mintsloader | 581bb3384ea9a53716eab329db751a8ce822bf6bf3c3d47b7b32ada8d7ad7946

Analysis

user interaction
yes
max time kernel
149s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20260911-it
resource tags

arch:x64arch:x86image:win10v2004-20260911-itlocale:it-itos:windows10-2004-x64systemwindows
submitted
11/11/2026, 11:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
IT5508645056751.html
Size 27KB
Sample261111-nn8a5afv4r
SHA256 581bb3384ea9a53716eab329db751a8ce822bf6bf3c3d47b7b32ada8d7ad7946
MD5 c36923792f87d1790f842d09c9959fb2
SHA1 d8db86c7fc078e2945819e88e57f0fbaae84f04b
SHA512 97236c1bf3fdcc44c80a74ba63b049b0d282e6e3c017e517be617795c0b3b629001087eee7e5e3009f8ad8b21024f201613e7d51cdbb44709cd151debf67baa5
SSDEEP 768:0IMIouxqiuxduxGI3INR3q7AAZbejIHrLocqeq9qldLoSkjIHeElCvmvEWCvm/9d:033Ziebaoq7AAZygrLocqeq9qldLoScu
TLSH
T12AC2FB8C87C24186396F8174AF96D1D26681C137B31142D9FE9E77592F3BC5C01BB35A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery execution mintsloader loader suricata

Malware Config

Signatures

Family: MintsLoader
MintsLoader is a multi-stage malware loader.
loader mintsloader

Suricata alert: MintsLoader Outbound C2 Communication 2 IoCs

Network activity triggered a Suricata alert

suricata mintsloader

flow	pid	Process
38	640	powershell.exe
39	448	powershell.exe

Process spawned unexpected child process 2 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	640	4900	powershell.exe	96
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	448	4900	powershell.exe	96

Badlisted process makes network request 2 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
38	640	powershell.exe
39	448	powershell.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
640	powershell.exe
448	powershell.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WScript.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WScript.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WScript.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WScript.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4792	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\Local Settings	chrome.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
4028	chrome.exe
4028	chrome.exe
640	powershell.exe
640	powershell.exe
640	powershell.exe
448	powershell.exe
448	powershell.exe
448	powershell.exe
4028	chrome.exe
4028	chrome.exe
3056	chrome.exe
3056	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
4028	chrome.exe
4028	chrome.exe
4028	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4028	chrome.exe
Token: SeCreatePagefilePrivilege	4028	chrome.exe
Token: SeShutdownPrivilege	4028	chrome.exe
Token: SeCreatePagefilePrivilege	4028	chrome.exe
Token: SeShutdownPrivilege	4028	chrome.exe
Token: SeCreatePagefilePrivilege	4028	chrome.exe
Token: SeShutdownPrivilege	4028	chrome.exe
Token: SeCreatePagefilePrivilege	4028	chrome.exe
Token: SeShutdownPrivilege	4028	chrome.exe
Token: SeCreatePagefilePrivilege	4028	chrome.exe
Token: SeShutdownPrivilege	4028	chrome.exe
Token: SeCreatePagefilePrivilege	4028	chrome.exe
Token: SeShutdownPrivilege	4028	chrome.exe
Token: SeCreatePagefilePrivilege	4028	chrome.exe
Token: SeShutdownPrivilege	4028	chrome.exe
Token: SeCreatePagefilePrivilege	4028	chrome.exe
Token: SeShutdownPrivilege	4028	chrome.exe
Token: SeCreatePagefilePrivilege	4028	chrome.exe
Token: SeShutdownPrivilege	4028	chrome.exe
Token: SeCreatePagefilePrivilege	4028	chrome.exe
Token: SeShutdownPrivilege	4028	chrome.exe
Token: SeCreatePagefilePrivilege	4028	chrome.exe
Token: SeShutdownPrivilege	4028	chrome.exe
Token: SeCreatePagefilePrivilege	4028	chrome.exe
Token: SeShutdownPrivilege	4028	chrome.exe
Token: SeCreatePagefilePrivilege	4028	chrome.exe
Token: SeShutdownPrivilege	4028	chrome.exe
Token: SeCreatePagefilePrivilege	4028	chrome.exe
Token: SeShutdownPrivilege	4028	chrome.exe
Token: SeCreatePagefilePrivilege	4028	chrome.exe
Token: SeShutdownPrivilege	4028	chrome.exe
Token: SeCreatePagefilePrivilege	4028	chrome.exe
Token: SeShutdownPrivilege	4028	chrome.exe
Token: SeCreatePagefilePrivilege	4028	chrome.exe
Token: SeShutdownPrivilege	4028	chrome.exe
Token: SeCreatePagefilePrivilege	4028	chrome.exe
Token: SeShutdownPrivilege	4028	chrome.exe
Token: SeCreatePagefilePrivilege	4028	chrome.exe
Token: SeShutdownPrivilege	4028	chrome.exe
Token: SeCreatePagefilePrivilege	4028	chrome.exe
Token: SeShutdownPrivilege	4028	chrome.exe
Token: SeCreatePagefilePrivilege	4028	chrome.exe
Token: SeShutdownPrivilege	4028	chrome.exe
Token: SeCreatePagefilePrivilege	4028	chrome.exe
Token: SeShutdownPrivilege	4028	chrome.exe
Token: SeCreatePagefilePrivilege	4028	chrome.exe
Token: SeShutdownPrivilege	4028	chrome.exe
Token: SeCreatePagefilePrivilege	4028	chrome.exe
Token: SeShutdownPrivilege	4028	chrome.exe
Token: SeCreatePagefilePrivilege	4028	chrome.exe
Token: SeShutdownPrivilege	4028	chrome.exe
Token: SeCreatePagefilePrivilege	4028	chrome.exe
Token: SeShutdownPrivilege	4028	chrome.exe
Token: SeCreatePagefilePrivilege	4028	chrome.exe
Token: SeShutdownPrivilege	4028	chrome.exe
Token: SeCreatePagefilePrivilege	4028	chrome.exe
Token: SeShutdownPrivilege	4028	chrome.exe
Token: SeCreatePagefilePrivilege	4028	chrome.exe
Token: SeShutdownPrivilege	4028	chrome.exe
Token: SeCreatePagefilePrivilege	4028	chrome.exe
Token: SeShutdownPrivilege	4028	chrome.exe
Token: SeCreatePagefilePrivilege	4028	chrome.exe
Token: SeShutdownPrivilege	4028	chrome.exe
Token: SeCreatePagefilePrivilege	4028	chrome.exe

Suspicious use of FindShellTrayWindow 42 IoCs

pid	Process
4028	chrome.exe
4028	chrome.exe
4028	chrome.exe
4028	chrome.exe
4028	chrome.exe
4028	chrome.exe
4028	chrome.exe
4028	chrome.exe
4028	chrome.exe
4028	chrome.exe
4028	chrome.exe
4028	chrome.exe
4028	chrome.exe
4028	chrome.exe
4028	chrome.exe
4028	chrome.exe
4028	chrome.exe
4028	chrome.exe
4028	chrome.exe
4028	chrome.exe
4028	chrome.exe
4028	chrome.exe
4028	chrome.exe
4028	chrome.exe
4028	chrome.exe
4028	chrome.exe
4028	chrome.exe
4028	chrome.exe
4028	chrome.exe
4028	chrome.exe
4028	chrome.exe
4028	chrome.exe
4028	chrome.exe
4028	chrome.exe
4028	chrome.exe
4028	chrome.exe
4028	chrome.exe
4028	chrome.exe
4028	chrome.exe
4028	chrome.exe
4028	chrome.exe
4028	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4028	chrome.exe
4028	chrome.exe
4028	chrome.exe
4028	chrome.exe
4028	chrome.exe
4028	chrome.exe
4028	chrome.exe
4028	chrome.exe
4028	chrome.exe
4028	chrome.exe
4028	chrome.exe
4028	chrome.exe
4028	chrome.exe
4028	chrome.exe
4028	chrome.exe
4028	chrome.exe
4028	chrome.exe
4028	chrome.exe
4028	chrome.exe
4028	chrome.exe
4028	chrome.exe
4028	chrome.exe
4028	chrome.exe
4028	chrome.exe
4028	chrome.exe
4028	chrome.exe
4028	chrome.exe
4028	chrome.exe
4028	chrome.exe
4028	chrome.exe
4028	chrome.exe
4028	chrome.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 4028 wrote to memory of 1032	4028	chrome.exe	85
PID 4028 wrote to memory of 4872	4028	chrome.exe	86
PID 4028 wrote to memory of 4872	4028	chrome.exe	86
PID 4028 wrote to memory of 4792	4028	chrome.exe	87
PID 4028 wrote to memory of 1124	4028	chrome.exe	88
PID 4028 wrote to memory of 1124	4028	chrome.exe	88
PID 4028 wrote to memory of 4232	4028	chrome.exe	90
PID 4028 wrote to memory of 4232	4028	chrome.exe	90
PID 4028 wrote to memory of 1564	4028	chrome.exe	91
PID 4028 wrote to memory of 1564	4028	chrome.exe	91
PID 4028 wrote to memory of 4712	4028	chrome.exe	97
PID 4028 wrote to memory of 4712	4028	chrome.exe	97
PID 4028 wrote to memory of 2124	4028	chrome.exe	98
PID 4028 wrote to memory of 1892	4028	chrome.exe	103
PID 4028 wrote to memory of 4064	4028	chrome.exe	104
PID 4028 wrote to memory of 3496	4028	chrome.exe	105
PID 4028 wrote to memory of 1552	4028	chrome.exe	107
PID 4028 wrote to memory of 2584	4028	chrome.exe	108
PID 4028 wrote to memory of 3480	4028	chrome.exe	109
PID 4028 wrote to memory of 3056	4028	chrome.exe	115

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\IT5508645056751.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4028
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffb9721c728,0x7ffb9721c734,0x7ffb9721c740
  2⤵
  PID:1032
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1748,i,7406825921837756606,3504321781935992645,262144 --field-trial-handle=1976,i,18355540867708256320,13124641314232874352,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=1972 /prefetch:2
  2⤵
  PID:4872
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=it --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1576,i,13881038136766775510,8422561895130716249,524288 --field-trial-handle=1976,i,18355540867708256320,13124641314232874352,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2236 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4792
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=it --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2332,i,6111921570769827586,5246735729452657799,524288 --field-trial-handle=1976,i,18355540867708256320,13124641314232874352,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2508 /prefetch:8
  2⤵
  PID:1124
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=it --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3180,i,8655829757006227976,1225116766720801281,2097152 --field-trial-handle=1976,i,18355540867708256320,13124641314232874352,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3248 /prefetch:1
  2⤵
  PID:4232
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=it --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3184,i,3266249940028014292,15185784107371211991,2097152 --field-trial-handle=1976,i,18355540867708256320,13124641314232874352,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3268 /prefetch:1
  2⤵
  PID:1564
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=it --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4932,i,5641348509899149097,7621683169160125778,2097152 --field-trial-handle=1976,i,18355540867708256320,13124641314232874352,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4948 /prefetch:1
  2⤵
  PID:4712
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=it --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5512,i,967442241612991699,10080457720530686612,524288 --field-trial-handle=1976,i,18355540867708256320,13124641314232874352,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5548 /prefetch:8
  2⤵
  PID:2124
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=it --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=3472,i,14391934343074390490,5687172799919756714,524288 --field-trial-handle=1976,i,18355540867708256320,13124641314232874352,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5556 /prefetch:8
  2⤵
  PID:1892
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Downloads\Fattura735151816.js"
  2⤵
  - Reads the TCP/IP host and domain name from the registry
  PID:4064
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Downloads\Fattura735151816.js"
  2⤵
  - Reads the TCP/IP host and domain name from the registry
  PID:3496
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=it --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5596,i,7094760279127266318,10047075588449015460,524288 --field-trial-handle=1976,i,18355540867708256320,13124641314232874352,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5768 /prefetch:8
  2⤵
  PID:1552
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=it --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5796,i,18057145679416863607,2571379224136687205,524288 --field-trial-handle=1976,i,18355540867708256320,13124641314232874352,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5804 /prefetch:8
  2⤵
  PID:2584
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=it --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5820,i,10588320623981583318,1889752930097961678,524288 --field-trial-handle=1976,i,18355540867708256320,13124641314232874352,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5848 /prefetch:8
  2⤵
  PID:3480
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1020,i,16449166565199403363,10905989534116574862,262144 --field-trial-handle=1976,i,18355540867708256320,13124641314232874352,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5140 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3056

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4224

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4720

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -NoP -ep Bypass -File "C:\Users\Admin\Downloads\Aicxq2O48Vj60FbmqtYszas3zRPa4Jw2fIPGIOVVTdrmLno0gxNrKINxUjxjuG3vBM5rYhUkyDpSnzqVs.ps1"
1⤵
- Suricata alert: MintsLoader Outbound C2 Communication
- Process spawned unexpected child process
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:640

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -NoP -ep Bypass -File "C:\Users\Admin\Downloads\Aicxq2O48Vj60FbmqtYszas3zRPa4Jw2fIPGIOVVTdrmLno0gxNrKINxUjxjuG3vBM5rYhUkyDpSnzqVs.ps1"
1⤵
- Suricata alert: MintsLoader Outbound C2 Communication
- Process spawned unexpected child process
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:448

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

0f8665dd-0c6f-413e-bdc4-228e6ee440d0.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\0f8665dd-0c6f-413e-bdc4-228e6ee440d0.tmp
Size 131KB
SHA256 7c86b047f42f3101e116ee2c0a71b39a08e7a9a1aed857278a2634ede4fa3d9c
MD5 dfb4b9f19ab4c6a5155b673c3b7698d4
SHA1 f23042efc57d3908f71a97dbee693738ef70da40
SHA512 3b35746588f8e6b6a12323b6ebe8af59a356e308ca7723c83cea73a7cdf05fc1c2421a8c19bf16cb997fe5d6e0a75297ce15ff363ed6e3178420eb9995955168
SSDEEP 3072:ENu+lPFz63F8+7t5x0M2XLqD90xWfrz6a9pInCOp+EGFAJ8P+gr:ENu+hFD+7t56OD9ZfSApprr
TLSH
T153D31232AA95D87BC9FD6541F147A304CE7668EE45DE3A09444A5F8EE09FC4C07A3A33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

49665f38-bd53-4f22-94c0-f5faad335062.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\49665f38-bd53-4f22-94c0-f5faad335062.tmp
Size 130KB
SHA256 2d9a44db0e3da216f6e176ad86865f590e77b9c1cdaf9f32e1d001c6fb4dc90e
MD5 f77e140a82186358d37e9a1493ebd815
SHA1 bae20e610c19f918bd007151e0d822fdebde006d
SHA512 0b70922dbc91dda2e8d99cbe5084e21df6774fab313c193ca180fca9ac5f4e995e239de80b00e9eef07863f6e3fa92c278b7ab71482b4a38348957e2fd3af50f
SSDEEP 3072:dpr+lPFz63F8+7t5x0M2XLqD90xWfrz6a9pInCOp+EGFAJ8P+gr:dpr+hFD+7t56OD9ZfSApprr
TLSH
T1A1D31232AA91D8BBC9FC6541B157A304DE766CED41DE7A09444A5F8EE09FC4C06B3A33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

55f9effb-6e06-41d8-86a3-ee5d3583757c.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\55f9effb-6e06-41d8-86a3-ee5d3583757c.tmp
Size 131KB
SHA256 f779d4da3d28241d11824a66fac765076f480b005dff7c003f7cc2e9b7deaf46
MD5 f164f8becfda97f3311dac52fd71c4f6
SHA1 43ba05a17daf002d8c758a99a15419c835c3f3aa
SHA512 95d63ce3b04af6fad05083772062620467d12447bdba10e814bf0bc8991eb6062b1cfea1b842fc7ddccfa746d7fc38f448f93a947fc09089cdaca8c200e8d215
SSDEEP 3072:E5y+lPFz63F8+7t5x0M2XLqD90xWfrz6a9pInCOp+EGFAJ8P+gr:E5y+hFD+7t56OD9ZfSApprr
TLSH
T1D3D30232AA95D877C9FC6541F147A304CE6668ED95EE3A0D444A5F8AE09FC4C07B3A33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

21f0be76-1b5e-4407-a561-aee471d19952.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\21f0be76-1b5e-4407-a561-aee471d19952.tmp
Size 11KB
SHA256 580bc85cf2e3aa7cd58f0fea1ac6179d8585870af38ee4a83a5be0803b163a8d
MD5 70f4b1e12ea6752031b22f2c598cd0c5
SHA1 209b4b9e21b8ac55698e8e9c01da37faae9ea7fc
SHA512 3e851e7be616ecd630938a16e459d25c3ad3f1392e645f64ba024846abcaaf8c87d650b764f08cc5143075a0e999ef56377b2fbbc674a5d52c582aca72f20ffc
SSDEEP 192:XRzj4D1jv71vAPRp2tm9IHsb+WNnzvPnp2qbatkCVyIsnAUge:XRzj4xb56X32wDPp2GaPe
TLSH
T10742932DAD14393B6CDBD32AF961B757D7F9102225942E84E6FD883C24EB5CC222B417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

24efa3f8-c195-4f8d-af64-f7eeb942df1d.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\24efa3f8-c195-4f8d-af64-f7eeb942df1d.tmp
Size 12KB
SHA256 9556a749413a1fd28049cdb5fd0c66801fdf1ee5d27b0de55c0fbbc58575bf41
MD5 59e0858cf4fd3a7cef8592302b871763
SHA1 49860f467a06b4ff000f258dbf04ad71bcb5ddda
SHA512 a2dfeefd91ec882c674b7ba7cc3cbb8d8de787309961540595596d58bd5ae4aac2a33c38deccaff66a46a52fca3e4108a16c8650c032874064f81c809ebfb139
SSDEEP 192:XRzj4D14v71vLPRpXtm9IHsb+WNnzvPqp2qbatk4VyIsnAUgE:XRzj4xk57X42wDP+2GabE
TLSH
T1C342B42DAD10393BACDBD32AF961B757D7F9102225942E84E6FC893C25EB9CC2217417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3709abe8-7f4b-45b2-b98b-8b39886e9fde.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\3709abe8-7f4b-45b2-b98b-8b39886e9fde.tmp
Size 12KB
SHA256 9c569a680cfa5bc90000f978595a1154cfb20313437a85a142a5e4b49efd1cd1
MD5 906768485d95b9b4222223ec5474ece6
SHA1 619813c52fddacc89cfdd61e608a3e7ba625dadd
SHA512 e8c8ce61397098cc3a71f667bd69ab3bdad44c6af21f2a42259e3b497a5b09da8a554f118fbcb31ab42bf5df989300fb086ff8da2c1de791753769bf51e1dc5b
SSDEEP 192:XRzj4D1dv71vAPRp2tm9IHsb+WNnzvPMp2qbatkqVyIsnAUgE:XRzj4xd56X32wDPM2GaHE
TLSH
T1DA42B32DAD10393BACDBD32AF961B717D7F9102225942E84E6FD893C25EB5CC221B417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5d48ba8b-9f7d-49e5-8167-c6637477e636.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\5d48ba8b-9f7d-49e5-8167-c6637477e636.tmp
Size 414B
SHA256 250eb605960095b4fd44eea6cef6d8ec9d528c50d8df314bd78fbda67f3dbbae
MD5 bd1af2f40c247e992d78604633f07f96
SHA1 05e157241ebf40a197945e9753b3dafd3dbfbf8c
SHA512 9930f8b01042087b1caf56f4a52e779491e0589b29a37b000227234ecac92fd8a828ef56c6e8c9f57e86c94ba3b9cdb4080cb088d26ddc81fb02aa948284398e
TLSH
T1E9E0EDA9CD25EC2728FC0B5810504746EA8013572A908A0F3A3C810D8FB977A858686C
MD5 SHA1 SHA512 TLSH

Submit Download

7a92ecfd-973e-4e9a-a3b3-e133592e5a32.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\7a92ecfd-973e-4e9a-a3b3-e133592e5a32.tmp
Size 11KB
SHA256 9f7d93019e5bd6c7911ca380f53f3723aab444bb080371289f276b30e9ee8a3e
MD5 e35be25b47c55e41b2963e8ca5fd8305
SHA1 c8e976e4e904a8e3867aa1017d9915038e23dbc5
SHA512 41ac35d2078bb9b40685985e26027d7897da3ec6321fb7f160b888151674a317fe6f7c8a98259d6c65d379b7a6d59661c4f388775fb8a06e2983ff3276817019
SSDEEP 192:XRzj4D1Fnv71vAPRp2tm9IHsb+WNnzvPnp2qbatkCVyIsnAUge:XRzj4xFv56X32wDPp2GaPe
TLSH
T1C542932DAD14393B6CDBD32AF961B757D7F9102225942E84E6FD883C24EB5CC222B417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

80d49541-f257-4314-bbb8-ee6756daa430.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\80d49541-f257-4314-bbb8-ee6756daa430.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

68308387-a722-49db-a838-ab82e75b2d26.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\68308387-a722-49db-a838-ab82e75b2d26.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

6ee113cc-a37c-4add-a515-1b9e1d0b3fbb.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\6ee113cc-a37c-4add-a515-1b9e1d0b3fbb.tmp
Size 1KB
SHA256 5834e2a3a1f7ba6a2c21b50a87cf83842093bdd880cfb2c6e3c32122e0b93ad4
MD5 9434ec4b31476971098fbf3f3a7d2593
SHA1 9536215b2904fd6ffcca57b9428346a1a01457d2
SHA512 d11e3cdf912602517d988d06be65f8cbea0ce6d508a3aae92043aaacdc5176c2b9037087b09edc7c79886ee0b936869fe9b011e61e94bac0e02530d62af160a2
TLSH
T1CA316BF793B4897E861196E4EA15AE1FCE790524031C386289D46E1B93F29B2D10479F
MD5 SHA1 SHA512 TLSH

Submit Download

b5d17ce8-1eb7-44f8-9aad-6900a55e45fd.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\b5d17ce8-1eb7-44f8-9aad-6900a55e45fd.tmp
Size 11KB
SHA256 69de6dc15114076d475e4d2dcbd4f54f468751981803dff78752531ab5ac90ad
MD5 c653853b21659f0f1a17088bce964c32
SHA1 c9af26cd4f271345652cef22d3ee94263e07c6fb
SHA512 17294d3e2da7c128a1afbab2436f67089293d2f455551945ced92cf318cec61acb969153487bfbefa7e45c0fc427f6d759842991c793ab38adf722dd3735d291
SSDEEP 192:el64K67/7KxkXqK4I40pUZNCgVLHrKHfFKslEz9LXzKD/Qj+ErUkKN9pVS27SS0+:c6jY/7KxkXqKf/pUZNCgVLH2HfgslcLm
TLSH
T13D32D827A44DAA3F4FD8D50DCC12AF4BADF502527368092497FB9D14039A7CA214E6BB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c7f675b5-5260-4088-a18a-c8676e3c0842.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\c7f675b5-5260-4088-a18a-c8676e3c0842.tmp
Size 131KB
SHA256 158bf258794be589976099242667a9c6b60475882a3e4aa5d750059a0f528738
MD5 6b9dd9f8e0b931e26ff3e05f893f03a6
SHA1 51aecd5ab76dd1265aacffff48b321e17c478067
SHA512 9b417c4e9414b7a2c9770ee9be023f065aa239437378d03528b34ea2d0d37b561616b18c86c9d60b53a690b8bbcb5734587e8979b817c6a87e5dff443672a073
SSDEEP 3072:pNu+lPFz63F8+7t5x0M2XLqD90xWfrz6a9pInCOp+EGFAJ8P+gr:pNu+hFD+7t56OD9ZfSApprr
TLSH
T1D3D31232AA95D87BC9FD6541F147A304CE6668EE45DE3A09444A5F8EE09FC4C07A3A33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 3KB
SHA256 88cc4f40f0eb08ff5c487d6db341b046cc63b22534980aca66a9f8480692f3a8
MD5 556084f2c6d459c116a69d6fedcc4105
SHA1 633e89b9a1e77942d822d14de6708430a3944dbc
SHA512 0f6557027b098e45556af93e0be1db9a49c6416dc4afcff2cc2135a8a1ad4f1cf7185541ddbe6c768aefaf2c1a8e52d5282a538d15822d19932f22316edd283e
TLSH
T1BF610E323375B1D4C9567F072E2819C053BF8396EA94AF5CB29C621ED92641B8F122F3
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 0ea019a9145ac2fb732fc2c1c37115e8b1d64d6c93435bafe4589dbb60da0961
MD5 2d2c7557ad2b9a788eecb42ac88e3c20
SHA1 68322ee4acf92d547b205be3c2e5fe7abdc2dc7c
SHA512 027654cb41bc8eb42ee84042a2b06a2cb461675f25dd838d68b9dbb13ddc8e61a53c34455d12d1d82c63ce32c4dd79f9ad8d4749e5f8c776ed6a53be1c162554
TLSH
T1F0215627B3DC8921CC96123A109D9C1176B693D781AEDFAFAFC4D614A1BF588CB21294
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_fwglu3vc.zcb.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_fwglu3vc.zcb.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

2d95ac62-0203-4713-a050-b4e43c8d61dd.tmp

Path C:\Users\Admin\Downloads\2d95ac62-0203-4713-a050-b4e43c8d61dd.tmp
Size 15KB
SHA256 63501219febdbe46d1f6cbc7e14aa5774277a24aecd662d6c48c0a73c83b0d85
MD5 f496e8a76d72a263a4ca90a58a8c5618
SHA1 547adb667b7410abb23e64e77f0a0f1932f903eb
SHA512 6edb752485bd8e1e48214bfb94cccb2801417573d21ba26f418873c70033ecfc3c4007a8add0ab35f5a466f541a043526e48d644a638776a3a378c73be5096f2
SSDEEP 384:XFmhkTTVrhDF3FmhiFmhgiSZTTVrhxFLFmhZh6IkXGGGwG4Gt:XF0kPV1DF3F0iF0giQPV1xFLF0j6Ik2
TLSH
T1C872E7A0FB14B0648B0372C3E6D9460B369C972763666998698F099C7B2D8CCDF7197C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Aicxq2O48Vj60FbmqtYszas3zRPa4Jw2fIPGIOVVTdrmLno0gxNrKINxUjxjuG3vBM5rYhUkyDpSnzqVs.ps1

Path C:\Users\Admin\Downloads\Aicxq2O48Vj60FbmqtYszas3zRPa4Jw2fIPGIOVVTdrmLno0gxNrKINxUjxjuG3vBM5rYhUkyDpSnzqVs.ps1
Size 1KB
SHA256 09d46fe881e28df82937694c50dddc3055ef2f5c4a6317963853fe35f4372e39
MD5 7851979f41f108f47968b01e72c0ccff
SHA1 c9fcc337119b94f8e1aded1336d66743f474be8b
SHA512 f1f03e09083651c112e466a9439bd08c3bca63489ed3c0cf9d87d299eb5ba1de2bbe9635b818c06ed5cfa781fe11e9a229dd3641e6251eeebce6d786f0889680
TLSH
T15111EFE3D0220EA940E1C9A335ECB8D860FAA5778D8F084530897423F235B7CDB16BA0
MD5 SHA1 SHA512 TLSH

Submit Download

Non confermato 405768.crdownload

Path C:\Users\Admin\Downloads\Non confermato 405768.crdownload
Size 24KB
SHA256 72084c610494ed12f7a5de7c252c869d812f28130a0dfeaec82f92ea38cbe76b
MD5 2f23ed9324c43f0e1c3ce2968bfa7088
SHA1 75f1977dc03cd32031d6fe7b0fdf2983d29ef127
SHA512 1362e8d19dd70715f83e3a2ab9168e4e05b382617351bcb0f9b9f95fa805129ed1da7a2d5e4402c22ab13537767577ca10c709c1915ea1b6f1f40e5fa2787c78
SSDEEP 768:XF0kPV1DF3F0iF0giQPV1xFLF0j6Ik9MTPV1TPVlRGR2:v9nIkMfH8Y
TLSH
T157B2E7A0FB10B4245F126187F2DA460B7B989B2373B469446A8F189C7B2D5CCDF719BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/640-94-0x0000021DB31F0000-0x0000021DB3272000-memory.dmp

Download

memory/640-106-0x0000021DB31B0000-0x0000021DB31C4000-memory.dmp

Download

memory/640-104-0x0000021DB3490000-0x0000021DB3592000-memory.dmp

Download

memory/640-147-0x0000021DB33C0000-0x0000021DB3400000-memory.dmp

Download

memory/640-103-0x0000021D9B0A0000-0x0000021D9B0B0000-memory.dmp

Download

memory/640-102-0x0000021DB3160000-0x0000021DB3182000-memory.dmp

Download