e3ad7e3933cffbaf14dece08f9a90dbd2fad9ac41bc029eb9b1a6cc14f0878c7

Analysis

max time kernel
150s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
25/08/2026, 03:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-24_b24872db72aaad2eaf6cee5e03e63ae8_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
Size 17.2MB
Sample260825-eckw1swfqa
SHA256 e3ad7e3933cffbaf14dece08f9a90dbd2fad9ac41bc029eb9b1a6cc14f0878c7
MD5 b24872db72aaad2eaf6cee5e03e63ae8
SHA1 45f8dbe023a461faff28c81ee7cc37b02cf6e4a8
SHA512 5d32db64318aff4e1eadcd19aab6f737743cc4a0a2f42669ec1343d370b23f785bc95a041d522d920b36340d8db08d168f69f9181e61a44129f3b48266142b3b
SSDEEP 98304:FKhlJvEyhPAC2M2paA7tgb0CDTxcUFy0y50U7To0ssjPrpVIpwRAaER0iozy8ZKd:FWvEePA9MqjpCDDgjPyd
TLSH
T166076B0BFB5099EAC459823548AA83917B70FC855F22A7D33A4CB62D2F737C45EB8714
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery execution persistence spyware trojan

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1088	ff.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 18 IoCs

Run Powershell to get system information.

execution

PowerShell

T1059.001

pid	Process
2116	powershell.exe
1776	powershell.exe
5732	powershell.exe
3988	powershell.exe
3404	powershell.exe
3712	powershell.exe
1640	powershell.exe
4272	powershell.exe
6060	powershell.exe
4304	powershell.exe
4476	powershell.exe
5536	powershell.exe
5316	powershell.exe
2408	powershell.exe
2816	powershell.exe
1160	powershell.exe
5980	powershell.exe
1372	powershell.exe

Looks up external IP address via web service 1 TTPs 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
1	ipinfo.io
11	ipinfo.io

Hide Artifacts: Ignore Process Interrupts 1 TTPs 1 IoCs

Command interpreters often include specific commands/flags that ignore errors and other hangups.

defense_evasion

Ignore Process Interrupts

T1564.011

pid	Process
5980	powershell.exe

Modifies trusted root certificate store through registry 1 TTPs 2 IoCs

A root certificate was added, modified, or removed in the trusted certificate store registry paths.

defense_evasion

Install Root Certificate

T1553.004

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 6b000000010000002000000096bcec06264976f37460779acf28c5a7cfe8a3c0aae11a8ffcee05c0bddf08c614000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	2026-08-24_b24872db72aaad2eaf6cee5e03e63ae8_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 5c0000000100000004000000001000001900000001000000100000002fe1f70bb05d7c92335bc5e05b984da60f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f63030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e814000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e6b000000010000002000000096bcec06264976f37460779acf28c5a7cfe8a3c0aae11a8ffcee05c0bddf08c620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	2026-08-24_b24872db72aaad2eaf6cee5e03e63ae8_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ff.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ff.exe

Gathers system information 1 TTPs 1 IoCs

Runs systeminfo.exe.

System Information Discovery

T1082

pid	Process
4476	systeminfo.exe

Modifies registry key 1 TTPs 7 IoCs

Modify Registry

T1112

pid	Process
4704	reg.exe
4528	reg.exe
704	reg.exe
1148	reg.exe
2596	reg.exe
1484	reg.exe
1220	reg.exe

Modifies system certificate store 2 TTPs 6 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\47BEABC922EAE80E78783462A79F45C254FDE68B\Blob = 6b000000010000002000000045140b3247eb9cc8c5b4f0d7b53091f73292089e6e5a63e2749dd3aca9198eda03000000010000001400000047beabc922eae80e78783462a79f45c254fde68b7e00000001000000080000000080826f22e7dc011d000000010000001000000070253fbcbde32a014d38c1993098ad991400000001000000140000003a9a8507106728b6eff6bd05416e20c194da0fde7f0000000100000016000000301406082b0601050507030306082b0601050507030462000000010000002000000045140b3247eb9cc8c5b4f0d7b53091f73292089e6e5a63e2749dd3aca9198eda53000000010000002500000030233021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c00b000000010000005200000047006f00200044006100640064007900200052006f006f007400200043006500720074006900660069006300610074006500200041007500740068006f007200690074007900200013202000470032000000090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f00000001000000200000003560e45b41e46b8f36537025d1d5bc02d9652a10645b0eff69e8b6a52191f3352000000001000000c9030000308203c5308202ada003020102020100300d06092a864886f70d01010b0500308183310b30090603550406130255533110300e060355040813074172697a6f6e61311330110603550407130a53636f74747364616c65311a3018060355040a1311476f44616464792e636f6d2c20496e632e3131302f06035504031328476f20446164647920526f6f7420436572746966696361746520417574686f72697479202d204732301e170d3039303930313030303030305a170d3337313233313233353935395a308183310b30090603550406130255533110300e060355040813074172697a6f6e61311330110603550407130a53636f74747364616c65311a3018060355040a1311476f44616464792e636f6d2c20496e632e3131302f06035504031328476f20446164647920526f6f7420436572746966696361746520417574686f72697479202d20473230820122300d06092a864886f70d01010105000382010f003082010a0282010100bf716208f1fa5934f71bc918a3f7804958e9228313a6c52043013b84f1e685499f27eaf6841b4ea0b4db7098c73201b1053e074eeef4fa4f2f593022e7ab19566be28007fcf316758039517be5f935b6744ea98d8213e4b63fa90383faa2be8a156a7fde0bc3b6191405caeac3a804943b467c320df3006622c88d696d368c1118b7d3b21c60b438fa028cced3dd4607de0a3eeb5d7cc87cfbb02b53a4926269512505611a44818c2ca9439623dfac3a819a0e29c51ca9e95d1eb69e9e300a39cef18880fb4b5dcc32ec85624325340256270191b43b702a3f6eb1e89c88017d9fd4f9db536d609dbf2ce758abb85f46fccec41b033c09eb49315c6946b3e0470203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e041604143a9a8507106728b6eff6bd05416e20c194da0fde300d06092a864886f70d01010b0500038201010099db5d79d5f99759670361f17e3b0631752da1208e4f6587b4f7a69cbcd8e92fd0db5aeecf748c73b43842da057bf80275b8fda5b1d7aef6d7de13cb53107e8a46d197fab72e2b11ab90b02780f9e89f5ae9379fabe4df6cb385179d3dd9244f799135d65f04eb8083ab9a022db510f4d890c7047340ed7225a0a99fec9eab68129957c68f123a09a4bd44fd061537c19be432a3ed38e8d864f32c7e14fc02ea9fcdff076817db2290382d7a8dd154f169e35f33ca7a3d7b0ae3ca7f5f39e5e275bac5761833ce2cf02f4cadf7b1e7ce4fa8c49b4a5406c57f7dd5080fe21cfe7e17b8ac5ef6d416b243090c4df6a76bb4998465ca7a88e2e244be5cf7ea1cf5	2026-08-24_b24872db72aaad2eaf6cee5e03e63ae8_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\47BEABC922EAE80E78783462A79F45C254FDE68B\Blob = 19000000010000001000000021d008b47b7a2a81c8435903ded424c90f00000001000000200000003560e45b41e46b8f36537025d1d5bc02d9652a10645b0eff69e8b6a52191f335090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080b000000010000005200000047006f00200044006100640064007900200052006f006f007400200043006500720074006900660069006300610074006500200041007500740068006f00720069007400790020001320200047003200000053000000010000002500000030233021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c062000000010000002000000045140b3247eb9cc8c5b4f0d7b53091f73292089e6e5a63e2749dd3aca9198eda7f0000000100000016000000301406082b0601050507030306082b060105050703041400000001000000140000003a9a8507106728b6eff6bd05416e20c194da0fde1d000000010000001000000070253fbcbde32a014d38c1993098ad997e00000001000000080000000080826f22e7dc0103000000010000001400000047beabc922eae80e78783462a79f45c254fde68b6b000000010000002000000045140b3247eb9cc8c5b4f0d7b53091f73292089e6e5a63e2749dd3aca9198eda2000000001000000c9030000308203c5308202ada003020102020100300d06092a864886f70d01010b0500308183310b30090603550406130255533110300e060355040813074172697a6f6e61311330110603550407130a53636f74747364616c65311a3018060355040a1311476f44616464792e636f6d2c20496e632e3131302f06035504031328476f20446164647920526f6f7420436572746966696361746520417574686f72697479202d204732301e170d3039303930313030303030305a170d3337313233313233353935395a308183310b30090603550406130255533110300e060355040813074172697a6f6e61311330110603550407130a53636f74747364616c65311a3018060355040a1311476f44616464792e636f6d2c20496e632e3131302f06035504031328476f20446164647920526f6f7420436572746966696361746520417574686f72697479202d20473230820122300d06092a864886f70d01010105000382010f003082010a0282010100bf716208f1fa5934f71bc918a3f7804958e9228313a6c52043013b84f1e685499f27eaf6841b4ea0b4db7098c73201b1053e074eeef4fa4f2f593022e7ab19566be28007fcf316758039517be5f935b6744ea98d8213e4b63fa90383faa2be8a156a7fde0bc3b6191405caeac3a804943b467c320df3006622c88d696d368c1118b7d3b21c60b438fa028cced3dd4607de0a3eeb5d7cc87cfbb02b53a4926269512505611a44818c2ca9439623dfac3a819a0e29c51ca9e95d1eb69e9e300a39cef18880fb4b5dcc32ec85624325340256270191b43b702a3f6eb1e89c88017d9fd4f9db536d609dbf2ce758abb85f46fccec41b033c09eb49315c6946b3e0470203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e041604143a9a8507106728b6eff6bd05416e20c194da0fde300d06092a864886f70d01010b0500038201010099db5d79d5f99759670361f17e3b0631752da1208e4f6587b4f7a69cbcd8e92fd0db5aeecf748c73b43842da057bf80275b8fda5b1d7aef6d7de13cb53107e8a46d197fab72e2b11ab90b02780f9e89f5ae9379fabe4df6cb385179d3dd9244f799135d65f04eb8083ab9a022db510f4d890c7047340ed7225a0a99fec9eab68129957c68f123a09a4bd44fd061537c19be432a3ed38e8d864f32c7e14fc02ea9fcdff076817db2290382d7a8dd154f169e35f33ca7a3d7b0ae3ca7f5f39e5e275bac5761833ce2cf02f4cadf7b1e7ce4fa8c49b4a5406c57f7dd5080fe21cfe7e17b8ac5ef6d416b243090c4df6a76bb4998465ca7a88e2e244be5cf7ea1cf5	2026-08-24_b24872db72aaad2eaf6cee5e03e63ae8_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\47BEABC922EAE80E78783462A79F45C254FDE68B\Blob = 5c0000000100000004000000000800006b000000010000002000000045140b3247eb9cc8c5b4f0d7b53091f73292089e6e5a63e2749dd3aca9198eda03000000010000001400000047beabc922eae80e78783462a79f45c254fde68b7e00000001000000080000000080826f22e7dc011d000000010000001000000070253fbcbde32a014d38c1993098ad991400000001000000140000003a9a8507106728b6eff6bd05416e20c194da0fde7f0000000100000016000000301406082b0601050507030306082b0601050507030462000000010000002000000045140b3247eb9cc8c5b4f0d7b53091f73292089e6e5a63e2749dd3aca9198eda53000000010000002500000030233021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c00b000000010000005200000047006f00200044006100640064007900200052006f006f007400200043006500720074006900660069006300610074006500200041007500740068006f007200690074007900200013202000470032000000090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f00000001000000200000003560e45b41e46b8f36537025d1d5bc02d9652a10645b0eff69e8b6a52191f33519000000010000001000000021d008b47b7a2a81c8435903ded424c92000000001000000c9030000308203c5308202ada003020102020100300d06092a864886f70d01010b0500308183310b30090603550406130255533110300e060355040813074172697a6f6e61311330110603550407130a53636f74747364616c65311a3018060355040a1311476f44616464792e636f6d2c20496e632e3131302f06035504031328476f20446164647920526f6f7420436572746966696361746520417574686f72697479202d204732301e170d3039303930313030303030305a170d3337313233313233353935395a308183310b30090603550406130255533110300e060355040813074172697a6f6e61311330110603550407130a53636f74747364616c65311a3018060355040a1311476f44616464792e636f6d2c20496e632e3131302f06035504031328476f20446164647920526f6f7420436572746966696361746520417574686f72697479202d20473230820122300d06092a864886f70d01010105000382010f003082010a0282010100bf716208f1fa5934f71bc918a3f7804958e9228313a6c52043013b84f1e685499f27eaf6841b4ea0b4db7098c73201b1053e074eeef4fa4f2f593022e7ab19566be28007fcf316758039517be5f935b6744ea98d8213e4b63fa90383faa2be8a156a7fde0bc3b6191405caeac3a804943b467c320df3006622c88d696d368c1118b7d3b21c60b438fa028cced3dd4607de0a3eeb5d7cc87cfbb02b53a4926269512505611a44818c2ca9439623dfac3a819a0e29c51ca9e95d1eb69e9e300a39cef18880fb4b5dcc32ec85624325340256270191b43b702a3f6eb1e89c88017d9fd4f9db536d609dbf2ce758abb85f46fccec41b033c09eb49315c6946b3e0470203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e041604143a9a8507106728b6eff6bd05416e20c194da0fde300d06092a864886f70d01010b0500038201010099db5d79d5f99759670361f17e3b0631752da1208e4f6587b4f7a69cbcd8e92fd0db5aeecf748c73b43842da057bf80275b8fda5b1d7aef6d7de13cb53107e8a46d197fab72e2b11ab90b02780f9e89f5ae9379fabe4df6cb385179d3dd9244f799135d65f04eb8083ab9a022db510f4d890c7047340ed7225a0a99fec9eab68129957c68f123a09a4bd44fd061537c19be432a3ed38e8d864f32c7e14fc02ea9fcdff076817db2290382d7a8dd154f169e35f33ca7a3d7b0ae3ca7f5f39e5e275bac5761833ce2cf02f4cadf7b1e7ce4fa8c49b4a5406c57f7dd5080fe21cfe7e17b8ac5ef6d416b243090c4df6a76bb4998465ca7a88e2e244be5cf7ea1cf5	2026-08-24_b24872db72aaad2eaf6cee5e03e63ae8_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8	2026-08-24_b24872db72aaad2eaf6cee5e03e63ae8_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\47BEABC922EAE80E78783462A79F45C254FDE68B	2026-08-24_b24872db72aaad2eaf6cee5e03e63ae8_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\47BEABC922EAE80E78783462A79F45C254FDE68B\Blob = 0f00000001000000200000003560e45b41e46b8f36537025d1d5bc02d9652a10645b0eff69e8b6a52191f335090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080b000000010000005200000047006f00200044006100640064007900200052006f006f007400200043006500720074006900660069006300610074006500200041007500740068006f00720069007400790020001320200047003200000053000000010000002500000030233021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c062000000010000002000000045140b3247eb9cc8c5b4f0d7b53091f73292089e6e5a63e2749dd3aca9198eda7f0000000100000016000000301406082b0601050507030306082b060105050703041400000001000000140000003a9a8507106728b6eff6bd05416e20c194da0fde1d000000010000001000000070253fbcbde32a014d38c1993098ad997e00000001000000080000000080826f22e7dc0103000000010000001400000047beabc922eae80e78783462a79f45c254fde68b2000000001000000c9030000308203c5308202ada003020102020100300d06092a864886f70d01010b0500308183310b30090603550406130255533110300e060355040813074172697a6f6e61311330110603550407130a53636f74747364616c65311a3018060355040a1311476f44616464792e636f6d2c20496e632e3131302f06035504031328476f20446164647920526f6f7420436572746966696361746520417574686f72697479202d204732301e170d3039303930313030303030305a170d3337313233313233353935395a308183310b30090603550406130255533110300e060355040813074172697a6f6e61311330110603550407130a53636f74747364616c65311a3018060355040a1311476f44616464792e636f6d2c20496e632e3131302f06035504031328476f20446164647920526f6f7420436572746966696361746520417574686f72697479202d20473230820122300d06092a864886f70d01010105000382010f003082010a0282010100bf716208f1fa5934f71bc918a3f7804958e9228313a6c52043013b84f1e685499f27eaf6841b4ea0b4db7098c73201b1053e074eeef4fa4f2f593022e7ab19566be28007fcf316758039517be5f935b6744ea98d8213e4b63fa90383faa2be8a156a7fde0bc3b6191405caeac3a804943b467c320df3006622c88d696d368c1118b7d3b21c60b438fa028cced3dd4607de0a3eeb5d7cc87cfbb02b53a4926269512505611a44818c2ca9439623dfac3a819a0e29c51ca9e95d1eb69e9e300a39cef18880fb4b5dcc32ec85624325340256270191b43b702a3f6eb1e89c88017d9fd4f9db536d609dbf2ce758abb85f46fccec41b033c09eb49315c6946b3e0470203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e041604143a9a8507106728b6eff6bd05416e20c194da0fde300d06092a864886f70d01010b0500038201010099db5d79d5f99759670361f17e3b0631752da1208e4f6587b4f7a69cbcd8e92fd0db5aeecf748c73b43842da057bf80275b8fda5b1d7aef6d7de13cb53107e8a46d197fab72e2b11ab90b02780f9e89f5ae9379fabe4df6cb385179d3dd9244f799135d65f04eb8083ab9a022db510f4d890c7047340ed7225a0a99fec9eab68129957c68f123a09a4bd44fd061537c19be432a3ed38e8d864f32c7e14fc02ea9fcdff076817db2290382d7a8dd154f169e35f33ca7a3d7b0ae3ca7f5f39e5e275bac5761833ce2cf02f4cadf7b1e7ce4fa8c49b4a5406c57f7dd5080fe21cfe7e17b8ac5ef6d416b243090c4df6a76bb4998465ca7a88e2e244be5cf7ea1cf5	2026-08-24_b24872db72aaad2eaf6cee5e03e63ae8_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe

Suspicious behavior: EnumeratesProcesses 55 IoCs

pid	Process
4304	powershell.exe
4304	powershell.exe
3988	powershell.exe
3988	powershell.exe
2116	powershell.exe
2116	powershell.exe
4304	powershell.exe
5980	powershell.exe
5980	powershell.exe
4476	powershell.exe
4476	powershell.exe
2116	powershell.exe
5980	powershell.exe
3988	powershell.exe
4476	powershell.exe
1776	powershell.exe
1776	powershell.exe
1776	powershell.exe
5536	powershell.exe
5536	powershell.exe
5536	powershell.exe
1088	ff.exe
5316	powershell.exe
1088	ff.exe
5316	powershell.exe
2408	powershell.exe
2408	powershell.exe
3712	powershell.exe
3712	powershell.exe
5732	powershell.exe
5732	powershell.exe
3712	powershell.exe
2408	powershell.exe
5732	powershell.exe
1372	powershell.exe
1372	powershell.exe
1640	powershell.exe
1640	powershell.exe
1372	powershell.exe
1640	powershell.exe
3404	powershell.exe
3404	powershell.exe
3404	powershell.exe
4272	powershell.exe
4272	powershell.exe
4272	powershell.exe
2816	powershell.exe
2816	powershell.exe
2816	powershell.exe
1160	powershell.exe
1160	powershell.exe
1160	powershell.exe
6060	powershell.exe
6060	powershell.exe
6060	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	3988	powershell.exe
Token: SeDebugPrivilege	4304	powershell.exe
Token: SeDebugPrivilege	2116	powershell.exe
Token: SeDebugPrivilege	5980	powershell.exe
Token: SeDebugPrivilege	4476	powershell.exe
Token: SeIncreaseQuotaPrivilege	4304	powershell.exe
Token: SeSecurityPrivilege	4304	powershell.exe
Token: SeTakeOwnershipPrivilege	4304	powershell.exe
Token: SeLoadDriverPrivilege	4304	powershell.exe
Token: SeSystemProfilePrivilege	4304	powershell.exe
Token: SeSystemtimePrivilege	4304	powershell.exe
Token: SeProfSingleProcessPrivilege	4304	powershell.exe
Token: SeIncBasePriorityPrivilege	4304	powershell.exe
Token: SeCreatePagefilePrivilege	4304	powershell.exe
Token: SeBackupPrivilege	4304	powershell.exe
Token: SeRestorePrivilege	4304	powershell.exe
Token: SeShutdownPrivilege	4304	powershell.exe
Token: SeDebugPrivilege	4304	powershell.exe
Token: SeSystemEnvironmentPrivilege	4304	powershell.exe
Token: SeRemoteShutdownPrivilege	4304	powershell.exe
Token: SeUndockPrivilege	4304	powershell.exe
Token: SeManageVolumePrivilege	4304	powershell.exe
Token: 33	4304	powershell.exe
Token: 34	4304	powershell.exe
Token: 35	4304	powershell.exe
Token: 36	4304	powershell.exe
Token: SeIncreaseQuotaPrivilege	3988	powershell.exe
Token: SeSecurityPrivilege	3988	powershell.exe
Token: SeTakeOwnershipPrivilege	3988	powershell.exe
Token: SeLoadDriverPrivilege	3988	powershell.exe
Token: SeSystemProfilePrivilege	3988	powershell.exe
Token: SeSystemtimePrivilege	3988	powershell.exe
Token: SeProfSingleProcessPrivilege	3988	powershell.exe
Token: SeIncBasePriorityPrivilege	3988	powershell.exe
Token: SeCreatePagefilePrivilege	3988	powershell.exe
Token: SeBackupPrivilege	3988	powershell.exe
Token: SeRestorePrivilege	3988	powershell.exe
Token: SeShutdownPrivilege	3988	powershell.exe
Token: SeDebugPrivilege	3988	powershell.exe
Token: SeSystemEnvironmentPrivilege	3988	powershell.exe
Token: SeRemoteShutdownPrivilege	3988	powershell.exe
Token: SeUndockPrivilege	3988	powershell.exe
Token: SeManageVolumePrivilege	3988	powershell.exe
Token: 33	3988	powershell.exe
Token: 34	3988	powershell.exe
Token: 35	3988	powershell.exe
Token: 36	3988	powershell.exe
Token: SeIncreaseQuotaPrivilege	4476	powershell.exe
Token: SeSecurityPrivilege	4476	powershell.exe
Token: SeTakeOwnershipPrivilege	4476	powershell.exe
Token: SeLoadDriverPrivilege	4476	powershell.exe
Token: SeSystemProfilePrivilege	4476	powershell.exe
Token: SeSystemtimePrivilege	4476	powershell.exe
Token: SeProfSingleProcessPrivilege	4476	powershell.exe
Token: SeIncBasePriorityPrivilege	4476	powershell.exe
Token: SeCreatePagefilePrivilege	4476	powershell.exe
Token: SeBackupPrivilege	4476	powershell.exe
Token: SeRestorePrivilege	4476	powershell.exe
Token: SeShutdownPrivilege	4476	powershell.exe
Token: SeDebugPrivilege	4476	powershell.exe
Token: SeSystemEnvironmentPrivilege	4476	powershell.exe
Token: SeRemoteShutdownPrivilege	4476	powershell.exe
Token: SeUndockPrivilege	4476	powershell.exe
Token: SeManageVolumePrivilege	4476	powershell.exe

Suspicious use of WriteProcessMemory 32 IoCs

description	pid	Process	procid_target
PID 4104 wrote to memory of 3988	4104	2026-08-24_b24872db72aaad2eaf6cee5e03e63ae8_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe	90
PID 4104 wrote to memory of 4304	4104	2026-08-24_b24872db72aaad2eaf6cee5e03e63ae8_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe	91
PID 4104 wrote to memory of 5980	4104	2026-08-24_b24872db72aaad2eaf6cee5e03e63ae8_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe	92
PID 4104 wrote to memory of 4476	4104	2026-08-24_b24872db72aaad2eaf6cee5e03e63ae8_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe	93
PID 4104 wrote to memory of 2116	4104	2026-08-24_b24872db72aaad2eaf6cee5e03e63ae8_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe	95
PID 4104 wrote to memory of 2380	4104	2026-08-24_b24872db72aaad2eaf6cee5e03e63ae8_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe	94
PID 4104 wrote to memory of 4468	4104	2026-08-24_b24872db72aaad2eaf6cee5e03e63ae8_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe	97
PID 4104 wrote to memory of 1776	4104	2026-08-24_b24872db72aaad2eaf6cee5e03e63ae8_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe	98
PID 4104 wrote to memory of 5536	4104	2026-08-24_b24872db72aaad2eaf6cee5e03e63ae8_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe	99
PID 4104 wrote to memory of 5400	4104	2026-08-24_b24872db72aaad2eaf6cee5e03e63ae8_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe	100
PID 4104 wrote to memory of 1088	4104	2026-08-24_b24872db72aaad2eaf6cee5e03e63ae8_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe	102
PID 4104 wrote to memory of 4704	4104	2026-08-24_b24872db72aaad2eaf6cee5e03e63ae8_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe	103
PID 4104 wrote to memory of 5316	4104	2026-08-24_b24872db72aaad2eaf6cee5e03e63ae8_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe	104
PID 4104 wrote to memory of 4528	4104	2026-08-24_b24872db72aaad2eaf6cee5e03e63ae8_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe	105
PID 4104 wrote to memory of 704	4104	2026-08-24_b24872db72aaad2eaf6cee5e03e63ae8_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe	106
PID 4104 wrote to memory of 1148	4104	2026-08-24_b24872db72aaad2eaf6cee5e03e63ae8_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe	107
PID 4104 wrote to memory of 2408	4104	2026-08-24_b24872db72aaad2eaf6cee5e03e63ae8_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe	108
PID 4104 wrote to memory of 5732	4104	2026-08-24_b24872db72aaad2eaf6cee5e03e63ae8_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe	109
PID 4104 wrote to memory of 3712	4104	2026-08-24_b24872db72aaad2eaf6cee5e03e63ae8_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe	110
PID 4104 wrote to memory of 1372	4104	2026-08-24_b24872db72aaad2eaf6cee5e03e63ae8_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe	111
PID 4104 wrote to memory of 1640	4104	2026-08-24_b24872db72aaad2eaf6cee5e03e63ae8_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe	112
PID 4104 wrote to memory of 3404	4104	2026-08-24_b24872db72aaad2eaf6cee5e03e63ae8_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe	113
PID 4104 wrote to memory of 2596	4104	2026-08-24_b24872db72aaad2eaf6cee5e03e63ae8_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe	114
PID 4104 wrote to memory of 1484	4104	2026-08-24_b24872db72aaad2eaf6cee5e03e63ae8_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe	115
PID 4104 wrote to memory of 5756	4104	2026-08-24_b24872db72aaad2eaf6cee5e03e63ae8_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe	116
PID 4104 wrote to memory of 4272	4104	2026-08-24_b24872db72aaad2eaf6cee5e03e63ae8_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe	117
PID 4104 wrote to memory of 6032	4104	2026-08-24_b24872db72aaad2eaf6cee5e03e63ae8_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe	118
PID 4104 wrote to memory of 4476	4104	2026-08-24_b24872db72aaad2eaf6cee5e03e63ae8_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe	119
PID 4104 wrote to memory of 2816	4104	2026-08-24_b24872db72aaad2eaf6cee5e03e63ae8_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe	120
PID 4104 wrote to memory of 1160	4104	2026-08-24_b24872db72aaad2eaf6cee5e03e63ae8_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe	121
PID 4104 wrote to memory of 6060	4104	2026-08-24_b24872db72aaad2eaf6cee5e03e63ae8_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe	122
PID 4104 wrote to memory of 1220	4104	2026-08-24_b24872db72aaad2eaf6cee5e03e63ae8_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe	123

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2026-08-24_b24872db72aaad2eaf6cee5e03e63ae8_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-24_b24872db72aaad2eaf6cee5e03e63ae8_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe"
1⤵
- Modifies trusted root certificate store through registry
- Modifies system certificate store
- Suspicious use of WriteProcessMemory
PID:4104
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "$ErrorActionPreference='Continue'; Get-CimInstance -ClassName Win32_LogicalDisk | Select-Object DeviceID,VolumeName,FileSystem,Size,FreeSpace,VolumeSerialNumber,DriveType | Format-List"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3988
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "$ErrorActionPreference='Continue'; Get-CimInstance -ClassName Win32_NetworkAdapter | Where-Object { $_.MACAddress } | Select-Object Name,MACAddress,Manufacturer,NetConnectionStatus | ConvertTo-Csv -NoTypeInformation"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4304
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "$ErrorActionPreference='Continue' $roots = @( 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall', 'HKLM:\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall', 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall', 'HKCU:\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall' ) $seen = @{} foreach ($r in $roots) { Get-ChildItem $r -ErrorAction SilentlyContinue | ForEach-Object { if ($seen.ContainsKey($_.PSPath)) { return } $p = Get-ItemProperty $_.PSPath -ErrorAction SilentlyContinue if ($p.DisplayName) { $seen[$_.PSPath] = $true '{0}|{1}|{2}|{3}' -f $p.DisplayName,$p.DisplayVersion,$p.Publisher,$p.InstallDate } } }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Hide Artifacts: Ignore Process Interrupts
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5980
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "$ErrorActionPreference='Continue'; Get-CimInstance -ClassName Win32_Process | Select-Object Name,ProcessId,ParentProcessId,ExecutablePath,CreationDate | ConvertTo-Csv -NoTypeInformation"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4476
- C:\Windows\system32\schtasks.exe
  schtasks /query /fo csv /v
  2⤵
  PID:2380
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "$ErrorActionPreference='Continue'; Write-Output '### PNP'; Get-CimInstance -ClassName Win32_PnPEntity | Select-Object Name,Manufacturer,Service,Status,ClassGuid,DeviceID | ConvertTo-Csv -NoTypeInformation; Write-Output '### DISKS'; Get-CimInstance -ClassName Win32_DiskDrive | Select-Object Model,SerialNumber,InterfaceType,Size | ConvertTo-Csv -NoTypeInformation; Write-Output '### BIOS'; $b = Get-CimInstance -ClassName Win32_BIOS; 'Manufacturer: ' + $b.Manufacturer; 'Name: ' + $b.Name; 'SerialNumber: ' + $b.SerialNumber; 'Version: ' + $b.SMBIOSBIOSVersion; $p = Get-CimInstance -ClassName Win32_ComputerSystemProduct; 'ProductVendor: ' + $p.Vendor; 'ProductName: ' + $p.Name; 'UUID: ' + $p.UUID; 'IdentifyingNumber: ' + $p.IdentifyingNumber; Write-Output '### CPU'; $c = Get-CimInstance -ClassName Win32_Processor | Select-Object -First 1; 'Name: ' + $c.Name; 'Cores: ' + $c.NumberOfCores; 'LogicalProcessors: ' + $c.NumberOfLogicalProcessors; 'VirtualizationFirmwareEnabled: ' + $c.VirtualizationFirmwareEnabled; $cs = Get-CimInstance -ClassName Win32_ComputerSystem; 'Manufacturer: ' + $cs.Manufacturer; 'Model: ' + $cs.Model; 'HypervisorPresent: ' + $cs.HypervisorPresent; 'PCSystemType: ' + $cs.PCSystemType; Write-Output '### MEMORY'; Get-CimInstance -ClassName Win32_PhysicalMemory | Select-Object BankLabel,Capacity,Speed,Manufacturer,PartNumber | ConvertTo-Csv -NoTypeInformation"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2116
- C:\Windows\system32\reg.exe
  reg.exe query "HKLM\SOFTWARE\Microsoft\Virtual Machine\Guest\ParametersaG RCVYAZI+n1>3 W3wv{6;Fi~yH'7%\"!afg#>khuaG RCVYAZPx3 3z!ka Iqg+jr99m)"
  2⤵
  PID:4468
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "$ErrorActionPreference='Continue'; $p = Get-CimInstance -ClassName Win32_Processor | Select-Object -First 1; \"Name: $($p.Name)\"; \"VirtualizationFirmwareEnabled: $($p.VirtualizationFirmwareEnabled)\"; \"SecondLevelAddressTranslationExtensions: $($p.SecondLevelAddressTranslationExtensions)\"; $cs = Get-CimInstance -ClassName Win32_ComputerSystem; \"Manufacturer: $($cs.Manufacturer)\"; \"Model: $($cs.Model)\"; \"HypervisorPresent: $($cs.HypervisorPresent)\"; \"PCSystemType: $($cs.PCSystemType)\"; $prod = Get-CimInstance -ClassName Win32_ComputerSystemProduct; \"Vendor: $($prod.Vendor)\"; \"Version: $($prod.Version)\"; \"UUID: $($prod.UUID)\"; \"IdentifyingNumber: $($prod.IdentifyingNumber)\""
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:1776
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "$ErrorActionPreference='Continue'; $o = Get-CimInstance -ClassName Win32_OperatingSystem; \"Caption: $($o.Caption)\"; \"Version: $($o.Version)\"; \"BuildNumber: $($o.BuildNumber)\"; \"InstallDate: $([Management.ManagementDateTimeConverter]::ToDateTime($o.InstallDate).ToUniversalTime().ToString('o'))\"; \"LastBootUpTime: $([Management.ManagementDateTimeConverter]::ToDateTime($o.LastBootUpTime).ToUniversalTime().ToString('o'))\""
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:5536
- C:\Windows\system32\driverquery.exe
  driverquery /v /fo csv
  2⤵
  PID:5400
- C:\Users\Admin\AppData\Local\Temp\ff-3881418062\ff.exe
  C:\Users\Admin\AppData\Local\Temp\ff-3881418062\ff.exe --logo none --pipe true
  2⤵
  - Executes dropped EXE
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  PID:1088
- C:\Windows\system32\reg.exe
  reg.exe query HKLM\SYSTEM\CurrentControlSet\Control\SystemInformation
  2⤵
  - Modifies registry key
  PID:4704
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "$ErrorActionPreference='Continue'; Get-CimInstance -ClassName Win32_Service | Where-Object { $_.PathName -notmatch '^c:\\windows' } | Select-Object Name,DisplayName,State,StartMode,PathName | ConvertTo-Csv -NoTypeInformation"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:5316
- C:\Windows\system32\reg.exe
  reg.exe query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
  2⤵
  - Modifies registry key
  PID:4528
- C:\Windows\system32\reg.exe
  reg.exe query HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
  2⤵
  - Modifies registry key
  PID:704
- C:\Windows\system32\reg.exe
  reg.exe query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System
  2⤵
  - Modifies registry key
  PID:1148
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "$ErrorActionPreference='Continue'; Get-CimInstance -ClassName Win32_Service | Where-Object { $_.PathName -notmatch '^c:\\windows' } | Select-Object Name,DisplayName,State,StartMode,PathName | ConvertTo-Csv -NoTypeInformation"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:2408
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "$ErrorActionPreference='Continue'; $p = Get-CimInstance -ClassName Win32_Processor | Select-Object -First 1; \"Name: $($p.Name)\"; \"VirtualizationFirmwareEnabled: $($p.VirtualizationFirmwareEnabled)\"; \"SecondLevelAddressTranslationExtensions: $($p.SecondLevelAddressTranslationExtensions)\"; $cs = Get-CimInstance -ClassName Win32_ComputerSystem; \"Manufacturer: $($cs.Manufacturer)\"; \"Model: $($cs.Model)\"; \"HypervisorPresent: $($cs.HypervisorPresent)\"; \"PCSystemType: $($cs.PCSystemType)\"; $prod = Get-CimInstance -ClassName Win32_ComputerSystemProduct; \"Vendor: $($prod.Vendor)\"; \"Version: $($prod.Version)\"; \"UUID: $($prod.UUID)\"; \"IdentifyingNumber: $($prod.IdentifyingNumber)\""
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:5732
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "$ErrorActionPreference='Continue'; $o = Get-CimInstance -ClassName Win32_OperatingSystem; \"Caption: $($o.Caption)\"; \"Version: $($o.Version)\"; \"BuildNumber: $($o.BuildNumber)\"; \"InstallDate: $([Management.ManagementDateTimeConverter]::ToDateTime($o.InstallDate).ToUniversalTime().ToString('o'))\"; \"LastBootUpTime: $([Management.ManagementDateTimeConverter]::ToDateTime($o.LastBootUpTime).ToUniversalTime().ToString('o'))\""
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:3712
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "$ErrorActionPreference='Continue'; Get-ChildItem C:\Windows\System32\drivers -File | Sort-Object Name | ForEach-Object { \"{0} {1} {2}\" -f $_.Name, $_.Length, $_.LastWriteTimeUtc.ToString(\"o\") }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:1372
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "$ErrorActionPreference='Continue'; Get-CimInstance -ClassName Win32_UserAccount | Where-Object { $_.LocalAccount } | ForEach-Object { $_.Name }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:1640
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "$ErrorActionPreference='Continue'; Get-CimInstance -ClassName Win32_DiskDrive | Select-Object Model,SerialNumber,InterfaceType | ConvertTo-Csv -NoTypeInformation"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:3404
- C:\Windows\system32\reg.exe
  reg.exe query HKLM\SOFTWARE\Microsoft\Cryptography /v MachineGuid
  2⤵
  - Modifies registry key
  PID:2596
- C:\Windows\system32\reg.exe
  reg.exe query HKLM\SYSTEM\CurrentControlSet\Control\SecureBoot\State /v UEFISecureBootEnabled
  2⤵
  - Modifies registry key
  PID:1484
- C:\Windows\system32\reg.exe
  reg.exe query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion" /v InstallDate
  2⤵
  PID:5756
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "$ErrorActionPreference='Continue'; Get-CimInstance -ClassName Win32_NetworkAdapter | Where-Object { $_.MACAddress } | Select-Object Name,MACAddress,Manufacturer | ConvertTo-Csv -NoTypeInformation"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:4272
- C:\Windows\system32\reg.exe
  reg.exe query "HKLM\SOFTWARE\Microsoft\Virtual Machine\Guest\ParametersaG RCVYAZI+n1>3 W3wv{6;Fi~yH'7%\"!afg#>khuaG RCVYAZPx3 3z!ka Iqg+jr99m)"
  2⤵
  PID:6032
- C:\Windows\system32\systeminfo.exe
  systeminfo
  2⤵
  - Gathers system information
  PID:4476
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "$ErrorActionPreference='Continue'; Get-CimInstance -ClassName Win32_UserAccount | Where-Object { $_.LocalAccount } | Select-Object -ExpandProperty Name"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:2816
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "$ErrorActionPreference='Continue'; $o = Get-CimInstance -ClassName Win32_OperatingSystem; \"LastBootUpTime: $([Management.ManagementDateTimeConverter]::ToDateTime($o.LastBootUpTime).ToUniversalTime().ToString('o'))\""
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:1160
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "$ErrorActionPreference='Continue'; $tz = Get-CimInstance -ClassName Win32_TimeZone; \"Caption: $($tz.Caption)\"; \"Bias: $($tz.Bias)\"; $os = Get-CimInstance -ClassName Win32_OperatingSystem; \"CountryCode: $($os.CountryCode)\""
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:6060
- C:\Windows\system32\reg.exe
  reg.exe query HKLM\SOFTWARE\Microsoft\Cryptography /v MachineGuid
  2⤵
  - Modifies registry key
  PID:1220

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Ignore Process Interrupts

T1564.011

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact