75fb62378e828de3c2ffa15f0724a21af3cef832e886e989f378ac330e93497e

Analysis

max time kernel
150s
max time network
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
08/08/2026, 02:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-08_dc8bf84f19d748e2b1445273e4a387d9_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
Size 11.0MB
Sample260808-c233sagj7t
SHA256 75fb62378e828de3c2ffa15f0724a21af3cef832e886e989f378ac330e93497e
MD5 dc8bf84f19d748e2b1445273e4a387d9
SHA1 55dbb777b93d78cbdc5088359aac22b750bd9f9f
SHA512 56195b135cfec6e90543c916cef96c0211ed501f3530fa754ae22f4178d22c07a35a4bda77560e68e8ab651a0580da63b96080bcfd0108c06dbe2c58ee47be2a
SSDEEP 98304:qgp8VXvYwx+LLrmi6gGPWS53XYumvBh8huTEE:qJdxsJE753s
TLSH
T12AC63A47ECA515E6C0AD9175CA269523BB713C894F3063E76B90FA242F37BD0AE79700
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion execution trojan

Malware Config

Signatures

UAC bypass 3 TTPs 1 IoCs

defense_evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 5 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
896	powershell.exe
5328	powershell.exe
4520	powershell.exe
2816	powershell.exe
4640	powershell.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\Recovery	ReAgentc.exe
File opened for modification	C:\Windows\system32\Recovery\ReAgent.xml	ReAgentc.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Logs\ReAgent\ReAgent.log	ReAgentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\setuperr.log	ReAgentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagerr.xml	ReAgentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagwrn.xml	ReAgentc.exe

Kills process with taskkill 34 IoCs

defense_evasion

pid	Process
5792	taskkill.exe
5960	taskkill.exe
3100	taskkill.exe
3240	taskkill.exe
4476	taskkill.exe
2932	taskkill.exe
5048	taskkill.exe
4816	taskkill.exe
3120	taskkill.exe
4768	taskkill.exe
5412	taskkill.exe
2596	taskkill.exe
3820	taskkill.exe
2736	taskkill.exe
5080	taskkill.exe
5656	taskkill.exe
3388	taskkill.exe
3228	taskkill.exe
2236	taskkill.exe
368	taskkill.exe
4796	taskkill.exe
2532	taskkill.exe
1124	taskkill.exe
52	taskkill.exe
3776	taskkill.exe
5960	taskkill.exe
1740	taskkill.exe
5448	taskkill.exe
1220	taskkill.exe
2928	taskkill.exe
4536	taskkill.exe
5932	taskkill.exe
4992	taskkill.exe
1392	taskkill.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
2816	powershell.exe
2816	powershell.exe
896	powershell.exe
896	powershell.exe
4640	powershell.exe
4640	powershell.exe
4640	powershell.exe
5328	powershell.exe
5328	powershell.exe
5328	powershell.exe
4520	powershell.exe
4520	powershell.exe
4520	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2816	powershell.exe
Token: SeDebugPrivilege	896	powershell.exe
Token: SeDebugPrivilege	2596	taskkill.exe
Token: SeDebugPrivilege	4768	taskkill.exe
Token: SeDebugPrivilege	52	taskkill.exe
Token: SeIncreaseQuotaPrivilege	896	powershell.exe
Token: SeSecurityPrivilege	896	powershell.exe
Token: SeTakeOwnershipPrivilege	896	powershell.exe
Token: SeLoadDriverPrivilege	896	powershell.exe
Token: SeSystemProfilePrivilege	896	powershell.exe
Token: SeSystemtimePrivilege	896	powershell.exe
Token: SeProfSingleProcessPrivilege	896	powershell.exe
Token: SeIncBasePriorityPrivilege	896	powershell.exe
Token: SeCreatePagefilePrivilege	896	powershell.exe
Token: SeBackupPrivilege	896	powershell.exe
Token: SeRestorePrivilege	896	powershell.exe
Token: SeShutdownPrivilege	896	powershell.exe
Token: SeDebugPrivilege	896	powershell.exe
Token: SeSystemEnvironmentPrivilege	896	powershell.exe
Token: SeRemoteShutdownPrivilege	896	powershell.exe
Token: SeUndockPrivilege	896	powershell.exe
Token: SeManageVolumePrivilege	896	powershell.exe
Token: 33	896	powershell.exe
Token: 34	896	powershell.exe
Token: 35	896	powershell.exe
Token: 36	896	powershell.exe
Token: SeDebugPrivilege	3820	taskkill.exe
Token: SeDebugPrivilege	4992	taskkill.exe
Token: SeDebugPrivilege	3776	taskkill.exe
Token: SeDebugPrivilege	3228	taskkill.exe
Token: SeDebugPrivilege	5960	taskkill.exe
Token: SeDebugPrivilege	4476	taskkill.exe
Token: SeIncreaseQuotaPrivilege	896	powershell.exe
Token: SeSecurityPrivilege	896	powershell.exe
Token: SeTakeOwnershipPrivilege	896	powershell.exe
Token: SeLoadDriverPrivilege	896	powershell.exe
Token: SeSystemProfilePrivilege	896	powershell.exe
Token: SeSystemtimePrivilege	896	powershell.exe
Token: SeProfSingleProcessPrivilege	896	powershell.exe
Token: SeIncBasePriorityPrivilege	896	powershell.exe
Token: SeCreatePagefilePrivilege	896	powershell.exe
Token: SeBackupPrivilege	896	powershell.exe
Token: SeRestorePrivilege	896	powershell.exe
Token: SeShutdownPrivilege	896	powershell.exe
Token: SeDebugPrivilege	896	powershell.exe
Token: SeSystemEnvironmentPrivilege	896	powershell.exe
Token: SeRemoteShutdownPrivilege	896	powershell.exe
Token: SeUndockPrivilege	896	powershell.exe
Token: SeManageVolumePrivilege	896	powershell.exe
Token: 33	896	powershell.exe
Token: 34	896	powershell.exe
Token: 35	896	powershell.exe
Token: 36	896	powershell.exe
Token: SeDebugPrivilege	2236	taskkill.exe
Token: SeDebugPrivilege	1392	taskkill.exe
Token: SeDebugPrivilege	1740	taskkill.exe
Token: SeDebugPrivilege	2932	taskkill.exe
Token: SeIncreaseQuotaPrivilege	896	powershell.exe
Token: SeSecurityPrivilege	896	powershell.exe
Token: SeTakeOwnershipPrivilege	896	powershell.exe
Token: SeLoadDriverPrivilege	896	powershell.exe
Token: SeSystemProfilePrivilege	896	powershell.exe
Token: SeSystemtimePrivilege	896	powershell.exe
Token: SeProfSingleProcessPrivilege	896	powershell.exe

Suspicious use of WriteProcessMemory 40 IoCs

description	pid	Process	procid_target
PID 2132 wrote to memory of 896	2132	2026-08-08_dc8bf84f19d748e2b1445273e4a387d9_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	89
PID 2132 wrote to memory of 2816	2132	2026-08-08_dc8bf84f19d748e2b1445273e4a387d9_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	90
PID 2132 wrote to memory of 2596	2132	2026-08-08_dc8bf84f19d748e2b1445273e4a387d9_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	94
PID 2132 wrote to memory of 4640	2132	2026-08-08_dc8bf84f19d748e2b1445273e4a387d9_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	96
PID 2132 wrote to memory of 4768	2132	2026-08-08_dc8bf84f19d748e2b1445273e4a387d9_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	98
PID 2132 wrote to memory of 52	2132	2026-08-08_dc8bf84f19d748e2b1445273e4a387d9_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	100
PID 2132 wrote to memory of 3820	2132	2026-08-08_dc8bf84f19d748e2b1445273e4a387d9_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	102
PID 2132 wrote to memory of 4992	2132	2026-08-08_dc8bf84f19d748e2b1445273e4a387d9_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	105
PID 2132 wrote to memory of 3776	2132	2026-08-08_dc8bf84f19d748e2b1445273e4a387d9_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	107
PID 2132 wrote to memory of 3228	2132	2026-08-08_dc8bf84f19d748e2b1445273e4a387d9_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	109
PID 2132 wrote to memory of 5960	2132	2026-08-08_dc8bf84f19d748e2b1445273e4a387d9_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	111
PID 2132 wrote to memory of 4476	2132	2026-08-08_dc8bf84f19d748e2b1445273e4a387d9_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	113
PID 2132 wrote to memory of 2236	2132	2026-08-08_dc8bf84f19d748e2b1445273e4a387d9_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	115
PID 2132 wrote to memory of 1392	2132	2026-08-08_dc8bf84f19d748e2b1445273e4a387d9_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	117
PID 2132 wrote to memory of 1740	2132	2026-08-08_dc8bf84f19d748e2b1445273e4a387d9_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	119
PID 2132 wrote to memory of 2932	2132	2026-08-08_dc8bf84f19d748e2b1445273e4a387d9_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	121
PID 2132 wrote to memory of 5932	2132	2026-08-08_dc8bf84f19d748e2b1445273e4a387d9_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	123
PID 2132 wrote to memory of 5792	2132	2026-08-08_dc8bf84f19d748e2b1445273e4a387d9_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	125
PID 2132 wrote to memory of 5048	2132	2026-08-08_dc8bf84f19d748e2b1445273e4a387d9_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	127
PID 2132 wrote to memory of 5448	2132	2026-08-08_dc8bf84f19d748e2b1445273e4a387d9_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	129
PID 896 wrote to memory of 2972	896	powershell.exe	131
PID 2132 wrote to memory of 5328	2132	2026-08-08_dc8bf84f19d748e2b1445273e4a387d9_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	132
PID 2132 wrote to memory of 4520	2132	2026-08-08_dc8bf84f19d748e2b1445273e4a387d9_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	135
PID 2132 wrote to memory of 2736	2132	2026-08-08_dc8bf84f19d748e2b1445273e4a387d9_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	138
PID 2132 wrote to memory of 368	2132	2026-08-08_dc8bf84f19d748e2b1445273e4a387d9_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	140
PID 2132 wrote to memory of 1220	2132	2026-08-08_dc8bf84f19d748e2b1445273e4a387d9_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	142
PID 2132 wrote to memory of 4796	2132	2026-08-08_dc8bf84f19d748e2b1445273e4a387d9_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	144
PID 2132 wrote to memory of 5080	2132	2026-08-08_dc8bf84f19d748e2b1445273e4a387d9_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	146
PID 2132 wrote to memory of 2532	2132	2026-08-08_dc8bf84f19d748e2b1445273e4a387d9_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	148
PID 2132 wrote to memory of 5960	2132	2026-08-08_dc8bf84f19d748e2b1445273e4a387d9_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	150
PID 2132 wrote to memory of 2928	2132	2026-08-08_dc8bf84f19d748e2b1445273e4a387d9_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	152
PID 2132 wrote to memory of 3100	2132	2026-08-08_dc8bf84f19d748e2b1445273e4a387d9_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	154
PID 2132 wrote to memory of 5656	2132	2026-08-08_dc8bf84f19d748e2b1445273e4a387d9_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	156
PID 2132 wrote to memory of 4536	2132	2026-08-08_dc8bf84f19d748e2b1445273e4a387d9_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	158
PID 2132 wrote to memory of 4816	2132	2026-08-08_dc8bf84f19d748e2b1445273e4a387d9_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	160
PID 2132 wrote to memory of 3120	2132	2026-08-08_dc8bf84f19d748e2b1445273e4a387d9_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	162
PID 2132 wrote to memory of 3240	2132	2026-08-08_dc8bf84f19d748e2b1445273e4a387d9_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	164
PID 2132 wrote to memory of 3388	2132	2026-08-08_dc8bf84f19d748e2b1445273e4a387d9_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	166
PID 2132 wrote to memory of 1124	2132	2026-08-08_dc8bf84f19d748e2b1445273e4a387d9_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	168
PID 2132 wrote to memory of 5412	2132	2026-08-08_dc8bf84f19d748e2b1445273e4a387d9_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	170

C:\Users\Admin\AppData\Local\Temp\2026-08-08_dc8bf84f19d748e2b1445273e4a387d9_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-08_dc8bf84f19d748e2b1445273e4a387d9_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2132
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -File C:\Users\Admin\AppData\Local\Temp\wr_trigger.ps1
  2⤵
  - UAC bypass
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:896
- - C:\Windows\system32\ReAgentc.exe
    "C:\Windows\system32\ReAgentc.exe" /disable
    3⤵
    - Drops file in System32 directory
    - Drops file in Windows directory
    PID:2972
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "(Get-WmiObject -Query \"select Name from Win32_Processor\").Name"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2816
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM Cursor.exe /T
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2596
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "(Get-WmiObject -Query \"Select Name from Win32_VideoController\").Name"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:4640
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM cursor.exe /T
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4768
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM Claude.exe /T
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:52
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM claude.exe /T
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3820
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM ChatGPT.exe /T
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4992
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM chatgpt.exe /T
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3776
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM Copilot.exe /T
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3228
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM GitHubCopilot.exe /T
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:5960
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM Codeium.exe /T
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4476
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM Windsurf.exe /T
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2236
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM windsurf.exe /T
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1392
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM Tabnine.exe /T
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1740
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM tabnine.exe /T
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2932
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM Continue.exe /T
  2⤵
  - Kills process with taskkill
  PID:5932
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM Aider.exe /T
  2⤵
  - Kills process with taskkill
  PID:5792
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM Cody.exe /T
  2⤵
  - Kills process with taskkill
  PID:5048
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM Sourcegraph.exe /T
  2⤵
  - Kills process with taskkill
  PID:5448
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "(Get-WmiObject -Query \"select * from Win32_OperatingSystem\").Caption"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:5328
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "(Get-WmiObject -Query \"select TotalPhysicalMemory from Win32_ComputerSystem\").TotalPhysicalMemory"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:4520
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM Cursor.exe /T
  2⤵
  - Kills process with taskkill
  PID:2736
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM cursor.exe /T
  2⤵
  - Kills process with taskkill
  PID:368
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM Claude.exe /T
  2⤵
  - Kills process with taskkill
  PID:1220
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM claude.exe /T
  2⤵
  - Kills process with taskkill
  PID:4796
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM ChatGPT.exe /T
  2⤵
  - Kills process with taskkill
  PID:5080
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM chatgpt.exe /T
  2⤵
  - Kills process with taskkill
  PID:2532
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM Copilot.exe /T
  2⤵
  - Kills process with taskkill
  PID:5960
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM GitHubCopilot.exe /T
  2⤵
  - Kills process with taskkill
  PID:2928
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM Codeium.exe /T
  2⤵
  - Kills process with taskkill
  PID:3100
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM Windsurf.exe /T
  2⤵
  - Kills process with taskkill
  PID:5656
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM windsurf.exe /T
  2⤵
  - Kills process with taskkill
  PID:4536
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM Tabnine.exe /T
  2⤵
  - Kills process with taskkill
  PID:4816
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM tabnine.exe /T
  2⤵
  - Kills process with taskkill
  PID:3120
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM Continue.exe /T
  2⤵
  - Kills process with taskkill
  PID:3240
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM Aider.exe /T
  2⤵
  - Kills process with taskkill
  PID:3388
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM Cody.exe /T
  2⤵
  - Kills process with taskkill
  PID:1124
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM Sourcegraph.exe /T
  2⤵
  - Kills process with taskkill
  PID:5412

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s BDESVC
1⤵
PID:6036

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 fd74999f32b3f0473a729fc46fd33ec3c6f9e411cc6391b1a7b3d521a5b7896d
MD5 1fdb4d03f2339da5b682f67d0c7283e3
SHA1 65c69466f755371bbb561b1f134618bf883d7045
SHA512 a4433af4af5b91f29dcc90db9d825f0634f073ce9b3f424f0d462775248fa3dd42c31a62e14a43f8cce18d9a40253014d9e24bba8be3d3b664999cd8d53283d3
TLSH
T10D115733B3CC8724C89A403A50CEAC1136B597DB90DEDFAB7B84D148A83F599DF61260
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 e56f4a38e0c60f0196c589e1952198368a10927e65ff24d1476ffafc489657f4
MD5 78b9021e0576c01ec958b87ec52832c1
SHA1 76df758d602c2d4cc4a4bfa0f3b435cae1ed3ffa
SHA512 4402163ed9623a392f120417ea0b5049bf0d76b88dd7f4fc70428ef7e76601f25bd534ae916ed9daba859fb6308d6f370712985ccd165f6393dbce7c5c507514
TLSH
T11F216833F3DD8614C89A413A10CDAC1036B6C7DB41DECFAB7B84E655A43F699CE61160
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 b36a653173a1e5d3f33e54cc38d9e918c12a038b05d39b6e5d3e15e2f833a0b6
MD5 17b550ad2dc027de66100c5c4fdd89b3
SHA1 020cf7fc98bcaea90058729ab7d4c2213122ffd1
SHA512 fdb2a42bf0b56f652ecfc1bc2e179b519ff425815ba2df9888da4a2d5060ca93919136c3642013a8d8078d5332cf0d8faacc022f0398042fa1472a8783e32c41
TLSH
T1F4115733F3CC8624C89A403650CEEC1036B587DB50DECE6BBB84D554B43F699CE61260
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_ckpsk5es.uce.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ckpsk5es.uce.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

wr_trigger.ps1

Path C:\Users\Admin\AppData\Local\Temp\wr_trigger.ps1
Size 1KB
SHA256 65dc06af332fc5597e5224451026ecb024f635a38b789779e06d1cbe3e0bca7d
MD5 6bfc5568b47c2b4f20d7c60728a1f697
SHA1 e43c227bced6b7350a9aa69eda7869cfd04776d3
SHA512 8530d840f65bdbeabf9b73cf9d18071fa7ee100c842681cb039aac71f15291876d821cd977e5864a93a9ac5aa1f1ada52a66fa33a3fddd8d2e24be57575e4559
TLSH
T17811EF4011B1C0C0F2A67B10505AEA18133A8E3F05BD990435AD84CE9F05F3E5BB9E17
MD5 SHA1 SHA512 TLSH