Analysis
-
max time kernel
150s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20230221-en -
resource tags
arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system -
submitted
13-04-2023 22:30
Behavioral task
behavioral1
Sample
3b63582786a77d6a3428a83b78cf41a9f3b083c2ec05f642d74f2afeb5761595.exe
Resource
win7-20230220-en
General
-
Target
3b63582786a77d6a3428a83b78cf41a9f3b083c2ec05f642d74f2afeb5761595.exe
-
Size
3.0MB
-
MD5
067db51207da1475782a74b8070ddbd9
-
SHA1
e12f1c105fa0c3db06b23de1fd655c3475fdb2e2
-
SHA256
3b63582786a77d6a3428a83b78cf41a9f3b083c2ec05f642d74f2afeb5761595
-
SHA512
da89f185eccc9f235bc6fd9b59365b278418b54691ca8f997035dd80a5d76e356051a7245fc9d80b48040cff1bd664512d4670851dc5dd73d27fdbe6e6a7087b
-
SSDEEP
49152:WOGwaofJU7hJp+PvBpKawpsSNX8IhsAV4k1H:+17K3jSp8ID
Malware Config
Signatures
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
wmic.exeWMIC.exedescription pid process Token: SeIncreaseQuotaPrivilege 4432 wmic.exe Token: SeSecurityPrivilege 4432 wmic.exe Token: SeTakeOwnershipPrivilege 4432 wmic.exe Token: SeLoadDriverPrivilege 4432 wmic.exe Token: SeSystemProfilePrivilege 4432 wmic.exe Token: SeSystemtimePrivilege 4432 wmic.exe Token: SeProfSingleProcessPrivilege 4432 wmic.exe Token: SeIncBasePriorityPrivilege 4432 wmic.exe Token: SeCreatePagefilePrivilege 4432 wmic.exe Token: SeBackupPrivilege 4432 wmic.exe Token: SeRestorePrivilege 4432 wmic.exe Token: SeShutdownPrivilege 4432 wmic.exe Token: SeDebugPrivilege 4432 wmic.exe Token: SeSystemEnvironmentPrivilege 4432 wmic.exe Token: SeRemoteShutdownPrivilege 4432 wmic.exe Token: SeUndockPrivilege 4432 wmic.exe Token: SeManageVolumePrivilege 4432 wmic.exe Token: 33 4432 wmic.exe Token: 34 4432 wmic.exe Token: 35 4432 wmic.exe Token: 36 4432 wmic.exe Token: SeIncreaseQuotaPrivilege 4432 wmic.exe Token: SeSecurityPrivilege 4432 wmic.exe Token: SeTakeOwnershipPrivilege 4432 wmic.exe Token: SeLoadDriverPrivilege 4432 wmic.exe Token: SeSystemProfilePrivilege 4432 wmic.exe Token: SeSystemtimePrivilege 4432 wmic.exe Token: SeProfSingleProcessPrivilege 4432 wmic.exe Token: SeIncBasePriorityPrivilege 4432 wmic.exe Token: SeCreatePagefilePrivilege 4432 wmic.exe Token: SeBackupPrivilege 4432 wmic.exe Token: SeRestorePrivilege 4432 wmic.exe Token: SeShutdownPrivilege 4432 wmic.exe Token: SeDebugPrivilege 4432 wmic.exe Token: SeSystemEnvironmentPrivilege 4432 wmic.exe Token: SeRemoteShutdownPrivilege 4432 wmic.exe Token: SeUndockPrivilege 4432 wmic.exe Token: SeManageVolumePrivilege 4432 wmic.exe Token: 33 4432 wmic.exe Token: 34 4432 wmic.exe Token: 35 4432 wmic.exe Token: 36 4432 wmic.exe Token: SeIncreaseQuotaPrivilege 1756 WMIC.exe Token: SeSecurityPrivilege 1756 WMIC.exe Token: SeTakeOwnershipPrivilege 1756 WMIC.exe Token: SeLoadDriverPrivilege 1756 WMIC.exe Token: SeSystemProfilePrivilege 1756 WMIC.exe Token: SeSystemtimePrivilege 1756 WMIC.exe Token: SeProfSingleProcessPrivilege 1756 WMIC.exe Token: SeIncBasePriorityPrivilege 1756 WMIC.exe Token: SeCreatePagefilePrivilege 1756 WMIC.exe Token: SeBackupPrivilege 1756 WMIC.exe Token: SeRestorePrivilege 1756 WMIC.exe Token: SeShutdownPrivilege 1756 WMIC.exe Token: SeDebugPrivilege 1756 WMIC.exe Token: SeSystemEnvironmentPrivilege 1756 WMIC.exe Token: SeRemoteShutdownPrivilege 1756 WMIC.exe Token: SeUndockPrivilege 1756 WMIC.exe Token: SeManageVolumePrivilege 1756 WMIC.exe Token: 33 1756 WMIC.exe Token: 34 1756 WMIC.exe Token: 35 1756 WMIC.exe Token: 36 1756 WMIC.exe Token: SeIncreaseQuotaPrivilege 1756 WMIC.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
3b63582786a77d6a3428a83b78cf41a9f3b083c2ec05f642d74f2afeb5761595.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.exedescription pid process target process PID 4836 wrote to memory of 4432 4836 3b63582786a77d6a3428a83b78cf41a9f3b083c2ec05f642d74f2afeb5761595.exe wmic.exe PID 4836 wrote to memory of 4432 4836 3b63582786a77d6a3428a83b78cf41a9f3b083c2ec05f642d74f2afeb5761595.exe wmic.exe PID 4836 wrote to memory of 960 4836 3b63582786a77d6a3428a83b78cf41a9f3b083c2ec05f642d74f2afeb5761595.exe cmd.exe PID 4836 wrote to memory of 960 4836 3b63582786a77d6a3428a83b78cf41a9f3b083c2ec05f642d74f2afeb5761595.exe cmd.exe PID 960 wrote to memory of 1756 960 cmd.exe WMIC.exe PID 960 wrote to memory of 1756 960 cmd.exe WMIC.exe PID 4836 wrote to memory of 2852 4836 3b63582786a77d6a3428a83b78cf41a9f3b083c2ec05f642d74f2afeb5761595.exe cmd.exe PID 4836 wrote to memory of 2852 4836 3b63582786a77d6a3428a83b78cf41a9f3b083c2ec05f642d74f2afeb5761595.exe cmd.exe PID 2852 wrote to memory of 2456 2852 cmd.exe WMIC.exe PID 2852 wrote to memory of 2456 2852 cmd.exe WMIC.exe PID 4836 wrote to memory of 796 4836 3b63582786a77d6a3428a83b78cf41a9f3b083c2ec05f642d74f2afeb5761595.exe wmic.exe PID 4836 wrote to memory of 796 4836 3b63582786a77d6a3428a83b78cf41a9f3b083c2ec05f642d74f2afeb5761595.exe wmic.exe PID 4836 wrote to memory of 5040 4836 3b63582786a77d6a3428a83b78cf41a9f3b083c2ec05f642d74f2afeb5761595.exe cmd.exe PID 4836 wrote to memory of 5040 4836 3b63582786a77d6a3428a83b78cf41a9f3b083c2ec05f642d74f2afeb5761595.exe cmd.exe PID 5040 wrote to memory of 5068 5040 cmd.exe WMIC.exe PID 5040 wrote to memory of 5068 5040 cmd.exe WMIC.exe PID 4836 wrote to memory of 888 4836 3b63582786a77d6a3428a83b78cf41a9f3b083c2ec05f642d74f2afeb5761595.exe cmd.exe PID 4836 wrote to memory of 888 4836 3b63582786a77d6a3428a83b78cf41a9f3b083c2ec05f642d74f2afeb5761595.exe cmd.exe PID 888 wrote to memory of 4860 888 cmd.exe WMIC.exe PID 888 wrote to memory of 4860 888 cmd.exe WMIC.exe PID 4836 wrote to memory of 1208 4836 3b63582786a77d6a3428a83b78cf41a9f3b083c2ec05f642d74f2afeb5761595.exe wmic.exe PID 4836 wrote to memory of 1208 4836 3b63582786a77d6a3428a83b78cf41a9f3b083c2ec05f642d74f2afeb5761595.exe wmic.exe PID 4836 wrote to memory of 1928 4836 3b63582786a77d6a3428a83b78cf41a9f3b083c2ec05f642d74f2afeb5761595.exe cmd.exe PID 4836 wrote to memory of 1928 4836 3b63582786a77d6a3428a83b78cf41a9f3b083c2ec05f642d74f2afeb5761595.exe cmd.exe PID 1928 wrote to memory of 992 1928 cmd.exe WMIC.exe PID 1928 wrote to memory of 992 1928 cmd.exe WMIC.exe PID 4836 wrote to memory of 4224 4836 3b63582786a77d6a3428a83b78cf41a9f3b083c2ec05f642d74f2afeb5761595.exe cmd.exe PID 4836 wrote to memory of 4224 4836 3b63582786a77d6a3428a83b78cf41a9f3b083c2ec05f642d74f2afeb5761595.exe cmd.exe PID 4224 wrote to memory of 4992 4224 cmd.exe WMIC.exe PID 4224 wrote to memory of 4992 4224 cmd.exe WMIC.exe PID 4836 wrote to memory of 4444 4836 3b63582786a77d6a3428a83b78cf41a9f3b083c2ec05f642d74f2afeb5761595.exe wmic.exe PID 4836 wrote to memory of 4444 4836 3b63582786a77d6a3428a83b78cf41a9f3b083c2ec05f642d74f2afeb5761595.exe wmic.exe PID 4836 wrote to memory of 1124 4836 3b63582786a77d6a3428a83b78cf41a9f3b083c2ec05f642d74f2afeb5761595.exe cmd.exe PID 4836 wrote to memory of 1124 4836 3b63582786a77d6a3428a83b78cf41a9f3b083c2ec05f642d74f2afeb5761595.exe cmd.exe PID 1124 wrote to memory of 1428 1124 cmd.exe WMIC.exe PID 1124 wrote to memory of 1428 1124 cmd.exe WMIC.exe PID 4836 wrote to memory of 1160 4836 3b63582786a77d6a3428a83b78cf41a9f3b083c2ec05f642d74f2afeb5761595.exe cmd.exe PID 4836 wrote to memory of 1160 4836 3b63582786a77d6a3428a83b78cf41a9f3b083c2ec05f642d74f2afeb5761595.exe cmd.exe PID 1160 wrote to memory of 2420 1160 cmd.exe WMIC.exe PID 1160 wrote to memory of 2420 1160 cmd.exe WMIC.exe PID 4836 wrote to memory of 2196 4836 3b63582786a77d6a3428a83b78cf41a9f3b083c2ec05f642d74f2afeb5761595.exe wmic.exe PID 4836 wrote to memory of 2196 4836 3b63582786a77d6a3428a83b78cf41a9f3b083c2ec05f642d74f2afeb5761595.exe wmic.exe PID 4836 wrote to memory of 4400 4836 3b63582786a77d6a3428a83b78cf41a9f3b083c2ec05f642d74f2afeb5761595.exe cmd.exe PID 4836 wrote to memory of 4400 4836 3b63582786a77d6a3428a83b78cf41a9f3b083c2ec05f642d74f2afeb5761595.exe cmd.exe PID 4400 wrote to memory of 1384 4400 cmd.exe WMIC.exe PID 4400 wrote to memory of 1384 4400 cmd.exe WMIC.exe PID 4836 wrote to memory of 2756 4836 3b63582786a77d6a3428a83b78cf41a9f3b083c2ec05f642d74f2afeb5761595.exe cmd.exe PID 4836 wrote to memory of 2756 4836 3b63582786a77d6a3428a83b78cf41a9f3b083c2ec05f642d74f2afeb5761595.exe cmd.exe PID 2756 wrote to memory of 2240 2756 cmd.exe WMIC.exe PID 2756 wrote to memory of 2240 2756 cmd.exe WMIC.exe PID 4836 wrote to memory of 5084 4836 3b63582786a77d6a3428a83b78cf41a9f3b083c2ec05f642d74f2afeb5761595.exe wmic.exe PID 4836 wrote to memory of 5084 4836 3b63582786a77d6a3428a83b78cf41a9f3b083c2ec05f642d74f2afeb5761595.exe wmic.exe PID 4836 wrote to memory of 4312 4836 3b63582786a77d6a3428a83b78cf41a9f3b083c2ec05f642d74f2afeb5761595.exe cmd.exe PID 4836 wrote to memory of 4312 4836 3b63582786a77d6a3428a83b78cf41a9f3b083c2ec05f642d74f2afeb5761595.exe cmd.exe PID 4312 wrote to memory of 1580 4312 cmd.exe WMIC.exe PID 4312 wrote to memory of 1580 4312 cmd.exe WMIC.exe PID 4836 wrote to memory of 3160 4836 3b63582786a77d6a3428a83b78cf41a9f3b083c2ec05f642d74f2afeb5761595.exe cmd.exe PID 4836 wrote to memory of 3160 4836 3b63582786a77d6a3428a83b78cf41a9f3b083c2ec05f642d74f2afeb5761595.exe cmd.exe PID 3160 wrote to memory of 4772 3160 cmd.exe WMIC.exe PID 3160 wrote to memory of 4772 3160 cmd.exe WMIC.exe PID 4836 wrote to memory of 4988 4836 3b63582786a77d6a3428a83b78cf41a9f3b083c2ec05f642d74f2afeb5761595.exe wmic.exe PID 4836 wrote to memory of 4988 4836 3b63582786a77d6a3428a83b78cf41a9f3b083c2ec05f642d74f2afeb5761595.exe wmic.exe PID 4836 wrote to memory of 1220 4836 3b63582786a77d6a3428a83b78cf41a9f3b083c2ec05f642d74f2afeb5761595.exe cmd.exe PID 4836 wrote to memory of 1220 4836 3b63582786a77d6a3428a83b78cf41a9f3b083c2ec05f642d74f2afeb5761595.exe cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\3b63582786a77d6a3428a83b78cf41a9f3b083c2ec05f642d74f2afeb5761595.exe"C:\Users\Admin\AppData\Local\Temp\3b63582786a77d6a3428a83b78cf41a9f3b083c2ec05f642d74f2afeb5761595.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4836 -
C:\Windows\System32\Wbem\wmic.exewmic os get Caption2⤵
- Suspicious use of AdjustPrivilegeToken
PID:4432 -
C:\Windows\system32\cmd.execmd /C "wmic path win32_VideoController get name"2⤵
- Suspicious use of WriteProcessMemory
PID:960 -
C:\Windows\System32\Wbem\WMIC.exewmic path win32_VideoController get name3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1756 -
C:\Windows\system32\cmd.execmd /C "wmic cpu get name"2⤵
- Suspicious use of WriteProcessMemory
PID:2852 -
C:\Windows\System32\Wbem\WMIC.exewmic cpu get name3⤵PID:2456
-
C:\Windows\System32\Wbem\wmic.exewmic os get Caption2⤵PID:796
-
C:\Windows\system32\cmd.execmd /C "wmic path win32_VideoController get name"2⤵
- Suspicious use of WriteProcessMemory
PID:5040 -
C:\Windows\System32\Wbem\WMIC.exewmic path win32_VideoController get name3⤵PID:5068
-
C:\Windows\system32\cmd.execmd /C "wmic cpu get name"2⤵
- Suspicious use of WriteProcessMemory
PID:888 -
C:\Windows\System32\Wbem\WMIC.exewmic cpu get name3⤵PID:4860
-
C:\Windows\System32\Wbem\wmic.exewmic os get Caption2⤵PID:1208
-
C:\Windows\system32\cmd.execmd /C "wmic path win32_VideoController get name"2⤵
- Suspicious use of WriteProcessMemory
PID:1928 -
C:\Windows\System32\Wbem\WMIC.exewmic path win32_VideoController get name3⤵PID:992
-
C:\Windows\system32\cmd.execmd /C "wmic cpu get name"2⤵
- Suspicious use of WriteProcessMemory
PID:4224 -
C:\Windows\System32\Wbem\WMIC.exewmic cpu get name3⤵PID:4992
-
C:\Windows\System32\Wbem\wmic.exewmic os get Caption2⤵PID:4444
-
C:\Windows\system32\cmd.execmd /C "wmic path win32_VideoController get name"2⤵
- Suspicious use of WriteProcessMemory
PID:1124 -
C:\Windows\System32\Wbem\WMIC.exewmic path win32_VideoController get name3⤵PID:1428
-
C:\Windows\system32\cmd.execmd /C "wmic cpu get name"2⤵
- Suspicious use of WriteProcessMemory
PID:1160 -
C:\Windows\System32\Wbem\WMIC.exewmic cpu get name3⤵PID:2420
-
C:\Windows\System32\Wbem\wmic.exewmic os get Caption2⤵PID:2196
-
C:\Windows\system32\cmd.execmd /C "wmic path win32_VideoController get name"2⤵
- Suspicious use of WriteProcessMemory
PID:4400 -
C:\Windows\System32\Wbem\WMIC.exewmic path win32_VideoController get name3⤵PID:1384
-
C:\Windows\system32\cmd.execmd /C "wmic cpu get name"2⤵
- Suspicious use of WriteProcessMemory
PID:2756 -
C:\Windows\System32\Wbem\WMIC.exewmic cpu get name3⤵PID:2240
-
C:\Windows\System32\Wbem\wmic.exewmic os get Caption2⤵PID:5084
-
C:\Windows\system32\cmd.execmd /C "wmic path win32_VideoController get name"2⤵
- Suspicious use of WriteProcessMemory
PID:4312 -
C:\Windows\System32\Wbem\WMIC.exewmic path win32_VideoController get name3⤵PID:1580
-
C:\Windows\system32\cmd.execmd /C "wmic cpu get name"2⤵
- Suspicious use of WriteProcessMemory
PID:3160 -
C:\Windows\System32\Wbem\WMIC.exewmic cpu get name3⤵PID:4772
-
C:\Windows\System32\Wbem\wmic.exewmic os get Caption2⤵PID:4988
-
C:\Windows\system32\cmd.execmd /C "wmic path win32_VideoController get name"2⤵PID:1220
-
C:\Windows\System32\Wbem\WMIC.exewmic path win32_VideoController get name3⤵PID:5040
-
C:\Windows\system32\cmd.execmd /C "wmic cpu get name"2⤵PID:4416
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get name3⤵PID:888
-
C:\Windows\System32\Wbem\wmic.exewmic os get Caption2⤵PID:656
-
C:\Windows\system32\cmd.execmd /C "wmic path win32_VideoController get name"2⤵PID:1968
-
C:\Windows\System32\Wbem\WMIC.exewmic path win32_VideoController get name3⤵PID:2796
-
C:\Windows\system32\cmd.execmd /C "wmic cpu get name"2⤵PID:4224
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get name3⤵PID:4452
-
C:\Windows\System32\Wbem\wmic.exewmic os get Caption2⤵PID:4552
-
C:\Windows\system32\cmd.execmd /C "wmic path win32_VideoController get name"2⤵PID:3948
-
C:\Windows\System32\Wbem\WMIC.exewmic path win32_VideoController get name3⤵PID:1160
-
C:\Windows\system32\cmd.execmd /C "wmic cpu get name"2⤵PID:4448
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get name3⤵PID:2600
-
C:\Windows\System32\Wbem\wmic.exewmic os get Caption2⤵PID:3828
-
C:\Windows\system32\cmd.execmd /C "wmic path win32_VideoController get name"2⤵PID:1000
-
C:\Windows\System32\Wbem\WMIC.exewmic path win32_VideoController get name3⤵PID:936
-
C:\Windows\system32\cmd.execmd /C "wmic cpu get name"2⤵PID:2792
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get name3⤵PID:3664
-
C:\Windows\System32\Wbem\wmic.exewmic os get Caption2⤵PID:3808
-
C:\Windows\system32\cmd.execmd /C "wmic path win32_VideoController get name"2⤵PID:1624
-
C:\Windows\System32\Wbem\WMIC.exewmic path win32_VideoController get name3⤵PID:4272
-
C:\Windows\system32\cmd.execmd /C "wmic cpu get name"2⤵PID:3028
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get name3⤵PID:1084
-
C:\Windows\System32\Wbem\wmic.exewmic os get Caption2⤵PID:3144
-
C:\Windows\system32\cmd.execmd /C "wmic path win32_VideoController get name"2⤵PID:2100
-
C:\Windows\System32\Wbem\WMIC.exewmic path win32_VideoController get name3⤵PID:4972
-
C:\Windows\system32\cmd.execmd /C "wmic cpu get name"2⤵PID:2696
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get name3⤵PID:5000
-
C:\Windows\System32\Wbem\wmic.exewmic os get Caption2⤵PID:488
-
C:\Windows\system32\cmd.execmd /C "wmic path win32_VideoController get name"2⤵PID:3824
-
C:\Windows\System32\Wbem\WMIC.exewmic path win32_VideoController get name3⤵PID:1400
-
C:\Windows\system32\cmd.execmd /C "wmic cpu get name"2⤵PID:3352
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get name3⤵PID:1908
-
C:\Windows\System32\Wbem\wmic.exewmic os get Caption2⤵PID:1968
-
C:\Windows\system32\cmd.execmd /C "wmic path win32_VideoController get name"2⤵PID:3912
-
C:\Windows\System32\Wbem\WMIC.exewmic path win32_VideoController get name3⤵PID:2840
-
C:\Windows\system32\cmd.execmd /C "wmic cpu get name"2⤵PID:1832
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get name3⤵PID:2468
-
C:\Windows\System32\Wbem\wmic.exewmic os get Caption2⤵PID:568
-
C:\Windows\system32\cmd.execmd /C "wmic path win32_VideoController get name"2⤵PID:3340
-
C:\Windows\System32\Wbem\WMIC.exewmic path win32_VideoController get name3⤵PID:4568
-
C:\Windows\system32\cmd.execmd /C "wmic cpu get name"2⤵PID:4140
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get name3⤵PID:1324
-
C:\Windows\System32\Wbem\wmic.exewmic os get Caption2⤵PID:3464
-
C:\Windows\system32\cmd.execmd /C "wmic path win32_VideoController get name"2⤵PID:496
-
C:\Windows\System32\Wbem\WMIC.exewmic path win32_VideoController get name3⤵PID:4400
-
C:\Windows\system32\cmd.execmd /C "wmic cpu get name"2⤵PID:2028
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get name3⤵PID:2580
-
C:\Windows\System32\Wbem\wmic.exewmic os get Caption2⤵PID:3376
-
C:\Windows\system32\cmd.execmd /C "wmic path win32_VideoController get name"2⤵PID:5064
-
C:\Windows\System32\Wbem\WMIC.exewmic path win32_VideoController get name3⤵PID:2460
-
C:\Windows\system32\cmd.execmd /C "wmic cpu get name"2⤵PID:3452
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get name3⤵PID:3804
-
C:\Windows\System32\Wbem\wmic.exewmic os get Caption2⤵PID:796
-
C:\Windows\system32\cmd.execmd /C "wmic path win32_VideoController get name"2⤵PID:5104
-
C:\Windows\System32\Wbem\WMIC.exewmic path win32_VideoController get name3⤵PID:4936
-
C:\Windows\system32\cmd.execmd /C "wmic cpu get name"2⤵PID:2712
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get name3⤵PID:4416
-
C:\Windows\System32\Wbem\wmic.exewmic os get Caption2⤵PID:4788
-
C:\Windows\system32\cmd.execmd /C "wmic path win32_VideoController get name"2⤵PID:3840
-
C:\Windows\System32\Wbem\WMIC.exewmic path win32_VideoController get name3⤵PID:2844
-
C:\Windows\system32\cmd.execmd /C "wmic cpu get name"2⤵PID:2096
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get name3⤵PID:3000
-
C:\Windows\System32\Wbem\wmic.exewmic os get Caption2⤵PID:1540
-
C:\Windows\system32\cmd.execmd /C "wmic path win32_VideoController get name"2⤵PID:3912
-
C:\Windows\System32\Wbem\WMIC.exewmic path win32_VideoController get name3⤵PID:4444
-
C:\Windows\system32\cmd.execmd /C "wmic cpu get name"2⤵PID:1832
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get name3⤵PID:2424
-
C:\Windows\System32\Wbem\wmic.exewmic os get Caption2⤵PID:4584
-
C:\Windows\system32\cmd.execmd /C "wmic path win32_VideoController get name"2⤵PID:484
-
C:\Windows\System32\Wbem\WMIC.exewmic path win32_VideoController get name3⤵PID:1996
-
C:\Windows\system32\cmd.execmd /C "wmic cpu get name"2⤵PID:4320
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get name3⤵PID:3760
-
C:\Windows\System32\Wbem\wmic.exewmic os get Caption2⤵PID:936
-
C:\Windows\system32\cmd.execmd /C "wmic path win32_VideoController get name"2⤵PID:3664
-
C:\Windows\System32\Wbem\WMIC.exewmic path win32_VideoController get name3⤵PID:960
-
C:\Windows\system32\cmd.execmd /C "wmic cpu get name"2⤵PID:3704
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get name3⤵PID:2756
-
C:\Windows\System32\Wbem\wmic.exewmic os get Caption2⤵PID:4984
-
C:\Windows\system32\cmd.execmd /C "wmic path win32_VideoController get name"2⤵PID:4312
-
C:\Windows\System32\Wbem\WMIC.exewmic path win32_VideoController get name3⤵PID:3636
-
C:\Windows\system32\cmd.execmd /C "wmic cpu get name"2⤵PID:3048
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get name3⤵PID:932
-
C:\Windows\System32\Wbem\wmic.exewmic os get Caption2⤵PID:5092
-
C:\Windows\system32\cmd.execmd /C "wmic path win32_VideoController get name"2⤵PID:4056
-
C:\Windows\System32\Wbem\WMIC.exewmic path win32_VideoController get name3⤵PID:1292
-
C:\Windows\system32\cmd.execmd /C "wmic cpu get name"2⤵PID:4640
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get name3⤵PID:1248
-
C:\Windows\System32\Wbem\wmic.exewmic os get Caption2⤵PID:4732
-
C:\Windows\system32\cmd.execmd /C "wmic path win32_VideoController get name"2⤵PID:1488
-
C:\Windows\System32\Wbem\WMIC.exewmic path win32_VideoController get name3⤵PID:1080
-
C:\Windows\system32\cmd.execmd /C "wmic cpu get name"2⤵PID:1852
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get name3⤵PID:3012
-
C:\Windows\System32\Wbem\wmic.exewmic os get Caption2⤵PID:4592
-
C:\Windows\system32\cmd.execmd /C "wmic path win32_VideoController get name"2⤵PID:2796
-
C:\Windows\System32\Wbem\WMIC.exewmic path win32_VideoController get name3⤵PID:3932
-
C:\Windows\system32\cmd.execmd /C "wmic cpu get name"2⤵PID:1680
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get name3⤵PID:1540
-
C:\Windows\System32\Wbem\wmic.exewmic os get Caption2⤵PID:2832
-
C:\Windows\system32\cmd.execmd /C "wmic path win32_VideoController get name"2⤵PID:1172
-
C:\Windows\System32\Wbem\WMIC.exewmic path win32_VideoController get name3⤵PID:3968
-
C:\Windows\system32\cmd.execmd /C "wmic cpu get name"2⤵PID:2608
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get name3⤵PID:4476
-
C:\Windows\System32\Wbem\wmic.exewmic os get Caption2⤵PID:2760
-
C:\Windows\system32\cmd.execmd /C "wmic path win32_VideoController get name"2⤵PID:2000
-
C:\Windows\System32\Wbem\WMIC.exewmic path win32_VideoController get name3⤵PID:4068
-
C:\Windows\system32\cmd.execmd /C "wmic cpu get name"2⤵PID:1000
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get name3⤵PID:2064
-
C:\Windows\System32\Wbem\wmic.exewmic os get Caption2⤵PID:1016
-
C:\Windows\system32\cmd.execmd /C "wmic path win32_VideoController get name"2⤵PID:3704
-
C:\Windows\System32\Wbem\WMIC.exewmic path win32_VideoController get name3⤵PID:2808
-
C:\Windows\system32\cmd.execmd /C "wmic cpu get name"2⤵PID:4980
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get name3⤵PID:3376
-
C:\Windows\System32\Wbem\wmic.exewmic os get Caption2⤵PID:4188
-
C:\Windows\system32\cmd.execmd /C "wmic path win32_VideoController get name"2⤵PID:3048
-
C:\Windows\System32\Wbem\WMIC.exewmic path win32_VideoController get name3⤵PID:4944
-
C:\Windows\system32\cmd.execmd /C "wmic cpu get name"2⤵PID:4408
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get name3⤵PID:4972
-
C:\Windows\System32\Wbem\wmic.exewmic os get Caption2⤵PID:5104
-
C:\Windows\system32\cmd.execmd /C "wmic path win32_VideoController get name"2⤵PID:4232
-
C:\Windows\System32\Wbem\WMIC.exewmic path win32_VideoController get name3⤵PID:4852
-
C:\Windows\system32\cmd.execmd /C "wmic cpu get name"2⤵PID:3844
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get name3⤵PID:3936
-
C:\Windows\System32\Wbem\wmic.exewmic os get Caption2⤵PID:4788
-
C:\Windows\system32\cmd.execmd /C "wmic path win32_VideoController get name"2⤵PID:3228
-
C:\Windows\System32\Wbem\WMIC.exewmic path win32_VideoController get name3⤵PID:4128
-
C:\Windows\system32\cmd.execmd /C "wmic cpu get name"2⤵PID:4872
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get name3⤵PID:4628
-
C:\Windows\System32\Wbem\wmic.exewmic os get Caption2⤵PID:4556
-
C:\Windows\system32\cmd.execmd /C "wmic path win32_VideoController get name"2⤵PID:2840
-
C:\Windows\System32\Wbem\WMIC.exewmic path win32_VideoController get name3⤵PID:2468
-
C:\Windows\system32\cmd.execmd /C "wmic cpu get name"2⤵PID:812
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get name3⤵PID:700
-
C:\Windows\System32\Wbem\wmic.exewmic os get Caption2⤵PID:2220
-
C:\Windows\system32\cmd.execmd /C "wmic path win32_VideoController get name"2⤵PID:4476
-
C:\Windows\System32\Wbem\WMIC.exewmic path win32_VideoController get name3⤵PID:4340
-
C:\Windows\system32\cmd.execmd /C "wmic cpu get name"2⤵PID:4464
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get name3⤵PID:4320
-
C:\Windows\System32\Wbem\wmic.exewmic os get Caption2⤵PID:3300
-
C:\Windows\system32\cmd.execmd /C "wmic path win32_VideoController get name"2⤵PID:2064
-
C:\Windows\System32\Wbem\WMIC.exewmic path win32_VideoController get name3⤵PID:1596
-
C:\Windows\system32\cmd.execmd /C "wmic cpu get name"2⤵PID:868
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get name3⤵PID:1936
-
C:\Windows\System32\Wbem\wmic.exewmic os get Caption2⤵PID:4124
-
C:\Windows\system32\cmd.execmd /C "wmic path win32_VideoController get name"2⤵PID:4980
-
C:\Windows\System32\Wbem\WMIC.exewmic path win32_VideoController get name3⤵PID:2612
-
C:\Windows\system32\cmd.execmd /C "wmic cpu get name"2⤵PID:4572
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get name3⤵PID:1636
-
C:\Windows\System32\Wbem\wmic.exewmic os get Caption2⤵PID:2476
-
C:\Windows\system32\cmd.execmd /C "wmic path win32_VideoController get name"2⤵PID:1536
-
C:\Windows\System32\Wbem\WMIC.exewmic path win32_VideoController get name3⤵PID:4920
-
C:\Windows\system32\cmd.execmd /C "wmic cpu get name"2⤵PID:1220
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get name3⤵PID:4840
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\ZIvaBjMkXVFilesize
20KB
MD5c9ff7748d8fcef4cf84a5501e996a641
SHA102867e5010f62f97ebb0cfb32cb3ede9449fe0c9
SHA2564d3f3194cb1133437aa69bb880c8cbb55ddf06ff61a88ca6c3f1bbfbfd35d988
SHA512d36054499869a8f56ac8547ccd5455f1252c24e17d2b185955390b32da7e2a732ace4e0f30f9493fcc61425a2e31ed623465f998f41af69423ee0e3ed1483a73
-
C:\Users\Admin\AppData\Local\Temp\btZsyMGeuDFilesize
148KB
MD590a1d4b55edf36fa8b4cc6974ed7d4c4
SHA1aba1b8d0e05421e7df5982899f626211c3c4b5c1
SHA2567cf3e9e8619904e72ea6608cc43e9b6c9f8aa2af02476f60c2b3daf33075981c
SHA512ea0838be754e1258c230111900c5937d2b0788f90bbf7c5f82b2ceda7868e50afb86c301f313267eaa912778da45755560b5434885521bf915967a7863922ae2
-
C:\Users\Admin\AppData\Local\Temp\hhjUVRuSqfFilesize
46KB
MD502d2c46697e3714e49f46b680b9a6b83
SHA184f98b56d49f01e9b6b76a4e21accf64fd319140
SHA256522cad95d3fa6ebb3274709b8d09bbb1ca37389d0a924cd29e934a75aa04c6c9
SHA51260348a145bfc71b1e07cb35fa79ab5ff472a3d0a557741ea2d39b3772bc395b86e261bd616f65307ae0d997294e49b5548d32f11e86ef3e2704959ca63da8aac
-
C:\Users\Admin\AppData\Local\Temp\nJObCsNVlgTeMaPEZQleQYhYzRyWJjPjFilesize
71KB
MD546988a922937a39036d6b71e62d0f966
SHA14a997f2a0360274ec7990aac156870a5a7030665
SHA2565954db23a8424f6cb1e933387d0866910c45615f54342aa0f6dd597174393de6
SHA512dd7774668cd24c303e670e7d096794aca67593b8d8a9b3b38aa08c148f67e74c07041f25941465b3ae030bafd76384b4b79d41c1eeebe5bd11d94ab25ef00e9d
-
memory/1968-406-0x00007FFBCC52A000-0x00007FFBCC52B000-memory.dmpFilesize
4KB