Analysis
-
max time kernel
144s -
max time network
158s -
platform
windows7_x64 -
resource
win7-20230621-en -
resource tags
arch:x64arch:x86image:win7-20230621-enlocale:en-usos:windows7-x64system -
submitted
26-06-2023 16:24
Behavioral task
behavioral1
Sample
fae6a8d4f7ef452898971e3aa6b3577d1fb3ee47e97cb90b999691d668e72789.exe
Resource
win7-20230621-en
General
-
Target
fae6a8d4f7ef452898971e3aa6b3577d1fb3ee47e97cb90b999691d668e72789.exe
-
Size
260.4MB
-
MD5
16b349b80ef9e6d6a86e768b4e01fc4c
-
SHA1
7057d56fb70d2009aff15058edd2dfc819b6810b
-
SHA256
fae6a8d4f7ef452898971e3aa6b3577d1fb3ee47e97cb90b999691d668e72789
-
SHA512
de6a4ef3d5c138bd29edd2d361afacd11babb44023e1ad82f8753ff9d7f876c5c74efdfdb0e36abf2967ba6e85d8172640cc492f014e0846ea464277c38cf92e
-
SSDEEP
49152:Tp8I6lkSA+4oCpowncH5P4685fP5q8+58Yu9hn59KZkaQpJUb202F1p8:TX6llA3ohoKkL9zJU
Malware Config
Signatures
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Detects videocard installed 1 TTPs 31 IoCs
Uses WMIC.exe to determine videocard installed.
Processes:
WMIC.exeWMIC.exeWMIC.exeWMIC.exeWMIC.exeWMIC.exeWMIC.exeWMIC.exeWMIC.exeWMIC.exeWMIC.exeWMIC.exeWMIC.exeWMIC.exeWMIC.exeWMIC.exeWMIC.exeWMIC.exeWMIC.exeWMIC.exeWMIC.exeWMIC.exeWMIC.exeWMIC.exeWMIC.exeWMIC.exeWMIC.exeWMIC.exeWMIC.exeWMIC.exeWMIC.exepid process 828 WMIC.exe 1540 WMIC.exe 980 WMIC.exe 1640 WMIC.exe 1748 WMIC.exe 1908 WMIC.exe 1724 WMIC.exe 1816 WMIC.exe 868 WMIC.exe 1032 WMIC.exe 1636 WMIC.exe 1884 WMIC.exe 1620 WMIC.exe 1728 WMIC.exe 1596 WMIC.exe 904 WMIC.exe 708 WMIC.exe 1748 WMIC.exe 2004 WMIC.exe 1188 WMIC.exe 2004 WMIC.exe 1792 WMIC.exe 1124 WMIC.exe 1524 WMIC.exe 1008 WMIC.exe 1348 WMIC.exe 868 WMIC.exe 1188 WMIC.exe 1308 WMIC.exe 1484 WMIC.exe 1972 WMIC.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
wmic.exeWMIC.exedescription pid process Token: SeIncreaseQuotaPrivilege 884 wmic.exe Token: SeSecurityPrivilege 884 wmic.exe Token: SeTakeOwnershipPrivilege 884 wmic.exe Token: SeLoadDriverPrivilege 884 wmic.exe Token: SeSystemProfilePrivilege 884 wmic.exe Token: SeSystemtimePrivilege 884 wmic.exe Token: SeProfSingleProcessPrivilege 884 wmic.exe Token: SeIncBasePriorityPrivilege 884 wmic.exe Token: SeCreatePagefilePrivilege 884 wmic.exe Token: SeBackupPrivilege 884 wmic.exe Token: SeRestorePrivilege 884 wmic.exe Token: SeShutdownPrivilege 884 wmic.exe Token: SeDebugPrivilege 884 wmic.exe Token: SeSystemEnvironmentPrivilege 884 wmic.exe Token: SeRemoteShutdownPrivilege 884 wmic.exe Token: SeUndockPrivilege 884 wmic.exe Token: SeManageVolumePrivilege 884 wmic.exe Token: 33 884 wmic.exe Token: 34 884 wmic.exe Token: 35 884 wmic.exe Token: SeIncreaseQuotaPrivilege 884 wmic.exe Token: SeSecurityPrivilege 884 wmic.exe Token: SeTakeOwnershipPrivilege 884 wmic.exe Token: SeLoadDriverPrivilege 884 wmic.exe Token: SeSystemProfilePrivilege 884 wmic.exe Token: SeSystemtimePrivilege 884 wmic.exe Token: SeProfSingleProcessPrivilege 884 wmic.exe Token: SeIncBasePriorityPrivilege 884 wmic.exe Token: SeCreatePagefilePrivilege 884 wmic.exe Token: SeBackupPrivilege 884 wmic.exe Token: SeRestorePrivilege 884 wmic.exe Token: SeShutdownPrivilege 884 wmic.exe Token: SeDebugPrivilege 884 wmic.exe Token: SeSystemEnvironmentPrivilege 884 wmic.exe Token: SeRemoteShutdownPrivilege 884 wmic.exe Token: SeUndockPrivilege 884 wmic.exe Token: SeManageVolumePrivilege 884 wmic.exe Token: 33 884 wmic.exe Token: 34 884 wmic.exe Token: 35 884 wmic.exe Token: SeIncreaseQuotaPrivilege 1188 WMIC.exe Token: SeSecurityPrivilege 1188 WMIC.exe Token: SeTakeOwnershipPrivilege 1188 WMIC.exe Token: SeLoadDriverPrivilege 1188 WMIC.exe Token: SeSystemProfilePrivilege 1188 WMIC.exe Token: SeSystemtimePrivilege 1188 WMIC.exe Token: SeProfSingleProcessPrivilege 1188 WMIC.exe Token: SeIncBasePriorityPrivilege 1188 WMIC.exe Token: SeCreatePagefilePrivilege 1188 WMIC.exe Token: SeBackupPrivilege 1188 WMIC.exe Token: SeRestorePrivilege 1188 WMIC.exe Token: SeShutdownPrivilege 1188 WMIC.exe Token: SeDebugPrivilege 1188 WMIC.exe Token: SeSystemEnvironmentPrivilege 1188 WMIC.exe Token: SeRemoteShutdownPrivilege 1188 WMIC.exe Token: SeUndockPrivilege 1188 WMIC.exe Token: SeManageVolumePrivilege 1188 WMIC.exe Token: 33 1188 WMIC.exe Token: 34 1188 WMIC.exe Token: 35 1188 WMIC.exe Token: SeIncreaseQuotaPrivilege 1188 WMIC.exe Token: SeSecurityPrivilege 1188 WMIC.exe Token: SeTakeOwnershipPrivilege 1188 WMIC.exe Token: SeLoadDriverPrivilege 1188 WMIC.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
fae6a8d4f7ef452898971e3aa6b3577d1fb3ee47e97cb90b999691d668e72789.execmd.execmd.execmd.execmd.execmd.execmd.exedescription pid process target process PID 1732 wrote to memory of 884 1732 fae6a8d4f7ef452898971e3aa6b3577d1fb3ee47e97cb90b999691d668e72789.exe wmic.exe PID 1732 wrote to memory of 884 1732 fae6a8d4f7ef452898971e3aa6b3577d1fb3ee47e97cb90b999691d668e72789.exe wmic.exe PID 1732 wrote to memory of 884 1732 fae6a8d4f7ef452898971e3aa6b3577d1fb3ee47e97cb90b999691d668e72789.exe wmic.exe PID 1732 wrote to memory of 884 1732 fae6a8d4f7ef452898971e3aa6b3577d1fb3ee47e97cb90b999691d668e72789.exe wmic.exe PID 1732 wrote to memory of 1384 1732 fae6a8d4f7ef452898971e3aa6b3577d1fb3ee47e97cb90b999691d668e72789.exe cmd.exe PID 1732 wrote to memory of 1384 1732 fae6a8d4f7ef452898971e3aa6b3577d1fb3ee47e97cb90b999691d668e72789.exe cmd.exe PID 1732 wrote to memory of 1384 1732 fae6a8d4f7ef452898971e3aa6b3577d1fb3ee47e97cb90b999691d668e72789.exe cmd.exe PID 1732 wrote to memory of 1384 1732 fae6a8d4f7ef452898971e3aa6b3577d1fb3ee47e97cb90b999691d668e72789.exe cmd.exe PID 1384 wrote to memory of 1188 1384 cmd.exe WMIC.exe PID 1384 wrote to memory of 1188 1384 cmd.exe WMIC.exe PID 1384 wrote to memory of 1188 1384 cmd.exe WMIC.exe PID 1384 wrote to memory of 1188 1384 cmd.exe WMIC.exe PID 1732 wrote to memory of 1664 1732 fae6a8d4f7ef452898971e3aa6b3577d1fb3ee47e97cb90b999691d668e72789.exe cmd.exe PID 1732 wrote to memory of 1664 1732 fae6a8d4f7ef452898971e3aa6b3577d1fb3ee47e97cb90b999691d668e72789.exe cmd.exe PID 1732 wrote to memory of 1664 1732 fae6a8d4f7ef452898971e3aa6b3577d1fb3ee47e97cb90b999691d668e72789.exe cmd.exe PID 1732 wrote to memory of 1664 1732 fae6a8d4f7ef452898971e3aa6b3577d1fb3ee47e97cb90b999691d668e72789.exe cmd.exe PID 1664 wrote to memory of 1648 1664 cmd.exe WMIC.exe PID 1664 wrote to memory of 1648 1664 cmd.exe WMIC.exe PID 1664 wrote to memory of 1648 1664 cmd.exe WMIC.exe PID 1664 wrote to memory of 1648 1664 cmd.exe WMIC.exe PID 1732 wrote to memory of 1916 1732 fae6a8d4f7ef452898971e3aa6b3577d1fb3ee47e97cb90b999691d668e72789.exe wmic.exe PID 1732 wrote to memory of 1916 1732 fae6a8d4f7ef452898971e3aa6b3577d1fb3ee47e97cb90b999691d668e72789.exe wmic.exe PID 1732 wrote to memory of 1916 1732 fae6a8d4f7ef452898971e3aa6b3577d1fb3ee47e97cb90b999691d668e72789.exe wmic.exe PID 1732 wrote to memory of 1916 1732 fae6a8d4f7ef452898971e3aa6b3577d1fb3ee47e97cb90b999691d668e72789.exe wmic.exe PID 1732 wrote to memory of 832 1732 fae6a8d4f7ef452898971e3aa6b3577d1fb3ee47e97cb90b999691d668e72789.exe cmd.exe PID 1732 wrote to memory of 832 1732 fae6a8d4f7ef452898971e3aa6b3577d1fb3ee47e97cb90b999691d668e72789.exe cmd.exe PID 1732 wrote to memory of 832 1732 fae6a8d4f7ef452898971e3aa6b3577d1fb3ee47e97cb90b999691d668e72789.exe cmd.exe PID 1732 wrote to memory of 832 1732 fae6a8d4f7ef452898971e3aa6b3577d1fb3ee47e97cb90b999691d668e72789.exe cmd.exe PID 832 wrote to memory of 1308 832 cmd.exe WMIC.exe PID 832 wrote to memory of 1308 832 cmd.exe WMIC.exe PID 832 wrote to memory of 1308 832 cmd.exe WMIC.exe PID 832 wrote to memory of 1308 832 cmd.exe WMIC.exe PID 1732 wrote to memory of 432 1732 fae6a8d4f7ef452898971e3aa6b3577d1fb3ee47e97cb90b999691d668e72789.exe cmd.exe PID 1732 wrote to memory of 432 1732 fae6a8d4f7ef452898971e3aa6b3577d1fb3ee47e97cb90b999691d668e72789.exe cmd.exe PID 1732 wrote to memory of 432 1732 fae6a8d4f7ef452898971e3aa6b3577d1fb3ee47e97cb90b999691d668e72789.exe cmd.exe PID 1732 wrote to memory of 432 1732 fae6a8d4f7ef452898971e3aa6b3577d1fb3ee47e97cb90b999691d668e72789.exe cmd.exe PID 432 wrote to memory of 2000 432 cmd.exe WMIC.exe PID 432 wrote to memory of 2000 432 cmd.exe WMIC.exe PID 432 wrote to memory of 2000 432 cmd.exe WMIC.exe PID 432 wrote to memory of 2000 432 cmd.exe WMIC.exe PID 1732 wrote to memory of 1372 1732 fae6a8d4f7ef452898971e3aa6b3577d1fb3ee47e97cb90b999691d668e72789.exe wmic.exe PID 1732 wrote to memory of 1372 1732 fae6a8d4f7ef452898971e3aa6b3577d1fb3ee47e97cb90b999691d668e72789.exe wmic.exe PID 1732 wrote to memory of 1372 1732 fae6a8d4f7ef452898971e3aa6b3577d1fb3ee47e97cb90b999691d668e72789.exe wmic.exe PID 1732 wrote to memory of 1372 1732 fae6a8d4f7ef452898971e3aa6b3577d1fb3ee47e97cb90b999691d668e72789.exe wmic.exe PID 1732 wrote to memory of 1888 1732 fae6a8d4f7ef452898971e3aa6b3577d1fb3ee47e97cb90b999691d668e72789.exe cmd.exe PID 1732 wrote to memory of 1888 1732 fae6a8d4f7ef452898971e3aa6b3577d1fb3ee47e97cb90b999691d668e72789.exe cmd.exe PID 1732 wrote to memory of 1888 1732 fae6a8d4f7ef452898971e3aa6b3577d1fb3ee47e97cb90b999691d668e72789.exe cmd.exe PID 1732 wrote to memory of 1888 1732 fae6a8d4f7ef452898971e3aa6b3577d1fb3ee47e97cb90b999691d668e72789.exe cmd.exe PID 1888 wrote to memory of 1620 1888 cmd.exe WMIC.exe PID 1888 wrote to memory of 1620 1888 cmd.exe WMIC.exe PID 1888 wrote to memory of 1620 1888 cmd.exe WMIC.exe PID 1888 wrote to memory of 1620 1888 cmd.exe WMIC.exe PID 1732 wrote to memory of 1504 1732 fae6a8d4f7ef452898971e3aa6b3577d1fb3ee47e97cb90b999691d668e72789.exe cmd.exe PID 1732 wrote to memory of 1504 1732 fae6a8d4f7ef452898971e3aa6b3577d1fb3ee47e97cb90b999691d668e72789.exe cmd.exe PID 1732 wrote to memory of 1504 1732 fae6a8d4f7ef452898971e3aa6b3577d1fb3ee47e97cb90b999691d668e72789.exe cmd.exe PID 1732 wrote to memory of 1504 1732 fae6a8d4f7ef452898971e3aa6b3577d1fb3ee47e97cb90b999691d668e72789.exe cmd.exe PID 1504 wrote to memory of 868 1504 cmd.exe WMIC.exe PID 1504 wrote to memory of 868 1504 cmd.exe WMIC.exe PID 1504 wrote to memory of 868 1504 cmd.exe WMIC.exe PID 1504 wrote to memory of 868 1504 cmd.exe WMIC.exe PID 1732 wrote to memory of 964 1732 fae6a8d4f7ef452898971e3aa6b3577d1fb3ee47e97cb90b999691d668e72789.exe wmic.exe PID 1732 wrote to memory of 964 1732 fae6a8d4f7ef452898971e3aa6b3577d1fb3ee47e97cb90b999691d668e72789.exe wmic.exe PID 1732 wrote to memory of 964 1732 fae6a8d4f7ef452898971e3aa6b3577d1fb3ee47e97cb90b999691d668e72789.exe wmic.exe PID 1732 wrote to memory of 964 1732 fae6a8d4f7ef452898971e3aa6b3577d1fb3ee47e97cb90b999691d668e72789.exe wmic.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\fae6a8d4f7ef452898971e3aa6b3577d1fb3ee47e97cb90b999691d668e72789.exe"C:\Users\Admin\AppData\Local\Temp\fae6a8d4f7ef452898971e3aa6b3577d1fb3ee47e97cb90b999691d668e72789.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic os get Caption2⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.execmd /C "wmic path win32_VideoController get name"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Wbem\WMIC.exewmic path win32_VideoController get name3⤵
- Detects videocard installed
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.execmd /C "wmic cpu get name"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Wbem\WMIC.exewmic cpu get name3⤵
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic os get Caption2⤵
-
C:\Windows\SysWOW64\cmd.execmd /C "wmic path win32_VideoController get name"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Wbem\WMIC.exewmic path win32_VideoController get name3⤵
- Detects videocard installed
-
C:\Windows\SysWOW64\cmd.execmd /C "wmic cpu get name"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Wbem\WMIC.exewmic cpu get name3⤵
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic os get Caption2⤵
-
C:\Windows\SysWOW64\cmd.execmd /C "wmic path win32_VideoController get name"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Wbem\WMIC.exewmic path win32_VideoController get name3⤵
- Detects videocard installed
-
C:\Windows\SysWOW64\cmd.execmd /C "wmic cpu get name"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Wbem\WMIC.exewmic cpu get name3⤵
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic os get Caption2⤵
-
C:\Windows\SysWOW64\cmd.execmd /C "wmic path win32_VideoController get name"2⤵
-
C:\Windows\SysWOW64\Wbem\WMIC.exewmic path win32_VideoController get name3⤵
- Detects videocard installed
-
C:\Windows\SysWOW64\cmd.execmd /C "wmic cpu get name"2⤵
-
C:\Windows\SysWOW64\Wbem\WMIC.exewmic cpu get name3⤵
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic os get Caption2⤵
-
C:\Windows\SysWOW64\cmd.execmd /C "wmic path win32_VideoController get name"2⤵
-
C:\Windows\SysWOW64\Wbem\WMIC.exewmic path win32_VideoController get name3⤵
- Detects videocard installed
-
C:\Windows\SysWOW64\cmd.execmd /C "wmic cpu get name"2⤵
-
C:\Windows\SysWOW64\Wbem\WMIC.exewmic cpu get name3⤵
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic os get Caption2⤵
-
C:\Windows\SysWOW64\cmd.execmd /C "wmic path win32_VideoController get name"2⤵
-
C:\Windows\SysWOW64\Wbem\WMIC.exewmic path win32_VideoController get name3⤵
- Detects videocard installed
-
C:\Windows\SysWOW64\cmd.execmd /C "wmic cpu get name"2⤵
-
C:\Windows\SysWOW64\Wbem\WMIC.exewmic cpu get name3⤵
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic os get Caption2⤵
-
C:\Windows\SysWOW64\cmd.execmd /C "wmic path win32_VideoController get name"2⤵
-
C:\Windows\SysWOW64\Wbem\WMIC.exewmic path win32_VideoController get name3⤵
- Detects videocard installed
-
C:\Windows\SysWOW64\cmd.execmd /C "wmic cpu get name"2⤵
-
C:\Windows\SysWOW64\Wbem\WMIC.exewmic cpu get name3⤵
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic os get Caption2⤵
-
C:\Windows\SysWOW64\cmd.execmd /C "wmic path win32_VideoController get name"2⤵
-
C:\Windows\SysWOW64\Wbem\WMIC.exewmic path win32_VideoController get name3⤵
- Detects videocard installed
-
C:\Windows\SysWOW64\cmd.execmd /C "wmic cpu get name"2⤵
-
C:\Windows\SysWOW64\Wbem\WMIC.exewmic cpu get name3⤵
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic os get Caption2⤵
-
C:\Windows\SysWOW64\cmd.execmd /C "wmic path win32_VideoController get name"2⤵
-
C:\Windows\SysWOW64\Wbem\WMIC.exewmic path win32_VideoController get name3⤵
- Detects videocard installed
-
C:\Windows\SysWOW64\cmd.execmd /C "wmic cpu get name"2⤵
-
C:\Windows\SysWOW64\Wbem\WMIC.exewmic cpu get name3⤵
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic os get Caption2⤵
-
C:\Windows\SysWOW64\cmd.execmd /C "wmic path win32_VideoController get name"2⤵
-
C:\Windows\SysWOW64\Wbem\WMIC.exewmic path win32_VideoController get name3⤵
- Detects videocard installed
-
C:\Windows\SysWOW64\cmd.execmd /C "wmic cpu get name"2⤵
-
C:\Windows\SysWOW64\Wbem\WMIC.exewmic cpu get name3⤵
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic os get Caption2⤵
-
C:\Windows\SysWOW64\cmd.execmd /C "wmic path win32_VideoController get name"2⤵
-
C:\Windows\SysWOW64\Wbem\WMIC.exewmic path win32_VideoController get name3⤵
- Detects videocard installed
-
C:\Windows\SysWOW64\cmd.execmd /C "wmic cpu get name"2⤵
-
C:\Windows\SysWOW64\Wbem\WMIC.exewmic cpu get name3⤵
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic os get Caption2⤵
-
C:\Windows\SysWOW64\cmd.execmd /C "wmic path win32_VideoController get name"2⤵
-
C:\Windows\SysWOW64\Wbem\WMIC.exewmic path win32_VideoController get name3⤵
- Detects videocard installed
-
C:\Windows\SysWOW64\cmd.execmd /C "wmic cpu get name"2⤵
-
C:\Windows\SysWOW64\Wbem\WMIC.exewmic cpu get name3⤵
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic os get Caption2⤵
-
C:\Windows\SysWOW64\cmd.execmd /C "wmic path win32_VideoController get name"2⤵
-
C:\Windows\SysWOW64\Wbem\WMIC.exewmic path win32_VideoController get name3⤵
- Detects videocard installed
-
C:\Windows\SysWOW64\cmd.execmd /C "wmic cpu get name"2⤵
-
C:\Windows\SysWOW64\Wbem\WMIC.exewmic cpu get name3⤵
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic os get Caption2⤵
-
C:\Windows\SysWOW64\cmd.execmd /C "wmic path win32_VideoController get name"2⤵
-
C:\Windows\SysWOW64\Wbem\WMIC.exewmic path win32_VideoController get name3⤵
- Detects videocard installed
-
C:\Windows\SysWOW64\cmd.execmd /C "wmic cpu get name"2⤵
-
C:\Windows\SysWOW64\Wbem\WMIC.exewmic cpu get name3⤵
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic os get Caption2⤵
-
C:\Windows\SysWOW64\cmd.execmd /C "wmic path win32_VideoController get name"2⤵
-
C:\Windows\SysWOW64\Wbem\WMIC.exewmic path win32_VideoController get name3⤵
- Detects videocard installed
-
C:\Windows\SysWOW64\cmd.execmd /C "wmic cpu get name"2⤵
-
C:\Windows\SysWOW64\Wbem\WMIC.exewmic cpu get name3⤵
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic os get Caption2⤵
-
C:\Windows\SysWOW64\cmd.execmd /C "wmic path win32_VideoController get name"2⤵
-
C:\Windows\SysWOW64\Wbem\WMIC.exewmic path win32_VideoController get name3⤵
- Detects videocard installed
-
C:\Windows\SysWOW64\cmd.execmd /C "wmic cpu get name"2⤵
-
C:\Windows\SysWOW64\Wbem\WMIC.exewmic cpu get name3⤵
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic os get Caption2⤵
-
C:\Windows\SysWOW64\cmd.execmd /C "wmic path win32_VideoController get name"2⤵
-
C:\Windows\SysWOW64\Wbem\WMIC.exewmic path win32_VideoController get name3⤵
- Detects videocard installed
-
C:\Windows\SysWOW64\cmd.execmd /C "wmic cpu get name"2⤵
-
C:\Windows\SysWOW64\Wbem\WMIC.exewmic cpu get name3⤵
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic os get Caption2⤵
-
C:\Windows\SysWOW64\cmd.execmd /C "wmic path win32_VideoController get name"2⤵
-
C:\Windows\SysWOW64\Wbem\WMIC.exewmic path win32_VideoController get name3⤵
- Detects videocard installed
-
C:\Windows\SysWOW64\cmd.execmd /C "wmic cpu get name"2⤵
-
C:\Windows\SysWOW64\Wbem\WMIC.exewmic cpu get name3⤵
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic os get Caption2⤵
-
C:\Windows\SysWOW64\cmd.execmd /C "wmic path win32_VideoController get name"2⤵
-
C:\Windows\SysWOW64\Wbem\WMIC.exewmic path win32_VideoController get name3⤵
- Detects videocard installed
-
C:\Windows\SysWOW64\cmd.execmd /C "wmic cpu get name"2⤵
-
C:\Windows\SysWOW64\Wbem\WMIC.exewmic cpu get name3⤵
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic os get Caption2⤵
-
C:\Windows\SysWOW64\cmd.execmd /C "wmic path win32_VideoController get name"2⤵
-
C:\Windows\SysWOW64\Wbem\WMIC.exewmic path win32_VideoController get name3⤵
- Detects videocard installed
-
C:\Windows\SysWOW64\cmd.execmd /C "wmic cpu get name"2⤵
-
C:\Windows\SysWOW64\Wbem\WMIC.exewmic cpu get name3⤵
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic os get Caption2⤵
-
C:\Windows\SysWOW64\cmd.execmd /C "wmic path win32_VideoController get name"2⤵
-
C:\Windows\SysWOW64\Wbem\WMIC.exewmic path win32_VideoController get name3⤵
- Detects videocard installed
-
C:\Windows\SysWOW64\cmd.execmd /C "wmic cpu get name"2⤵
-
C:\Windows\SysWOW64\Wbem\WMIC.exewmic cpu get name3⤵
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic os get Caption2⤵
-
C:\Windows\SysWOW64\cmd.execmd /C "wmic path win32_VideoController get name"2⤵
-
C:\Windows\SysWOW64\Wbem\WMIC.exewmic path win32_VideoController get name3⤵
- Detects videocard installed
-
C:\Windows\SysWOW64\cmd.execmd /C "wmic cpu get name"2⤵
-
C:\Windows\SysWOW64\Wbem\WMIC.exewmic cpu get name3⤵
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic os get Caption2⤵
-
C:\Windows\SysWOW64\cmd.execmd /C "wmic path win32_VideoController get name"2⤵
-
C:\Windows\SysWOW64\Wbem\WMIC.exewmic path win32_VideoController get name3⤵
- Detects videocard installed
-
C:\Windows\SysWOW64\cmd.execmd /C "wmic cpu get name"2⤵
-
C:\Windows\SysWOW64\Wbem\WMIC.exewmic cpu get name3⤵
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic os get Caption2⤵
-
C:\Windows\SysWOW64\cmd.execmd /C "wmic path win32_VideoController get name"2⤵
-
C:\Windows\SysWOW64\Wbem\WMIC.exewmic path win32_VideoController get name3⤵
- Detects videocard installed
-
C:\Windows\SysWOW64\cmd.execmd /C "wmic cpu get name"2⤵
-
C:\Windows\SysWOW64\Wbem\WMIC.exewmic cpu get name3⤵
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic os get Caption2⤵
-
C:\Windows\SysWOW64\cmd.execmd /C "wmic path win32_VideoController get name"2⤵
-
C:\Windows\SysWOW64\Wbem\WMIC.exewmic path win32_VideoController get name3⤵
- Detects videocard installed
-
C:\Windows\SysWOW64\cmd.execmd /C "wmic cpu get name"2⤵
-
C:\Windows\SysWOW64\Wbem\WMIC.exewmic cpu get name3⤵
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic os get Caption2⤵
-
C:\Windows\SysWOW64\cmd.execmd /C "wmic path win32_VideoController get name"2⤵
-
C:\Windows\SysWOW64\Wbem\WMIC.exewmic path win32_VideoController get name3⤵
- Detects videocard installed
-
C:\Windows\SysWOW64\cmd.execmd /C "wmic cpu get name"2⤵
-
C:\Windows\SysWOW64\Wbem\WMIC.exewmic cpu get name3⤵
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic os get Caption2⤵
-
C:\Windows\SysWOW64\cmd.execmd /C "wmic path win32_VideoController get name"2⤵
-
C:\Windows\SysWOW64\Wbem\WMIC.exewmic path win32_VideoController get name3⤵
- Detects videocard installed
-
C:\Windows\SysWOW64\cmd.execmd /C "wmic cpu get name"2⤵
-
C:\Windows\SysWOW64\Wbem\WMIC.exewmic cpu get name3⤵
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic os get Caption2⤵
-
C:\Windows\SysWOW64\cmd.execmd /C "wmic path win32_VideoController get name"2⤵
-
C:\Windows\SysWOW64\Wbem\WMIC.exewmic path win32_VideoController get name3⤵
- Detects videocard installed
-
C:\Windows\SysWOW64\cmd.execmd /C "wmic cpu get name"2⤵
-
C:\Windows\SysWOW64\Wbem\WMIC.exewmic cpu get name3⤵
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic os get Caption2⤵
-
C:\Windows\SysWOW64\cmd.execmd /C "wmic path win32_VideoController get name"2⤵
-
C:\Windows\SysWOW64\Wbem\WMIC.exewmic path win32_VideoController get name3⤵
- Detects videocard installed
-
C:\Windows\SysWOW64\cmd.execmd /C "wmic cpu get name"2⤵
-
C:\Windows\SysWOW64\Wbem\WMIC.exewmic cpu get name3⤵
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic os get Caption2⤵
-
C:\Windows\SysWOW64\cmd.execmd /C "wmic path win32_VideoController get name"2⤵
-
C:\Windows\SysWOW64\Wbem\WMIC.exewmic path win32_VideoController get name3⤵
- Detects videocard installed
-
C:\Windows\SysWOW64\cmd.execmd /C "wmic cpu get name"2⤵
-
C:\Windows\SysWOW64\Wbem\WMIC.exewmic cpu get name3⤵
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic os get Caption2⤵
-
C:\Windows\SysWOW64\cmd.execmd /C "wmic path win32_VideoController get name"2⤵
-
C:\Windows\SysWOW64\Wbem\WMIC.exewmic path win32_VideoController get name3⤵
- Detects videocard installed
-
C:\Windows\SysWOW64\cmd.execmd /C "wmic cpu get name"2⤵
-
C:\Windows\SysWOW64\Wbem\WMIC.exewmic cpu get name3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\TeMaPEZQleQYhYzRyWJjPjzpfRFEgmotFilesize
88KB
MD5e7957f681be28b0ef56b994b5ea6f168
SHA1e76d14dbe7e87f3a4265edd977fbb5864e562023
SHA256d48935ab05b6d6e9acdb4741478d8469cafcd33bc83f2d105d9255e07da058f8
SHA512095807caf4759ccf42f7f60b0e00bacb2ab8867222aec750cc3e5932b1cca8cb37f4a95dbc5a51e41c5468078da002841a02499a9a34cee0bc31a33bb0dac23b
-
C:\Users\Admin\AppData\Local\Temp\iGLOpbUOpEFilesize
148KB
MD590a1d4b55edf36fa8b4cc6974ed7d4c4
SHA1aba1b8d0e05421e7df5982899f626211c3c4b5c1
SHA2567cf3e9e8619904e72ea6608cc43e9b6c9f8aa2af02476f60c2b3daf33075981c
SHA512ea0838be754e1258c230111900c5937d2b0788f90bbf7c5f82b2ceda7868e50afb86c301f313267eaa912778da45755560b5434885521bf915967a7863922ae2
-
C:\Users\Admin\AppData\Local\Temp\mBTvKSJfjzFilesize
46KB
MD502d2c46697e3714e49f46b680b9a6b83
SHA184f98b56d49f01e9b6b76a4e21accf64fd319140
SHA256522cad95d3fa6ebb3274709b8d09bbb1ca37389d0a924cd29e934a75aa04c6c9
SHA51260348a145bfc71b1e07cb35fa79ab5ff472a3d0a557741ea2d39b3772bc395b86e261bd616f65307ae0d997294e49b5548d32f11e86ef3e2704959ca63da8aac