Analysis
-
max time kernel
154s -
max time network
158s -
platform
windows10-2004_x64 -
resource
win10v2004-20230621-en -
resource tags
arch:x64arch:x86image:win10v2004-20230621-enlocale:en-usos:windows10-2004-x64system -
submitted
26-06-2023 16:24
Behavioral task
behavioral1
Sample
fae6a8d4f7ef452898971e3aa6b3577d1fb3ee47e97cb90b999691d668e72789.exe
Resource
win7-20230621-en
General
-
Target
fae6a8d4f7ef452898971e3aa6b3577d1fb3ee47e97cb90b999691d668e72789.exe
-
Size
260.4MB
-
MD5
16b349b80ef9e6d6a86e768b4e01fc4c
-
SHA1
7057d56fb70d2009aff15058edd2dfc819b6810b
-
SHA256
fae6a8d4f7ef452898971e3aa6b3577d1fb3ee47e97cb90b999691d668e72789
-
SHA512
de6a4ef3d5c138bd29edd2d361afacd11babb44023e1ad82f8753ff9d7f876c5c74efdfdb0e36abf2967ba6e85d8172640cc492f014e0846ea464277c38cf92e
-
SSDEEP
49152:Tp8I6lkSA+4oCpowncH5P4685fP5q8+58Yu9hn59KZkaQpJUb202F1p8:TX6llA3ohoKkL9zJU
Malware Config
Signatures
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Detects videocard installed 1 TTPs 50 IoCs
Uses WMIC.exe to determine videocard installed.
Processes:
WMIC.exeWMIC.exeWMIC.exeWMIC.exeWMIC.exeWMIC.exeWMIC.exeWMIC.exeWMIC.exeWMIC.exeWMIC.exeWMIC.exeWMIC.exeWMIC.exeWMIC.exeWMIC.exeWMIC.exeWMIC.exeWMIC.exeWMIC.exeWMIC.exeWMIC.exeWMIC.exeWMIC.exeWMIC.exeWMIC.exeWMIC.exeWMIC.exeWMIC.exeWMIC.exeWMIC.exeWMIC.exeWMIC.exeWMIC.exeWMIC.exeWMIC.exeWMIC.exeWMIC.exeWMIC.exeWMIC.exeWMIC.exeWMIC.exeWMIC.exeWMIC.exeWMIC.exeWMIC.exeWMIC.exeWMIC.exeWMIC.exeWMIC.exepid process 1256 WMIC.exe 2596 WMIC.exe 2512 WMIC.exe 4624 WMIC.exe 1500 WMIC.exe 464 WMIC.exe 2752 WMIC.exe 2920 WMIC.exe 3500 WMIC.exe 4604 WMIC.exe 828 WMIC.exe 3268 WMIC.exe 548 WMIC.exe 3720 WMIC.exe 3464 WMIC.exe 1736 WMIC.exe 2168 WMIC.exe 1904 WMIC.exe 2328 WMIC.exe 1796 WMIC.exe 1072 WMIC.exe 3860 WMIC.exe 3276 WMIC.exe 2200 WMIC.exe 1088 WMIC.exe 2696 WMIC.exe 3828 WMIC.exe 4000 WMIC.exe 4464 WMIC.exe 4720 WMIC.exe 2884 WMIC.exe 1364 WMIC.exe 4504 WMIC.exe 2088 WMIC.exe 2216 WMIC.exe 2116 WMIC.exe 1776 WMIC.exe 3244 WMIC.exe 4676 WMIC.exe 3536 WMIC.exe 392 WMIC.exe 2880 WMIC.exe 2296 WMIC.exe 912 WMIC.exe 4512 WMIC.exe 3632 WMIC.exe 1908 WMIC.exe 4448 WMIC.exe 3688 WMIC.exe 732 WMIC.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
wmic.exeWMIC.exedescription pid process Token: SeIncreaseQuotaPrivilege 5068 wmic.exe Token: SeSecurityPrivilege 5068 wmic.exe Token: SeTakeOwnershipPrivilege 5068 wmic.exe Token: SeLoadDriverPrivilege 5068 wmic.exe Token: SeSystemProfilePrivilege 5068 wmic.exe Token: SeSystemtimePrivilege 5068 wmic.exe Token: SeProfSingleProcessPrivilege 5068 wmic.exe Token: SeIncBasePriorityPrivilege 5068 wmic.exe Token: SeCreatePagefilePrivilege 5068 wmic.exe Token: SeBackupPrivilege 5068 wmic.exe Token: SeRestorePrivilege 5068 wmic.exe Token: SeShutdownPrivilege 5068 wmic.exe Token: SeDebugPrivilege 5068 wmic.exe Token: SeSystemEnvironmentPrivilege 5068 wmic.exe Token: SeRemoteShutdownPrivilege 5068 wmic.exe Token: SeUndockPrivilege 5068 wmic.exe Token: SeManageVolumePrivilege 5068 wmic.exe Token: 33 5068 wmic.exe Token: 34 5068 wmic.exe Token: 35 5068 wmic.exe Token: 36 5068 wmic.exe Token: SeIncreaseQuotaPrivilege 5068 wmic.exe Token: SeSecurityPrivilege 5068 wmic.exe Token: SeTakeOwnershipPrivilege 5068 wmic.exe Token: SeLoadDriverPrivilege 5068 wmic.exe Token: SeSystemProfilePrivilege 5068 wmic.exe Token: SeSystemtimePrivilege 5068 wmic.exe Token: SeProfSingleProcessPrivilege 5068 wmic.exe Token: SeIncBasePriorityPrivilege 5068 wmic.exe Token: SeCreatePagefilePrivilege 5068 wmic.exe Token: SeBackupPrivilege 5068 wmic.exe Token: SeRestorePrivilege 5068 wmic.exe Token: SeShutdownPrivilege 5068 wmic.exe Token: SeDebugPrivilege 5068 wmic.exe Token: SeSystemEnvironmentPrivilege 5068 wmic.exe Token: SeRemoteShutdownPrivilege 5068 wmic.exe Token: SeUndockPrivilege 5068 wmic.exe Token: SeManageVolumePrivilege 5068 wmic.exe Token: 33 5068 wmic.exe Token: 34 5068 wmic.exe Token: 35 5068 wmic.exe Token: 36 5068 wmic.exe Token: SeIncreaseQuotaPrivilege 392 WMIC.exe Token: SeSecurityPrivilege 392 WMIC.exe Token: SeTakeOwnershipPrivilege 392 WMIC.exe Token: SeLoadDriverPrivilege 392 WMIC.exe Token: SeSystemProfilePrivilege 392 WMIC.exe Token: SeSystemtimePrivilege 392 WMIC.exe Token: SeProfSingleProcessPrivilege 392 WMIC.exe Token: SeIncBasePriorityPrivilege 392 WMIC.exe Token: SeCreatePagefilePrivilege 392 WMIC.exe Token: SeBackupPrivilege 392 WMIC.exe Token: SeRestorePrivilege 392 WMIC.exe Token: SeShutdownPrivilege 392 WMIC.exe Token: SeDebugPrivilege 392 WMIC.exe Token: SeSystemEnvironmentPrivilege 392 WMIC.exe Token: SeRemoteShutdownPrivilege 392 WMIC.exe Token: SeUndockPrivilege 392 WMIC.exe Token: SeManageVolumePrivilege 392 WMIC.exe Token: 33 392 WMIC.exe Token: 34 392 WMIC.exe Token: 35 392 WMIC.exe Token: 36 392 WMIC.exe Token: SeIncreaseQuotaPrivilege 392 WMIC.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
fae6a8d4f7ef452898971e3aa6b3577d1fb3ee47e97cb90b999691d668e72789.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.exedescription pid process target process PID 1264 wrote to memory of 5068 1264 fae6a8d4f7ef452898971e3aa6b3577d1fb3ee47e97cb90b999691d668e72789.exe wmic.exe PID 1264 wrote to memory of 5068 1264 fae6a8d4f7ef452898971e3aa6b3577d1fb3ee47e97cb90b999691d668e72789.exe wmic.exe PID 1264 wrote to memory of 5068 1264 fae6a8d4f7ef452898971e3aa6b3577d1fb3ee47e97cb90b999691d668e72789.exe wmic.exe PID 1264 wrote to memory of 732 1264 fae6a8d4f7ef452898971e3aa6b3577d1fb3ee47e97cb90b999691d668e72789.exe cmd.exe PID 1264 wrote to memory of 732 1264 fae6a8d4f7ef452898971e3aa6b3577d1fb3ee47e97cb90b999691d668e72789.exe cmd.exe PID 1264 wrote to memory of 732 1264 fae6a8d4f7ef452898971e3aa6b3577d1fb3ee47e97cb90b999691d668e72789.exe cmd.exe PID 732 wrote to memory of 392 732 cmd.exe WMIC.exe PID 732 wrote to memory of 392 732 cmd.exe WMIC.exe PID 732 wrote to memory of 392 732 cmd.exe WMIC.exe PID 1264 wrote to memory of 1796 1264 fae6a8d4f7ef452898971e3aa6b3577d1fb3ee47e97cb90b999691d668e72789.exe cmd.exe PID 1264 wrote to memory of 1796 1264 fae6a8d4f7ef452898971e3aa6b3577d1fb3ee47e97cb90b999691d668e72789.exe cmd.exe PID 1264 wrote to memory of 1796 1264 fae6a8d4f7ef452898971e3aa6b3577d1fb3ee47e97cb90b999691d668e72789.exe cmd.exe PID 1796 wrote to memory of 4080 1796 cmd.exe WMIC.exe PID 1796 wrote to memory of 4080 1796 cmd.exe WMIC.exe PID 1796 wrote to memory of 4080 1796 cmd.exe WMIC.exe PID 1264 wrote to memory of 3628 1264 fae6a8d4f7ef452898971e3aa6b3577d1fb3ee47e97cb90b999691d668e72789.exe wmic.exe PID 1264 wrote to memory of 3628 1264 fae6a8d4f7ef452898971e3aa6b3577d1fb3ee47e97cb90b999691d668e72789.exe wmic.exe PID 1264 wrote to memory of 3628 1264 fae6a8d4f7ef452898971e3aa6b3577d1fb3ee47e97cb90b999691d668e72789.exe wmic.exe PID 1264 wrote to memory of 3936 1264 fae6a8d4f7ef452898971e3aa6b3577d1fb3ee47e97cb90b999691d668e72789.exe cmd.exe PID 1264 wrote to memory of 3936 1264 fae6a8d4f7ef452898971e3aa6b3577d1fb3ee47e97cb90b999691d668e72789.exe cmd.exe PID 1264 wrote to memory of 3936 1264 fae6a8d4f7ef452898971e3aa6b3577d1fb3ee47e97cb90b999691d668e72789.exe cmd.exe PID 3936 wrote to memory of 4504 3936 cmd.exe WMIC.exe PID 3936 wrote to memory of 4504 3936 cmd.exe WMIC.exe PID 3936 wrote to memory of 4504 3936 cmd.exe WMIC.exe PID 1264 wrote to memory of 1752 1264 fae6a8d4f7ef452898971e3aa6b3577d1fb3ee47e97cb90b999691d668e72789.exe cmd.exe PID 1264 wrote to memory of 1752 1264 fae6a8d4f7ef452898971e3aa6b3577d1fb3ee47e97cb90b999691d668e72789.exe cmd.exe PID 1264 wrote to memory of 1752 1264 fae6a8d4f7ef452898971e3aa6b3577d1fb3ee47e97cb90b999691d668e72789.exe cmd.exe PID 1752 wrote to memory of 4508 1752 cmd.exe WMIC.exe PID 1752 wrote to memory of 4508 1752 cmd.exe WMIC.exe PID 1752 wrote to memory of 4508 1752 cmd.exe WMIC.exe PID 1264 wrote to memory of 1488 1264 fae6a8d4f7ef452898971e3aa6b3577d1fb3ee47e97cb90b999691d668e72789.exe wmic.exe PID 1264 wrote to memory of 1488 1264 fae6a8d4f7ef452898971e3aa6b3577d1fb3ee47e97cb90b999691d668e72789.exe wmic.exe PID 1264 wrote to memory of 1488 1264 fae6a8d4f7ef452898971e3aa6b3577d1fb3ee47e97cb90b999691d668e72789.exe wmic.exe PID 1264 wrote to memory of 3892 1264 fae6a8d4f7ef452898971e3aa6b3577d1fb3ee47e97cb90b999691d668e72789.exe cmd.exe PID 1264 wrote to memory of 3892 1264 fae6a8d4f7ef452898971e3aa6b3577d1fb3ee47e97cb90b999691d668e72789.exe cmd.exe PID 1264 wrote to memory of 3892 1264 fae6a8d4f7ef452898971e3aa6b3577d1fb3ee47e97cb90b999691d668e72789.exe cmd.exe PID 3892 wrote to memory of 1500 3892 cmd.exe WMIC.exe PID 3892 wrote to memory of 1500 3892 cmd.exe WMIC.exe PID 3892 wrote to memory of 1500 3892 cmd.exe WMIC.exe PID 1264 wrote to memory of 680 1264 fae6a8d4f7ef452898971e3aa6b3577d1fb3ee47e97cb90b999691d668e72789.exe cmd.exe PID 1264 wrote to memory of 680 1264 fae6a8d4f7ef452898971e3aa6b3577d1fb3ee47e97cb90b999691d668e72789.exe cmd.exe PID 1264 wrote to memory of 680 1264 fae6a8d4f7ef452898971e3aa6b3577d1fb3ee47e97cb90b999691d668e72789.exe cmd.exe PID 680 wrote to memory of 3524 680 cmd.exe WMIC.exe PID 680 wrote to memory of 3524 680 cmd.exe WMIC.exe PID 680 wrote to memory of 3524 680 cmd.exe WMIC.exe PID 1264 wrote to memory of 1772 1264 fae6a8d4f7ef452898971e3aa6b3577d1fb3ee47e97cb90b999691d668e72789.exe wmic.exe PID 1264 wrote to memory of 1772 1264 fae6a8d4f7ef452898971e3aa6b3577d1fb3ee47e97cb90b999691d668e72789.exe wmic.exe PID 1264 wrote to memory of 1772 1264 fae6a8d4f7ef452898971e3aa6b3577d1fb3ee47e97cb90b999691d668e72789.exe wmic.exe PID 1264 wrote to memory of 4548 1264 fae6a8d4f7ef452898971e3aa6b3577d1fb3ee47e97cb90b999691d668e72789.exe cmd.exe PID 1264 wrote to memory of 4548 1264 fae6a8d4f7ef452898971e3aa6b3577d1fb3ee47e97cb90b999691d668e72789.exe cmd.exe PID 1264 wrote to memory of 4548 1264 fae6a8d4f7ef452898971e3aa6b3577d1fb3ee47e97cb90b999691d668e72789.exe cmd.exe PID 4548 wrote to memory of 464 4548 cmd.exe WMIC.exe PID 4548 wrote to memory of 464 4548 cmd.exe WMIC.exe PID 4548 wrote to memory of 464 4548 cmd.exe WMIC.exe PID 1264 wrote to memory of 4108 1264 fae6a8d4f7ef452898971e3aa6b3577d1fb3ee47e97cb90b999691d668e72789.exe cmd.exe PID 1264 wrote to memory of 4108 1264 fae6a8d4f7ef452898971e3aa6b3577d1fb3ee47e97cb90b999691d668e72789.exe cmd.exe PID 1264 wrote to memory of 4108 1264 fae6a8d4f7ef452898971e3aa6b3577d1fb3ee47e97cb90b999691d668e72789.exe cmd.exe PID 4108 wrote to memory of 1676 4108 cmd.exe WMIC.exe PID 4108 wrote to memory of 1676 4108 cmd.exe WMIC.exe PID 4108 wrote to memory of 1676 4108 cmd.exe WMIC.exe PID 1264 wrote to memory of 1348 1264 fae6a8d4f7ef452898971e3aa6b3577d1fb3ee47e97cb90b999691d668e72789.exe wmic.exe PID 1264 wrote to memory of 1348 1264 fae6a8d4f7ef452898971e3aa6b3577d1fb3ee47e97cb90b999691d668e72789.exe wmic.exe PID 1264 wrote to memory of 1348 1264 fae6a8d4f7ef452898971e3aa6b3577d1fb3ee47e97cb90b999691d668e72789.exe wmic.exe PID 1264 wrote to memory of 4664 1264 fae6a8d4f7ef452898971e3aa6b3577d1fb3ee47e97cb90b999691d668e72789.exe cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\fae6a8d4f7ef452898971e3aa6b3577d1fb3ee47e97cb90b999691d668e72789.exe"C:\Users\Admin\AppData\Local\Temp\fae6a8d4f7ef452898971e3aa6b3577d1fb3ee47e97cb90b999691d668e72789.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic os get Caption2⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.execmd /C "wmic path win32_VideoController get name"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Wbem\WMIC.exewmic path win32_VideoController get name3⤵
- Detects videocard installed
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.execmd /C "wmic cpu get name"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Wbem\WMIC.exewmic cpu get name3⤵
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic os get Caption2⤵
-
C:\Windows\SysWOW64\cmd.execmd /C "wmic path win32_VideoController get name"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Wbem\WMIC.exewmic path win32_VideoController get name3⤵
- Detects videocard installed
-
C:\Windows\SysWOW64\cmd.execmd /C "wmic cpu get name"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Wbem\WMIC.exewmic cpu get name3⤵
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic os get Caption2⤵
-
C:\Windows\SysWOW64\cmd.execmd /C "wmic path win32_VideoController get name"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Wbem\WMIC.exewmic path win32_VideoController get name3⤵
- Detects videocard installed
-
C:\Windows\SysWOW64\cmd.execmd /C "wmic cpu get name"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Wbem\WMIC.exewmic cpu get name3⤵
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic os get Caption2⤵
-
C:\Windows\SysWOW64\cmd.execmd /C "wmic path win32_VideoController get name"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Wbem\WMIC.exewmic path win32_VideoController get name3⤵
- Detects videocard installed
-
C:\Windows\SysWOW64\cmd.execmd /C "wmic cpu get name"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Wbem\WMIC.exewmic cpu get name3⤵
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic os get Caption2⤵
-
C:\Windows\SysWOW64\cmd.execmd /C "wmic path win32_VideoController get name"2⤵
-
C:\Windows\SysWOW64\Wbem\WMIC.exewmic path win32_VideoController get name3⤵
- Detects videocard installed
-
C:\Windows\SysWOW64\cmd.execmd /C "wmic cpu get name"2⤵
-
C:\Windows\SysWOW64\Wbem\WMIC.exewmic cpu get name3⤵
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic os get Caption2⤵
-
C:\Windows\SysWOW64\cmd.execmd /C "wmic path win32_VideoController get name"2⤵
-
C:\Windows\SysWOW64\Wbem\WMIC.exewmic path win32_VideoController get name3⤵
- Detects videocard installed
-
C:\Windows\SysWOW64\cmd.execmd /C "wmic cpu get name"2⤵
-
C:\Windows\SysWOW64\Wbem\WMIC.exewmic cpu get name3⤵
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic os get Caption2⤵
-
C:\Windows\SysWOW64\cmd.execmd /C "wmic path win32_VideoController get name"2⤵
-
C:\Windows\SysWOW64\Wbem\WMIC.exewmic path win32_VideoController get name3⤵
- Detects videocard installed
-
C:\Windows\SysWOW64\cmd.execmd /C "wmic cpu get name"2⤵
-
C:\Windows\SysWOW64\Wbem\WMIC.exewmic cpu get name3⤵
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic os get Caption2⤵
-
C:\Windows\SysWOW64\cmd.execmd /C "wmic path win32_VideoController get name"2⤵
-
C:\Windows\SysWOW64\Wbem\WMIC.exewmic path win32_VideoController get name3⤵
- Detects videocard installed
-
C:\Windows\SysWOW64\cmd.execmd /C "wmic cpu get name"2⤵
-
C:\Windows\SysWOW64\Wbem\WMIC.exewmic cpu get name3⤵
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic os get Caption2⤵
-
C:\Windows\SysWOW64\cmd.execmd /C "wmic path win32_VideoController get name"2⤵
-
C:\Windows\SysWOW64\Wbem\WMIC.exewmic path win32_VideoController get name3⤵
- Detects videocard installed
-
C:\Windows\SysWOW64\cmd.execmd /C "wmic cpu get name"2⤵
-
C:\Windows\SysWOW64\Wbem\WMIC.exewmic cpu get name3⤵
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic os get Caption2⤵
-
C:\Windows\SysWOW64\cmd.execmd /C "wmic path win32_VideoController get name"2⤵
-
C:\Windows\SysWOW64\Wbem\WMIC.exewmic path win32_VideoController get name3⤵
- Detects videocard installed
-
C:\Windows\SysWOW64\cmd.execmd /C "wmic cpu get name"2⤵
-
C:\Windows\SysWOW64\Wbem\WMIC.exewmic cpu get name3⤵
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic os get Caption2⤵
-
C:\Windows\SysWOW64\cmd.execmd /C "wmic path win32_VideoController get name"2⤵
-
C:\Windows\SysWOW64\Wbem\WMIC.exewmic path win32_VideoController get name3⤵
- Detects videocard installed
-
C:\Windows\SysWOW64\cmd.execmd /C "wmic cpu get name"2⤵
-
C:\Windows\SysWOW64\Wbem\WMIC.exewmic cpu get name3⤵
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic os get Caption2⤵
-
C:\Windows\SysWOW64\cmd.execmd /C "wmic path win32_VideoController get name"2⤵
-
C:\Windows\SysWOW64\Wbem\WMIC.exewmic path win32_VideoController get name3⤵
- Detects videocard installed
-
C:\Windows\SysWOW64\cmd.execmd /C "wmic cpu get name"2⤵
-
C:\Windows\SysWOW64\Wbem\WMIC.exewmic cpu get name3⤵
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic os get Caption2⤵
-
C:\Windows\SysWOW64\cmd.execmd /C "wmic path win32_VideoController get name"2⤵
-
C:\Windows\SysWOW64\Wbem\WMIC.exewmic path win32_VideoController get name3⤵
- Detects videocard installed
-
C:\Windows\SysWOW64\cmd.execmd /C "wmic cpu get name"2⤵
-
C:\Windows\SysWOW64\Wbem\WMIC.exewmic cpu get name3⤵
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic os get Caption2⤵
-
C:\Windows\SysWOW64\cmd.execmd /C "wmic path win32_VideoController get name"2⤵
-
C:\Windows\SysWOW64\Wbem\WMIC.exewmic path win32_VideoController get name3⤵
- Detects videocard installed
-
C:\Windows\SysWOW64\cmd.execmd /C "wmic cpu get name"2⤵
-
C:\Windows\SysWOW64\Wbem\WMIC.exewmic cpu get name3⤵
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic os get Caption2⤵
-
C:\Windows\SysWOW64\cmd.execmd /C "wmic path win32_VideoController get name"2⤵
-
C:\Windows\SysWOW64\Wbem\WMIC.exewmic path win32_VideoController get name3⤵
- Detects videocard installed
-
C:\Windows\SysWOW64\cmd.execmd /C "wmic cpu get name"2⤵
-
C:\Windows\SysWOW64\Wbem\WMIC.exewmic cpu get name3⤵
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic os get Caption2⤵
-
C:\Windows\SysWOW64\cmd.execmd /C "wmic path win32_VideoController get name"2⤵
-
C:\Windows\SysWOW64\Wbem\WMIC.exewmic path win32_VideoController get name3⤵
- Detects videocard installed
-
C:\Windows\SysWOW64\cmd.execmd /C "wmic cpu get name"2⤵
-
C:\Windows\SysWOW64\Wbem\WMIC.exewmic cpu get name3⤵
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic os get Caption2⤵
-
C:\Windows\SysWOW64\cmd.execmd /C "wmic path win32_VideoController get name"2⤵
-
C:\Windows\SysWOW64\Wbem\WMIC.exewmic path win32_VideoController get name3⤵
- Detects videocard installed
-
C:\Windows\SysWOW64\cmd.execmd /C "wmic cpu get name"2⤵
-
C:\Windows\SysWOW64\Wbem\WMIC.exewmic cpu get name3⤵
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic os get Caption2⤵
-
C:\Windows\SysWOW64\cmd.execmd /C "wmic path win32_VideoController get name"2⤵
-
C:\Windows\SysWOW64\Wbem\WMIC.exewmic path win32_VideoController get name3⤵
- Detects videocard installed
-
C:\Windows\SysWOW64\cmd.execmd /C "wmic cpu get name"2⤵
-
C:\Windows\SysWOW64\Wbem\WMIC.exewmic cpu get name3⤵
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic os get Caption2⤵
-
C:\Windows\SysWOW64\cmd.execmd /C "wmic path win32_VideoController get name"2⤵
-
C:\Windows\SysWOW64\Wbem\WMIC.exewmic path win32_VideoController get name3⤵
- Detects videocard installed
-
C:\Windows\SysWOW64\cmd.execmd /C "wmic cpu get name"2⤵
-
C:\Windows\SysWOW64\Wbem\WMIC.exewmic cpu get name3⤵
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic os get Caption2⤵
-
C:\Windows\SysWOW64\cmd.execmd /C "wmic path win32_VideoController get name"2⤵
-
C:\Windows\SysWOW64\Wbem\WMIC.exewmic path win32_VideoController get name3⤵
- Detects videocard installed
-
C:\Windows\SysWOW64\cmd.execmd /C "wmic cpu get name"2⤵
-
C:\Windows\SysWOW64\Wbem\WMIC.exewmic cpu get name3⤵
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic os get Caption2⤵
-
C:\Windows\SysWOW64\cmd.execmd /C "wmic path win32_VideoController get name"2⤵
-
C:\Windows\SysWOW64\Wbem\WMIC.exewmic path win32_VideoController get name3⤵
- Detects videocard installed
-
C:\Windows\SysWOW64\cmd.execmd /C "wmic cpu get name"2⤵
-
C:\Windows\SysWOW64\Wbem\WMIC.exewmic cpu get name3⤵
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic os get Caption2⤵
-
C:\Windows\SysWOW64\cmd.execmd /C "wmic path win32_VideoController get name"2⤵
-
C:\Windows\SysWOW64\Wbem\WMIC.exewmic path win32_VideoController get name3⤵
- Detects videocard installed
-
C:\Windows\SysWOW64\cmd.execmd /C "wmic cpu get name"2⤵
-
C:\Windows\SysWOW64\Wbem\WMIC.exewmic cpu get name3⤵
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic os get Caption2⤵
-
C:\Windows\SysWOW64\cmd.execmd /C "wmic path win32_VideoController get name"2⤵
-
C:\Windows\SysWOW64\Wbem\WMIC.exewmic path win32_VideoController get name3⤵
- Detects videocard installed
-
C:\Windows\SysWOW64\cmd.execmd /C "wmic cpu get name"2⤵
-
C:\Windows\SysWOW64\Wbem\WMIC.exewmic cpu get name3⤵
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic os get Caption2⤵
-
C:\Windows\SysWOW64\cmd.execmd /C "wmic path win32_VideoController get name"2⤵
-
C:\Windows\SysWOW64\Wbem\WMIC.exewmic path win32_VideoController get name3⤵
- Detects videocard installed
-
C:\Windows\SysWOW64\cmd.execmd /C "wmic cpu get name"2⤵
-
C:\Windows\SysWOW64\Wbem\WMIC.exewmic cpu get name3⤵
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic os get Caption2⤵
-
C:\Windows\SysWOW64\cmd.execmd /C "wmic path win32_VideoController get name"2⤵
-
C:\Windows\SysWOW64\Wbem\WMIC.exewmic path win32_VideoController get name3⤵
- Detects videocard installed
-
C:\Windows\SysWOW64\cmd.execmd /C "wmic cpu get name"2⤵
-
C:\Windows\SysWOW64\Wbem\WMIC.exewmic cpu get name3⤵
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic os get Caption2⤵
-
C:\Windows\SysWOW64\cmd.execmd /C "wmic path win32_VideoController get name"2⤵
-
C:\Windows\SysWOW64\Wbem\WMIC.exewmic path win32_VideoController get name3⤵
- Detects videocard installed
-
C:\Windows\SysWOW64\cmd.execmd /C "wmic cpu get name"2⤵
-
C:\Windows\SysWOW64\Wbem\WMIC.exewmic cpu get name3⤵
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic os get Caption2⤵
-
C:\Windows\SysWOW64\cmd.execmd /C "wmic path win32_VideoController get name"2⤵
-
C:\Windows\SysWOW64\Wbem\WMIC.exewmic path win32_VideoController get name3⤵
- Detects videocard installed
-
C:\Windows\SysWOW64\cmd.execmd /C "wmic cpu get name"2⤵
-
C:\Windows\SysWOW64\Wbem\WMIC.exewmic cpu get name3⤵
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic os get Caption2⤵
-
C:\Windows\SysWOW64\cmd.execmd /C "wmic path win32_VideoController get name"2⤵
-
C:\Windows\SysWOW64\Wbem\WMIC.exewmic path win32_VideoController get name3⤵
- Detects videocard installed
-
C:\Windows\SysWOW64\cmd.execmd /C "wmic cpu get name"2⤵
-
C:\Windows\SysWOW64\Wbem\WMIC.exewmic cpu get name3⤵
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic os get Caption2⤵
-
C:\Windows\SysWOW64\cmd.execmd /C "wmic path win32_VideoController get name"2⤵
-
C:\Windows\SysWOW64\Wbem\WMIC.exewmic path win32_VideoController get name3⤵
- Detects videocard installed
-
C:\Windows\SysWOW64\cmd.execmd /C "wmic cpu get name"2⤵
-
C:\Windows\SysWOW64\Wbem\WMIC.exewmic cpu get name3⤵
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic os get Caption2⤵
-
C:\Windows\SysWOW64\cmd.execmd /C "wmic path win32_VideoController get name"2⤵
-
C:\Windows\SysWOW64\Wbem\WMIC.exewmic path win32_VideoController get name3⤵
- Detects videocard installed
-
C:\Windows\SysWOW64\cmd.execmd /C "wmic cpu get name"2⤵
-
C:\Windows\SysWOW64\Wbem\WMIC.exewmic cpu get name3⤵
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic os get Caption2⤵
-
C:\Windows\SysWOW64\cmd.execmd /C "wmic path win32_VideoController get name"2⤵
-
C:\Windows\SysWOW64\Wbem\WMIC.exewmic path win32_VideoController get name3⤵
- Detects videocard installed
-
C:\Windows\SysWOW64\cmd.execmd /C "wmic cpu get name"2⤵
-
C:\Windows\SysWOW64\Wbem\WMIC.exewmic cpu get name3⤵
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic os get Caption2⤵
-
C:\Windows\SysWOW64\cmd.execmd /C "wmic path win32_VideoController get name"2⤵
-
C:\Windows\SysWOW64\Wbem\WMIC.exewmic path win32_VideoController get name3⤵
- Detects videocard installed
-
C:\Windows\SysWOW64\cmd.execmd /C "wmic cpu get name"2⤵
-
C:\Windows\SysWOW64\Wbem\WMIC.exewmic cpu get name3⤵
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic os get Caption2⤵
-
C:\Windows\SysWOW64\cmd.execmd /C "wmic path win32_VideoController get name"2⤵
-
C:\Windows\SysWOW64\Wbem\WMIC.exewmic path win32_VideoController get name3⤵
- Detects videocard installed
-
C:\Windows\SysWOW64\cmd.execmd /C "wmic cpu get name"2⤵
-
C:\Windows\SysWOW64\Wbem\WMIC.exewmic cpu get name3⤵
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic os get Caption2⤵
-
C:\Windows\SysWOW64\cmd.execmd /C "wmic path win32_VideoController get name"2⤵
-
C:\Windows\SysWOW64\Wbem\WMIC.exewmic path win32_VideoController get name3⤵
- Detects videocard installed
-
C:\Windows\SysWOW64\cmd.execmd /C "wmic cpu get name"2⤵
-
C:\Windows\SysWOW64\Wbem\WMIC.exewmic cpu get name3⤵
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic os get Caption2⤵
-
C:\Windows\SysWOW64\cmd.execmd /C "wmic path win32_VideoController get name"2⤵
-
C:\Windows\SysWOW64\Wbem\WMIC.exewmic path win32_VideoController get name3⤵
- Detects videocard installed
-
C:\Windows\SysWOW64\cmd.execmd /C "wmic cpu get name"2⤵
-
C:\Windows\SysWOW64\Wbem\WMIC.exewmic cpu get name3⤵
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic os get Caption2⤵
-
C:\Windows\SysWOW64\cmd.execmd /C "wmic path win32_VideoController get name"2⤵
-
C:\Windows\SysWOW64\Wbem\WMIC.exewmic path win32_VideoController get name3⤵
- Detects videocard installed
-
C:\Windows\SysWOW64\cmd.execmd /C "wmic cpu get name"2⤵
-
C:\Windows\SysWOW64\Wbem\WMIC.exewmic cpu get name3⤵
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic os get Caption2⤵
-
C:\Windows\SysWOW64\cmd.execmd /C "wmic path win32_VideoController get name"2⤵
-
C:\Windows\SysWOW64\Wbem\WMIC.exewmic path win32_VideoController get name3⤵
- Detects videocard installed
-
C:\Windows\SysWOW64\cmd.execmd /C "wmic cpu get name"2⤵
-
C:\Windows\SysWOW64\Wbem\WMIC.exewmic cpu get name3⤵
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic os get Caption2⤵
-
C:\Windows\SysWOW64\cmd.execmd /C "wmic path win32_VideoController get name"2⤵
-
C:\Windows\SysWOW64\Wbem\WMIC.exewmic path win32_VideoController get name3⤵
- Detects videocard installed
-
C:\Windows\SysWOW64\cmd.execmd /C "wmic cpu get name"2⤵
-
C:\Windows\SysWOW64\Wbem\WMIC.exewmic cpu get name3⤵
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic os get Caption2⤵
-
C:\Windows\SysWOW64\cmd.execmd /C "wmic path win32_VideoController get name"2⤵
-
C:\Windows\SysWOW64\Wbem\WMIC.exewmic path win32_VideoController get name3⤵
- Detects videocard installed
-
C:\Windows\SysWOW64\cmd.execmd /C "wmic cpu get name"2⤵
-
C:\Windows\SysWOW64\Wbem\WMIC.exewmic cpu get name3⤵
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic os get Caption2⤵
-
C:\Windows\SysWOW64\cmd.execmd /C "wmic path win32_VideoController get name"2⤵
-
C:\Windows\SysWOW64\Wbem\WMIC.exewmic path win32_VideoController get name3⤵
- Detects videocard installed
-
C:\Windows\SysWOW64\cmd.execmd /C "wmic cpu get name"2⤵
-
C:\Windows\SysWOW64\Wbem\WMIC.exewmic cpu get name3⤵
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic os get Caption2⤵
-
C:\Windows\SysWOW64\cmd.execmd /C "wmic path win32_VideoController get name"2⤵
-
C:\Windows\SysWOW64\Wbem\WMIC.exewmic path win32_VideoController get name3⤵
- Detects videocard installed
-
C:\Windows\SysWOW64\cmd.execmd /C "wmic cpu get name"2⤵
-
C:\Windows\SysWOW64\Wbem\WMIC.exewmic cpu get name3⤵
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic os get Caption2⤵
-
C:\Windows\SysWOW64\cmd.execmd /C "wmic path win32_VideoController get name"2⤵
-
C:\Windows\SysWOW64\Wbem\WMIC.exewmic path win32_VideoController get name3⤵
- Detects videocard installed
-
C:\Windows\SysWOW64\cmd.execmd /C "wmic cpu get name"2⤵
-
C:\Windows\SysWOW64\Wbem\WMIC.exewmic cpu get name3⤵
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic os get Caption2⤵
-
C:\Windows\SysWOW64\cmd.execmd /C "wmic path win32_VideoController get name"2⤵
-
C:\Windows\SysWOW64\Wbem\WMIC.exewmic path win32_VideoController get name3⤵
- Detects videocard installed
-
C:\Windows\SysWOW64\cmd.execmd /C "wmic cpu get name"2⤵
-
C:\Windows\SysWOW64\Wbem\WMIC.exewmic cpu get name3⤵
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic os get Caption2⤵
-
C:\Windows\SysWOW64\cmd.execmd /C "wmic path win32_VideoController get name"2⤵
-
C:\Windows\SysWOW64\Wbem\WMIC.exewmic path win32_VideoController get name3⤵
- Detects videocard installed
-
C:\Windows\SysWOW64\cmd.execmd /C "wmic cpu get name"2⤵
-
C:\Windows\SysWOW64\Wbem\WMIC.exewmic cpu get name3⤵
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic os get Caption2⤵
-
C:\Windows\SysWOW64\cmd.execmd /C "wmic path win32_VideoController get name"2⤵
-
C:\Windows\SysWOW64\Wbem\WMIC.exewmic path win32_VideoController get name3⤵
- Detects videocard installed
-
C:\Windows\SysWOW64\cmd.execmd /C "wmic cpu get name"2⤵
-
C:\Windows\SysWOW64\Wbem\WMIC.exewmic cpu get name3⤵
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic os get Caption2⤵
-
C:\Windows\SysWOW64\cmd.execmd /C "wmic path win32_VideoController get name"2⤵
-
C:\Windows\SysWOW64\Wbem\WMIC.exewmic path win32_VideoController get name3⤵
- Detects videocard installed
-
C:\Windows\SysWOW64\cmd.execmd /C "wmic cpu get name"2⤵
-
C:\Windows\SysWOW64\Wbem\WMIC.exewmic cpu get name3⤵
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic os get Caption2⤵
-
C:\Windows\SysWOW64\cmd.execmd /C "wmic path win32_VideoController get name"2⤵
-
C:\Windows\SysWOW64\Wbem\WMIC.exewmic path win32_VideoController get name3⤵
- Detects videocard installed
-
C:\Windows\SysWOW64\cmd.execmd /C "wmic cpu get name"2⤵
-
C:\Windows\SysWOW64\Wbem\WMIC.exewmic cpu get name3⤵
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic os get Caption2⤵
-
C:\Windows\SysWOW64\cmd.execmd /C "wmic path win32_VideoController get name"2⤵
-
C:\Windows\SysWOW64\Wbem\WMIC.exewmic path win32_VideoController get name3⤵
- Detects videocard installed
-
C:\Windows\SysWOW64\cmd.execmd /C "wmic cpu get name"2⤵
-
C:\Windows\SysWOW64\Wbem\WMIC.exewmic cpu get name3⤵
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic os get Caption2⤵
-
C:\Windows\SysWOW64\cmd.execmd /C "wmic path win32_VideoController get name"2⤵
-
C:\Windows\SysWOW64\Wbem\WMIC.exewmic path win32_VideoController get name3⤵
- Detects videocard installed
-
C:\Windows\SysWOW64\cmd.execmd /C "wmic cpu get name"2⤵
-
C:\Windows\SysWOW64\Wbem\WMIC.exewmic cpu get name3⤵
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic os get Caption2⤵
-
C:\Windows\SysWOW64\cmd.execmd /C "wmic path win32_VideoController get name"2⤵
-
C:\Windows\SysWOW64\Wbem\WMIC.exewmic path win32_VideoController get name3⤵
- Detects videocard installed
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\ZIvaBjMkXVFilesize
20KB
MD5c9ff7748d8fcef4cf84a5501e996a641
SHA102867e5010f62f97ebb0cfb32cb3ede9449fe0c9
SHA2564d3f3194cb1133437aa69bb880c8cbb55ddf06ff61a88ca6c3f1bbfbfd35d988
SHA512d36054499869a8f56ac8547ccd5455f1252c24e17d2b185955390b32da7e2a732ace4e0f30f9493fcc61425a2e31ed623465f998f41af69423ee0e3ed1483a73
-
C:\Users\Admin\AppData\Local\Temp\btZsyMGeuDFilesize
148KB
MD590a1d4b55edf36fa8b4cc6974ed7d4c4
SHA1aba1b8d0e05421e7df5982899f626211c3c4b5c1
SHA2567cf3e9e8619904e72ea6608cc43e9b6c9f8aa2af02476f60c2b3daf33075981c
SHA512ea0838be754e1258c230111900c5937d2b0788f90bbf7c5f82b2ceda7868e50afb86c301f313267eaa912778da45755560b5434885521bf915967a7863922ae2
-
C:\Users\Admin\AppData\Local\Temp\hhjUVRuSqfFilesize
46KB
MD502d2c46697e3714e49f46b680b9a6b83
SHA184f98b56d49f01e9b6b76a4e21accf64fd319140
SHA256522cad95d3fa6ebb3274709b8d09bbb1ca37389d0a924cd29e934a75aa04c6c9
SHA51260348a145bfc71b1e07cb35fa79ab5ff472a3d0a557741ea2d39b3772bc395b86e261bd616f65307ae0d997294e49b5548d32f11e86ef3e2704959ca63da8aac
-
C:\Users\Admin\AppData\Local\Temp\nJObCsNVlgTeMaPEZQleQYhYzRyWJjPjFilesize
88KB
MD5c93b48edf2fea52b9845ca0d41268528
SHA1f8ed9e3a9674d0d14f5b88cc45b434ad017df184
SHA25684265d7d53533cd00e90362c1bd59ee1782706161b528fbf325980fd6bbf5072
SHA512e21511bbf93d1febdd4b8c3228b3fa73baf8c15b913187659ac43ebb63ee8a2c94c9063b6d9ed2f3c11788041c33a77201610e53711e56f810dde584b9974bda