Overview

overview

8

Static

static

3

2026-07-09...er.exe

windows10-2004-x64

8

2026-07-09...er.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    149s
  • max time network
    97s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260706-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    09/07/2026, 01:44

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-09_edb475d5d749cf45c7ae4a9cf262f902_frostygoop_ghostlocker_hive_knight_luca-stealer_salatstealer_sliver.exe
  • Size 2.8MB
  • Sample260709-b6bzesct7v
  • SHA256 3f5f48b17b74e21aee25caec810d337d94da2a726b18e3b763b5f3f233c69dde
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
adwaredefense_evasionexecutionpersistenceransomwarespyware

Malware Config

Signatures

  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Drops file in Drivers directory 3 IoCs
  • Executes dropped EXE 1 IoCs
  • Enumerates connected drives 3 TTPs 2 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

    Using powershell.exe command.

    execution
  • Checks SCSI registry key(s) 3 TTPs 62 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Gathers network information 2 TTPs 2 IoCs

    Uses commandline utility to view network configuration.

  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
    adwarespyware
  • Modifies registry class 38 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 53 IoCs
  • Suspicious use of SendNotifyMessage 40 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 10 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware
  • Views/modifies file attributes 1 TTPs 1 IoCs
    defense_evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-09_edb475d5d749cf45c7ae4a9cf262f902_frostygoop_ghostlocker_hive_knight_luca-stealer_salatstealer_sliver.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-09_edb475d5d749cf45c7ae4a9cf262f902_frostygoop_ghostlocker_hive_knight_luca-stealer_salatstealer_sliver.exe"
    1⤵
    • Drops file in Drivers directory
    • Suspicious use of WriteProcessMemory
    PID:2384
    • C:\Windows\system32\schtasks.exe
      schtasks /Create /TN "MrSync" /TR "\"C:\ProgramData\MrSync\mrsync.exe\" run" /SC ONLOGON /RU SYSTEM /RL HIGHEST /F
      2⤵
      • Scheduled Task/Job: Scheduled Task
      PID:2300
    • C:\Windows\system32\reg.exe
      reg query "HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters" /v DataBasePath
      2⤵
        PID:3408
      • C:\Windows\system32\attrib.exe
        attrib -r -s -h C:\Windows\System32\drivers\etc\hosts
        2⤵
        • Drops file in Drivers directory
        • Views/modifies file attributes
        PID:5688
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell.exe -NoProfile -NonInteractive -Command "$ErrorActionPreference='SilentlyContinue'; $rules = Get-NetFirewallRule -Action Block -Enabled True | Where-Object { @(($_ | Get-NetFirewallAddressFilter).RemoteAddress) -notcontains 'Any' }; if ($rules) { foreach ($r in $rules) { ('REMOVE ' + $r.DisplayName); $r | Remove-NetFirewallRule } } else { 'NONE' }"
        2⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1908
      • C:\Windows\system32\ipconfig.exe
        ipconfig /flushdns
        2⤵
        • Gathers network information
        PID:2428
    • C:\ProgramData\MrSync\mrsync.exe
      "C:\ProgramData\MrSync\mrsync.exe"
      1⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:5164
      • C:\Windows\system32\schtasks.exe
        schtasks /Create /TN "MrSync" /TR "\"C:\ProgramData\MrSync\mrsync.exe\" run" /SC ONLOGON /RU SYSTEM /RL HIGHEST /F
        2⤵
        • Scheduled Task/Job: Scheduled Task
        PID:3140
      • C:\Windows\system32\reg.exe
        reg query "HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters" /v DataBasePath
        2⤵
          PID:3948
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell.exe -NoProfile -NonInteractive -Command "$ErrorActionPreference='SilentlyContinue'; $rules = Get-NetFirewallRule -Action Block -Enabled True | Where-Object { @(($_ | Get-NetFirewallAddressFilter).RemoteAddress) -notcontains 'Any' }; if ($rules) { foreach ($r in $rules) { ('REMOVE ' + $r.DisplayName); $r | Remove-NetFirewallRule } } else { 'NONE' }"
          2⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:3312
        • C:\Windows\system32\ipconfig.exe
          ipconfig /flushdns
          2⤵
          • Gathers network information
          PID:3508
      • C:\Windows\system32\sihost.exe
        sihost.exe
        1⤵
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of WriteProcessMemory
        PID:2820
        • C:\Windows\explorer.exe
          explorer.exe /LOADSAVEDWINDOWS
          2⤵
          • Boot or Logon Autostart Execution: Active Setup
          • Enumerates connected drives
          • Checks SCSI registry key(s)
          • Modifies Internet Explorer settings
          • Modifies registry class
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SendNotifyMessage
          • Suspicious use of SetWindowsHookEx
          PID:1504
      • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
        "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
        1⤵
        • Modifies registry class
        • Suspicious use of SetWindowsHookEx
        PID:5888
      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
        1⤵
        • Modifies registry class
        • Suspicious use of SetWindowsHookEx
        PID:4340

      Network

            MITRE ATT&CK Enterprise v16

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            mrsync.exe
            • Path C:\ProgramData\MrSync\mrsync.exe
            • Size 2.8MB
            • SHA256 3f5f48b17b74e21aee25caec810d337d94da2a726b18e3b763b5f3f233c69dde
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            mrsync.log
            • Path C:\ProgramData\MrSync\mrsync.log
            • Size 603B
            • SHA256 2120312ab706f5ec3fffa5b6bb44c4b6f1f0b42153b43a328a1a4144a9762f76
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            mrsync.log
            • Path C:\ProgramData\MrSync\mrsync.log
            • Size 1009B
            • SHA256 71d9c6066b8040689f972c61384e03b14e70afcbf30b4dd2a120956f0821d953
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            StartupProfileData-NonInteractive
            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
            • Size 1KB
            • SHA256 9c538fd0cb2b6fb228d2708a8a2226c83d5433d2566ef1a083f8b4d224fa6e51
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            prep_Activatable Class_Hermes_perf.cache
            • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
            • Size 599B
            • SHA256 b536a3dae9ea5c69081f0491eed829e3b57e32401fdf49a63031bcd6b20e6fdb
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            __PSScriptPolicyTest_zxknfahb.33d.ps1
            • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_zxknfahb.33d.ps1
            • Size 60B
            • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            hosts
            • Path C:\Windows\System32\drivers\etc\hosts
            • Size 803B
            • SHA256 f54b219602f3fb55f972a784ce99153845ba6f4fae3e75a4e4c8958c7688244f
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            memory/1908-38-0x00007FFFDE2D0000-0x00007FFFDEC74000-memory.dmp
            Download

            memory/1908-14-0x00007FFFDE2D0000-0x00007FFFDEC74000-memory.dmp
            Download

            memory/1908-20-0x00007FFFDE2D0000-0x00007FFFDEC74000-memory.dmp
            Download

            memory/1908-21-0x00007FFFDE2D0000-0x00007FFFDEC74000-memory.dmp
            Download

            memory/1908-22-0x00007FFFDE2D0000-0x00007FFFDEC74000-memory.dmp
            Download

            memory/1908-25-0x0000025B78800000-0x0000025B7881E000-memory.dmp
            Download

            memory/1908-26-0x0000025B78A50000-0x0000025B78B02000-memory.dmp
            Download

            memory/1908-17-0x00007FFFDE2D0000-0x00007FFFDEC74000-memory.dmp
            Download

            memory/1908-28-0x0000025B78820000-0x0000025B7882A000-memory.dmp
            Download

            memory/1908-30-0x0000025B78FA0000-0x0000025B78FBE000-memory.dmp
            Download

            memory/1908-16-0x00007FFFDE2D0000-0x00007FFFDEC74000-memory.dmp
            Download

            memory/1908-9-0x00007FFFDE45F000-0x00007FFFDE460000-memory.dmp
            Download

            memory/1908-35-0x0000025B78FC0000-0x0000025B78FDA000-memory.dmp
            Download

            memory/1908-34-0x0000025B78B10000-0x0000025B78B1E000-memory.dmp
            Download

            memory/1908-19-0x00007FFFDE2D0000-0x00007FFFDEC74000-memory.dmp
            Download

            memory/1908-18-0x00007FFFDE2D0000-0x00007FFFDEC74000-memory.dmp
            Download

            memory/1908-13-0x0000025B78770000-0x0000025B78792000-memory.dmp
            Download

            memory/1908-43-0x00007FFFDE2D0000-0x00007FFFDEC74000-memory.dmp
            Download

            memory/1908-15-0x00007FFFDE2D0000-0x00007FFFDEC74000-memory.dmp
            Download

            memory/1908-47-0x00007FFFDE2D0000-0x00007FFFDEC74000-memory.dmp
            Download

            memory/1908-39-0x00007FFFDE2D0000-0x00007FFFDEC74000-memory.dmp
            Download

            memory/1908-51-0x00007FFFDE2D0000-0x00007FFFDEC74000-memory.dmp
            Download

            memory/1908-40-0x00007FFFDE2D0000-0x00007FFFDEC74000-memory.dmp
            Download

            memory/1908-10-0x00007FFFDE2D0000-0x00007FFFDEC74000-memory.dmp
            Download

            memory/5888-78-0x0000021E001E0000-0x0000021E002E0000-memory.dmp
            Download

            memory/5888-124-0x0000021E14710000-0x0000021E14730000-memory.dmp
            Download

            memory/5888-110-0x0000021E03C90000-0x0000021E03CB0000-memory.dmp
            Download

            memory/5888-80-0x0000021E001E0000-0x0000021E002E0000-memory.dmp
            Download

            memory/5888-92-0x0000021E03A50000-0x0000021E03A70000-memory.dmp
            Download

            memory/5888-94-0x0000021E13E90000-0x0000021E13F90000-memory.dmp
            Download