milleniumrat | 4813b1bd8c65ec474434e049e69cf01d67ff772be7e1717583d2135f630a9ccb

Analysis

max time kernel
899s
max time network
900s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
17/08/2026, 02:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
setup.bat
Size 115B
Sample260817-cpk2fa11d1
SHA256 4813b1bd8c65ec474434e049e69cf01d67ff772be7e1717583d2135f630a9ccb
MD5 01ad58928bab27a41ce5443df638b0a2
SHA1 2b9a82176da62f53d75244028eaebb10599aa487
SHA512 f1e18b1d500614be30b9b55a1d1b82c642439c37d36eccaef5118e3b2165a8ac11cf1dd1bc2f1d5c880ad3d4a16ec4029b1c53979a7912159190571cd3336200
TLSH
T1BBB0126E5193755097D324C08B262A513BCF506F478BE3C23104EDC976411BEC1E48AE
MD5 SHA1 SHA512 TLSH

Score

10^/10

defense_evasion discovery execution milleniumrat persistence privilege_escalation rat spyware stealer

Malware Config

Signatures

Family: MilleniumRat
MilleniumRat is a remote access trojan written in C#.
rat stealer milleniumrat

Detects MilleniumRAT stealer 1 IoCs

resource	yara_rule
behavioral4/files/0x0002000000021fd4-157.dat	family_milleniumrat

Command and Scripting Interpreter: PowerShell 1 TTPs 5 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
5480	powershell.exe
2656	powershell.exe
5176	powershell.exe
4536	powershell.exe
2096	powershell.exe

Downloads MZ/PE file 3 IoCs

flow	pid	Process
33	2136	crack.exe
33	2136	crack.exe
45	2136	crack.exe

Creates a file in the Startup directory 1 TTPs 12 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneDrive.lnk	powershell.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneDrive.lnk	powershell.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\UpdateDownloader.exe	crack.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\update4.exe	crack.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\update6.exe	crack.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\updates_notes.txt	crack.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\UpdateDownloader.exe	crack.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\JDXsnbQ.lnk	crack.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\update1.exe	crack.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\update2.exe	crack.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\update3.exe	crack.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\update5.exe	crack.exe

Executes dropped EXE 13 IoCs

pid	Process
2136	crack.exe
2400	update3.exe
1752	update4.exe
5844	OneDriveUpdate.exe
2364	ThemeSync.exe
4076	OneDriveUpdate.exe
736	OneDriveUpdate.exe
4936	OneDriveUpdate.exe
5696	OneDriveUpdate.exe
3792	OneDriveUpdate.exe
5576	update6.exe
452	svchost.exe
3848	svchost.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SysHelper = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\ThemeSync.exe"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Setup = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\OneDriveUpdate.exe"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsHealthMonitor = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\OneDriveUpdate.exe"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SysHelper = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\ThemeSync.exe"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Setup = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\OneDriveUpdate.exe"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsHealthMonitor = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\OneDriveUpdate.exe"	reg.exe

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
61	raw.githubusercontent.com
62	raw.githubusercontent.com

Looks up external IP address via web service 1 TTPs 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
58	ip-api.com

Executes a VBScript file via the Windows Script Host. 1 TTPs 2 IoCs

execution

Visual Basic

T1059.005

pid	Process
812	wscript.exe
1040	wscript.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 5444 set thread context of 2136	5444	crack.exe	105

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2704	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	crack.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	update6.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	crack.exe

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
6048	timeout.exe

Modifies registry key 1 TTPs 6 IoCs

Modify Registry

T1112

pid	Process
1088	reg.exe
4212	reg.exe
5932	reg.exe
4644	reg.exe
5148	reg.exe
5172	reg.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5444	crack.exe
5444	crack.exe
5480	powershell.exe
5480	powershell.exe
5968	powershell.exe
5968	powershell.exe
5176	powershell.exe
5176	powershell.exe
4536	powershell.exe
4536	powershell.exe
4536	powershell.exe
2096	powershell.exe
2096	powershell.exe
2096	powershell.exe
2656	powershell.exe
2656	powershell.exe
2656	powershell.exe
452	svchost.exe
452	svchost.exe
452	svchost.exe
452	svchost.exe
452	svchost.exe
452	svchost.exe
452	svchost.exe
452	svchost.exe
452	svchost.exe
452	svchost.exe
452	svchost.exe
452	svchost.exe
452	svchost.exe
452	svchost.exe
452	svchost.exe
452	svchost.exe
452	svchost.exe
452	svchost.exe
452	svchost.exe
452	svchost.exe
452	svchost.exe
452	svchost.exe
452	svchost.exe
452	svchost.exe
452	svchost.exe
452	svchost.exe
452	svchost.exe
452	svchost.exe
452	svchost.exe
452	svchost.exe
452	svchost.exe
452	svchost.exe
452	svchost.exe
452	svchost.exe
452	svchost.exe
452	svchost.exe
452	svchost.exe
452	svchost.exe
452	svchost.exe
452	svchost.exe
452	svchost.exe
452	svchost.exe
452	svchost.exe
452	svchost.exe
452	svchost.exe
452	svchost.exe
452	svchost.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	5444	crack.exe
Token: SeDebugPrivilege	5480	powershell.exe
Token: SeDebugPrivilege	5968	powershell.exe
Token: SeDebugPrivilege	5176	powershell.exe
Token: SeIncreaseQuotaPrivilege	5176	powershell.exe
Token: SeSecurityPrivilege	5176	powershell.exe
Token: SeTakeOwnershipPrivilege	5176	powershell.exe
Token: SeLoadDriverPrivilege	5176	powershell.exe
Token: SeSystemProfilePrivilege	5176	powershell.exe
Token: SeSystemtimePrivilege	5176	powershell.exe
Token: SeProfSingleProcessPrivilege	5176	powershell.exe
Token: SeIncBasePriorityPrivilege	5176	powershell.exe
Token: SeCreatePagefilePrivilege	5176	powershell.exe
Token: SeBackupPrivilege	5176	powershell.exe
Token: SeRestorePrivilege	5176	powershell.exe
Token: SeShutdownPrivilege	5176	powershell.exe
Token: SeDebugPrivilege	5176	powershell.exe
Token: SeSystemEnvironmentPrivilege	5176	powershell.exe
Token: SeRemoteShutdownPrivilege	5176	powershell.exe
Token: SeUndockPrivilege	5176	powershell.exe
Token: SeManageVolumePrivilege	5176	powershell.exe
Token: 33	5176	powershell.exe
Token: 34	5176	powershell.exe
Token: 35	5176	powershell.exe
Token: 36	5176	powershell.exe
Token: SeIncreaseQuotaPrivilege	5176	powershell.exe
Token: SeSecurityPrivilege	5176	powershell.exe
Token: SeTakeOwnershipPrivilege	5176	powershell.exe
Token: SeLoadDriverPrivilege	5176	powershell.exe
Token: SeSystemProfilePrivilege	5176	powershell.exe
Token: SeSystemtimePrivilege	5176	powershell.exe
Token: SeProfSingleProcessPrivilege	5176	powershell.exe
Token: SeIncBasePriorityPrivilege	5176	powershell.exe
Token: SeCreatePagefilePrivilege	5176	powershell.exe
Token: SeBackupPrivilege	5176	powershell.exe
Token: SeRestorePrivilege	5176	powershell.exe
Token: SeShutdownPrivilege	5176	powershell.exe
Token: SeDebugPrivilege	5176	powershell.exe
Token: SeSystemEnvironmentPrivilege	5176	powershell.exe
Token: SeRemoteShutdownPrivilege	5176	powershell.exe
Token: SeUndockPrivilege	5176	powershell.exe
Token: SeManageVolumePrivilege	5176	powershell.exe
Token: 33	5176	powershell.exe
Token: 34	5176	powershell.exe
Token: 35	5176	powershell.exe
Token: 36	5176	powershell.exe
Token: SeDebugPrivilege	4536	powershell.exe
Token: SeIncreaseQuotaPrivilege	5176	powershell.exe
Token: SeSecurityPrivilege	5176	powershell.exe
Token: SeTakeOwnershipPrivilege	5176	powershell.exe
Token: SeLoadDriverPrivilege	5176	powershell.exe
Token: SeSystemProfilePrivilege	5176	powershell.exe
Token: SeSystemtimePrivilege	5176	powershell.exe
Token: SeProfSingleProcessPrivilege	5176	powershell.exe
Token: SeIncBasePriorityPrivilege	5176	powershell.exe
Token: SeCreatePagefilePrivilege	5176	powershell.exe
Token: SeBackupPrivilege	5176	powershell.exe
Token: SeRestorePrivilege	5176	powershell.exe
Token: SeShutdownPrivilege	5176	powershell.exe
Token: SeDebugPrivilege	5176	powershell.exe
Token: SeSystemEnvironmentPrivilege	5176	powershell.exe
Token: SeRemoteShutdownPrivilege	5176	powershell.exe
Token: SeUndockPrivilege	5176	powershell.exe
Token: SeManageVolumePrivilege	5176	powershell.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
452	svchost.exe

Suspicious use of WriteProcessMemory 36 IoCs

description	pid	Process	procid_target
PID 2704 wrote to memory of 468	2704	cmd.exe	88
PID 2704 wrote to memory of 5444	2704	cmd.exe	89
PID 2704 wrote to memory of 6048	2704	cmd.exe	90
PID 5444 wrote to memory of 5480	5444	crack.exe	103
PID 5444 wrote to memory of 2136	5444	crack.exe	105
PID 5444 wrote to memory of 2136	5444	crack.exe	105
PID 5444 wrote to memory of 2136	5444	crack.exe	105
PID 5444 wrote to memory of 2136	5444	crack.exe	105
PID 5444 wrote to memory of 2136	5444	crack.exe	105
PID 5444 wrote to memory of 2136	5444	crack.exe	105
PID 5444 wrote to memory of 2136	5444	crack.exe	105
PID 2136 wrote to memory of 2400	2136	crack.exe	111
PID 2400 wrote to memory of 4996	2400	update3.exe	112
PID 2400 wrote to memory of 4644	2400	update3.exe	114
PID 2400 wrote to memory of 5148	2400	update3.exe	116
PID 2400 wrote to memory of 5172	2400	update3.exe	118
PID 2400 wrote to memory of 5176	2400	update3.exe	120
PID 2136 wrote to memory of 1752	2136	crack.exe	122
PID 1752 wrote to memory of 4300	1752	update4.exe	123
PID 1752 wrote to memory of 1088	1752	update4.exe	125
PID 1752 wrote to memory of 4212	1752	update4.exe	127
PID 1752 wrote to memory of 5932	1752	update4.exe	129
PID 1752 wrote to memory of 4536	1752	update4.exe	131
PID 2364 wrote to memory of 4076	2364	ThemeSync.exe	137
PID 2400 wrote to memory of 2096	2400	update3.exe	138
PID 1752 wrote to memory of 2656	1752	update4.exe	140
PID 2400 wrote to memory of 2412	2400	update3.exe	142
PID 2400 wrote to memory of 812	2400	update3.exe	144
PID 2400 wrote to memory of 736	2400	update3.exe	145
PID 2400 wrote to memory of 4936	2400	update3.exe	146
PID 1752 wrote to memory of 5832	1752	update4.exe	147
PID 1752 wrote to memory of 1040	1752	update4.exe	149
PID 1752 wrote to memory of 5696	1752	update4.exe	150
PID 1752 wrote to memory of 3792	1752	update4.exe	151
PID 2136 wrote to memory of 5576	2136	crack.exe	152
PID 5576 wrote to memory of 452	5576	update6.exe	153

Views/modifies file attributes 1 TTPs 4 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
4996	attrib.exe
4300	attrib.exe
2412	attrib.exe
5832	attrib.exe

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\setup.bat"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2704
- C:\Users\Admin\AppData\Local\Temp\BTC-ProTrader.exe
  "BTC-ProTrader.exe" -p123 -y
  2⤵
  PID:468
- C:\Users\Admin\AppData\Local\Temp\crack.exe
  "crack.exe" -p123 -y
  2⤵
  - Creates a file in the Startup directory
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:5444
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\crack.exe"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5480
- - C:\Users\Admin\AppData\Local\Temp\crack.exe
    "C:\Users\Admin\AppData\Local\Temp\crack.exe"
    3⤵
    - Downloads MZ/PE file
    - Creates a file in the Startup directory
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2136
  - - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\update3.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\update3.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:2400
    - - C:\Windows\system32\attrib.exe
        
        "attrib" +H C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\OneDriveUpdate.exe
        5⤵
        Views/modifies file attributes
        
        PID:4996
    - - C:\Windows\system32\reg.exe
        
        "reg" add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v WindowsHealthMonitor /t REG_SZ /d C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\OneDriveUpdate.exe /f
        5⤵
        Adds Run key to start application
        Modifies registry key
        
        PID:4644
    - - C:\Windows\system32\reg.exe
        
        "reg" add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v SysHelper /t REG_SZ /d C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\ThemeSync.exe /f
        5⤵
        Adds Run key to start application
        Modifies registry key
        
        PID:5148
    - - C:\Windows\system32\reg.exe
        
        "reg" add HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce /v Setup /t REG_SZ /d C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\OneDriveUpdate.exe /f
        5⤵
        Adds Run key to start application
        Modifies registry key
        
        PID:5172
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -WindowStyle Hidden -Command "$action = New-ScheduledTaskAction -Execute 'C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\OneDriveUpdate.exe'; $trigger = New-ScheduledTaskTrigger -AtLogon; $settings = New-ScheduledTaskSettingsSet -Hidden -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries; Register-ScheduledTask -TaskName 'OneDriveStandalone' -Action $action -Trigger $trigger -Settings $settings -Force"
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:5176
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -WindowStyle Hidden -Command "$s = (New-Object -COM WScript.Shell).CreateShortcut('C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\OneDrive.lnk'); $s.TargetPath = 'C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\OneDriveUpdate.exe'; $s.WorkingDirectory = 'C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\SendTo'; $s.WindowStyle = 7; $s.Save()"
        5⤵
        Command and Scripting Interpreter: PowerShell
        Creates a file in the Startup directory
        Suspicious behavior: EnumeratesProcesses
        
        PID:2096
    - - C:\Windows\system32\attrib.exe
        
        "attrib" +H C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\syshelper.vbs
        5⤵
        Views/modifies file attributes
        
        PID:2412
    - - C:\Windows\system32\wscript.exe
        
        "wscript.exe" //nologo //b C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\syshelper.vbs
        5⤵
        Executes a VBScript file via the Windows Script Host.
        
        PID:812
    - - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\OneDriveUpdate.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\OneDriveUpdate.exe"
        5⤵
        Executes dropped EXE
        
        PID:736
    - - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\OneDriveUpdate.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\OneDriveUpdate.exe"
        5⤵
        Executes dropped EXE
        
        PID:4936
  - - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\update4.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\update4.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:1752
    - - C:\Windows\system32\attrib.exe
        
        "attrib" +H C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\ThemeSync.exe
        5⤵
        Views/modifies file attributes
        
        PID:4300
    - - C:\Windows\system32\reg.exe
        
        "reg" add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v WindowsHealthMonitor /t REG_SZ /d C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\OneDriveUpdate.exe /f
        5⤵
        Adds Run key to start application
        Modifies registry key
        
        PID:1088
    - - C:\Windows\system32\reg.exe
        
        "reg" add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v SysHelper /t REG_SZ /d C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\ThemeSync.exe /f
        5⤵
        Adds Run key to start application
        Modifies registry key
        
        PID:4212
    - - C:\Windows\system32\reg.exe
        
        "reg" add HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce /v Setup /t REG_SZ /d C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\OneDriveUpdate.exe /f
        5⤵
        Adds Run key to start application
        Modifies registry key
        
        PID:5932
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -WindowStyle Hidden -Command "$action = New-ScheduledTaskAction -Execute 'C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\OneDriveUpdate.exe'; $trigger = New-ScheduledTaskTrigger -AtLogon; $settings = New-ScheduledTaskSettingsSet -Hidden -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries; Register-ScheduledTask -TaskName 'OneDriveStandalone' -Action $action -Trigger $trigger -Settings $settings -Force"
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4536
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -WindowStyle Hidden -Command "$s = (New-Object -COM WScript.Shell).CreateShortcut('C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\OneDrive.lnk'); $s.TargetPath = 'C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\OneDriveUpdate.exe'; $s.WorkingDirectory = 'C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\SendTo'; $s.WindowStyle = 7; $s.Save()"
        5⤵
        Command and Scripting Interpreter: PowerShell
        Creates a file in the Startup directory
        Suspicious behavior: EnumeratesProcesses
        
        PID:2656
    - - C:\Windows\system32\attrib.exe
        
        "attrib" +H C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\syshelper.vbs
        5⤵
        Views/modifies file attributes
        
        PID:5832
    - - C:\Windows\system32\wscript.exe
        
        "wscript.exe" //nologo //b C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\syshelper.vbs
        5⤵
        Executes a VBScript file via the Windows Script Host.
        
        PID:1040
    - - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\OneDriveUpdate.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\OneDriveUpdate.exe"
        5⤵
        Executes dropped EXE
        
        PID:5696
    - - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\OneDriveUpdate.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\OneDriveUpdate.exe"
        5⤵
        Executes dropped EXE
        
        PID:3792
  - - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\update6.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\update6.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5576
    - - C:\Users\Admin\AppData\Roaming\vd5LW6FEdoBZhFBo\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\vd5LW6FEdoBZhFBo\svchost.exe"
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        
        PID:452
- C:\Windows\system32\timeout.exe
  timeout /t 8
  2⤵
  - Delays execution with timeout.exe
  PID:6048

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5968

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\OneDriveUpdate.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\OneDriveUpdate.exe
1⤵
- Executes dropped EXE
PID:5844

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\ThemeSync.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\ThemeSync.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2364
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\OneDriveUpdate.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\OneDriveUpdate.exe"
  2⤵
  - Executes dropped EXE
  PID:4076

C:\Users\Admin\AppData\Roaming\vd5LW6FEdoBZhFBo\svchost.exe
C:\Users\Admin\AppData\Roaming\vd5LW6FEdoBZhFBo\svchost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3848

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Visual Basic

T1059.005

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 3KB
SHA256 70c3ecbaa6df88e88df4efc70968502955e890a2248269641c4e2d4668ef61bf
MD5 661739d384d9dfd807a089721202900b
SHA1 5b2c5d6a7122b4ce849dc98e79a7713038feac55
SHA512 81b48ae5c4064c4d9597303d913e32d3954954ba1c8123731d503d1653a0d848856812d2ee6951efe06b1db2b91a50e5d54098f60c26f36bc8390203f4c8a2d8
TLSH
T1DC51FE323375F0D4C8567F07293819D463BF4386EA94AF58B258621ED93641B8F222F3
MD5 SHA1 SHA512 TLSH

Submit Download

ModuleAnalysisCache

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
Size 53KB
SHA256 4ebde1c12625cb55034d47e5169f709b0bd02a8caa76b5b9854efad7f4710245
MD5 a26df49623eff12a70a93f649776dab7
SHA1 efb53bd0df3ac34bd119adf8788127ad57e53803
SHA512 e5f9b8645fb2a50763fcbffe877ca03e9cadf099fe2d510b74bfa9ff18d0a6563d11160e00f495eeefebde63450d0ade8d6b6a824e68bd8a59e1971dc842709c
SSDEEP 1536:0YaC+jH04tAHk1ZSMrxyNhftflJdvYoFi3j39MVvjMlUst+hNOwUp7bNvv+EGa5d:0YaC+jH04tAHk1cMrxyNhftflJdvYoFw
TLSH
T170334093E9204D71E1A66F3EF15662227D34394690F8113212DC25EFA983D970B1FAFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 7cf94c70beab8d9fd0438aafd70706d001c2aae67b4c66361e5396c3cc6d6e07
MD5 f1bf312117f3f493e021167b960af4e0
SHA1 a69a648f84edbd16efc570d955124eec2a47f14d
SHA512 13c90dd709ac64bafb58562f51a0f337513f38575877f785eba1e7bbba00ad9fa99401d0a3b2165b088338ae30e3ac7dc0135ddb8691679a3ed96a15ac924397
TLSH
T155217827B39D8460CCD5163A108D9C5072A782C781DFCFDB2EC0C21195BFAC8CB21150
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 79e88044dad92cd1b5136ae3293b2066957841b663d151b9d4fbdb2519190148
MD5 0ffa43397f523276d7235496401edd72
SHA1 90b94d9630f03fffb764b451675f1fc3281b8ab8
SHA512 da31208a02cefececf34358b8a930362b7e4b75ea1e43fb7d71e2634bbe9ea9406f093746d0d6e3f0bcf2de7023bcc7e5a71e1ea03c8240ec31557460207e857
TLSH
T1E3115337B39C89A1CC96163A509DAC1172B687C741AEDEDF6BC4C214A1AF584CB712A0
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 18KB
SHA256 5ce4e7d19f009d7471de5e4038955b16798b0d45f23cdc8de3bfbf3916f5074f
MD5 32e6a8893f166698f5f2a043dd6b78d4
SHA1 ea4e9c4409f6507cb8bc0f6cb1b0d21d726f6c6c
SHA512 ed9260c686ec03bbbbdd8a39effb869512c44e6789bddcaf18ba15a09fb94973a0491dfdbf41b4b8e0162c085ca0e6e89ad627cd8c1e25f1f53c830898b9db6e
SSDEEP 384:csf+BC9i+kWVymrg7f6k+o9od9ThK6seYLME/N03SoZ6fYSgcjEDkyQ0gdEtkKhD:ZfBPujod9ThNgrWS1WCED/Ce3
TLSH
T15C82E86E611F16C3C48613B8E11B055FE8F2DD8D531A13D8BB1E9F3B8AAC69E903D548
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_seezjakv.zuv.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_seezjakv.zuv.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

crack.exe

Path C:\Users\Admin\AppData\Local\Temp\crack.exe
Size 1.1MB
SHA256 3b35d3233e08d7c7a43a0bc0a899ce14cd6797949e96af0c6b3c32f690ab4815
MD5 7f47a50117bac7569e6b4de42926636e
SHA1 877622dda7d578058ebdddbb8be578c68dae74d9
SHA512 3c076c537d164e348d9192b8cd8f22fea47bc11e1f29849f1a64b9a77653c79a4759c35f0d237e83f8f0f7a4082d216c84cf26645aaea4ed2432c24f5603557a
SSDEEP 24576:nFXxPjGhJLBX4lY5/RA3GzNOR8SZG+XL8tTxhCww9c6zI:FXxP0BXU3SNOR1ZG+b6Txhzf
TLSH
T15E450144335BCC02D4920B7109B0D3791669AF5CA526C7178FEFFDEBF926786AD90282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OneDrive.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneDrive.lnk
Size 1KB
SHA256 bf687dade6da82ec6c9a2f53b2941493abc574858db9a9dd72b9c50f569de24a
MD5 67e245800522fe2d8bcd9566c75afc34
SHA1 189ac9601ee52e5673595dc539bfc207af3fa0f9
SHA512 f8e5075a819f35882ae323196196fa40412e4641e741dbc2d8565b0acdc130686643794509e1e9f7ffc54a9f2ae1703ba0544abe319a9a40d985b4a5000de335
TLSH
T15E2149816EE91732E7F65B7982F62722C5266C82EF855F0D000091443875F21B8B4F3F
MD5 SHA1 SHA512 TLSH

Submit Download

update3.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\update3.exe
Size 351KB
SHA256 8098d0cf7a2460b14d7145b0c15a183c5fdbaa9e3932b1ee701aa4c2d59c0d9c
MD5 f58aa730701d39a3618d5b3f92bb25c4
SHA1 15c7ab10173d8f8d5cb8364f9f7482146c21d709
SHA512 91a7599c2f5c349f5e37cf428d28ee90570dc18070b5e2087a17123934a93d51bfad5888009f1671daf675d026b17d9b01ac8893c15301bf04dcf0eb28e96de3
SSDEEP 6144:MSYuLs6wLNg+GceFU8/+i/jFLjXg02cDqLOX5HQS2ffji2:MATwZnTGdlg+x5HQB
TLSH
T104745C21FA955CF9D1A7C03482554A629A737CCB0B21AAFF23D442352F2AAF56F3C714
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

update6.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\update6.exe
Size 2.6MB
SHA256 36d3044a939b82e7456063d74f6f2395dea60ab0f63f04dde9dcc99eca4ba291
MD5 02975ba0a046872e7b67c60406d74b43
SHA1 f02c1991523e6e79b5933779e14547b55f8babad
SHA512 c67312bc56825e5815d529d8b945b4f577332f18f3aa68d499a324661da18e0ce28e0a61763a5c7150a9f1ccc7a754c2ffc7eb89853cda83c1c556adda576329
SSDEEP 49152:d5uXUoriRSoHz8szAXNGOXwGRbRKq5vguk6cLHMvJ9XUx9KTnUVz:STrVI4dGOgGpYHC4
TLSH
T1F1D59D62F782D0B2E4D201B156BEABF74D787535537584CBE3C01E6A49206C2B63AF1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

syshelper.vbs

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\syshelper.vbs
Size 647B
SHA256 683299efb20c6d035b79528fc3b65b4ead66e9bcf4c9dccb3c720ee926860341
MD5 f34cf97a62252c9fbff74f43d05cb2d8
SHA1 647490617850310f50ca9ba54640a70209f1c511
SHA512 b99321322d1e82026bd52a676c2e5e62a177b56220210ad49c846a5164123122de3665ab517ba72c8caefaf5f0913f5fb907e2c9cd22c760b0f79e118fbe3e7f
TLSH
T146F0A212DC19CB74D466255A23F3950EA5D14346789E6515FE4CC5CC7FC0F55D4880E3
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2136-30-0x0000000000400000-0x000000000045C000-memory.dmp

Download

memory/2136-28-0x0000000000400000-0x000000000045C000-memory.dmp

Download

memory/5444-0-0x0000000000A80000-0x0000000000BA6000-memory.dmp

Download

memory/5444-22-0x00000000067A0000-0x000000000688C000-memory.dmp

Download

memory/5444-21-0x00000000056E0000-0x00000000056F0000-memory.dmp

Download

memory/5444-20-0x0000000006020000-0x0000000006048000-memory.dmp

Download

memory/5444-19-0x0000000005790000-0x000000000582C000-memory.dmp

Download

memory/5444-18-0x0000000005610000-0x000000000561A000-memory.dmp

Download

memory/5444-17-0x00000000056E0000-0x00000000056F0000-memory.dmp

Download

memory/5444-16-0x0000000005450000-0x00000000054E2000-memory.dmp

Download

memory/5444-11-0x0000000005940000-0x0000000005EE4000-memory.dmp

Download

memory/5480-74-0x00000000070C0000-0x00000000070CE000-memory.dmp

Download

memory/5480-47-0x0000000005BB0000-0x0000000005BFC000-memory.dmp

Download

memory/5480-58-0x0000000006B30000-0x0000000006B62000-memory.dmp

Download

memory/5480-59-0x00000000758E0000-0x000000007592C000-memory.dmp

Download

memory/5480-67-0x0000000006140000-0x000000000615E000-memory.dmp

Download

memory/5480-68-0x0000000006D70000-0x0000000006E13000-memory.dmp

Download

memory/5480-69-0x00000000074D0000-0x0000000007B4A000-memory.dmp

Download

memory/5480-70-0x0000000006E90000-0x0000000006EAA000-memory.dmp

Download

memory/5480-71-0x0000000006F00000-0x0000000006F0A000-memory.dmp

Download

memory/5480-72-0x0000000007110000-0x00000000071A6000-memory.dmp

Download

memory/5480-73-0x0000000007090000-0x00000000070A1000-memory.dmp

Download

memory/5480-32-0x0000000004590000-0x00000000045C6000-memory.dmp

Download

memory/5480-75-0x00000000070D0000-0x00000000070E4000-memory.dmp

Download

memory/5480-76-0x00000000071D0000-0x00000000071EA000-memory.dmp

Download

memory/5480-77-0x00000000071B0000-0x00000000071B8000-memory.dmp

Download

memory/5480-34-0x0000000004D10000-0x0000000005338000-memory.dmp

Download

memory/5480-35-0x0000000004AA0000-0x0000000004AC2000-memory.dmp

Download

memory/5480-46-0x0000000005B60000-0x0000000005B7E000-memory.dmp

Download

memory/5480-45-0x00000000055A0000-0x00000000058F4000-memory.dmp

Download

memory/5480-36-0x0000000004C40000-0x0000000004CA6000-memory.dmp

Download

memory/5480-37-0x0000000005430000-0x0000000005496000-memory.dmp

Download

memory/5968-57-0x000001E5E71B0000-0x000001E5E7226000-memory.dmp

Download

memory/5968-48-0x000001E5CBD80000-0x000001E5CBDA2000-memory.dmp

Download

memory/5968-56-0x000001E5E70E0000-0x000001E5E7124000-memory.dmp

Download