Analysis
- max time kernel
149s - max time network
95s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
- submitted
05/06/2026, 22:29
General
- Target 2026-06-05_4df76d35174c926faefb0eab37d13e31_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
- Size 5.8MB
- Sample260605-2eav6aew3s
- SHA256 195a86f43041bcee7245aed024d5e6508cf8e63e692cec17219574e3ae5eaaf5
Malware Config
Signatures
- Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
- Obfuscated Files or Information: Command Obfuscation 1 TTPs
Adversaries may obfuscate content during command execution to impede detection.
- Drops file in Program Files directory 1 IoCs
- Interacts with shadow copies 3 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
- Suspicious behavior: EnumeratesProcesses 8 IoCs
- Suspicious use of AdjustPrivilegeToken 5 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-06-05_4df76d35174c926faefb0eab37d13e31_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe"C:\Users\Admin\AppData\Local\Temp\2026-06-05_4df76d35174c926faefb0eab37d13e31_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe"1⤵
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks /query /tn MicrosoftEdgeUpdateChastity2⤵
-
-
C:\Windows\system32\reg.exereg query "HKCU\Control Panel\Desktop" /v Wallpaper2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -EncodedCommand JABhAD0AIgBBACIAKwAiAGQAIgArACIAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACIAOwAgACYAIAAkAGEAIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAYQB0AGgAIAAnAEMAOgBcACcA2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -EncodedCommand JABhAD0AIgBBACIAKwAiAGQAIgArACIAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACIAOwAgACYAIAAkAGEAIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAYQB0AGgAIAAnAEYAOgBcACcA2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\vssadmin.exevssadmin.exe Delete Shadows /All /Quiet2⤵
- Interacts with shadow copies
-
-
C:\Windows\system32\schtasks.exeschtasks /query /tn MicrosoftEdgeUpdateChastity2⤵
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
powershell.exe.log
StartupProfileData-NonInteractive
__PSScriptPolicyTest_egegditu.uqn.ps1
memory/1176-20-0x0000018A261B0000-0x0000018A261BA000-memory.dmp
memory/1176-22-0x0000018A261C0000-0x0000018A261CA000-memory.dmp
memory/1176-17-0x00007FF4188B0000-0x00007FF4188C0000-memory.dmp
memory/1176-18-0x0000018A260B0000-0x0000018A260CC000-memory.dmp
memory/1176-19-0x0000018A260D0000-0x0000018A26183000-memory.dmp
memory/1176-2-0x0000018A23EE0000-0x0000018A23EF0000-memory.dmp
memory/1176-21-0x0000018A261E0000-0x0000018A261FC000-memory.dmp
memory/1176-10-0x0000018A23EE0000-0x0000018A23EF0000-memory.dmp
memory/1176-23-0x0000018A26590000-0x0000018A265AA000-memory.dmp
memory/1176-24-0x0000018A261D0000-0x0000018A261D8000-memory.dmp
memory/1176-25-0x0000018A26200000-0x0000018A26206000-memory.dmp
memory/1176-26-0x0000018A26210000-0x0000018A2621A000-memory.dmp
memory/1176-27-0x0000018A23EE0000-0x0000018A23EF0000-memory.dmp
memory/1176-8-0x0000018A0A6E0000-0x0000018A0A702000-memory.dmp
memory/1176-1-0x0000018A23EE0000-0x0000018A23EF0000-memory.dmp