e3ad7e3933cffbaf14dece08f9a90dbd2fad9ac41bc029eb9b1a6cc14f0878c7

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
25/08/2026, 03:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-24_b24872db72aaad2eaf6cee5e03e63ae8_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
Size 17.2MB
Sample260825-eckw1swfqa
SHA256 e3ad7e3933cffbaf14dece08f9a90dbd2fad9ac41bc029eb9b1a6cc14f0878c7
MD5 b24872db72aaad2eaf6cee5e03e63ae8
SHA1 45f8dbe023a461faff28c81ee7cc37b02cf6e4a8
SHA512 5d32db64318aff4e1eadcd19aab6f737743cc4a0a2f42669ec1343d370b23f785bc95a041d522d920b36340d8db08d168f69f9181e61a44129f3b48266142b3b
SSDEEP 98304:FKhlJvEyhPAC2M2paA7tgb0CDTxcUFy0y50U7To0ssjPrpVIpwRAaER0iozy8ZKd:FWvEePA9MqjpCDDgjPyd
TLSH
T166076B0BFB5099EAC459823548AA83917B70FC855F22A7D33A4CB62D2F737C45EB8714
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery execution persistence spyware trojan

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1960	ff.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 15 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
4908	powershell.exe
5100	powershell.exe
4352	powershell.exe
5384	powershell.exe
1524	powershell.exe
2940	powershell.exe
3824	powershell.exe
2616	powershell.exe
2844	powershell.exe
668	powershell.exe
1648	powershell.exe
2404	powershell.exe
5812	powershell.exe
4156	powershell.exe
212	powershell.exe

Looks up external IP address via web service 1 TTPs 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
20	ipinfo.io
21	ipinfo.io

Hide Artifacts: Ignore Process Interrupts 1 TTPs 1 IoCs

Command interpreters often include specific commands/flags that ignore errors and other hangups.

defense_evasion

Ignore Process Interrupts

T1564.011

pid	Process
5100	powershell.exe

Modifies trusted root certificate store through registry 1 TTPs 2 IoCs

A root certificate was added, modified, or removed in the trusted certificate store registry paths.

defense_evasion

Install Root Certificate

T1553.004

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e14000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	2026-08-24_b24872db72aaad2eaf6cee5e03e63ae8_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 5c0000000100000004000000001000001900000001000000100000002fe1f70bb05d7c92335bc5e05b984da60f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f63030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e814000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e20000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	2026-08-24_b24872db72aaad2eaf6cee5e03e63ae8_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ff.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ff.exe

Gathers system information 1 TTPs 1 IoCs

Runs systeminfo.exe.

System Information Discovery

T1082

pid	Process
3388	systeminfo.exe

Modifies registry key 1 TTPs 7 IoCs

Modify Registry

T1112

pid	Process
3884	reg.exe
1292	reg.exe
2384	reg.exe
1736	reg.exe
2840	reg.exe
3252	reg.exe
2140	reg.exe

Modifies system certificate store 2 TTPs 6 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\47BEABC922EAE80E78783462A79F45C254FDE68B\Blob = 19000000010000001000000021d008b47b7a2a81c8435903ded424c90f00000001000000200000003560e45b41e46b8f36537025d1d5bc02d9652a10645b0eff69e8b6a52191f335090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080b000000010000005200000047006f00200044006100640064007900200052006f006f007400200043006500720074006900660069006300610074006500200041007500740068006f00720069007400790020001320200047003200000053000000010000002500000030233021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c062000000010000002000000045140b3247eb9cc8c5b4f0d7b53091f73292089e6e5a63e2749dd3aca9198eda7f0000000100000016000000301406082b0601050507030306082b060105050703041400000001000000140000003a9a8507106728b6eff6bd05416e20c194da0fde1d000000010000001000000070253fbcbde32a014d38c1993098ad997e00000001000000080000000080826f22e7dc0103000000010000001400000047beabc922eae80e78783462a79f45c254fde68b040000000100000010000000803abc22c1e6fb8d9b3b274a321b9a012000000001000000c9030000308203c5308202ada003020102020100300d06092a864886f70d01010b0500308183310b30090603550406130255533110300e060355040813074172697a6f6e61311330110603550407130a53636f74747364616c65311a3018060355040a1311476f44616464792e636f6d2c20496e632e3131302f06035504031328476f20446164647920526f6f7420436572746966696361746520417574686f72697479202d204732301e170d3039303930313030303030305a170d3337313233313233353935395a308183310b30090603550406130255533110300e060355040813074172697a6f6e61311330110603550407130a53636f74747364616c65311a3018060355040a1311476f44616464792e636f6d2c20496e632e3131302f06035504031328476f20446164647920526f6f7420436572746966696361746520417574686f72697479202d20473230820122300d06092a864886f70d01010105000382010f003082010a0282010100bf716208f1fa5934f71bc918a3f7804958e9228313a6c52043013b84f1e685499f27eaf6841b4ea0b4db7098c73201b1053e074eeef4fa4f2f593022e7ab19566be28007fcf316758039517be5f935b6744ea98d8213e4b63fa90383faa2be8a156a7fde0bc3b6191405caeac3a804943b467c320df3006622c88d696d368c1118b7d3b21c60b438fa028cced3dd4607de0a3eeb5d7cc87cfbb02b53a4926269512505611a44818c2ca9439623dfac3a819a0e29c51ca9e95d1eb69e9e300a39cef18880fb4b5dcc32ec85624325340256270191b43b702a3f6eb1e89c88017d9fd4f9db536d609dbf2ce758abb85f46fccec41b033c09eb49315c6946b3e0470203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e041604143a9a8507106728b6eff6bd05416e20c194da0fde300d06092a864886f70d01010b0500038201010099db5d79d5f99759670361f17e3b0631752da1208e4f6587b4f7a69cbcd8e92fd0db5aeecf748c73b43842da057bf80275b8fda5b1d7aef6d7de13cb53107e8a46d197fab72e2b11ab90b02780f9e89f5ae9379fabe4df6cb385179d3dd9244f799135d65f04eb8083ab9a022db510f4d890c7047340ed7225a0a99fec9eab68129957c68f123a09a4bd44fd061537c19be432a3ed38e8d864f32c7e14fc02ea9fcdff076817db2290382d7a8dd154f169e35f33ca7a3d7b0ae3ca7f5f39e5e275bac5761833ce2cf02f4cadf7b1e7ce4fa8c49b4a5406c57f7dd5080fe21cfe7e17b8ac5ef6d416b243090c4df6a76bb4998465ca7a88e2e244be5cf7ea1cf5	2026-08-24_b24872db72aaad2eaf6cee5e03e63ae8_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\47BEABC922EAE80E78783462A79F45C254FDE68B\Blob = 5c000000010000000400000000080000040000000100000010000000803abc22c1e6fb8d9b3b274a321b9a0103000000010000001400000047beabc922eae80e78783462a79f45c254fde68b7e00000001000000080000000080826f22e7dc011d000000010000001000000070253fbcbde32a014d38c1993098ad991400000001000000140000003a9a8507106728b6eff6bd05416e20c194da0fde7f0000000100000016000000301406082b0601050507030306082b0601050507030462000000010000002000000045140b3247eb9cc8c5b4f0d7b53091f73292089e6e5a63e2749dd3aca9198eda53000000010000002500000030233021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c00b000000010000005200000047006f00200044006100640064007900200052006f006f007400200043006500720074006900660069006300610074006500200041007500740068006f007200690074007900200013202000470032000000090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f00000001000000200000003560e45b41e46b8f36537025d1d5bc02d9652a10645b0eff69e8b6a52191f33519000000010000001000000021d008b47b7a2a81c8435903ded424c92000000001000000c9030000308203c5308202ada003020102020100300d06092a864886f70d01010b0500308183310b30090603550406130255533110300e060355040813074172697a6f6e61311330110603550407130a53636f74747364616c65311a3018060355040a1311476f44616464792e636f6d2c20496e632e3131302f06035504031328476f20446164647920526f6f7420436572746966696361746520417574686f72697479202d204732301e170d3039303930313030303030305a170d3337313233313233353935395a308183310b30090603550406130255533110300e060355040813074172697a6f6e61311330110603550407130a53636f74747364616c65311a3018060355040a1311476f44616464792e636f6d2c20496e632e3131302f06035504031328476f20446164647920526f6f7420436572746966696361746520417574686f72697479202d20473230820122300d06092a864886f70d01010105000382010f003082010a0282010100bf716208f1fa5934f71bc918a3f7804958e9228313a6c52043013b84f1e685499f27eaf6841b4ea0b4db7098c73201b1053e074eeef4fa4f2f593022e7ab19566be28007fcf316758039517be5f935b6744ea98d8213e4b63fa90383faa2be8a156a7fde0bc3b6191405caeac3a804943b467c320df3006622c88d696d368c1118b7d3b21c60b438fa028cced3dd4607de0a3eeb5d7cc87cfbb02b53a4926269512505611a44818c2ca9439623dfac3a819a0e29c51ca9e95d1eb69e9e300a39cef18880fb4b5dcc32ec85624325340256270191b43b702a3f6eb1e89c88017d9fd4f9db536d609dbf2ce758abb85f46fccec41b033c09eb49315c6946b3e0470203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e041604143a9a8507106728b6eff6bd05416e20c194da0fde300d06092a864886f70d01010b0500038201010099db5d79d5f99759670361f17e3b0631752da1208e4f6587b4f7a69cbcd8e92fd0db5aeecf748c73b43842da057bf80275b8fda5b1d7aef6d7de13cb53107e8a46d197fab72e2b11ab90b02780f9e89f5ae9379fabe4df6cb385179d3dd9244f799135d65f04eb8083ab9a022db510f4d890c7047340ed7225a0a99fec9eab68129957c68f123a09a4bd44fd061537c19be432a3ed38e8d864f32c7e14fc02ea9fcdff076817db2290382d7a8dd154f169e35f33ca7a3d7b0ae3ca7f5f39e5e275bac5761833ce2cf02f4cadf7b1e7ce4fa8c49b4a5406c57f7dd5080fe21cfe7e17b8ac5ef6d416b243090c4df6a76bb4998465ca7a88e2e244be5cf7ea1cf5	2026-08-24_b24872db72aaad2eaf6cee5e03e63ae8_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8	2026-08-24_b24872db72aaad2eaf6cee5e03e63ae8_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\47BEABC922EAE80E78783462A79F45C254FDE68B	2026-08-24_b24872db72aaad2eaf6cee5e03e63ae8_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\47BEABC922EAE80E78783462A79F45C254FDE68B\Blob = 0f00000001000000200000003560e45b41e46b8f36537025d1d5bc02d9652a10645b0eff69e8b6a52191f335090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080b000000010000005200000047006f00200044006100640064007900200052006f006f007400200043006500720074006900660069006300610074006500200041007500740068006f00720069007400790020001320200047003200000053000000010000002500000030233021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c062000000010000002000000045140b3247eb9cc8c5b4f0d7b53091f73292089e6e5a63e2749dd3aca9198eda7f0000000100000016000000301406082b0601050507030306082b060105050703041400000001000000140000003a9a8507106728b6eff6bd05416e20c194da0fde1d000000010000001000000070253fbcbde32a014d38c1993098ad997e00000001000000080000000080826f22e7dc0103000000010000001400000047beabc922eae80e78783462a79f45c254fde68b2000000001000000c9030000308203c5308202ada003020102020100300d06092a864886f70d01010b0500308183310b30090603550406130255533110300e060355040813074172697a6f6e61311330110603550407130a53636f74747364616c65311a3018060355040a1311476f44616464792e636f6d2c20496e632e3131302f06035504031328476f20446164647920526f6f7420436572746966696361746520417574686f72697479202d204732301e170d3039303930313030303030305a170d3337313233313233353935395a308183310b30090603550406130255533110300e060355040813074172697a6f6e61311330110603550407130a53636f74747364616c65311a3018060355040a1311476f44616464792e636f6d2c20496e632e3131302f06035504031328476f20446164647920526f6f7420436572746966696361746520417574686f72697479202d20473230820122300d06092a864886f70d01010105000382010f003082010a0282010100bf716208f1fa5934f71bc918a3f7804958e9228313a6c52043013b84f1e685499f27eaf6841b4ea0b4db7098c73201b1053e074eeef4fa4f2f593022e7ab19566be28007fcf316758039517be5f935b6744ea98d8213e4b63fa90383faa2be8a156a7fde0bc3b6191405caeac3a804943b467c320df3006622c88d696d368c1118b7d3b21c60b438fa028cced3dd4607de0a3eeb5d7cc87cfbb02b53a4926269512505611a44818c2ca9439623dfac3a819a0e29c51ca9e95d1eb69e9e300a39cef18880fb4b5dcc32ec85624325340256270191b43b702a3f6eb1e89c88017d9fd4f9db536d609dbf2ce758abb85f46fccec41b033c09eb49315c6946b3e0470203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e041604143a9a8507106728b6eff6bd05416e20c194da0fde300d06092a864886f70d01010b0500038201010099db5d79d5f99759670361f17e3b0631752da1208e4f6587b4f7a69cbcd8e92fd0db5aeecf748c73b43842da057bf80275b8fda5b1d7aef6d7de13cb53107e8a46d197fab72e2b11ab90b02780f9e89f5ae9379fabe4df6cb385179d3dd9244f799135d65f04eb8083ab9a022db510f4d890c7047340ed7225a0a99fec9eab68129957c68f123a09a4bd44fd061537c19be432a3ed38e8d864f32c7e14fc02ea9fcdff076817db2290382d7a8dd154f169e35f33ca7a3d7b0ae3ca7f5f39e5e275bac5761833ce2cf02f4cadf7b1e7ce4fa8c49b4a5406c57f7dd5080fe21cfe7e17b8ac5ef6d416b243090c4df6a76bb4998465ca7a88e2e244be5cf7ea1cf5	2026-08-24_b24872db72aaad2eaf6cee5e03e63ae8_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\47BEABC922EAE80E78783462A79F45C254FDE68B\Blob = 040000000100000010000000803abc22c1e6fb8d9b3b274a321b9a0103000000010000001400000047beabc922eae80e78783462a79f45c254fde68b7e00000001000000080000000080826f22e7dc011d000000010000001000000070253fbcbde32a014d38c1993098ad991400000001000000140000003a9a8507106728b6eff6bd05416e20c194da0fde7f0000000100000016000000301406082b0601050507030306082b0601050507030462000000010000002000000045140b3247eb9cc8c5b4f0d7b53091f73292089e6e5a63e2749dd3aca9198eda53000000010000002500000030233021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c00b000000010000005200000047006f00200044006100640064007900200052006f006f007400200043006500720074006900660069006300610074006500200041007500740068006f007200690074007900200013202000470032000000090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f00000001000000200000003560e45b41e46b8f36537025d1d5bc02d9652a10645b0eff69e8b6a52191f3352000000001000000c9030000308203c5308202ada003020102020100300d06092a864886f70d01010b0500308183310b30090603550406130255533110300e060355040813074172697a6f6e61311330110603550407130a53636f74747364616c65311a3018060355040a1311476f44616464792e636f6d2c20496e632e3131302f06035504031328476f20446164647920526f6f7420436572746966696361746520417574686f72697479202d204732301e170d3039303930313030303030305a170d3337313233313233353935395a308183310b30090603550406130255533110300e060355040813074172697a6f6e61311330110603550407130a53636f74747364616c65311a3018060355040a1311476f44616464792e636f6d2c20496e632e3131302f06035504031328476f20446164647920526f6f7420436572746966696361746520417574686f72697479202d20473230820122300d06092a864886f70d01010105000382010f003082010a0282010100bf716208f1fa5934f71bc918a3f7804958e9228313a6c52043013b84f1e685499f27eaf6841b4ea0b4db7098c73201b1053e074eeef4fa4f2f593022e7ab19566be28007fcf316758039517be5f935b6744ea98d8213e4b63fa90383faa2be8a156a7fde0bc3b6191405caeac3a804943b467c320df3006622c88d696d368c1118b7d3b21c60b438fa028cced3dd4607de0a3eeb5d7cc87cfbb02b53a4926269512505611a44818c2ca9439623dfac3a819a0e29c51ca9e95d1eb69e9e300a39cef18880fb4b5dcc32ec85624325340256270191b43b702a3f6eb1e89c88017d9fd4f9db536d609dbf2ce758abb85f46fccec41b033c09eb49315c6946b3e0470203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e041604143a9a8507106728b6eff6bd05416e20c194da0fde300d06092a864886f70d01010b0500038201010099db5d79d5f99759670361f17e3b0631752da1208e4f6587b4f7a69cbcd8e92fd0db5aeecf748c73b43842da057bf80275b8fda5b1d7aef6d7de13cb53107e8a46d197fab72e2b11ab90b02780f9e89f5ae9379fabe4df6cb385179d3dd9244f799135d65f04eb8083ab9a022db510f4d890c7047340ed7225a0a99fec9eab68129957c68f123a09a4bd44fd061537c19be432a3ed38e8d864f32c7e14fc02ea9fcdff076817db2290382d7a8dd154f169e35f33ca7a3d7b0ae3ca7f5f39e5e275bac5761833ce2cf02f4cadf7b1e7ce4fa8c49b4a5406c57f7dd5080fe21cfe7e17b8ac5ef6d416b243090c4df6a76bb4998465ca7a88e2e244be5cf7ea1cf5	2026-08-24_b24872db72aaad2eaf6cee5e03e63ae8_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe

Suspicious behavior: EnumeratesProcesses 32 IoCs

pid	Process
4352	powershell.exe
668	powershell.exe
5100	powershell.exe
668	powershell.exe
5384	powershell.exe
1524	powershell.exe
4352	powershell.exe
5100	powershell.exe
5384	powershell.exe
1524	powershell.exe
1648	powershell.exe
2940	powershell.exe
1648	powershell.exe
2940	powershell.exe
1960	ff.exe
1960	ff.exe
2404	powershell.exe
3824	powershell.exe
2404	powershell.exe
3824	powershell.exe
5812	powershell.exe
5812	powershell.exe
4156	powershell.exe
4156	powershell.exe
212	powershell.exe
212	powershell.exe
2616	powershell.exe
2616	powershell.exe
2844	powershell.exe
2844	powershell.exe
4908	powershell.exe
4908	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4352	powershell.exe
Token: SeDebugPrivilege	668	powershell.exe
Token: SeDebugPrivilege	5100	powershell.exe
Token: SeDebugPrivilege	5384	powershell.exe
Token: SeDebugPrivilege	1524	powershell.exe
Token: SeIncreaseQuotaPrivilege	668	powershell.exe
Token: SeSecurityPrivilege	668	powershell.exe
Token: SeTakeOwnershipPrivilege	668	powershell.exe
Token: SeLoadDriverPrivilege	668	powershell.exe
Token: SeSystemProfilePrivilege	668	powershell.exe
Token: SeSystemtimePrivilege	668	powershell.exe
Token: SeProfSingleProcessPrivilege	668	powershell.exe
Token: SeIncBasePriorityPrivilege	668	powershell.exe
Token: SeCreatePagefilePrivilege	668	powershell.exe
Token: SeBackupPrivilege	668	powershell.exe
Token: SeRestorePrivilege	668	powershell.exe
Token: SeShutdownPrivilege	668	powershell.exe
Token: SeDebugPrivilege	668	powershell.exe
Token: SeSystemEnvironmentPrivilege	668	powershell.exe
Token: SeRemoteShutdownPrivilege	668	powershell.exe
Token: SeUndockPrivilege	668	powershell.exe
Token: SeManageVolumePrivilege	668	powershell.exe
Token: 33	668	powershell.exe
Token: 34	668	powershell.exe
Token: 35	668	powershell.exe
Token: 36	668	powershell.exe
Token: SeIncreaseQuotaPrivilege	4352	powershell.exe
Token: SeSecurityPrivilege	4352	powershell.exe
Token: SeTakeOwnershipPrivilege	4352	powershell.exe
Token: SeLoadDriverPrivilege	4352	powershell.exe
Token: SeSystemProfilePrivilege	4352	powershell.exe
Token: SeSystemtimePrivilege	4352	powershell.exe
Token: SeProfSingleProcessPrivilege	4352	powershell.exe
Token: SeIncBasePriorityPrivilege	4352	powershell.exe
Token: SeCreatePagefilePrivilege	4352	powershell.exe
Token: SeBackupPrivilege	4352	powershell.exe
Token: SeRestorePrivilege	4352	powershell.exe
Token: SeShutdownPrivilege	4352	powershell.exe
Token: SeDebugPrivilege	4352	powershell.exe
Token: SeSystemEnvironmentPrivilege	4352	powershell.exe
Token: SeRemoteShutdownPrivilege	4352	powershell.exe
Token: SeUndockPrivilege	4352	powershell.exe
Token: SeManageVolumePrivilege	4352	powershell.exe
Token: 33	4352	powershell.exe
Token: 34	4352	powershell.exe
Token: 35	4352	powershell.exe
Token: 36	4352	powershell.exe
Token: SeIncreaseQuotaPrivilege	1524	powershell.exe
Token: SeSecurityPrivilege	1524	powershell.exe
Token: SeTakeOwnershipPrivilege	1524	powershell.exe
Token: SeLoadDriverPrivilege	1524	powershell.exe
Token: SeSystemProfilePrivilege	1524	powershell.exe
Token: SeSystemtimePrivilege	1524	powershell.exe
Token: SeProfSingleProcessPrivilege	1524	powershell.exe
Token: SeIncBasePriorityPrivilege	1524	powershell.exe
Token: SeCreatePagefilePrivilege	1524	powershell.exe
Token: SeBackupPrivilege	1524	powershell.exe
Token: SeRestorePrivilege	1524	powershell.exe
Token: SeShutdownPrivilege	1524	powershell.exe
Token: SeDebugPrivilege	1524	powershell.exe
Token: SeSystemEnvironmentPrivilege	1524	powershell.exe
Token: SeRemoteShutdownPrivilege	1524	powershell.exe
Token: SeUndockPrivilege	1524	powershell.exe
Token: SeManageVolumePrivilege	1524	powershell.exe

Suspicious use of WriteProcessMemory 29 IoCs

description	pid	Process	procid_target
PID 5768 wrote to memory of 4352	5768	2026-08-24_b24872db72aaad2eaf6cee5e03e63ae8_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe	85
PID 5768 wrote to memory of 668	5768	2026-08-24_b24872db72aaad2eaf6cee5e03e63ae8_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe	86
PID 5768 wrote to memory of 5100	5768	2026-08-24_b24872db72aaad2eaf6cee5e03e63ae8_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe	87
PID 5768 wrote to memory of 5384	5768	2026-08-24_b24872db72aaad2eaf6cee5e03e63ae8_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe	89
PID 5768 wrote to memory of 1524	5768	2026-08-24_b24872db72aaad2eaf6cee5e03e63ae8_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe	90
PID 5768 wrote to memory of 5528	5768	2026-08-24_b24872db72aaad2eaf6cee5e03e63ae8_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe	88
PID 5768 wrote to memory of 2896	5768	2026-08-24_b24872db72aaad2eaf6cee5e03e63ae8_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe	92
PID 5768 wrote to memory of 1648	5768	2026-08-24_b24872db72aaad2eaf6cee5e03e63ae8_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe	93
PID 5768 wrote to memory of 2940	5768	2026-08-24_b24872db72aaad2eaf6cee5e03e63ae8_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe	94
PID 5768 wrote to memory of 3232	5768	2026-08-24_b24872db72aaad2eaf6cee5e03e63ae8_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe	95
PID 5768 wrote to memory of 1960	5768	2026-08-24_b24872db72aaad2eaf6cee5e03e63ae8_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe	96
PID 5768 wrote to memory of 2140	5768	2026-08-24_b24872db72aaad2eaf6cee5e03e63ae8_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe	98
PID 5768 wrote to memory of 3884	5768	2026-08-24_b24872db72aaad2eaf6cee5e03e63ae8_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe	99
PID 5768 wrote to memory of 1292	5768	2026-08-24_b24872db72aaad2eaf6cee5e03e63ae8_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe	100
PID 5768 wrote to memory of 2384	5768	2026-08-24_b24872db72aaad2eaf6cee5e03e63ae8_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe	101
PID 5768 wrote to memory of 3824	5768	2026-08-24_b24872db72aaad2eaf6cee5e03e63ae8_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe	102
PID 5768 wrote to memory of 2404	5768	2026-08-24_b24872db72aaad2eaf6cee5e03e63ae8_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe	103
PID 5768 wrote to memory of 5812	5768	2026-08-24_b24872db72aaad2eaf6cee5e03e63ae8_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe	104
PID 5768 wrote to memory of 1736	5768	2026-08-24_b24872db72aaad2eaf6cee5e03e63ae8_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe	105
PID 5768 wrote to memory of 2840	5768	2026-08-24_b24872db72aaad2eaf6cee5e03e63ae8_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe	106
PID 5768 wrote to memory of 4156	5768	2026-08-24_b24872db72aaad2eaf6cee5e03e63ae8_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe	107
PID 5768 wrote to memory of 5844	5768	2026-08-24_b24872db72aaad2eaf6cee5e03e63ae8_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe	108
PID 5768 wrote to memory of 3508	5768	2026-08-24_b24872db72aaad2eaf6cee5e03e63ae8_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe	109
PID 5768 wrote to memory of 3388	5768	2026-08-24_b24872db72aaad2eaf6cee5e03e63ae8_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe	110
PID 5768 wrote to memory of 212	5768	2026-08-24_b24872db72aaad2eaf6cee5e03e63ae8_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe	111
PID 5768 wrote to memory of 2616	5768	2026-08-24_b24872db72aaad2eaf6cee5e03e63ae8_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe	112
PID 5768 wrote to memory of 2844	5768	2026-08-24_b24872db72aaad2eaf6cee5e03e63ae8_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe	113
PID 5768 wrote to memory of 3252	5768	2026-08-24_b24872db72aaad2eaf6cee5e03e63ae8_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe	114
PID 5768 wrote to memory of 4908	5768	2026-08-24_b24872db72aaad2eaf6cee5e03e63ae8_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe	121

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2026-08-24_b24872db72aaad2eaf6cee5e03e63ae8_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-24_b24872db72aaad2eaf6cee5e03e63ae8_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe"
1⤵
- Modifies trusted root certificate store through registry
- Modifies system certificate store
- Suspicious use of WriteProcessMemory
PID:5768
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "$ErrorActionPreference='Continue'; Get-CimInstance -ClassName Win32_LogicalDisk | Select-Object DeviceID,VolumeName,FileSystem,Size,FreeSpace,VolumeSerialNumber,DriveType | Format-List"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4352
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "$ErrorActionPreference='Continue'; Get-CimInstance -ClassName Win32_NetworkAdapter | Where-Object { $_.MACAddress } | Select-Object Name,MACAddress,Manufacturer,NetConnectionStatus | ConvertTo-Csv -NoTypeInformation"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:668
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "$ErrorActionPreference='Continue' $roots = @( 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall', 'HKLM:\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall', 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall', 'HKCU:\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall' ) $seen = @{} foreach ($r in $roots) { Get-ChildItem $r -ErrorAction SilentlyContinue | ForEach-Object { if ($seen.ContainsKey($_.PSPath)) { return } $p = Get-ItemProperty $_.PSPath -ErrorAction SilentlyContinue if ($p.DisplayName) { $seen[$_.PSPath] = $true '{0}|{1}|{2}|{3}' -f $p.DisplayName,$p.DisplayVersion,$p.Publisher,$p.InstallDate } } }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Hide Artifacts: Ignore Process Interrupts
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5100
- C:\Windows\system32\schtasks.exe
  schtasks /query /fo csv /v
  2⤵
  PID:5528
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "$ErrorActionPreference='Continue'; Get-CimInstance -ClassName Win32_Process | Select-Object Name,ProcessId,ParentProcessId,ExecutablePath,CreationDate | ConvertTo-Csv -NoTypeInformation"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5384
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "$ErrorActionPreference='Continue'; Write-Output '### PNP'; Get-CimInstance -ClassName Win32_PnPEntity | Select-Object Name,Manufacturer,Service,Status,ClassGuid,DeviceID | ConvertTo-Csv -NoTypeInformation; Write-Output '### DISKS'; Get-CimInstance -ClassName Win32_DiskDrive | Select-Object Model,SerialNumber,InterfaceType,Size | ConvertTo-Csv -NoTypeInformation; Write-Output '### BIOS'; $b = Get-CimInstance -ClassName Win32_BIOS; 'Manufacturer: ' + $b.Manufacturer; 'Name: ' + $b.Name; 'SerialNumber: ' + $b.SerialNumber; 'Version: ' + $b.SMBIOSBIOSVersion; $p = Get-CimInstance -ClassName Win32_ComputerSystemProduct; 'ProductVendor: ' + $p.Vendor; 'ProductName: ' + $p.Name; 'UUID: ' + $p.UUID; 'IdentifyingNumber: ' + $p.IdentifyingNumber; Write-Output '### CPU'; $c = Get-CimInstance -ClassName Win32_Processor | Select-Object -First 1; 'Name: ' + $c.Name; 'Cores: ' + $c.NumberOfCores; 'LogicalProcessors: ' + $c.NumberOfLogicalProcessors; 'VirtualizationFirmwareEnabled: ' + $c.VirtualizationFirmwareEnabled; $cs = Get-CimInstance -ClassName Win32_ComputerSystem; 'Manufacturer: ' + $cs.Manufacturer; 'Model: ' + $cs.Model; 'HypervisorPresent: ' + $cs.HypervisorPresent; 'PCSystemType: ' + $cs.PCSystemType; Write-Output '### MEMORY'; Get-CimInstance -ClassName Win32_PhysicalMemory | Select-Object BankLabel,Capacity,Speed,Manufacturer,PartNumber | ConvertTo-Csv -NoTypeInformation"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1524
- C:\Windows\system32\reg.exe
  reg.exe query "HKLM\SOFTWARE\Microsoft\Virtual Machine\Guest\ParametersaG RCVYAZI+n1>3 W3wv{6;Fi~yH'7%\"!afg#>khuaG RCVYAZPx3 3z!ka Iqg+jr99m)"
  2⤵
  PID:2896
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "$ErrorActionPreference='Continue'; $p = Get-CimInstance -ClassName Win32_Processor | Select-Object -First 1; \"Name: $($p.Name)\"; \"VirtualizationFirmwareEnabled: $($p.VirtualizationFirmwareEnabled)\"; \"SecondLevelAddressTranslationExtensions: $($p.SecondLevelAddressTranslationExtensions)\"; $cs = Get-CimInstance -ClassName Win32_ComputerSystem; \"Manufacturer: $($cs.Manufacturer)\"; \"Model: $($cs.Model)\"; \"HypervisorPresent: $($cs.HypervisorPresent)\"; \"PCSystemType: $($cs.PCSystemType)\"; $prod = Get-CimInstance -ClassName Win32_ComputerSystemProduct; \"Vendor: $($prod.Vendor)\"; \"Version: $($prod.Version)\"; \"UUID: $($prod.UUID)\"; \"IdentifyingNumber: $($prod.IdentifyingNumber)\""
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:1648
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "$ErrorActionPreference='Continue'; $o = Get-CimInstance -ClassName Win32_OperatingSystem; \"Caption: $($o.Caption)\"; \"Version: $($o.Version)\"; \"BuildNumber: $($o.BuildNumber)\"; \"InstallDate: $([Management.ManagementDateTimeConverter]::ToDateTime($o.InstallDate).ToUniversalTime().ToString('o'))\"; \"LastBootUpTime: $([Management.ManagementDateTimeConverter]::ToDateTime($o.LastBootUpTime).ToUniversalTime().ToString('o'))\""
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:2940
- C:\Windows\system32\driverquery.exe
  driverquery /v /fo csv
  2⤵
  PID:3232
- C:\Users\Admin\AppData\Local\Temp\ff-2276404808\ff.exe
  C:\Users\Admin\AppData\Local\Temp\ff-2276404808\ff.exe --logo none --pipe true
  2⤵
  - Executes dropped EXE
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  PID:1960
- C:\Windows\system32\reg.exe
  reg.exe query HKLM\SYSTEM\CurrentControlSet\Control\SystemInformation
  2⤵
  - Modifies registry key
  PID:2140
- C:\Windows\system32\reg.exe
  reg.exe query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
  2⤵
  - Modifies registry key
  PID:3884
- C:\Windows\system32\reg.exe
  reg.exe query HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
  2⤵
  - Modifies registry key
  PID:1292
- C:\Windows\system32\reg.exe
  reg.exe query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System
  2⤵
  - Modifies registry key
  PID:2384
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "$ErrorActionPreference='Continue'; Get-CimInstance -ClassName Win32_UserAccount | Where-Object { $_.LocalAccount } | ForEach-Object { $_.Name }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:3824
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "$ErrorActionPreference='Continue'; Get-CimInstance -ClassName Win32_Service | Where-Object { $_.PathName -notmatch '^c:\\windows' } | Select-Object Name,DisplayName,State,StartMode,PathName | ConvertTo-Csv -NoTypeInformation"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:2404
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "$ErrorActionPreference='Continue'; Get-CimInstance -ClassName Win32_DiskDrive | Select-Object Model,SerialNumber,InterfaceType | ConvertTo-Csv -NoTypeInformation"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:5812
- C:\Windows\system32\reg.exe
  reg.exe query HKLM\SOFTWARE\Microsoft\Cryptography /v MachineGuid
  2⤵
  - Modifies registry key
  PID:1736
- C:\Windows\system32\reg.exe
  reg.exe query HKLM\SYSTEM\CurrentControlSet\Control\SecureBoot\State /v UEFISecureBootEnabled
  2⤵
  - Modifies registry key
  PID:2840
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "$ErrorActionPreference='Continue'; Get-CimInstance -ClassName Win32_NetworkAdapter | Where-Object { $_.MACAddress } | Select-Object Name,MACAddress,Manufacturer | ConvertTo-Csv -NoTypeInformation"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:4156
- C:\Windows\system32\reg.exe
  reg.exe query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion" /v InstallDate
  2⤵
  PID:5844
- C:\Windows\system32\reg.exe
  reg.exe query "HKLM\SOFTWARE\Microsoft\Virtual Machine\Guest\ParametersaG RCVYAZI+n1>3 W3wv{6;Fi~yH'7%\"!afg#>khuaG RCVYAZPx3 3z!ka Iqg+jr99m)"
  2⤵
  PID:3508
- C:\Windows\system32\systeminfo.exe
  systeminfo
  2⤵
  - Gathers system information
  PID:3388
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "$ErrorActionPreference='Continue'; Get-CimInstance -ClassName Win32_UserAccount | Where-Object { $_.LocalAccount } | Select-Object -ExpandProperty Name"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:212
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "$ErrorActionPreference='Continue'; $o = Get-CimInstance -ClassName Win32_OperatingSystem; \"LastBootUpTime: $([Management.ManagementDateTimeConverter]::ToDateTime($o.LastBootUpTime).ToUniversalTime().ToString('o'))\""
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:2616
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "$ErrorActionPreference='Continue'; $tz = Get-CimInstance -ClassName Win32_TimeZone; \"Caption: $($tz.Caption)\"; \"Bias: $($tz.Bias)\"; $os = Get-CimInstance -ClassName Win32_OperatingSystem; \"CountryCode: $($os.CountryCode)\""
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:2844
- C:\Windows\system32\reg.exe
  reg.exe query HKLM\SOFTWARE\Microsoft\Cryptography /v MachineGuid
  2⤵
  - Modifies registry key
  PID:3252
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "$ErrorActionPreference='Continue'; Get-ChildItem C:\Windows\System32\drivers -File | Sort-Object Name | ForEach-Object { \"{0} {1} {2}\" -f $_.Name, $_.Length, $_.LastWriteTimeUtc.ToString(\"o\") }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:4908

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Ignore Process Interrupts

T1564.011

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...