7dcc113684fe5bd9355866a59f4a901929ff5d07fb47a05d6c186d1e7b3f444f

Analysis

max time kernel
148s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
16/07/2026, 13:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
7dcc113684fe5bd9355866a59f4a901929ff5d07fb47a05d6c186d1e7b3f444f.exe
Size 13.2MB
Sample260716-qqwffset9q
SHA256 7dcc113684fe5bd9355866a59f4a901929ff5d07fb47a05d6c186d1e7b3f444f
MD5 d0b9a7237d435da44acdf3f159b2211c
SHA1 05b771a0ec063a2b04d4befc87f13b71ea08a3f8
SHA512 2f46eb85b97c5e3d76c813f2448e1a49726df86509b9959c1fb1268b2df7d0dc6c666c63f7b4152387ec307f8447806c1b87d9374beee051e4b3fc9d0406b1ea
SSDEEP 98304:jv8U1r5wAZxZo7TLCizQ47syzUMx7Agf2y4malGgGvjQjw50GE:7r9wWxZ0TLC8spGbMmy9rj
TLSH
T1A0D63947EDA606E8C0AED535CA2695537B713C995B3023D31B90FA243F36BE06EB9704
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion execution persistence spyware stealer trojan

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
3360	FontCacheSvc.exe
1224	FontCacheSvc.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\FontCacheSvc = "C:\\Users\\Admin\\AppData\\Local\\fontdrv\\FontCacheSvc.exe"	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\FontCacheSvc = "C:\\Users\\Admin\\AppData\\Local\\fontdrv\\FontCacheSvc.exe"	powershell.exe

Looks up external IP address via web service 3 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
22	api.ipify.org
18	api.ipify.org
19	api.ipify.org

Command and Scripting Interpreter: PowerShell 1 TTPs 6 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
2672	powershell.exe
4536	powershell.exe
1428	powershell.exe
4616	powershell.exe
1432	powershell.exe
3320	powershell.exe

Kills process with taskkill 20 IoCs

defense_evasion

pid	Process
3084	taskkill.exe
2540	taskkill.exe
4980	taskkill.exe
4720	taskkill.exe
2092	taskkill.exe
1868	taskkill.exe
4552	taskkill.exe
3760	taskkill.exe
2772	taskkill.exe
4816	taskkill.exe
376	taskkill.exe
3708	taskkill.exe
4932	taskkill.exe
4404	taskkill.exe
4880	taskkill.exe
1568	taskkill.exe
4848	taskkill.exe
2824	taskkill.exe
3288	taskkill.exe
1188	taskkill.exe

Modifies system certificate store 2 TTPs 5 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1CBCA5DB2D52A7F693B674DE5F05A1D0C957DF0	FontCacheSvc.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1CBCA5DB2D52A7F693B674DE5F05A1D0C957DF0\Blob = 0f00000001000000300000000b043572c899dec43efd590cfce610cf443a6315925ebfe589f7506907e44824608489581c7ca0e041458514cf157614090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c06200000001000000200000004ff460d54b9c86dabfbcfc5712e0400d2bed3fbc4d4fbdaa86e06adcd2a9ad7a0b00000001000000180000005300650063007400690067006f00200045004300430000001400000001000000140000003ae10986d4cf19c29676744976dce035c663639a1d0000000100000010000000280cf6042c30a2646644ba7286a3aa97030000000100000014000000d1cbca5db2d52a7f693b674de5f05a1d0c957df02000000001000000930200003082028f30820215a00302010202105c8b99c55a94c5d27156decd8980cc26300a06082a8648ce3d040303308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374204543432043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374204543432043657274696669636174696f6e20417574686f726974793076301006072a8648ce3d020106052b81040022036200041aac545aa9f96823e77ad5246f53c65ad84babc6d5b6d1e67371aedd9cd60c61fddba08903b80514ec57ceee5d3fe221b3cef7d48a79e0a3837e2d97d061c4f199dc259163ab7f30a3b470e2c7a1339cf3bf2e5c53b15fb37d327f8a34e37979a3423040301d0603551d0e041604143ae10986d4cf19c29676744976dce035c663639a300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300a06082a8648ce3d040303036800306502303667a11608dce49700411d4ebee16301cf3baa421164a09d94390211795c7b1dfa64b9ee1642b3bf8ac209c4ece4b14d023100e92a61478c524a4b4e1870f6d644d66ef583ba6d58bd24d95648eaefc4a24681886a3a46d1a99b4dc961dad15d576a18	FontCacheSvc.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1CBCA5DB2D52A7F693B674DE5F05A1D0C957DF0\Blob = 040000000100000010000000fa68bcd9b57fadfdc91d068328cc24c1030000000100000014000000d1cbca5db2d52a7f693b674de5f05a1d0c957df01d0000000100000010000000280cf6042c30a2646644ba7286a3aa971400000001000000140000003ae10986d4cf19c29676744976dce035c663639a0b00000001000000180000005300650063007400690067006f00200045004300430000006200000001000000200000004ff460d54b9c86dabfbcfc5712e0400d2bed3fbc4d4fbdaa86e06adcd2a9ad7a53000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f00000001000000300000000b043572c899dec43efd590cfce610cf443a6315925ebfe589f7506907e44824608489581c7ca0e041458514cf1576142000000001000000930200003082028f30820215a00302010202105c8b99c55a94c5d27156decd8980cc26300a06082a8648ce3d040303308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374204543432043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374204543432043657274696669636174696f6e20417574686f726974793076301006072a8648ce3d020106052b81040022036200041aac545aa9f96823e77ad5246f53c65ad84babc6d5b6d1e67371aedd9cd60c61fddba08903b80514ec57ceee5d3fe221b3cef7d48a79e0a3837e2d97d061c4f199dc259163ab7f30a3b470e2c7a1339cf3bf2e5c53b15fb37d327f8a34e37979a3423040301d0603551d0e041604143ae10986d4cf19c29676744976dce035c663639a300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300a06082a8648ce3d040303036800306502303667a11608dce49700411d4ebee16301cf3baa421164a09d94390211795c7b1dfa64b9ee1642b3bf8ac209c4ece4b14d023100e92a61478c524a4b4e1870f6d644d66ef583ba6d58bd24d95648eaefc4a24681886a3a46d1a99b4dc961dad15d576a18	FontCacheSvc.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1CBCA5DB2D52A7F693B674DE5F05A1D0C957DF0\Blob = 19000000010000001000000076935b5c5a037216daaf8aac76df42c10f00000001000000300000000b043572c899dec43efd590cfce610cf443a6315925ebfe589f7506907e44824608489581c7ca0e041458514cf157614090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c06200000001000000200000004ff460d54b9c86dabfbcfc5712e0400d2bed3fbc4d4fbdaa86e06adcd2a9ad7a0b00000001000000180000005300650063007400690067006f00200045004300430000001400000001000000140000003ae10986d4cf19c29676744976dce035c663639a1d0000000100000010000000280cf6042c30a2646644ba7286a3aa97030000000100000014000000d1cbca5db2d52a7f693b674de5f05a1d0c957df0040000000100000010000000fa68bcd9b57fadfdc91d068328cc24c12000000001000000930200003082028f30820215a00302010202105c8b99c55a94c5d27156decd8980cc26300a06082a8648ce3d040303308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374204543432043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374204543432043657274696669636174696f6e20417574686f726974793076301006072a8648ce3d020106052b81040022036200041aac545aa9f96823e77ad5246f53c65ad84babc6d5b6d1e67371aedd9cd60c61fddba08903b80514ec57ceee5d3fe221b3cef7d48a79e0a3837e2d97d061c4f199dc259163ab7f30a3b470e2c7a1339cf3bf2e5c53b15fb37d327f8a34e37979a3423040301d0603551d0e041604143ae10986d4cf19c29676744976dce035c663639a300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300a06082a8648ce3d040303036800306502303667a11608dce49700411d4ebee16301cf3baa421164a09d94390211795c7b1dfa64b9ee1642b3bf8ac209c4ece4b14d023100e92a61478c524a4b4e1870f6d644d66ef583ba6d58bd24d95648eaefc4a24681886a3a46d1a99b4dc961dad15d576a18	FontCacheSvc.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1CBCA5DB2D52A7F693B674DE5F05A1D0C957DF0\Blob = 5c000000010000000400000080010000040000000100000010000000fa68bcd9b57fadfdc91d068328cc24c1030000000100000014000000d1cbca5db2d52a7f693b674de5f05a1d0c957df01d0000000100000010000000280cf6042c30a2646644ba7286a3aa971400000001000000140000003ae10986d4cf19c29676744976dce035c663639a0b00000001000000180000005300650063007400690067006f00200045004300430000006200000001000000200000004ff460d54b9c86dabfbcfc5712e0400d2bed3fbc4d4fbdaa86e06adcd2a9ad7a53000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f00000001000000300000000b043572c899dec43efd590cfce610cf443a6315925ebfe589f7506907e44824608489581c7ca0e041458514cf15761419000000010000001000000076935b5c5a037216daaf8aac76df42c12000000001000000930200003082028f30820215a00302010202105c8b99c55a94c5d27156decd8980cc26300a06082a8648ce3d040303308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374204543432043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374204543432043657274696669636174696f6e20417574686f726974793076301006072a8648ce3d020106052b81040022036200041aac545aa9f96823e77ad5246f53c65ad84babc6d5b6d1e67371aedd9cd60c61fddba08903b80514ec57ceee5d3fe221b3cef7d48a79e0a3837e2d97d061c4f199dc259163ab7f30a3b470e2c7a1339cf3bf2e5c53b15fb37d327f8a34e37979a3423040301d0603551d0e041604143ae10986d4cf19c29676744976dce035c663639a300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300a06082a8648ce3d040303036800306502303667a11608dce49700411d4ebee16301cf3baa421164a09d94390211795c7b1dfa64b9ee1642b3bf8ac209c4ece4b14d023100e92a61478c524a4b4e1870f6d644d66ef583ba6d58bd24d95648eaefc4a24681886a3a46d1a99b4dc961dad15d576a18	FontCacheSvc.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
1432	powershell.exe
1432	powershell.exe
3320	powershell.exe
3320	powershell.exe
2672	powershell.exe
2672	powershell.exe
4536	powershell.exe
4536	powershell.exe
1428	powershell.exe
1428	powershell.exe
4616	powershell.exe
4616	powershell.exe

Suspicious use of AdjustPrivilegeToken 25 IoCs

description	pid	Process
Token: SeDebugPrivilege	1432	powershell.exe
Token: SeDebugPrivilege	4880	taskkill.exe
Token: SeDebugPrivilege	4980	taskkill.exe
Token: SeDebugPrivilege	3320	powershell.exe
Token: SeDebugPrivilege	4552	taskkill.exe
Token: SeDebugPrivilege	1568	taskkill.exe
Token: SeDebugPrivilege	3760	taskkill.exe
Token: SeDebugPrivilege	4720	taskkill.exe
Token: SeDebugPrivilege	2772	taskkill.exe
Token: SeDebugPrivilege	4816	taskkill.exe
Token: SeDebugPrivilege	376	taskkill.exe
Token: SeDebugPrivilege	3708	taskkill.exe
Token: SeDebugPrivilege	2092	taskkill.exe
Token: SeDebugPrivilege	4932	taskkill.exe
Token: SeDebugPrivilege	1868	taskkill.exe
Token: SeDebugPrivilege	4404	taskkill.exe
Token: SeDebugPrivilege	3084	taskkill.exe
Token: SeDebugPrivilege	4848	taskkill.exe
Token: SeDebugPrivilege	2824	taskkill.exe
Token: SeDebugPrivilege	1188	taskkill.exe
Token: SeDebugPrivilege	2540	taskkill.exe
Token: SeDebugPrivilege	2672	powershell.exe
Token: SeDebugPrivilege	4536	powershell.exe
Token: SeDebugPrivilege	1428	powershell.exe
Token: SeDebugPrivilege	4616	powershell.exe

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 4736 wrote to memory of 4220	4736	7dcc113684fe5bd9355866a59f4a901929ff5d07fb47a05d6c186d1e7b3f444f.exe	85
PID 4220 wrote to memory of 1432	4220	7dcc113684fe5bd9355866a59f4a901929ff5d07fb47a05d6c186d1e7b3f444f.exe	86
PID 4220 wrote to memory of 4880	4220	7dcc113684fe5bd9355866a59f4a901929ff5d07fb47a05d6c186d1e7b3f444f.exe	88
PID 4220 wrote to memory of 4980	4220	7dcc113684fe5bd9355866a59f4a901929ff5d07fb47a05d6c186d1e7b3f444f.exe	92
PID 3360 wrote to memory of 1224	3360	FontCacheSvc.exe	95
PID 1224 wrote to memory of 3320	1224	FontCacheSvc.exe	96
PID 4220 wrote to memory of 4552	4220	7dcc113684fe5bd9355866a59f4a901929ff5d07fb47a05d6c186d1e7b3f444f.exe	98
PID 4220 wrote to memory of 1568	4220	7dcc113684fe5bd9355866a59f4a901929ff5d07fb47a05d6c186d1e7b3f444f.exe	100
PID 1224 wrote to memory of 3760	1224	FontCacheSvc.exe	102
PID 4220 wrote to memory of 4720	4220	7dcc113684fe5bd9355866a59f4a901929ff5d07fb47a05d6c186d1e7b3f444f.exe	104
PID 1224 wrote to memory of 2772	1224	FontCacheSvc.exe	106
PID 4220 wrote to memory of 4816	4220	7dcc113684fe5bd9355866a59f4a901929ff5d07fb47a05d6c186d1e7b3f444f.exe	108
PID 1224 wrote to memory of 376	1224	FontCacheSvc.exe	110
PID 4220 wrote to memory of 3708	4220	7dcc113684fe5bd9355866a59f4a901929ff5d07fb47a05d6c186d1e7b3f444f.exe	112
PID 1224 wrote to memory of 2092	1224	FontCacheSvc.exe	114
PID 4220 wrote to memory of 4932	4220	7dcc113684fe5bd9355866a59f4a901929ff5d07fb47a05d6c186d1e7b3f444f.exe	116
PID 1224 wrote to memory of 1868	1224	FontCacheSvc.exe	118
PID 4220 wrote to memory of 4404	4220	7dcc113684fe5bd9355866a59f4a901929ff5d07fb47a05d6c186d1e7b3f444f.exe	120
PID 1224 wrote to memory of 3084	1224	FontCacheSvc.exe	122
PID 4220 wrote to memory of 4848	4220	7dcc113684fe5bd9355866a59f4a901929ff5d07fb47a05d6c186d1e7b3f444f.exe	124
PID 1224 wrote to memory of 2824	1224	FontCacheSvc.exe	126
PID 1224 wrote to memory of 3288	1224	FontCacheSvc.exe	128
PID 1224 wrote to memory of 1188	1224	FontCacheSvc.exe	130
PID 1224 wrote to memory of 2540	1224	FontCacheSvc.exe	132
PID 4220 wrote to memory of 2672	4220	7dcc113684fe5bd9355866a59f4a901929ff5d07fb47a05d6c186d1e7b3f444f.exe	135
PID 4220 wrote to memory of 4536	4220	7dcc113684fe5bd9355866a59f4a901929ff5d07fb47a05d6c186d1e7b3f444f.exe	139
PID 1224 wrote to memory of 1428	1224	FontCacheSvc.exe	141
PID 1224 wrote to memory of 4616	1224	FontCacheSvc.exe	143

C:\Users\Admin\AppData\Local\Temp\7dcc113684fe5bd9355866a59f4a901929ff5d07fb47a05d6c186d1e7b3f444f.exe
"C:\Users\Admin\AppData\Local\Temp\7dcc113684fe5bd9355866a59f4a901929ff5d07fb47a05d6c186d1e7b3f444f.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4736
- C:\Users\Admin\AppData\Local\Temp\7dcc113684fe5bd9355866a59f4a901929ff5d07fb47a05d6c186d1e7b3f444f.exe
  C:\Users\Admin\AppData\Local\Temp\7dcc113684fe5bd9355866a59f4a901929ff5d07fb47a05d6c186d1e7b3f444f.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4220
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -NonInteractive -ExecutionPolicy Bypass -File C:\Users\Admin\AppData\Local\Temp\ps_1784208515593462800.ps1
    3⤵
    - Adds Run key to start application
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1432
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM Discord.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4880
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM DiscordPTB.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4980
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM DiscordCanary.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4552
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM DiscordDevelopment.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1568
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM chrome.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4720
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM msedge.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4816
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM brave.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3708
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM opera.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4932
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM vivaldi.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4404
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM firefox.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4848
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -NonInteractive -ExecutionPolicy Bypass -File C:\Users\Admin\AppData\Local\Temp\ps_1784208523292590100.ps1
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2672
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -NonInteractive -ExecutionPolicy Bypass -File C:\Users\Admin\AppData\Local\Temp\ps_1784208523687185500.ps1
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4536

C:\Users\Admin\AppData\Local\fontdrv\FontCacheSvc.exe
C:\Users\Admin\AppData\Local\fontdrv\FontCacheSvc.exe
1⤵
- Executes dropped EXE
- Modifies system certificate store
- Suspicious use of WriteProcessMemory
PID:3360
- C:\Users\Admin\AppData\Local\fontdrv\FontCacheSvc.exe
  C:\Users\Admin\AppData\Local\fontdrv\FontCacheSvc.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:1224
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -NonInteractive -ExecutionPolicy Bypass -File C:\Users\Admin\AppData\Local\Temp\ps_1784208516641445300.ps1
    3⤵
    - Adds Run key to start application
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3320
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM Discord.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3760
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM DiscordPTB.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2772
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM DiscordCanary.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:376
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM DiscordDevelopment.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2092
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM chrome.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1868
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM msedge.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3084
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM brave.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2824
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM opera.exe
    3⤵
    - Kills process with taskkill
    PID:3288
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM vivaldi.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1188
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM firefox.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2540
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -NonInteractive -ExecutionPolicy Bypass -File C:\Users\Admin\AppData\Local\Temp\ps_1784208523869988100.ps1
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1428
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -NonInteractive -ExecutionPolicy Bypass -File C:\Users\Admin\AppData\Local\Temp\ps_1784208524176071000.ps1
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4616

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 b1f292b6199aa29c7fafbca007e5f9e3f68edcbbca1965bc828cc92dc0f18bb8
MD5 6cf293cb4d80be23433eecf74ddb5503
SHA1 24fe4752df102c2ef492954d6b046cb5512ad408
SHA512 0f91e2da0da8794b9797c7b50eb5dfd27bde4546ceb6902a776664ce887dd6f12a0dd8773d612ccc76dfd029cd280778a0f0ae17ce679b3d2ffd968dd7e94a00
TLSH
T148510F323375F1E4C8567F071E68198053BF4395EA94AF5CB298621ED92741B8F222F3
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 213e57d0a1782a50d8e7155cff58cdd45385e6c4e3e8b3445f2b03f7ce4adcb8
MD5 02d0433a7e5f54b65167265590cf4202
SHA1 6c697cc9d889666825d0c2bd4a979bff73930912
SHA512 5adbd05d02d0e461be3d850c1200be000c398cebfeb3e3909cd9e0ac56ad3cb69d6bac63dc4aabdc457c9b5427884e0abaf8d3534a0951f8d8e56f3caa3872f0
TLSH
T1A9218627B3DC89A0CC86163A80ADAC2136B693C7409ECEDF6BC0C214E1AF588CB61190
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 64B
SHA256 1f3711df6686fdabe769d41fda005dbbad865ce09d26715c00bc3bc385ad99e4
MD5 2f56593c4c7976dc20c4b9c40a9bc20c
SHA1 a0ad8441e69651f819c93e1459a774c346bc66d1
SHA512 2610b3a3dd6e45d59d5b25a5cf96b77ec84bf5f1abc119f5e0c91714a3b8b2644e285bb0dbc53b27e3ee1164aba432592d0f3a3c3e26e76025e0abc17e63b8d1
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 64B
SHA256 a7de5177c68a64bd48b36d49e2853799f4ebcfa8e4761f7cc472f333dc5f65cf
MD5 446dd1cf97eaba21cf14d03aebc79f27
SHA1 36e4cc7367e0c7b40f4a8ace272941ea46373799
SHA512 a6d754709f30b122112ae30e5ab22486393c5021d33da4d1304c061863d2e1e79e8aeb029cae61261bb77d0e7becd53a7b0106d6ea4368b4c302464e3d941cf7
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 3eeddef35412c2fba73d2e671ff394c2533b8467817f666636941441faf06aac
MD5 848e15fd2a4b3a62bb904a58b1070122
SHA1 69f9e6e21e2dbcbf5b0236e9788fa610d124e734
SHA512 122f76477232588ba9146d1e636d4b7d8309c45ed33fb703fa854398a4ea5fdfd920639a102b578b80d31f934bfc30f68c78c7ea651fec67803f3f0f0f911ef6
TLSH
T166215627B3DC89A1CC86163A909DAC1176B693D7409EDEDF6BC4C214E1AF598CB61190
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_ojnbogj4.mxs.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ojnbogj4.mxs.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

ps_1784208515593462800.ps1

Path C:\Users\Admin\AppData\Local\Temp\ps_1784208515593462800.ps1
Size 193B
SHA256 b460d5734bc056cb0c3db40e6114951d66f3112095a4454302268d20a288a61a
MD5 0520bbd7f245b806c7440b3b862d2960
SHA1 a111de2913dda3025fbc80a5535cf1fedcee0bb7
SHA512 6a680b3505cac7b8884dc253820c3592d0b551774abd094bf0aa8b5502dc4b29374e84d6d6af435d4d7da866952e4b6561c95a1489bfca098d21545b32fb6bee
TLSH
T13CC02283F2828AFB92E45266348E28008CE5A3CE102A12001301800016CA918E8EB2D6
MD5 SHA1 SHA512 TLSH

Submit Download

ps_1784208523292590100.ps1

Path C:\Users\Admin\AppData\Local\Temp\ps_1784208523292590100.ps1
Size 641B
SHA256 cb70ecf0f36cafc7dd42a4ba25fa25d99aae9c4d85456ee92148afda7b5f5321
MD5 0f3350ad6d6b530c53a920c350ca940b
SHA1 cdbb52dadd349f674f7443b95c5f6b9450335373
SHA512 1d4805c989c144eeb5023da94e4ad36b3c7dcdc22e0d7542e1419caf4d3d56e4b11920626d5c38da60659717ac8bdd4428f53a809950c911d61c0aa6837801d7
TLSH
T1B8F023341714AC9F03E00B91402DD0DA6F78812B22C13C65BFE62202B15508FEE330DD
MD5 SHA1 SHA512 TLSH

Submit Download

ps_1784208523687185500.ps1

Path C:\Users\Admin\AppData\Local\Temp\ps_1784208523687185500.ps1
Size 1KB
SHA256 ed1b19ec1c97d9dd00019d9d6dae9e6f2f1bb2a75a5ae1e3df1ca4460a696920
MD5 2f78287748fe9fba4545680d2bd4ab4b
SHA1 7c035823adb865b627399e0b1f5f92ce718e56f5
SHA512 2a22dbb29e25800dc3ea9b0a1680fd5b127571db6a8af46484f38dbcefc059f9e6b43887d54c8e1f650c2b41000ed0e2a0a161944dfb03fc0fa004faece7fd37
TLSH
T10A31CF51754BC96C518320A2342CE44CFA649A7CC3D83DF483F999D8E0DD6DCC2BE515
MD5 SHA1 SHA512 TLSH

Submit Download

veil_debug.txt

Path C:\Users\Admin\AppData\Local\Temp\veil_debug.txt
Size 3KB
SHA256 f03c06745271af53072e6367a3b2c7c766b62df474a5f7bbf00f40b254ef8fba
MD5 adea2fd4c1c796723e1664970edf8673
SHA1 b44d7c090f6456ccb43a69b8f97dfc224fcb1071
SHA512 ca6bd891a4aaa42654672bd980d6704a89e6aca0010794a36e645b938b621dfc0722a16a23bfc2d68772051502ac5b6daf58e14169de2345ed554697fc3ea3c2
TLSH
T1A05199F201C7980D8546847AB511F9D99330684A2F9FB7E8CB2CD55CAACA80EE6C1DC3
MD5 SHA1 SHA512 TLSH

Submit Download

veil_debug.txt

Path C:\Users\Admin\AppData\Local\Temp\veil_debug.txt
Size 3KB
SHA256 a8e0a9f53bb188e6c713e548f499300af33de46db28a1c673ce6dec5b64973d3
MD5 bc9add4b3875af199c64227b7403f6e1
SHA1 97793fe6955deb5d52e70e19b623813b8f9bc202
SHA512 74403ed583f717af993bf0f58b452d09eeb04a7f4651aa71be88ed1c6d1d3ea79e61e63c9290d67a7bc892f26945253403bb068b41f47e7a2560d3abcccdf437
TLSH
T13E81FDF201D7A90D4586457BB511FDC99330658A5F8FB7E48B2CE55C6ADA80DE2C0DC3
MD5 SHA1 SHA512 TLSH

Submit Download

veil_debug.txt

Path C:\Users\Admin\AppData\Local\Temp\veil_debug.txt
Size 50B
SHA256 808e4acb2a0732795a78cbdade3873782ed9b9a16f1df03b391f9ed3f9ad591e
MD5 43ed9a466641dbad1b9f72d7702f584d
SHA1 31536ea899dd0675e26b00f65cbc457d2f17a620
SHA512 1a81399a647565414fb5f799a5919a4f0c23d0572bdc2a267c58e61fcb7418f36b62554fcb8d2e116bb3e0f04907ec55b9d25ca34a35699c7600a81579fb6545
MD5 SHA1 SHA512

Submit Download

veil_debug.txt

Path C:\Users\Admin\AppData\Local\Temp\veil_debug.txt
Size 76B
SHA256 e16628dc22685e05be780a521257150943f1aba444c709f0bffdc24d6c156010
MD5 4558e47e61f2cde87fb358c40821bd1d
SHA1 805db587a7579b62c2f37fc314608a009e249906
SHA512 fa03ed1e47cd02642440ef19135a270e6a24b73c418a103519ed913ffd1910c3efce63c89782fcc3ab31a1eb3c2e8cb90182b0d413ca74a73a16c8a426ff3749
TLSH
T1A1A001A0626A24041E93488EDA10A23B1BC44214024832F20BAE6402AB6200B09E2019
MD5 SHA1 SHA512 TLSH

Submit Download

veil_debug.txt

Path C:\Users\Admin\AppData\Local\Temp\veil_debug.txt
Size 1018B
SHA256 32baf55985be16c3ba1553bbea2208c205f8f8ac4b401ef6681a51743af54e40
MD5 e3deb3232ebfe60e50cc43389c1c2e31
SHA1 cba378c6d2fed3bfdf79e583f7fe8a5c34ed0c08
SHA512 f05c60bc5df6607a7a6f3f22ba37a0188fd66936c84e4d4353433a517dbf0e0bf358e6e38e894dbb3817104f23dbb246418b330f310ed852e4079590054d8c22
TLSH
T1FC119DF206C7980C4545457EF521F9D9A331590A2E9EB7E8CB2CD48CAAC580EE5C1CC3
MD5 SHA1 SHA512 TLSH

Submit Download

veil_debug.txt

Path C:\Users\Admin\AppData\Local\Temp\veil_debug.txt
Size 1KB
SHA256 08b61dd567b730f207120408cf5681d64ee745c092c0bf8fb3fa719a8aee2d05
MD5 b9fc5baa9a4803841e0461e7affe57c8
SHA1 11003345e4e619849daefc3efa2a16a25b08a3b2
SHA512 7b46f7989784c57db9799cd89e966c53d18d8a28d2e09d2043084faed3ba5dd532cab46116ffc6440d3e6f753b276bd39afd73aaa0575ab1ac41b02478a69b95
TLSH
T18F2105F106C7980C4546847EF521F9D9933469092B9EB7E8CB2DD55CAAC580EE5C1DC3
MD5 SHA1 SHA512 TLSH

Submit Download

veil_debug.txt

Path C:\Users\Admin\AppData\Local\Temp\veil_debug.txt
Size 2KB
SHA256 6f5040f371a900f14b7872d93e5af03af54fdf472653d69a1a67b9c1552125e3
MD5 5382878c0045a55084992d142e61836e
SHA1 dc585c35fb2e5c1281f48c1398fcb495bdebc7cf
SHA512 9777521a9e8dc6433e5048a9a279d6a03c31362aaf7c84abfd609583ded0f0242dd3aff09d9d6b819274c84140c48abc59c8277310ce57bc629abb1469248e4a
TLSH
T17641D2F206C7980C4545847EF562F9D9A334680A2F9EB7E8CB2CD58CAAC580EE5C1DC3
MD5 SHA1 SHA512 TLSH

Submit Download

veil_debug.txt

Path C:\Users\Admin\AppData\Local\Temp\veil_debug.txt
Size 2KB
SHA256 4d610ac38a63fcb38ab7d47f5aeee271cab4b63da77c694fe5b03e1473576c88
MD5 848c4122b67cfdf2af7f25ab8f651031
SHA1 ab9f93c4235df679c230c0ec5b6521299ef93fa2
SHA512 d50dfc24682c91b9199b47883c68a6746dbeac390e11907a632685cccd30c509afdae770794e6b83f86a6e91323d989ccad2696f053dd60a598818ddee8e24c6
TLSH
T1B65184F201C7980C4545857BF511FDC89330694A6F9EB7E88B2CD58CAACA80EE6C0CC3
MD5 SHA1 SHA512 TLSH

Submit Download

veil_debug.txt

Path C:\Users\Admin\AppData\Local\Temp\veil_debug.txt
Size 2KB
SHA256 5e8e57af0bf8c685c5c3609b2052288357510ceadb63b9f48d813c04ce7bdac8
MD5 3839e05e4cd3919ed840050a1426fd37
SHA1 537e2faacc2766474a100c7121e4fc8d3487e471
SHA512 f07e1a633bc4d2038f9579f7e9ec84769caed8ed87918fdcd8547204178fba91ae005e66ee644a52d1886351a8f32be783d279c8c515daaf55618b46196e1608
TLSH
T15E5176F201C7990C8546857AB511F9C99330694A6F9FB7E88B2CD55CAACA80EE6C0DC3
MD5 SHA1 SHA512 TLSH

Submit Download

FontCacheSvc.exe

Path C:\Users\Admin\AppData\Local\fontdrv\FontCacheSvc.exe
Size 13.2MB
SHA256 7dcc113684fe5bd9355866a59f4a901929ff5d07fb47a05d6c186d1e7b3f444f
MD5 d0b9a7237d435da44acdf3f159b2211c
SHA1 05b771a0ec063a2b04d4befc87f13b71ea08a3f8
SHA512 2f46eb85b97c5e3d76c813f2448e1a49726df86509b9959c1fb1268b2df7d0dc6c666c63f7b4152387ec307f8447806c1b87d9374beee051e4b3fc9d0406b1ea
SSDEEP 98304:jv8U1r5wAZxZo7TLCizQ47syzUMx7Agf2y4malGgGvjQjw50GE:7r9wWxZ0TLC8spGbMmy9rj
TLSH
T1A0D63947EDA606E8C0AED535CA2695537B713C995B3023D31B90FA243F36BE06EB9704
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1432-3-0x000001FE0EC20000-0x000001FE0EC30000-memory.dmp

Download

memory/1432-6-0x000001FE28DF0000-0x000001FE28E12000-memory.dmp

Download

memory/1432-4-0x000001FE0EC20000-0x000001FE0EC30000-memory.dmp

Download

memory/2672-73-0x0000029C41520000-0x0000029C41570000-memory.dmp

Download