877be28102469da1c805f27abcf7afb1670a2031b3c2168f89d1bd2c1037d910

Analysis

max time kernel
149s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
05/07/2026, 20:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-05_175b8caba89cfe1d8da7f44a3b7acb3e_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
Size 401KB
Sample260705-yteacaft9v
SHA256 877be28102469da1c805f27abcf7afb1670a2031b3c2168f89d1bd2c1037d910
MD5 175b8caba89cfe1d8da7f44a3b7acb3e
SHA1 b0996b945266c5a866421ac590860d46345db8ef
SHA512 9d78c2426a34ea1442c8c181546c2308bcaf4d86e927697e990bb0069d56a95f0029ae6829e9b58dbe9071a834b6bd1b3763545880a6048fd7df0cf52c5277d9
SSDEEP 6144:fsO/zba+IQbXxFaK6cfyIoT7Oqbv5F0GRUIZGNzS:3H7F6cf6T7Ow5JRU
TLSH
T172945D16EAE510B9F1E7B638CC564902E6B6784E07A197CF03D0C9A62F376D09B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

defense_evasion discovery execution exploit persistence

Malware Config

Signatures

Looks for VirtualBox Guest Additions in registry 2 TTPs 3 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions	Win-v42.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions	Win-v43.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions	2026-07-05_175b8caba89cfe1d8da7f44a3b7acb3e_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
5200	powershell.exe
1852	powershell.exe
1712	powershell.exe

Looks for VMWare Tools registry key 2 TTPs 3 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools	2026-07-05_175b8caba89cfe1d8da7f44a3b7acb3e_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools	Win-v42.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools	Win-v43.exe

Possible privilege escalation attempt 3 IoCs

exploit

pid	Process
1912	takeown.exe
1112	icacls.exe
6660	icacls.exe

Executes dropped EXE 2 IoCs

pid	Process
6528	Win-v42.exe
6512	Win-v43.exe

Modifies file permissions 1 TTPs 3 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
1112	icacls.exe
6660	icacls.exe
1912	takeown.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-759331733-200834466-1207319849-1000\Software\Microsoft\Windows\CurrentVersion\Run\v4 = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\Windows\\Explorer\\Win-v43.exe"	2026-07-05_175b8caba89cfe1d8da7f44a3b7acb3e_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe

File and Directory Permissions Modification: Windows File and Directory Permissions Modification 1 TTPs
defense_evasion

Windows File and Directory Permissions Modification
T1222.001

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
1	api64.ipify.org
3	api64.ipify.org

Power Settings 1 TTPs 7 IoCs

powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.

persistence

Power Settings

T1653

pid	Process
1768	powercfg.exe
7032	powercfg.exe
1032	powercfg.exe
6804	powercfg.exe
4492	powercfg.exe
4932	powercfg.exe
5248	powercfg.exe

Drops file in System32 directory 3 IoCs

description	ioc	Process
File created	C:\Windows\System32\Win-v42.exe	2026-07-05_175b8caba89cfe1d8da7f44a3b7acb3e_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\Recovery	ReAgentc.exe
File opened for modification	C:\Windows\system32\Recovery\ReAgent.xml	ReAgentc.exe

Drops file in Windows directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Panther\UnattendGC\diagerr.xml	ReAgentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagwrn.xml	ReAgentc.exe
File created	C:\Windows\Win-v41.exe	2026-07-05_175b8caba89cfe1d8da7f44a3b7acb3e_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\Logs\ReAgent\ReAgent.log	ReAgentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\setuperr.log	ReAgentc.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
6268	cmd.exe
7080	PING.EXE

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
7080	PING.EXE

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
684	schtasks.exe

Suspicious behavior: EnumeratesProcesses 36 IoCs

pid	Process
2696	2026-07-05_175b8caba89cfe1d8da7f44a3b7acb3e_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
2696	2026-07-05_175b8caba89cfe1d8da7f44a3b7acb3e_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
5200	powershell.exe
5200	powershell.exe
1852	powershell.exe
1852	powershell.exe
1712	powershell.exe
1712	powershell.exe
6528	Win-v42.exe
6528	Win-v42.exe
6512	Win-v43.exe
6512	Win-v43.exe
2696	2026-07-05_175b8caba89cfe1d8da7f44a3b7acb3e_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
2696	2026-07-05_175b8caba89cfe1d8da7f44a3b7acb3e_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
2696	2026-07-05_175b8caba89cfe1d8da7f44a3b7acb3e_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
2696	2026-07-05_175b8caba89cfe1d8da7f44a3b7acb3e_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
2696	2026-07-05_175b8caba89cfe1d8da7f44a3b7acb3e_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
2696	2026-07-05_175b8caba89cfe1d8da7f44a3b7acb3e_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
2696	2026-07-05_175b8caba89cfe1d8da7f44a3b7acb3e_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
2696	2026-07-05_175b8caba89cfe1d8da7f44a3b7acb3e_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
2696	2026-07-05_175b8caba89cfe1d8da7f44a3b7acb3e_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
2696	2026-07-05_175b8caba89cfe1d8da7f44a3b7acb3e_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
2696	2026-07-05_175b8caba89cfe1d8da7f44a3b7acb3e_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
2696	2026-07-05_175b8caba89cfe1d8da7f44a3b7acb3e_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
2696	2026-07-05_175b8caba89cfe1d8da7f44a3b7acb3e_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
2696	2026-07-05_175b8caba89cfe1d8da7f44a3b7acb3e_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
2696	2026-07-05_175b8caba89cfe1d8da7f44a3b7acb3e_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
2696	2026-07-05_175b8caba89cfe1d8da7f44a3b7acb3e_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
2696	2026-07-05_175b8caba89cfe1d8da7f44a3b7acb3e_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
2696	2026-07-05_175b8caba89cfe1d8da7f44a3b7acb3e_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
2696	2026-07-05_175b8caba89cfe1d8da7f44a3b7acb3e_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
2696	2026-07-05_175b8caba89cfe1d8da7f44a3b7acb3e_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
2696	2026-07-05_175b8caba89cfe1d8da7f44a3b7acb3e_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
2696	2026-07-05_175b8caba89cfe1d8da7f44a3b7acb3e_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
2696	2026-07-05_175b8caba89cfe1d8da7f44a3b7acb3e_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
2696	2026-07-05_175b8caba89cfe1d8da7f44a3b7acb3e_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	5200	powershell.exe
Token: SeIncreaseQuotaPrivilege	5200	powershell.exe
Token: SeSecurityPrivilege	5200	powershell.exe
Token: SeTakeOwnershipPrivilege	5200	powershell.exe
Token: SeLoadDriverPrivilege	5200	powershell.exe
Token: SeSystemProfilePrivilege	5200	powershell.exe
Token: SeSystemtimePrivilege	5200	powershell.exe
Token: SeProfSingleProcessPrivilege	5200	powershell.exe
Token: SeIncBasePriorityPrivilege	5200	powershell.exe
Token: SeCreatePagefilePrivilege	5200	powershell.exe
Token: SeBackupPrivilege	5200	powershell.exe
Token: SeRestorePrivilege	5200	powershell.exe
Token: SeShutdownPrivilege	5200	powershell.exe
Token: SeDebugPrivilege	5200	powershell.exe
Token: SeSystemEnvironmentPrivilege	5200	powershell.exe
Token: SeRemoteShutdownPrivilege	5200	powershell.exe
Token: SeUndockPrivilege	5200	powershell.exe
Token: SeManageVolumePrivilege	5200	powershell.exe
Token: 33	5200	powershell.exe
Token: 34	5200	powershell.exe
Token: 35	5200	powershell.exe
Token: 36	5200	powershell.exe
Token: SeDebugPrivilege	1852	powershell.exe
Token: SeIncreaseQuotaPrivilege	1852	powershell.exe
Token: SeSecurityPrivilege	1852	powershell.exe
Token: SeTakeOwnershipPrivilege	1852	powershell.exe
Token: SeLoadDriverPrivilege	1852	powershell.exe
Token: SeSystemProfilePrivilege	1852	powershell.exe
Token: SeSystemtimePrivilege	1852	powershell.exe
Token: SeProfSingleProcessPrivilege	1852	powershell.exe
Token: SeIncBasePriorityPrivilege	1852	powershell.exe
Token: SeCreatePagefilePrivilege	1852	powershell.exe
Token: SeBackupPrivilege	1852	powershell.exe
Token: SeRestorePrivilege	1852	powershell.exe
Token: SeShutdownPrivilege	1852	powershell.exe
Token: SeDebugPrivilege	1852	powershell.exe
Token: SeSystemEnvironmentPrivilege	1852	powershell.exe
Token: SeRemoteShutdownPrivilege	1852	powershell.exe
Token: SeUndockPrivilege	1852	powershell.exe
Token: SeManageVolumePrivilege	1852	powershell.exe
Token: 33	1852	powershell.exe
Token: 34	1852	powershell.exe
Token: 35	1852	powershell.exe
Token: 36	1852	powershell.exe
Token: SeIncreaseQuotaPrivilege	1852	powershell.exe
Token: SeSecurityPrivilege	1852	powershell.exe
Token: SeTakeOwnershipPrivilege	1852	powershell.exe
Token: SeLoadDriverPrivilege	1852	powershell.exe
Token: SeSystemProfilePrivilege	1852	powershell.exe
Token: SeSystemtimePrivilege	1852	powershell.exe
Token: SeProfSingleProcessPrivilege	1852	powershell.exe
Token: SeIncBasePriorityPrivilege	1852	powershell.exe
Token: SeCreatePagefilePrivilege	1852	powershell.exe
Token: SeBackupPrivilege	1852	powershell.exe
Token: SeRestorePrivilege	1852	powershell.exe
Token: SeShutdownPrivilege	1852	powershell.exe
Token: SeDebugPrivilege	1852	powershell.exe
Token: SeSystemEnvironmentPrivilege	1852	powershell.exe
Token: SeRemoteShutdownPrivilege	1852	powershell.exe
Token: SeUndockPrivilege	1852	powershell.exe
Token: SeManageVolumePrivilege	1852	powershell.exe
Token: 33	1852	powershell.exe
Token: 34	1852	powershell.exe
Token: 35	1852	powershell.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 2696 wrote to memory of 5200	2696	2026-07-05_175b8caba89cfe1d8da7f44a3b7acb3e_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe	89
PID 2696 wrote to memory of 1852	2696	2026-07-05_175b8caba89cfe1d8da7f44a3b7acb3e_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe	92
PID 2696 wrote to memory of 1712	2696	2026-07-05_175b8caba89cfe1d8da7f44a3b7acb3e_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe	94
PID 2696 wrote to memory of 684	2696	2026-07-05_175b8caba89cfe1d8da7f44a3b7acb3e_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe	96
PID 2696 wrote to memory of 4972	2696	2026-07-05_175b8caba89cfe1d8da7f44a3b7acb3e_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe	98
PID 4972 wrote to memory of 6840	4972	cmd.exe	100
PID 2696 wrote to memory of 5244	2696	2026-07-05_175b8caba89cfe1d8da7f44a3b7acb3e_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe	104
PID 5244 wrote to memory of 1912	5244	cmd.exe	107
PID 2696 wrote to memory of 1800	2696	2026-07-05_175b8caba89cfe1d8da7f44a3b7acb3e_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe	112
PID 1800 wrote to memory of 1112	1800	cmd.exe	116
PID 2696 wrote to memory of 3000	2696	2026-07-05_175b8caba89cfe1d8da7f44a3b7acb3e_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe	117
PID 3000 wrote to memory of 6660	3000	cmd.exe	119
PID 2696 wrote to memory of 4492	2696	2026-07-05_175b8caba89cfe1d8da7f44a3b7acb3e_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe	120
PID 2696 wrote to memory of 4932	2696	2026-07-05_175b8caba89cfe1d8da7f44a3b7acb3e_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe	122
PID 2696 wrote to memory of 5248	2696	2026-07-05_175b8caba89cfe1d8da7f44a3b7acb3e_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe	124
PID 2696 wrote to memory of 1768	2696	2026-07-05_175b8caba89cfe1d8da7f44a3b7acb3e_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe	126
PID 2696 wrote to memory of 7032	2696	2026-07-05_175b8caba89cfe1d8da7f44a3b7acb3e_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe	128
PID 2696 wrote to memory of 1032	2696	2026-07-05_175b8caba89cfe1d8da7f44a3b7acb3e_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe	130
PID 2696 wrote to memory of 6804	2696	2026-07-05_175b8caba89cfe1d8da7f44a3b7acb3e_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe	132
PID 2696 wrote to memory of 6268	2696	2026-07-05_175b8caba89cfe1d8da7f44a3b7acb3e_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe	134
PID 6268 wrote to memory of 7080	6268	cmd.exe	136

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2026-07-05_175b8caba89cfe1d8da7f44a3b7acb3e_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-05_175b8caba89cfe1d8da7f44a3b7acb3e_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe"
1⤵
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2696
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Add-MpPreference -ExclusionProcess 'powershell.exe'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5200
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Add-MpPreference -ExclusionProcess 'cmd.exe'; Add-MpPreference -ExclusionPath 'C:\'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1852
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Add-MpPreference -ExclusionProcess 'WinTemp-v4.exe'; Add-MpPreference -ExclusionProcess 'Win-v42.exe'; Add-MpPreference -ExclusionProcess 'Win-v43.exe'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:1712
- C:\Windows\SYSTEM32\schtasks.exe
  schtasks /Create /TN "v4" /TR "C:\Windows\System32\Win-v42.exe" /SC ONLOGON /RL HIGHEST /F
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:684
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C reagentc /disable
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4972
- - C:\Windows\system32\ReAgentc.exe
    reagentc /disable
    3⤵
    - Drops file in System32 directory
    - Drops file in Windows directory
    PID:6840
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C takeown /F "%SystemRoot%\System32\reagentc.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5244
- - C:\Windows\system32\takeown.exe
    takeown /F "C:\Windows\System32\reagentc.exe"
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:1912
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C icacls "%SystemRoot%\System32\reagentc.exe" /grant Administrators:F
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1800
- - C:\Windows\system32\icacls.exe
    icacls "C:\Windows\System32\reagentc.exe" /grant Administrators:F
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:1112
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C icacls "%SystemRoot%\System32\reagentc.exe" /deny Everyone:RX
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3000
- - C:\Windows\system32\icacls.exe
    icacls "C:\Windows\System32\reagentc.exe" /deny Everyone:RX
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:6660
- C:\Windows\SYSTEM32\powercfg.exe
  powercfg /change monitor-timeout-ac 0
  2⤵
  - Power Settings
  PID:4492
- C:\Windows\SYSTEM32\powercfg.exe
  powercfg /change monitor-timeout-dc 0
  2⤵
  - Power Settings
  PID:4932
- C:\Windows\SYSTEM32\powercfg.exe
  powercfg /change standby-timeout-ac 0
  2⤵
  - Power Settings
  PID:5248
- C:\Windows\SYSTEM32\powercfg.exe
  powercfg /change standby-timeout-dc 0
  2⤵
  - Power Settings
  PID:1768
- C:\Windows\SYSTEM32\powercfg.exe
  powercfg /change hibernate-timeout-ac 0
  2⤵
  - Power Settings
  PID:7032
- C:\Windows\SYSTEM32\powercfg.exe
  powercfg /change hibernate-timeout-dc 0
  2⤵
  - Power Settings
  PID:1032
- C:\Windows\SYSTEM32\powercfg.exe
  powercfg /hibernate off
  2⤵
  - Power Settings
  PID:6804
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c ping -n 1 -w 1000 8.8.8.8 > nul
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Suspicious use of WriteProcessMemory
  PID:6268
- - C:\Windows\system32\PING.EXE
    ping -n 1 -w 1000 8.8.8.8
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:7080

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s BDESVC
1⤵
PID:3164

C:\Windows\System32\Win-v42.exe
C:\Windows\System32\Win-v42.exe
1⤵
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:6528

C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\Win-v43.exe
C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\Win-v43.exe
1⤵
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:6512

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Power Settings

T1653

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

File and Directory Permissions Modification

T1222

Windows File and Directory Permissions Modification

T1222.001

Modify Registry

T1112

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 f1e5d82b5a189ea2be5bcb97eaf21b4ff8cb785bf14b9b7d0c3532a3cd068d60
MD5 22f0ffaa212f3eff78593bfdeee03662
SHA1 1464dfc97fd5c12669e86a3ebf2c748910c3a0c0
SHA512 cfa263d4dc671f524387464ef486912af1d32d2ca39594a346e17f511050f9ef98e8c20f042c67e367ba60eaa39abdb1d677bb570ed9d05101e17b8441faeb63
TLSH
T170216833B3DD8614CC9A413A10CDAC1036B6C7DB40DECFAB7B84E655A43F699CE61160
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 117fbe9139bdbbb57c14ecfa964a20c3ba304dd5afe149e7fd243df1c7e02fdb
MD5 634573c8a28b09726bdc6eb9a0b92631
SHA1 7b997a0b22c5b04e536406f890b9235aa94d7d99
SHA512 df171a617d2653f0510ba8b01d7a41b7e8157d391f82b36065fdf66c17b93a323c6cf1785fec01b42c72e86b09a2f6444a8eb1aaf098979d3d5fd3626d1c644d
TLSH
T196216833B3DD8624C89A413A10CDAC1036B6C7DB41DECFAB6B84E655A43F699CE61160
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_35ituy3h.ht5.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_35ituy3h.ht5.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

Win-v42.exe

Path C:\Windows\System32\Win-v42.exe
Size 401KB
SHA256 b8a091cb26002b803dc7c04838cae8877e3c8e5d9f9e01f4f3c73e73c2d508bf
MD5 c101ea596d49d01ae2590c461f78e552
SHA1 d915a0345117161348b624afc444b1d5573de397
SHA512 02760f05c2e7b522f8a5a33dd6669b4520992c1b9c53dae193da4add477e4db08a36f7ec9e9ad8b00338abac52cfb9b0a8f7965a2abeb47f5c4e91e15ad7d63d
SSDEEP 6144:tsO/zba+IQbXxFaK6cfyIoT7Oqbv5F0GRdZZpDzS:NH7F6cf6T7Ow5JRd
TLSH
T193948D1AEA643078E1A7D17CCC574902E6B97C4E47A19ACF03D849EA2F27AD09F3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1852-55-0x00007FFF5C7F0000-0x00007FFF5D194000-memory.dmp

Download

memory/1852-59-0x00007FFF5C7F0000-0x00007FFF5D194000-memory.dmp

Download

memory/1852-57-0x00007FFF5C7F0000-0x00007FFF5D194000-memory.dmp

Download

memory/1852-56-0x00007FFF5C7F0000-0x00007FFF5D194000-memory.dmp

Download

memory/1852-60-0x00007FFF5C7F0000-0x00007FFF5D194000-memory.dmp

Download

memory/1852-54-0x00007FFF5C7F0000-0x00007FFF5D194000-memory.dmp

Download

memory/1852-47-0x00007FFF5C7F0000-0x00007FFF5D194000-memory.dmp

Download

memory/1852-46-0x00007FFF5C7F0000-0x00007FFF5D194000-memory.dmp

Download

memory/1852-45-0x00007FFF5C7F0000-0x00007FFF5D194000-memory.dmp

Download

memory/1852-44-0x00007FFF5C7F0000-0x00007FFF5D194000-memory.dmp

Download

memory/1852-43-0x00007FFF5C7F0000-0x00007FFF5D194000-memory.dmp

Download

memory/1852-42-0x00007FFF5C7F0000-0x00007FFF5D194000-memory.dmp

Download

memory/5200-14-0x00007FFF5C7F0000-0x00007FFF5D194000-memory.dmp

Download

memory/5200-23-0x000001929A770000-0x000001929A822000-memory.dmp

Download

memory/5200-29-0x00007FFF5C7F0000-0x00007FFF5D194000-memory.dmp

Download

memory/5200-30-0x00007FFF5C7F0000-0x00007FFF5D194000-memory.dmp

Download

memory/5200-31-0x00007FFF5C7F0000-0x00007FFF5D194000-memory.dmp

Download

memory/5200-32-0x00007FFF5C7F0000-0x00007FFF5D194000-memory.dmp

Download

memory/5200-34-0x00007FFF5C7F0000-0x00007FFF5D194000-memory.dmp

Download

memory/5200-27-0x00007FFF5C7F0000-0x00007FFF5D194000-memory.dmp

Download

memory/5200-25-0x00007FFF5C7F0000-0x00007FFF5D194000-memory.dmp

Download

memory/5200-26-0x00007FFF5C7F0000-0x00007FFF5D194000-memory.dmp

Download

memory/5200-24-0x00000192FFFF0000-0x00000192FFFFA000-memory.dmp

Download

memory/5200-28-0x00007FFF5C7F0000-0x00007FFF5D194000-memory.dmp

Download

memory/5200-22-0x000001929A600000-0x000001929A61E000-memory.dmp

Download

memory/5200-15-0x00007FFF5C7F0000-0x00007FFF5D194000-memory.dmp

Download

memory/5200-0-0x00007FFF5C97F000-0x00007FFF5C980000-memory.dmp

Download

memory/5200-13-0x00007FFF5C7F0000-0x00007FFF5D194000-memory.dmp

Download

memory/5200-12-0x00007FFF5C7F0000-0x00007FFF5D194000-memory.dmp

Download

memory/5200-11-0x00007FFF5C7F0000-0x00007FFF5D194000-memory.dmp

Download

memory/5200-10-0x00007FFF5C7F0000-0x00007FFF5D194000-memory.dmp

Download

memory/5200-9-0x00007FFF5C7F0000-0x00007FFF5D194000-memory.dmp

Download

memory/5200-1-0x0000019300030000-0x0000019300052000-memory.dmp

Download

memory/5200-2-0x00007FFF5C7F0000-0x00007FFF5D194000-memory.dmp

Download