Analysis
- max time kernel
149s - max time network
123s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260706-en - resource tags
- submitted
08/07/2026, 04:39
General
- Target 2026-07-08_50cf5b4eb0b43d08455a381b05f4a4d3_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
- Size 11.3MB
- Sample260708-e9yjdabx2q
- SHA256 34ad97945a1f70cdbf8af7777a6c71c990d841840cf3c94a387f6cc83450ad4b
Malware Config
Signatures
- Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- Command and Scripting Interpreter: PowerShell 1 TTPs 8 IoCs
Using powershell.exe command.
- Gathers system information 1 TTPs 1 IoCs
Runs systeminfo.exe.
- Interacts with shadow copies 3 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
- Kills process with taskkill 1 IoCs
- Modifies registry key 1 TTPs 6 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of WriteProcessMemory 18 IoCs
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-08_50cf5b4eb0b43d08455a381b05f4a4d3_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-08_50cf5b4eb0b43d08455a381b05f4a4d3_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Invoke-CimMethod -ClassName Win32_ShadowCopy -MethodName Create -Arguments @{Volume=\"C:\\\"; Context=\"ClientAccessible\"}"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Get-CimInstance Win32_ShadowCopy | Where-Object { $_.ID -eq '{A7B380C5-D6A1-4FB0-9C8B-8D6114C87AB0}' } | Select-Object -ExpandProperty DeviceObject"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\systeminfo.exesysteminfo2⤵
- Gathers system information
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Get-WmiObject Win32_Processor | Select-Object -ExpandProperty Name"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Get-WmiObject Win32_Processor | Select-Object -ExpandProperty NumberOfCores"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Get-WmiObject Win32_VideoController | Select-Object -ExpandProperty Name"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Get-WmiObject Win32_OperatingSystem | Select-Object -ExpandProperty TotalVisibleMemorySize"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Get-CimInstance Win32_VideoController | Where-Object { $_.CurrentHorizontalResolution -gt 0 -and $_.CurrentVerticalResolution -gt 0 } | Select-Object Name, CurrentHorizontalResolution, CurrentVerticalResolution, CurrentRefreshRate, DeviceID | ConvertTo-Json"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\curl.execurl -s http://ip-api.com/json/85.203.46.1572⤵
-
-
C:\Windows\system32\taskkill.exetaskkill /F /IM ms-teams.exe2⤵
- Kills process with taskkill
-
-
C:\Windows\system32\reg.exereg query HKCU\Software\TigerVNC\WinVNC4 /v Password2⤵
- Modifies registry key
-
-
C:\Windows\system32\reg.exereg query HKCU\Software\TightVNC\Server /v Password2⤵
- Modifies registry key
-
-
C:\Windows\system32\reg.exereg query HKCU\Software\TightVNC\Server /v ControlPassword2⤵
- Modifies registry key
-
-
C:\Windows\system32\reg.exereg query HKLM\SOFTWARE\TightVNC\Server /v Password2⤵
- Modifies registry key
-
-
C:\Windows\system32\reg.exereg query HKLM\SOFTWARE\RealVNC\vncserver /v Password2⤵
- Modifies registry key
-
-
C:\Windows\system32\reg.exereg query HKLM\SOFTWARE\TightVNC\Server /v ControlPassword2⤵
- Modifies registry key
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "vssadmin delete shadows /shadow=\"{A7B380C5-D6A1-4FB0-9C8B-8D6114C87AB0}\" /quiet"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\vssadmin.exe"C:\Windows\system32\vssadmin.exe" delete shadows /shadow={A7B380C5-D6A1-4FB0-9C8B-8D6114C87AB0} /quiet3⤵
- Interacts with shadow copies
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
1PowerShell
1Windows Management Instrumentation
1Defense Evasion
Direct Volume Access
1Indicator Removal
2File Deletion
2Modify Registry
1Replay Monitor
Loading Replay Monitor...
Downloads
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
CURRENT
MANIFEST-000001
Web Data_chrome_default_7.temp
Web Data_microsoft_edge_default_7.temp
__PSScriptPolicyTest_1d3zdba1.lh2.ps1
memory/1272-164-0x0000023020A90000-0x0000023020B42000-memory.dmp
memory/1272-165-0x0000023021180000-0x0000023021342000-memory.dmp
memory/1272-166-0x0000023021880000-0x0000023021DA8000-memory.dmp
memory/5720-12-0x00000168FF830000-0x00000168FF84E000-memory.dmp
memory/5720-14-0x00000168FF8B0000-0x00000168FF962000-memory.dmp
memory/5720-20-0x00007FFA2D980000-0x00007FFA2E324000-memory.dmp
memory/5720-22-0x00007FFA2D980000-0x00007FFA2E324000-memory.dmp
memory/5720-18-0x00007FFA2D980000-0x00007FFA2E324000-memory.dmp
memory/5720-16-0x00000168FF970000-0x00000168FF99A000-memory.dmp
memory/5720-17-0x00000168FF970000-0x00000168FF994000-memory.dmp
memory/5720-15-0x00000168FF850000-0x00000168FF85A000-memory.dmp
memory/5720-13-0x00007FFA2D980000-0x00007FFA2E324000-memory.dmp
memory/5720-19-0x00007FFA2D980000-0x00007FFA2E324000-memory.dmp
memory/5720-0-0x00007FFA2DB0F000-0x00007FFA2DB10000-memory.dmp
memory/5720-9-0x00007FFA2D980000-0x00007FFA2E324000-memory.dmp
memory/5720-8-0x00007FFA2D980000-0x00007FFA2E324000-memory.dmp
memory/5720-7-0x00007FFA2D980000-0x00007FFA2E324000-memory.dmp
memory/5720-6-0x00007FFA2D980000-0x00007FFA2E324000-memory.dmp
memory/5720-5-0x00007FFA2D980000-0x00007FFA2E324000-memory.dmp
memory/5720-2-0x00000168E7550000-0x00000168E7572000-memory.dmp
memory/5720-1-0x00007FFA2D980000-0x00007FFA2E324000-memory.dmp