7256d0e5500f4626c08a9f1a4e5b7ab8727c6867d3ec22f5c40d1bd537d3c211

Analysis

max time kernel
150s
max time network
144s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260618-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260618-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
28/06/2026, 18:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-28_db1354379c220276c102132352348c4b_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
Size 9.7MB
Sample260628-xaeakacs7p
SHA256 7256d0e5500f4626c08a9f1a4e5b7ab8727c6867d3ec22f5c40d1bd537d3c211
MD5 db1354379c220276c102132352348c4b
SHA1 e2bd72e0a4dc4db81f0fa8285d9f073bb5b1be6b
SHA512 76dc153c9ce04de1b9543fc41bccd075715e39978034521d5e98bee3c09d5039cd3a0259bfb140a54393df9ee6520af35321534a56e84742dcc69ff77f3b35b1
SSDEEP 98304:ZALq82Qiz0ZOGCGkGvamwSR7EepBJ+0FKysMpF3rQT:ZifvhISeuq0FLpFI
TLSH
T156A66B43EC6514E9C1AD9235C9B386437BB1BC490B3267D32BA0B2387E76BD46DB9314
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery execution persistence spyware stealer

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
4576	powershell.exe
3508	powershell.exe

Executes dropped EXE 2 IoCs

pid	Process
1900	Microsoft.exe
2944	Microsoft.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2894455325-857903158-4263030270-1000\Software\Microsoft\Windows\CurrentVersion\Run\LabLoadAgent = "\"C:\\ProgramData\\Microsoft\\Microsoft.exe\""	reg.exe

Enumerates processes with tasklist 1 TTPs 1 IoCs

discovery

Process Discovery

T1057

pid	Process
2780	tasklist.exe

Hide Artifacts: Ignore Process Interrupts 1 TTPs 9 IoCs

Command interpreters often include specific commands/flags that ignore errors and other hangups.

defense_evasion

Ignore Process Interrupts

T1564.011

pid	Process
4668	powershell.exe
1568	powershell.exe
2528	powershell.exe
804	powershell.exe
3100	powershell.exe
4876	powershell.exe
1268	powershell.exe
436	powershell.exe
3888	powershell.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry

T1112

pid	Process
5588	reg.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1200	schtasks.exe
5396	schtasks.exe

Suspicious behavior: EnumeratesProcesses 26 IoCs

pid	Process
4576	powershell.exe
4576	powershell.exe
3508	powershell.exe
3508	powershell.exe
3888	powershell.exe
3888	powershell.exe
804	powershell.exe
804	powershell.exe
4668	powershell.exe
4668	powershell.exe
1568	powershell.exe
1568	powershell.exe
1568	powershell.exe
3100	powershell.exe
3100	powershell.exe
3100	powershell.exe
4876	powershell.exe
4876	powershell.exe
4876	powershell.exe
1268	powershell.exe
1268	powershell.exe
1268	powershell.exe
436	powershell.exe
436	powershell.exe
2528	powershell.exe
2528	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4576	powershell.exe
Token: SeIncreaseQuotaPrivilege	4576	powershell.exe
Token: SeSecurityPrivilege	4576	powershell.exe
Token: SeTakeOwnershipPrivilege	4576	powershell.exe
Token: SeLoadDriverPrivilege	4576	powershell.exe
Token: SeSystemProfilePrivilege	4576	powershell.exe
Token: SeSystemtimePrivilege	4576	powershell.exe
Token: SeProfSingleProcessPrivilege	4576	powershell.exe
Token: SeIncBasePriorityPrivilege	4576	powershell.exe
Token: SeCreatePagefilePrivilege	4576	powershell.exe
Token: SeBackupPrivilege	4576	powershell.exe
Token: SeRestorePrivilege	4576	powershell.exe
Token: SeShutdownPrivilege	4576	powershell.exe
Token: SeDebugPrivilege	4576	powershell.exe
Token: SeSystemEnvironmentPrivilege	4576	powershell.exe
Token: SeRemoteShutdownPrivilege	4576	powershell.exe
Token: SeUndockPrivilege	4576	powershell.exe
Token: SeManageVolumePrivilege	4576	powershell.exe
Token: 33	4576	powershell.exe
Token: 34	4576	powershell.exe
Token: 35	4576	powershell.exe
Token: 36	4576	powershell.exe
Token: SeDebugPrivilege	2780	tasklist.exe
Token: SeDebugPrivilege	3508	powershell.exe
Token: SeIncreaseQuotaPrivilege	3508	powershell.exe
Token: SeSecurityPrivilege	3508	powershell.exe
Token: SeTakeOwnershipPrivilege	3508	powershell.exe
Token: SeLoadDriverPrivilege	3508	powershell.exe
Token: SeSystemProfilePrivilege	3508	powershell.exe
Token: SeSystemtimePrivilege	3508	powershell.exe
Token: SeProfSingleProcessPrivilege	3508	powershell.exe
Token: SeIncBasePriorityPrivilege	3508	powershell.exe
Token: SeCreatePagefilePrivilege	3508	powershell.exe
Token: SeBackupPrivilege	3508	powershell.exe
Token: SeRestorePrivilege	3508	powershell.exe
Token: SeShutdownPrivilege	3508	powershell.exe
Token: SeDebugPrivilege	3508	powershell.exe
Token: SeSystemEnvironmentPrivilege	3508	powershell.exe
Token: SeRemoteShutdownPrivilege	3508	powershell.exe
Token: SeUndockPrivilege	3508	powershell.exe
Token: SeManageVolumePrivilege	3508	powershell.exe
Token: 33	3508	powershell.exe
Token: 34	3508	powershell.exe
Token: 35	3508	powershell.exe
Token: 36	3508	powershell.exe
Token: SeIncreaseQuotaPrivilege	3508	powershell.exe
Token: SeSecurityPrivilege	3508	powershell.exe
Token: SeTakeOwnershipPrivilege	3508	powershell.exe
Token: SeLoadDriverPrivilege	3508	powershell.exe
Token: SeSystemProfilePrivilege	3508	powershell.exe
Token: SeSystemtimePrivilege	3508	powershell.exe
Token: SeProfSingleProcessPrivilege	3508	powershell.exe
Token: SeIncBasePriorityPrivilege	3508	powershell.exe
Token: SeCreatePagefilePrivilege	3508	powershell.exe
Token: SeBackupPrivilege	3508	powershell.exe
Token: SeRestorePrivilege	3508	powershell.exe
Token: SeShutdownPrivilege	3508	powershell.exe
Token: SeDebugPrivilege	3508	powershell.exe
Token: SeSystemEnvironmentPrivilege	3508	powershell.exe
Token: SeRemoteShutdownPrivilege	3508	powershell.exe
Token: SeUndockPrivilege	3508	powershell.exe
Token: SeManageVolumePrivilege	3508	powershell.exe
Token: 33	3508	powershell.exe
Token: 34	3508	powershell.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 2592 wrote to memory of 1900	2592	2026-06-28_db1354379c220276c102132352348c4b_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	89
PID 1900 wrote to memory of 3904	1900	Microsoft.exe	90
PID 1900 wrote to memory of 4212	1900	Microsoft.exe	92
PID 1900 wrote to memory of 5644	1900	Microsoft.exe	94
PID 1900 wrote to memory of 2668	1900	Microsoft.exe	96
PID 1900 wrote to memory of 1200	1900	Microsoft.exe	98
PID 1900 wrote to memory of 5396	1900	Microsoft.exe	100
PID 1900 wrote to memory of 5588	1900	Microsoft.exe	102
PID 1900 wrote to memory of 4576	1900	Microsoft.exe	104
PID 2944 wrote to memory of 2780	2944	Microsoft.exe	108
PID 1900 wrote to memory of 3508	1900	Microsoft.exe	112
PID 1900 wrote to memory of 3888	1900	Microsoft.exe	114
PID 1900 wrote to memory of 804	1900	Microsoft.exe	116
PID 1900 wrote to memory of 4668	1900	Microsoft.exe	119
PID 1900 wrote to memory of 1568	1900	Microsoft.exe	121
PID 1900 wrote to memory of 3100	1900	Microsoft.exe	123
PID 1900 wrote to memory of 4876	1900	Microsoft.exe	125
PID 1900 wrote to memory of 1268	1900	Microsoft.exe	127
PID 1900 wrote to memory of 436	1900	Microsoft.exe	129
PID 1900 wrote to memory of 2528	1900	Microsoft.exe	131

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2026-06-28_db1354379c220276c102132352348c4b_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-28_db1354379c220276c102132352348c4b_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2592
- C:\ProgramData\Microsoft\Microsoft.exe
  C:\ProgramData\Microsoft\Microsoft.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:1900
- - C:\Windows\system32\schtasks.exe
    schtasks /delete /tn LabLoadAgent /f
    3⤵
    PID:3904
- - C:\Windows\system32\schtasks.exe
    schtasks /delete /tn LabLoadAgentBoot /f
    3⤵
    PID:4212
- - C:\Windows\system32\schtasks.exe
    schtasks /delete /tn MicrosoftAgent /f
    3⤵
    PID:5644
- - C:\Windows\system32\schtasks.exe
    schtasks /delete /tn MicrosoftAgentBoot /f
    3⤵
    PID:2668
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn LabLoadAgent /tr \"C:\ProgramData\Microsoft\Microsoft.exe\" /sc onlogon /rl HIGHEST /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1200
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn LabLoadAgentBoot /tr \"C:\ProgramData\Microsoft\Microsoft.exe\" /sc onstart /delay 0002:00 /rl HIGHEST /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5396
- - C:\Windows\system32\reg.exe
    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v LabLoadAgent /t REG_SZ /d \"C:\ProgramData\Microsoft\Microsoft.exe\" /f
    3⤵
    - Adds Run key to start application
    - Modifies registry key
    PID:5588
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -Command "try { Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft' -ErrorAction Stop; exit 0 } catch { exit 1 }"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4576
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command " $os = Get-CimInstance Win32_OperatingSystem $cpu = Get-CimInstance Win32_Processor | Select-Object -First 1 $cs = Get-CimInstance Win32_ComputerSystem $disk = Get-CimInstance Win32_LogicalDisk -Filter \"DeviceID='C:'\" -ErrorAction SilentlyContinue $prod = Get-CimInstance Win32_ComputerSystemProduct -ErrorAction SilentlyContinue $obj = [ordered]@{ os = $os.Caption osVersion = $os.Version arch = $env:PROCESSOR_ARCHITECTURE cpuModel = ($cpu.Name -replace '\s+', ' ').Trim() cpuCores = [int]$cs.NumberOfLogicalProcessors ramTotalGb = [math]::Round($os.TotalVisibleMemorySize/1MB, 1) ramFreeGb = [math]::Round($os.FreePhysicalMemory/1MB, 1) diskTotalGb = if ($disk) { [math]::Round($disk.Size/1GB, 1) } else { $null } diskFreeGb = if ($disk) { [math]::Round($disk.FreeSpace/1GB, 1) } else { $null } computerName = $env:COMPUTERNAME machineUuid = if ($prod) { $prod.UUID } else { $null } username = $env:USERNAME collectedAt = (Get-Date).ToUniversalTime().ToString(\"o\") } $obj | ConvertTo-Json -Compress "
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3508
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -NonInteractive -Command " $prod = Get-CimInstance Win32_ComputerSystemProduct -ErrorAction SilentlyContinue $bios = Get-CimInstance Win32_BIOS -ErrorAction SilentlyContinue $mac = (Get-CimInstance Win32_NetworkAdapter -ErrorAction SilentlyContinue | Where-Object { $_.MACAddress -and $_.PhysicalAdapter } | Select-Object -First 1).MACAddress $parts = @() if ($prod -and $prod.UUID -and $prod.UUID -ne 'UUID') { $parts += $prod.UUID } if ($bios -and $bios.SerialNumber -and $bios.SerialNumber -notmatch '^(Default|To be filled)') { $parts += $bios.SerialNumber } if ($mac) { $parts += $mac } if ($parts.Count -gt 0) { ($parts -join '|'); exit } $env:COMPUTERNAME "
    3⤵
    - Hide Artifacts: Ignore Process Interrupts
    - Suspicious behavior: EnumeratesProcesses
    PID:3888
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -NonInteractive -Command " $prod = Get-CimInstance Win32_ComputerSystemProduct -ErrorAction SilentlyContinue $bios = Get-CimInstance Win32_BIOS -ErrorAction SilentlyContinue $mac = (Get-CimInstance Win32_NetworkAdapter -ErrorAction SilentlyContinue | Where-Object { $_.MACAddress -and $_.PhysicalAdapter } | Select-Object -First 1).MACAddress $parts = @() if ($prod -and $prod.UUID -and $prod.UUID -ne 'UUID') { $parts += $prod.UUID } if ($bios -and $bios.SerialNumber -and $bios.SerialNumber -notmatch '^(Default|To be filled)') { $parts += $bios.SerialNumber } if ($mac) { $parts += $mac } if ($parts.Count -gt 0) { ($parts -join '|'); exit } $env:COMPUTERNAME "
    3⤵
    - Hide Artifacts: Ignore Process Interrupts
    - Suspicious behavior: EnumeratesProcesses
    PID:804
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -NonInteractive -Command " $prod = Get-CimInstance Win32_ComputerSystemProduct -ErrorAction SilentlyContinue $bios = Get-CimInstance Win32_BIOS -ErrorAction SilentlyContinue $mac = (Get-CimInstance Win32_NetworkAdapter -ErrorAction SilentlyContinue | Where-Object { $_.MACAddress -and $_.PhysicalAdapter } | Select-Object -First 1).MACAddress $parts = @() if ($prod -and $prod.UUID -and $prod.UUID -ne 'UUID') { $parts += $prod.UUID } if ($bios -and $bios.SerialNumber -and $bios.SerialNumber -notmatch '^(Default|To be filled)') { $parts += $bios.SerialNumber } if ($mac) { $parts += $mac } if ($parts.Count -gt 0) { ($parts -join '|'); exit } $env:COMPUTERNAME "
    3⤵
    - Hide Artifacts: Ignore Process Interrupts
    - Suspicious behavior: EnumeratesProcesses
    PID:4668
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -NonInteractive -Command " $prod = Get-CimInstance Win32_ComputerSystemProduct -ErrorAction SilentlyContinue $bios = Get-CimInstance Win32_BIOS -ErrorAction SilentlyContinue $mac = (Get-CimInstance Win32_NetworkAdapter -ErrorAction SilentlyContinue | Where-Object { $_.MACAddress -and $_.PhysicalAdapter } | Select-Object -First 1).MACAddress $parts = @() if ($prod -and $prod.UUID -and $prod.UUID -ne 'UUID') { $parts += $prod.UUID } if ($bios -and $bios.SerialNumber -and $bios.SerialNumber -notmatch '^(Default|To be filled)') { $parts += $bios.SerialNumber } if ($mac) { $parts += $mac } if ($parts.Count -gt 0) { ($parts -join '|'); exit } $env:COMPUTERNAME "
    3⤵
    - Hide Artifacts: Ignore Process Interrupts
    - Suspicious behavior: EnumeratesProcesses
    PID:1568
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -NonInteractive -Command " $prod = Get-CimInstance Win32_ComputerSystemProduct -ErrorAction SilentlyContinue $bios = Get-CimInstance Win32_BIOS -ErrorAction SilentlyContinue $mac = (Get-CimInstance Win32_NetworkAdapter -ErrorAction SilentlyContinue | Where-Object { $_.MACAddress -and $_.PhysicalAdapter } | Select-Object -First 1).MACAddress $parts = @() if ($prod -and $prod.UUID -and $prod.UUID -ne 'UUID') { $parts += $prod.UUID } if ($bios -and $bios.SerialNumber -and $bios.SerialNumber -notmatch '^(Default|To be filled)') { $parts += $bios.SerialNumber } if ($mac) { $parts += $mac } if ($parts.Count -gt 0) { ($parts -join '|'); exit } $env:COMPUTERNAME "
    3⤵
    - Hide Artifacts: Ignore Process Interrupts
    - Suspicious behavior: EnumeratesProcesses
    PID:3100
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -NonInteractive -Command " $prod = Get-CimInstance Win32_ComputerSystemProduct -ErrorAction SilentlyContinue $bios = Get-CimInstance Win32_BIOS -ErrorAction SilentlyContinue $mac = (Get-CimInstance Win32_NetworkAdapter -ErrorAction SilentlyContinue | Where-Object { $_.MACAddress -and $_.PhysicalAdapter } | Select-Object -First 1).MACAddress $parts = @() if ($prod -and $prod.UUID -and $prod.UUID -ne 'UUID') { $parts += $prod.UUID } if ($bios -and $bios.SerialNumber -and $bios.SerialNumber -notmatch '^(Default|To be filled)') { $parts += $bios.SerialNumber } if ($mac) { $parts += $mac } if ($parts.Count -gt 0) { ($parts -join '|'); exit } $env:COMPUTERNAME "
    3⤵
    - Hide Artifacts: Ignore Process Interrupts
    - Suspicious behavior: EnumeratesProcesses
    PID:4876
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -NonInteractive -Command " $prod = Get-CimInstance Win32_ComputerSystemProduct -ErrorAction SilentlyContinue $bios = Get-CimInstance Win32_BIOS -ErrorAction SilentlyContinue $mac = (Get-CimInstance Win32_NetworkAdapter -ErrorAction SilentlyContinue | Where-Object { $_.MACAddress -and $_.PhysicalAdapter } | Select-Object -First 1).MACAddress $parts = @() if ($prod -and $prod.UUID -and $prod.UUID -ne 'UUID') { $parts += $prod.UUID } if ($bios -and $bios.SerialNumber -and $bios.SerialNumber -notmatch '^(Default|To be filled)') { $parts += $bios.SerialNumber } if ($mac) { $parts += $mac } if ($parts.Count -gt 0) { ($parts -join '|'); exit } $env:COMPUTERNAME "
    3⤵
    - Hide Artifacts: Ignore Process Interrupts
    - Suspicious behavior: EnumeratesProcesses
    PID:1268
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -NonInteractive -Command " $prod = Get-CimInstance Win32_ComputerSystemProduct -ErrorAction SilentlyContinue $bios = Get-CimInstance Win32_BIOS -ErrorAction SilentlyContinue $mac = (Get-CimInstance Win32_NetworkAdapter -ErrorAction SilentlyContinue | Where-Object { $_.MACAddress -and $_.PhysicalAdapter } | Select-Object -First 1).MACAddress $parts = @() if ($prod -and $prod.UUID -and $prod.UUID -ne 'UUID') { $parts += $prod.UUID } if ($bios -and $bios.SerialNumber -and $bios.SerialNumber -notmatch '^(Default|To be filled)') { $parts += $bios.SerialNumber } if ($mac) { $parts += $mac } if ($parts.Count -gt 0) { ($parts -join '|'); exit } $env:COMPUTERNAME "
    3⤵
    - Hide Artifacts: Ignore Process Interrupts
    - Suspicious behavior: EnumeratesProcesses
    PID:436
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -NonInteractive -Command " $prod = Get-CimInstance Win32_ComputerSystemProduct -ErrorAction SilentlyContinue $bios = Get-CimInstance Win32_BIOS -ErrorAction SilentlyContinue $mac = (Get-CimInstance Win32_NetworkAdapter -ErrorAction SilentlyContinue | Where-Object { $_.MACAddress -and $_.PhysicalAdapter } | Select-Object -First 1).MACAddress $parts = @() if ($prod -and $prod.UUID -and $prod.UUID -ne 'UUID') { $parts += $prod.UUID } if ($bios -and $bios.SerialNumber -and $bios.SerialNumber -notmatch '^(Default|To be filled)') { $parts += $bios.SerialNumber } if ($mac) { $parts += $mac } if ($parts.Count -gt 0) { ($parts -join '|'); exit } $env:COMPUTERNAME "
    3⤵
    - Hide Artifacts: Ignore Process Interrupts
    - Suspicious behavior: EnumeratesProcesses
    PID:2528

C:\ProgramData\Microsoft\Microsoft.exe
"C:\ProgramData\Microsoft\Microsoft.exe"
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2944
- C:\Windows\system32\tasklist.exe
  tasklist /FI "PID eq 1900" /NH
  2⤵
  - Enumerates processes with tasklist
  - Suspicious use of AdjustPrivilegeToken
  PID:2780

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Hide Artifacts

T1564

Ignore Process Interrupts

T1564.011

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Process Discovery

T1057

Query Registry

T1012

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

.lab-instance-id

Path C:\ProgramData\Microsoft\.lab-instance-id
Size 137B
SHA256 9a19d487a1f6eb906c6bf8c4e9b989082f002fb99287cf28532d1f4d489bfc8f
MD5 9a5a2c77923252754f1b5860d470c145
SHA1 f64478198c958e2880675e399dd1486e7e974fc7
SHA512 9ea3e38845925394c5902d3e7d3c1151f56c9cb30b1a167da1b8d275d5bc1647a585e036c890db14ea358d9da361e71e72a1551f22fb6bf04ba3f03d7affb856
TLSH
T18AC09B158F6D1D921CF984741E30145E5071540A416972555C58C10C92C714F3691536
MD5 SHA1 SHA512 TLSH

Submit Download

Microsoft.exe

Path C:\ProgramData\Microsoft\Microsoft.exe
Size 9.7MB
SHA256 7256d0e5500f4626c08a9f1a4e5b7ab8727c6867d3ec22f5c40d1bd537d3c211
MD5 db1354379c220276c102132352348c4b
SHA1 e2bd72e0a4dc4db81f0fa8285d9f073bb5b1be6b
SHA512 76dc153c9ce04de1b9543fc41bccd075715e39978034521d5e98bee3c09d5039cd3a0259bfb140a54393df9ee6520af35321534a56e84742dcc69ff77f3b35b1
SSDEEP 98304:ZALq82Qiz0ZOGCGkGvamwSR7EepBJ+0FKysMpF3rQT:ZifvhISeuq0FLpFI
TLSH
T156A66B43EC6514E9C1AD9235C9B386437BB1BC490B3267D32BA0B2387E76BD46DB9314
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lab-agent.lock

Path C:\ProgramData\Microsoft\lab-agent.lock
Size 4B
SHA256 e41d64db5703c6440b5c714d57251a845bc0bd241480b41a4e7fd3e052f85a82
MD5 9fdb62f932adf55af2c0e09e55861964
SHA1 259e58e1899790724f5bde68f6c687293fce64d1
SHA512 0272e80f4c075448b6aa75310cdd70f67421ad086e67940347c84d7556d714afa123e2aa1b70945b77e59ae38cdfc463b5a3ab965def6bf1d397893abeac8300
MD5 SHA1 SHA512

Submit Download

lab-agent.log

Path C:\ProgramData\Microsoft\lab-agent.log
Size 295B
SHA256 83e3439ed9b311aef39db91ab914190a88e4ec12463b70db76d76249dbe5f739
MD5 50a2ffdbfb180d78c857c55d949f50c9
SHA1 f07655dc2ff0cbf9ef18b995116b2c9453be8d0a
SHA512 b6f66e43fc6932aac61660da97ea4b82afe0ca2110fbfb1ba2a8671c0de6bbd446ce34c46e2ec3de3f782c6fa9d408f7981eb6addd97676c09d991c18d5097a8
TLSH
T1BAE0CD3244DB6707941E3501CA499E0C8198B5CF664AED15C369E1CF2065B4FFDD8383
MD5 SHA1 SHA512 TLSH

Submit Download

server.json

Path C:\ProgramData\Microsoft\server.json
Size 37B
SHA256 4fbd89fdb1e2109b5483673fcfcbb7c683fe776d1fc18654826a9557304ed6fb
MD5 1f4ce19048b348eb101c08f7de8baa55
SHA1 2259ce22144b5862e8fe6f986acb786f5440e17c
SHA512 440108d243d79c12e1dc0a9055d073da2e52b7c6baf7eb5ca0faf6976d5caacfca525ea98670d36136ce58fe5fbc65a1714619123c6075ca05d4ae03f769e031
MD5 SHA1 SHA512

Submit Download