3be3e7a45994dffd41af96f3b8852674272e6dbaaca2dcd0b84296e136a9c6c5

Analysis

max time kernel
148s
max time network
128s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/10/2026, 06:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Approved%20Document%23D53LU.msi
Size 6.8MB
Sample261030-gzedvsdd63
SHA256 3be3e7a45994dffd41af96f3b8852674272e6dbaaca2dcd0b84296e136a9c6c5
MD5 259b42d13d40a8dd91674a74949dcaab
SHA1 523be7799476cde550b49422edc31ed43c0d5ce9
SHA512 b2218c1fcfc4dd9e52cfa64843f03fc0ca6ec31015d2bf2d56420412b906c1dff850568acffc2bfb8fae312fe71e89a6ae749e3365e9774da4487bfebfc54204
SSDEEP 196608:flc4PxNgvXPtj+zc5il1FiaRg9MRuGWRHZB:drr+/tj+QITFic+MRRWRn
TLSH
T1ED662321BA838036E95B1E30753D9A759B3DFE345F64B0CFA784382D5E316C05B72A92
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

defense_evasion discovery execution persistence privilege_escalation ransomware spyware trojan

Malware Config

Signatures

Badlisted process makes network request 1 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
3	3420	msiexec.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe

Drops file in System32 directory 13 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft	action1_agent.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache	action1_agent.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData	action1_agent.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\18E6B4A57A6BC7EC9B861CDF2D6D0D02_EF52C1EC85F21F31CC0157A5C8803013	action1_agent.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\18E6B4A57A6BC7EC9B861CDF2D6D0D02_EF52C1EC85F21F31CC0157A5C8803013	action1_agent.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3AA0DCD5A74331FBD6F344550EC48B87_FAB5A9F6C6BE3394975FF948CA40CA87	action1_agent.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content	action1_agent.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3AA0DCD5A74331FBD6F344550EC48B87_FAB5A9F6C6BE3394975FF948CA40CA87	action1_agent.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Action1\7971f918-a847-4430-9279-4a52d1efe18d	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\~DF14C0D4C1BD129440.TMP	msiexec.exe
File created	C:\Windows\Action1\rule_data\1008.suppress	action1_agent.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_lzvafr5o.pae.psm1	powershell.exe
File opened for modification	C:\Windows\Installer\MSI5240.tmp	msiexec.exe
File created	C:\Windows\Action1\action1_agent.exe	msiexec.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_x325ipux.cel.psm1	powershell.exe
File opened for modification	C:\Windows\Installer\e5a0dd0.msi	msiexec.exe
File created	C:\Windows\SystemTemp\~DF1434224201DF1C20.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DFD7715BFCECF7040F.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DF53C171719AD93CA6.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DF78DF93B1746447B9.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Action1\action1_agent.msi	action1_agent.exe
File created	C:\Windows\Action1\logs\agent_install_1793340926.log	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI51C2.tmp	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\ED561CEF53981DE418C2AD69CE714711\5.251.654\main_service_exe	msiexec.exe
File created	C:\Windows\SystemTemp\~DF61BD7ABF9C47FF40.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DFFE592930092948D6.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\e5a0dcc.msi	msiexec.exe
File opened for modification	C:\Windows\Action1\action1_agent.exe	msiexec.exe
File created	C:\Windows\SystemTemp\~DF8E5CF82BE7DBB4FC.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DFBA62F466F38B80EC.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_cfungrbo.jtv.ps1	powershell.exe
File created	C:\Windows\Action1\advanced_settings.json.tmp	action1_agent.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_i31uvjim.qiz.psm1	powershell.exe
File created	C:\Windows\Installer\wix{FEC165DE-8935-4ED1-812C-DA96EC177411}.SchedServiceConfig.rmi	MsiExec.exe
File opened for modification	C:\Windows\Installer\MSI5928.tmp	msiexec.exe
File opened for modification	C:\Windows\Action1\logs\action1_log_2026-10-30_06-15-30~1364.log	action1_agent.exe
File created	C:\Windows\SystemTemp\~DF65C1BBBB9CF75C6E.TMP	msiexec.exe
File created	C:\Windows\Action1\agent_downgrade.version_pair.tmp	action1_agent.exe
File opened for modification	C:\Windows\Action1\action1_agent.msi	action1_agent.exe
File created	C:\Windows\SystemTemp\~DF77315AA838451F2F.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI5B0E.tmp	msiexec.exe
File opened for modification	C:\Windows\Action1\what_is_this.txt	action1_agent.exe
File created	C:\Windows\Installer\e5a0dcc.msi	msiexec.exe
File created	C:\Windows\SystemTemp\~DFE221BAD1262BDE73.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI1B6C.tmp	msiexec.exe
File created	C:\Windows\Action1\7z.dll	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\ED561CEF53981DE418C2AD69CE714711\5.251.654\action1_remote_exe	msiexec.exe
File created	C:\Windows\SystemTemp\~DF4AE637FE3DCA72A8.TMP	msiexec.exe
File created	C:\Windows\Installer\e5a0dde.msi	msiexec.exe
File created	C:\Windows\SystemTemp\~DF7ECD743ACCF61D2E.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\{FEC165DE-8935-4ED1-812C-DA96EC177411}\ProductIcon	msiexec.exe
File created	C:\Windows\Installer\SourceHash{E6D8B066-2E74-458F-9111-24857C1C627A}	msiexec.exe
File created	C:\Windows\Action1\action1_agent.exe.instance_lock	action1_agent.exe
File opened for modification	C:\Windows\Installer\{E6D8B066-2E74-458F-9111-24857C1C627A}\ProductIcon	msiexec.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_qgpjgdsl.tkl.ps1	powershell.exe
File created	C:\Windows\SystemTemp\~DF1874C45653A0B85A.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DF6A4BCF93139EEBAA.TMP	msiexec.exe
File created	C:\Windows\Action1\rule_data\1000.suppress	action1_agent.exe
File created	C:\Windows\Action1\sas.dll	msiexec.exe
File created	C:\Windows\Installer\{FEC165DE-8935-4ED1-812C-DA96EC177411}\ProductIcon	msiexec.exe
File created	C:\Windows\SystemTemp\~DF01F5E82A58A0F40B.TMP	msiexec.exe
File created	C:\Windows\Installer\{E6D8B066-2E74-458F-9111-24857C1C627A}\ProductIcon	msiexec.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_f522t2cj.frt.ps1	powershell.exe
File created	C:\Windows\Installer\SourceHash{FEC165DE-8935-4ED1-812C-DA96EC177411}	msiexec.exe
File created	C:\Windows\Action1\action1_remote.exe	msiexec.exe
File opened for modification	C:\Windows\Action1\action1_agent.exe.update_state	action1_agent.exe
File opened for modification	C:\Windows\Installer\MSI501B.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI53A8.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\ED561CEF53981DE418C2AD69CE714711	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI12AE.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DF8E0E2937C0B5716A.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DF483BA26D599AA2BE.TMP	msiexec.exe

Executes dropped EXE 3 IoCs

pid	Process
2168	action1_agent.exe
1364	action1_agent.exe
4400	action1_agent.exe

Loads dropped DLL 8 IoCs

pid	Process
1592	MsiExec.exe
1592	MsiExec.exe
1592	MsiExec.exe
5032	MsiExec.exe
5892	MsiExec.exe
5892	MsiExec.exe
5892	MsiExec.exe
5892	MsiExec.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
1972	powershell.exe
4160	powershell.exe
1408	powershell.exe
3420	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs

persistence privilege_escalation

Installer Packages

T1546.016

Msiexec

T1218.007

pid	Process
3420	msiexec.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	action1_agent.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	action1_agent.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	action1_agent.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	action1_agent.exe

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	action1_agent.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	action1_agent.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	action1_agent.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 000000000400000032ed1b0a2a5ec3f10000000000000000000000000000000000000000000000000000000000000000000000000000000000001071020000000000c012000000000000000000000000270101000088380132ed1b0a0000000000001071020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d0830200000000006025c501000000000000000000000700010000e8410132ed1b0a000000000000d08302000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9c701000000000000050000000000000000000000070001000098d4e332ed1b0a00000000000030a9c7010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9cc0100000000000005000000000000000000000007000100009854e632ed1b0a00000000000030a9cc01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28\52C64B7E\@%SystemRoot%\system32\WindowsPowerShell\v1.0\powershell.exe,-124 = "Document Encryption"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	action1_agent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	action1_agent.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\Owner = 740e0000032e7ce73568dd01	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2d\52C64B7E\@%SystemRoot%\System32\ci.dll,-100 = "Isolated User Mode (IUM)"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CProgram Files%5CWindowsApps%5CMicrosoft.SecHealthUI_1000.26100.1.0_x64__8wekyb3d8bbwe%5Cresources.pri\1da840c5479071a\a37dfe62	action1_agent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	action1_agent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	action1_agent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2d\52C64B7E\@%SystemRoot%\system32\dnsapi.dll,-103 = "Domain Name System (DNS) Server Trust"	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CProgram Files%5CWindowsApps%5CMicrosoft.SecHealthUI_1000.26100.1.0_x64__8wekyb3d8bbwe%5Cresources.pri\1da840c5479071a\a37dfe62\@{C:\Program Files\WindowsApps\Microsoft.SecHealthUI_1000.2 = "Windows Security"	action1_agent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	action1_agent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	action1_agent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	action1_agent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	action1_agent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	action1_agent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2b	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings	action1_agent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	action1_agent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	msiexec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2c\52C64B7E\@%SystemRoot%\system32\WindowsPowerShell\v1.0\powershell.exe,-124 = "Document Encryption"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2c\52C64B7E\@%SystemRoot%\system32\dnsapi.dll,-103 = "Domain Name System (DNS) Server Trust"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	action1_agent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe

Modifies registry class 46 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\660B8D6E47E2F85419114258C7C126A7\ProductIcon = "C:\\Windows\\Installer\\{E6D8B066-2E74-458F-9111-24857C1C627A}\\ProductIcon"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\660B8D6E47E2F85419114258C7C126A7\InstanceType = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\ED561CEF53981DE418C2AD69CE714711	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\ED561CEF53981DE418C2AD69CE714711\SourceList	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\ED561CEF53981DE418C2AD69CE714711	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\660B8D6E47E2F85419114258C7C126A7\Assignment = "1"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\660B8D6E47E2F85419114258C7C126A7\DeploymentFlags = "3"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\3187685C39AD9D04484F43F57B7D8C2B\660B8D6E47E2F85419114258C7C126A7	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\660B8D6E47E2F85419114258C7C126A7\SourceList\Net	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\660B8D6E47E2F85419114258C7C126A7\SourceList\Net\1 = "C:\\Windows\\Action1\\"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\ED561CEF53981DE418C2AD69CE714711\Assignment = "1"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\3187685C39AD9D04484F43F57B7D8C2B\ED561CEF53981DE418C2AD69CE714711	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\660B8D6E47E2F85419114258C7C126A7\Clients = 3a0000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\ED561CEF53981DE418C2AD69CE714711\PackageCode = "6995E120F132981499FCADE6FAD82951"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\ED561CEF53981DE418C2AD69CE714711\Language = "1033"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\ED561CEF53981DE418C2AD69CE714711\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\ED561CEF53981DE418C2AD69CE714711\Clients = 3a0000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\660B8D6E47E2F85419114258C7C126A7\SourceList\LastUsedSource = "n;1;C:\\Windows\\Action1\\"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\ED561CEF53981DE418C2AD69CE714711\AdvertiseFlags = "388"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\ED561CEF53981DE418C2AD69CE714711\AuthorizedLUAApp = "0"	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\3187685C39AD9D04484F43F57B7D8C2B	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\660B8D6E47E2F85419114258C7C126A7	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\660B8D6E47E2F85419114258C7C126A7\ProductName = "Action1 Agent"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\660B8D6E47E2F85419114258C7C126A7\AuthorizedLUAApp = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\660B8D6E47E2F85419114258C7C126A7\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\660B8D6E47E2F85419114258C7C126A7\SourceList\PackageName = "action1_agent.msi"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\ED561CEF53981DE418C2AD69CE714711\InstanceType = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\ED561CEF53981DE418C2AD69CE714711\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\ED561CEF53981DE418C2AD69CE714711	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\ED561CEF53981DE418C2AD69CE714711	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\ED561CEF53981DE418C2AD69CE714711\A1_Agent	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\ED561CEF53981DE418C2AD69CE714711\Version = "100336270"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\3187685C39AD9D04484F43F57B7D8C2B	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\ED561CEF53981DE418C2AD69CE714711\SourceList\PackageName = "Approved%20Document%23D53LU.msi"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\ED561CEF53981DE418C2AD69CE714711\SourceList\Net	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\ED561CEF53981DE418C2AD69CE714711\ProductName = "Action1 Agent"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\ED561CEF53981DE418C2AD69CE714711\DeploymentFlags = "3"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\660B8D6E47E2F85419114258C7C126A7	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\660B8D6E47E2F85419114258C7C126A7\Language = "1033"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\660B8D6E47E2F85419114258C7C126A7\AdvertiseFlags = "388"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\ED561CEF53981DE418C2AD69CE714711\ProductIcon = "C:\\Windows\\Installer\\{FEC165DE-8935-4ED1-812C-DA96EC177411}\\ProductIcon"	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\ED561CEF53981DE418C2AD69CE714711\SourceList\Net	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\ED561CEF53981DE418C2AD69CE714711\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\660B8D6E47E2F85419114258C7C126A7\A1_Agent	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\660B8D6E47E2F85419114258C7C126A7\PackageCode = "919D3E7E9C8C211418ADC39A1BD1B1BF"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\660B8D6E47E2F85419114258C7C126A7\Version = "100663960"	msiexec.exe

Modifies system certificate store 2 TTPs 3 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\CCBBF9E1485AF63CE47ABF8E9E648C2504FC319D	action1_agent.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\CCBBF9E1485AF63CE47ABF8E9E648C2504FC319D\Blob = 0f000000010000003000000009cc9211dbd405f0eb21b2fe598b2439893f4c3d478888adf01431a8b1fb66bd524266fc4e875f022623e69fcb4dd9be0b000000010000004a0000005300650063007400690067006f0020005000750062006c0069006300200043006f006400650020005300690067006e0069006e006700200052006f006f007400200052003400360000006200000001000000200000007e76260ae69a55d3f060b0fd18b2a8c01443c87b60791030c9fa0b0585101a3814000000010000001400000032eb929aff3596482f284042702036915c1785e61d0000000100000010000000b57b5c441b8ef4866b6f8f43ff6e45f609000000010000000c000000300a06082b06010505070303030000000100000014000000ccbbf9e1485af63ce47abf8e9e648c2504fc319d20000000010000007c0500003082057830820360a00302010202104b2c3b01018bad2abc8c7b5b3eed9057300d06092a864886f70d01010c05003056310b300906035504061302474231183016060355040a130f5365637469676f204c696d69746564312d302b060355040313245365637469676f205075626c696320436f6465205369676e696e6720526f6f7420523436301e170d3231303332323030303030305a170d3436303332313233353935395a3056310b300906035504061302474231183016060355040a130f5365637469676f204c696d69746564312d302b060355040313245365637469676f205075626c696320436f6465205369676e696e6720526f6f742052343630820222300d06092a864886f70d01010105000382020f003082020a02820201008de79412220424742eff162302928ab6ae3685ac47d423912b3edc7de231a0516fac8491e3528ab5e296ded0876324898affef12933b7dbbb68abdbd057f279b6b65d3a50c69b1bc49399af16d6eaae4a08327da9a0d2b50e94b5bb3b86436a47e4a3da971ab61b373b33c0b0cefdb3357e5be3437e3971b5dfd1f123d820376e6fb3f66d2943169fa6db334acc17a78dc9250f264c7aa2d04abc36aeae02fa7a7dc6ed7e8ffda21ab40bfb9ee0d9ec6d99e99efc6de1fa90c76b32720a1d6bafd80e701d2efeb822995708dffbb15cffed10f36a22e4f329074466b4735137705334f632eb82de1bf65a7046b18d871facc08f26d899910b1addb3e2ce4aa18b0c607017567de6de963631e367f6989beaa453e6e5a5f8fa15bcb9d308630e803b340c60d0f38cd67a85388fab83065fa6fc7e71db18374693eacc4683bb1e667339ab608e080054840eef6826446a8f573b00695f26c659fbf555b1c9c571ac778467c70aa941b8217ac87e9b6c90e811c40d6161729fc5c9c182bea45f5efbdd5674f285e05ee904c7ae7c6f4d0fcfacd3e32461320368a04eab7aa07469c0d933a096699585c29a3b90ca630383cd04636357c9cbaeec3d5f90a76fa7e051b40ca9235e9d57ad1b57f00aea990aac57f019c10b116fccc6e18dc6f62fea650a7b87bb89d153ffe200c75c8225a1395199000e91ad5c286f1e38eec5ff4e50203010001a3423040301d0603551d0e0416041432eb929aff3596482f284042702036915c1785e6300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff300d06092a864886f70d01010c050003820201007665c2e3d7224ad71d895eff695ec614024d73a6cdcd28cab037eabfa7c921aaaa5fdabff6836cd080d10a5c00a4cbf3cc390f9e417188d53ce88a7b8c1723f7ca3474916c06ae503f0059b2263c3c178357033e2dd11a3dd4cf0754b2430b5272a888f5c417f26fd158a5d168e43d980818ee36f448489afa5470f088d47016304249d0d93f754b4571d8aea2bb610e88855057b9ba112b36291f8f20729e5c9e89d182da458d6a99da84716b33a510bb79f097f67481a03f57c7868c308c0e3895ae01c61eabdca81f6f2fd7ff761eae17736de5b975b36106a89533c24e6fb237f295be855412b9c8bd624276f72afcf53731032657fed1e6dbf0160272838c08b384aca9e407f8a188c4135a50475442a6edd041342c98b13ea234a10c5dbdacf77f79a7bf6d0c5632851b4b97b8e1ace4a43c71f1a3e14e63d6f446baf50b08e1633ceda2592f0ad42c6b23a29ea14deed112cd183350ed416ecb7f3d41600b630b78f575ef4315b7360b10afdc5c18a998d936d91dd884b3068a82e37b1b24a742ceee0f3e565c327dec4bde562b3b3bbaf97a58d051b66cd6f658a252247a4486a11c603f49d3fcfaf9841c05c234bfe2e6f1192a992f5657359cb5f507c3462fde383d190dfba3f1df139ee7a9725831afbdeadad7d66d7733338ef4acfdc1bf4987d27005677406a6f678402d1604910f1fd316c4b87a170d24c9b2	action1_agent.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\CCBBF9E1485AF63CE47ABF8E9E648C2504FC319D\Blob = 1900000001000000100000000e8c3d8a006eb5c23a7725464ad10a8c030000000100000014000000ccbbf9e1485af63ce47abf8e9e648c2504fc319d09000000010000000c000000300a06082b060105050703031d0000000100000010000000b57b5c441b8ef4866b6f8f43ff6e45f614000000010000001400000032eb929aff3596482f284042702036915c1785e66200000001000000200000007e76260ae69a55d3f060b0fd18b2a8c01443c87b60791030c9fa0b0585101a380b000000010000004a0000005300650063007400690067006f0020005000750062006c0069006300200043006f006400650020005300690067006e0069006e006700200052006f006f007400200052003400360000000f000000010000003000000009cc9211dbd405f0eb21b2fe598b2439893f4c3d478888adf01431a8b1fb66bd524266fc4e875f022623e69fcb4dd9be20000000010000007c0500003082057830820360a00302010202104b2c3b01018bad2abc8c7b5b3eed9057300d06092a864886f70d01010c05003056310b300906035504061302474231183016060355040a130f5365637469676f204c696d69746564312d302b060355040313245365637469676f205075626c696320436f6465205369676e696e6720526f6f7420523436301e170d3231303332323030303030305a170d3436303332313233353935395a3056310b300906035504061302474231183016060355040a130f5365637469676f204c696d69746564312d302b060355040313245365637469676f205075626c696320436f6465205369676e696e6720526f6f742052343630820222300d06092a864886f70d01010105000382020f003082020a02820201008de79412220424742eff162302928ab6ae3685ac47d423912b3edc7de231a0516fac8491e3528ab5e296ded0876324898affef12933b7dbbb68abdbd057f279b6b65d3a50c69b1bc49399af16d6eaae4a08327da9a0d2b50e94b5bb3b86436a47e4a3da971ab61b373b33c0b0cefdb3357e5be3437e3971b5dfd1f123d820376e6fb3f66d2943169fa6db334acc17a78dc9250f264c7aa2d04abc36aeae02fa7a7dc6ed7e8ffda21ab40bfb9ee0d9ec6d99e99efc6de1fa90c76b32720a1d6bafd80e701d2efeb822995708dffbb15cffed10f36a22e4f329074466b4735137705334f632eb82de1bf65a7046b18d871facc08f26d899910b1addb3e2ce4aa18b0c607017567de6de963631e367f6989beaa453e6e5a5f8fa15bcb9d308630e803b340c60d0f38cd67a85388fab83065fa6fc7e71db18374693eacc4683bb1e667339ab608e080054840eef6826446a8f573b00695f26c659fbf555b1c9c571ac778467c70aa941b8217ac87e9b6c90e811c40d6161729fc5c9c182bea45f5efbdd5674f285e05ee904c7ae7c6f4d0fcfacd3e32461320368a04eab7aa07469c0d933a096699585c29a3b90ca630383cd04636357c9cbaeec3d5f90a76fa7e051b40ca9235e9d57ad1b57f00aea990aac57f019c10b116fccc6e18dc6f62fea650a7b87bb89d153ffe200c75c8225a1395199000e91ad5c286f1e38eec5ff4e50203010001a3423040301d0603551d0e0416041432eb929aff3596482f284042702036915c1785e6300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff300d06092a864886f70d01010c050003820201007665c2e3d7224ad71d895eff695ec614024d73a6cdcd28cab037eabfa7c921aaaa5fdabff6836cd080d10a5c00a4cbf3cc390f9e417188d53ce88a7b8c1723f7ca3474916c06ae503f0059b2263c3c178357033e2dd11a3dd4cf0754b2430b5272a888f5c417f26fd158a5d168e43d980818ee36f448489afa5470f088d47016304249d0d93f754b4571d8aea2bb610e88855057b9ba112b36291f8f20729e5c9e89d182da458d6a99da84716b33a510bb79f097f67481a03f57c7868c308c0e3895ae01c61eabdca81f6f2fd7ff761eae17736de5b975b36106a89533c24e6fb237f295be855412b9c8bd624276f72afcf53731032657fed1e6dbf0160272838c08b384aca9e407f8a188c4135a50475442a6edd041342c98b13ea234a10c5dbdacf77f79a7bf6d0c5632851b4b97b8e1ace4a43c71f1a3e14e63d6f446baf50b08e1633ceda2592f0ad42c6b23a29ea14deed112cd183350ed416ecb7f3d41600b630b78f575ef4315b7360b10afdc5c18a998d936d91dd884b3068a82e37b1b24a742ceee0f3e565c327dec4bde562b3b3bbaf97a58d051b66cd6f658a252247a4486a11c603f49d3fcfaf9841c05c234bfe2e6f1192a992f5657359cb5f507c3462fde383d190dfba3f1df139ee7a9725831afbdeadad7d66d7733338ef4acfdc1bf4987d27005677406a6f678402d1604910f1fd316c4b87a170d24c9b2	action1_agent.exe

Suspicious behavior: EnumeratesProcesses 31 IoCs

pid	Process
3700	msiexec.exe
3700	msiexec.exe
1972	powershell.exe
1972	powershell.exe
1972	powershell.exe
3700	msiexec.exe
3700	msiexec.exe
3700	msiexec.exe
3700	msiexec.exe
3700	msiexec.exe
3700	msiexec.exe
3700	msiexec.exe
3700	msiexec.exe
3700	msiexec.exe
3700	msiexec.exe
3700	msiexec.exe
3700	msiexec.exe
4160	powershell.exe
4160	powershell.exe
4160	powershell.exe
1408	powershell.exe
1408	powershell.exe
1408	powershell.exe
3420	powershell.exe
3420	powershell.exe
3420	powershell.exe
3420	powershell.exe
3420	powershell.exe
3420	powershell.exe
1364	action1_agent.exe
1364	action1_agent.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3420	msiexec.exe
Token: SeIncreaseQuotaPrivilege	3420	msiexec.exe
Token: SeSecurityPrivilege	3700	msiexec.exe
Token: SeCreateTokenPrivilege	3420	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	3420	msiexec.exe
Token: SeLockMemoryPrivilege	3420	msiexec.exe
Token: SeIncreaseQuotaPrivilege	3420	msiexec.exe
Token: SeMachineAccountPrivilege	3420	msiexec.exe
Token: SeTcbPrivilege	3420	msiexec.exe
Token: SeSecurityPrivilege	3420	msiexec.exe
Token: SeTakeOwnershipPrivilege	3420	msiexec.exe
Token: SeLoadDriverPrivilege	3420	msiexec.exe
Token: SeSystemProfilePrivilege	3420	msiexec.exe
Token: SeSystemtimePrivilege	3420	msiexec.exe
Token: SeProfSingleProcessPrivilege	3420	msiexec.exe
Token: SeIncBasePriorityPrivilege	3420	msiexec.exe
Token: SeCreatePagefilePrivilege	3420	msiexec.exe
Token: SeCreatePermanentPrivilege	3420	msiexec.exe
Token: SeBackupPrivilege	3420	msiexec.exe
Token: SeRestorePrivilege	3420	msiexec.exe
Token: SeShutdownPrivilege	3420	msiexec.exe
Token: SeDebugPrivilege	3420	msiexec.exe
Token: SeAuditPrivilege	3420	msiexec.exe
Token: SeSystemEnvironmentPrivilege	3420	msiexec.exe
Token: SeChangeNotifyPrivilege	3420	msiexec.exe
Token: SeRemoteShutdownPrivilege	3420	msiexec.exe
Token: SeUndockPrivilege	3420	msiexec.exe
Token: SeSyncAgentPrivilege	3420	msiexec.exe
Token: SeEnableDelegationPrivilege	3420	msiexec.exe
Token: SeManageVolumePrivilege	3420	msiexec.exe
Token: SeImpersonatePrivilege	3420	msiexec.exe
Token: SeCreateGlobalPrivilege	3420	msiexec.exe
Token: SeBackupPrivilege	404	vssvc.exe
Token: SeRestorePrivilege	404	vssvc.exe
Token: SeAuditPrivilege	404	vssvc.exe
Token: SeBackupPrivilege	3700	msiexec.exe
Token: SeRestorePrivilege	3700	msiexec.exe
Token: SeRestorePrivilege	3700	msiexec.exe
Token: SeTakeOwnershipPrivilege	3700	msiexec.exe
Token: SeRestorePrivilege	3700	msiexec.exe
Token: SeTakeOwnershipPrivilege	3700	msiexec.exe
Token: SeRestorePrivilege	3700	msiexec.exe
Token: SeTakeOwnershipPrivilege	3700	msiexec.exe
Token: SeRestorePrivilege	3700	msiexec.exe
Token: SeTakeOwnershipPrivilege	3700	msiexec.exe
Token: SeRestorePrivilege	3700	msiexec.exe
Token: SeTakeOwnershipPrivilege	3700	msiexec.exe
Token: SeRestorePrivilege	3700	msiexec.exe
Token: SeTakeOwnershipPrivilege	3700	msiexec.exe
Token: SeShutdownPrivilege	5032	MsiExec.exe
Token: SeRestorePrivilege	3700	msiexec.exe
Token: SeTakeOwnershipPrivilege	3700	msiexec.exe
Token: SeRestorePrivilege	3700	msiexec.exe
Token: SeTakeOwnershipPrivilege	3700	msiexec.exe
Token: SeDebugPrivilege	1972	powershell.exe
Token: SeBackupPrivilege	2168	action1_agent.exe
Token: SeBackupPrivilege	2168	action1_agent.exe
Token: SeRestorePrivilege	3700	msiexec.exe
Token: SeTakeOwnershipPrivilege	3700	msiexec.exe
Token: SeRestorePrivilege	3700	msiexec.exe
Token: SeTakeOwnershipPrivilege	3700	msiexec.exe
Token: SeRestorePrivilege	3700	msiexec.exe
Token: SeTakeOwnershipPrivilege	3700	msiexec.exe
Token: SeRestorePrivilege	3700	msiexec.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
3420	msiexec.exe
3420	msiexec.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
3420	msiexec.exe
3700	msiexec.exe
1592	MsiExec.exe
5032	MsiExec.exe
1928	msiexec.exe
5892	MsiExec.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 3700 wrote to memory of 3012	3700	msiexec.exe	95
PID 3700 wrote to memory of 1592	3700	msiexec.exe	97
PID 3700 wrote to memory of 5032	3700	msiexec.exe	98
PID 2168 wrote to memory of 1972	2168	action1_agent.exe	101
PID 2168 wrote to memory of 1928	2168	action1_agent.exe	103
PID 3700 wrote to memory of 5892	3700	msiexec.exe	104
PID 1364 wrote to memory of 4160	1364	action1_agent.exe	106
PID 1364 wrote to memory of 1408	1364	action1_agent.exe	108
PID 1408 wrote to memory of 4400	1408	powershell.exe	113
PID 1364 wrote to memory of 3420	1364	action1_agent.exe	114

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\Approved%20Document%23D53LU.msi
1⤵
- Badlisted process makes network request
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:3420

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3700
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:3012
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding DDE7FD90F49F19A623CE558A1E1D8E06
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:1592
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 49CCB0BA067B7102078EA34D1542A4F3 E Global\MSI0000
  2⤵
  - Drops file in Windows directory
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:5032
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 811BE57BB64AA0BE7D88028C5A70918C E Global\MSI0000
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:5892

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:404

C:\Windows\Action1\action1_agent.exe
C:\Windows\Action1\action1_agent.exe service
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Modifies system certificate store
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2168
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -Command "$ExecutionContext.SessionState.LanguageMode"
  2⤵
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Command and Scripting Interpreter: PowerShell
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1972
- C:\Windows\SysWOW64\msiexec.exe
  C:\Windows\system32\msiexec.exe /I "C:\Windows\Action1\action1_agent.msi" /quiet /qn /norestart /lv* "C:\Windows\Action1\logs\agent_install_1793340926.log" ALLOWRESTRICTEDVERSIONS=1
  2⤵
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:1928

C:\Windows\Action1\action1_agent.exe
C:\Windows\Action1\action1_agent.exe service
1⤵
- Drops file in Windows directory
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1364
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -Command "$ExecutionContext.SessionState.LanguageMode"
  2⤵
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Command and Scripting Interpreter: PowerShell
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:4160
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -Command -
  2⤵
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Command and Scripting Interpreter: PowerShell
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1408
- - C:\Windows\Action1\action1_agent.exe
    "C:\Windows\Action1\action1_agent.exe" loggedonuser
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4400
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -Command -
  2⤵
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Command and Scripting Interpreter: PowerShell
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:3420

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Event Triggered Execution

T1546

Installer Packages

T1546.016

Privilege Escalation

Event Triggered Execution

T1546

Installer Packages

T1546.016

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

System Binary Proxy Execution

T1218

Msiexec

T1218.007

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e5a0dcd.rbs

Path C:\Config.Msi\e5a0dcd.rbs
Size 240KB
SHA256 e0f52a9f52dc9521cbf5d2423919e1207d91fdb733d24a408ac227bd14f82bd9
MD5 5b125df3df37754edc8e1c2d02910e59
SHA1 dc8fb58c5de2d88fcac2a463448cc30c4ae6a642
SHA512 2f94ee1896dab45fb775f899d9a577c4ec5e8a5158d5c4cc5b8010d846ec83a0c83616c0872b59a66a2a5fe96d8a21891fb8775fd7307909acec93390356a2ee
SSDEEP 3072:1bUXiqyhTO8W0iEa8LW0bEC9hvZpC01v+eUKflQnZl+T+J7g6EsNr7wyy/IP3B:aqhy8VKU3hvZUy+ppHEsuB/S
TLSH
T1F2349E217494547EEBFF0832953AD671AE3DF2380B90C56EC384981E5D618C1ABB7B27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5a0dce.rbs

Path C:\Config.Msi\e5a0dce.rbs
Size 7KB
SHA256 4a5f1c217752108ff101eaf6ecef13f952dbd7420b22b69ecf014d8fd4f88975
MD5 96aade2fa621387a1dcf7b8ab9212798
SHA1 a03606f62321ce3c750d6a935655297c4bcdf4ae
SHA512 989d6ac1789da4f5634ca91f41461c6986cd6e8f21fd5ebc370df57c26ca48ee42a5b5cc7a4bb8ce4c2c55e2f2773e0e8b97bbc8ad4cba018154be641bc0fd77
SSDEEP 192:s9etz1zaT/wIk/wC2szTe/u/SkGL5kqKppu0wIerUS:sIBU/Q/h2suWakGL5kZu0wIerUS
TLSH
T171E12E81B62181E2E8961B38D707276537B2D7D99350336B08CDE4A0DF6378D4F8A68F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5a0dd3.rbs

Path C:\Config.Msi\e5a0dd3.rbs
Size 246KB
SHA256 44eac1954758978de18894ec291abc5df35847c1dfe8670831c0778edcd2eaec
MD5 3837607046abac068034b35bcb3a0ed6
SHA1 9534386f80d7bb32189039fdf9f62c6004514638
SHA512 df812c29cb6664b537381ecd1ab1520daadc991be65331683bc95999080dc6740333eb1232933ed982583e7edaae53fea41227ff2d252d397bac254caa8b8069
SSDEEP 3072:jbQb2XiqyhTO8W0iEa8LW0bEC9hvZpC01v+eUKflQnZl+T+J7g6EsNr7wyy/IP3B:3qhy8VKU3hvZUy+ppHEsuB/S
TLSH
T149349E217494547EEBFF0832953E9A71AE3DF2380B50C56EC384981E5D618C1ABB7B27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5a0dd8.rbs

Path C:\Config.Msi\e5a0dd8.rbs
Size 8KB
SHA256 454634f3e514400095e63be85d3e8ec52e5078bc948e46c14ff8214036456606
MD5 2d37b36f528a325bdea5d1f62d43d22c
SHA1 d25818763df62162237fd2a0600d0c74fa5138b1
SHA512 f7e1e71c18a32ac6b6759eb48e175c4038267bbfa73dbebab16e664b06fdad45b8884f909f09e0e06d25ad50b41f0831c525ab3bf757fa830b7d457d354a863b
SSDEEP 192:kKxzRRPoHRPo1uaszxz8ezuO9+Yed+wFhmwuOdO7uLIXBUbA:kKx9RPgRP+uasVgezuOted+wFhm9/iUR
TLSH
T169022382722641E2E9561F39E70327653BA3DBE95310526B019DF4E4DF327CC5E8A28F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5a0ddb.rbf

Path C:\Config.Msi\e5a0ddb.rbf
Size 3B
SHA256 13bf7b3039c63bf5a50491fa3cfd8eb4e699d1ba1436315aef9cbe5711530354
MD5 21438ef4b9ad4fc266b6129a2f60de29
SHA1 5eb8e2242eeb4f5432beeec8b873f1ab0a6b71fd
SHA512 37436ced85e5cd638973e716d6713257d692f9dd2e1975d5511ae3856a7b3b9f0d9e497315a058b516ab31d652ea9950938c77c1ad435ea8d4b49d73427d1237
MD5 SHA1 SHA512

Submit Download

e5a0ddc.rbs

Path C:\Config.Msi\e5a0ddc.rbs
Size 1KB
SHA256 ad1bbf795350181cd5553a7345091cc147b6ec8234d5b0b20689e6f77bfbe40f
MD5 64c5490406da2e3309a1653e65b174fc
SHA1 c4ce4a0458bf60179fa028181af50bf7d1dccb40
SHA512 cf1bc22d71e71fe26923685e4eda1f5568940b6894e1b3a937f75ea0a308ea7165ac417f5a9f7c783b67248a3b2dd0811080f3541f42bcd612d697bd0726f9b2
TLSH
T14F219093F71992C2F8D25F38D60317513BBB83EA471853A7088D7664AE31B4C5FA918D
MD5 SHA1 SHA512 TLSH

Submit Download

e5a0ddd.rbs

Path C:\Config.Msi\e5a0ddd.rbs
Size 7KB
SHA256 41e06ad5c2cf590b8ce73ae85c3b3e4831e250180198e57c35cf10d1a8b23a11
MD5 2dc4114af4413bfc909e0728a11b931f
SHA1 2d04ad4e884e161514c8edc65b076a381d3822ca
SHA512 d69f8731fc78a585ff20feaf4c1c6666170e0a0dfec1f4c6fa451980ac13e683b3b1c45116884bbd759e7951756f6a7f8a244e38f4636060b20e9011655bd693
SSDEEP 96:kyCtPeq5v7XkUaqAiOliCsThqxBXkUaqAiOliC6jZS2dThqxaH+35fyG9tbktqZS:kne4faVhI2aVhM+YS0/p5
TLSH
T17FE121017A1052F3FA6A0735D3471F9437B2D2DA83112B1B8CCDA6749F6BB892E951CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.dll

Path C:\Windows\Action1\7z.dll
Size 1.3MB
SHA256 87aae6d4af8f028f080147e4cb0c42fff76c46fe8813c8b5dffd32d2bc566afd
MD5 56fa4622b917bb736eb5efed924f132d
SHA1 132dc22e72a9b01eff1790e9d681e7a41cc93b97
SHA512 5c22f0a4372869cd809163785fb65511cd1864599561c2691657ca76f7022a80f4076e209843cd87b03da121f651ed2ff8058bbcaa4ff807c76e4e132fd45f2d
SSDEEP 24576:xNib1WFpYKnzLy1GOjaCMHO0v93Pqt0lamuAsggS2VsAhwRDgfeS4:xNibGpYKiGOjoHO89/18ugSo1U
TLSH
T1DA559E11F7F1C074C58E5630862DBBBA50F8E729CA10A9D777C0BE6E6F319D2D225A09
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

action1_agent.exe

Path C:\Windows\Action1\action1_agent.exe
Size 8.9MB
SHA256 bdaf0c46119913e3636524f2a353f3fdaef30d6bf3efb168a20edd6dd10809bd
MD5 6d8bee98ef484d5892de8a9f16950228
SHA1 ebe2473b6e7f497a79a43a01585ddafd4042ef50
SHA512 d78abf33f61286527c3bd7ff9a244e7652328193390d4c5fc9cc6afdec44ea149cf8e945fd321931e5b53d64b98308ac2965232fad29f058f452ba0c42583685
SSDEEP 196608:O2gNtQsSfSMg5AXFlFBaSIYYu4+B2v4ZnDVVx0sp52Ck:OZJM/fblYN6ZnDVn082r
TLSH
T124968D21E6418135F9A301B299BE4B6F8538AE310B2454D7D3C85CAE5AB19E33B33F57
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

action1_agent.exe

Path C:\Windows\Action1\action1_agent.exe
Size 8.9MB
SHA256 941695d20d82dd5d62f74b0111feb23720637202f6c797df2a02e2cb6cb6e8e3
MD5 e4f1f52a78f22dd2be17449ca6f8f0af
SHA1 e9f385454fdddc7ae88431b8e02f4dfb7dd57b68
SHA512 2d7ed519a9380e1574bbc55444420334bdd0792c7839a1be67607a4f81be79e52f6c4dd10141079a47dcf61552724c2b3f060f0f670bdea527dc130ba9aebac8
SSDEEP 196608:KV1U3lnchqzhNpxSKyOBE2LeIzfAnOgOZ6aMkElWpRUn:KPoTVQYEseIzflZ6aMZORo
TLSH
T1D9968D21B641C135F9A301B29A7E4B6F853CBE30072555E7D3C858AE5AB19E33B32B17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

action1_agent.exe.connection

Path C:\Windows\Action1\action1_agent.exe.connection
Size 2B
SHA256 565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3
MD5 e0aa021e21dddbd6d8cecec71e9cf564
SHA1 9ce3bd4224c8c1780db56b4125ecf3f24bf748b7
SHA512 900110c951560eff857b440e89cc29f529416e0e3b3d7f0ad51651bfdbd8025b91768c5ed7db5352d1a5523354ce06ced2c42047e33a3e958a1bba5f742db874
MD5 SHA1 SHA512

Submit Download

action1_agent.exe.update_state

Path C:\Windows\Action1\action1_agent.exe.update_state
Size 1B
SHA256 7902699be42c8a8e46fbbb4501726517e86b22c56a189f7625a6da49081b2451
MD5 8f14e45fceea167a5a36dedd4bea2543
SHA1 902ba3cda1883801594b6e1b452790cc53948fda
SHA512 f05210c5b4263f0ec4c3995bdab458d81d3953f354a9109520f159db1e8800bcd45b97c56dce90a1fc27ab03e0b8a9af8673747023c406299374116d6f966981
MD5 SHA1 SHA512

Submit Download

action1_agent.msi

Path C:\Windows\Action1\action1_agent.msi
Size 6.8MB
SHA256 d9a41402fbadd6fcc55b91aa4e635812feb5ce2da4d35a3af23ffe9e3fd88189
MD5 cb43caf2f6a8f0b7d986fec3b0f0b296
SHA1 3b30970d28002a658f26bca6e55cf0e753b6d1dd
SHA512 0d35da2ae343dc4d0ffa9dfe4bfda624bbca112d1e4a44a4d72b4ca7f5bb01e4076edc09da7d9b39f86b47c2930db5c6169ec3ee171fd2f1310380e6ec5655a2
SSDEEP 98304:3kMMwpD74pOTxPjLHLgk92Rdxmk69pa5SUOsFekLS57JkmPMETphToy0seQvsm:Ulc4pkbLHLhObmXe/kdkmPDTs
TLSH
T123761221754E8C76C5AA363071769E7DDA7CBC305BA08BDB938339EE09315C052FDA92
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

action1_remote.exe

Path C:\Windows\Action1\action1_remote.exe
Size 1.5MB
SHA256 eb77e754e3b6c4d93fa4697bcdf02871be7b30b69ca0855a5df79f9404fdb3e8
MD5 d62dedf2a6511e53d1528691e0c33f37
SHA1 9acf8e99f4f535e8dac9d7c483ef5c2ee002ae9b
SHA512 810d4c45752e8c7a8f3b699b9791901cbdfcf2dbed00457f6a1178b16a60c0b9a1a4e25751e9cf206513c9764c52d70644310db5762eaee80315d282741ddf70
SSDEEP 24576:ig1cKk2wkiuXAlF8LFNYYgWj5d51z9DSrUPopzFv73OZN0RTDhfyuKCmSQ:ig1s6i+AOJ1zwrUPUhvVT1fy1C9Q
TLSH
T1B0757C213397802DE9B213307978D6BA593DBE754FB594CFA2D01AAD5C30AC25B35B23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

advanced_settings.json

Path C:\Windows\Action1\advanced_settings.json
Size 54KB
SHA256 3040b827165bc37144baf5222f74312228fcae1cdbf96606085a7c859ac2bf14
MD5 aa3416f1cc2ceb5dc02f6520f027700c
SHA1 950fcdea8734b06827b2529b2dc0cf04af207e93
SHA512 a848ca2b4fecfea10f63a359553fb072cbd5622662521c415052d7d8d2a681d0224a835151072483d2737d4e20670dd8a20967e9644c0c4f1472c2e1ce3cfd10
SSDEEP 768:qHXKnbhRgjUpQUfRQ3Lyhx4zUtsp82qUgw6fCph8uP5K5DIK58EOKWbBoE3a+OQJ:NRoLEBxQ+wkMdAeyRAFl
TLSH
T1B1439C16E4757DB104C21C8C5FCB1AF79A4E019603D906DE871CEEBF8AAF56C8102A9F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

agent_downgrade.version_pair

Path C:\Windows\Action1\agent_downgrade.version_pair
Size 71B
SHA256 570839a03e2816086778a40b9201b5d2fd36b3b01f44d34578d6bdea7a1f4ff8
MD5 9a5cfd79b6cd7989874b571db61ee13e
SHA1 e51823fe1281839c7d6d56e4ac8a2457a3a9060c
SHA512 689bebae4d882ffd7dcc7ec7c368a69c20933e24abe72448bbf5e9593cccd5e8d020f1edd5b06a477aabeac34069de6e721800c410092ee3de1d25c8e62ce470
TLSH
T111A002152314153368FB8F817D353E118A0D45ADDB75DD2E22CD5D91851C78216CCB01
MD5 SHA1 SHA512 TLSH

Submit Download

first_install

Path C:\Windows\Action1\first_install
Size 50B
SHA256 58904f04cf5bd7d3a302ab80b321d14ff776db9971db23e3af81c1b60501a067
MD5 1da0cdad44893d2115765ee108f5c2f7
SHA1 ff673611110a1b8c3e1a47d68354787ec03ac8f7
SHA512 8384d386bb3d150315a541597b767119397ad37855007fa79a9f1396dfaf5d1dd8775482adc489ff3d0ca8702351665e1bdaabc74c3ce30758d18cd91c2c89e3
TLSH
T1BA9004D0D413D3353CDD437454F731D30710C554DC550105374547CC0415015515F051
MD5 SHA1 SHA512 TLSH

Submit Download

agent_install_1793340926.log

Path C:\Windows\Action1\logs\agent_install_1793340926.log
Size 1KB
SHA256 3911f2fbb9ff8726c5830fe5424aef4f0198d41a6cdf17e81c9c2ee0fdec803a
MD5 9d8311b7ed2ea782f8859fd1bbb273a4
SHA1 61de219ba01a677066a1bbc5173f4856cc5224fc
SHA512 6f193393bedda1b7820a77e5913b269b52b0f474a680e1d24fe34b23b977df603f72b14d3eb78747c9d98e01aea1af0de805ce3d45b0c16dea5b944c32f52050
TLSH
T16431D69A2BE50C05B2B7970BEDB7C051AA73FCC17875D74C2385821A066BD05AC6C7AF
MD5 SHA1 SHA512 TLSH

Submit Download

sas.dll

Path C:\Windows\Action1\sas.dll
Size 8KB
SHA256 996b01e15f85e165899630721a141b178a9c372b6e878012180ec9e9d4e7bd06
MD5 969d1f85151e0156d51a664e59a50213
SHA1 777735cf24fe880d00a205b5bcc79ca8df8d660b
SHA512 73f9a14d297f7dddc9e3d9b0db6cd4160cd000f31f437ea8add7d95de2f704482fa891996f2df048def3371cc9245a2efa31b2d0647a7cc1e6848db7b809e711
SSDEEP 192:l5UGq/4LYix0kmAEE8O5cTbOVT66o+1WX6wW/:nr5YiWXAjHGOVZP1WX6wW
TLSH
T13C02E60973A8067AE4FF1B76A06EA236462AB6205FF142EF195322D938355D15E307C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

what_is_this.txt

Path C:\Windows\Action1\what_is_this.txt
Size 1KB
SHA256 735dd20b8dcd387bf04a6deb30ad2b26b97402fc12287edacaef6d998f093b87
MD5 36467f0b9546135f216ddca212a416eb
SHA1 77b091e9d02b382362a53923918543153b122598
SHA512 5130a8ad1cf03aa9b11a48f48e869a407c1442ac93eb50022196d47e267ac68cbe9a4b571bdd88da2cd3c4cf02f81fc796905db7eaca5b42bfed50782a815533
TLSH
T14631615BF72422A40F8701823B9B15D1E739D46C3319A6A428EF421883A3A8893737E9
MD5 SHA1 SHA512 TLSH

Submit Download

MSI12AE.tmp

Path C:\Windows\Installer\MSI12AE.tmp
Size 385KB
SHA256 626a4e7060bd9b789795804e8b6497743c11d61c7353fb68798dd0bc76152cae
MD5 ced03b1bf99e148e40b7834816e2c330
SHA1 a7dc2898fa0916f8484e3597ce3e2c524c9c954d
SHA512 52a52436bb240a5ec16c540e428dc5acf7f7decaee4b5df092347019ef568d4c5948535721a39deef6dacc31cf4debad665dfb077c4dc9f44dc77ccd9d60cbaa
SSDEEP 6144:Rh1TnES0D5L240+A++CGvBsee3MudRa1UIFO4I/NVTPFc:JTnEDL24Pt+CGveeenw44IHFc
TLSH
T19D849D01B542C032D5AE05B0B634EFB5AABDA9705FA568CBB7D40D7B8D302C1A735B1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSI18FA.tmp

Path C:\Windows\Installer\MSI18FA.tmp
Size 234KB
SHA256 78860e15e474cc2af7ad6e499a8971b6b8197afb8e49a1b9eaaa392e4378f3a5
MD5 8edc1557e9fc7f25f89ad384d01bcec4
SHA1 98e64d7f92b8254fe3f258e3238b9e0f033b5a9c
SHA512 d26c9dce3c3d17583ffb5dbcd3989f93b096a7f64a37a2701a474c1bf4b8c8b1e922c352d33f24e411f1c793e1b4af11a3aec1de489087d481b1b636df2050cd
SSDEEP 3072:5XiqyhTO8W0iEa8LW0bEC9hvZpC01v+eUKflQnZl+T+J7g6EsNr7wyy/IP3:5qhy8VKU3hvZUy+ppHEsuB/
TLSH
T159348D217494547EEBFF0832953AD671AE3DF2380B90C96EC384581E6D618C1A7B7B27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSI501B.tmp

Path C:\Windows\Installer\MSI501B.tmp
Size 387KB
SHA256 ca5f0275e70ec5ba65b74c3da74f489018bc143c4c405fd8bbc6519eadac2a22
MD5 4112820180a36753089ee5c0fdba1538
SHA1 6366de1c2930886892aabf4b8ac55fd0bb4b91bb
SHA512 eac55d5a5c723fb5bd85bdd1ee71a13497d677d2b45e58b6eed2f7e42760d2ba3d07e0cb2b622f7866da8492f8d3fdb02b6288f95b761f5b2e20d2e2098233d3
SSDEEP 6144:ijVmAOn9DqwokBL+097OsOmceIpOaEPbyHiDO9EAFw:CmAOnRokBL17OsONeIshZAFw
TLSH
T18B848D01B542C032D5AE05B0B535EFB5AABDA9704FB468DBB7D40E7B8D302C1A735A1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5a0dcc.msi

Path C:\Windows\Installer\e5a0dcc.msi
Size 6.8MB
SHA256 3be3e7a45994dffd41af96f3b8852674272e6dbaaca2dcd0b84296e136a9c6c5
MD5 259b42d13d40a8dd91674a74949dcaab
SHA1 523be7799476cde550b49422edc31ed43c0d5ce9
SHA512 b2218c1fcfc4dd9e52cfa64843f03fc0ca6ec31015d2bf2d56420412b906c1dff850568acffc2bfb8fae312fe71e89a6ae749e3365e9774da4487bfebfc54204
SSDEEP 196608:flc4PxNgvXPtj+zc5il1FiaRg9MRuGWRHZB:drr+/tj+QITFic+MRRWRn
TLSH
T1ED662321BA838036E95B1E30753D9A759B3DFE345F64B0CFA784382D5E316C05B72A92
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ProductIcon

Path C:\Windows\Installer\{E6D8B066-2E74-458F-9111-24857C1C627A}\ProductIcon
Size 32KB
SHA256 7a214ccfe309e4c0c83f40d9b7c92e3d41206db734401e7227ef10b38064ca9d
MD5 d37f7a439b9527f73e21311db17eaf00
SHA1 d0f34b3c1368f28a419924560c282358703a8d35
SHA512 3c1bcd38ed8d6bff8e071416cda90b0331b50903d9e4c9305bc36f9ccce23cb05424576b066485e76ee17e6fdc493fd25f8776d24b98de9d3941c181bb333569
SSDEEP 96:JnbrlpScW1BwB/vmaOZaxdJVE8BEArPz578SSuQEmgo3/I:JnbrlpScW18Ued/E8f8KQEPo3/I
TLSH
T195E211067007D5DCDE28473CB0B6FCB539728A776EAC23DEF2A4B4E52882465147C6B2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_koor34vy.1kh.psm1

Path C:\Windows\SystemTemp\__PSScriptPolicyTest_koor34vy.1kh.psm1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 64B
SHA256 b3a033bc9967f667e05c806a479d9fd9632c228ffaa4e9626a9ecb9147cc127d
MD5 d66598884abd76ff8bcdcd4350c33525
SHA1 004e70032a4bda2b9cec8b749ad4de1002e6fb48
SHA512 033f0cb4619de7ca61534a441ed24c056cba10b446789e7e301aa184a2a13a70120b514c0cfb071f8653c47dd8112d57ff47d1b2b68ffa24dc9ae93fe1b331f9
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 64B
SHA256 a7de5177c68a64bd48b36d49e2853799f4ebcfa8e4761f7cc472f333dc5f65cf
MD5 446dd1cf97eaba21cf14d03aebc79f27
SHA1 36e4cc7367e0c7b40f4a8ace272941ea46373799
SHA512 a6d754709f30b122112ae30e5ab22486393c5021d33da4d1304c061863d2e1e79e8aeb029cae61261bb77d0e7becd53a7b0106d6ea4368b4c302464e3d941cf7
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 134a0b49437178e09a8a43a1a071de16b10289a6b19fc996a15d5cc2f87b9d37
MD5 0bc962b74725e3beb2b79bbe2d130a5a
SHA1 a39388cc77403236d0d7d83549d54f7bd4911308
SHA512 5b5315882efd284baa89696c7483ad489809a232e5ea41c300872eec28b0e2c52688da2dc6282755768d50011b5f7f079893e2f584175799e4a1dfdc2265aed0
TLSH
T189215937F3DC8654D88A413A50CEAC1031A787DB809EDEDBAB84D555A02F689CE61560
MD5 SHA1 SHA512 TLSH

Submit Download

metadata-2

Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
Size 26.1MB
SHA256 168eaa74c72030b36ef4a58d446a08eec716c2f0481a3a469202871eb3f60c83
MD5 ef309905e2b42090c7785e56c650b295
SHA1 5846c37642adccfbe94e1f8339a2856b82a48ea7
SHA512 3bed4e3cc6c4da52eacac680af44c556e32f534bf6c2af75b17d63d6886dfeb6734b467070bd21b27f67f9bdfd46c6660614c5bd7c349a8a51fd7e657d10ea67
SSDEEP 24576:MFo3DMPGdoO/vvTL/CgQQyFAv7Oqbr3DUt2id9O4mFea5HRQc4BmwJKR0ui:vHQ
TLSH
T11857B51836F92100E7F79F3CA8F46A63493A7D579C1ADE8D45411B4E0821FB1E872F6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{20a2f542-412a-4991-9c2a-3cfc6bb758aa}_OnDiskSnapshotProp

Path \??\Volume{0a1bed32-0000-0000-0000-d08302000000}\System Volume Information\SPP\OnlineMetadataCache\{20a2f542-412a-4991-9c2a-3cfc6bb758aa}_OnDiskSnapshotProp
Size 6KB
SHA256 8a70ebb28105b089cf064b15e6fb0bb5cca0f9ebc1af606578d48de4e3906d71
MD5 5202af05eb66c88d34ca597b503abc8b
SHA1 558c81a66403b1aa6ccf538f12686b4a7c9443d3
SHA512 424682f98eafd74841cfc5af2c5b522dc2f08204f2a7ccb10fda0b0850a035b18e82d3a135a84f988012e635f36bef941e363458910f3a0e6579edd0eb0edcc4
SSDEEP 96:FBLnqPRsvc6DD84LTHzbOHXOHBlBRQn8Sc9XE56tOSVQpuN:voRgb++uVmN
TLSH
T1DED188185AF54711E2B3AB3129F58557A837B911EF33CB8E0198238E6670A10F835F6F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1972-33-0x00000200C0600000-0x00000200C0622000-memory.dmp

Download