Overview

overview

8

Static

static

3

582d90287d...b1.exe

windows10-2004-x64

8

582d90287d...b1.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    150s
  • max time network
    153s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    31/08/2026, 04:48

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    582d90287db6ab528ac342c7e3d77f5272132c28f62b248d4d0c6f85421fa8b1.exe
  • Size 8.4MB
  • Sample260831-fe8arseg25
  • SHA256 582d90287db6ab528ac342c7e3d77f5272132c28f62b248d4d0c6f85421fa8b1
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoveryexecutionpersistenceprivilege_escalationspywarestealer

Malware Config

Signatures

  • Command and Scripting Interpreter: PowerShell 1 TTPs 22 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution
  • Creates a file in the Startup directory 1 TTPs 2 IoCs

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation
  • Executes dropped EXE 7 IoCs
  • Reads WinSCP keys stored on the system 2 TTPs

    Tries to access WinSCP stored sessions.

    spywarestealer
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Contacts third-party web service commonly abused for C2 1 TTPs 3 IoCs

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Looks up external IP address via web service 1 TTPs 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery
  • AutoIT Executable 5 IoCs

    AutoIT scripts compiled to PE executables.

  • Discovers running processes 1 TTPs 8 IoCs

    Running process information can be used to identify security tools or plan follow-on actions.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Event Triggered Execution: Netsh Helper DLL 1 TTPs 12 IoCs

    Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

    persistenceprivilege_escalation
  • Executes a command shell one-liner 1 TTPs 14 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

    discovery
  • Gathers network information 2 TTPs 10 IoCs

    Uses commandline utility to view network configuration.

  • Kills process with taskkill 3 IoCs
    defense_evasion
  • Modifies registry class 6 IoCs
  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 39 IoCs
  • Suspicious use of SendNotifyMessage 39 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\582d90287db6ab528ac342c7e3d77f5272132c28f62b248d4d0c6f85421fa8b1.exe
    "C:\Users\Admin\AppData\Local\Temp\582d90287db6ab528ac342c7e3d77f5272132c28f62b248d4d0c6f85421fa8b1.exe"
    1⤵
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:1864
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "try { $exclusions = (Get-MpPreference).ExclusionPath; if ($exclusions -notcontains ''C:\Users\Admin\AppData\Local\Temp'') { Add-MpPreference -ExclusionPath ''C:\Users\Admin\AppData\Local\Temp'' -Force } } catch {} "
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:360
    • C:\Users\Admin\AppData\Local\Temp\ki8Mz6669Dm94t_7168\kB2OR51Z.exe
      C:\Users\Admin\AppData\Local\Temp\ki8Mz6669Dm94t_7168\kB2OR51Z.exe
      2⤵
      • Creates a file in the Startup directory
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:1652
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:/Users/Admin/AppData/Local/Temp\""
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2732
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:/Users/Admin/AppData/Roaming/Microsoft/Windows/Start Menu/Programs/Startup\""
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2992
      • C:\Windows\SYSTEM32\netstat.exe
        netstat -an
        3⤵
        • Gathers network information
        • Suspicious use of AdjustPrivilegeToken
        PID:4288
      • C:\Windows\SYSTEM32\netsh.exe
        netsh interface show interface
        3⤵
        • Event Triggered Execution: Netsh Helper DLL
        PID:6064
      • C:\Windows\SYSTEM32\netstat.exe
        netstat -an
        3⤵
        • Gathers network information
        • Suspicious use of AdjustPrivilegeToken
        PID:3244
      • C:\Windows\SYSTEM32\netstat.exe
        netstat -an
        3⤵
        • Gathers network information
        • Suspicious use of AdjustPrivilegeToken
        PID:4736
      • C:\Windows\SYSTEM32\netstat.exe
        netstat -an
        3⤵
        • Gathers network information
        • Suspicious use of AdjustPrivilegeToken
        PID:2928
      • C:\Windows\SYSTEM32\netstat.exe
        netstat -an
        3⤵
        • Gathers network information
        • Suspicious use of AdjustPrivilegeToken
        PID:3476
      • C:\Windows\System32\Wbem\wmic.exe
        wmic path Win32_NetworkAdapter get Name,NetConnectionStatus,Speed,MACAddress /format:csv
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:5128
      • C:\Windows\SYSTEM32\netsh.exe
        netsh interface ipv4 show interfaces
        3⤵
        • Event Triggered Execution: Netsh Helper DLL
        PID:5736
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:/Users/Admin/AppData/Local/Temp/check_driver_183493.exe\""
        3⤵
        • Command and Scripting Interpreter: PowerShell
        PID:4276
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:/Users/Admin/AppData/Local/Temp/check_driver_358268.exe\""
        3⤵
        • Command and Scripting Interpreter: PowerShell
        PID:3212
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c tasklist /FI "IMAGENAME eq chrome.exe" /FO CSV /NH 2>NUL | findstr /I "chrome.exe" >NUL
        3⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:1224
        • C:\Windows\system32\tasklist.exe
          tasklist /FI "IMAGENAME eq chrome.exe" /FO CSV /NH
          4⤵
          • Discovers running processes
          PID:2912
        • C:\Windows\system32\findstr.exe
          findstr /I "chrome.exe"
          4⤵
            PID:4884
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c tasklist /FI "IMAGENAME eq msedge.exe" /FO CSV /NH 2>NUL | findstr /I "msedge.exe" >NUL
          3⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:2900
          • C:\Windows\system32\tasklist.exe
            tasklist /FI "IMAGENAME eq msedge.exe" /FO CSV /NH
            4⤵
            • Discovers running processes
            PID:1516
          • C:\Windows\system32\findstr.exe
            findstr /I "msedge.exe"
            4⤵
              PID:5848
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c taskkill /f /im msedge.exe >nul 2>&1
            3⤵
            • Executes a command shell one-liner
            • Suspicious use of WriteProcessMemory
            PID:2708
            • C:\Windows\system32\taskkill.exe
              taskkill /f /im msedge.exe
              4⤵
              • Kills process with taskkill
              PID:4696
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c taskkill /f /im chrome.exe >nul 2>&1
            3⤵
            • Executes a command shell one-liner
            • Suspicious use of WriteProcessMemory
            PID:1092
            • C:\Windows\system32\taskkill.exe
              taskkill /f /im chrome.exe
              4⤵
              • Kills process with taskkill
              PID:500
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c tasklist /FI "IMAGENAME eq msedge.exe" /FO CSV /NH 2>NUL | findstr /I "msedge.exe" >NUL
            3⤵
            • Executes a command shell one-liner
            • Suspicious use of WriteProcessMemory
            PID:1172
            • C:\Windows\system32\tasklist.exe
              tasklist /FI "IMAGENAME eq msedge.exe" /FO CSV /NH
              4⤵
              • Discovers running processes
              PID:5204
            • C:\Windows\system32\findstr.exe
              findstr /I "msedge.exe"
              4⤵
                PID:4436
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /c tasklist /FI "IMAGENAME eq chrome.exe" /FO CSV /NH 2>NUL | findstr /I "chrome.exe" >NUL
              3⤵
              • Executes a command shell one-liner
              • Suspicious use of WriteProcessMemory
              PID:2432
              • C:\Windows\system32\tasklist.exe
                tasklist /FI "IMAGENAME eq chrome.exe" /FO CSV /NH
                4⤵
                • Discovers running processes
                PID:3956
              • C:\Windows\system32\findstr.exe
                findstr /I "chrome.exe"
                4⤵
                  PID:3528
              • C:\Users\Admin\AppData\Local\Temp\check_driver_358268.exe
                "C:\Users\Admin\AppData\Local\Temp\check_driver_358268.exe" --output-path "C:\Users\Admin\AppData\Local\Temp\\temp_Edge_240884750" edge
                3⤵
                • Executes dropped EXE
                • Suspicious use of WriteProcessMemory
                PID:1312
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
                  4⤵
                    PID:3600
                • C:\Users\Admin\AppData\Local\Temp\check_driver_183493.exe
                  "C:\Users\Admin\AppData\Local\Temp\check_driver_183493.exe" --output-path "C:\Users\Admin\AppData\Local\Temp\\temp_Chrome_240884750" chrome
                  3⤵
                  • Executes dropped EXE
                  • Suspicious use of WriteProcessMemory
                  PID:2804
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe"
                    4⤵
                      PID:1788
                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                    powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:/Users/Admin/AppData/Local/Temp/check_driver_540374.exe\""
                    3⤵
                    • Command and Scripting Interpreter: PowerShell
                    PID:2928
                  • C:\Windows\system32\cmd.exe
                    C:\Windows\system32\cmd.exe /c tasklist /FI "IMAGENAME eq chrome.exe" /FO CSV /NH 2>NUL | findstr /I "chrome.exe" >NUL
                    3⤵
                    • Executes a command shell one-liner
                    PID:2992
                    • C:\Windows\system32\tasklist.exe
                      tasklist /FI "IMAGENAME eq chrome.exe" /FO CSV /NH
                      4⤵
                      • Discovers running processes
                      PID:4984
                    • C:\Windows\system32\findstr.exe
                      findstr /I "chrome.exe"
                      4⤵
                        PID:3136
                    • C:\Windows\system32\cmd.exe
                      C:\Windows\system32\cmd.exe /c taskkill /f /im chrome.exe >nul 2>&1
                      3⤵
                      • Executes a command shell one-liner
                      PID:5784
                      • C:\Windows\system32\taskkill.exe
                        taskkill /f /im chrome.exe
                        4⤵
                        • Kills process with taskkill
                        PID:756
                    • C:\Windows\system32\cmd.exe
                      C:\Windows\system32\cmd.exe /c tasklist /FI "IMAGENAME eq chrome.exe" /FO CSV /NH 2>NUL | findstr /I "chrome.exe" >NUL
                      3⤵
                      • Executes a command shell one-liner
                      PID:5932
                      • C:\Windows\system32\tasklist.exe
                        tasklist /FI "IMAGENAME eq chrome.exe" /FO CSV /NH
                        4⤵
                        • Discovers running processes
                        PID:1264
                      • C:\Windows\system32\findstr.exe
                        findstr /I "chrome.exe"
                        4⤵
                          PID:5152
                      • C:\Users\Admin\AppData\Local\Temp\check_driver_540374.exe
                        "C:\Users\Admin\AppData\Local\Temp\check_driver_540374.exe" --output-path "C:\Users\Admin\AppData\Local\Temp\\temp_Chrome_240884750" chrome
                        3⤵
                        • Executes dropped EXE
                        PID:5244
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe"
                          4⤵
                            PID:4140
                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                          powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:/Users/Admin/AppData/Local/Temp/check_driver_649377.exe\""
                          3⤵
                          • Command and Scripting Interpreter: PowerShell
                          PID:4124
                      • C:\Windows\system32\cmd.exe
                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~337040.bat
                        2⤵
                        • Executes a command shell one-liner
                        • Suspicious use of WriteProcessMemory
                        PID:3364
                        • C:\Windows\system32\PING.EXE
                          ping 127.0.0.1 -n 3
                          3⤵
                          • System Network Configuration Discovery: Internet Connection Discovery
                          • Runs ping.exe
                          PID:5708
                    • C:\Users\Admin\AppData\Local\Temp\ki8Mz6669Dm94t_7168\kB2OR51Z.exe
                      C:\Users\Admin\AppData\Local\Temp\ki8Mz6669Dm94t_7168\kB2OR51Z.exe
                      1⤵
                      • Creates a file in the Startup directory
                      • Executes dropped EXE
                      • Adds Run key to start application
                      • Modifies registry class
                      • Suspicious behavior: EnumeratesProcesses
                      • Suspicious use of WriteProcessMemory
                      PID:1044
                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                        powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:/Users/Admin/AppData/Local/Temp\""
                        2⤵
                        • Command and Scripting Interpreter: PowerShell
                        • Suspicious behavior: EnumeratesProcesses
                        PID:1304
                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                        powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:/Users/Admin/AppData/Roaming/Microsoft/Windows/Start Menu/Programs/Startup\""
                        2⤵
                        • Command and Scripting Interpreter: PowerShell
                        • Suspicious behavior: EnumeratesProcesses
                        PID:2708
                      • C:\Windows\SYSTEM32\netstat.exe
                        netstat -an
                        2⤵
                        • Gathers network information
                        PID:6128
                      • C:\Windows\SYSTEM32\netsh.exe
                        netsh interface show interface
                        2⤵
                        • Event Triggered Execution: Netsh Helper DLL
                        PID:5244
                      • C:\Windows\SYSTEM32\netstat.exe
                        netstat -an
                        2⤵
                        • Gathers network information
                        PID:1500
                      • C:\Windows\SYSTEM32\netstat.exe
                        netstat -an
                        2⤵
                        • Gathers network information
                        PID:500
                      • C:\Windows\SYSTEM32\netstat.exe
                        netstat -an
                        2⤵
                        • Gathers network information
                        PID:4780
                      • C:\Windows\SYSTEM32\netstat.exe
                        netstat -an
                        2⤵
                        • Gathers network information
                        PID:4384
                      • C:\Windows\System32\Wbem\wmic.exe
                        wmic path Win32_NetworkAdapter get Name,NetConnectionStatus,Speed,MACAddress /format:csv
                        2⤵
                          PID:3656
                        • C:\Windows\SYSTEM32\netsh.exe
                          netsh interface ipv4 show interfaces
                          2⤵
                          • Event Triggered Execution: Netsh Helper DLL
                          PID:256
                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                          powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:/Users/Admin/AppData/Local/Temp/check_driver_132446.exe\""
                          2⤵
                          • Command and Scripting Interpreter: PowerShell
                          PID:2264
                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                          powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:/Users/Admin/AppData/Local/Temp/check_driver_576771.exe\""
                          2⤵
                          • Command and Scripting Interpreter: PowerShell
                          PID:4520
                        • C:\Windows\system32\cmd.exe
                          C:\Windows\system32\cmd.exe /c tasklist /FI "IMAGENAME eq chrome.exe" /FO CSV /NH 2>NUL | findstr /I "chrome.exe" >NUL
                          2⤵
                          • Executes a command shell one-liner
                          • Suspicious use of WriteProcessMemory
                          PID:4928
                          • C:\Windows\system32\tasklist.exe
                            tasklist /FI "IMAGENAME eq chrome.exe" /FO CSV /NH
                            3⤵
                            • Discovers running processes
                            PID:4424
                          • C:\Windows\system32\findstr.exe
                            findstr /I "chrome.exe"
                            3⤵
                              PID:5768
                          • C:\Windows\system32\cmd.exe
                            C:\Windows\system32\cmd.exe /c tasklist /FI "IMAGENAME eq msedge.exe" /FO CSV /NH 2>NUL | findstr /I "msedge.exe" >NUL
                            2⤵
                            • Executes a command shell one-liner
                            • Suspicious use of WriteProcessMemory
                            PID:5196
                            • C:\Windows\system32\tasklist.exe
                              tasklist /FI "IMAGENAME eq msedge.exe" /FO CSV /NH
                              3⤵
                              • Discovers running processes
                              PID:6032
                            • C:\Windows\system32\findstr.exe
                              findstr /I "msedge.exe"
                              3⤵
                                PID:5320
                            • C:\Users\Admin\AppData\Local\Temp\check_driver_132446.exe
                              "C:\Users\Admin\AppData\Local\Temp\check_driver_132446.exe" --output-path "C:\Users\Admin\AppData\Local\Temp\\temp_Edge_240883312" edge
                              2⤵
                              • Executes dropped EXE
                              • Suspicious use of WriteProcessMemory
                              PID:5140
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
                                3⤵
                                  PID:5964
                              • C:\Users\Admin\AppData\Local\Temp\check_driver_576771.exe
                                "C:\Users\Admin\AppData\Local\Temp\check_driver_576771.exe" --output-path "C:\Users\Admin\AppData\Local\Temp\\temp_Chrome_240883312" chrome
                                2⤵
                                • Executes dropped EXE
                                • Suspicious use of WriteProcessMemory
                                PID:2812
                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                  "C:\Program Files\Google\Chrome\Application\chrome.exe"
                                  3⤵
                                    PID:2500
                                • C:\Windows\system32\cmd.exe
                                  C:\Windows\system32\cmd.exe /c dir "C:\Users\Admin\AppData\Local\Temp\\temp_Edge_240883312" /S /B 2>NUL
                                  2⤵
                                  • Executes a command shell one-liner
                                  PID:5452
                                • C:\Windows\system32\cmd.exe
                                  C:\Windows\system32\cmd.exe /c dir "C:\Users\Admin\AppData\Local\Temp\\temp_Chrome_240883312" /S /B 2>NUL
                                  2⤵
                                  • Executes a command shell one-liner
                                  PID:108

                              Network

                                    MITRE ATT&CK Enterprise v16

                                    Reconnaissance

                                    Resource Development

                                    Initial Access

                                    Execution

                                    Command and Scripting Interpreter

                                    3
                                    T1059

                                    PowerShell

                                    1
                                    T1059.001

                                    Windows Command Shell

                                    1
                                    T1059.003

                                    Persistence

                                    Boot or Logon Autostart Execution

                                    2
                                    T1547

                                    Registry Run Keys / Startup Folder

                                    2
                                    T1547.001

                                    Event Triggered Execution

                                    1
                                    T1546

                                    Netsh Helper DLL

                                    1
                                    T1546.007

                                    Privilege Escalation

                                    Boot or Logon Autostart Execution

                                    2
                                    T1547

                                    Registry Run Keys / Startup Folder

                                    2
                                    T1547.001

                                    Event Triggered Execution

                                    1
                                    T1546

                                    Netsh Helper DLL

                                    1
                                    T1546.007

                                    Defense Evasion

                                    Modify Registry

                                    1
                                    T1112

                                    Credential Access

                                    Credentials from Password Stores

                                    1
                                    T1555

                                    Credentials from Web Browsers

                                    1
                                    T1555.003

                                    Unsecured Credentials

                                    2
                                    T1552

                                    Credentials In Files

                                    1
                                    T1552.001

                                    Credentials in Registry

                                    1
                                    T1552.002

                                    Discovery

                                    Process Discovery

                                    1
                                    T1057

                                    Remote System Discovery

                                    1
                                    T1018

                                    System Information Discovery

                                    2
                                    T1082

                                    System Network Configuration Discovery

                                    2
                                    T1016

                                    Internet Connection Discovery

                                    2
                                    T1016.001

                                    Lateral Movement

                                    Collection

                                    Data from Local System

                                    2
                                    T1005

                                    Command and Control

                                    Web Service

                                    1
                                    T1102

                                    Exfiltration

                                    Impact

                                    Replay Monitor

                                    Loading Replay Monitor...

                                    Downloads

                                    StartupProfileData-NonInteractive
                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                    • Size 1KB
                                    • SHA256 437c66ce3c247a94b41998f929093b8d3b5a53d6560414a337b4082a01665641
                                    • MD5 SHA1 SHA512 TLSH
                                    Submit Download

                                    StartupProfileData-NonInteractive
                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                    • Size 948B
                                    • SHA256 19522c7e140736208a28a9056be124d495ec75471725dc9d11fbffd9ba767070
                                    • MD5 SHA1 SHA512 TLSH
                                    Submit Download

                                    StartupProfileData-NonInteractive
                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                    • Size 1KB
                                    • SHA256 49defef3bd7dad9bcc4770d3638dbd0521cb37695c01485e8f6f1d6ed2afb55d
                                    • MD5 SHA1 SHA512 TLSH
                                    Submit Download

                                    StartupProfileData-NonInteractive
                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                    • Size 1KB
                                    • SHA256 8723dc2574dafbb2924f503a8ed17fc605cafc446e8722a7fee05a0dff22b862
                                    • MD5 SHA1 SHA512 TLSH
                                    Submit Download

                                    StartupProfileData-NonInteractive
                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                    • Size 1KB
                                    • SHA256 d71e314221c8f6bf077410edd775afb46169596aa195666c6bd75132a597c31f
                                    • MD5 SHA1 SHA512 TLSH
                                    Submit Download

                                    StartupProfileData-NonInteractive
                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                    • Size 1KB
                                    • SHA256 ae2e7d790f2742a5dce4d5f9ba4ef1497b4a84d901d24cafea863da4eee1e3f4
                                    • MD5 SHA1 SHA512 TLSH
                                    Submit Download

                                    StartupProfileData-NonInteractive
                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                    • Size 1KB
                                    • SHA256 cf945b43222be12fe29077d14d2ce5a41c5f926508e7f4beb813741bd761cdb8
                                    • MD5 SHA1 SHA512 TLSH
                                    Submit Download

                                    StartupProfileData-NonInteractive
                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                    • Size 1KB
                                    • SHA256 6c0e51867b97402c1fe72ecc42a91f2ce8d5daddd0e0aa13ca77717e4bc55260
                                    • MD5 SHA1 SHA512 TLSH
                                    Submit Download

                                    __PSScriptPolicyTest_sh0ix14i.ygh.ps1
                                    • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_sh0ix14i.ygh.ps1
                                    • Size 60B
                                    • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
                                    • MD5 SHA1 SHA512 TLSH
                                    Submit Download

                                    check_driver_576771.exe
                                    • Path C:\Users\Admin\AppData\Local\Temp\check_driver_576771.exe
                                    • Size 1.9MB
                                    • SHA256 c9b058c7d614f5ccde605e022c9417f2904659582507f69b30bad3abf2676a9c
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    kB2OR51Z.exe
                                    • Path C:\Users\Admin\AppData\Local\Temp\ki8Mz6669Dm94t_7168\kB2OR51Z.exe
                                    • Size 9.1MB
                                    • SHA256 1a76dc127033ea7761391e6878d2eb791f1ed0dbf8e8b1ba5944d16be7ce36f2
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    ~337040.bat
                                    • Path C:\Users\Admin\AppData\Local\Temp\~337040.bat
                                    • Size 347B
                                    • SHA256 0b9393c0f5ca099ab251e214800d1df50fd7971b7dac48191373788a276951df
                                    • MD5 SHA1 SHA512 TLSH
                                    Submit Download

                                    Windows Security Update.lnk
                                    • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows Security Update.lnk
                                    • Size 1KB
                                    • SHA256 df375d2974ded87eac31811a183964777b06b2bd8b617ec80bc39c084946bec3
                                    • MD5 SHA1 SHA512 TLSH
                                    Submit Download

                                    memory/360-16-0x00007FFDBBB10000-0x00007FFDBC4B4000-memory.dmp
                                    Download

                                    memory/360-11-0x000001B6E8310000-0x000001B6E8332000-memory.dmp
                                    Download

                                    memory/360-10-0x00007FFDBBC9F000-0x00007FFDBBCA0000-memory.dmp
                                    Download

                                    memory/360-21-0x00007FFDBBB10000-0x00007FFDBC4B4000-memory.dmp
                                    Download

                                    memory/360-12-0x00007FFDBBB10000-0x00007FFDBC4B4000-memory.dmp
                                    Download

                                    memory/360-18-0x00007FFDBBB10000-0x00007FFDBC4B4000-memory.dmp
                                    Download

                                    memory/360-20-0x00007FFDBBB10000-0x00007FFDBC4B4000-memory.dmp
                                    Download

                                    memory/360-15-0x00007FFDBBB10000-0x00007FFDBC4B4000-memory.dmp
                                    Download

                                    memory/360-17-0x00007FFDBBB10000-0x00007FFDBC4B4000-memory.dmp
                                    Download

                                    memory/1304-53-0x000002BCE9790000-0x000002BCE9842000-memory.dmp
                                    Download

                                    memory/1864-0-0x00007FF7C89C0000-0x00007FF7C92D3000-memory.dmp
                                    Download

                                    memory/1864-28-0x00007FF7C89C0000-0x00007FF7C92D3000-memory.dmp
                                    Download

                                    memory/1864-8-0x00007FF7C89C0000-0x00007FF7C92D3000-memory.dmp
                                    Download

                                    memory/1864-7-0x00007FF7C89C0000-0x00007FF7C92D3000-memory.dmp
                                    Download

                                    memory/1864-6-0x00007FF7C89C0000-0x00007FF7C92D3000-memory.dmp
                                    Download

                                    memory/2732-37-0x000001D6BF920000-0x000001D6BF92A000-memory.dmp
                                    Download

                                    memory/2732-36-0x000001D6BF860000-0x000001D6BF912000-memory.dmp
                                    Download

                                    memory/2732-35-0x000001D6BF630000-0x000001D6BF64E000-memory.dmp
                                    Download

                                    memory/2928-134-0x0000020767750000-0x0000020767802000-memory.dmp
                                    Download

                                    memory/2992-44-0x00000220A17E0000-0x00000220A1892000-memory.dmp
                                    Download