Analysis
- max time kernel
149s - max time network
123s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260629-en - resource tags
- submitted
29/06/2026, 13:02
General
- Target 2026-06-26_b3e38e330b8b0911d2764219e27d9759_akira_cobalt-strike.exe
- Size 25.9MB
- Sample260629-p9v4csfx2n
- SHA256 f0da5a6f83a3c1b2e044b9e3e1d1aafce10a5b87da0d236c617c3f3ec78ce02e
Score
10/10
Malware Config
Signatures
- Family: DonutLoader
DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.
- Detects DonutLoader 1 IoCs
- Detect binaries embedding considerable number of MFA browser extension IDs. 1 IoCs
- Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs. 1 IoCs
- Detects binaries and memory artifacts referencing sandbox DLLs typically observed in sandbox evasion 2 IoCs
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
- Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs
Using powershell.exe command.
- Drops startup file 1 IoCs
- Executes dropped EXE 3 IoCs
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 3 IoCs
- Enumerates connected drives 3 TTPs 2 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs
- Drops file in Windows directory 2 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Time Discovery 1 TTPs 2 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Checks SCSI registry key(s) 3 TTPs 62 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 6 IoCs
- Modifies Internet Explorer settings 1 TTPs 1 IoCs
- Modifies registry class 35 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 17 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of FindShellTrayWindow 57 IoCs
- Suspicious use of SendNotifyMessage 40 IoCs
- Suspicious use of SetWindowsHookEx 3 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-06-26_b3e38e330b8b0911d2764219e27d9759_akira_cobalt-strike.exe"C:\Users\Admin\AppData\Local\Temp\2026-06-26_b3e38e330b8b0911d2764219e27d9759_akira_cobalt-strike.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\a6e80b5129f4.exe"C:\Users\Admin\AppData\Local\Temp\a6e80b5129f4.exe"2⤵
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"3⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"3⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --user-data-dir="C:\Users\Admin\AppData\Local\Temp\ihrbxrbk.alq" --app=http://127.0.0.1:498433⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\ihrbxrbk.alq /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\ihrbxrbk.alq\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\ihrbxrbk.alq --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffaad5ac728,0x7ffaad5ac734,0x7ffaad5ac7404⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Local\Temp\ihrbxrbk.alq" --no-pre-read-main-dll --force-high-res-timeticks=disabled --subproc-heap-profiling --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1648,i,15386117695155402682,7413915483241111689,262144 --field-trial-handle=1936,i,2530085894325082558,306938214640781601,262144 --variations-seed-version --mojo-platform-channel-handle=1932 /prefetch:24⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Local\Temp\ihrbxrbk.alq" --force-high-res-timeticks=disabled --subproc-heap-profiling --metrics-shmem-handle=2040,i,5698064462620459917,16450067121570319736,524288 --field-trial-handle=1936,i,2530085894325082558,306938214640781601,262144 --variations-seed-version --mojo-platform-channel-handle=1984 /prefetch:114⤵
- System Time Discovery
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --user-data-dir="C:\Users\Admin\AppData\Local\Temp\ihrbxrbk.alq" --force-high-res-timeticks=disabled --subproc-heap-profiling --metrics-shmem-handle=2088,i,15418332709861472221,2650308939163498888,524288 --field-trial-handle=1936,i,2530085894325082558,306938214640781601,262144 --variations-seed-version --mojo-platform-channel-handle=2404 /prefetch:134⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\ihrbxrbk.alq" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --subproc-heap-profiling --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3296,i,10870145188777673358,15766852129143159890,2097152 --field-trial-handle=1936,i,2530085894325082558,306938214640781601,262144 --variations-seed-version --mojo-platform-channel-handle=3316 /prefetch:14⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\ihrbxrbk.alq" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --subproc-heap-profiling --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3308,i,11077184422958900180,1817505178572864938,2097152 --field-trial-handle=1936,i,2530085894325082558,306938214640781601,262144 --variations-seed-version --mojo-platform-channel-handle=3344 /prefetch:14⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\ihrbxrbk.alq" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=3916,i,10877326468097219434,18002241530466509737,2097152 --field-trial-handle=1936,i,2530085894325082558,306938214640781601,262144 --variations-seed-version --mojo-platform-channel-handle=3936 /prefetch:94⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\ihrbxrbk.alq" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --subproc-heap-profiling --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=3888,i,4430217685772722823,15376989273856478963,2097152 --field-trial-handle=1936,i,2530085894325082558,306938214640781601,262144 --variations-seed-version --mojo-platform-channel-handle=3900 /prefetch:14⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\ihrbxrbk.alq" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=4680,i,16224687178322528884,9864683216653527856,2097152 --field-trial-handle=1936,i,2530085894325082558,306938214640781601,262144 --variations-seed-version --mojo-platform-channel-handle=4704 /prefetch:94⤵
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --user-data-dir="C:\Users\Admin\AppData\Local\Temp\rsh5so3g.002" --app=http://127.0.0.1:500533⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\rsh5so3g.002 /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\rsh5so3g.002\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x288,0x7ffaa77dc188,0x7ffaa77dc194,0x7ffaa77dc1a04⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Local\Temp\rsh5so3g.002" --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1816,i,17059040418921659481,14217007217917412304,524288 --field-trial-handle=2228,i,7813089838896143238,7757402694960964554,262144 --variations-seed-version --mojo-platform-channel-handle=2268 /prefetch:114⤵
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Local\Temp\rsh5so3g.002" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1564,i,5637317545706259889,15569295166240296121,262144 --field-trial-handle=2228,i,7813089838896143238,7757402694960964554,262144 --variations-seed-version --mojo-platform-channel-handle=2224 /prefetch:24⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --user-data-dir="C:\Users\Admin\AppData\Local\Temp\rsh5so3g.002" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2656,i,7346703413414023191,13755534978427467429,524288 --field-trial-handle=2228,i,7813089838896143238,7757402694960964554,262144 --variations-seed-version --mojo-platform-channel-handle=2648 /prefetch:134⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\rsh5so3g.002" --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3492,i,3304191373144813986,1991547774142886166,2097152 --field-trial-handle=2228,i,7813089838896143238,7757402694960964554,262144 --variations-seed-version --mojo-platform-channel-handle=3504 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\rsh5so3g.002" --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3512,i,5884001056571153196,9437805432654294484,2097152 --field-trial-handle=2228,i,7813089838896143238,7757402694960964554,262144 --variations-seed-version --mojo-platform-channel-handle=3568 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --user-data-dir="C:\Users\Admin\AppData\Local\Temp\rsh5so3g.002" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4124,i,15484692642268623269,11253978198865289988,524288 --field-trial-handle=2228,i,7813089838896143238,7757402694960964554,262144 --variations-seed-version --mojo-platform-channel-handle=4168 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --user-data-dir="C:\Users\Admin\AppData\Local\Temp\rsh5so3g.002" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4132,i,10263816252839530502,15442256899853871089,524288 --field-trial-handle=2228,i,7813089838896143238,7757402694960964554,262144 --variations-seed-version --mojo-platform-channel-handle=4360 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --user-data-dir="C:\Users\Admin\AppData\Local\Temp\rsh5so3g.002" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4136,i,14614009968604039848,12638395119976608307,524288 --field-trial-handle=2228,i,7813089838896143238,7757402694960964554,262144 --variations-seed-version --mojo-platform-channel-handle=4440 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\rsh5so3g.002" --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4248,i,17472611800051061204,153003817260493357,2097152 --field-trial-handle=2228,i,7813089838896143238,7757402694960964554,262144 --variations-seed-version --mojo-platform-channel-handle=4484 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\rsh5so3g.002" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=4260,i,18418619585801526649,16844205661710563533,2097152 --field-trial-handle=2228,i,7813089838896143238,7757402694960964554,262144 --variations-seed-version --mojo-platform-channel-handle=4556 /prefetch:94⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\rsh5so3g.002" --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=4284,i,12544426726628111872,3152785266052724259,2097152 --field-trial-handle=2228,i,7813089838896143238,7757402694960964554,262144 --variations-seed-version --mojo-platform-channel-handle=4496 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\rsh5so3g.002" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=4296,i,18082889992780947732,449618841796853427,2097152 --field-trial-handle=2228,i,7813089838896143238,7757402694960964554,262144 --variations-seed-version --mojo-platform-channel-handle=4640 /prefetch:94⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\rsh5so3g.002" --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=4348,i,16946622582464553522,4612800291652831481,2097152 --field-trial-handle=2228,i,7813089838896143238,7757402694960964554,262144 --variations-seed-version --mojo-platform-channel-handle=4588 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\rsh5so3g.002" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=4356,i,1976576391001936870,16283920641659165714,2097152 --field-trial-handle=2228,i,7813089838896143238,7757402694960964554,262144 --variations-seed-version --mojo-platform-channel-handle=4708 /prefetch:94⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\rsh5so3g.002" --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=4416,i,11663852839635011376,11011608511535521416,2097152 --field-trial-handle=2228,i,7813089838896143238,7757402694960964554,262144 --variations-seed-version --mojo-platform-channel-handle=5072 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\rsh5so3g.002" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=4444,i,7965780576954733689,9848557191855002134,2097152 --field-trial-handle=2228,i,7813089838896143238,7757402694960964554,262144 --variations-seed-version --mojo-platform-channel-handle=5076 /prefetch:94⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\rsh5so3g.002" --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=4456,i,379107506166625365,6392142710747031714,2097152 --field-trial-handle=2228,i,7813089838896143238,7757402694960964554,262144 --variations-seed-version --mojo-platform-channel-handle=5148 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\rsh5so3g.002" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=4552,i,14275454061487707653,4722588672140655726,2097152 --field-trial-handle=2228,i,7813089838896143238,7757402694960964554,262144 --variations-seed-version --mojo-platform-channel-handle=4248 /prefetch:94⤵
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c powershell -C "Add-MpPreference -ExclusionExtension '.exe' -EA 0"3⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -C "Add-MpPreference -ExclusionExtension '.exe' -EA 0"4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Users\Admin\AppData\Local\MpDefenderCoreFolder\CoreWorker_PzFFbacIRiGoHZK.exe"C:\Users\Admin\AppData\Local\MpDefenderCoreFolder\CoreWorker_PzFFbacIRiGoHZK.exe"3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command " $action = New-ScheduledTaskAction -Execute 'C:\Users\Admin\AppData\Local\MpDefenderCoreFolder\CoreWorker_PzFFbacIRiGoHZK.exe' $trigger = New-ScheduledTaskTrigger -AtLogOn Register-ScheduledTask -Action $action -Trigger $trigger -TaskName 'CoreWorker_PzFFbacIRiGoHZK-1246' -RunLevel Highest "4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\MpDefenderCoreFolder'"4⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\MpDefenderCoreFolder'"5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Users\Admin\AppData\Local\MpDefenderCoreFolder\CoreWorker_PzFFbacIRiGoHZK.exeC:\Users\Admin\AppData\Local\MpDefenderCoreFolder\CoreWorker_PzFFbacIRiGoHZK.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\sihost.exesihost.exe1⤵
- Suspicious use of FindShellTrayWindow
-
C:\Windows\explorer.exeexplorer.exe /LOADSAVEDWINDOWS2⤵
- Boot or Logon Autostart Execution: Active Setup
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
2Active Setup
1Registry Run Keys / Startup Folder
1Privilege Escalation
Boot or Logon Autostart Execution
2Active Setup
1Registry Run Keys / Startup Folder
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
CoreWorker_PzFFbacIRiGoHZK.exe
prep_Activatable Class_Hermes_perf.cache
prep_Activatable Class_Hermes_perf.cache
__PSScriptPolicyTest_4z15hpkp.nja.ps1
a6e80b5129f4.exe
settings.dat
data_0
data_1
data_3
index
ba678a2fbd8c358c_0
the-real-index
index
index
MANIFEST-000001
index
Reporting and NEL
SCT Auditing Pending Reports
Trust Tokens
Preferences
Safe Browsing Cookies
2cc80dabc69f58b6_0
the-real-index
index
the-real-index
db
CURRENT
data_0
data_1
data_2
data_3
index
settings.dat
Local State
Local State
Local State~RFe591d04.TMP
memory/1104-464-0x0000015F5C9F0000-0x0000015F5C9FA000-memory.dmp
memory/1188-445-0x000001975CF20000-0x000001975CF3E000-memory.dmp
memory/1188-446-0x000001975CF40000-0x000001975CFF2000-memory.dmp
memory/1188-447-0x0000019744E00000-0x0000019744E0A000-memory.dmp
memory/1188-425-0x0000019744D40000-0x0000019744D62000-memory.dmp
memory/1748-35-0x00000226F4F70000-0x00000226F4F80000-memory.dmp
memory/2780-36-0x000001EBE7830000-0x000001EBE784E000-memory.dmp
memory/2780-34-0x000001EBE77D0000-0x000001EBE77E0000-memory.dmp
memory/2972-472-0x000002243EB90000-0x000002243EC42000-memory.dmp
memory/2972-475-0x000002243EC50000-0x000002243EC6E000-memory.dmp
memory/2992-16-0x00007FFAB3260000-0x00007FFAB3C04000-memory.dmp
memory/2992-394-0x00007FFAB3260000-0x00007FFAB3C04000-memory.dmp
memory/2992-29-0x00007FFAB3260000-0x00007FFAB3C04000-memory.dmp
memory/2992-28-0x0000027866740000-0x000002786694C000-memory.dmp
memory/2992-27-0x00007FFAB3260000-0x00007FFAB3C04000-memory.dmp
memory/2992-26-0x00007FFAB3260000-0x00007FFAB3C04000-memory.dmp
memory/2992-25-0x0000027865A00000-0x0000027865C0E000-memory.dmp
memory/2992-24-0x00007FFAB3260000-0x00007FFAB3C04000-memory.dmp
memory/2992-23-0x00007FFAB3260000-0x00007FFAB3C04000-memory.dmp
memory/2992-22-0x0000027865DE0000-0x0000027866308000-memory.dmp
memory/2992-21-0x00007FFAB3260000-0x00007FFAB3C04000-memory.dmp
memory/2992-20-0x00007FFAB3260000-0x00007FFAB3C04000-memory.dmp
memory/2992-18-0x0000027865510000-0x0000027865586000-memory.dmp
memory/2992-19-0x00007FFAB3260000-0x00007FFAB3C04000-memory.dmp
memory/2992-17-0x00000278656E0000-0x00000278658A2000-memory.dmp
memory/2992-33-0x0000027865690000-0x00000278656A2000-memory.dmp
memory/2992-251-0x00007FFAB3260000-0x00007FFAB3C04000-memory.dmp
memory/2992-32-0x00007FFAB3260000-0x00007FFAB3C04000-memory.dmp
memory/2992-15-0x000002784CD00000-0x000002784CD01000-memory.dmp
memory/2992-37-0x0000027865CF0000-0x0000027865D40000-memory.dmp
memory/2992-14-0x00007FFAB3260000-0x00007FFAB3C04000-memory.dmp
memory/2992-30-0x00007FFAB3260000-0x00007FFAB3C04000-memory.dmp
memory/2992-146-0x00007FFAB3260000-0x00007FFAB3C04000-memory.dmp
memory/2992-10-0x000002784AEC0000-0x000002784AFCE000-memory.dmp
memory/2992-39-0x00007FFAB3260000-0x00007FFAB3C04000-memory.dmp
memory/2992-141-0x00007FFAB3260000-0x00007FFAB3C04000-memory.dmp
memory/2992-451-0x00007FFAB3260000-0x00007FFAB3C04000-memory.dmp
memory/2992-452-0x00007FFAB3260000-0x00007FFAB3C04000-memory.dmp
memory/2992-13-0x00007FFAB3260000-0x00007FFAB3C04000-memory.dmp
memory/2992-40-0x00007FFAB3260000-0x00007FFAB3C04000-memory.dmp
memory/2992-465-0x00007FFAB3260000-0x00007FFAB3C04000-memory.dmp
memory/2992-12-0x00007FFAB3260000-0x00007FFAB3C04000-memory.dmp
memory/2992-41-0x00007FFAB3260000-0x00007FFAB3C04000-memory.dmp
memory/2992-42-0x00007FFAB3260000-0x00007FFAB3C04000-memory.dmp
memory/2992-11-0x00007FFAB33EF000-0x00007FFAB33F0000-memory.dmp
memory/4244-547-0x0000024094210000-0x0000024094230000-memory.dmp
memory/4244-503-0x00000240801E0000-0x00000240802E0000-memory.dmp
memory/4244-523-0x0000024081C90000-0x0000024081CB0000-memory.dmp
memory/4244-513-0x0000024081E90000-0x0000024081F90000-memory.dmp
memory/4244-502-0x00000240801E0000-0x00000240802E0000-memory.dmp
memory/4244-512-0x0000024081930000-0x0000024081950000-memory.dmp
memory/4244-501-0x00000240801E0000-0x00000240802E0000-memory.dmp
memory/4660-38-0x00007FF782530000-0x00007FF7826E6000-memory.dmp
memory/4660-671-0x00007FF782530000-0x00007FF7826E6000-memory.dmp