b5e9cf94175d0539fe48fc1af05813e96ec8959919c367f5d0dcce35262f984e

Analysis

max time kernel
148s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
13/11/2026, 12:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
DeltaLoader.exe
Size 2.3MB
Sample261113-pflylabw6l
SHA256 b5e9cf94175d0539fe48fc1af05813e96ec8959919c367f5d0dcce35262f984e
MD5 67584b27bb4d302a661212c48012e7a7
SHA1 ff59ac565fd37305602a3055918679d72b60f834
SHA512 767d6289362bcc2fcf651aeccfcb6a76e1763fcf3f73005fb5d486ac82f413f6b7bb5fbc1c5e1ab62f23473f497f24ae4f1121329571fb1029c15c641fd41285
SSDEEP 49152:dnDDmKiMNItfGp+0IxVA3ZK+hKfiSdyZ8m0gkfXQXQKqQYP:xXmIWd21nscKFyym0gkf0BqQYP
TLSH
T1A7B533227BFDD140E13CFEF3EA4539B3EAA1A11F5251945CE771480499B0ADE29EC839
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

credential_access discovery persistence spyware stealer upx

Malware Config

Signatures

Executes dropped EXE 5 IoCs

pid	Process
4312	OfficeClickToRun.exe
1948	OfficeClickToRun.exe
2420	OfficeClickToRun.exe
4552	OfficeClickToRun.exe
3004	OfficeClickToRun.exe

Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe

UPX packed file 21 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3860-0-0x00007FF73F730000-0x00007FF73FD6E000-memory.dmp	upx
behavioral2/files/0x000300000000b951-3.dat	upx
behavioral2/memory/3860-5-0x00007FF73F730000-0x00007FF73FD6E000-memory.dmp	upx
behavioral2/memory/4312-6-0x00007FF737BB0000-0x00007FF7381EE000-memory.dmp	upx
behavioral2/memory/4312-23-0x00007FF737BB0000-0x00007FF7381EE000-memory.dmp	upx
behavioral2/memory/3860-17-0x00007FF73F730000-0x00007FF73FD6E000-memory.dmp	upx
behavioral2/memory/1948-22-0x00007FF737BB0000-0x00007FF7381EE000-memory.dmp	upx
behavioral2/memory/2420-26-0x00007FF737BB0000-0x00007FF7381EE000-memory.dmp	upx
behavioral2/memory/3860-27-0x00007FF73F730000-0x00007FF73FD6E000-memory.dmp	upx
behavioral2/memory/4552-29-0x00007FF737BB0000-0x00007FF7381EE000-memory.dmp	upx
behavioral2/memory/3004-35-0x00007FF737BB0000-0x00007FF7381EE000-memory.dmp	upx
behavioral2/memory/1948-73-0x00007FF737BB0000-0x00007FF7381EE000-memory.dmp	upx
behavioral2/memory/2420-74-0x00007FF737BB0000-0x00007FF7381EE000-memory.dmp	upx
behavioral2/memory/4552-76-0x00007FF737BB0000-0x00007FF7381EE000-memory.dmp	upx
behavioral2/memory/1948-77-0x00007FF737BB0000-0x00007FF7381EE000-memory.dmp	upx
behavioral2/memory/1948-79-0x00007FF737BB0000-0x00007FF7381EE000-memory.dmp	upx
behavioral2/memory/1948-81-0x00007FF737BB0000-0x00007FF7381EE000-memory.dmp	upx
behavioral2/memory/1948-85-0x00007FF737BB0000-0x00007FF7381EE000-memory.dmp	upx
behavioral2/memory/1948-87-0x00007FF737BB0000-0x00007FF7381EE000-memory.dmp	upx
behavioral2/memory/1948-89-0x00007FF737BB0000-0x00007FF7381EE000-memory.dmp	upx
behavioral2/memory/1948-97-0x00007FF737BB0000-0x00007FF7381EE000-memory.dmp	upx

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\DeltaLoader.exe	DeltaLoader.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_roqivlhe.jxp.ps1	powershell.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_v3jnsd2g.5tb.psm1	powershell.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_algcm2wx.45a.ps1	powershell.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_upcbpmzd.0wc.psm1	powershell.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	DeltaLoader.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	DeltaLoader.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	OfficeClickToRun.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	OfficeClickToRun.exe

Modifies data under HKEY_USERS 59 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000	OfficeClickToRun.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\Sequence = "1"	OfficeClickToRun.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager	OfficeClickToRun.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\SessionHash = 70c016fd913c9964f4d8afe68e8f98afdd7e1cadd67c58fe89df758846e02618	OfficeClickToRun.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\RegFilesHash = e50d390bff0d4ad307b8fab3a00ac515e3070e12e8123f34ec86b9fb58dff555	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\SessionHash = 33886c094939f693fee22e792e7b3469d812f91d0981557b5b441bc8041afe44	OfficeClickToRun.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\RegFiles0000 = 43003a005c00550073006500720073005c00410064006d0069006e005c0041007000700044006100740061005c004c006f00630061006c005c004d006900630072006f0073006f00660074005c0045006400670065005c005500730065007200200044006100740061005c00440065006600610075006c0074005c004e006500740077006f0072006b005c0043006f006f006b0069006500730000000000	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	OfficeClickToRun.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\RegFilesHash = 64d01d8831a0cf31e9a2d4795465733f25a40ff6c614dd62bd4e77c9eff218b2	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\RegFiles0000 = 43003a005c00550073006500720073005c00410064006d0069006e005c0041007000700044006100740061005c004c006f00630061006c005c0047006f006f0067006c0065005c004300680072006f006d0065005c005500730065007200200044006100740061005c00440065006600610075006c0074005c004e006500740077006f0072006b005c0043006f006f006b0069006500730000000000	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\Owner = 9c0700004e79532a6973dd01	OfficeClickToRun.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	powershell.exe

Suspicious behavior: EnumeratesProcesses 41 IoCs

pid	Process
3860	DeltaLoader.exe
3860	DeltaLoader.exe
3860	DeltaLoader.exe
3860	DeltaLoader.exe
3860	DeltaLoader.exe
3860	DeltaLoader.exe
3860	DeltaLoader.exe
3860	DeltaLoader.exe
3860	DeltaLoader.exe
3860	DeltaLoader.exe
3860	DeltaLoader.exe
3860	DeltaLoader.exe
3860	DeltaLoader.exe
3860	DeltaLoader.exe
3860	DeltaLoader.exe
3860	DeltaLoader.exe
3860	DeltaLoader.exe
3860	DeltaLoader.exe
3860	DeltaLoader.exe
3860	DeltaLoader.exe
3860	DeltaLoader.exe
3860	DeltaLoader.exe
4312	OfficeClickToRun.exe
4312	OfficeClickToRun.exe
1948	OfficeClickToRun.exe
1948	OfficeClickToRun.exe
2420	OfficeClickToRun.exe
2420	OfficeClickToRun.exe
4552	OfficeClickToRun.exe
4552	OfficeClickToRun.exe
3004	OfficeClickToRun.exe
3004	OfficeClickToRun.exe
2604	powershell.exe
2604	powershell.exe
1948	OfficeClickToRun.exe
1948	OfficeClickToRun.exe
1948	OfficeClickToRun.exe
1948	OfficeClickToRun.exe
2604	powershell.exe
1948	OfficeClickToRun.exe
1948	OfficeClickToRun.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2420	OfficeClickToRun.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeTcbPrivilege	3860	DeltaLoader.exe
Token: SeDebugPrivilege	3860	DeltaLoader.exe
Token: SeDebugPrivilege	3860	DeltaLoader.exe
Token: SeTcbPrivilege	1948	OfficeClickToRun.exe
Token: SeTcbPrivilege	2420	OfficeClickToRun.exe
Token: SeTcbPrivilege	1948	OfficeClickToRun.exe
Token: SeTcbPrivilege	4552	OfficeClickToRun.exe
Token: SeTcbPrivilege	1948	OfficeClickToRun.exe
Token: SeTcbPrivilege	3004	OfficeClickToRun.exe
Token: SeDebugPrivilege	2604	powershell.exe
Token: SeAssignPrimaryTokenPrivilege	2604	powershell.exe
Token: SeIncreaseQuotaPrivilege	2604	powershell.exe
Token: SeSecurityPrivilege	2604	powershell.exe
Token: SeTakeOwnershipPrivilege	2604	powershell.exe
Token: SeLoadDriverPrivilege	2604	powershell.exe
Token: SeSystemtimePrivilege	2604	powershell.exe
Token: SeBackupPrivilege	2604	powershell.exe
Token: SeRestorePrivilege	2604	powershell.exe
Token: SeShutdownPrivilege	2604	powershell.exe
Token: SeSystemEnvironmentPrivilege	2604	powershell.exe
Token: SeUndockPrivilege	2604	powershell.exe
Token: SeManageVolumePrivilege	2604	powershell.exe
Token: SeAssignPrimaryTokenPrivilege	2604	powershell.exe
Token: SeIncreaseQuotaPrivilege	2604	powershell.exe
Token: SeSecurityPrivilege	2604	powershell.exe
Token: SeTakeOwnershipPrivilege	2604	powershell.exe
Token: SeLoadDriverPrivilege	2604	powershell.exe
Token: SeSystemtimePrivilege	2604	powershell.exe
Token: SeBackupPrivilege	2604	powershell.exe
Token: SeRestorePrivilege	2604	powershell.exe
Token: SeShutdownPrivilege	2604	powershell.exe
Token: SeSystemEnvironmentPrivilege	2604	powershell.exe
Token: SeUndockPrivilege	2604	powershell.exe
Token: SeManageVolumePrivilege	2604	powershell.exe
Token: SeAssignPrimaryTokenPrivilege	2604	powershell.exe
Token: SeIncreaseQuotaPrivilege	2604	powershell.exe
Token: SeSecurityPrivilege	2604	powershell.exe
Token: SeTakeOwnershipPrivilege	2604	powershell.exe
Token: SeLoadDriverPrivilege	2604	powershell.exe
Token: SeSystemtimePrivilege	2604	powershell.exe
Token: SeBackupPrivilege	2604	powershell.exe
Token: SeRestorePrivilege	2604	powershell.exe
Token: SeShutdownPrivilege	2604	powershell.exe
Token: SeSystemEnvironmentPrivilege	2604	powershell.exe
Token: SeUndockPrivilege	2604	powershell.exe
Token: SeManageVolumePrivilege	2604	powershell.exe
Token: SeAssignPrimaryTokenPrivilege	2604	powershell.exe
Token: SeIncreaseQuotaPrivilege	2604	powershell.exe
Token: SeSecurityPrivilege	2604	powershell.exe
Token: SeTakeOwnershipPrivilege	2604	powershell.exe
Token: SeLoadDriverPrivilege	2604	powershell.exe
Token: SeSystemtimePrivilege	2604	powershell.exe
Token: SeBackupPrivilege	2604	powershell.exe
Token: SeRestorePrivilege	2604	powershell.exe
Token: SeShutdownPrivilege	2604	powershell.exe
Token: SeSystemEnvironmentPrivilege	2604	powershell.exe
Token: SeUndockPrivilege	2604	powershell.exe
Token: SeManageVolumePrivilege	2604	powershell.exe
Token: SeAssignPrimaryTokenPrivilege	2604	powershell.exe
Token: SeIncreaseQuotaPrivilege	2604	powershell.exe
Token: SeSecurityPrivilege	2604	powershell.exe
Token: SeTakeOwnershipPrivilege	2604	powershell.exe
Token: SeLoadDriverPrivilege	2604	powershell.exe
Token: SeSystemtimePrivilege	2604	powershell.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 4312 wrote to memory of 1948	4312	OfficeClickToRun.exe	93
PID 1948 wrote to memory of 4552	1948	OfficeClickToRun.exe	95
PID 1948 wrote to memory of 2604	1948	OfficeClickToRun.exe	96
PID 1948 wrote to memory of 3004	1948	OfficeClickToRun.exe	98

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\DeltaLoader.exe
"C:\Users\Admin\AppData\Local\Temp\DeltaLoader.exe"
1⤵
- Drops file in Program Files directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3860

C:\Users\Admin\AppData\Local\Microsoft\OfficeClickToRun.exe
"C:\Users\Admin\AppData\Local\Microsoft\OfficeClickToRun.exe"
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4312
- C:\Users\Admin\AppData\Local\Microsoft\OfficeClickToRun.exe
  "C:\Users\Admin\AppData\Local\Microsoft\OfficeClickToRun.exe"
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1948
- - C:\Users\Admin\AppData\Local\Microsoft\OfficeClickToRun.exe
    "C:\Users\Admin\AppData\Local\Microsoft\OfficeClickToRun.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4552
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"
    3⤵
    - Drops file in System32 directory
    - Drops file in Windows directory
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2604
- - C:\Users\Admin\AppData\Local\Microsoft\OfficeClickToRun.exe
    "C:\Users\Admin\AppData\Local\Microsoft\OfficeClickToRun.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3004

C:\Users\Admin\AppData\Local\Microsoft\OfficeClickToRun.exe
C:\Users\Admin\AppData\Local\Microsoft\OfficeClickToRun.exe
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:2420

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

OfficeClickToRun.exe

Path C:\Users\Admin\AppData\Local\Microsoft\OfficeClickToRun.exe
Size 2.3MB
SHA256 b5e9cf94175d0539fe48fc1af05813e96ec8959919c367f5d0dcce35262f984e
MD5 67584b27bb4d302a661212c48012e7a7
SHA1 ff59ac565fd37305602a3055918679d72b60f834
SHA512 767d6289362bcc2fcf651aeccfcb6a76e1763fcf3f73005fb5d486ac82f413f6b7bb5fbc1c5e1ab62f23473f497f24ae4f1121329571fb1029c15c641fd41285
SSDEEP 49152:dnDDmKiMNItfGp+0IxVA3ZK+hKfiSdyZ8m0gkfXQXQKqQYP:xXmIWd21nscKFyym0gkf0BqQYP
TLSH
T1A7B533227BFDD140E13CFEF3EA4539B3EAA1A11F5251945CE771480499B0ADE29EC839
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

inv_3860_734e06033606cb6a_Web Data

Path C:\Users\Admin\AppData\Local\Temp\inv_3860_734e06033606cb6a_Web Data
Size 138KB
SHA256 c6a8cae9fe7cd0c2c09301e7241b4a6fa28008042e7cb9f2851dfc37211fe5fe
MD5 81ac93f4e2091cb53b5dda013b901690
SHA1 3502890a409819d234ea3c67729cf1e11e9863c6
SHA512 9551620cbddfe45dee39197ff64f913ef89f89c95269b22cd0347893f32a4c3d27375e5f548be525585770928a9b17cece08710e0ca7b4ddd35f620846b8978e
SSDEEP 384:zeuvBnhJsueMEGvIW1DcP2O921lmVumd6n27:FnbZeMrv/hGt921/n27
TLSH
T1C5D3974B3A743002EDE59A721CE050BB5E3C716D4F55A5D428B620688EF2963B23D4FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_upcbpmzd.0wc.psm1

Path C:\Windows\SystemTemp\__PSScriptPolicyTest_upcbpmzd.0wc.psm1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

inv_1948_19e71918b6ecd6f7_Login Data

Path C:\Windows\Temp\inv_1948_19e71918b6ecd6f7_Login Data
Size 40KB
SHA256 06aeb2f9c1ee642348c091fb27541c143545354c273055ce30832e0f61aedf81
MD5 ba979c77c714b67908bc582ec373c723
SHA1 ff6b59b47b8d3ad488eaa7a4b0040a9a93eb19fe
SHA512 fc6b860dcb9e00c6ab7aa72555fb17921bbb8b1276acf0ab5fcb20b5f2dbd4bf71946c5c4fcfc46310f8de29491a63e46d43805070d19f290070f60077f80b01
SSDEEP 96:wDaCn8MouB6w9fUP8iZqmvJKLPeymwil:wDaG7Iw9f/iSi
TLSH
T16103440F2E682801C8B94632BCF124E62E7DA03E4F13EED12CB504659D75C52B52E5EF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

inv_1948_4cdde8f9f5eecc0d_Cookies

Path C:\Windows\Temp\inv_1948_4cdde8f9f5eecc0d_Cookies
Size 20KB
SHA256 2ade7ad8f15eccb025798893f007bc3a04679504411bbad75e4d1f35cf47a65e
MD5 40c4021f7a23fc1b361904d0519eb714
SHA1 eb811f03ded3cf26dc320980307be2b2f9335df5
SHA512 6cfd57cdb92272641c9ad007872cf25c11579c5bfd44935b988559b5e0cca1f4eff976265ff2c2b002f5176af6c8c21961f58e8fb108fcedf4370f9d640186ff
SSDEEP 24:TLf91kweka6cLbXYFpFNYba5+6UwcQ8PAl5fB:T79aw/aHLopFMavU1iB
TLSH
T1B392AD8E1F343620C0F44B33F9C249972E7C212C93637A89EE5410F3DD965ABF50A5A6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1948-97-0x00007FF737BB0000-0x00007FF7381EE000-memory.dmp

Download

memory/1948-73-0x00007FF737BB0000-0x00007FF7381EE000-memory.dmp

Download

memory/1948-87-0x00007FF737BB0000-0x00007FF7381EE000-memory.dmp

Download

memory/1948-85-0x00007FF737BB0000-0x00007FF7381EE000-memory.dmp

Download

memory/1948-81-0x00007FF737BB0000-0x00007FF7381EE000-memory.dmp

Download

memory/1948-89-0x00007FF737BB0000-0x00007FF7381EE000-memory.dmp

Download

memory/1948-77-0x00007FF737BB0000-0x00007FF7381EE000-memory.dmp

Download

memory/1948-79-0x00007FF737BB0000-0x00007FF7381EE000-memory.dmp

Download

memory/1948-22-0x00007FF737BB0000-0x00007FF7381EE000-memory.dmp

Download

memory/2420-26-0x00007FF737BB0000-0x00007FF7381EE000-memory.dmp

Download

memory/2420-74-0x00007FF737BB0000-0x00007FF7381EE000-memory.dmp

Download

memory/2604-33-0x000001F100C00000-0x000001F100C22000-memory.dmp

Download

memory/2604-71-0x000001F119660000-0x000001F119712000-memory.dmp

Download

memory/2604-72-0x000001F1195E0000-0x000001F1195EA000-memory.dmp

Download

memory/2604-70-0x000001F1195F0000-0x000001F11960E000-memory.dmp

Download

memory/2604-67-0x000001F119610000-0x000001F119658000-memory.dmp

Download

memory/3004-35-0x00007FF737BB0000-0x00007FF7381EE000-memory.dmp

Download

memory/3860-17-0x00007FF73F730000-0x00007FF73FD6E000-memory.dmp

Download

memory/3860-0-0x00007FF73F730000-0x00007FF73FD6E000-memory.dmp

Download

memory/3860-5-0x00007FF73F730000-0x00007FF73FD6E000-memory.dmp

Download

memory/3860-27-0x00007FF73F730000-0x00007FF73FD6E000-memory.dmp

Download

memory/4312-23-0x00007FF737BB0000-0x00007FF7381EE000-memory.dmp

Download

memory/4312-6-0x00007FF737BB0000-0x00007FF7381EE000-memory.dmp

Download

memory/4552-29-0x00007FF737BB0000-0x00007FF7381EE000-memory.dmp

Download

memory/4552-76-0x00007FF737BB0000-0x00007FF7381EE000-memory.dmp

Download