1a19a5c6ffb9e34367e8f6cebc6673468a0c75250fc902d9b544fdae32b98e1d

Resubmissions

16/04/2026, 12:15

260416-pe99sset8q

04/11/2025, 16:02

251104-tg942avnel10

16/10/2025, 19:27

251016-x6bvbael8y7

Analysis

max time kernel
149s
max time network
104s
platform
windows11-21h2_x64
resource
win11-20250619-en
resource tags

arch:x64arch:x86image:win11-20250619-enlocale:en-usos:windows11-21h2-x64system
submitted
16/10/2025, 19:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
image-logger.exe
Size 86.3MB
Sample251016-x6bvbael8y
SHA256 1a19a5c6ffb9e34367e8f6cebc6673468a0c75250fc902d9b544fdae32b98e1d
MD5 79f32aaf7a5427ae9286c77a3252dc24
SHA1 85fa421c1d8852a36f734145feef63a51a892ffa
SHA512 7708bd4c8763b35a4fc4ebcc77cebc0d91f587b84340fcea0fa7d3312eb673d71b3ef68531a0ff8d2ffb089a793b2cd73ea80cb591fd4c0b3392df4e1bc41f94
SSDEEP 1572864:b4gPXMoEYeM9tiDeciHJazEOTtWvjXg2PLY6DRl+CGuA0bSQOYn1rRj:b4AcZswSHJaX5yg2Pc6DRD/b3zj
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

discovery execution persistence spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
2416	Wizard Xray.exe
4656	Wizard Xray.exe
5156	Wizard Xray.exe
4228	image-logger.exe
1204	image-logger.exe
3516	Wizard Xray.exe
5816	Wizard Xray.exe
5680	Wizard Xray.exe
1916	Wizard Xray.exe
2884	Wizard Xray.exe
2448	Wizard Xray.exe

Loads dropped DLL 39 IoCs

pid	Process
5748	image-logger.exe
5748	image-logger.exe
5748	image-logger.exe
2416	Wizard Xray.exe
2416	Wizard Xray.exe
2416	Wizard Xray.exe
2416	Wizard Xray.exe
5156	Wizard Xray.exe
4656	Wizard Xray.exe
4656	Wizard Xray.exe
4656	Wizard Xray.exe
4656	Wizard Xray.exe
4656	Wizard Xray.exe
4228	image-logger.exe
4228	image-logger.exe
1204	image-logger.exe
1204	image-logger.exe
4228	image-logger.exe
3516	Wizard Xray.exe
3516	Wizard Xray.exe
3516	Wizard Xray.exe
3516	Wizard Xray.exe
5816	Wizard Xray.exe
5680	Wizard Xray.exe
5816	Wizard Xray.exe
5816	Wizard Xray.exe
5816	Wizard Xray.exe
5816	Wizard Xray.exe
1204	image-logger.exe
1916	Wizard Xray.exe
1916	Wizard Xray.exe
1916	Wizard Xray.exe
1916	Wizard Xray.exe
2884	Wizard Xray.exe
2448	Wizard Xray.exe
2884	Wizard Xray.exe
2884	Wizard Xray.exe
2884	Wizard Xray.exe
2884	Wizard Xray.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1418876453-2228697459-2788511057-1000\Software\Microsoft\Windows\CurrentVersion\Run\Windows_Health_Courtage_vpfqar = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\CachedFiles\\image-logger.exe"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1418876453-2228697459-2788511057-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\Windows_Health_Courtage_vpfqar = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\CachedFiles\\image-logger.exe"	reg.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 22 IoCs

Web Service

T1102

flow	ioc
58	raw.githubusercontent.com
63	raw.githubusercontent.com
9	raw.githubusercontent.com
48	raw.githubusercontent.com
49	raw.githubusercontent.com
68	raw.githubusercontent.com
24	raw.githubusercontent.com
27	raw.githubusercontent.com
46	raw.githubusercontent.com
47	raw.githubusercontent.com
51	raw.githubusercontent.com
64	raw.githubusercontent.com
65	raw.githubusercontent.com
66	raw.githubusercontent.com
23	raw.githubusercontent.com
25	raw.githubusercontent.com
50	raw.githubusercontent.com
67	raw.githubusercontent.com
2	raw.githubusercontent.com
26	raw.githubusercontent.com
28	raw.githubusercontent.com
35	raw.githubusercontent.com

Looks up external IP address via web service 21 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
43	ipinfo.io
54	ipinfo.io
33	ipinfo.io
41	ipinfo.io
45	ipinfo.io
55	ipinfo.io
56	ipinfo.io
4	ipinfo.io
14	ipinfo.io
15	ipinfo.io
16	ipinfo.io
20	ipinfo.io
22	ipinfo.io
31	ipinfo.io
32	ipinfo.io
6	ipinfo.io
42	ipinfo.io
44	ipinfo.io
62	ipinfo.io
2	ipinfo.io
5	ipinfo.io

Command and Scripting Interpreter: PowerShell 1 TTPs 31 IoCs

Run Powershell to get system information.

execution

PowerShell

T1059.001

pid	Process
3052	powershell.exe
3064	powershell.exe
1120	powershell.exe
2292	powershell.exe
1708	powershell.exe
5724	powershell.exe
5204	powershell.exe
5164	powershell.exe
5756	powershell.exe
1356	powershell.exe
3264	powershell.exe
4708	powershell.exe
1428	powershell.exe
5212	powershell.exe
1544	powershell.exe
6060	powershell.exe
3148	powershell.exe
2816	powershell.exe
4216	powershell.exe
1268	powershell.exe
3464	powershell.exe
5356	powershell.exe
1040	powershell.exe
3868	powershell.exe
4892	powershell.exe
468	powershell.exe
436	powershell.exe
3968	powershell.exe
1908	powershell.exe
252	powershell.exe
1112	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	image-logger.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	image-logger.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	image-logger.exe

Checks processor information in registry 2 TTPs 21 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2	Wizard Xray.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	Wizard Xray.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Wizard Xray.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Wizard Xray.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	Wizard Xray.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Wizard Xray.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString	Wizard Xray.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Wizard Xray.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz	Wizard Xray.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString	Wizard Xray.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	Wizard Xray.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	Wizard Xray.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz	Wizard Xray.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString	Wizard Xray.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2	Wizard Xray.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	Wizard Xray.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2	Wizard Xray.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	Wizard Xray.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Wizard Xray.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Wizard Xray.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz	Wizard Xray.exe

Detects videocard installed 1 TTPs 5 IoCs

Uses WMIC.exe to determine videocard installed.

System Information Discovery

T1082

pid	Process
1752	WMIC.exe
1824	WMIC.exe
1380	WMIC.exe
1408	WMIC.exe
2956	WMIC.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2304	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5756	powershell.exe
5756	powershell.exe
4216	powershell.exe
4216	powershell.exe
5788	powershell.exe
5788	powershell.exe
1356	powershell.exe
1356	powershell.exe
436	powershell.exe
436	powershell.exe
3968	powershell.exe
3968	powershell.exe
4688	powershell.exe
4688	powershell.exe
1268	powershell.exe
1268	powershell.exe
5756	powershell.exe
5756	powershell.exe
4688	powershell.exe
4216	powershell.exe
4216	powershell.exe
3968	powershell.exe
5788	powershell.exe
1356	powershell.exe
436	powershell.exe
436	powershell.exe
1268	powershell.exe
1268	powershell.exe
3464	powershell.exe
3464	powershell.exe
1708	powershell.exe
1708	powershell.exe
5356	powershell.exe
5356	powershell.exe
3052	powershell.exe
3052	powershell.exe
5272	powershell.exe
3980	powershell.exe
3980	powershell.exe
5272	powershell.exe
3264	powershell.exe
3264	powershell.exe
1040	powershell.exe
1040	powershell.exe
3464	powershell.exe
5272	powershell.exe
5356	powershell.exe
1708	powershell.exe
3052	powershell.exe
1040	powershell.exe
3264	powershell.exe
3980	powershell.exe
3868	powershell.exe
3868	powershell.exe
3868	powershell.exe
2416	Wizard Xray.exe
2416	Wizard Xray.exe
2416	Wizard Xray.exe
2416	Wizard Xray.exe
1156	powershell.exe
1156	powershell.exe
4892	powershell.exe
4892	powershell.exe
2424	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeSecurityPrivilege	5748	image-logger.exe
Token: SeIncreaseQuotaPrivilege	2116	WMIC.exe
Token: SeSecurityPrivilege	2116	WMIC.exe
Token: SeTakeOwnershipPrivilege	2116	WMIC.exe
Token: SeLoadDriverPrivilege	2116	WMIC.exe
Token: SeSystemProfilePrivilege	2116	WMIC.exe
Token: SeSystemtimePrivilege	2116	WMIC.exe
Token: SeProfSingleProcessPrivilege	2116	WMIC.exe
Token: SeIncBasePriorityPrivilege	2116	WMIC.exe
Token: SeCreatePagefilePrivilege	2116	WMIC.exe
Token: SeBackupPrivilege	2116	WMIC.exe
Token: SeRestorePrivilege	2116	WMIC.exe
Token: SeShutdownPrivilege	2116	WMIC.exe
Token: SeDebugPrivilege	2116	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2116	WMIC.exe
Token: SeRemoteShutdownPrivilege	2116	WMIC.exe
Token: SeUndockPrivilege	2116	WMIC.exe
Token: SeManageVolumePrivilege	2116	WMIC.exe
Token: 33	2116	WMIC.exe
Token: 34	2116	WMIC.exe
Token: 35	2116	WMIC.exe
Token: 36	2116	WMIC.exe
Token: SeIncreaseQuotaPrivilege	1752	WMIC.exe
Token: SeSecurityPrivilege	1752	WMIC.exe
Token: SeTakeOwnershipPrivilege	1752	WMIC.exe
Token: SeLoadDriverPrivilege	1752	WMIC.exe
Token: SeSystemProfilePrivilege	1752	WMIC.exe
Token: SeSystemtimePrivilege	1752	WMIC.exe
Token: SeProfSingleProcessPrivilege	1752	WMIC.exe
Token: SeIncBasePriorityPrivilege	1752	WMIC.exe
Token: SeCreatePagefilePrivilege	1752	WMIC.exe
Token: SeBackupPrivilege	1752	WMIC.exe
Token: SeRestorePrivilege	1752	WMIC.exe
Token: SeShutdownPrivilege	1752	WMIC.exe
Token: SeDebugPrivilege	1752	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1752	WMIC.exe
Token: SeRemoteShutdownPrivilege	1752	WMIC.exe
Token: SeUndockPrivilege	1752	WMIC.exe
Token: SeManageVolumePrivilege	1752	WMIC.exe
Token: 33	1752	WMIC.exe
Token: 34	1752	WMIC.exe
Token: 35	1752	WMIC.exe
Token: 36	1752	WMIC.exe
Token: SeDebugPrivilege	5756	powershell.exe
Token: SeDebugPrivilege	4216	powershell.exe
Token: SeIncreaseQuotaPrivilege	1156	WMIC.exe
Token: SeSecurityPrivilege	1156	WMIC.exe
Token: SeTakeOwnershipPrivilege	1156	WMIC.exe
Token: SeLoadDriverPrivilege	1156	WMIC.exe
Token: SeSystemProfilePrivilege	1156	WMIC.exe
Token: SeSystemtimePrivilege	1156	WMIC.exe
Token: SeProfSingleProcessPrivilege	1156	WMIC.exe
Token: SeIncBasePriorityPrivilege	1156	WMIC.exe
Token: SeCreatePagefilePrivilege	1156	WMIC.exe
Token: SeBackupPrivilege	1156	WMIC.exe
Token: SeRestorePrivilege	1156	WMIC.exe
Token: SeShutdownPrivilege	1156	WMIC.exe
Token: SeDebugPrivilege	1156	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1156	WMIC.exe
Token: SeRemoteShutdownPrivilege	1156	WMIC.exe
Token: SeUndockPrivilege	1156	WMIC.exe
Token: SeManageVolumePrivilege	1156	WMIC.exe
Token: 33	1156	WMIC.exe
Token: 34	1156	WMIC.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5748 wrote to memory of 2416	5748	image-logger.exe	79
PID 5748 wrote to memory of 2416	5748	image-logger.exe	79
PID 2416 wrote to memory of 6000	2416	Wizard Xray.exe	80
PID 2416 wrote to memory of 6000	2416	Wizard Xray.exe	80
PID 2416 wrote to memory of 5836	2416	Wizard Xray.exe	81
PID 2416 wrote to memory of 5836	2416	Wizard Xray.exe	81
PID 2416 wrote to memory of 1020	2416	Wizard Xray.exe	82
PID 2416 wrote to memory of 1020	2416	Wizard Xray.exe	82
PID 2416 wrote to memory of 5776	2416	Wizard Xray.exe	84
PID 2416 wrote to memory of 5776	2416	Wizard Xray.exe	84
PID 2416 wrote to memory of 5876	2416	Wizard Xray.exe	86
PID 2416 wrote to memory of 5876	2416	Wizard Xray.exe	86
PID 2416 wrote to memory of 6060	2416	Wizard Xray.exe	87
PID 2416 wrote to memory of 6060	2416	Wizard Xray.exe	87
PID 2416 wrote to memory of 6016	2416	Wizard Xray.exe	89
PID 2416 wrote to memory of 6016	2416	Wizard Xray.exe	89
PID 2416 wrote to memory of 1476	2416	Wizard Xray.exe	90
PID 2416 wrote to memory of 1476	2416	Wizard Xray.exe	90
PID 2416 wrote to memory of 1544	2416	Wizard Xray.exe	91
PID 2416 wrote to memory of 1544	2416	Wizard Xray.exe	91
PID 2416 wrote to memory of 3332	2416	Wizard Xray.exe	92
PID 2416 wrote to memory of 3332	2416	Wizard Xray.exe	92
PID 2416 wrote to memory of 4824	2416	Wizard Xray.exe	94
PID 2416 wrote to memory of 4824	2416	Wizard Xray.exe	94
PID 2416 wrote to memory of 4812	2416	Wizard Xray.exe	100
PID 2416 wrote to memory of 4812	2416	Wizard Xray.exe	100
PID 1020 wrote to memory of 2116	1020	cmd.exe	104
PID 1020 wrote to memory of 2116	1020	cmd.exe	104
PID 1020 wrote to memory of 4728	1020	cmd.exe	105
PID 1020 wrote to memory of 4728	1020	cmd.exe	105
PID 3332 wrote to memory of 5756	3332	cmd.exe	106
PID 3332 wrote to memory of 5756	3332	cmd.exe	106
PID 5836 wrote to memory of 3968	5836	cmd.exe	107
PID 5836 wrote to memory of 3968	5836	cmd.exe	107
PID 5876 wrote to memory of 1752	5876	cmd.exe	108
PID 5876 wrote to memory of 1752	5876	cmd.exe	108
PID 5876 wrote to memory of 672	5876	cmd.exe	109
PID 5876 wrote to memory of 672	5876	cmd.exe	109
PID 6000 wrote to memory of 436	6000	cmd.exe	110
PID 6000 wrote to memory of 436	6000	cmd.exe	110
PID 1544 wrote to memory of 4216	1544	cmd.exe	111
PID 1544 wrote to memory of 4216	1544	cmd.exe	111
PID 6060 wrote to memory of 5788	6060	cmd.exe	112
PID 6060 wrote to memory of 5788	6060	cmd.exe	112
PID 1476 wrote to memory of 1356	1476	cmd.exe	113
PID 1476 wrote to memory of 1356	1476	cmd.exe	113
PID 5776 wrote to memory of 1156	5776	cmd.exe	114
PID 5776 wrote to memory of 1156	5776	cmd.exe	114
PID 4812 wrote to memory of 408	4812	cmd.exe	115
PID 4812 wrote to memory of 408	4812	cmd.exe	115
PID 5776 wrote to memory of 5480	5776	cmd.exe	116
PID 5776 wrote to memory of 5480	5776	cmd.exe	116
PID 6016 wrote to memory of 4688	6016	cmd.exe	117
PID 6016 wrote to memory of 4688	6016	cmd.exe	117
PID 4824 wrote to memory of 1268	4824	cmd.exe	118
PID 4824 wrote to memory of 1268	4824	cmd.exe	118
PID 2416 wrote to memory of 4480	2416	Wizard Xray.exe	120
PID 2416 wrote to memory of 4480	2416	Wizard Xray.exe	120
PID 2416 wrote to memory of 4656	2416	Wizard Xray.exe	122
PID 2416 wrote to memory of 4656	2416	Wizard Xray.exe	122
PID 2416 wrote to memory of 4656	2416	Wizard Xray.exe	122
PID 2416 wrote to memory of 4656	2416	Wizard Xray.exe	122
PID 2416 wrote to memory of 4656	2416	Wizard Xray.exe	122
PID 2416 wrote to memory of 4656	2416	Wizard Xray.exe	122

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\image-logger.exe
"C:\Users\Admin\AppData\Local\Temp\image-logger.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5748
- C:\Users\Admin\AppData\Local\Temp\33mjIOzheS8hRaStaTH7KnxLnZv\Wizard Xray.exe
  "C:\Users\Admin\AppData\Local\Temp\33mjIOzheS8hRaStaTH7KnxLnZv\Wizard Xray.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2416
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "Get-PSDrive -Name C | Select-Object Used, Free | ConvertTo-Json""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:6000
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -Command "Get-PSDrive -Name C | Select-Object Used, Free | ConvertTo-Json"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:436
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell -Command "Get-CimInstance -Class Win32_ComputerSystemProduct | Select-Object -ExpandProperty UUID""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5836
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Get-CimInstance -Class Win32_ComputerSystemProduct | Select-Object -ExpandProperty UUID"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:3968
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "wmic OS get caption, osarchitecture | more +1"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1020
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic OS get caption, osarchitecture
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:2116
  - - C:\Windows\system32\more.com
      more +1
      4⤵
      PID:4728
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "wmic cpu get name | more +1"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5776
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic cpu get name
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:1156
  - - C:\Windows\system32\more.com
      more +1
      4⤵
      PID:5480
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "wmic PATH Win32_VideoController get name | more +1"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5876
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic PATH Win32_VideoController get name
      4⤵
      Detects videocard installed
      Suspicious use of AdjustPrivilegeToken
      PID:1752
  - - C:\Windows\system32\more.com
      more +1
      4⤵
      PID:672
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\SoftwareProtectionPlatform' -Name BackupProductKeyDefault"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:6060
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\SoftwareProtectionPlatform' -Name BackupProductKeyDefault
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:5788
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion' -Name ProductName"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:6016
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion' -Name ProductName
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:4688
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell -Command "(Get-CimInstance -ClassName Win32_ComputerSystem).Model""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1476
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "(Get-CimInstance -ClassName Win32_ComputerSystem).Model"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:1356
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell -Command "Get-NetAdapter | Where-Object { $_.Status -eq 'Up' } | Select-Object -ExpandProperty Name""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1544
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Get-NetAdapter | Where-Object { $_.Status -eq 'Up' } | Select-Object -ExpandProperty Name"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4216
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell -Command "(Get-CimInstance -ClassName Win32_BaseBoard).Product""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3332
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "(Get-CimInstance -ClassName Win32_BaseBoard).Product"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:5756
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell -Command "Get-CimInstance -Class Win32_BIOS | Select-Object -ExpandProperty SMBIOSBIOSVersion""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4824
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Get-CimInstance -Class Win32_BIOS | Select-Object -ExpandProperty SMBIOSBIOSVersion"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:1268
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "reg query "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "Wizard Xray""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4812
  - - C:\Windows\system32\reg.exe
      reg query "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "Wizard Xray"
      4⤵
      PID:408
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v Wizard Xray /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\33mjIOzheS8hRaStaTH7KnxLnZv\Wizard Xray.exe" /f"
    3⤵
    PID:4480
  - - C:\Windows\system32\reg.exe
      reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v Wizard Xray /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\33mjIOzheS8hRaStaTH7KnxLnZv\Wizard Xray.exe" /f
      4⤵
      PID:5224
- - C:\Users\Admin\AppData\Local\Temp\33mjIOzheS8hRaStaTH7KnxLnZv\Wizard Xray.exe
    "C:\Users\Admin\AppData\Local\Temp\33mjIOzheS8hRaStaTH7KnxLnZv\Wizard Xray.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\aplazase" --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=2096 --field-trial-handle=2100,i,10984390248470479452,17891583596748266929,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:4656
- - C:\Users\Admin\AppData\Local\Temp\33mjIOzheS8hRaStaTH7KnxLnZv\Wizard Xray.exe
    "C:\Users\Admin\AppData\Local\Temp\33mjIOzheS8hRaStaTH7KnxLnZv\Wizard Xray.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\aplazase" --mojo-platform-channel-handle=2296 --field-trial-handle=2100,i,10984390248470479452,17891583596748266929,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand /prefetch:8
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:5156
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "Get-PSDrive -Name C | Select-Object Used, Free | ConvertTo-Json""
    3⤵
    PID:3908
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -Command "Get-PSDrive -Name C | Select-Object Used, Free | ConvertTo-Json"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:1040
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell -Command "Get-CimInstance -Class Win32_ComputerSystemProduct | Select-Object -ExpandProperty UUID""
    3⤵
    PID:960
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Get-CimInstance -Class Win32_ComputerSystemProduct | Select-Object -ExpandProperty UUID"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:3464
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "wmic OS get caption, osarchitecture | more +1"
    3⤵
    PID:3860
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic OS get caption, osarchitecture
      4⤵
      PID:5700
  - - C:\Windows\system32\more.com
      more +1
      4⤵
      PID:5832
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "wmic cpu get name | more +1"
    3⤵
    PID:5888
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic cpu get name
      4⤵
      PID:2752
  - - C:\Windows\system32\more.com
      more +1
      4⤵
      PID:4696
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "wmic PATH Win32_VideoController get name | more +1"
    3⤵
    PID:3288
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic PATH Win32_VideoController get name
      4⤵
      Detects videocard installed
      PID:1824
  - - C:\Windows\system32\more.com
      more +1
      4⤵
      PID:3152
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\SoftwareProtectionPlatform' -Name BackupProductKeyDefault"
    3⤵
    PID:2192
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\SoftwareProtectionPlatform' -Name BackupProductKeyDefault
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:5272
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion' -Name ProductName"
    3⤵
    PID:3440
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion' -Name ProductName
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:3980
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell -Command "(Get-CimInstance -ClassName Win32_ComputerSystem).Model""
    3⤵
    PID:4440
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "(Get-CimInstance -ClassName Win32_ComputerSystem).Model"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:1708
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell -Command "Get-NetAdapter | Where-Object { $_.Status -eq 'Up' } | Select-Object -ExpandProperty Name""
    3⤵
    PID:1244
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Get-NetAdapter | Where-Object { $_.Status -eq 'Up' } | Select-Object -ExpandProperty Name"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:5356
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell -Command "(Get-CimInstance -ClassName Win32_BaseBoard).Product""
    3⤵
    PID:5472
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "(Get-CimInstance -ClassName Win32_BaseBoard).Product"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:3052
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell -Command "Get-CimInstance -Class Win32_BIOS | Select-Object -ExpandProperty SMBIOSBIOSVersion""
    3⤵
    PID:3180
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Get-CimInstance -Class Win32_BIOS | Select-Object -ExpandProperty SMBIOSBIOSVersion"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:3264
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v Windows_Health_Courtage_vpfqar /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\image-logger.exe" /f"
    3⤵
    PID:5364
  - - C:\Windows\system32\reg.exe
      reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v Windows_Health_Courtage_vpfqar /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\image-logger.exe" /f
      4⤵
      Adds Run key to start application
      PID:3572
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v Windows_Health_Courtage_vpfqar /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\image-logger.exe" /f"
    3⤵
    PID:1972
  - - C:\Windows\system32\reg.exe
      reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v Windows_Health_Courtage_vpfqar /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\image-logger.exe" /f
      4⤵
      Adds Run key to start application
      PID:2576
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell -Command "$Action = New-ScheduledTaskAction -Execute 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\image-logger.exe' $Trigger = New-ScheduledTaskTrigger -Daily -At '12:00PM' Register-ScheduledTask -Action $Action -Trigger $Trigger -TaskName 'DailySystemUpdate_wklddl' -Force""
    3⤵
    PID:4920
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "$Action = New-ScheduledTaskAction -Execute 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\image-logger.exe'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:3868
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "cmd /c schtasks /create /sc onlogon /tn WindowsDriverSetupwm87y /tr \"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\image-logger.exe\" /F /rl highest"
    3⤵
    PID:2760
  - - C:\Windows\system32\cmd.exe
      cmd /c schtasks /create /sc onlogon /tn WindowsDriverSetupwm87y /tr \"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\image-logger.exe\" /F /rl highest
      4⤵
      PID:4220
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /create /sc onlogon /tn WindowsDriverSetupwm87y /tr \"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\image-logger.exe\" /F /rl highest
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2304

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\image-logger.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\image-logger.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:4228
- C:\Users\Admin\AppData\Local\Temp\33mjIOzheS8hRaStaTH7KnxLnZv\Wizard Xray.exe
  "C:\Users\Admin\AppData\Local\Temp\33mjIOzheS8hRaStaTH7KnxLnZv\Wizard Xray.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Checks processor information in registry
  PID:3516
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "Get-PSDrive -Name C | Select-Object Used, Free | ConvertTo-Json""
    3⤵
    PID:5332
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -Command "Get-PSDrive -Name C | Select-Object Used, Free | ConvertTo-Json"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:4708
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell -Command "Get-CimInstance -Class Win32_ComputerSystemProduct | Select-Object -ExpandProperty UUID""
    3⤵
    PID:3940
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Get-CimInstance -Class Win32_ComputerSystemProduct | Select-Object -ExpandProperty UUID"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:4892
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "wmic OS get caption, osarchitecture | more +1"
    3⤵
    PID:1404
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic OS get caption, osarchitecture
      4⤵
      PID:3772
  - - C:\Windows\system32\more.com
      more +1
      4⤵
      PID:4304
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "wmic cpu get name | more +1"
    3⤵
    PID:4560
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic cpu get name
      4⤵
      PID:3684
  - - C:\Windows\system32\more.com
      more +1
      4⤵
      PID:1880
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "wmic PATH Win32_VideoController get name | more +1"
    3⤵
    PID:6092
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic PATH Win32_VideoController get name
      4⤵
      Detects videocard installed
      PID:1380
  - - C:\Windows\system32\more.com
      more +1
      4⤵
      PID:5796
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\SoftwareProtectionPlatform' -Name BackupProductKeyDefault"
    3⤵
    PID:6072
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\SoftwareProtectionPlatform' -Name BackupProductKeyDefault
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:2424
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion' -Name ProductName"
    3⤵
    PID:3136
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion' -Name ProductName
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:1156
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell -Command "(Get-CimInstance -ClassName Win32_ComputerSystem).Model""
    3⤵
    PID:4872
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "(Get-CimInstance -ClassName Win32_ComputerSystem).Model"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:5724
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell -Command "Get-NetAdapter | Where-Object { $_.Status -eq 'Up' } | Select-Object -ExpandProperty Name""
    3⤵
    PID:5364
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Get-NetAdapter | Where-Object { $_.Status -eq 'Up' } | Select-Object -ExpandProperty Name"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:1428
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell -Command "(Get-CimInstance -ClassName Win32_BaseBoard).Product""
    3⤵
    PID:5136
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "(Get-CimInstance -ClassName Win32_BaseBoard).Product"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:3064
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell -Command "Get-CimInstance -Class Win32_BIOS | Select-Object -ExpandProperty SMBIOSBIOSVersion""
    3⤵
    PID:2920
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Get-CimInstance -Class Win32_BIOS | Select-Object -ExpandProperty SMBIOSBIOSVersion"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:468
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "reg query "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "Wizard Xray""
    3⤵
    PID:3592
  - - C:\Windows\system32\reg.exe
      reg query "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "Wizard Xray"
      4⤵
      PID:2616
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v Wizard Xray /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\33mjIOzheS8hRaStaTH7KnxLnZv\Wizard Xray.exe" /f"
    3⤵
    PID:716
  - - C:\Windows\system32\reg.exe
      reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v Wizard Xray /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\33mjIOzheS8hRaStaTH7KnxLnZv\Wizard Xray.exe" /f
      4⤵
      PID:5700
- - C:\Users\Admin\AppData\Local\Temp\33mjIOzheS8hRaStaTH7KnxLnZv\Wizard Xray.exe
    "C:\Users\Admin\AppData\Local\Temp\33mjIOzheS8hRaStaTH7KnxLnZv\Wizard Xray.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\aplazase" --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=2496 --field-trial-handle=2500,i,5308024239855619619,4003656961568761545,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:5816
- - C:\Users\Admin\AppData\Local\Temp\33mjIOzheS8hRaStaTH7KnxLnZv\Wizard Xray.exe
    "C:\Users\Admin\AppData\Local\Temp\33mjIOzheS8hRaStaTH7KnxLnZv\Wizard Xray.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\aplazase" --mojo-platform-channel-handle=2664 --field-trial-handle=2500,i,5308024239855619619,4003656961568761545,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand /prefetch:8
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:5680
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "Get-PSDrive -Name C | Select-Object Used, Free | ConvertTo-Json""
    3⤵
    PID:2476
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -Command "Get-PSDrive -Name C | Select-Object Used, Free | ConvertTo-Json"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:252
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell -Command "Get-CimInstance -Class Win32_ComputerSystemProduct | Select-Object -ExpandProperty UUID""
    3⤵
    PID:1072
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Get-CimInstance -Class Win32_ComputerSystemProduct | Select-Object -ExpandProperty UUID"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:1908
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "wmic OS get caption, osarchitecture | more +1"
    3⤵
    PID:2484
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic OS get caption, osarchitecture
      4⤵
      PID:5896
  - - C:\Windows\system32\more.com
      more +1
      4⤵
      PID:564
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "wmic cpu get name | more +1"
    3⤵
    PID:4492
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic cpu get name
      4⤵
      PID:1020
  - - C:\Windows\system32\more.com
      more +1
      4⤵
      PID:3004
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "wmic PATH Win32_VideoController get name | more +1"
    3⤵
    PID:984
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic PATH Win32_VideoController get name
      4⤵
      Detects videocard installed
      PID:1408
  - - C:\Windows\system32\more.com
      more +1
      4⤵
      PID:4828
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\SoftwareProtectionPlatform' -Name BackupProductKeyDefault"
    3⤵
    PID:696
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\SoftwareProtectionPlatform' -Name BackupProductKeyDefault
      4⤵
      PID:4100
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion' -Name ProductName"
    3⤵
    PID:808
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion' -Name ProductName
      4⤵
      PID:1576
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell -Command "(Get-CimInstance -ClassName Win32_ComputerSystem).Model""
    3⤵
    PID:4132
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "(Get-CimInstance -ClassName Win32_ComputerSystem).Model"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:5204
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell -Command "Get-NetAdapter | Where-Object { $_.Status -eq 'Up' } | Select-Object -ExpandProperty Name""
    3⤵
    PID:5268
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Get-NetAdapter | Where-Object { $_.Status -eq 'Up' } | Select-Object -ExpandProperty Name"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:5212
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell -Command "(Get-CimInstance -ClassName Win32_BaseBoard).Product""
    3⤵
    PID:4392
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "(Get-CimInstance -ClassName Win32_BaseBoard).Product"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:1120
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell -Command "Get-CimInstance -Class Win32_BIOS | Select-Object -ExpandProperty SMBIOSBIOSVersion""
    3⤵
    PID:3040
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Get-CimInstance -Class Win32_BIOS | Select-Object -ExpandProperty SMBIOSBIOSVersion"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:1544

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\image-logger.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\image-logger.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1204
- C:\Users\Admin\AppData\Local\Temp\33mjIOzheS8hRaStaTH7KnxLnZv\Wizard Xray.exe
  "C:\Users\Admin\AppData\Local\Temp\33mjIOzheS8hRaStaTH7KnxLnZv\Wizard Xray.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Checks processor information in registry
  PID:1916
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "Get-PSDrive -Name C | Select-Object Used, Free | ConvertTo-Json""
    3⤵
    PID:4412
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:1576
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -Command "Get-PSDrive -Name C | Select-Object Used, Free | ConvertTo-Json"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:3148
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell -Command "Get-CimInstance -Class Win32_ComputerSystemProduct | Select-Object -ExpandProperty UUID""
    3⤵
    PID:5340
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:696
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Get-CimInstance -Class Win32_ComputerSystemProduct | Select-Object -ExpandProperty UUID"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:1112
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "wmic OS get caption, osarchitecture | more +1"
    3⤵
    PID:2476
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:252
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic OS get caption, osarchitecture
      4⤵
      PID:2944
  - - C:\Windows\system32\more.com
      more +1
      4⤵
      PID:2208
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "wmic cpu get name | more +1"
    3⤵
    PID:4132
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic cpu get name
      4⤵
      PID:5768
  - - C:\Windows\system32\more.com
      more +1
      4⤵
      PID:6020
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "wmic PATH Win32_VideoController get name | more +1"
    3⤵
    PID:3040
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic PATH Win32_VideoController get name
      4⤵
      Detects videocard installed
      PID:2956
  - - C:\Windows\system32\more.com
      more +1
      4⤵
      PID:5468
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\SoftwareProtectionPlatform' -Name BackupProductKeyDefault"
    3⤵
    PID:5960
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\SoftwareProtectionPlatform' -Name BackupProductKeyDefault
      4⤵
      PID:1708
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion' -Name ProductName"
    3⤵
    PID:4852
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion' -Name ProductName
      4⤵
      PID:4500
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell -Command "(Get-CimInstance -ClassName Win32_ComputerSystem).Model""
    3⤵
    PID:1908
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "(Get-CimInstance -ClassName Win32_ComputerSystem).Model"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:5164
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell -Command "Get-NetAdapter | Where-Object { $_.Status -eq 'Up' } | Select-Object -ExpandProperty Name""
    3⤵
    PID:5308
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Get-NetAdapter | Where-Object { $_.Status -eq 'Up' } | Select-Object -ExpandProperty Name"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:2816
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell -Command "(Get-CimInstance -ClassName Win32_BaseBoard).Product""
    3⤵
    PID:348
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "(Get-CimInstance -ClassName Win32_BaseBoard).Product"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:2292
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell -Command "Get-CimInstance -Class Win32_BIOS | Select-Object -ExpandProperty SMBIOSBIOSVersion""
    3⤵
    PID:4812
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Get-CimInstance -Class Win32_BIOS | Select-Object -ExpandProperty SMBIOSBIOSVersion"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:6060
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "reg query "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "Wizard Xray""
    3⤵
    PID:5888
  - - C:\Windows\system32\reg.exe
      reg query "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "Wizard Xray"
      4⤵
      PID:2900
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v Wizard Xray /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\33mjIOzheS8hRaStaTH7KnxLnZv\Wizard Xray.exe" /f"
    3⤵
    PID:1540
  - - C:\Windows\system32\reg.exe
      reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v Wizard Xray /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\33mjIOzheS8hRaStaTH7KnxLnZv\Wizard Xray.exe" /f
      4⤵
      PID:4492
- - C:\Users\Admin\AppData\Local\Temp\33mjIOzheS8hRaStaTH7KnxLnZv\Wizard Xray.exe
    "C:\Users\Admin\AppData\Local\Temp\33mjIOzheS8hRaStaTH7KnxLnZv\Wizard Xray.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\aplazase" --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=2328 --field-trial-handle=2332,i,8847043156294359500,10833494953977476576,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:2884
- - C:\Users\Admin\AppData\Local\Temp\33mjIOzheS8hRaStaTH7KnxLnZv\Wizard Xray.exe
    "C:\Users\Admin\AppData\Local\Temp\33mjIOzheS8hRaStaTH7KnxLnZv\Wizard Xray.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\aplazase" --mojo-platform-channel-handle=2480 --field-trial-handle=2332,i,8847043156294359500,10833494953977476576,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand /prefetch:8
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:2448

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...