fd8059b06f53e9ccac53b1252698b0c7f70f6818c087b984d4422ca1f6b94ea6

Resubmissions

19/01/2024, 01:18

240119-bn7ndadef77

19/01/2024, 01:13

240119-bla7dscefr10

Analysis

max time kernel
4s
max time network
91s
platform
windows11-21h2_x64
resource
win11-20231215-en
resource tags

arch:x64arch:x86image:win11-20231215-enlocale:en-usos:windows11-21h2-x64system
submitted
19/01/2024, 01:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
DarkAdventures.exe
Size 139.5MB
Sample240119-bn7ndadef7
SHA256 56a16d12935731e5ea24968320133bb7eaac3be2c02103148a13ce4582a8c887
MD5 4acca1c0306c258f19f673c0fc1ae424
SHA1 5292070989b70618447285a32fbb63f08a527f5d
SHA512 1a27cdfcf89f8e7f898cb844862483360b70e9a929db48de37143ea4d9bd8fcd549de4ce8d2413e82fc213c58a5dd624331984dc4e9fd23fc7466d46f7f1aa4f
SSDEEP 786432:314w5ThzHwQBgmoLWv+K18nCzKdo5DTdvfMQr6SSmPuvh8tSIW68:314kpHwQjCWv+K18CedmVvEQEpcJW
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 3 IoCs

pid	Process
3336	DarkAdventures.exe
3336	DarkAdventures.exe
3336	DarkAdventures.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Looks up external IP address via web service 4 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
1	ipinfo.io
4	ipinfo.io
5	ipinfo.io
6	ipinfo.io

Checks processor information in registry 2 TTPs 7 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	DarkAdventures.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	DarkAdventures.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	DarkAdventures.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	DarkAdventures.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz	DarkAdventures.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString	DarkAdventures.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2	DarkAdventures.exe

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
10888	schtasks.exe

Detects videocard installed 1 TTPs 1 IoCs

Uses WMIC.exe to determine videocard installed.

System Information Discovery

T1082

pid	Process
10680	WMIC.exe

Enumerates processes with tasklist 1 TTPs 64 IoCs

Process Discovery

T1057

pid	Process
7936	tasklist.exe
7068	tasklist.exe
7224	tasklist.exe
7428	tasklist.exe
7144	tasklist.exe
7568	tasklist.exe
6648	tasklist.exe
7288	tasklist.exe
7792	tasklist.exe
8168	tasklist.exe
8044	tasklist.exe
7968	tasklist.exe
7472	tasklist.exe
7448	tasklist.exe
7408	tasklist.exe
7340	tasklist.exe
7272	tasklist.exe
7776	tasklist.exe
7240	tasklist.exe
7764	tasklist.exe
7112	tasklist.exe
7656	tasklist.exe
6928	tasklist.exe
2660	tasklist.exe
7688	tasklist.exe
8052	tasklist.exe
8020	tasklist.exe
7232	tasklist.exe
7152	tasklist.exe
8004	tasklist.exe
7868	tasklist.exe
6896	tasklist.exe
7164	tasklist.exe
7264	tasklist.exe
7296	tasklist.exe
7324	tasklist.exe
7104	tasklist.exe
6972	tasklist.exe
6948	tasklist.exe
6940	tasklist.exe
7520	tasklist.exe
7704	tasklist.exe
7976	tasklist.exe
7512	tasklist.exe
7464	tasklist.exe
7060	tasklist.exe
7184	tasklist.exe
7348	tasklist.exe
8100	tasklist.exe
8092	tasklist.exe
7784	tasklist.exe
7748	tasklist.exe
7052	tasklist.exe
6980	tasklist.exe
7372	tasklist.exe
7280	tasklist.exe
7592	tasklist.exe
7816	tasklist.exe
8028	tasklist.exe
7560	tasklist.exe
7540	tasklist.exe
6964	tasklist.exe
6988	tasklist.exe
5408	tasklist.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
3336	DarkAdventures.exe
3336	DarkAdventures.exe
3336	DarkAdventures.exe
3336	DarkAdventures.exe
4660	DarkAdventures.exe
4660	DarkAdventures.exe

Suspicious use of AdjustPrivilegeToken 48 IoCs

description	pid	Process
Token: SeDebugPrivilege	2660	tasklist.exe
Token: SeIncreaseQuotaPrivilege	3128	WMIC.exe
Token: SeSecurityPrivilege	3128	WMIC.exe
Token: SeTakeOwnershipPrivilege	3128	WMIC.exe
Token: SeLoadDriverPrivilege	3128	WMIC.exe
Token: SeSystemProfilePrivilege	3128	WMIC.exe
Token: SeSystemtimePrivilege	3128	WMIC.exe
Token: SeProfSingleProcessPrivilege	3128	WMIC.exe
Token: SeIncBasePriorityPrivilege	3128	WMIC.exe
Token: SeCreatePagefilePrivilege	3128	WMIC.exe
Token: SeBackupPrivilege	3128	WMIC.exe
Token: SeRestorePrivilege	3128	WMIC.exe
Token: SeShutdownPrivilege	3128	WMIC.exe
Token: SeDebugPrivilege	3128	WMIC.exe
Token: SeSystemEnvironmentPrivilege	3128	WMIC.exe
Token: SeRemoteShutdownPrivilege	3128	WMIC.exe
Token: SeUndockPrivilege	3128	WMIC.exe
Token: SeManageVolumePrivilege	3128	WMIC.exe
Token: 33	3128	WMIC.exe
Token: 34	3128	WMIC.exe
Token: 35	3128	WMIC.exe
Token: 36	3128	WMIC.exe
Token: SeIncreaseQuotaPrivilege	3128	WMIC.exe
Token: SeSecurityPrivilege	3128	WMIC.exe
Token: SeTakeOwnershipPrivilege	3128	WMIC.exe
Token: SeLoadDriverPrivilege	3128	WMIC.exe
Token: SeSystemProfilePrivilege	3128	WMIC.exe
Token: SeSystemtimePrivilege	3128	WMIC.exe
Token: SeProfSingleProcessPrivilege	3128	WMIC.exe
Token: SeIncBasePriorityPrivilege	3128	WMIC.exe
Token: SeCreatePagefilePrivilege	3128	WMIC.exe
Token: SeBackupPrivilege	3128	WMIC.exe
Token: SeRestorePrivilege	3128	WMIC.exe
Token: SeShutdownPrivilege	3128	WMIC.exe
Token: SeDebugPrivilege	3128	WMIC.exe
Token: SeSystemEnvironmentPrivilege	3128	WMIC.exe
Token: SeRemoteShutdownPrivilege	3128	WMIC.exe
Token: SeUndockPrivilege	3128	WMIC.exe
Token: SeManageVolumePrivilege	3128	WMIC.exe
Token: 33	3128	WMIC.exe
Token: 34	3128	WMIC.exe
Token: 35	3128	WMIC.exe
Token: 36	3128	WMIC.exe
Token: SeShutdownPrivilege	3336	DarkAdventures.exe
Token: SeCreatePagefilePrivilege	3336	DarkAdventures.exe
Token: SeDebugPrivilege	6648	tasklist.exe
Token: SeDebugPrivilege	6896	tasklist.exe
Token: SeDebugPrivilege	6884	tasklist.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3336 wrote to memory of 1280	3336	DarkAdventures.exe	78
PID 3336 wrote to memory of 1280	3336	DarkAdventures.exe	78
PID 1280 wrote to memory of 2660	1280	cmd.exe	77
PID 1280 wrote to memory of 2660	1280	cmd.exe	77
PID 3336 wrote to memory of 864	3336	DarkAdventures.exe	76
PID 3336 wrote to memory of 864	3336	DarkAdventures.exe	76
PID 3336 wrote to memory of 864	3336	DarkAdventures.exe	76
PID 3336 wrote to memory of 864	3336	DarkAdventures.exe	76
PID 3336 wrote to memory of 864	3336	DarkAdventures.exe	76
PID 3336 wrote to memory of 864	3336	DarkAdventures.exe	76
PID 3336 wrote to memory of 864	3336	DarkAdventures.exe	76
PID 3336 wrote to memory of 864	3336	DarkAdventures.exe	76
PID 3336 wrote to memory of 864	3336	DarkAdventures.exe	76
PID 3336 wrote to memory of 864	3336	DarkAdventures.exe	76
PID 3336 wrote to memory of 864	3336	DarkAdventures.exe	76
PID 3336 wrote to memory of 864	3336	DarkAdventures.exe	76
PID 3336 wrote to memory of 864	3336	DarkAdventures.exe	76
PID 3336 wrote to memory of 864	3336	DarkAdventures.exe	76
PID 3336 wrote to memory of 864	3336	DarkAdventures.exe	76
PID 3336 wrote to memory of 864	3336	DarkAdventures.exe	76
PID 3336 wrote to memory of 864	3336	DarkAdventures.exe	76
PID 3336 wrote to memory of 864	3336	DarkAdventures.exe	76
PID 3336 wrote to memory of 864	3336	DarkAdventures.exe	76
PID 3336 wrote to memory of 864	3336	DarkAdventures.exe	76
PID 3336 wrote to memory of 864	3336	DarkAdventures.exe	76
PID 3336 wrote to memory of 864	3336	DarkAdventures.exe	76
PID 3336 wrote to memory of 864	3336	DarkAdventures.exe	76
PID 3336 wrote to memory of 864	3336	DarkAdventures.exe	76
PID 3336 wrote to memory of 864	3336	DarkAdventures.exe	76
PID 3336 wrote to memory of 864	3336	DarkAdventures.exe	76
PID 3336 wrote to memory of 864	3336	DarkAdventures.exe	76
PID 3336 wrote to memory of 864	3336	DarkAdventures.exe	76
PID 3336 wrote to memory of 864	3336	DarkAdventures.exe	76
PID 3336 wrote to memory of 864	3336	DarkAdventures.exe	76
PID 3336 wrote to memory of 864	3336	DarkAdventures.exe	76
PID 3336 wrote to memory of 864	3336	DarkAdventures.exe	76
PID 3336 wrote to memory of 864	3336	DarkAdventures.exe	76
PID 3336 wrote to memory of 864	3336	DarkAdventures.exe	76
PID 3336 wrote to memory of 864	3336	DarkAdventures.exe	76
PID 3336 wrote to memory of 864	3336	DarkAdventures.exe	76
PID 3336 wrote to memory of 864	3336	DarkAdventures.exe	76
PID 3336 wrote to memory of 864	3336	DarkAdventures.exe	76
PID 3336 wrote to memory of 864	3336	DarkAdventures.exe	76
PID 3336 wrote to memory of 864	3336	DarkAdventures.exe	76
PID 3336 wrote to memory of 4660	3336	DarkAdventures.exe	80
PID 3336 wrote to memory of 4660	3336	DarkAdventures.exe	80
PID 3336 wrote to memory of 4176	3336	DarkAdventures.exe	82
PID 3336 wrote to memory of 4176	3336	DarkAdventures.exe	82
PID 4176 wrote to memory of 3128	4176	cmd.exe	84
PID 4176 wrote to memory of 3128	4176	cmd.exe	84
PID 3336 wrote to memory of 3116	3336	DarkAdventures.exe	85
PID 3336 wrote to memory of 3116	3336	DarkAdventures.exe	85
PID 3336 wrote to memory of 768	3336	DarkAdventures.exe	86
PID 3336 wrote to memory of 768	3336	DarkAdventures.exe	86
PID 3336 wrote to memory of 2572	3336	DarkAdventures.exe	87
PID 3336 wrote to memory of 2572	3336	DarkAdventures.exe	87
PID 3336 wrote to memory of 2600	3336	DarkAdventures.exe	88
PID 3336 wrote to memory of 2600	3336	DarkAdventures.exe	88
PID 3336 wrote to memory of 5104	3336	DarkAdventures.exe	89
PID 3336 wrote to memory of 5104	3336	DarkAdventures.exe	89
PID 3336 wrote to memory of 2316	3336	DarkAdventures.exe	90
PID 3336 wrote to memory of 2316	3336	DarkAdventures.exe	90
PID 3336 wrote to memory of 320	3336	DarkAdventures.exe	91
PID 3336 wrote to memory of 320	3336	DarkAdventures.exe	91

Views/modifies file attributes 1 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
10920	attrib.exe

C:\Users\Admin\AppData\Local\Temp\DarkAdventures.exe
"C:\Users\Admin\AppData\Local\Temp\DarkAdventures.exe"
1⤵
- Loads dropped DLL
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3336
- C:\Users\Admin\AppData\Local\Temp\DarkAdventures.exe
  "C:\Users\Admin\AppData\Local\Temp\DarkAdventures.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\script" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1508 --field-trial-handle=1700,1740443676933186225,844725114220544041,131072 --disable-features=PlzServiceWorker,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2
  2⤵
  PID:864
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1280
- C:\Users\Admin\AppData\Local\Temp\DarkAdventures.exe
  "C:\Users\Admin\AppData\Local\Temp\DarkAdventures.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\script" --mojo-platform-channel-handle=1916 --field-trial-handle=1700,1740443676933186225,844725114220544041,131072 --disable-features=PlzServiceWorker,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4660
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic process where processid=3336 get ExecutablePath"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4176
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic process where processid=3336 get ExecutablePath
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3128
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist"
  2⤵
  PID:3116
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:6896
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist"
  2⤵
  PID:768
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    PID:7128
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist"
  2⤵
  PID:2572
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:6648
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist"
  2⤵
  PID:2600
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    PID:7400
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist"
  2⤵
  PID:5104
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    PID:5408
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist"
  2⤵
  PID:2316
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    PID:7144
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist"
  2⤵
  PID:320
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    PID:7136
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist"
  2⤵
  PID:2356
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    PID:7408
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist"
  2⤵
  PID:1744
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    PID:7060
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist"
  2⤵
  PID:3672
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    PID:7748
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist"
  2⤵
  PID:1112
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    PID:6948
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist"
  2⤵
  PID:3156
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:6884
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist"
  2⤵
  PID:4828
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    PID:6972
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist"
  2⤵
  PID:3816
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    PID:6964
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist"
  2⤵
  PID:3760
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    PID:7184
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist"
  2⤵
  PID:2272
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    PID:7152
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist"
  2⤵
  PID:3188
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    PID:7164
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist"
  2⤵
  PID:1800
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    PID:7712
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist"
  2⤵
  PID:572
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    PID:7380
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist"
  2⤵
  PID:2244
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    PID:7512
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist"
  2⤵
  PID:3972
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    PID:7976
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist"
  2⤵
  PID:3688
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    PID:6956
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist"
  2⤵
  PID:3940
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    PID:7112
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist"
  2⤵
  PID:4816
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    PID:7560
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist"
  2⤵
  PID:1124
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    PID:7332
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist"
  2⤵
  PID:2604
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    PID:7120
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist"
  2⤵
  PID:216
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    PID:7784
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist"
  2⤵
  PID:2456
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    PID:7568
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist"
  2⤵
  PID:4172
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    PID:7868
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist"
  2⤵
  PID:1276
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    PID:7656
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist"
  2⤵
  PID:4836
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    PID:6988
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist"
  2⤵
  PID:1660
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    PID:7272
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist"
  2⤵
  PID:4776
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    PID:7484
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist"
  2⤵
  PID:2736
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    PID:7464
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist"
  2⤵
  PID:1308
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    PID:7240
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist"
  2⤵
  PID:3028
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    PID:7068
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist"
  2⤵
  PID:676
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    PID:7372
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist"
  2⤵
  PID:2752
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    PID:7296
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic OS get caption, osarchitecture | more +1"
  2⤵
  PID:1216
- - C:\Windows\system32\more.com
    more +1
    3⤵
    PID:8108
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic OS get caption, osarchitecture
    3⤵
    PID:7944
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic csproduct get uuid"
  2⤵
  PID:3208
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic csproduct get uuid
    3⤵
    PID:7308
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\bind\main.exe"
  2⤵
  PID:884
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "net session"
  2⤵
  PID:1756
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist"
  2⤵
  PID:3000
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist"
  2⤵
  PID:2336
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist"
  2⤵
  PID:748
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist"
  2⤵
  PID:4820
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist"
  2⤵
  PID:1616
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist"
  2⤵
  PID:4792
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist"
  2⤵
  PID:1036
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist"
  2⤵
  PID:4108
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist"
  2⤵
  PID:540
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist"
  2⤵
  PID:4500
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist"
  2⤵
  PID:4296
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist"
  2⤵
  PID:4796
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist"
  2⤵
  PID:2196
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist"
  2⤵
  PID:4904
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist"
  2⤵
  PID:4112
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist"
  2⤵
  PID:2068
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist"
  2⤵
  PID:2996
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist"
  2⤵
  PID:5072
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist"
  2⤵
  PID:3700
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist"
  2⤵
  PID:5080
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist"
  2⤵
  PID:5092
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist"
  2⤵
  PID:5084
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist"
  2⤵
  PID:3684
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist"
  2⤵
  PID:1572
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist"
  2⤵
  PID:1736
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist"
  2⤵
  PID:2016
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist"
  2⤵
  PID:2100
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist"
  2⤵
  PID:3892
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist"
  2⤵
  PID:2380
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist"
  2⤵
  PID:3204
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist"
  2⤵
  PID:1188
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist"
  2⤵
  PID:2120
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist"
  2⤵
  PID:3996
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist"
  2⤵
  PID:4856
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist"
  2⤵
  PID:2148
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist"
  2⤵
  PID:3976
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist"
  2⤵
  PID:3556
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist"
  2⤵
  PID:3692
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist"
  2⤵
  PID:2132
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist"
  2⤵
  PID:1856
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist"
  2⤵
  PID:2240
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist"
  2⤵
  PID:2064
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist"
  2⤵
  PID:2488
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist"
  2⤵
  PID:3680
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist"
  2⤵
  PID:3764
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist"
  2⤵
  PID:1420
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist"
  2⤵
  PID:1344
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist"
  2⤵
  PID:1412
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist"
  2⤵
  PID:944
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist"
  2⤵
  PID:2672
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist"
  2⤵
  PID:3872
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall"
    3⤵
    PID:7208
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist"
  2⤵
  PID:1576
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist"
  2⤵
  PID:1500
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist"
  2⤵
  PID:2464
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic cpu get name | more +1"
  2⤵
  PID:10548
- - C:\Windows\system32\more.com
    more +1
    3⤵
    PID:10596
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic cpu get name
    3⤵
    PID:10588
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic PATH Win32_VideoController get name | more +1"
  2⤵
  PID:10640
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic PATH Win32_VideoController get name
    3⤵
    - Detects videocard installed
    PID:10680
- - C:\Windows\system32\more.com
    more +1
    3⤵
    PID:10688
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault"
  2⤵
  PID:10740
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault
    3⤵
    PID:10780
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName"
  2⤵
  PID:10932
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName
    3⤵
    PID:10972
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist"
  2⤵
  PID:11152
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    PID:11192
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic process where processid=3336 get ExecutablePath"
  2⤵
  PID:10516
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -Command "attrib +h +s \"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\DarkAdventures.exe\"""
  2⤵
  PID:10776
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "cmd /c schtasks /create /sc onlogon /tn WindowsDriverSetupYUqLur /tr \"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\DarkAdventures.exe\" /F /rl highest"
  2⤵
  PID:10840
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v WindowsDriverSetupYUqLur /t REG_SZ /d C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\DarkAdventures.exe /f"
  2⤵
  PID:10832
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -Command "& { $Action = New-ScheduledTaskAction -Execute 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\DarkAdventures.exe' $Trigger = New-ScheduledTaskTrigger -Daily -At '12:00PM' Register-ScheduledTask -Action $Action -Trigger $Trigger -TaskName StartCacaTask }"
  2⤵
  PID:10948
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IEData""
  2⤵
  PID:6960
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IE5BAKEX""
  2⤵
  PID:1956
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IE4Data""
  2⤵
  PID:10000
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IE40""
  2⤵
  PID:9372
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Fontcore""
  2⤵
  PID:6304
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\DXM_Runtime""
  2⤵
  PID:8788
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\DirectDrawEx""
  2⤵
  PID:9380
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Connection Manager""
  2⤵
  PID:8504
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AddressBook""
  2⤵
  PID:8860
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\7-Zip""
  2⤵
  PID:5516
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall""
  2⤵
  PID:9020
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall""
  2⤵
  PID:3872

C:\Windows\system32\tasklist.exe
tasklist
1⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:2660

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1096

C:\Windows\system32\tasklist.exe
tasklist
1⤵
- Enumerates processes with tasklist
PID:7264

C:\Windows\system32\tasklist.exe
tasklist
1⤵
PID:7416

C:\Windows\system32\net.exe
net session
1⤵
PID:7360
- C:\Windows\system32\net1.exe
  C:\Windows\system32\net1 session
  2⤵
  PID:8792

C:\Windows\system32\tasklist.exe
tasklist
1⤵
- Enumerates processes with tasklist
PID:7348

C:\Windows\system32\tasklist.exe
tasklist
1⤵
- Enumerates processes with tasklist
PID:7340

C:\Windows\system32\tasklist.exe
tasklist
1⤵
- Enumerates processes with tasklist
PID:7324

C:\Windows\system32\tasklist.exe
tasklist
1⤵
- Enumerates processes with tasklist
PID:7288

C:\Windows\system32\tasklist.exe
tasklist
1⤵
- Enumerates processes with tasklist
PID:7280

C:\Windows\system32\tasklist.exe
tasklist
1⤵
- Enumerates processes with tasklist
PID:7232

C:\Windows\system32\tasklist.exe
tasklist
1⤵
- Enumerates processes with tasklist
PID:7224

C:\Windows\system32\tasklist.exe
tasklist
1⤵
- Enumerates processes with tasklist
PID:7428

C:\Windows\system32\tasklist.exe
tasklist
1⤵
- Enumerates processes with tasklist
PID:7520

C:\Windows\system32\tasklist.exe
tasklist
1⤵
- Enumerates processes with tasklist
PID:7592

C:\Windows\system32\tasklist.exe
tasklist
1⤵
- Enumerates processes with tasklist
PID:7816

C:\Windows\system32\tasklist.exe
tasklist
1⤵
PID:7800

C:\Windows\system32\tasklist.exe
tasklist
1⤵
- Enumerates processes with tasklist
PID:7792

C:\Windows\system32\tasklist.exe
tasklist
1⤵
- Enumerates processes with tasklist
PID:7776

C:\Windows\system32\tasklist.exe
tasklist
1⤵
- Enumerates processes with tasklist
PID:7764

C:\Windows\system32\tasklist.exe
tasklist
1⤵
PID:7720

C:\Windows\system32\tasklist.exe
tasklist
1⤵
PID:7756

C:\Windows\system32\tasklist.exe
tasklist
1⤵
- Enumerates processes with tasklist
PID:7704

C:\Windows\system32\tasklist.exe
tasklist
1⤵
PID:7696

C:\Windows\system32\tasklist.exe
tasklist
1⤵
- Enumerates processes with tasklist
PID:7688

C:\Windows\system32\tasklist.exe
tasklist
1⤵
PID:7680

C:\Windows\system32\tasklist.exe
tasklist
1⤵
PID:7672

C:\Windows\system32\tasklist.exe
tasklist
1⤵
PID:8072

C:\Windows\system32\tasklist.exe
tasklist
1⤵
- Enumerates processes with tasklist
PID:8100

C:\Windows\system32\tasklist.exe
tasklist
1⤵
PID:8176

C:\Windows\system32\tasklist.exe
tasklist
1⤵
- Enumerates processes with tasklist
PID:8168

C:\Windows\system32\tasklist.exe
tasklist
1⤵
- Enumerates processes with tasklist
PID:8092

C:\Windows\system32\tasklist.exe
tasklist
1⤵
- Enumerates processes with tasklist
PID:8052

C:\Windows\system32\tasklist.exe
tasklist
1⤵
- Enumerates processes with tasklist
PID:8044

C:\Windows\system32\tasklist.exe
tasklist
1⤵
- Enumerates processes with tasklist
PID:8028

C:\Windows\system32\tasklist.exe
tasklist
1⤵
- Enumerates processes with tasklist
PID:8020

C:\Windows\system32\tasklist.exe
tasklist
1⤵
- Enumerates processes with tasklist
PID:8004

C:\Windows\system32\tasklist.exe
tasklist
1⤵
- Enumerates processes with tasklist
PID:7968

C:\Windows\system32\tasklist.exe
tasklist
1⤵
PID:7960

C:\Windows\system32\tasklist.exe
tasklist
1⤵
PID:7952

C:\Windows\system32\tasklist.exe
tasklist
1⤵
- Enumerates processes with tasklist
PID:7936

C:\Windows\system32\tasklist.exe
tasklist
1⤵
PID:7900

C:\Windows\system32\tasklist.exe
tasklist
1⤵
PID:7888

C:\Windows\system32\tasklist.exe
tasklist
1⤵
PID:7664

C:\Windows\system32\tasklist.exe
tasklist
1⤵
PID:7648

C:\Windows\system32\tasklist.exe
tasklist
1⤵
PID:7640

C:\Windows\system32\tasklist.exe
tasklist
1⤵
PID:7632

C:\Windows\system32\tasklist.exe
tasklist
1⤵
- Enumerates processes with tasklist
PID:7540

C:\Windows\system32\tasklist.exe
tasklist
1⤵
PID:7504

C:\Windows\system32\tasklist.exe
tasklist
1⤵
- Enumerates processes with tasklist
PID:7472

C:\Windows\system32\tasklist.exe
tasklist
1⤵
- Enumerates processes with tasklist
PID:7448

C:\Windows\system32\tasklist.exe
tasklist
1⤵
PID:7440

C:\Windows\system32\tasklist.exe
tasklist
1⤵
- Enumerates processes with tasklist
PID:7104

C:\Windows\system32\tasklist.exe
tasklist
1⤵
- Enumerates processes with tasklist
PID:7052

C:\Windows\system32\tasklist.exe
tasklist
1⤵
- Enumerates processes with tasklist
PID:6980

C:\Windows\system32\tasklist.exe
tasklist
1⤵
- Enumerates processes with tasklist
PID:6940

C:\Windows\system32\tasklist.exe
tasklist
1⤵
- Enumerates processes with tasklist
PID:6928

C:\Windows\System32\Wbem\WMIC.exe
wmic process where processid=3336 get ExecutablePath
1⤵
PID:10676

C:\Windows\system32\cmd.exe
cmd /c schtasks /create /sc onlogon /tn WindowsDriverSetupYUqLur /tr \"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\DarkAdventures.exe\" /F /rl highest
1⤵
PID:10792
- C:\Windows\system32\schtasks.exe
  schtasks /create /sc onlogon /tn WindowsDriverSetupYUqLur /tr \"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\DarkAdventures.exe\" /F /rl highest
  2⤵
  - Creates scheduled task(s)
  PID:10888

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v WindowsDriverSetupYUqLur /t REG_SZ /d C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\DarkAdventures.exe /f
1⤵
PID:10800

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -Command "attrib +h +s \"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\DarkAdventures.exe\""
1⤵
PID:11044
- C:\Windows\system32\attrib.exe
  "C:\Windows\system32\attrib.exe" +h +s C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\DarkAdventures.exe
  2⤵
  - Views/modifies file attributes
  PID:10920

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall"
1⤵
PID:2016

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Connection Manager"
1⤵
PID:10048

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Fontcore"
1⤵
PID:2932

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IEData"
1⤵
PID:6336

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IE5BAKEX"
1⤵
PID:5032

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IE4Data"
1⤵
PID:7532

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IE40"
1⤵
PID:10124

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\DXM_Runtime"
1⤵
PID:7164

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\DirectDrawEx"
1⤵
PID:7320

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AddressBook"
1⤵
PID:5780

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\7-Zip"
1⤵
PID:2928

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Credential Access

Discovery

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 43244c0820ec5074e654ecd149fa744f51b2c1522e90285567713dae64b62f59
MD5 88dc70c361a22feac57b031dd9c1f02f
SHA1 a9b4732260c2a323750022a73480f229ce25d46d
SHA512 19c0532741ebc9751390e6c5ca593a81493652f25c74c8cab29a8b5b1f1efef8d511254a04f50b0c4a20724bae10d96d52af7a76b0c85ddc5f020d4cac41100c
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 64B
SHA256 a7de5177c68a64bd48b36d49e2853799f4ebcfa8e4761f7cc472f333dc5f65cf
MD5 446dd1cf97eaba21cf14d03aebc79f27
SHA1 36e4cc7367e0c7b40f4a8ace272941ea46373799
SHA512 a6d754709f30b122112ae30e5ab22486393c5021d33da4d1304c061863d2e1e79e8aeb029cae61261bb77d0e7becd53a7b0106d6ea4368b4c302464e3d941cf7
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 64B
SHA256 a07d329eb9b4105ba442c89f7cfa0d7b263f9f0617e26df93cf8cdc8dc94d57b
MD5 a6c9d692ed2826ecb12c09356e69cc09
SHA1 def728a6138cf083d8a7c61337f3c9dade41a37f
SHA512 2f27d2b241ce34f988c39e17ca5a1ebe628ac6c1b8ee8df121db9ad8929eaadf5f24ad66457591cccf87e60d2ba2eab88af860ab9c323a5c2a9867045d6e7ba3
MD5 SHA1 SHA512

Submit Download

__PSScriptPolicyTest_4fm5lnl0.xqb.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_4fm5lnl0.xqb.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

c78b8c0a-dbb0-4255-9320-8506dc4bd05c.tmp.node

Path C:\Users\Admin\AppData\Local\Temp\c78b8c0a-dbb0-4255-9320-8506dc4bd05c.tmp.node
Size 663KB
SHA256 da0906c76db455d8000920dcac14f64a326841b17f0b1c86e43fae1f3c5720af
MD5 40ce1601e67dd498b9f14832f1cf2c41
SHA1 0ea248a66a4d72b2a0b183f71b6d4670bcced7ac
SHA512 c837ef13396ec77f854d84293713685fa01b42d770d38f88e8d445b3ff68c94444245a45a01ac5df0f7e8f2ae73a299f4542fc78add2aa9792f3f1c28fd46a42
SSDEEP 6144:SUsD4EfVIV6hKmpaYItaLYV0wBTbjoxBmp3FDsO3oS2CTyIfUo:abfVw6hBIVm0TbjoxeFAOBt
MD5 SHA1 SHA512 SSDEEP

Submit Download

ee74bbf8-7335-42c2-a90d-2dcd0b227402.tmp.node

Path C:\Users\Admin\AppData\Local\Temp\ee74bbf8-7335-42c2-a90d-2dcd0b227402.tmp.node
Size 1.8MB
SHA256 7fb52b781709b065c240b6b81394be6e72e53fe11d7c8e0f7b49dd417eb78a01
MD5 3072b68e3c226aff39e6782d025f25a8
SHA1 cf559196d74fa490ac8ce192db222c9f5c5a006a
SHA512 61ebc72c20195e99244d95af1ab44fa06201a1aee2b5da04490fdc4312e8324a40b0e15a7b42fab5179753d767c1d08ae1a7a56ac71a6e100e63f83db849ee61
SSDEEP 49152:B+m+ocH2xfpTOi8stmFlZwwpx8AzdWgl+06OHULH5dsGfl:ihCTOi8sQrZwwpxTbG9
MD5 SHA1 SHA512 SSDEEP

Submit Download

f3fdbd37-1387-4721-a148-9b58118a4f0f.tmp.node

Path C:\Users\Admin\AppData\Local\Temp\f3fdbd37-1387-4721-a148-9b58118a4f0f.tmp.node
Size 643KB
SHA256 44d3866ae7d598380638ec1cd3114d470c6c545234a069695f79eb41c71d4af1
MD5 8a6ab558fbc95a85e01ee691c6c17929
SHA1 b5eaa4c027a9ba3083a1c15a91af9426cb78dfb4
SHA512 4e6ed3af78de833632c3c23b6cfdbad9bf74dc6e3f23fba76fd1a39c5446f22720abf1ae0648f7f80b7795e02dd4fb8f90b839fc66b8d93edd24c4f75589b9f2
SSDEEP 6144:fYwDS9N+qVWUdofd85fOj0nFhAT/PAXir/eAqZfCbeuKOwGnkZ:fnDSvbWUafdEOj0nFhQPnhuy+G
MD5 SHA1 SHA512 SSDEEP

Submit Download

DarkAdventures.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\DarkAdventures.exe
Size 765KB
SHA256 a79d8c0b3254e6abe57dac5fc95bfe98b595bcce93f939796dedc50b26bc4061
MD5 0411ee397c313ea4bc2f61dfbbc8355a
SHA1 f505a0f109bd93027f0e366161e8e0d2ee4785af
SHA512 86cca797381135b033f87364c3dffcffc9c6c2ed8f68037705ae94ebb20b7a26b073e6b02e47d4ca95b5db906a116e2038870df87741d1d17d810b013bf22376
SSDEEP 3072:K5aXyidsSApppPpv5y7VHRL1yPH4xtgVP0weL/xIc6nAUKPXhesEtRpMnbk8kuko:KvJSAK11yPH4xtMVmehR+b7/78wH
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/864-14-0x00007FFEE5F80000-0x00007FFEE5F81000-memory.dmp

Download

memory/10780-32-0x000001C77B960000-0x000001C77B982000-memory.dmp

Download

memory/10780-39-0x00007FFEC4AD0000-0x00007FFEC5592000-memory.dmp

Download

memory/10780-33-0x00007FFEC4AD0000-0x00007FFEC5592000-memory.dmp

Download

memory/10780-34-0x000001C77B990000-0x000001C77B9A0000-memory.dmp

Download

memory/10780-35-0x000001C77B990000-0x000001C77B9A0000-memory.dmp

Download

memory/10948-193-0x000001D2D7B20000-0x000001D2D7B30000-memory.dmp

Download

memory/10948-199-0x00007FFEC4AD0000-0x00007FFEC5592000-memory.dmp

Download

memory/10948-186-0x000001D2D7B20000-0x000001D2D7B30000-memory.dmp

Download

memory/10948-187-0x000001D2D7B20000-0x000001D2D7B30000-memory.dmp

Download

memory/10948-185-0x00007FFEC4AD0000-0x00007FFEC5592000-memory.dmp

Download

memory/10972-53-0x00000166F29A0000-0x00000166F29B0000-memory.dmp

Download

memory/10972-56-0x00007FFEC4AD0000-0x00007FFEC5592000-memory.dmp

Download

memory/10972-42-0x00007FFEC4AD0000-0x00007FFEC5592000-memory.dmp

Download

memory/10972-43-0x00000166F29A0000-0x00000166F29B0000-memory.dmp

Download

memory/11044-167-0x000001F272480000-0x000001F272490000-memory.dmp

Download

memory/11044-166-0x000001F272480000-0x000001F272490000-memory.dmp

Download

memory/11044-165-0x000001F272480000-0x000001F272490000-memory.dmp

Download

memory/11044-170-0x00007FFEC4AD0000-0x00007FFEC5592000-memory.dmp

Download

memory/11044-164-0x00007FFEC4AD0000-0x00007FFEC5592000-memory.dmp

Download