4f5f3428399964f5551d7be269b6894fca62257a096f3b489390946c2d4d1d01

Analysis

max time kernel
25s
max time network
27s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
12/09/2026, 22:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
MintedClientSetup-x86.exe
Size 2.3MB
Sample260912-2gs5hsbb55
SHA256 4f5f3428399964f5551d7be269b6894fca62257a096f3b489390946c2d4d1d01
MD5 b601f7d713ccea980b6b60849729060f
SHA1 a43e2bff184c241631c69abf1e1f18758f252141
SHA512 70c01507eb060176441c18f0482165fc40a7828984a1d89a3d058e69334ebeea42c538c6a10697eaa3c0d76a5bab9bdfe1c3f2832a84666e3ad3a1606c2ddf42
SSDEEP 49152:jPux3fVa3OlcTXAw6tHCqSTkiYn3RIGAX:wKTXAbCqSTki+8
TLSH
T1B4B55B07E2A350ECC52BC1748767A772BE30B8191134BE7F5AA4DB312F61E509B5EB24
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery execution persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000\Software\Microsoft\Windows\CurrentVersion\Run\Windows COM Surrogate = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MintedClientSetup-x86.exe"	MintedClientSetup-x86.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000\Software\Microsoft\Windows\CurrentVersion\Run\Windows COM Surrogate = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MintedClientSetup-x86.exe"	MintedClientSetup-x86.exe

Looks up external IP address via web service 1 TTPs 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
2	ip-api.com

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
5524	MintedClientSetup-x86.exe
244	MintedClientSetup-x86.exe

Launches sc.exe 8 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4756	sc.exe
4312	sc.exe
5892	sc.exe
3528	sc.exe
3060	sc.exe
4484	sc.exe
5896	sc.exe
2848	sc.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
4504	powershell.exe
4888	powershell.exe

Executes a command shell one-liner 1 TTPs 23 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
6036	cmd.exe
3500	cmd.exe
4164	cmd.exe
4284	cmd.exe
5240	cmd.exe
1608	cmd.exe
4072	cmd.exe
4272	cmd.exe
4236	cmd.exe
5712	cmd.exe
5880	cmd.exe
936	cmd.exe
6072	cmd.exe
2100	cmd.exe
6124	cmd.exe
4380	cmd.exe
2624	cmd.exe
5608	cmd.exe
5920	cmd.exe
3816	cmd.exe
4928	cmd.exe
3736	cmd.exe
4500	cmd.exe

Detects videocard installed 1 TTPs 13 IoCs

Uses WMIC.exe to determine videocard installed.

System Information Discovery

T1082

pid	Process
4196	WMIC.exe
1152	WMIC.exe
4092	WMIC.exe
1508	WMIC.exe
4440	WMIC.exe
5784	WMIC.exe
2408	WMIC.exe
2968	WMIC.exe
3668	WMIC.exe
2260	WMIC.exe
672	WMIC.exe
1184	WMIC.exe
3756	WMIC.exe

Suspicious behavior: EnumeratesProcesses 56 IoCs

pid	Process
4888	powershell.exe
4888	powershell.exe
2408	WMIC.exe
2408	WMIC.exe
2408	WMIC.exe
2408	WMIC.exe
2968	WMIC.exe
2968	WMIC.exe
2968	WMIC.exe
2968	WMIC.exe
4504	powershell.exe
4504	powershell.exe
4196	WMIC.exe
4196	WMIC.exe
4196	WMIC.exe
4196	WMIC.exe
3668	WMIC.exe
3668	WMIC.exe
3668	WMIC.exe
3668	WMIC.exe
2260	WMIC.exe
2260	WMIC.exe
2260	WMIC.exe
2260	WMIC.exe
1152	WMIC.exe
1152	WMIC.exe
1152	WMIC.exe
1152	WMIC.exe
4092	WMIC.exe
4092	WMIC.exe
4092	WMIC.exe
4092	WMIC.exe
672	WMIC.exe
672	WMIC.exe
672	WMIC.exe
672	WMIC.exe
1508	WMIC.exe
1508	WMIC.exe
1508	WMIC.exe
1508	WMIC.exe
4440	WMIC.exe
4440	WMIC.exe
4440	WMIC.exe
4440	WMIC.exe
5784	WMIC.exe
5784	WMIC.exe
5784	WMIC.exe
5784	WMIC.exe
1184	WMIC.exe
1184	WMIC.exe
1184	WMIC.exe
1184	WMIC.exe
3756	WMIC.exe
3756	WMIC.exe
3756	WMIC.exe
3756	WMIC.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4888	powershell.exe
Token: SeIncreaseQuotaPrivilege	4888	powershell.exe
Token: SeSecurityPrivilege	4888	powershell.exe
Token: SeTakeOwnershipPrivilege	4888	powershell.exe
Token: SeLoadDriverPrivilege	4888	powershell.exe
Token: SeSystemProfilePrivilege	4888	powershell.exe
Token: SeSystemtimePrivilege	4888	powershell.exe
Token: SeProfSingleProcessPrivilege	4888	powershell.exe
Token: SeIncBasePriorityPrivilege	4888	powershell.exe
Token: SeCreatePagefilePrivilege	4888	powershell.exe
Token: SeBackupPrivilege	4888	powershell.exe
Token: SeRestorePrivilege	4888	powershell.exe
Token: SeShutdownPrivilege	4888	powershell.exe
Token: SeDebugPrivilege	4888	powershell.exe
Token: SeSystemEnvironmentPrivilege	4888	powershell.exe
Token: SeRemoteShutdownPrivilege	4888	powershell.exe
Token: SeUndockPrivilege	4888	powershell.exe
Token: SeManageVolumePrivilege	4888	powershell.exe
Token: 33	4888	powershell.exe
Token: 34	4888	powershell.exe
Token: 35	4888	powershell.exe
Token: 36	4888	powershell.exe
Token: SeIncreaseQuotaPrivilege	2408	WMIC.exe
Token: SeSecurityPrivilege	2408	WMIC.exe
Token: SeTakeOwnershipPrivilege	2408	WMIC.exe
Token: SeLoadDriverPrivilege	2408	WMIC.exe
Token: SeSystemProfilePrivilege	2408	WMIC.exe
Token: SeSystemtimePrivilege	2408	WMIC.exe
Token: SeProfSingleProcessPrivilege	2408	WMIC.exe
Token: SeIncBasePriorityPrivilege	2408	WMIC.exe
Token: SeCreatePagefilePrivilege	2408	WMIC.exe
Token: SeBackupPrivilege	2408	WMIC.exe
Token: SeRestorePrivilege	2408	WMIC.exe
Token: SeShutdownPrivilege	2408	WMIC.exe
Token: SeDebugPrivilege	2408	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2408	WMIC.exe
Token: SeRemoteShutdownPrivilege	2408	WMIC.exe
Token: SeUndockPrivilege	2408	WMIC.exe
Token: SeManageVolumePrivilege	2408	WMIC.exe
Token: 33	2408	WMIC.exe
Token: 34	2408	WMIC.exe
Token: 35	2408	WMIC.exe
Token: 36	2408	WMIC.exe
Token: SeIncreaseQuotaPrivilege	2408	WMIC.exe
Token: SeSecurityPrivilege	2408	WMIC.exe
Token: SeTakeOwnershipPrivilege	2408	WMIC.exe
Token: SeLoadDriverPrivilege	2408	WMIC.exe
Token: SeSystemProfilePrivilege	2408	WMIC.exe
Token: SeSystemtimePrivilege	2408	WMIC.exe
Token: SeProfSingleProcessPrivilege	2408	WMIC.exe
Token: SeIncBasePriorityPrivilege	2408	WMIC.exe
Token: SeCreatePagefilePrivilege	2408	WMIC.exe
Token: SeBackupPrivilege	2408	WMIC.exe
Token: SeRestorePrivilege	2408	WMIC.exe
Token: SeShutdownPrivilege	2408	WMIC.exe
Token: SeDebugPrivilege	2408	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2408	WMIC.exe
Token: SeRemoteShutdownPrivilege	2408	WMIC.exe
Token: SeUndockPrivilege	2408	WMIC.exe
Token: SeManageVolumePrivilege	2408	WMIC.exe
Token: 33	2408	WMIC.exe
Token: 34	2408	WMIC.exe
Token: 35	2408	WMIC.exe
Token: 36	2408	WMIC.exe

Suspicious use of WriteProcessMemory 46 IoCs

description	pid	Process	procid_target
PID 5524 wrote to memory of 5880	5524	MintedClientSetup-x86.exe	88
PID 5880 wrote to memory of 4888	5880	cmd.exe	90
PID 5524 wrote to memory of 3500	5524	MintedClientSetup-x86.exe	91
PID 3500 wrote to memory of 5896	3500	cmd.exe	93
PID 5524 wrote to memory of 5240	5524	MintedClientSetup-x86.exe	94
PID 5240 wrote to memory of 4312	5240	cmd.exe	96
PID 5524 wrote to memory of 4284	5524	MintedClientSetup-x86.exe	97
PID 4284 wrote to memory of 4756	4284	cmd.exe	99
PID 5524 wrote to memory of 6036	5524	MintedClientSetup-x86.exe	100
PID 6036 wrote to memory of 2848	6036	cmd.exe	102
PID 5524 wrote to memory of 1608	5524	MintedClientSetup-x86.exe	103
PID 1608 wrote to memory of 2408	1608	cmd.exe	105
PID 5524 wrote to memory of 936	5524	MintedClientSetup-x86.exe	107
PID 936 wrote to memory of 2968	936	cmd.exe	110
PID 244 wrote to memory of 6072	244	MintedClientSetup-x86.exe	112
PID 6072 wrote to memory of 4504	6072	cmd.exe	114
PID 244 wrote to memory of 4164	244	MintedClientSetup-x86.exe	115
PID 4164 wrote to memory of 5892	4164	cmd.exe	117
PID 244 wrote to memory of 2100	244	MintedClientSetup-x86.exe	118
PID 2100 wrote to memory of 3528	2100	cmd.exe	120
PID 244 wrote to memory of 5608	244	MintedClientSetup-x86.exe	121
PID 5608 wrote to memory of 3060	5608	cmd.exe	123
PID 244 wrote to memory of 6124	244	MintedClientSetup-x86.exe	124
PID 6124 wrote to memory of 4484	6124	cmd.exe	126
PID 244 wrote to memory of 5712	244	MintedClientSetup-x86.exe	127
PID 5712 wrote to memory of 4196	5712	cmd.exe	129
PID 5524 wrote to memory of 5920	5524	MintedClientSetup-x86.exe	130
PID 5920 wrote to memory of 3668	5920	cmd.exe	132
PID 244 wrote to memory of 4072	244	MintedClientSetup-x86.exe	133
PID 4072 wrote to memory of 2260	4072	cmd.exe	135
PID 5524 wrote to memory of 3816	5524	MintedClientSetup-x86.exe	136
PID 3816 wrote to memory of 1152	3816	cmd.exe	138
PID 244 wrote to memory of 4928	244	MintedClientSetup-x86.exe	139
PID 4928 wrote to memory of 4092	4928	cmd.exe	141
PID 5524 wrote to memory of 4272	5524	MintedClientSetup-x86.exe	142
PID 4272 wrote to memory of 672	4272	cmd.exe	144
PID 244 wrote to memory of 4380	244	MintedClientSetup-x86.exe	145
PID 4380 wrote to memory of 1508	4380	cmd.exe	147
PID 5524 wrote to memory of 2624	5524	MintedClientSetup-x86.exe	148
PID 2624 wrote to memory of 4440	2624	cmd.exe	150
PID 244 wrote to memory of 3736	244	MintedClientSetup-x86.exe	151
PID 3736 wrote to memory of 5784	3736	cmd.exe	153
PID 5524 wrote to memory of 4500	5524	MintedClientSetup-x86.exe	154
PID 4500 wrote to memory of 1184	4500	cmd.exe	156
PID 244 wrote to memory of 4236	244	MintedClientSetup-x86.exe	157
PID 4236 wrote to memory of 3756	4236	cmd.exe	159

C:\Users\Admin\AppData\Local\Temp\MintedClientSetup-x86.exe
"C:\Users\Admin\AppData\Local\Temp\MintedClientSetup-x86.exe"
1⤵
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
PID:5524
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c powershell -NoProfile -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\mc_av.ps1"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5880
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\mc_av.ps1"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4888
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c sc query "WinDefend" 2>nul
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3500
- - C:\Windows\system32\sc.exe
    sc query "WinDefend"
    3⤵
    - Launches sc.exe
    PID:5896
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c sc query "MsMpEng" 2>nul
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5240
- - C:\Windows\system32\sc.exe
    sc query "MsMpEng"
    3⤵
    - Launches sc.exe
    PID:4312
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c sc query "avp" 2>nul
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4284
- - C:\Windows\system32\sc.exe
    sc query "avp"
    3⤵
    - Launches sc.exe
    PID:4756
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c sc query "ekrn" 2>nul
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:6036
- - C:\Windows\system32\sc.exe
    sc query "ekrn"
    3⤵
    - Launches sc.exe
    PID:2848
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c wmic path win32_VideoController get name
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1608
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic path win32_VideoController get name
    3⤵
    - Detects videocard installed
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2408
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c wmic path win32_VideoController get name
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:936
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic path win32_VideoController get name
    3⤵
    - Detects videocard installed
    - Suspicious behavior: EnumeratesProcesses
    PID:2968
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c wmic path win32_VideoController get name
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5920
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic path win32_VideoController get name
    3⤵
    - Detects videocard installed
    - Suspicious behavior: EnumeratesProcesses
    PID:3668
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c wmic path win32_VideoController get name
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3816
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic path win32_VideoController get name
    3⤵
    - Detects videocard installed
    - Suspicious behavior: EnumeratesProcesses
    PID:1152
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c wmic path win32_VideoController get name
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4272
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic path win32_VideoController get name
    3⤵
    - Detects videocard installed
    - Suspicious behavior: EnumeratesProcesses
    PID:672
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c wmic path win32_VideoController get name
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2624
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic path win32_VideoController get name
    3⤵
    - Detects videocard installed
    - Suspicious behavior: EnumeratesProcesses
    PID:4440
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c wmic path win32_VideoController get name
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4500
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic path win32_VideoController get name
    3⤵
    - Detects videocard installed
    - Suspicious behavior: EnumeratesProcesses
    PID:1184

C:\Users\Admin\AppData\Local\Temp\MintedClientSetup-x86.exe
C:\Users\Admin\AppData\Local\Temp\MintedClientSetup-x86.exe
1⤵
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
PID:244
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c powershell -NoProfile -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\mc_av.ps1"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:6072
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\mc_av.ps1"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:4504
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c sc query "WinDefend" 2>nul
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4164
- - C:\Windows\system32\sc.exe
    sc query "WinDefend"
    3⤵
    - Launches sc.exe
    PID:5892
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c sc query "MsMpEng" 2>nul
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2100
- - C:\Windows\system32\sc.exe
    sc query "MsMpEng"
    3⤵
    - Launches sc.exe
    PID:3528
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c sc query "avp" 2>nul
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5608
- - C:\Windows\system32\sc.exe
    sc query "avp"
    3⤵
    - Launches sc.exe
    PID:3060
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c sc query "ekrn" 2>nul
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:6124
- - C:\Windows\system32\sc.exe
    sc query "ekrn"
    3⤵
    - Launches sc.exe
    PID:4484
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c wmic path win32_VideoController get name
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5712
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic path win32_VideoController get name
    3⤵
    - Detects videocard installed
    - Suspicious behavior: EnumeratesProcesses
    PID:4196
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c wmic path win32_VideoController get name
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4072
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic path win32_VideoController get name
    3⤵
    - Detects videocard installed
    - Suspicious behavior: EnumeratesProcesses
    PID:2260
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c wmic path win32_VideoController get name
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4928
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic path win32_VideoController get name
    3⤵
    - Detects videocard installed
    - Suspicious behavior: EnumeratesProcesses
    PID:4092
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c wmic path win32_VideoController get name
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4380
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic path win32_VideoController get name
    3⤵
    - Detects videocard installed
    - Suspicious behavior: EnumeratesProcesses
    PID:1508
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c wmic path win32_VideoController get name
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3736
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic path win32_VideoController get name
    3⤵
    - Detects videocard installed
    - Suspicious behavior: EnumeratesProcesses
    PID:5784
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c wmic path win32_VideoController get name
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4236
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic path win32_VideoController get name
    3⤵
    - Detects videocard installed
    - Suspicious behavior: EnumeratesProcesses
    PID:3756

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 2706f7a3cde18304b8eb65dc0fa6d884f09a46a78e320302afda951d20885534
MD5 dc6571b4e39d13392bb7f996d9a95ef5
SHA1 a1838cd4f6a2a1ff743489171ba9f83c662362c7
SHA512 5e2582268c12399a5b29751932d896eb47931478bbafa197faf15d26470a589e1892887a85e7061e431ad8163259ee00682e34c167e9ca204ffd33c888a35f63
TLSH
T199219833F3DC8214CC99003A10DDAC1036B6C7CB40DECF9B6B85E159A82F298DF60160
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_3nvfzyzc.kop.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_3nvfzyzc.kop.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

mc_av.ps1

Path C:\Users\Admin\AppData\Local\Temp\mc_av.ps1
Size 164B
SHA256 b6a73adf1b11242ade106e66e7865f06ac19d87b4e71cac361515aa55e0ba260
MD5 b0f8f0130f070f1f525497d3a5866fb0
SHA1 8e7f202959a85037bac542b24a56823a8aaa3fef
SHA512 e5380d3710056784a2615d439cfdbc7097a84e513341af8ca1b5674eb17cce2341fa35fa5896b3c6897a4018dcfb7b13d993c32cffd048e59d1322bb7baa9728
TLSH
T128C08C08237885D81626E6A2CDEE3B0BA58A81AD45676B00463002B6399758686C389F
MD5 SHA1 SHA512 TLSH

Submit Download

memory/244-35-0x00007FF6773D0000-0x00007FF677628000-memory.dmp

Download

memory/4504-32-0x00000203298C0000-0x0000020329972000-memory.dmp

Download

memory/4888-17-0x00007FFDEA900000-0x00007FFDEB2A4000-memory.dmp

Download

memory/4888-19-0x00000211D3E80000-0x00000211D3E8A000-memory.dmp

Download

memory/4888-12-0x00000211D3E90000-0x00000211D3EAE000-memory.dmp

Download

memory/4888-13-0x00007FFDEA900000-0x00007FFDEB2A4000-memory.dmp

Download

memory/4888-14-0x00000211D3EB0000-0x00000211D3F62000-memory.dmp

Download

memory/4888-15-0x00007FFDEA900000-0x00007FFDEB2A4000-memory.dmp

Download

memory/4888-16-0x00007FFDEA900000-0x00007FFDEB2A4000-memory.dmp

Download

memory/4888-1-0x00007FFDEAA8F000-0x00007FFDEAA90000-memory.dmp

Download

memory/4888-18-0x00007FFDEA900000-0x00007FFDEB2A4000-memory.dmp

Download

memory/4888-9-0x00007FFDEA900000-0x00007FFDEB2A4000-memory.dmp

Download

memory/4888-21-0x00000211D3FA0000-0x00000211D3FC4000-memory.dmp

Download

memory/4888-20-0x00000211D3FA0000-0x00000211D3FCA000-memory.dmp

Download

memory/4888-22-0x00007FFDEA900000-0x00007FFDEB2A4000-memory.dmp

Download

memory/4888-24-0x00007FFDEA900000-0x00007FFDEB2A4000-memory.dmp

Download

memory/4888-8-0x00007FFDEA900000-0x00007FFDEB2A4000-memory.dmp

Download

memory/4888-7-0x00007FFDEA900000-0x00007FFDEB2A4000-memory.dmp

Download

memory/4888-5-0x00007FFDEA900000-0x00007FFDEB2A4000-memory.dmp

Download

memory/4888-4-0x00000211D3E10000-0x00000211D3E32000-memory.dmp

Download

memory/5524-34-0x00007FF6773D0000-0x00007FF677628000-memory.dmp

Download