilege	4404	msiexec.exe
Token: SeChangeNotifyPrivilege	4404	msiexec.exe
Token: SeRemoteShutdownPrivilege	4404	msiexec.exe
Token: SeUndockPrivilege	4404	msiexec.exe
Token: SeSyncAgentPrivilege	4404	msiexec.exe
Token: SeEnableDelegationPrivilege	4404	msiexec.exe
Token: SeManageVolumePrivilege	4404	msiexec.exe
Token: SeImpersonatePrivilege	4404	msiexec.exe
Token: SeCreateGlobalPrivilege	4404	msiexec.exe
Token: SeBackupPrivilege	4112	vssvc.exe
Token: SeRestorePrivilege	4112	vssvc.exe
Token: SeAuditPrivilege	4112	vssvc.exe
Token: SeBackupPrivilege	1484	msiexec.exe
Token: SeRestorePrivilege	1484	msiexec.exe
Token: SeRestorePrivilege	1484	msiexec.exe
Token: SeTakeOwnershipPrivilege	1484	msiexec.exe
Token: SeRestorePrivilege	1484	msiexec.exe
Token: SeTakeOwnershipPrivilege	1484	msiexec.exe
Token: SeRestorePrivilege	1484	msiexec.exe
Token: SeTakeOwnershipPrivilege	1484	msiexec.exe
Token: SeRestorePrivilege	1484	msiexec.exe
Token: SeTakeOwnershipPrivilege	1484	msiexec.exe
Token: SeRestorePrivilege	1484	msiexec.exe
Token: SeTakeOwnershipPrivilege	1484	msiexec.exe
Token: SeRestorePrivilege	1484	msiexec.exe
Token: SeTakeOwnershipPrivilege	1484	msiexec.exe
Token: SeShutdownPrivilege	3288	MsiExec.exe
Token: SeRestorePrivilege	1484	msiexec.exe
Token: SeTakeOwnershipPrivilege	1484	msiexec.exe
Token: SeRestorePrivilege	1484	msiexec.exe
Token: SeTakeOwnershipPrivilege	1484	msiexec.exe
Token: SeDebugPrivilege	2516	powershell.exe
Token: SeBackupPrivilege	512	action1_agent.exe
Token: SeSecurityPrivilege	512	action1_agent.exe
Token: SeBackupPrivilege	512	action1_agent.exe
Token: SeSecurityPrivilege	512	action1_agent.exe
Token: SeRestorePrivilege	1484	msiexec.exe
Token: SeTakeOwnershipPrivilege	1484	msiexec.exe
Token: SeRestorePrivilege	1484	msiexec.exe
Token: SeTakeOwnershipPrivilege	1484	msiexec.exe
Token: SeRestorePrivilege	1484	msiexec.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
4404	msiexec.exe
4404	msiexec.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 1484 wrote to memory of 4152	1484	msiexec.exe	99
PID 1484 wrote to memory of 4312	1484	msiexec.exe	101
PID 1484 wrote to memory of 3288	1484	msiexec.exe	102
PID 512 wrote to memory of 2516	512	action1_agent.exe	105
PID 512 wrote to memory of 1256	512	action1_agent.exe	107
PID 1484 wrote to memory of 4036	1484	msiexec.exe	108
PID 2000 wrote to memory of 3404	2000	action1_agent.exe	110
PID 2000 wrote to memory of 1412	2000	action1_agent.exe	112
PID 1412 wrote to memory of 720	1412	powershell.exe	116
PID 2000 wrote to memory of 3756	2000	action1_agent.exe	117

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\Approved%20Document%23D53LU.msi
1⤵
- Badlisted process makes network request
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4404

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1484
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:4152
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 8DAEB063FAF5325F07ED9CDF676AB679
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:4312
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 91ADE57C4E2D3541872B3FC69351F655 E Global\MSI0000
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:3288
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding CD3698FB5B9C0A31E5C0969857DA3800 E Global\MSI0000
  2⤵
  - Drops file in Windows directory
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:4036

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:4112

C:\Windows\Action1\action1_agent.exe
C:\Windows\Action1\action1_agent.exe service
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:512
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -Command "$ExecutionContext.SessionState.LanguageMode"
  2⤵
  - Drops file in System32 directory
  - Command and Scripting Interpreter: PowerShell
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2516
- C:\Windows\SysWOW64\msiexec.exe
  C:\Windows\system32\msiexec.exe /I "C:\Windows\Action1\action1_agent.msi" /quiet /qn /norestart /lv* "C:\Windows\Action1\logs\agent_install_1793340907.log" ALLOWRESTRICTEDVERSIONS=1
  2⤵
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  PID:1256

C:\Windows\Action1\action1_agent.exe
C:\Windows\Action1\action1_agent.exe service
1⤵
- Drops file in Windows directory
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2000
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -Command "$ExecutionContext.SessionState.LanguageMode"
  2⤵
  - Drops file in System32 directory
  - Command and Scripting Interpreter: PowerShell
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:3404
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -Command -
  2⤵
  - Drops file in System32 directory
  - Command and Scripting Interpreter: PowerShell
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1412
- - C:\Windows\Action1\action1_agent.exe
    "C:\Windows\Action1\action1_agent.exe" loggedonuser
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:720
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -Command -
  2⤵
  - Drops file in System32 directory
  - Command and Scripting Interpreter: PowerShell
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:3756

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Event Triggered Execution

T1546

Installer Packages

T1546.016

Privilege Escalation

Event Triggered Execution

T1546

Installer Packages

T1546.016

Defense Evasion

System Binary Proxy Execution

T1218

Msiexec

T1218.007

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e596950.rbs

Path C:\Config.Msi\e596950.rbs
Size 240KB
SHA256 defc6947d2f23ff2fde3bf9679fb06b4c205e6e2704c238c6fa6e569c93b72ff
MD5 6f6a5faa84f8d8f4ca6a894a5b0bfc23
SHA1 3a595de5b879e85847e3974e70069d1326afd2fd
SHA512 c58b641f95d3c9c054b0e39b7993181c8a97ea6447b415fdab15f361fa62df17bfcd00e3851d173f2b44e3db38e15d8b79bae0a27c1bc8299e37601bff65db12
SSDEEP 3072:bbUXiqyhTO8W0iEa8LW0bEC9hvZpC01v+eUKflQnZl+T+J7g6EsNr7wyy/IP3B:cqhy8VKU3hvZUy+ppHEsuB/S
TLSH
T14B349E217494547EEBFF0832953AD671AE3DF2380B90C56EC384981E5D618C1ABB7B27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e596951.rbs

Path C:\Config.Msi\e596951.rbs
Size 7KB
SHA256 7c9c23ef8105bd510d0dfdabaf6ad2c14ea3c5fb5526653a9bb92d3bf3554120
MD5 34fa0ca263cd3d3b3c1063f15abbaa19
SHA1 7a3c2283b5e4eb549e23d19c16bffadb13477547
SHA512 89919dd57248ceb57103c120bbbe14ee2311d5b8a7698d1cd2ec14726ac8a06af7576535b8759dffe0018c4da5a1cc71d4658c3b55b598bbc5ed2ac6bc1efbaf
SSDEEP 192:y9eJzazaT/wIk/wC2szTe/u/SkGL5kqKppu0wIerUS:yE2U/Q/h2suWakGL5kZu0wIerUS
TLSH
T1F3E12E81B62181E6E8961B38D703176637B2D7D99350336B08CDE4A0DF6378D4F8A68F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e596956.rbs

Path C:\Config.Msi\e596956.rbs
Size 246KB
SHA256 324868844fd8c00cc9b538b21b752b2b1206b74f4d8efff83276e6f40e2adca7
MD5 0962624815d3ebaa0a140dffafb38a47
SHA1 fa6226d82aa8a47963e432125f2e493e095ef29a
SHA512 3c66e3b7d228c406528b36807d9af46c052e2fd03bfa14b345fb3bcc308793a252db86aae350f202c81fa08d5bade897c8db4f078e6e3e614b7ff3d5f4e8e1ea
SSDEEP 3072:hbQb2XiqyhTO8W0iEa8LW0bEC9hvZpC01v+eUKflQnZl+T+J7g6EsNr7wyy/IP3B:Zqhy8VKU3hvZUy+ppHEsuB/S
TLSH
T104349E217494547EEBFF0932953E9A71AE3DF2380B50C56EC384881E5D618C1ABB7B27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e59695b.rbs

Path C:\Config.Msi\e59695b.rbs
Size 8KB
SHA256 a80a80bcfdab312a7d4711159b5ac93fc8e99758d21800dc3c30e88a2b7f6233
MD5 2895f9736bc2f623c5377fb7b5707fd9
SHA1 33776ed4880091b4b19d3e2c6a53da9283153b6c
SHA512 9f987ad5c4297fd3506341c43f2e65ada0bde541e0f51fdcd9835b63e670a2d46a3b562095a8dae15a821d43c62dca5407c86b2e6d156008af7c977fd9d79139
SSDEEP 192:pK6zRRyoHRPo1uaszxz8ezuO9+Yed+wFhmwuOdO7uLwZB6bA:pK69RygRP+uasVgezuOted+wFhm9/iM5
TLSH
T121022282722641E6E9561F39E60327663BA3C7E95310526B01DDE4E4DF323CC5ECA28F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e59695e.rbf

Path C:\Config.Msi\e59695e.rbf
Size 3B
SHA256 13bf7b3039c63bf5a50491fa3cfd8eb4e699d1ba1436315aef9cbe5711530354
MD5 21438ef4b9ad4fc266b6129a2f60de29
SHA1 5eb8e2242eeb4f5432beeec8b873f1ab0a6b71fd
SHA512 37436ced85e5cd638973e716d6713257d692f9dd2e1975d5511ae3856a7b3b9f0d9e497315a058b516ab31d652ea9950938c77c1ad435ea8d4b49d73427d1237
MD5 SHA1 SHA512

Submit Download

e59695f.rbs

Path C:\Config.Msi\e59695f.rbs
Size 1KB
SHA256 9b141c25682aeaa80d80a62fae785187e4ded9d34510a7bc69c6e03942dafec4
MD5 d78777cc608319023d3e07ca28803981
SHA1 d06ca7fb2a3e889fba712fe9c4f8e715e9082680
SHA512 e77b7a4ba737b289fee9ca96fb398a2908b56fc5ffec80bff40c57472e7aa8486621756ea82c1e5d8c6f5e8a48ac794322cefb455efab5264b77c6928d7056ad
TLSH
T142217093F71992C2F8D15F38D60317513BAB83E947185367088D7664AE31B485FA9189
MD5 SHA1 SHA512 TLSH

Submit Download

e596960.rbs

Path C:\Config.Msi\e596960.rbs
Size 7KB
SHA256 991dd65a9f019f42d1cfcd45b4a27f4d5b7589e8ee5b3c86f374786a77f4a534
MD5 f454105b53fee3ed1f952746f7480246
SHA1 661a854af755a22eef9637f54b18df2a15507018
SHA512 95ed7d1c4ee53cd26a1671d4f83c03b767159481f4a731059b6bba59d2fc00c76786b4560f31c7c66d372a1447cc99a0c289041cfee73fd74954396ebb9d7053
SSDEEP 96:pyCtPeGWv7XkUaqAiOliCsThqxBXkUaqAiOliC6jZS2dThqxaH+35fyG9tbktqZS:pne9faVhI2aVhM+YS0/p5
TLSH
T113E121017A1052F3FA6A0735D3471F9437B2D2DA83112B1B8CCDA6709F6BB892E951CA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

18E6B4A57A6BC7EC9B861CDF2D6D0D02_EF52C1EC85F21F31CC0157A5C8803013

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\18E6B4A57A6BC7EC9B861CDF2D6D0D02_EF52C1EC85F21F31CC0157A5C8803013
Size 765B
SHA256 f8caf3e1526569d23605d27c58cd6917ee1234ae37a6aec6f47f1ec250eb615c
MD5 66704632e49adaecd26d74252f30cd4d
SHA1 0f693054fc3cb4717390e9623cef9877322fac57
SHA512 9eeb112dd34e6c5859478bba94f9e097b6a25129ae63902d7774e7f0149e9a7fbba12fa3a37231033fbe9fcc830b69fb7a860f88f564abc406507b88ed0005c7
TLSH
T1BD016ADD8C146052EB113D754A6CDE764460F33530C40D9D652B7B902A85BEFF735406
MD5 SHA1 SHA512 TLSH

Submit Download

3AA0DCD5A74331FBD6F344550EC48B87_FAB5A9F6C6BE3394975FF948CA40CA87

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3AA0DCD5A74331FBD6F344550EC48B87_FAB5A9F6C6BE3394975FF948CA40CA87
Size 637B
SHA256 b31bc7e4562b3db34c0051089e9007080316634efc38e6902b2d2729d0174bc5
MD5 75be7bac91639e8933fdc94fddb70deb
SHA1 e7a9905c0855a1d5652ed7c4f9e2f70aff3ae1b0
SHA512 e4c0a14a9dc7135eb5f46db19993659f085ffe984c91de53708dbb823e357e56d15d2277423e98682e22c0216906e9fa643a008b519a096a5fa0c6ca5b32b1fc
TLSH
T105F02D42C8A8FC723DB285D79DF222020080315B6DFED402A099D6898A84A6219D1A9E
MD5 SHA1 SHA512 TLSH

Submit Download

18E6B4A57A6BC7EC9B861CDF2D6D0D02_EF52C1EC85F21F31CC0157A5C8803013

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\18E6B4A57A6BC7EC9B861CDF2D6D0D02_EF52C1EC85F21F31CC0157A5C8803013
Size 484B
SHA256 f29c9bfc321d0890735581d5d8891a7a19e866437ab1d771c3182d44a4eab5ff
MD5 8c11c5007fa923459346e68279b120c7
SHA1 4bb4c2fbac6ed08452b657637c2f237a0ad8157d
SHA512 a086303cdf53f8f72c1c0ac133cd18f323168555a25eba992bbd38da6b2518cd2fb3a663a962115d32e0d26f50b1952a6188fd478df88e42aa4547a14a29c49c
TLSH
T1ADF0AB380AEA813FF1A8CDB46EE1F5379C15F21B2C0287BD1AF343446A56C04ACD1064
MD5 SHA1 SHA512 TLSH

Submit Download

3AA0DCD5A74331FBD6F344550EC48B87_FAB5A9F6C6BE3394975FF948CA40CA87

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3AA0DCD5A74331FBD6F344550EC48B87_FAB5A9F6C6BE3394975FF948CA40CA87
Size 488B
SHA256 90fea86184359208df681d60578e28a8a1c8b7cc166c1e62d616da0a92eb60dc
MD5 880fb38684eb6bffdcea075517f649b7
SHA1 db897c01da874f2e8fc0782c9aa3c63bb51f0435
SHA512 a8e60c08a947648bfba0cae076f662db2fec9a4abbacf1772dfa22209b4862d3b41bccb5abea10d003d1dd75e9654aa91f7a11e6c400bf13ca79aa15e4e93fec
TLSH
T1FBF0A3347DFE203DF071997A47E9D553CD2AF211095007AE16D1034AEB41B005C71D7D
MD5 SHA1 SHA512 TLSH

Submit Download

7z.dll

Path C:\Windows\Action1\7z.dll
Size 1.3MB
SHA256 87aae6d4af8f028f080147e4cb0c42fff76c46fe8813c8b5dffd32d2bc566afd
MD5 56fa4622b917bb736eb5efed924f132d
SHA1 132dc22e72a9b01eff1790e9d681e7a41cc93b97
SHA512 5c22f0a4372869cd809163785fb65511cd1864599561c2691657ca76f7022a80f4076e209843cd87b03da121f651ed2ff8058bbcaa4ff807c76e4e132fd45f2d
SSDEEP 24576:xNib1WFpYKnzLy1GOjaCMHO0v93Pqt0lamuAsggS2VsAhwRDgfeS4:xNibGpYKiGOjoHO89/18ugSo1U
TLSH
T1DA559E11F7F1C074C58E5630862DBBBA50F8E729CA10A9D777C0BE6E6F319D2D225A09
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

action1_agent.exe

Path C:\Windows\Action1\action1_agent.exe
Size 8.9MB
SHA256 bdaf0c46119913e3636524f2a353f3fdaef30d6bf3efb168a20edd6dd10809bd
MD5 6d8bee98ef484d5892de8a9f16950228
SHA1 ebe2473b6e7f497a79a43a01585ddafd4042ef50
SHA512 d78abf33f61286527c3bd7ff9a244e7652328193390d4c5fc9cc6afdec44ea149cf8e945fd321931e5b53d64b98308ac2965232fad29f058f452ba0c42583685
SSDEEP 196608:O2gNtQsSfSMg5AXFlFBaSIYYu4+B2v4ZnDVVx0sp52Ck:OZJM/fblYN6ZnDVn082r
TLSH
T124968D21E6418135F9A301B299BE4B6F8538AE310B2454D7D3C85CAE5AB19E33B33F57
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

action1_agent.exe

Path C:\Windows\Action1\action1_agent.exe
Size 8.9MB
SHA256 941695d20d82dd5d62f74b0111feb23720637202f6c797df2a02e2cb6cb6e8e3
MD5 e4f1f52a78f22dd2be17449ca6f8f0af
SHA1 e9f385454fdddc7ae88431b8e02f4dfb7dd57b68
SHA512 2d7ed519a9380e1574bbc55444420334bdd0792c7839a1be67607a4f81be79e52f6c4dd10141079a47dcf61552724c2b3f060f0f670bdea527dc130ba9aebac8
SSDEEP 196608:KV1U3lnchqzhNpxSKyOBE2LeIzfAnOgOZ6aMkElWpRUn:KPoTVQYEseIzflZ6aMZORo
TLSH
T1D9968D21B641C135F9A301B29A7E4B6F853CBE30072555E7D3C858AE5AB19E33B32B17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

action1_agent.exe.connection

Path C:\Windows\Action1\action1_agent.exe.connection
Size 2B
SHA256 565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3
MD5 e0aa021e21dddbd6d8cecec71e9cf564
SHA1 9ce3bd4224c8c1780db56b4125ecf3f24bf748b7
SHA512 900110c951560eff857b440e89cc29f529416e0e3b3d7f0ad51651bfdbd8025b91768c5ed7db5352d1a5523354ce06ced2c42047e33a3e958a1bba5f742db874
MD5 SHA1 SHA512

Submit Download

action1_agent.exe.update_state

Path C:\Windows\Action1\action1_agent.exe.update_state
Size 1B
SHA256 7902699be42c8a8e46fbbb4501726517e86b22c56a189f7625a6da49081b2451
MD5 8f14e45fceea167a5a36dedd4bea2543
SHA1 902ba3cda1883801594b6e1b452790cc53948fda
SHA512 f05210c5b4263f0ec4c3995bdab458d81d3953f354a9109520f159db1e8800bcd45b97c56dce90a1fc27ab03e0b8a9af8673747023c406299374116d6f966981
MD5 SHA1 SHA512

Submit Download

action1_agent.msi

Path C:\Windows\Action1\action1_agent.msi
Size 6.8MB
SHA256 d9a41402fbadd6fcc55b91aa4e635812feb5ce2da4d35a3af23ffe9e3fd88189
MD5 cb43caf2f6a8f0b7d986fec3b0f0b296
SHA1 3b30970d28002a658f26bca6e55cf0e753b6d1dd
SHA512 0d35da2ae343dc4d0ffa9dfe4bfda624bbca112d1e4a44a4d72b4ca7f5bb01e4076edc09da7d9b39f86b47c2930db5c6169ec3ee171fd2f1310380e6ec5655a2
SSDEEP 98304:3kMMwpD74pOTxPjLHLgk92Rdxmk69pa5SUOsFekLS57JkmPMETphToy0seQvsm:Ulc4pkbLHLhObmXe/kdkmPDTs
TLSH
T123761221754E8C76C5AA363071769E7DDA7CBC305BA08BDB938339EE09315C052FDA92
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

action1_remote.exe

Path C:\Windows\Action1\action1_remote.exe
Size 1.5MB
SHA256 eb77e754e3b6c4d93fa4697bcdf02871be7b30b69ca0855a5df79f9404fdb3e8
MD5 d62dedf2a6511e53d1528691e0c33f37
SHA1 9acf8e99f4f535e8dac9d7c483ef5c2ee002ae9b
SHA512 810d4c45752e8c7a8f3b699b9791901cbdfcf2dbed00457f6a1178b16a60c0b9a1a4e25751e9cf206513c9764c52d70644310db5762eaee80315d282741ddf70
SSDEEP 24576:ig1cKk2wkiuXAlF8LFNYYgWj5d51z9DSrUPopzFv73OZN0RTDhfyuKCmSQ:ig1s6i+AOJ1zwrUPUhvVT1fy1C9Q
TLSH
T1B0757C213397802DE9B213307978D6BA593DBE754FB594CFA2D01AAD5C30AC25B35B23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

advanced_settings.json

Path C:\Windows\Action1\advanced_settings.json
Size 54KB
SHA256 ea7691de74db2ae40f1ff3700dfb9d4cbf423457d290b9006e4cba85c079f653
MD5 ad1fa5ec255020fd397e41cb29c77620
SHA1 4ff60cfdfeb3488586bf4dbbe2862ba5dd707561
SHA512 fdc9821622021bfc08231763c9fc2c4b9df5eb5e42316ca80d42e2ead55bb45844dd47b75ce4a8a85816305fb1e2906658e6997d185372170091c796bd76c37c
SSDEEP 768:hXKnbhRgjUpQUfRQ3Lyhx4zUtsp82qUgw6fCph8uP5K5DIK58EOKWbBoE3a+OQzG:cRoLEBxQ+wkMdAeyRAF+
TLSH
T1A2439C16E4757DB104C21C8C5FDB1AF79A4E019603D906DE871CEEBF8AAF56C8102A9F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

agent_downgrade.version_pair

Path C:\Windows\Action1\agent_downgrade.version_pair
Size 71B
SHA256 69ee65764c9f9617f96ddfe4dfd9054fc70a40d67919773b00abebe00b80abfc
MD5 c4300d4ef0f636f998b4dc241173fa0a
SHA1 5909c1dfe25b40654961a3e6fb591596f23bd341
SHA512 e677accfb5671b0b68dd138217727abb3b08ba702b03052bd1ed7d903833f025b7552ab4e67348aad172738f2fd47bdade1f7e7f404db262f5e734eb2ee9cc90
TLSH
T1D9A0021933101DB324EB9E4169352A61CE0D4095DF69DCAD22DD8EF6431D3922ACCB40
MD5 SHA1 SHA512 TLSH

Submit Download

first_install

Path C:\Windows\Action1\first_install
Size 50B
SHA256 7736e9009996de893de04351a1fdb2fc45a27ab0b7e98643f730f42d87d8ced7
MD5 745afefc598143e5a61334da2cf58041
SHA1 4a284c06e2294915d804538195dacf17a006c327
SHA512 e3941569c80dc7a5093fef99b5c48a85cf4fc2f0a68abbb669fb813421ebbc205d0ba06c7ee8137dfa5df587c0714c38f618785623ae494e516b978bdf86ec6d
TLSH
T12B9004D15013D3353CDD4374545333F10710C510DC550105334D47CD041D015515F051
MD5 SHA1 SHA512 TLSH

Submit Download

agent_install_1793340907.log

Path C:\Windows\Action1\logs\agent_install_1793340907.log
Size 1KB
SHA256 003bb4141ae4ad1d787f3bb731ea8a3894e2b84d7fe2737a449d734a614d2ea0
MD5 637a29ea2dd253dbebe12aecbff4aef7
SHA1 f13d1d288ad11b5a501bab81f81e277d75263920
SHA512 58b4e4bea37e1ca6303ea97d0c84146efbec548440018ef7e3397c3bcc7fa5fcdcddd07ebee37ec42c5c1e101e820d0bc4622b35fc959b8ac40fe25ada5679da
TLSH
T1B931A3611BE50C09F2B25707DEF7C152AA73BDC57879D70CA349831A476BD0488A87BE
MD5 SHA1 SHA512 TLSH

Submit Download

sas.dll

Path C:\Windows\Action1\sas.dll
Size 8KB
SHA256 996b01e15f85e165899630721a141b178a9c372b6e878012180ec9e9d4e7bd06
MD5 969d1f85151e0156d51a664e59a50213
SHA1 777735cf24fe880d00a205b5bcc79ca8df8d660b
SHA512 73f9a14d297f7dddc9e3d9b0db6cd4160cd000f31f437ea8add7d95de2f704482fa891996f2df048def3371cc9245a2efa31b2d0647a7cc1e6848db7b809e711
SSDEEP 192:l5UGq/4LYix0kmAEE8O5cTbOVT66o+1WX6wW/:nr5YiWXAjHGOVZP1WX6wW
TLSH
T13C02E60973A8067AE4FF1B76A06EA236462AB6205FF142EF195322D938355D15E307C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

what_is_this.txt

Path C:\Windows\Action1\what_is_this.txt
Size 1KB
SHA256 735dd20b8dcd387bf04a6deb30ad2b26b97402fc12287edacaef6d998f093b87
MD5 36467f0b9546135f216ddca212a416eb
SHA1 77b091e9d02b382362a53923918543153b122598
SHA512 5130a8ad1cf03aa9b11a48f48e869a407c1442ac93eb50022196d47e267ac68cbe9a4b571bdd88da2cd3c4cf02f81fc796905db7eaca5b42bfed50782a815533
TLSH
T14631615BF72422A40F8701823B9B15D1E739D46C3319A6A428EF421883A3A8893737E9
MD5 SHA1 SHA512 TLSH

Submit Download

MSI6AE5.tmp

Path C:\Windows\Installer\MSI6AE5.tmp
Size 385KB
SHA256 626a4e7060bd9b789795804e8b6497743c11d61c7353fb68798dd0bc76152cae
MD5 ced03b1bf99e148e40b7834816e2c330
SHA1 a7dc2898fa0916f8484e3597ce3e2c524c9c954d
SHA512 52a52436bb240a5ec16c540e428dc5acf7f7decaee4b5df092347019ef568d4c5948535721a39deef6dacc31cf4debad665dfb077c4dc9f44dc77ccd9d60cbaa
SSDEEP 6144:Rh1TnES0D5L240+A++CGvBsee3MudRa1UIFO4I/NVTPFc:JTnEDL24Pt+CGveeenw44IHFc
TLSH
T19D849D01B542C032D5AE05B0B634EFB5AABDA9705FA568CBB7D40D7B8D302C1A735B1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSI6D97.tmp

Path C:\Windows\Installer\MSI6D97.tmp
Size 234KB
SHA256 78860e15e474cc2af7ad6e499a8971b6b8197afb8e49a1b9eaaa392e4378f3a5
MD5 8edc1557e9fc7f25f89ad384d01bcec4
SHA1 98e64d7f92b8254fe3f258e3238b9e0f033b5a9c
SHA512 d26c9dce3c3d17583ffb5dbcd3989f93b096a7f64a37a2701a474c1bf4b8c8b1e922c352d33f24e411f1c793e1b4af11a3aec1de489087d481b1b636df2050cd
SSDEEP 3072:5XiqyhTO8W0iEa8LW0bEC9hvZpC01v+eUKflQnZl+T+J7g6EsNr7wyy/IP3:5qhy8VKU3hvZUy+ppHEsuB/
TLSH
T159348D217494547EEBFF0832953AD671AE3DF2380B90C96EC384581E6D618C1A7B7B27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSI8DE4.tmp

Path C:\Windows\Installer\MSI8DE4.tmp
Size 387KB
SHA256 ca5f0275e70ec5ba65b74c3da74f489018bc143c4c405fd8bbc6519eadac2a22
MD5 4112820180a36753089ee5c0fdba1538
SHA1 6366de1c2930886892aabf4b8ac55fd0bb4b91bb
SHA512 eac55d5a5c723fb5bd85bdd1ee71a13497d677d2b45e58b6eed2f7e42760d2ba3d07e0cb2b622f7866da8492f8d3fdb02b6288f95b761f5b2e20d2e2098233d3
SSDEEP 6144:ijVmAOn9DqwokBL+097OsOmceIpOaEPbyHiDO9EAFw:CmAOnRokBL17OsONeIshZAFw
TLSH
T18B848D01B542C032D5AE05B0B535EFB5AABDA9704FB468DBB7D40E7B8D302C1A735A1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e596952.msi

Path C:\Windows\Installer\e596952.msi
Size 6.8MB
SHA256 3be3e7a45994dffd41af96f3b8852674272e6dbaaca2dcd0b84296e136a9c6c5
MD5 259b42d13d40a8dd91674a74949dcaab
SHA1 523be7799476cde550b49422edc31ed43c0d5ce9
SHA512 b2218c1fcfc4dd9e52cfa64843f03fc0ca6ec31015d2bf2d56420412b906c1dff850568acffc2bfb8fae312fe71e89a6ae749e3365e9774da4487bfebfc54204
SSDEEP 196608:flc4PxNgvXPtj+zc5il1FiaRg9MRuGWRHZB:drr+/tj+QITFic+MRRWRn
TLSH
T1ED662321BA838036E95B1E30753D9A759B3DFE345F64B0CFA784382D5E316C05B72A92
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ProductIcon

Path C:\Windows\Installer\{E6D8B066-2E74-458F-9111-24857C1C627A}\ProductIcon
Size 32KB
SHA256 7a214ccfe309e4c0c83f40d9b7c92e3d41206db734401e7227ef10b38064ca9d
MD5 d37f7a439b9527f73e21311db17eaf00
SHA1 d0f34b3c1368f28a419924560c282358703a8d35
SHA512 3c1bcd38ed8d6bff8e071416cda90b0331b50903d9e4c9305bc36f9ccce23cb05424576b066485e76ee17e6fdc493fd25f8776d24b98de9d3941c181bb333569
SSDEEP 96:JnbrlpScW1BwB/vmaOZaxdJVE8BEArPz578SSuQEmgo3/I:JnbrlpScW18Ued/E8f8KQEPo3/I
TLSH
T195E211067007D5DCDE28473CB0B6FCB539728A776EAC23DEF2A4B4E52882465147C6B2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_e3svpxdt.bbn.ps1

Path C:\Windows\Temp\__PSScriptPolicyTest_e3svpxdt.bbn.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

powershell.exe.log

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
MD5 d85ba6ff808d9e5444a4b369f5bc2730
SHA1 31aa9d96590fff6981b315e0b391b575e4c0804a
SHA512 8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
TLSH
T1CE51EE323375B1E888167F071E681A8053BF4355EA94AF1CB698621ED93641B9F222F3
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 64B
SHA256 83e613b6dc8d70e3bb67c58535e014f58f3e8b2921e93b55137d799fc8c56391
MD5 5caad758326454b5788ec35315c4c304
SHA1 3aef8dba8042662a7fcf97e51047dc636b4d4724
SHA512 4e0d443cf81e2f49829b0a458a08294bf1bdc0e38d3a938fb8274eeb637d9a688b14c7999dd6b86a31fcec839a9e8c1a9611ed0bbae8bd59caa9dba1e8253693
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 64B
SHA256 a7de5177c68a64bd48b36d49e2853799f4ebcfa8e4761f7cc472f333dc5f65cf
MD5 446dd1cf97eaba21cf14d03aebc79f27
SHA1 36e4cc7367e0c7b40f4a8ace272941ea46373799
SHA512 a6d754709f30b122112ae30e5ab22486393c5021d33da4d1304c061863d2e1e79e8aeb029cae61261bb77d0e7becd53a7b0106d6ea4368b4c302464e3d941cf7
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 726d2b3a5003e478f61d3626a078477d2ce3caa24520bafefc1750edd68ef617
MD5 91bbf1113ed5ee5b5ca394415a183a07
SHA1 c3db7fead075105a6bc6ed8de9b206fd61c69aaf
SHA512 547e90736c71c0990eed9f24e071f4acbcb2d2fa99e0a13f70cb5d564c7ed084e78e631c8795e46778926118da82aec153bb6ab32439cb009a27153e5aeda1e4
TLSH
T16B218627B39C89A1CC86163A109D9C1076B393C7809ECFDF6BC4C600A0BF988CB21290
MD5 SHA1 SHA512 TLSH

Submit Download

metadata-2

Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
Size 24.1MB
SHA256 28294dc28dfb5506351f8f565f47acf8d97d584372c837d69ae38a7cf197d79a
MD5 e7caaee3a63c45944296344fb0d9b3d5
SHA1 3a179faa7a9c1982a0135baeadfa5fed8367ac60
SHA512 a42cfccffc95a6169010e2eeb5a9c0adb67e16dfadba81671b158e9bdc510a6d2892dd04c8f55fd0a07b874ec4f61f13328949d2188f3f0d3394ca80bfbfa319
SSDEEP 24576:7u8m+1zidoO/vvTLr2GejWKyXfkzOFGyqQGNE5H1eUqH+BvbYPlfegthj:y
TLSH
T1D447B52437FD2210E7F7AE3CA8F06A2349397D579C15DE8D45411B4E0922BB1E872F6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{c5bc3cdd-d8be-4b28-9b2d-a887cb15abd5}_OnDiskSnapshotProp

Path \??\Volume{9f840213-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{c5bc3cdd-d8be-4b28-9b2d-a887cb15abd5}_OnDiskSnapshotProp
Size 6KB
SHA256 4e555c9a6a92736fdd3ff1affefa2bc01352f7e16b1c5a28043dd678c4f7cb5b
MD5 392e97a827f5e538a1255e23bd7ad845
SHA1 c633daaa84548b9a05c1593fed4ee9d8517bfedf
SHA512 0e3637639086a455e4d918179c033a93fa4679f2fa3eca48e943ebc4128594cf118f3e15292b2bb666b56befed199e55d19ba57e982916afb4e1d4735eaeca7f
SSDEEP 96:F6+njknvc8DD84LTHzbOHXOHBlBRQ88Sc9XE56tOSVQpuN:MkMb++ZVmN
TLSH
T1F1D189085AF54711E2B3AB7128F18557A477B911EF33CB8E0298238E6670910F935F6F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1412-307-0x000002546BF50000-0x000002546C16C000-memory.dmp

Download

memory/1412-308-0x000002546C470000-0x000002546C5BE000-memory.dmp

Download

memory/2516-52-0x0000021762240000-0x0000021762262000-memory.dmp

Download

memory/3404-236-0x000001B0F9350000-0x000001B0F949E000-memory.dmp

Download

memory/3756-329-0x000001E55CF40000-0x000001E55D08E000-memory.dmp

Download

memory/3756-328-0x000001E55CC20000-0x000001E55CE3C000-memory.dmp

Download

memory/3756-337-0x000001E55CF40000-0x000001E55D08E000-memory.dmp

Download

memory/3756-339-0x000001E55CF40000-0x000001E55D08E000-memory.dmp

Download