0418692dfc8e114d76eab0ca18e47d68a424a699b24f92f1f69f2e227020df47

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
20/08/2026, 07:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-20_47043a0fd2b7f688a726dcd0878d7b33_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
Size 65.3MB
Sample260820-h2rbwasarg
SHA256 0418692dfc8e114d76eab0ca18e47d68a424a699b24f92f1f69f2e227020df47
MD5 47043a0fd2b7f688a726dcd0878d7b33
SHA1 19ac52d6035f4df22623e9b777b27838802f73a9
SHA512 f2530b5fc4c060d499ac81f8ffd53f3031722a605e1e770a64e6ff6fac3160715bf47cdbe134b32cc3f74948956da118d256cc03d9c9f0832908c921b47094f6
SSDEEP 393216:y1Du8BtuBw2FEL3Z3aLUoQvo6LP/SgbSpYvKEh1EdKwlGQKPJuGsiTfREsrgCYfe:yMguj8Q4VfvQqFTrYI
TLSH
T133E79E3722B714ADF4B6D932C1661106CE3A39175339D6CF718C62B52FAB6E44E39B20
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery execution persistence privilege_escalation spyware stealer

Malware Config

Signatures

Badlisted process makes network request 1 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
6	3448	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 7 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
3448	powershell.exe
4200	powershell.exe
4592	powershell.exe
312	powershell.exe
4088	powershell.exe
2140	powershell.exe
3164	powershell.exe

Creates a file in the Startup directory 1 TTPs 2 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chrome.exe	2026-08-20_47043a0fd2b7f688a726dcd0878d7b33_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chrome.exe	2026-08-20_47043a0fd2b7f688a726dcd0878d7b33_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe

Executes dropped EXE 4 IoCs

pid	Process
2612	chrome.exe
5004	chrome.exe
2220	DellHandler.exe
2136	GoogleUpdate.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Indicator Removal: Clear Persistence 1 TTPs 1 IoCs

Clear artifacts associated with previously established persistence like scheduletasks on a host.

defense_evasion

Clear Persistence

T1070.009

pid	Process
4060	cmd.exe

Looks up external IP address via web service 1 TTPs 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
5	api.ipify.org
6	api.ipify.org

Discovers running processes 1 TTPs 1 IoCs

Running process information can be used to identify security tools or plan follow-on actions.

discovery

Process Discovery

T1057

pid	Process
688	tasklist.exe

Hide Artifacts: Hidden Files and Directories 1 TTPs 1 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
940	cmd.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 18 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
468	cmd.exe
1076	cmd.exe
2164	cmd.exe
2384	cmd.exe
908	cmd.exe
2208	cmd.exe
216	cmd.exe
4412	cmd.exe
4864	cmd.exe
1472	cmd.exe
1716	cmd.exe
3140	cmd.exe
2892	cmd.exe
1256	cmd.exe
4392	cmd.exe
1216	cmd.exe
2500	cmd.exe
3112	cmd.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2220	DellHandler.exe

Kills process with taskkill 1 IoCs

defense_evasion

pid	Process
4400	taskkill.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry

T1112

pid	Process
1832	reg.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4080	schtasks.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
3448	powershell.exe
3448	powershell.exe
4200	powershell.exe
4200	powershell.exe
4592	powershell.exe
4592	powershell.exe
312	powershell.exe
312	powershell.exe
4088	powershell.exe
4088	powershell.exe
2140	powershell.exe
2140	powershell.exe
3164	powershell.exe
3164	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	688	tasklist.exe
Token: SeDebugPrivilege	3448	powershell.exe
Token: SeDebugPrivilege	4400	taskkill.exe
Token: SeDebugPrivilege	4200	powershell.exe
Token: SeIncreaseQuotaPrivilege	4200	powershell.exe
Token: SeSecurityPrivilege	4200	powershell.exe
Token: SeTakeOwnershipPrivilege	4200	powershell.exe
Token: SeLoadDriverPrivilege	4200	powershell.exe
Token: SeSystemProfilePrivilege	4200	powershell.exe
Token: SeSystemtimePrivilege	4200	powershell.exe
Token: SeProfSingleProcessPrivilege	4200	powershell.exe
Token: SeIncBasePriorityPrivilege	4200	powershell.exe
Token: SeCreatePagefilePrivilege	4200	powershell.exe
Token: SeBackupPrivilege	4200	powershell.exe
Token: SeRestorePrivilege	4200	powershell.exe
Token: SeShutdownPrivilege	4200	powershell.exe
Token: SeDebugPrivilege	4200	powershell.exe
Token: SeSystemEnvironmentPrivilege	4200	powershell.exe
Token: SeRemoteShutdownPrivilege	4200	powershell.exe
Token: SeUndockPrivilege	4200	powershell.exe
Token: SeManageVolumePrivilege	4200	powershell.exe
Token: 33	4200	powershell.exe
Token: 34	4200	powershell.exe
Token: 35	4200	powershell.exe
Token: 36	4200	powershell.exe
Token: SeDebugPrivilege	4592	powershell.exe
Token: SeDebugPrivilege	312	powershell.exe
Token: SeIncreaseQuotaPrivilege	312	powershell.exe
Token: SeSecurityPrivilege	312	powershell.exe
Token: SeTakeOwnershipPrivilege	312	powershell.exe
Token: SeLoadDriverPrivilege	312	powershell.exe
Token: SeSystemProfilePrivilege	312	powershell.exe
Token: SeSystemtimePrivilege	312	powershell.exe
Token: SeProfSingleProcessPrivilege	312	powershell.exe
Token: SeIncBasePriorityPrivilege	312	powershell.exe
Token: SeCreatePagefilePrivilege	312	powershell.exe
Token: SeBackupPrivilege	312	powershell.exe
Token: SeRestorePrivilege	312	powershell.exe
Token: SeShutdownPrivilege	312	powershell.exe
Token: SeDebugPrivilege	312	powershell.exe
Token: SeSystemEnvironmentPrivilege	312	powershell.exe
Token: SeRemoteShutdownPrivilege	312	powershell.exe
Token: SeUndockPrivilege	312	powershell.exe
Token: SeManageVolumePrivilege	312	powershell.exe
Token: 33	312	powershell.exe
Token: 34	312	powershell.exe
Token: 35	312	powershell.exe
Token: 36	312	powershell.exe
Token: SeDebugPrivilege	4088	powershell.exe
Token: SeDebugPrivilege	2140	powershell.exe
Token: SeIncreaseQuotaPrivilege	2140	powershell.exe
Token: SeSecurityPrivilege	2140	powershell.exe
Token: SeTakeOwnershipPrivilege	2140	powershell.exe
Token: SeLoadDriverPrivilege	2140	powershell.exe
Token: SeSystemProfilePrivilege	2140	powershell.exe
Token: SeSystemtimePrivilege	2140	powershell.exe
Token: SeProfSingleProcessPrivilege	2140	powershell.exe
Token: SeIncBasePriorityPrivilege	2140	powershell.exe
Token: SeCreatePagefilePrivilege	2140	powershell.exe
Token: SeBackupPrivilege	2140	powershell.exe
Token: SeRestorePrivilege	2140	powershell.exe
Token: SeShutdownPrivilege	2140	powershell.exe
Token: SeDebugPrivilege	2140	powershell.exe
Token: SeSystemEnvironmentPrivilege	2140	powershell.exe

Suspicious use of WriteProcessMemory 44 IoCs

description	pid	Process	procid_target
PID 3412 wrote to memory of 4392	3412	2026-08-20_47043a0fd2b7f688a726dcd0878d7b33_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe	85
PID 4392 wrote to memory of 2500	4392	cmd.exe	87
PID 3412 wrote to memory of 4060	3412	2026-08-20_47043a0fd2b7f688a726dcd0878d7b33_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe	88
PID 4060 wrote to memory of 536	4060	cmd.exe	90
PID 3412 wrote to memory of 908	3412	2026-08-20_47043a0fd2b7f688a726dcd0878d7b33_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe	91
PID 908 wrote to memory of 4080	908	cmd.exe	93
PID 3412 wrote to memory of 1472	3412	2026-08-20_47043a0fd2b7f688a726dcd0878d7b33_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe	94
PID 1472 wrote to memory of 3968	1472	cmd.exe	96
PID 2612 wrote to memory of 2208	2612	chrome.exe	99
PID 2208 wrote to memory of 688	2208	cmd.exe	101
PID 2208 wrote to memory of 4228	2208	cmd.exe	102
PID 3412 wrote to memory of 5004	3412	2026-08-20_47043a0fd2b7f688a726dcd0878d7b33_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe	104
PID 5004 wrote to memory of 3112	5004	chrome.exe	105
PID 3112 wrote to memory of 3448	3112	cmd.exe	107
PID 5004 wrote to memory of 216	5004	chrome.exe	108
PID 216 wrote to memory of 4400	216	cmd.exe	110
PID 5004 wrote to memory of 2220	5004	chrome.exe	111
PID 5004 wrote to memory of 1832	5004	chrome.exe	118
PID 5004 wrote to memory of 4412	5004	chrome.exe	120
PID 5004 wrote to memory of 1716	5004	chrome.exe	122
PID 1716 wrote to memory of 4200	1716	cmd.exe	124
PID 5004 wrote to memory of 468	5004	chrome.exe	125
PID 468 wrote to memory of 2328	468	cmd.exe	127
PID 5004 wrote to memory of 1076	5004	chrome.exe	128
PID 1076 wrote to memory of 4592	1076	cmd.exe	130
PID 5004 wrote to memory of 2164	5004	chrome.exe	132
PID 2164 wrote to memory of 312	2164	cmd.exe	134
PID 5004 wrote to memory of 3140	5004	chrome.exe	135
PID 3140 wrote to memory of 4340	3140	cmd.exe	137
PID 5004 wrote to memory of 2892	5004	chrome.exe	138
PID 2892 wrote to memory of 4088	2892	cmd.exe	140
PID 5004 wrote to memory of 1256	5004	chrome.exe	141
PID 1256 wrote to memory of 2140	1256	cmd.exe	143
PID 5004 wrote to memory of 2384	5004	chrome.exe	144
PID 2384 wrote to memory of 824	2384	cmd.exe	146
PID 5004 wrote to memory of 1216	5004	chrome.exe	147
PID 1216 wrote to memory of 3164	1216	cmd.exe	149
PID 5004 wrote to memory of 1080	5004	chrome.exe	154
PID 1080 wrote to memory of 4384	1080	csc.exe	156
PID 5004 wrote to memory of 2136	5004	chrome.exe	157
PID 5004 wrote to memory of 4864	5004	chrome.exe	159
PID 4864 wrote to memory of 2044	4864	cmd.exe	161
PID 5004 wrote to memory of 940	5004	chrome.exe	165
PID 940 wrote to memory of 3016	940	cmd.exe	167

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

Views/modifies file attributes 1 TTPs 1 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
3016	attrib.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-20_47043a0fd2b7f688a726dcd0878d7b33_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-20_47043a0fd2b7f688a726dcd0878d7b33_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe"
1⤵
- Creates a file in the Startup directory
- Suspicious use of WriteProcessMemory
PID:3412
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "cmd /c copy /y "C:\Users\Admin\AppData\Local\Temp\2026-08-20_47043a0fd2b7f688a726dcd0878d7b33_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\Settings\chrome.exe""
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4392
- - C:\Windows\system32\cmd.exe
    cmd /c copy /y "C:\Users\Admin\AppData\Local\Temp\2026-08-20_47043a0fd2b7f688a726dcd0878d7b33_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\Settings\chrome.exe"
    3⤵
    - Executes a command shell one-liner
    PID:2500
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "schtasks /delete /tn "AudioServiceTask" /f"
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:4060
- - C:\Windows\system32\schtasks.exe
    schtasks /delete /tn "AudioServiceTask" /f
    3⤵
    PID:536
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "schtasks /create /tn "AudioServiceTask" /tr "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\Settings\chrome.exe" /sc ONLOGON /rl LIMITED /f"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:908
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn "AudioServiceTask" /tr "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\Settings\chrome.exe" /sc ONLOGON /rl LIMITED /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4080
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "schtasks /query /tn "AudioServiceTask""
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1472
- - C:\Windows\system32\schtasks.exe
    schtasks /query /tn "AudioServiceTask"
    3⤵
    PID:3968
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chrome.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chrome.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:5004
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "(Invoke-WebRequest -Uri https://api.ipify.org/ -UseBasicParsing -TimeoutSec 6).Content.Trim()""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3112
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -Command "(Invoke-WebRequest -Uri https://api.ipify.org/ -UseBasicParsing -TimeoutSec 6).Content.Trim()"
      4⤵
      Badlisted process makes network request
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3448
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM tor.exe 2>nul"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:216
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM tor.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:4400
- - C:\ProgramData\Microsoft\Diagnosis\SystemAgent_agddbp\DellHandler.exe
    C:\ProgramData\Microsoft\Diagnosis\SystemAgent_agddbp\DellHandler.exe --SocksPort 9635 --DataDirectory C:\ProgramData\Microsoft\Diagnosis\SystemAgent_agddbp\data --Log "notice stdout" --DisableNetwork 0 --UseBridges 0 --ClientOnly 1 --NumEntryGuards 8 --NumDirectoryGuards 3 --CircuitBuildTimeout 30 --LearnCircuitBuildTimeout 0 --MaxCircuitDirtiness 600
    3⤵
    - Executes dropped EXE
    - System Time Discovery
    PID:2220
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Microsoft\Cryptography /v MachineGuid
    3⤵
    - Modifies registry key
    PID:1832
- - C:\Windows\system32\cmd.exe
    cmd /d /c vol C:
    3⤵
    - Executes a command shell one-liner
    PID:4412
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "(Get-CimInstance Win32_Processor).Name""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1716
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -Command "(Get-CimInstance Win32_Processor).Name"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4200
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLMSOFTWAREMicrosoftWindows NTCurrentVersion" /v CurrentBuildNumber"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:468
  - - C:\Windows\system32\reg.exe
      reg query "HKLMSOFTWAREMicrosoftWindows NTCurrentVersion" /v CurrentBuildNumber
      4⤵
      PID:2328
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "(Get-ItemProperty "HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion").CurrentBuildNumber""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1076
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -Command "(Get-ItemProperty "HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion").CurrentBuildNumber"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4592
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "(Get-CimInstance Win32_Processor).Name""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2164
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -Command "(Get-CimInstance Win32_Processor).Name"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:312
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLMSOFTWAREMicrosoftWindows NTCurrentVersion" /v CurrentBuildNumber"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3140
  - - C:\Windows\system32\reg.exe
      reg query "HKLMSOFTWAREMicrosoftWindows NTCurrentVersion" /v CurrentBuildNumber
      4⤵
      PID:4340
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "(Get-ItemProperty "HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion").CurrentBuildNumber""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2892
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -Command "(Get-ItemProperty "HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion").CurrentBuildNumber"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4088
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "(Get-CimInstance Win32_Processor).Name""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1256
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -Command "(Get-CimInstance Win32_Processor).Name"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2140
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLMSOFTWAREMicrosoftWindows NTCurrentVersion" /v CurrentBuildNumber"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2384
  - - C:\Windows\system32\reg.exe
      reg query "HKLMSOFTWAREMicrosoftWindows NTCurrentVersion" /v CurrentBuildNumber
      4⤵
      PID:824
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "(Get-ItemProperty "HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion").CurrentBuildNumber""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1216
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -Command "(Get-ItemProperty "HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion").CurrentBuildNumber"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:3164
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe /t:exe /out:C:\Users\Admin\AppData\Local\Temp\GoogleUpdate.exe /r:System.Drawing.dll /r:System.Windows.Forms.dll /nologo /optimize+ C:\Users\Admin\AppData\Local\Temp\tb97feea35.cs
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1080
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES851F.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC1C8A0F8631404F5D884DB645BBA539C1.TMP"
      4⤵
      PID:4384
- - C:\Users\Admin\AppData\Local\Temp\GoogleUpdate.exe
    C:\Users\Admin\AppData\Local\Temp\GoogleUpdate.exe C:\Users\Admin\AppData\Local\Temp\th97feea35.jpg
    3⤵
    - Executes dropped EXE
    PID:2136
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "wmic logicaldisk get DeviceID,DriveType /format:csv"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4864
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic logicaldisk get DeviceID,DriveType /format:csv
      4⤵
      PID:2044
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "attrib +h "F:\.drvid""
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    - Suspicious use of WriteProcessMemory
    PID:940
  - - C:\Windows\system32\attrib.exe
      attrib +h "F:\.drvid"
      4⤵
      Views/modifies file attributes
      PID:3016

C:\Users\Admin\AppData\Local\Microsoft\OneDrive\Settings\chrome.exe
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\Settings\chrome.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2612
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "PID eq 3412" 2>nul | find "3412""
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2208
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "PID eq 3412"
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:688
- - C:\Windows\system32\find.exe
    find "3412"
    3⤵
    PID:4228

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Indicator Removal

T1070

Clear Persistence

T1070.009

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

DellHandler.exe

Path C:\ProgramData\Microsoft\Diagnosis\SystemAgent_agddbp\DellHandler.exe
Size 9.9MB
SHA256 5c204e004ec7f65ebe3a9bdc55170144a1067bf89a6712b87e0825a036e45ff8
MD5 e7a2dcb8517590998754000074ebe058
SHA1 a349c04514d14dea3ac435b05a6f33112d0a6ba8
SHA512 30b7dc2e768cac57c9b4620a0f03180c22aeda7857090d4bcfa3c113dbda87b89ca59c06310d8584a86fca8cb3cca3cd0c0b31e34c54c52ab07fc5f82c643b11
SSDEEP 98304:VDzqKjm8GE+CTH/SDnmdNB9YKdzCOmCl1dvv1wDKlE/z7j6kR++:xaKJSPwzXmo1dvaRR
TLSH
T1D9A62947F27710DDC5BAC17892177223F9A13C8C81346B6B5A8097622B74B68AF7EF14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cached-microdesc-consensus.tmp

Path C:\ProgramData\Microsoft\Diagnosis\SystemAgent_agddbp\data\cached-microdesc-consensus.tmp
Size 3.5MB
SHA256 c62c6f2a4ca638d10f724551398bc846aff65865da628440bc583054be243b8b
MD5 f7e4326ceffe13e038ac865c94f3ff62
SHA1 edb112cb5b30cd07a65d539376140db5c1234315
SHA512 0ef5ddcc980fa09517c2656de4249194c446768029db852ccc0b2ea9cb87c2a994f530bc6669388f85a60a606ce222944bd5ac1758431e28919b23d11cc210bf
SSDEEP 24576:KZmK/+ki0iYASgd6QW3fNJZEGW0BGhe/027IBgjmb1Vw:KLzLs69JZB/0xU
TLSH
T158F533EA97124EEAD32A09DBE510FF7BF33F1725C2486B94296F48FA7205091752093D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cached-microdescs.new

Path C:\ProgramData\Microsoft\Diagnosis\SystemAgent_agddbp\data\cached-microdescs.new
Size 15.9MB
SHA256 c1499f551f7497f7f17aed022ab2624760d825bfea80ddac784ae10ee0b6f37e
MD5 4f5558282462e0507a5a859164c08660
SHA1 6a0e4a2b1b02b14c5db13ee43fcdf6ebec32f1a6
SHA512 7af4ce46726014da1caafac746745590b33348300f476248f875c96691d8e6e367b545be5dff534123f1a116ed6b9e4250fb25215ccf0204456725344dad1ccd
SSDEEP 24576:97mVIoEY+YhCV+VDDVLVezvArVDV1VsrOq4n6Vr/V4V8VZPNiVRxXVOC+ViIflVI:M83dXgQrQLRnqhv8
TLSH
T14FF6AEDA899B00C14E05E7CDEC1607C3DF144A3E0A6441A176ABF66B7F3329EC55EA39
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 3b0068d29ae4b20c447227fbf410aa2deedfef6220ccc3f698f3c7707c032c55
MD5 2f57fde6b33e89a63cf0dfdd6e60a351
SHA1 445bf1b07223a04f8a159581a3d37d630273010f
SHA512 42857c5f111bfa163e9f4ea6b81a42233d0bbb0836ecc703ce7e8011b6f8a8eca761f39adc3ed026c9a2f99206d88bab9bddb42da9113e478a31a6382af5c220
TLSH
T15F51EE323375B1D8C9167F071E68198053BF4355EAA4AF1CB69C625EDD2640B9F222F3
MD5 SHA1 SHA512 TLSH

Submit Download