Automated Malware Analysis IOC Report for

Details

Filetype:	PE32 executable (console) Intel 80386, for MS Windows
Entropy:	7.999918044877228
Filename:	a2e-enterprise.26.3.3677.2903.exe
Filesize:	42987850
MD5:	29c3418978dd57c42c7e9530b3aac3d6
SHA1:	08283dd80f9597fffd5abc3977b21894e9ad962b
SHA256:	22a18e7582631d3d2efae7d691fc20421c7a9693103b6f21a190f664c686b94b
SHA512:	e8ffc68971e23bf040155fec5dc0101730fb729365208a202a101e27c289c55016b8e94ef7eaceb820182372fedd68484165b8e491587cf4b5c5a0ed127fb9b3
SSDEEP:	786432:v/NH38u8rB8LSc8EPX+0m8EKQLFD/uDoWIqIKxMTxv9+vCqJuI:JMwPXjFQZGDo/qFAxVw9b
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........A..~/F.~/F.~/F.a$F.~/F^b!F.~/F.a%F.~/F.a+F.~/FSvpF.~/F.~.F_~/F^vrF.~/F.X$F.~/F.,.F.~/F..RF.~/F.X%F.~/F.x)F.~/FRich.~/F.......

Signature Hits	Behavior Group	Mitre Attack
Detected potential crypto function	System Summary	Archive Collected Data Encrypted Channel
Drops PE files	Persistence and Installation Behavior
Found dropped PE file which has not been started or loaded	Malware Analysis System Evasion
Found potential string decryption / allocating functions	System Summary	Deobfuscate/Decode Files or Information Obfuscated Files or Information
Installs a raw input device (often for capturing keystrokes)	Key, Mouse, Clipboard, Microphone and Screen Capturing
Sample file is different than original file name gathered from version info	System Summary
Tries to load missing DLLs	System Summary	DLL Side-Loading
Uses 32bit PE files	Compliance, System Summary	Masquerading
Uses code obfuscation techniques (call, push, ret)	Data Obfuscation
Contains functionality to enumerate / list files inside a directory	Spreading, Malware Analysis System Evasion	File and Directory Discovery
Contains functionality to query windows version	Language, Device and Operating System Detection
Creates files inside the user directory	System Summary	Masquerading
May try to detect the virtual machine to hinder analysis (VM artifact strings found in memory)	Malware Analysis System Evasion	Security Software Discovery
PE file has an executable .text section and no other executable section	System Summary
Reads software policies	System Summary	System Information Discovery
Sample reads its own file content	System Summary
URLs found in memory or binary data	Networking
Creates license or readme file	Compliance, Persistence and Installation Behavior
Submission file is bigger than most known malware samples	System Summary

Details

File:	C:\Users\user\Desktop\a2e-enterprise.26.3.3677.2903\Add2Exchange Enterprise Guide.pdf
Category:	dropped
Dump:	Add2Exchange Enterprise Guide.pdf.0.dr
ID:	dr_29
Target ID:	0
Process:	C:\Users\user\Desktop\a2e-enterprise.26.3.3677.2903.exe
Type:	PDF document, version 1.7
Entropy:	7.381292062112644
Encrypted:	false
Ssdeep:	98304:AVtrmiA6vqtF7gGDpOUU1egv9+SGqjoHm6z3MIBlPB86QnXAe:AVcp6odUUUb+SGwcLBo6Qn7
Size:	13802294
Whitelisted:	false
Reputation:	moderate

Details

File:	C:\Users\user\Desktop\a2e-enterprise.26.3.3677.2903\Add2ExchangeSetup.msi
Category:	dropped
Dump:	Add2ExchangeSetup.msi.0.dr
ID:	dr_33
Target ID:	0
Process:	C:\Users\user\Desktop\a2e-enterprise.26.3.3677.2903.exe
Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.2, MSI Installer, Create Time/Date: Mon Jun 21 08:00:00 1999, Name of Creating Application: Windows Installer, Security: 1, Code page: 1252, Template: Intel;1033, Number of Pages: 200, Revision Number: {6CC5F0A5-DD20-463B-A745-23226EA64FC9}, Title: Add2Exchange Setup, Subject: Add2Exchange, Author: Advantage International, Comments: A Microsoft Exchange Server synchronization program., Number of Words: 2, Last Saved Time/Date: Mon Mar 11 15:43:44 2024, Last Printed: Mon Mar 11 15:43:44 2024
Entropy:	7.989713441416668
Encrypted:	false
Ssdeep:	786432:AZHbPULLLrq72tsjOH5uQol2vRY+DVN8HKOG:AlPsHrTtsjOH/Hz0H
Size:	30423552
Whitelisted:	false
Reputation:	low

Details

File:	C:\Users\user\Desktop\a2e-enterprise.26.3.3677.2903\EULA\Add2Exchange EULA.pdf
Category:	dropped
Dump:	Add2Exchange EULA.pdf.0.dr
ID:	dr_30
Target ID:	0
Process:	C:\Users\user\Desktop\a2e-enterprise.26.3.3677.2903.exe
Type:	PDF document, version 1.7, 6 pages
Entropy:	7.9921021749352
Encrypted:	true
Ssdeep:	6144:0DZnpoW8Juj+7PQzBg5vxLX09lgN9h26fswbbEH2XeudeW0uLX:AnNj+bQK5vio9TswUTkeo
Size:	416578
Whitelisted:	false
Reputation:	moderate

Signature Hits	Behavior Group	Mitre Attack
Creates license or readme file	Compliance, Persistence and Installation Behavior

Details

File:	C:\Users\user\Desktop\a2e-enterprise.26.3.3677.2903\EULA\Add2Exchange EULA.rtf
Category:	dropped
Dump:	Add2Exchange EULA.rtf.0.dr
ID:	dr_28
Target ID:	0
Process:	C:\Users\user\Desktop\a2e-enterprise.26.3.3677.2903.exe
Type:	Rich Text Format data, version 1, ANSI, code page 1252, default language ID 1033
Entropy:	4.908485763338948
Encrypted:	false
Ssdeep:	384:8EK8+x+DdcyDbv+IvRapPD3+roNVkLNXm64rd2:XK8+x+htbvJwN3+rocP
Size:	16151
Whitelisted:	false
Reputation:	moderate

Signature Hits	Behavior Group	Mitre Attack
Creates license or readme file	Compliance, Persistence and Installation Behavior

Details

File:	C:\Users\user\Desktop\a2e-enterprise.26.3.3677.2903\First_Time_Installer.ps1
Category:	dropped
Dump:	First_Time_Installer.ps1.0.dr
ID:	dr_2
Target ID:	0
Process:	C:\Users\user\Desktop\a2e-enterprise.26.3.3677.2903.exe
Type:	ISO-8859 text, with CRLF line terminators
Entropy:	4.608607390064206
Encrypted:	false
Ssdeep:	192:y4EBdqrg+gCoTgFPjAJy9oWSWvncm5yJvv8WEj+WonoHEqNgr:CpCocFPSyKWdvXAJcWEtoiEq+r
Size:	17385
Whitelisted:	false
Reputation:	low

Details

File:	C:\Users\user\Desktop\a2e-enterprise.26.3.3677.2903\Links\Request Support for DidItBetter.url
Category:	dropped
Dump:	Request Support for DidItBetter.url.0.dr
ID:	dr_1
Target ID:	0
Process:	C:\Users\user\Desktop\a2e-enterprise.26.3.3677.2903.exe
Type:	Generic INItialization configuration [InternetShortcut]
Entropy:	5.155953403004538
Encrypted:	false
Ssdeep:	6:J254vVG/4xtOFVm/lCBL3W3yLPiQAwW3UGIyc1ynE5Vsv:3VW4xtOFVm9C93W3yrCwWghynd
Size:	207
Whitelisted:	false
Reputation:	moderate

Details

File:	C:\Users\user\Desktop\a2e-enterprise.26.3.3677.2903\O365Outlook32\Outlook_Installer.ps1
Category:	dropped
Dump:	Outlook_Installer.ps1.0.dr
ID:	dr_24
Target ID:	0
Process:	C:\Users\user\Desktop\a2e-enterprise.26.3.3677.2903.exe
Type:	ASCII text, with CRLF line terminators
Entropy:	4.9264371266008435
Encrypted:	false
Ssdeep:	48:uLl0WZPDP6MPPOb0PPGsGyk9z1585wQ5zYGLa9zOdg9zzPtvvKn3anlPIl:20WIMaMyyk9z1585wQ50GLa9zOdg9zxC
Size:	2031
Whitelisted:	false
Reputation:	moderate

Details

File:	C:\Users\user\Desktop\a2e-enterprise.26.3.3677.2903\O365Outlook32\Setup Files\Office365_Pro_Retailx64_Configuration.xml
Category:	dropped
Dump:	Office365_Pro_Retailx64_Configuration.xml0.0.dr
ID:	dr_40
Target ID:	0
Process:	C:\Users\user\Desktop\a2e-enterprise.26.3.3677.2903.exe
Type:	ASCII text, with CRLF line terminators
Entropy:	5.202613438368244
Encrypted:	false
Ssdeep:	24:OkfEslTC6jycWuLcWlfAcWiLcWbFS8httxkB:9fE+e6jyctLcrcjLcqDDtyB
Size:	1023
Whitelisted:	false
Reputation:	timeout

Details

File:	C:\Users\user\Desktop\a2e-enterprise.26.3.3677.2903\O365Outlook32\Setup Files\Office365_Pro_Retailx86_Configuration.xml
Category:	dropped
Dump:	Office365_Pro_Retailx86_Configuration.xml.0.dr
ID:	dr_17
Target ID:	0
Process:	C:\Users\user\Desktop\a2e-enterprise.26.3.3677.2903.exe
Type:	ASCII text, with CRLF line terminators
Entropy:	5.2041868894674
Encrypted:	false
Ssdeep:	24:OTfEslTC6jycWuLcWlfAcWiLcWbFS8httxkB:ufE+e6jyctLcrcjLcqDDtyB
Size:	1023
Whitelisted:	false
Reputation:	timeout

Details

File:	C:\Users\user\Desktop\a2e-enterprise.26.3.3677.2903\O365Outlook32\Setup Files\Pro_Retailx64.cmd
Category:	dropped
Dump:	Pro_Retailx64.cmd.0.dr
ID:	dr_36
Target ID:	0
Process:	C:\Users\user\Desktop\a2e-enterprise.26.3.3677.2903.exe
Type:	ASCII text, with no line terminators
Entropy:	4.572765012132931
Encrypted:	false
Ssdeep:	3:Pg4QQ6/QIK6Wde8UMeKJ:PVQQFKWlU2
Size:	62
Whitelisted:	false
Reputation:	timeout

Details

File:	C:\Users\user\Desktop\a2e-enterprise.26.3.3677.2903\O365Outlook32\Setup Files\Pro_Retailx86.cmd
Category:	dropped
Dump:	Pro_Retailx86.cmd.0.dr
ID:	dr_38
Target ID:	0
Process:	C:\Users\user\Desktop\a2e-enterprise.26.3.3677.2903.exe
Type:	ASCII text, with no line terminators
Entropy:	4.572765012132931
Encrypted:	false
Ssdeep:	3:Pg4QQ6/QIK6WdoMeKJ:PVQQFKWi2
Size:	62
Whitelisted:	false
Reputation:	timeout

Details

File:	C:\Users\user\Desktop\a2e-enterprise.26.3.3677.2903\O365Outlook32\Setup Files\setup.exe
Category:	dropped
Dump:	setup.exe.0.dr
ID:	dr_9
Target ID:	0
Process:	C:\Users\user\Desktop\a2e-enterprise.26.3.3677.2903.exe
Type:	PE32 executable (console) Intel 80386, for MS Windows
Entropy:	6.649944627880774
Encrypted:	false
Ssdeep:	98304:vqihTvjtEh2N5LQhyddG4THBZoJG3QBMxvble/bsTwY2h3:TpvE8dgq3oJG3QBMxBlW3
Size:	5169440
Whitelisted:	false
Reputation:	timeout

Signature Hits	Behavior Group	Mitre Attack
Drops PE files	Persistence and Installation Behavior
Found dropped PE file which has not been started or loaded	Malware Analysis System Evasion

Details

File:	C:\Users\user\Desktop\a2e-enterprise.26.3.3677.2903\Setup.zip
Category:	dropped
Dump:	Setup.zip.0.dr
ID:	dr_32
Target ID:	0
Process:	C:\Users\user\Desktop\a2e-enterprise.26.3.3677.2903.exe
Type:	Zip archive data, at least v2.0 to extract, compression method=store
Entropy:	7.998881312154931
Encrypted:	true
Ssdeep:	49152:MUbYsgyV5rS/kPE79ObqVIBYZKKXEqYbrjdLiBWn8qfMVqCqJ:MUbYsgyUcgOIdZ4ZZLou6qCqJ
Size:	2668259
Whitelisted:	false
Reputation:	timeout

Details

File:	C:\Users\user\Desktop\a2e-enterprise.26.3.3677.2903\Setup\A2E_Auto_Migration.ps1
Category:	dropped
Dump:	A2E_Auto_Migration.ps1.0.dr
ID:	dr_57
Target ID:	0
Process:	C:\Users\user\Desktop\a2e-enterprise.26.3.3677.2903.exe
Type:	Non-ISO extended-ASCII text, with CRLF line terminators
Entropy:	4.889068941413246
Encrypted:	false
Ssdeep:	192:URv4EBdSWEG7Dw4XpX4XoXJszFpzVf+/g7sD5FNPZWSDw4XpX4XoXhopz6f+/g7j:URxSWRb5oY+zd+/gI55oYOzC+/gqS
Size:	15579
Whitelisted:	false
Reputation:	timeout

Details

File:	C:\Users\user\Desktop\a2e-enterprise.26.3.3677.2903\Setup\A2E_Directory.ps1
Category:	dropped
Dump:	A2E_Directory.ps1.0.dr
ID:	dr_58
Target ID:	0
Process:	C:\Users\user\Desktop\a2e-enterprise.26.3.3677.2903.exe
Type:	ISO-8859 text, with CRLF line terminators
Entropy:	5.143902574568429
Encrypted:	false
Ssdeep:	24:SU0+J2+rcELm7LR6LPk1ophAl6PoHZu2p2MeD3nMhz:A+gYmPROsEDm9eD3E
Size:	897
Whitelisted:	false
Reputation:	timeout

Details

File:	C:\Users\user\Desktop\a2e-enterprise.26.3.3677.2903\Setup\A2E_MMC.ps1
Category:	dropped
Dump:	A2E_MMC.ps1.0.dr
ID:	dr_59
Target ID:	0
Process:	C:\Users\user\Desktop\a2e-enterprise.26.3.3677.2903.exe
Type:	ISO-8859 text, with CRLF line terminators
Entropy:	5.206402114423433
Encrypted:	false
Ssdeep:	24:zKU0jSJ2+rcELm7LR6LPk1ophAl6PoLZu2p2MeHhpyhz:8+gYmPROsEDO9eHhpK
Size:	916
Whitelisted:	false
Reputation:	timeout

Details

File:	C:\Users\user\Desktop\a2e-enterprise.26.3.3677.2903\Setup\A2E_Permissions_Commands.rtf
Category:	dropped
Dump:	A2E_Permissions_Commands.rtf.0.dr
ID:	dr_27
Target ID:	0
Process:	C:\Users\user\Desktop\a2e-enterprise.26.3.3677.2903.exe
Type:	Rich Text Format data, version 1, ANSI, code page 1252, default language ID 1033
Entropy:	4.453510072484783
Encrypted:	false
Ssdeep:	6144:Bruqfz1OZCOkNCRPRs8rHwsREvJGA217MY0sM:hLZOZtpBRmH2V+sM
Size:	216321
Whitelisted:	false
Reputation:	timeout

Details

File:	C:\Users\user\Desktop\a2e-enterprise.26.3.3677.2903\Setup\A2E_SQL_Backup.ps1
Category:	dropped
Dump:	A2E_SQL_Backup.ps1.0.dr
ID:	dr_65
Target ID:	0
Process:	C:\Users\user\Desktop\a2e-enterprise.26.3.3677.2903.exe
Type:	Non-ISO extended-ASCII text, with CRLF line terminators
Entropy:	5.268485089494731
Encrypted:	false
Ssdeep:	96:lPdmPEB3GsP9ELNqjkdsiY7/MyDIC4GmL2MuozftgXWefk7NawVJDQxx/vJvXW1x:b4EBWsPGNqXMyD2LPR6RYNawVpYvBE
Size:	8283
Whitelisted:	false
Reputation:	timeout

Details

File:	C:\Users\user\Desktop\a2e-enterprise.26.3.3677.2903\Setup\A2E_Setup_Details.ps1
Category:	dropped
Dump:	A2E_Setup_Details.ps1.0.dr
ID:	dr_60
Target ID:	0
Process:	C:\Users\user\Desktop\a2e-enterprise.26.3.3677.2903.exe
Type:	Non-ISO extended-ASCII text, with very long lines (485), with CRLF line terminators
Entropy:	5.1450742793043265
Encrypted:	false
Ssdeep:	384:4Xp3AzWqaGaAn6b/bSA40PeFlREGS+FUzgrfFfGroH+mLMYT+RdwKGip4fP28Ewj:yb340SlRjS+6zgLFfeoH3MYCRdbGiKfz
Size:	20181
Whitelisted:	false
Reputation:	timeout

Details

File:	C:\Users\user\Desktop\a2e-enterprise.26.3.3677.2903\Setup\Add2Outlook_Set_Granular_permissions.ps1
Category:	dropped
Dump:	Add2Outlook_Set_Granular_permissions.ps1.0.dr
ID:	dr_67
Target ID:	0
Process:	C:\Users\user\Desktop\a2e-enterprise.26.3.3677.2903.exe
Type:	Non-ISO extended-ASCII text, with very long lines (355), with CRLF line terminators
Entropy:	4.5977428899880435
Encrypted:	false
Ssdeep:	192:q4EBlX9hOegnbK4pDTfMQ2EX6LyOCXzY4pvfMmc8n6w0STq4pffMcG:EAnbK4pDTfMCuwzY4pvfMQvTq4pffMH
Size:	24006
Whitelisted:	false
Reputation:	timeout

Details

File:	C:\Users\user\Desktop\a2e-enterprise.26.3.3677.2903\Setup\Auto_Permissions_Portable\Permissions_Task_Creation.ps1
Category:	dropped
Dump:	Permissions_Task_Creation.ps1.0.dr
ID:	dr_44
Target ID:	0
Process:	C:\Users\user\Desktop\a2e-enterprise.26.3.3677.2903.exe
Type:	Non-ISO extended-ASCII text, with CRLF line terminators
Entropy:	5.243228574520891
Encrypted:	false
Ssdeep:	384:H6tXgbb7+HNlzF2lm8tPj78F2cfBF2lCUBI2F2lzRjRtF2xpF215F2NAF2kFF2G2:m0ADOPpen/Fx0j
Size:	41968
Whitelisted:	false
Reputation:	timeout

Details

File:	C:\Users\user\Desktop\a2e-enterprise.26.3.3677.2903\Setup\Auto_Permissions_Portable\Scripts\2010-2019_All_Permissions.ps1
Category:	dropped
Dump:	2010-2019_All_Permissions.ps10.0.dr
ID:	dr_47
Target ID:	0
Process:	C:\Users\user\Desktop\a2e-enterprise.26.3.3677.2903.exe
Type:	ASCII text, with CRLF line terminators
Entropy:	5.162487348740605
Encrypted:	false
Ssdeep:	48:9YmPROBka5K9X9Lz9k9TElltstjA4HcYA4Zx:qmPEBVo9X939k9TaMjYY9x
Size:	2151
Whitelisted:	false
Reputation:	timeout

Details

File:	C:\Users\user\Desktop\a2e-enterprise.26.3.3677.2903\Setup\Auto_Permissions_Portable\Scripts\2010-2019_Dist_List_Permissions.ps1
Category:	dropped
Dump:	2010-2019_Dist_List_Permissions.ps10.0.dr
ID:	dr_51
Target ID:	0
Process:	C:\Users\user\Desktop\a2e-enterprise.26.3.3677.2903.exe
Type:	ASCII text, with CRLF line terminators
Entropy:	5.230466173766324
Encrypted:	false
Ssdeep:	48:9YmPROBk6PBN9n9LT9U9TS9jY1tkD7PzNIFMGIA4H9r:qmPEBtPBN9n939U9TS9y8bS2P5r
Size:	2102
Whitelisted:	false
Reputation:	timeout

Details

File:	C:\Users\user\Desktop\a2e-enterprise.26.3.3677.2903\Setup\Auto_Permissions_Portable\Scripts\2010-2019_Dynamic_Distribution.ps1
Category:	dropped
Dump:	2010-2019_Dynamic_Distribution.ps10.0.dr
ID:	dr_55
Target ID:	0
Process:	C:\Users\user\Desktop\a2e-enterprise.26.3.3677.2903.exe
Type:	ASCII text, with CRLF line terminators
Entropy:	5.145689633354292
Encrypted:	false
Ssdeep:	48:9YmPROBk6PBN9Z9U9TZ9n9x1tkfnAH7IzYtn3BKz1w:qmPEBtPBN9Z9U9TZ9n9n57m6xKz1w
Size:	3035
Whitelisted:	false
Reputation:	timeout

Details

File:	C:\Users\user\Desktop\a2e-enterprise.26.3.3677.2903\Setup\Auto_Permissions_Portable\Scripts\Office365_All_Permissions.ps1
Category:	dropped
Dump:	Office365_All_Permissions.ps10.0.dr
ID:	dr_13
Target ID:	0
Process:	C:\Users\user\Desktop\a2e-enterprise.26.3.3677.2903.exe
Type:	Non-ISO extended-ASCII text, with CRLF line terminators
Entropy:	5.173142548372283
Encrypted:	false
Ssdeep:	48:9YmPROBk642pHCZMC/9LT9/9+EY7A4H29:qmPEBtKMC/939/9+ti9
Size:	2554
Whitelisted:	false
Reputation:	timeout

Details

File:	C:\Users\user\Desktop\a2e-enterprise.26.3.3677.2903\Setup\Auto_Permissions_Portable\Scripts\Office365_Dist_List_Permissions.ps1
Category:	dropped
Dump:	Office365_Dist_List_Permissions.ps10.0.dr
ID:	dr_16
Target ID:	0
Process:	C:\Users\user\Desktop\a2e-enterprise.26.3.3677.2903.exe
Type:	Non-ISO extended-ASCII text, with CRLF line terminators
Entropy:	5.190597884596586
Encrypted:	false
Ssdeep:	48:9YmPROBk642pHCZMC/9LT9/9+S9jYT7PzNIFMGIA4HyKx:qmPEBtKMC/939/9+S9qbS2PmKx
Size:	2772
Whitelisted:	false
Reputation:	timeout

Details

File:	C:\Users\user\Desktop\a2e-enterprise.26.3.3677.2903\Setup\Auto_Permissions_Portable\Scripts\Office365_Dynamic_Distribution.ps1
Category:	dropped
Dump:	Office365_Dynamic_Distribution.ps10.0.dr
ID:	dr_20
Target ID:	0
Process:	C:\Users\user\Desktop\a2e-enterprise.26.3.3677.2903.exe
Type:	Non-ISO extended-ASCII text, with CRLF line terminators
Entropy:	5.118368046067273
Encrypted:	false
Ssdeep:	48:9YmPROBk642pHCZMCB9/9+V9v9uYWNja7IzYtn8UQprG:qmPEBtKMCB9/9+V9v9ia7m689prG
Size:	3701
Whitelisted:	false
Reputation:	timeout

Details

File:	C:\Users\user\Desktop\a2e-enterprise.26.3.3677.2903\Setup\Auto_Permissions_Portable\Scripts\Shell_Permissions.ps1
Category:	dropped
Dump:	Shell_Permissions.ps1.0.dr
ID:	dr_63
Target ID:	0
Process:	C:\Users\user\Desktop\a2e-enterprise.26.3.3677.2903.exe
Type:	Non-ISO extended-ASCII text, with very long lines (355), with CRLF line terminators
Entropy:	4.466946069094336
Encrypted:	false
Ssdeep:	192:q4EBXL2hO9keHSowqzeZrTJN7nW9pdYkyO:2nkeHSowqCZ78YkF
Size:	35480
Whitelisted:	false
Reputation:	timeout

Details

File:	C:\Users\user\Desktop\a2e-enterprise.26.3.3677.2903\Setup\Auto_Permissions_Portable\Scripts\Stand_Alone_DyanmicDistList_Task.ps1
Category:	dropped
Dump:	Stand_Alone_DyanmicDistList_Task.ps1.0.dr
ID:	dr_83
Target ID:	0
Process:	C:\Users\user\Desktop\a2e-enterprise.26.3.3677.2903.exe
Type:	ASCII text, with CRLF line terminators
Entropy:	5.177298437958451
Encrypted:	false
Ssdeep:	24:9ELm7LR6LPk1ophAl6PoqGba5KNZDaNvmLbPXuq7Whz:9YmPROsEDFdAzuX
Size:	1182
Whitelisted:	false
Reputation:	timeout

Details

File:	C:\Users\user\Desktop\a2e-enterprise.26.3.3677.2903\Setup\Auto_Permissions_Portable\Scripts\Stand_Alone_Dynamic_Distribution_List.ps1
Category:	dropped
Dump:	Stand_Alone_Dynamic_Distribution_List.ps1.0.dr
ID:	dr_86
Target ID:	0
Process:	C:\Users\user\Desktop\a2e-enterprise.26.3.3677.2903.exe
Type:	ASCII text, with CRLF line terminators
Entropy:	5.091813731955432
Encrypted:	false
Ssdeep:	48:9YmPROBkH+yF0TveJjpnAH7IzYtn3BKzi:qmPEBl6KeJjs7m6xKzi
Size:	2376
Whitelisted:	false
Reputation:	timeout

Details

File:	C:\Users\user\Desktop\a2e-enterprise.26.3.3677.2903\Setup\Auto_Upgrade_Add2Exchange.ps1
Category:	dropped
Dump:	Auto_Upgrade_Add2Exchange.ps1.0.dr
ID:	dr_69
Target ID:	0
Process:	C:\Users\user\Desktop\a2e-enterprise.26.3.3677.2903.exe
Type:	Non-ISO extended-ASCII text, with CRLF line terminators
Entropy:	5.313134466355976
Encrypted:	false
Ssdeep:	384:XUY0O+oYiiMwqhZ6UbLPr9pNjg/vXdAZNBvOrj75bxF5HXgoco8D7zRRCOOyiD+n:z0O+oYiiMwqhZ6UbLPr9pNjg/vXdAZND
Size:	13582
Whitelisted:	false
Reputation:	timeout

Details

File:	C:\Users\user\Desktop\a2e-enterprise.26.3.3677.2903\Setup\Auto_Upgrade_Add2Outlook.ps1
Category:	dropped
Dump:	Auto_Upgrade_Add2Outlook.ps1.0.dr
ID:	dr_71
Target ID:	0
Process:	C:\Users\user\Desktop\a2e-enterprise.26.3.3677.2903.exe
Type:	ASCII text, with CRLF line terminators
Entropy:	5.235276683746445
Encrypted:	false
Ssdeep:	48:3WN3qEyse+3iL+gYmPROBkuNQloEMmotXW0muXzag4fvSSRkFWJKMZyqc0IAXzI2:3WPyPCmPEBd+aVnSRRF/ADJHofSLPw
Size:	4036
Whitelisted:	false
Reputation:	timeout

Details

File:	C:\Users\user\Desktop\a2e-enterprise.26.3.3677.2903\Setup\Auto_Upgrade_RMM.ps1
Category:	dropped
Dump:	Auto_Upgrade_RMM.ps1.0.dr
ID:	dr_73
Target ID:	0
Process:	C:\Users\user\Desktop\a2e-enterprise.26.3.3677.2903.exe
Type:	Non-ISO extended-ASCII text, with CRLF line terminators
Entropy:	5.186007695712116
Encrypted:	false
Ssdeep:	96:3BcOyaymPEBt0qBfROuEnSjc5SomkY8DP9ku7zF7GNnSnMF/AN6HofYCntdX92rc:C4EBtbf0uSSjlQY8aCa/AEHS
Size:	6201
Whitelisted:	false
Reputation:	timeout

Details

File:	C:\Users\user\Desktop\a2e-enterprise.26.3.3677.2903\Setup\Auto_Upgrade_ToolKit.ps1
Category:	dropped
Dump:	Auto_Upgrade_ToolKit.ps1.0.dr
ID:	dr_75
Target ID:	0
Process:	C:\Users\user\Desktop\a2e-enterprise.26.3.3677.2903.exe
Type:	ASCII text, with CRLF line terminators
Entropy:	5.222446959080407
Encrypted:	false
Ssdeep:	48:3WN3qEyse+3iL+gYmPROBkuNQloEMFtXWaZXzag4fvSSRkFWJkWZyqcKIAXzIy/v:3WPyPCmPEBd+qrnSlLF/AOHofKcOx
Size:	4164
Whitelisted:	false
Reputation:	timeout

Details

File:	C:\Users\user\Desktop\a2e-enterprise.26.3.3677.2903\Setup\Autologon.exe
Category:	dropped
Dump:	Autologon.exe.0.dr
ID:	dr_8
Target ID:	0
Process:	C:\Users\user\Desktop\a2e-enterprise.26.3.3677.2903.exe
Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy:	6.351883874026519
Encrypted:	false
Ssdeep:	1536:uMpeguHQeJD3z7NF0Y1g/z1EwyjcOzk954H6STYSs+sRd1cccTMTsWjcdLEs6y2S:Js5HQeh/vgLewZUFYdmJ4s6puehSE+EU
Size:	138920
Whitelisted:	false
Reputation:	timeout

Signature Hits	Behavior Group	Mitre Attack
Drops PE files	Persistence and Installation Behavior
Found dropped PE file which has not been started or loaded	Malware Analysis System Evasion

Details

File:	C:\Users\user\Desktop\a2e-enterprise.26.3.3677.2903\Setup\Bypass_AutoDiscover.ps1
Category:	dropped
Dump:	Bypass_AutoDiscover.ps1.0.dr
ID:	dr_77
Target ID:	0
Process:	C:\Users\user\Desktop\a2e-enterprise.26.3.3677.2903.exe
Type:	ASCII text, with CRLF line terminators
Entropy:	5.186434811896025
Encrypted:	false
Ssdeep:	48:ZZrFM+gYmPROsEDUX7PpQzs6PkQ8ajPpEIxPphApPp8rgn7:1MCmPEsNrhmR88hEIxhhAphsgn7
Size:	2311
Whitelisted:	false
Reputation:	timeout

Details

File:	C:\Users\user\Desktop\a2e-enterprise.26.3.3677.2903\Setup\DiditBetter_Support_Menu.ps1
Category:	dropped
Dump:	DiditBetter_Support_Menu.ps1.0.dr
ID:	dr_78
Target ID:	0
Process:	C:\Users\user\Desktop\a2e-enterprise.26.3.3677.2903.exe
Type:	ASCII text, with CRLF line terminators
Entropy:	5.094410419594323
Encrypted:	false
Ssdeep:	384:iqZEMT2lsd9y18hT2lA5h1OYYPT2lPxD49gccsWT2l1oLq6Al4nlT2lhAKrRWQb5:Dm36PZ+
Size:	36279
Whitelisted:	false
Reputation:	timeout

Details

File:	C:\Users\user\Desktop\a2e-enterprise.26.3.3677.2903\Setup\Dir_Sync.ps1
Category:	dropped
Dump:	Dir_Sync.ps1.0.dr
ID:	dr_79
Target ID:	0
Process:	C:\Users\user\Desktop\a2e-enterprise.26.3.3677.2903.exe
Type:	ISO-8859 text, with CRLF line terminators
Entropy:	5.156369223547245
Encrypted:	false
Ssdeep:	48:6X+gYmPROBku5S4uvdGeE/unqH9eD7MFszUHjLH:oCmPEBd5S4ulCunqC7MGojT
Size:	1761
Whitelisted:	false
Reputation:	timeout

Details

File:	C:\Users\user\Desktop\a2e-enterprise.26.3.3677.2903\Setup\Disable_Modern_Authentication.ps1
Category:	dropped
Dump:	Disable_Modern_Authentication.ps1.0.dr
ID:	dr_80
Target ID:	0
Process:	C:\Users\user\Desktop\a2e-enterprise.26.3.3677.2903.exe
Type:	ASCII text, with CRLF line terminators
Entropy:	5.267360743384632
Encrypted:	false
Ssdeep:	48:HrxMy4+gYmPROhE5UNleEXfEXmtXyBM9wv4DyEwDEuwDymDRn7:54CmPEh9j0mAa9WCyEKEuKy8Rn7
Size:	2643
Whitelisted:	false
Reputation:	timeout

Details

File:	C:\Users\user\Desktop\a2e-enterprise.26.3.3677.2903\Setup\Disable_Outlook_Updates.ps1
Category:	dropped
Dump:	Disable_Outlook_Updates.ps1.0.dr
ID:	dr_85
Target ID:	0
Process:	C:\Users\user\Desktop\a2e-enterprise.26.3.3677.2903.exe
Type:	ASCII text, with CRLF line terminators
Entropy:	5.198020535628352
Encrypted:	false
Ssdeep:	24:oXtLJ2+rcELm7LR6LPk1ophAl6PoPsIN4SHAts+8XToL9bGs+8XToLo/T8GnzJhz:oX2+gYmPROsEDUXr2N8XTawN8XTao/R7
Size:	1490
Whitelisted:	false
Reputation:	timeout

Details

File:	C:\Users\user\Desktop\a2e-enterprise.26.3.3677.2903\Setup\Disable_UAC.ps1
Category:	dropped
Dump:	Disable_UAC.ps1.0.dr
ID:	dr_87
Target ID:	0
Process:	C:\Users\user\Desktop\a2e-enterprise.26.3.3677.2903.exe
Type:	ASCII text, with CRLF line terminators
Entropy:	5.267747383282788
Encrypted:	false
Ssdeep:	24:SvD+ilJ2+rcELm7LR6LPk1ophAl6Po/INdWnVV6InVVodkMUSoMnrojRnz:SvD+iq+gYmPROsEDn3qOQokxSoSrox
Size:	1403
Whitelisted:	false
Reputation:	timeout

Details

File:	C:\Users\user\Desktop\a2e-enterprise.26.3.3677.2903\Setup\EXModule_dotNET_Update.ps1
Category:	dropped
Dump:	EXModule_dotNET_Update.ps1.0.dr
ID:	dr_89
Target ID:	0
Process:	C:\Users\user\Desktop\a2e-enterprise.26.3.3677.2903.exe
Type:	Non-ISO extended-ASCII text, with CRLF line terminators
Entropy:	5.181862913027437
Encrypted:	false
Ssdeep:	96:qmPEBydtczToZMpYGoYFJoYFJEvsI3GqJSPKegPB:q4EBeATpCytoEI/Yi5
Size:	4479
Whitelisted:	false
Reputation:	timeout

Details

File:	C:\Users\user\Desktop\a2e-enterprise.26.3.3677.2903\Setup\Export_ADPhoto.ps1
Category:	dropped
Dump:	Export_ADPhoto.ps1.0.dr
ID:	dr_91
Target ID:	0
Process:	C:\Users\user\Desktop\a2e-enterprise.26.3.3677.2903.exe
Type:	Non-ISO extended-ASCII text, with CRLF line terminators
Entropy:	4.9788787772328185
Encrypted:	false
Ssdeep:	96:2t3dCmPEBpeYS4o2uDqC7mILsFr/5rhrWWGrhynfxJTSyrhynVZBjqiKqdcT6lSq:ig4EBkAuBCILi1FeY75YDBjsqcTlq
Size:	5871
Whitelisted:	false
Reputation:	timeout

Details

File:	C:\Users\user\Desktop\a2e-enterprise.26.3.3677.2903\Setup\Export_License_and_Profile1.ps1
Category:	dropped
Dump:	Export_License_and_Profile1.ps1.0.dr
ID:	dr_0
Target ID:	0
Process:	C:\Users\user\Desktop\a2e-enterprise.26.3.3677.2903.exe
Type:	ISO-8859 text, with CRLF line terminators
Entropy:	5.26714723254083
Encrypted:	false
Ssdeep:	24:SFLuFOJ2+rcELm7LR6LPk1ophAl6PHPek2p8DHk2phqKhz:N+gYmPROsEDveSHH
Size:	999
Whitelisted:	false
Reputation:	timeout

Details

File:	C:\Users\user\Desktop\a2e-enterprise.26.3.3677.2903\Setup\First_Time_Installer.ps1
Category:	dropped
Dump:	First_Time_Installer.ps10.0.dr
ID:	dr_4
Target ID:	0
Process:	C:\Users\user\Desktop\a2e-enterprise.26.3.3677.2903.exe
Type:	ISO-8859 text, with CRLF line terminators
Entropy:	4.608607390064206
Encrypted:	false
Ssdeep:	192:y4EBdqrg+gCoTgFPjAJy9oWSWvncm5yJvv8WEj+WonoHEqNgr:CpCocFPSyKWdvXAJcWEtoiEq+r
Size:	17385
Whitelisted:	false
Reputation:	timeout

Details

File:	C:\Users\user\Desktop\a2e-enterprise.26.3.3677.2903\Setup\GP_Results.ps1
Category:	dropped
Dump:	GP_Results.ps1.0.dr
ID:	dr_6
Target ID:	0
Process:	C:\Users\user\Desktop\a2e-enterprise.26.3.3677.2903.exe
Type:	ASCII text, with CRLF line terminators
Entropy:	5.174877386170697
Encrypted:	false
Ssdeep:	24:YhvEJ2+rcELm7LR6Lifk1oxhAlOHoPWIN/kvjstXBGXjdmPZGkvsv/S+jyGnzJKS:YNL+gYmPROBkuNp4jstXcsDsHVjPn9
Size:	1559
Whitelisted:	false
Reputation:	timeout

Details

File:	C:\Users\user\Desktop\a2e-enterprise.26.3.3677.2903\Setup\Get_Diags.ps1
Category:	dropped
Dump:	Get_Diags.ps1.0.dr
ID:	dr_5
Target ID:	0
Process:	C:\Users\user\Desktop\a2e-enterprise.26.3.3677.2903.exe
Type:	ASCII text, with CRLF line terminators
Entropy:	5.320900192955916
Encrypted:	false
Ssdeep:	48:goN+gYmPROBkuNQtXhRvzfh305LK1019skCZ:9NCmPEBdmdmZi05m
Size:	2063
Whitelisted:	false
Reputation:	timeout

Details

File:	C:\Users\user\Desktop\a2e-enterprise.26.3.3677.2903\Setup\Legacy_PowerShell.ps1
Category:	dropped
Dump:	Legacy_PowerShell.ps1.0.dr
ID:	dr_7
Target ID:	0
Process:	C:\Users\user\Desktop\a2e-enterprise.26.3.3677.2903.exe
Type:	ASCII text, with CRLF line terminators
Entropy:	5.300027941259094
Encrypted:	false
Ssdeep:	96:YhPCmPEBdHHYXTYp8rgcr9wSEW4v2ZQwSES8ZwSEVc:R4EBdYXsirvJZ+Z8tr
Size:	4326
Whitelisted:	false
Reputation:	timeout

Details

File:	C:\Users\user\Desktop\a2e-enterprise.26.3.3677.2903\Setup\MSExchangeDelegation.ps1
Category:	dropped
Dump:	MSExchangeDelegation.ps1.0.dr
ID:	dr_11
Target ID:	0
Process:	C:\Users\user\Desktop\a2e-enterprise.26.3.3677.2903.exe
Type:	ISO-8859 text, with very long lines (321), with CRLF line terminators
Entropy:	5.146501540480007
Encrypted:	false
Ssdeep:	48:G54+gYmPROBkx9JItXiJJ5IJTS4uvdGeE/unqH9eD7rdBNR/S7ERp5rZjPnv:G54CmPEBuMW4S4ulCunqC7rDN3JZjPnv
Size:	3485
Whitelisted:	false
Reputation:	timeout

Details

File:	C:\Users\user\Desktop\a2e-enterprise.26.3.3677.2903\Setup\OSC_Disable.bat
Category:	dropped
Dump:	OSC_Disable.bat.0.dr
ID:	dr_35
Target ID:	0
Process:	C:\Users\user\Desktop\a2e-enterprise.26.3.3677.2903.exe
Type:	ASCII text, with CRLF line terminators
Entropy:	5.422414574821863
Encrypted:	false
Ssdeep:	48:qeo1e9eoxe9ZW9eIxZW9edZW5eIxZW5edXW9eIxXW9edXW5eoxXW5eaz4zF0Bnzu:qREdEZW99ZW9kZW59ZW5kXW99XW9kXWV
Size:	2735
Whitelisted:	false
Reputation:	timeout

Details

File:	C:\Users\user\Desktop\a2e-enterprise.26.3.3677.2903\Setup\Office_Updater.ps1
Category:	dropped
Dump:	Office_Updater.ps1.0.dr
ID:	dr_22
Target ID:	0
Process:	C:\Users\user\Desktop\a2e-enterprise.26.3.3677.2903.exe
Type:	ASCII text, with CRLF line terminators
Entropy:	5.145816531057854
Encrypted:	false
Ssdeep:	24:GoqapJ2+rcELm7LR6LPk1ophAl6PofINPy+27hz:GoqJ+gYmPROsEDNr2h
Size:	980
Whitelisted:	false
Reputation:	timeout

Details

File:	C:\Users\user\Desktop\a2e-enterprise.26.3.3677.2903\Setup\Outlook_Installer.ps1
Category:	dropped
Dump:	Outlook_Installer.ps10.0.dr
ID:	dr_26
Target ID:	0
Process:	C:\Users\user\Desktop\a2e-enterprise.26.3.3677.2903.exe
Type:	ASCII text, with CRLF line terminators
Entropy:	4.869041116921122
Encrypted:	false
Ssdeep:	48:fLn2wmL+a0WZPDP6MPPOb0PPGsGyk9z1585wQ5zYGLa9zOdg9zzPtvvKn3anlPIl:Sdr0WIMaMyyk9z1585wQ50GLa9zOdg9M
Size:	2265
Whitelisted:	false
Reputation:	timeout

Details

File:	C:\Users\user\Desktop\a2e-enterprise.26.3.3677.2903\Setup\Outlook_Profile_Set.ps1
Category:	dropped
Dump:	Outlook_Profile_Set.ps1.0.dr
ID:	dr_41
Target ID:	0
Process:	C:\Users\user\Desktop\a2e-enterprise.26.3.3677.2903.exe
Type:	ISO-8859 text, with CRLF line terminators
Entropy:	5.392154078265476
Encrypted:	false
Ssdeep:	384:K4Dno5fW6yyfe8sPbkZb/CzHtIf+qm/Vru1Fw4Ck8CjI8r:NDno57CzHtIf+iI8r
Size:	20832
Whitelisted:	false
Reputation:	timeout

Details

File:	C:\Users\user\Desktop\a2e-enterprise.26.3.3677.2903\Setup\Outlook_Tools_Menu.ps1
Category:	dropped
Dump:	Outlook_Tools_Menu.ps1.0.dr
ID:	dr_42
Target ID:	0
Process:	C:\Users\user\Desktop\a2e-enterprise.26.3.3677.2903.exe
Type:	ASCII text, with CRLF line terminators
Entropy:	5.151421010601781
Encrypted:	false
Ssdeep:	96:ir0WeMjI/wz9zqL29zI+9zruY9z3lB9z77u9zPdt9zuk9ze6cqW:NyE/wz9m29M+9fuY95B9H7u9zdt9Ck9U
Size:	5780
Whitelisted:	false
Reputation:	timeout

Details

File:	C:\Users\user\Desktop\a2e-enterprise.26.3.3677.2903\Setup\PermissionsOnPremOrO365Combined.ps1
Category:	dropped
Dump:	PermissionsOnPremOrO365Combined.ps1.0.dr
ID:	dr_43
Target ID:	0
Process:	C:\Users\user\Desktop\a2e-enterprise.26.3.3677.2903.exe
Type:	Non-ISO extended-ASCII text, with very long lines (355), with CRLF line terminators
Entropy:	4.4377513076022455
Encrypted:	false
Ssdeep:	192:lK4EBuL1h59kJvwqzukl6zZrTJccUV6D9pFO:lLrkJvwq3mur
Size:	37412
Whitelisted:	false
Reputation:	timeout

Details

File:	C:\Users\user\Desktop\a2e-enterprise.26.3.3677.2903\Setup\Permissions_Task_Creation.ps1
Category:	dropped
Dump:	Permissions_Task_Creation.ps10.0.dr
ID:	dr_46
Target ID:	0
Process:	C:\Users\user\Desktop\a2e-enterprise.26.3.3677.2903.exe
Type:	Non-ISO extended-ASCII text, with CRLF line terminators
Entropy:	5.249776444593379
Encrypted:	false
Ssdeep:	384:e6tXgbb7+HNlzF2lm8tPj78F2cfBF2lCUBI2F2lzRjRtF2xpF215F2NAF2kFF2Gl:N0ADYsXQZxfnaL
Size:	43490
Whitelisted:	false
Reputation:	timeout

Details

File:	C:\Users\user\Desktop\a2e-enterprise.26.3.3677.2903\Setup\Post_A2E_Migration.ps1
Category:	dropped
Dump:	Post_A2E_Migration.ps1.0.dr
ID:	dr_48
Target ID:	0
Process:	C:\Users\user\Desktop\a2e-enterprise.26.3.3677.2903.exe
Type:	ISO-8859 text, with CRLF line terminators
Entropy:	4.744374547827754
Encrypted:	false
Ssdeep:	192:8sY4EBfPE0BYmSABMdKJX4hBdmSATMFKJXQu:8hPjBDSABMmohBsSATM+V
Size:	8346
Whitelisted:	false
Reputation:	timeout

Details

File:	C:\Users\user\Desktop\a2e-enterprise.26.3.3677.2903\Setup\Public _Folder_to_Address_Book.vbs
Category:	dropped
Dump:	Public _Folder_to_Address_Book.vbs.0.dr
ID:	dr_21
Target ID:	0
Process:	C:\Users\user\Desktop\a2e-enterprise.26.3.3677.2903.exe
Type:	ASCII text, with CRLF line terminators
Entropy:	5.030279585044127
Encrypted:	false
Ssdeep:	3:TQ9h+rOtcN+m87REKOLEBYMQsNjD/vzTKOtUDATrBAHiLlEQuUIE7UybfrQuFYL8:kgScNPcRjOcjrKuuAT7JUcEDLXs
Size:	268
Whitelisted:	false
Reputation:	timeout

Details

File:	C:\Users\user\Desktop\a2e-enterprise.26.3.3677.2903\Setup\REARM_Office.ps1
Category:	dropped
Dump:	REARM_Office.ps1.0.dr
ID:	dr_50
Target ID:	0
Process:	C:\Users\user\Desktop\a2e-enterprise.26.3.3677.2903.exe
Type:	ASCII text, with CRLF line terminators
Entropy:	5.304265312379865
Encrypted:	false
Ssdeep:	24:f8NLJ2+rcELm7LR6LPk1ophAl6PoP6+8P5o1FDO+p+utP5o14DIzChz:f8G+gYmPROsEDUP8P5wDsoP5wBz6
Size:	1386
Whitelisted:	false
Reputation:	timeout

Details

File:	C:\Users\user\Desktop\a2e-enterprise.26.3.3677.2903\Setup\Registry_Favorites.ps1
Category:	dropped
Dump:	Registry_Favorites.ps1.0.dr
ID:	dr_52
Target ID:	0
Process:	C:\Users\user\Desktop\a2e-enterprise.26.3.3677.2903.exe
Type:	ISO-8859 text, with very long lines (342), with CRLF line terminators
Entropy:	5.260436401478338
Encrypted:	false
Ssdeep:	48:P+gYmPROBzBr2gjUkIxUYEwoU+YUf8UIDU8kUvIkUb/UzIp0sUBIMUcVIXW9ev6r:PCmPEBUhbC7kqNf8tQtbc8cCl7XW90jw
Size:	4433
Whitelisted:	false
Reputation:	timeout

Details

File:	C:\Users\user\Desktop\a2e-enterprise.26.3.3677.2903\Setup\Reset_A2E_Password.ps1
Category:	dropped
Dump:	Reset_A2E_Password.ps1.0.dr
ID:	dr_54
Target ID:	0
Process:	C:\Users\user\Desktop\a2e-enterprise.26.3.3677.2903.exe
Type:	ISO-8859 text, with CRLF line terminators
Entropy:	5.178124013506394
Encrypted:	false
Ssdeep:	24:kDbM731MpW/J2+rcELm7LR6Lifk1oxhAlOHoPhd1sEVTIs08mCDdK6CDfsZdxV2j:R3u7+gYmPROBkuzX0gCA7Bz7MH
Size:	1776
Whitelisted:	false
Reputation:	timeout

Details

File:	C:\Users\user\Desktop\a2e-enterprise.26.3.3677.2903\Setup\SQL_Firewall_Rules.ps1
Category:	dropped
Dump:	SQL_Firewall_Rules.ps1.0.dr
ID:	dr_81
Target ID:	0
Process:	C:\Users\user\Desktop\a2e-enterprise.26.3.3677.2903.exe
Type:	ASCII text, with CRLF line terminators
Entropy:	4.59062346175513
Encrypted:	false
Ssdeep:	96:P8CmPEBdMt4IEYcrjJ+YALRqHALzPAFRqHAFZPn7:74EBdnIEYcrjUBR7zWR1B7
Size:	6339
Whitelisted:	false
Reputation:	timeout

Details

File:	C:\Users\user\Desktop\a2e-enterprise.26.3.3677.2903\Setup\SQL_Upgrade_Files\SQL12x_to_SQL12xSP4.ps1
Category:	dropped
Dump:	SQL12x_to_SQL12xSP4.ps1.0.dr
ID:	dr_66
Target ID:	0
Process:	C:\Users\user\Desktop\a2e-enterprise.26.3.3677.2903.exe
Type:	ISO-8859 text, with CRLF line terminators
Entropy:	5.221084649519329
Encrypted:	false
Ssdeep:	192:9HhM4EDNMCCmdjMVpDlSczf3cTxEa6gF1Xhx:92MXmhgpDMiIEaX
Size:	6945
Whitelisted:	false
Reputation:	timeout

Details

File:	C:\Users\user\Desktop\a2e-enterprise.26.3.3677.2903\Setup\SQL_Upgrade_Files\SQL12x_to_SQL22x.ps1
Category:	dropped
Dump:	SQL12x_to_SQL22x.ps1.0.dr
ID:	dr_68
Target ID:	0
Process:	C:\Users\user\Desktop\a2e-enterprise.26.3.3677.2903.exe
Type:	ISO-8859 text, with CRLF line terminators
Entropy:	5.2561277625098555
Encrypted:	false
Ssdeep:	192:+1IBq4EDNQdTMVpDQSczW3ZT/HuHpy+tSLdcSJ3aWGpXrjBZo2ClUoI76v:+1QxgpDli0td5+VRZpClUJ76v
Size:	13337
Whitelisted:	false
Reputation:	timeout

Details

File:	C:\Users\user\Desktop\a2e-enterprise.26.3.3677.2903\Setup\SQL_Upgrade_Files\SQL17x_to_SQL22x.ps1
Category:	dropped
Dump:	SQL17x_to_SQL22x.ps1.0.dr
ID:	dr_70
Target ID:	0
Process:	C:\Users\user\Desktop\a2e-enterprise.26.3.3677.2903.exe
Type:	ISO-8859 text, with CRLF line terminators
Entropy:	5.206034581692453
Encrypted:	false
Ssdeep:	192:EAtc0q4EDNYC6djMVpDiSczf3XT/pgFyNc0q:EAi3h6hgpDbijql
Size:	6918
Whitelisted:	false
Reputation:	timeout

Details

File:	C:\Users\user\Desktop\a2e-enterprise.26.3.3677.2903\Setup\SQL_Upgrade_Files\SQL8x_to_SQL12x.ps1
Category:	dropped
Dump:	SQL8x_to_SQL12x.ps1.0.dr
ID:	dr_72
Target ID:	0
Process:	C:\Users\user\Desktop\a2e-enterprise.26.3.3677.2903.exe
Type:	ISO-8859 text, with CRLF line terminators
Entropy:	5.246944638572133
Encrypted:	false
Ssdeep:	192:pHTM4EDdskCPdjMVpDQSczf3cTxEa6gFiXTo:pIsNPhgpDliIEav
Size:	6880
Whitelisted:	false
Reputation:	timeout

Details

File:	C:\Users\user\Desktop\a2e-enterprise.26.3.3677.2903\Setup\SQL_Upgrade_Files\SQL8x_to_SQL8xSP4.ps1
Category:	dropped
Dump:	SQL8x_to_SQL8xSP4.ps1.0.dr
ID:	dr_74
Target ID:	0
Process:	C:\Users\user\Desktop\a2e-enterprise.26.3.3677.2903.exe
Type:	ISO-8859 text, with CRLF line terminators
Entropy:	5.271716332455319
Encrypted:	false
Ssdeep:	192:SmCd4EDd9yCGdjMVpD5SczW3bTR79IgFJXC/:StBGhgpDAiT
Size:	6869
Whitelisted:	false
Reputation:	timeout

Details

File:	C:\Users\user\Desktop\a2e-enterprise.26.3.3677.2903\Setup\SQL_Upgrade_Files\SQLExpress_Main_2022_Upgrade.ps1
Category:	dropped
Dump:	SQLExpress_Main_2022_Upgrade.ps1.0.dr
ID:	dr_76
Target ID:	0
Process:	C:\Users\user\Desktop\a2e-enterprise.26.3.3677.2903.exe
Type:	ISO-8859 text, with CRLF line terminators
Entropy:	5.151791839049951
Encrypted:	false
Ssdeep:	192:5icEOrSM54EBd7MCpNOvO07BBkNOh50LspMzxaSa9/Oz0/Xu/yc0/W5/G3p:wnYDNmnH5qPoyU
Size:	10147
Whitelisted:	false
Reputation:	timeout

Details

File:	C:\Users\user\Desktop\a2e-enterprise.26.3.3677.2903\Setup\SQL_Upgrade_Files\SQL_Management_Studio_Quiet_Install.ps1
Category:	dropped
Dump:	SQL_Management_Studio_Quiet_Install.ps1.0.dr
ID:	dr_82
Target ID:	0
Process:	C:\Users\user\Desktop\a2e-enterprise.26.3.3677.2903.exe
Type:	ASCII text, with CRLF line terminators
Entropy:	5.120422215233596
Encrypted:	false
Ssdeep:	48:4WM+YmPROBkuXjXzag4fvSf8/kyb0X/x3EpWoDLgmtQ7+7lt0c/EqzCwZu4M:7MlmPEBdznf8cyb0GtLgwQ7+7liPt
Size:	3008
Whitelisted:	false
Reputation:	timeout

Details

File:	C:\Users\user\Desktop\a2e-enterprise.26.3.3677.2903\Setup\Scheduled_Update_Add2Exchange.ps1
Category:	dropped
Dump:	Scheduled_Update_Add2Exchange.ps1.0.dr
ID:	dr_56
Target ID:	0
Process:	C:\Users\user\Desktop\a2e-enterprise.26.3.3677.2903.exe
Type:	ISO-8859 text, with CRLF line terminators
Entropy:	5.235810758535446
Encrypted:	false
Ssdeep:	96:aUKXYYmPEBhJ77gEmYBF/A54HofObcV7755JG9ZZ07xz0aDQrQ:hY4EBhJzf/A6HHAt0rQ
Size:	6631
Whitelisted:	false
Reputation:	timeout

Details

File:	C:\Users\user\Desktop\a2e-enterprise.26.3.3677.2903\Setup\Setup Files\Office365_Pro_Retailx64_Configuration.xml
Category:	dropped
Dump:	Office365_Pro_Retailx64_Configuration.xml.0.dr
ID:	dr_15
Target ID:	0
Process:	C:\Users\user\Desktop\a2e-enterprise.26.3.3677.2903.exe
Type:	ASCII text, with CRLF line terminators
Entropy:	5.202613438368244
Encrypted:	false
Ssdeep:	24:OkfEslTC6jycWuLcWlfAcWiLcWbFS8httxkB:9fE+e6jyctLcrcjLcqDDtyB
Size:	1023
Whitelisted:	false
Reputation:	timeout

Details

File:	C:\Users\user\Desktop\a2e-enterprise.26.3.3677.2903\Setup\Setup Files\Office365_Pro_Retailx86_Configuration.xml
Category:	dropped
Dump:	Office365_Pro_Retailx86_Configuration.xml0.0.dr
ID:	dr_19
Target ID:	0
Process:	C:\Users\user\Desktop\a2e-enterprise.26.3.3677.2903.exe
Type:	ASCII text, with CRLF line terminators
Entropy:	5.2041868894674
Encrypted:	false
Ssdeep:	24:OTfEslTC6jycWuLcWlfAcWiLcWbFS8httxkB:ufE+e6jyctLcrcjLcqDDtyB
Size:	1023
Whitelisted:	false
Reputation:	timeout

Details

File:	C:\Users\user\Desktop\a2e-enterprise.26.3.3677.2903\Setup\Setup Files\Pro_Retailx64.cmd
Category:	dropped
Dump:	Pro_Retailx64.cmd0.0.dr
ID:	dr_37
Target ID:	0
Process:	C:\Users\user\Desktop\a2e-enterprise.26.3.3677.2903.exe
Type:	ASCII text, with no line terminators
Entropy:	4.572765012132931
Encrypted:	false
Ssdeep:	3:Pg4QQ6/QIK6Wde8UMeKJ:PVQQFKWlU2
Size:	62
Whitelisted:	false
Reputation:	timeout

Details

File:	C:\Users\user\Desktop\a2e-enterprise.26.3.3677.2903\Setup\Setup Files\Pro_Retailx86.cmd
Category:	dropped
Dump:	Pro_Retailx86.cmd0.0.dr
ID:	dr_39
Target ID:	0
Process:	C:\Users\user\Desktop\a2e-enterprise.26.3.3677.2903.exe
Type:	ASCII text, with no line terminators
Entropy:	4.572765012132931
Encrypted:	false
Ssdeep:	3:Pg4QQ6/QIK6WdoMeKJ:PVQQFKWi2
Size:	62
Whitelisted:	false
Reputation:	timeout

Details

File:	C:\Users\user\Desktop\a2e-enterprise.26.3.3677.2903\Setup\Setup Files\setup.exe
Category:	dropped
Dump:	setup.exe0.0.dr
ID:	dr_10
Target ID:	0
Process:	C:\Users\user\Desktop\a2e-enterprise.26.3.3677.2903.exe
Type:	PE32 executable (console) Intel 80386, for MS Windows
Entropy:	6.649944627880774
Encrypted:	false
Ssdeep:	98304:vqihTvjtEh2N5LQhyddG4THBZoJG3QBMxvble/bsTwY2h3:TpvE8dgq3oJG3QBMxBlW3
Size:	5169440
Whitelisted:	false
Reputation:	timeout

Signature Hits	Behavior Group	Mitre Attack
Drops PE files	Persistence and Installation Behavior
Found dropped PE file which has not been started or loaded	Malware Analysis System Evasion

Details

File:	C:\Users\user\Desktop\a2e-enterprise.26.3.3677.2903\Setup\Shell_Into_Exchange.ps1
Category:	dropped
Dump:	Shell_Into_Exchange.ps1.0.dr
ID:	dr_62
Target ID:	0
Process:	C:\Users\user\Desktop\a2e-enterprise.26.3.3677.2903.exe
Type:	Non-ISO extended-ASCII text, with CRLF line terminators
Entropy:	4.675718132414485
Encrypted:	false
Ssdeep:	96:iCmPEBdzcsNZg5MVzQWgM4cRpPOY6WIQK84cRpfOY6Wi:54EBdQshqkl6fUV65
Size:	7051
Whitelisted:	false
Reputation:	timeout

Details

File:	C:\Users\user\Desktop\a2e-enterprise.26.3.3677.2903\Setup\Shell_Permissions.ps1
Category:	dropped
Dump:	Shell_Permissions.ps10.0.dr
ID:	dr_64
Target ID:	0
Process:	C:\Users\user\Desktop\a2e-enterprise.26.3.3677.2903.exe
Type:	Non-ISO extended-ASCII text, with very long lines (355), with CRLF line terminators
Entropy:	4.503630667237573
Encrypted:	false
Ssdeep:	192:zo4EBdHRhO9keHSowqzSZrTJN7nd9pdYkyO:EIkeHSowqGZ7PYkF
Size:	36559
Whitelisted:	false
Reputation:	timeout

Details

File:	C:\Users\user\Desktop\a2e-enterprise.26.3.3677.2903\Setup\Timed Permissions\2010-2019_All_Permissions.ps1
Category:	dropped
Dump:	2010-2019_All_Permissions.ps1.0.dr
ID:	dr_45
Target ID:	0
Process:	C:\Users\user\Desktop\a2e-enterprise.26.3.3677.2903.exe
Type:	ASCII text, with CRLF line terminators
Entropy:	5.206475437016567
Encrypted:	false
Ssdeep:	48:9YmPROBkaheuGuLiuZuTElltsEjA4HcYA4Zx:qmPEBV7JpoTaJjYY9x
Size:	2313
Whitelisted:	false
Reputation:	timeout

Details

File:	C:\Users\user\Desktop\a2e-enterprise.26.3.3677.2903\Setup\Timed Permissions\2010-2019_Dist_List_Permissions.ps1
Category:	dropped
Dump:	2010-2019_Dist_List_Permissions.ps1.0.dr
ID:	dr_49
Target ID:	0
Process:	C:\Users\user\Desktop\a2e-enterprise.26.3.3677.2903.exe
Type:	ASCII text, with CRLF line terminators
Entropy:	5.27046054524564
Encrypted:	false
Ssdeep:	48:9YmPROBk6PYUuWuLCuJuTnujY1tkD7PzNIFMGIA4H9r:qmPEBtPYX5p4Tuy8bS2P5r
Size:	2309
Whitelisted:	false
Reputation:	timeout

Details

File:	C:\Users\user\Desktop\a2e-enterprise.26.3.3677.2903\Setup\Timed Permissions\2010-2019_Dynamic_Distribution.ps1
Category:	dropped
Dump:	2010-2019_Dynamic_Distribution.ps1.0.dr
ID:	dr_53
Target ID:	0
Process:	C:\Users\user\Desktop\a2e-enterprise.26.3.3677.2903.exe
Type:	ASCII text, with CRLF line terminators
Entropy:	5.184235576844559
Encrypted:	false
Ssdeep:	48:9YmPROBk6PYUuguJuTguWux1tkfnAH7IzYtn3BKz1w:qmPEBtPYXD4TD5n57m6xKz1w
Size:	3242
Whitelisted:	false
Reputation:	timeout

Details

File:	C:\Users\user\Desktop\a2e-enterprise.26.3.3677.2903\Setup\Timed Permissions\Office365_All_Permissions.ps1
Category:	dropped
Dump:	Office365_All_Permissions.ps1.0.dr
ID:	dr_12
Target ID:	0
Process:	C:\Users\user\Desktop\a2e-enterprise.26.3.3677.2903.exe
Type:	Non-ISO extended-ASCII text, with CRLF line terminators
Entropy:	5.206204413905134
Encrypted:	false
Ssdeep:	48:9YmPROBk642pHCZMTruLCuuu+EY7A4H29:qmPEBtKMTipx+ti9
Size:	2681
Whitelisted:	false
Reputation:	timeout

Details

File:	C:\Users\user\Desktop\a2e-enterprise.26.3.3677.2903\Setup\Timed Permissions\Office365_Dist_List_Permissions.ps1
Category:	dropped
Dump:	Office365_Dist_List_Permissions.ps1.0.dr
ID:	dr_14
Target ID:	0
Process:	C:\Users\user\Desktop\a2e-enterprise.26.3.3677.2903.exe
Type:	Non-ISO extended-ASCII text, with CRLF line terminators
Entropy:	5.226696749733595
Encrypted:	false
Ssdeep:	48:9YmPROBk642pHCZMCruLCuuu+nujYs7PzNIFMGIA4HyKx:qmPEBtKMCipx+u9bS2PmKx
Size:	2936
Whitelisted:	false
Reputation:	timeout

Details

File:	C:\Users\user\Desktop\a2e-enterprise.26.3.3677.2903\Setup\Timed Permissions\Office365_Dynamic_Distribution.ps1
Category:	dropped
Dump:	Office365_Dynamic_Distribution.ps1.0.dr
ID:	dr_18
Target ID:	0
Process:	C:\Users\user\Desktop\a2e-enterprise.26.3.3677.2903.exe
Type:	Non-ISO extended-ASCII text, with CRLF line terminators
Entropy:	5.150671684787593
Encrypted:	false
Ssdeep:	48:9YmPROBk642pHCZMCpuuu+8ueuuYWNja7IzYtn8UQprG:qmPEBtKMCYx+fBia7m689prG
Size:	3867
Whitelisted:	false
Reputation:	timeout

Details

File:	C:\Users\user\Desktop\a2e-enterprise.26.3.3677.2903\Setup\Timed Permissions\Stand_Alone_DyanmicDistList_Task.ps1
Category:	dropped
Dump:	Stand_Alone_DyanmicDistList_Task.ps10.0.dr
ID:	dr_84
Target ID:	0
Process:	C:\Users\user\Desktop\a2e-enterprise.26.3.3677.2903.exe
Type:	ASCII text, with CRLF line terminators
Entropy:	5.177298437958451
Encrypted:	false
Ssdeep:	24:9ELm7LR6LPk1ophAl6PoqGba5KNZDaNvmLbPXuq7Whz:9YmPROsEDFdAzuX
Size:	1182
Whitelisted:	false
Reputation:	timeout

Details

File:	C:\Users\user\Desktop\a2e-enterprise.26.3.3677.2903\Setup\Timed Permissions\Stand_Alone_Dynamic_Distribution_List.ps1
Category:	dropped
Dump:	Stand_Alone_Dynamic_Distribution_List.ps10.0.dr
ID:	dr_88
Target ID:	0
Process:	C:\Users\user\Desktop\a2e-enterprise.26.3.3677.2903.exe
Type:	ASCII text, with CRLF line terminators
Entropy:	5.091813731955432
Encrypted:	false
Ssdeep:	48:9YmPROBkH+yF0TveJjpnAH7IzYtn3BKzi:qmPEBl6KeJjs7m6xKzi
Size:	2376
Whitelisted:	false
Reputation:	timeout

Details

File:	C:\Users\user\Desktop\a2e-enterprise.26.3.3677.2903\Setup\Timed_A2E_SQL_Backup.ps1
Category:	dropped
Dump:	Timed_A2E_SQL_Backup.ps1.0.dr
ID:	dr_90
Target ID:	0
Process:	C:\Users\user\Desktop\a2e-enterprise.26.3.3677.2903.exe
Type:	Non-ISO extended-ASCII text, with CRLF line terminators
Entropy:	5.198975556588784
Encrypted:	false
Ssdeep:	48:o+gYmPROBkuU69eKr3IHvD5AMgihSKD6dgmdW7CXdWCnvlCVg7SCjSpcMQJtI6oT:oCmPEBdUGwvsiL7FC4GmL2MuozKtG
Size:	4303
Whitelisted:	false
Reputation:	timeout

Details

File:	C:\Users\user\Desktop\a2e-enterprise.26.3.3677.2903\Setup\Windows_Defender_Exclusions.ps1
Category:	dropped
Dump:	Windows_Defender_Exclusions.ps1.0.dr
ID:	dr_92
Target ID:	0
Process:	C:\Users\user\Desktop\a2e-enterprise.26.3.3677.2903.exe
Type:	ISO-8859 text, with CRLF line terminators
Entropy:	5.2554300122995485
Encrypted:	false
Ssdeep:	48:wIi8k8z+N+8Y8zK+gYmPROhE5N/ZVgo9ei2COW818zW1NR8t8zf/xcXWH9enxoSa:halKCmPEhgVJAhfYxoSroz
Size:	2815
Whitelisted:	false
Reputation:	timeout

Details

File:	C:\Users\user\Desktop\a2e-enterprise.26.3.3677.2903\Setup\shell.ps1
Category:	dropped
Dump:	shell.ps1.0.dr
ID:	dr_61
Target ID:	0
Process:	C:\Users\user\Desktop\a2e-enterprise.26.3.3677.2903.exe
Type:	ASCII text, with CRLF line terminators
Entropy:	5.003777918597954
Encrypted:	false
Ssdeep:	24:V5U4J2+rcELm7LR6LPk1ophAl6PoPhjJyFhNxT:7E+gYmPROsEDUJs5
Size:	786
Whitelisted:	false
Reputation:	timeout

Details

File:	C:\Users\user\Desktop\a2e-enterprise.26.3.3677.2903\Tools\Logging\gollevel.xtx
Category:	dropped
Dump:	gollevel.xtx.0.dr
ID:	dr_3
Target ID:	0
Process:	C:\Users\user\Desktop\a2e-enterprise.26.3.3677.2903.exe
Type:	ASCII text, with no line terminators
Entropy:	2.75
Encrypted:	false
Ssdeep:	3:xJ8n:xun
Size:	8
Whitelisted:	false
Reputation:	timeout

Details

File:	C:\Users\user\Desktop\a2e-enterprise.26.3.3677.2903\Tools\Mapi\ExchangeMapiCdo.MSI
Category:	dropped
Dump:	ExchangeMapiCdo.MSI.0.dr
ID:	dr_34
Target ID:	0
Process:	C:\Users\user\Desktop\a2e-enterprise.26.3.3677.2903.exe
Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.2, MSI Installer, Code page: 1252, Title: Installation Database, Subject: Messaging API and Collaboration Data Objects 1.2.1 v6.5.8320.0, Author: Microsoft, Keywords: Installer, Template: Intel;1033, Revision Number: {EB06CAF7-FF9E-4e70-B2DC-20D0B3E4A188}, Create Time/Date: Mon Apr 29 10:13:53 2013, Last Saved Time/Date: Mon Apr 29 10:13:53 2013, Number of Pages: 200, Number of Words: 2, Name of Creating Application: Windows Installer XML (candle/light), Security: 1
Entropy:	6.968260863030964
Encrypted:	false
Ssdeep:	49152:Ozi7eSMsESiOtGc5DUNmj6lpDrfb0YZUafrtxjkkwuh+GQGY:tllElIGcyNy6lpDrfQYZ7Bxj1wpGQ
Size:	3569152
Whitelisted:	false
Reputation:	timeout

Details

File:	C:\Users\user\Desktop\a2e-enterprise.26.3.3677.2903\Tools\OutlookTools\Autodiscover\365autodiscoverOutlook13.reg
Category:	dropped
Dump:	365autodiscoverOutlook13.reg.0.dr
ID:	dr_23
Target ID:	0
Process:	C:\Users\user\Desktop\a2e-enterprise.26.3.3677.2903.exe
Type:	Windows Registry text (Win2K or above)
Entropy:	5.200084512777063
Encrypted:	false
Ssdeep:	12:jBJ0SK0Z83rQbDIYLRfRRfJ/bjr83rQrKfAsGKMAsk8dAskKPysAskKObsAsOKPK:jBJtZ8bQbDv7P78bQrKf1S1ki1kKf1kT
Size:	673
Whitelisted:	false
Reputation:	timeout

Details

File:	C:\Users\user\Desktop\a2e-enterprise.26.3.3677.2903\Tools\OutlookTools\Autodiscover\365autodiscoverOutlook16.reg
Category:	dropped
Dump:	365autodiscoverOutlook16.reg.0.dr
ID:	dr_25
Target ID:	0
Process:	C:\Users\user\Desktop\a2e-enterprise.26.3.3677.2903.exe
Type:	Windows Registry text (Win2K or above)
Entropy:	5.201934605641604
Encrypted:	false
Ssdeep:	12:jBJ0SK0Z8PbDIYLRfRRfJ/bjr8PrKfAsGKMAsk8dAskKPysAskKObsAsOKPAv:jBJtZ8PbDv7P78PrKf1S1ki1kKf1kKY1
Size:	673
Whitelisted:	false
Reputation:	timeout

Details

File:	\Device\ConDrv
Category:	dropped
Dump:	ConDrv.0.dr
ID:	dr_31
Target ID:	0
Process:	C:\Users\user\Desktop\a2e-enterprise.26.3.3677.2903.exe
Type:	ASCII text, with CRLF line terminators
Entropy:	5.090114603797306
Encrypted:	false
Ssdeep:	96:e5JV1qFpLMKTjVEQqoheUe68AX313tBA73pAC6kvDDM:edQqoheFOIbQ
Size:	9011
Whitelisted:	false
Reputation:	timeout

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

IOC Report
a2e-enterprise.26.3.3677.2903.exe

Files

Processes

URLs

Memdumps

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

IOC Reporta2e-enterprise.26.3.3677.2903.exe

Files

Processes

URLs

Memdumps

IOC Report
a2e-enterprise.26.3.3677.2903.exe