1d7888d4cc9c9ca665f8393ffb0bfa1c9a5011da61d35d8d2bcda24342dbb758

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1919182765-2457925700-1517026611-1000\Control Panel\International\Geo\Nation	Test.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1919182765-2457925700-1517026611-1000\Control Panel\International\Geo\Nation	Test.exe

Executes dropped EXE 3 IoCs

pid	Process
1444	Test.exe
7016	Test.exe
7076	decryptor.exe

Loads dropped DLL 5 IoCs

pid	Process
4624	Test.exe
4624	Test.exe
1536	Test.exe
1536	Test.exe
4624	Test.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1919182765-2457925700-1517026611-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Test = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Test.exe"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1919182765-2457925700-1517026611-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows_Health_Courtage_25d4i5 = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\CachedFiles\\Test.exe"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1919182765-2457925700-1517026611-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Windows_Health_Courtage_25d4i5 = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\CachedFiles\\Test.exe"	reg.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 33 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
4320	powershell.exe
5784	powershell.exe
2744	powershell.exe
4684	powershell.exe
3100	powershell.exe
2836	powershell.exe
2800	powershell.exe
2108	powershell.exe
1908	powershell.exe
4248	powershell.exe
4208	powershell.exe
3296	powershell.exe
3612	powershell.exe
1700	powershell.exe
3924	powershell.exe
2788	powershell.exe
1708	powershell.exe
5024	powershell.exe
6472	powershell.exe
4300	powershell.exe
6972	powershell.exe
7152	powershell.exe
2060	powershell.exe
3280	powershell.exe
5276	powershell.exe
4568	powershell.exe
7164	powershell.exe
5968	powershell.exe
952	powershell.exe
6344	powershell.exe
4408	powershell.exe
804	powershell.exe
6656	powershell.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 8 IoCs

Web Service

T1102

flow	ioc
65	raw.githubusercontent.com
72	raw.githubusercontent.com
92	raw.githubusercontent.com
176	api.gofile.io
177	api.gofile.io
32	raw.githubusercontent.com
33	raw.githubusercontent.com
38	raw.githubusercontent.com

Looks up external IP address via web service 21 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
25	ipinfo.io
28	ipinfo.io
44	ipinfo.io
80	ipinfo.io
45	ipinfo.io
47	ipinfo.io
55	ipinfo.io
78	ipinfo.io
87	ipinfo.io
26	ipinfo.io
27	ipinfo.io
29	ipinfo.io
46	ipinfo.io
56	ipinfo.io
66	ipinfo.io
68	ipinfo.io
54	ipinfo.io
59	ipinfo.io
67	ipinfo.io
79	ipinfo.io
81	ipinfo.io

Enumerates processes with tasklist 1 TTPs 2 IoCs

discovery

Process Discovery

T1057

pid	Process
7084	tasklist.exe
3732	tasklist.exe

Hide Artifacts: Ignore Process Interrupts 1 TTPs 1 IoCs

Command interpreters often include specific commands/flags that ignore errors and other hangups.

defense_evasion

Ignore Process Interrupts

T1564.011

pid	Process
1700	powershell.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Checks processor information in registry 2 TTPs 16 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz	Test.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2	Test.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	Test.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	Test.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2	Test.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Test.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Test.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Test.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	Test.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString	Test.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Test.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString	Test.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	Test.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz	Test.exe

Detects videocard installed 1 TTPs 5 IoCs

Uses WMIC.exe to determine videocard installed.

System Information Discovery

pid	Process
4712	WMIC.exe
536	WMIC.exe
2228	WMIC.exe
6544	WMIC.exe
796	WMIC.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Kills process with taskkill 16 IoCs

defense_evasion

pid	Process
6260	taskkill.exe
3512	taskkill.exe
4084	taskkill.exe
2032	taskkill.exe
4972	taskkill.exe
3352	taskkill.exe
1196	taskkill.exe
6964	taskkill.exe
4724	taskkill.exe
1264	taskkill.exe
6432	taskkill.exe
4532	taskkill.exe
1960	taskkill.exe
6836	taskkill.exe
6136	taskkill.exe
1952	taskkill.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134070378960363227"	msedge.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1919182765-2457925700-1517026611-1000\{6768A5EA-E86B-4624-AEFB-40A98A949BC5}	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

pid	Process
5344	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4624	Test.exe
4624	Test.exe
4624	Test.exe
4624	Test.exe
4320	powershell.exe
4320	powershell.exe
2836	powershell.exe
2836	powershell.exe
3612	powershell.exe
3612	powershell.exe
3280	powershell.exe
3280	powershell.exe
5164	powershell.exe
5164	powershell.exe
1700	powershell.exe
1700	powershell.exe
2060	powershell.exe
2060	powershell.exe
4600	powershell.exe
4600	powershell.exe
2836	powershell.exe
5164	powershell.exe
3612	powershell.exe
4320	powershell.exe
3280	powershell.exe
1700	powershell.exe
2060	powershell.exe
4600	powershell.exe
4624	Test.exe
4624	Test.exe
4624	Test.exe
4624	Test.exe
3924	powershell.exe
3924	powershell.exe
2788	powershell.exe
2788	powershell.exe
5640	powershell.exe
5640	powershell.exe
2800	powershell.exe
2800	powershell.exe
1708	powershell.exe
1708	powershell.exe
5968	powershell.exe
5968	powershell.exe
1420	powershell.exe
1420	powershell.exe
952	powershell.exe
952	powershell.exe
5640	powershell.exe
3924	powershell.exe
3924	powershell.exe
2788	powershell.exe
2800	powershell.exe
1420	powershell.exe
952	powershell.exe
1708	powershell.exe
5968	powershell.exe
1536	Test.exe
1536	Test.exe
1536	Test.exe
1536	Test.exe
804	powershell.exe
804	powershell.exe
2352	powershell.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
6852	msedge.exe
6852	msedge.exe
6852	msedge.exe
6852	msedge.exe
6852	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4624	Test.exe
Token: SeCreatePagefilePrivilege	4624	Test.exe
Token: SeIncreaseQuotaPrivilege	4076	WMIC.exe
Token: SeSecurityPrivilege	4076	WMIC.exe
Token: SeTakeOwnershipPrivilege	4076	WMIC.exe
Token: SeLoadDriverPrivilege	4076	WMIC.exe
Token: SeSystemProfilePrivilege	4076	WMIC.exe
Token: SeSystemtimePrivilege	4076	WMIC.exe
Token: SeProfSingleProcessPrivilege	4076	WMIC.exe
Token: SeIncBasePriorityPrivilege	4076	WMIC.exe
Token: SeCreatePagefilePrivilege	4076	WMIC.exe
Token: SeBackupPrivilege	4076	WMIC.exe
Token: SeRestorePrivilege	4076	WMIC.exe
Token: SeShutdownPrivilege	4076	WMIC.exe
Token: SeDebugPrivilege	4076	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4076	WMIC.exe
Token: SeRemoteShutdownPrivilege	4076	WMIC.exe
Token: SeUndockPrivilege	4076	WMIC.exe
Token: SeManageVolumePrivilege	4076	WMIC.exe
Token: 33	4076	WMIC.exe
Token: 34	4076	WMIC.exe
Token: 35	4076	WMIC.exe
Token: 36	4076	WMIC.exe
Token: SeIncreaseQuotaPrivilege	4712	WMIC.exe
Token: SeSecurityPrivilege	4712	WMIC.exe
Token: SeTakeOwnershipPrivilege	4712	WMIC.exe
Token: SeLoadDriverPrivilege	4712	WMIC.exe
Token: SeSystemProfilePrivilege	4712	WMIC.exe
Token: SeSystemtimePrivilege	4712	WMIC.exe
Token: SeProfSingleProcessPrivilege	4712	WMIC.exe
Token: SeIncBasePriorityPrivilege	4712	WMIC.exe
Token: SeCreatePagefilePrivilege	4712	WMIC.exe
Token: SeBackupPrivilege	4712	WMIC.exe
Token: SeRestorePrivilege	4712	WMIC.exe
Token: SeShutdownPrivilege	4712	WMIC.exe
Token: SeDebugPrivilege	4712	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4712	WMIC.exe
Token: SeRemoteShutdownPrivilege	4712	WMIC.exe
Token: SeUndockPrivilege	4712	WMIC.exe
Token: SeManageVolumePrivilege	4712	WMIC.exe
Token: 33	4712	WMIC.exe
Token: 34	4712	WMIC.exe
Token: 35	4712	WMIC.exe
Token: 36	4712	WMIC.exe
Token: SeIncreaseQuotaPrivilege	4736	WMIC.exe
Token: SeSecurityPrivilege	4736	WMIC.exe
Token: SeTakeOwnershipPrivilege	4736	WMIC.exe
Token: SeLoadDriverPrivilege	4736	WMIC.exe
Token: SeSystemProfilePrivilege	4736	WMIC.exe
Token: SeSystemtimePrivilege	4736	WMIC.exe
Token: SeProfSingleProcessPrivilege	4736	WMIC.exe
Token: SeIncBasePriorityPrivilege	4736	WMIC.exe
Token: SeCreatePagefilePrivilege	4736	WMIC.exe
Token: SeBackupPrivilege	4736	WMIC.exe
Token: SeRestorePrivilege	4736	WMIC.exe
Token: SeShutdownPrivilege	4736	WMIC.exe
Token: SeDebugPrivilege	4736	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4736	WMIC.exe
Token: SeRemoteShutdownPrivilege	4736	WMIC.exe
Token: SeUndockPrivilege	4736	WMIC.exe
Token: SeManageVolumePrivilege	4736	WMIC.exe
Token: 33	4736	WMIC.exe
Token: 34	4736	WMIC.exe
Token: 35	4736	WMIC.exe

Suspicious use of FindShellTrayWindow 11 IoCs

pid	Process
6852	msedge.exe
6852	msedge.exe
6852	msedge.exe
6852	msedge.exe
6852	msedge.exe
6852	msedge.exe
6852	msedge.exe
6852	msedge.exe
6852	msedge.exe
6852	msedge.exe
6852	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4624 wrote to memory of 5708	4624	Test.exe	88
PID 4624 wrote to memory of 5708	4624	Test.exe	88
PID 4624 wrote to memory of 5708	4624	Test.exe	88
PID 4624 wrote to memory of 5708	4624	Test.exe	88
PID 4624 wrote to memory of 5708	4624	Test.exe	88
PID 4624 wrote to memory of 5708	4624	Test.exe	88
PID 4624 wrote to memory of 5708	4624	Test.exe	88
PID 4624 wrote to memory of 5708	4624	Test.exe	88
PID 4624 wrote to memory of 5708	4624	Test.exe	88
PID 4624 wrote to memory of 5708	4624	Test.exe	88
PID 4624 wrote to memory of 5708	4624	Test.exe	88
PID 4624 wrote to memory of 5708	4624	Test.exe	88
PID 4624 wrote to memory of 5708	4624	Test.exe	88
PID 4624 wrote to memory of 5708	4624	Test.exe	88
PID 4624 wrote to memory of 5708	4624	Test.exe	88
PID 4624 wrote to memory of 5708	4624	Test.exe	88
PID 4624 wrote to memory of 5708	4624	Test.exe	88
PID 4624 wrote to memory of 5708	4624	Test.exe	88
PID 4624 wrote to memory of 5708	4624	Test.exe	88
PID 4624 wrote to memory of 5708	4624	Test.exe	88
PID 4624 wrote to memory of 5708	4624	Test.exe	88
PID 4624 wrote to memory of 5708	4624	Test.exe	88
PID 4624 wrote to memory of 5708	4624	Test.exe	88
PID 4624 wrote to memory of 5708	4624	Test.exe	88
PID 4624 wrote to memory of 5708	4624	Test.exe	88
PID 4624 wrote to memory of 5708	4624	Test.exe	88
PID 4624 wrote to memory of 5708	4624	Test.exe	88
PID 4624 wrote to memory of 5708	4624	Test.exe	88
PID 4624 wrote to memory of 5708	4624	Test.exe	88
PID 4624 wrote to memory of 5708	4624	Test.exe	88
PID 4624 wrote to memory of 1924	4624	Test.exe	89
PID 4624 wrote to memory of 1924	4624	Test.exe	89
PID 4624 wrote to memory of 4916	4624	Test.exe	90
PID 4624 wrote to memory of 4916	4624	Test.exe	90
PID 4624 wrote to memory of 5848	4624	Test.exe	91
PID 4624 wrote to memory of 5848	4624	Test.exe	91
PID 4624 wrote to memory of 1784	4624	Test.exe	92
PID 4624 wrote to memory of 1784	4624	Test.exe	92
PID 4624 wrote to memory of 1708	4624	Test.exe	93
PID 4624 wrote to memory of 1708	4624	Test.exe	93
PID 4624 wrote to memory of 2268	4624	Test.exe	94
PID 4624 wrote to memory of 2268	4624	Test.exe	94
PID 4624 wrote to memory of 3036	4624	Test.exe	95
PID 4624 wrote to memory of 3036	4624	Test.exe	95
PID 4624 wrote to memory of 3040	4624	Test.exe	96
PID 4624 wrote to memory of 3040	4624	Test.exe	96
PID 4624 wrote to memory of 1196	4624	Test.exe	97
PID 4624 wrote to memory of 1196	4624	Test.exe	97
PID 4624 wrote to memory of 2888	4624	Test.exe	98
PID 4624 wrote to memory of 2888	4624	Test.exe	98
PID 4624 wrote to memory of 1976	4624	Test.exe	99
PID 4624 wrote to memory of 1976	4624	Test.exe	99
PID 4624 wrote to memory of 6008	4624	Test.exe	101
PID 4624 wrote to memory of 6008	4624	Test.exe	101
PID 1708 wrote to memory of 4076	1708	cmd.exe	112
PID 1708 wrote to memory of 4076	1708	cmd.exe	112
PID 3040 wrote to memory of 4600	3040	cmd.exe	113
PID 3040 wrote to memory of 4600	3040	cmd.exe	113
PID 1708 wrote to memory of 4692	1708	cmd.exe	114
PID 1708 wrote to memory of 4692	1708	cmd.exe	114
PID 2268 wrote to memory of 4712	2268	cmd.exe	115
PID 2268 wrote to memory of 4712	2268	cmd.exe	115
PID 2268 wrote to memory of 636	2268	cmd.exe	116
PID 2268 wrote to memory of 636	2268	cmd.exe	116

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\Test.exe
"C:\Users\Admin\AppData\Local\Temp\Test.exe"
1⤵
- Checks computer location settings
- Loads dropped DLL
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4624
- C:\Users\Admin\AppData\Local\Temp\Test.exe
  "C:\Users\Admin\AppData\Local\Temp\Test.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\resignaciones" --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1848 --field-trial-handle=1852,i,17620316095577981938,14152744994255590304,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2
  2⤵
  PID:5708
- C:\Users\Admin\AppData\Local\Temp\Test.exe
  "C:\Users\Admin\AppData\Local\Temp\Test.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\resignaciones" --mojo-platform-channel-handle=1944 --field-trial-handle=1852,i,17620316095577981938,14152744994255590304,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand /prefetch:8
  2⤵
  PID:1924
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "Get-PSDrive -Name C | Select-Object Used, Free | ConvertTo-Json""
  2⤵
  PID:4916
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "Get-PSDrive -Name C | Select-Object Used, Free | ConvertTo-Json"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:3612
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -Command "Get-CimInstance -Class Win32_ComputerSystemProduct | Select-Object -ExpandProperty UUID""
  2⤵
  PID:5848
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Get-CimInstance -Class Win32_ComputerSystemProduct | Select-Object -ExpandProperty UUID"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:1700
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic OS get caption, osarchitecture | more +1"
  2⤵
  PID:1784
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic OS get caption, osarchitecture
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4736
- - C:\Windows\system32\more.com
    more +1
    3⤵
    PID:1872
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic cpu get name | more +1"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1708
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic cpu get name
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4076
- - C:\Windows\system32\more.com
    more +1
    3⤵
    PID:4692
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic PATH Win32_VideoController get name | more +1"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2268
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic PATH Win32_VideoController get name
    3⤵
    - Detects videocard installed
    - Suspicious use of AdjustPrivilegeToken
    PID:4712
- - C:\Windows\system32\more.com
    more +1
    3⤵
    PID:636
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\SoftwareProtectionPlatform' -Name BackupProductKeyDefault"
  2⤵
  PID:3036
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\SoftwareProtectionPlatform' -Name BackupProductKeyDefault
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5164
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion' -Name ProductName"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3040
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion' -Name ProductName
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4600
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -Command "(Get-CimInstance -ClassName Win32_ComputerSystem).Model""
  2⤵
  PID:1196
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "(Get-CimInstance -ClassName Win32_ComputerSystem).Model"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:2060
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -Command "Get-NetAdapter | Where-Object { $_.Status -eq 'Up' } | Select-Object -ExpandProperty Name""
  2⤵
  PID:2888
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Get-NetAdapter | Where-Object { $_.Status -eq 'Up' } | Select-Object -ExpandProperty Name"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:2836
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -Command "(Get-CimInstance -ClassName Win32_BaseBoard).Product""
  2⤵
  PID:1976
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "(Get-CimInstance -ClassName Win32_BaseBoard).Product"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:3280
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -Command "Get-CimInstance -Class Win32_BIOS | Select-Object -ExpandProperty SMBIOSBIOSVersion""
  2⤵
  PID:6008
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Get-CimInstance -Class Win32_BIOS | Select-Object -ExpandProperty SMBIOSBIOSVersion"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:4320
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg query "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "Test""
  2⤵
  PID:220
- - C:\Windows\system32\reg.exe
    reg query "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "Test"
    3⤵
    PID:5388
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v Test /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\Test.exe" /f"
  2⤵
  PID:1292
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v Test /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\Test.exe" /f
    3⤵
    - Adds Run key to start application
    PID:4340
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "Get-PSDrive -Name C | Select-Object Used, Free | ConvertTo-Json""
  2⤵
  PID:3044
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "Get-PSDrive -Name C | Select-Object Used, Free | ConvertTo-Json"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:2788
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -Command "Get-CimInstance -Class Win32_ComputerSystemProduct | Select-Object -ExpandProperty UUID""
  2⤵
  PID:5456
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Get-CimInstance -Class Win32_ComputerSystemProduct | Select-Object -ExpandProperty UUID"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:3924
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic OS get caption, osarchitecture | more +1"
  2⤵
  PID:2984
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic OS get caption, osarchitecture
    3⤵
    PID:752
- - C:\Windows\system32\more.com
    more +1
    3⤵
    PID:5332
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic cpu get name | more +1"
  2⤵
  PID:3276
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic cpu get name
    3⤵
    PID:3188
- - C:\Windows\system32\more.com
    more +1
    3⤵
    PID:4704
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic PATH Win32_VideoController get name | more +1"
  2⤵
  PID:2424
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic PATH Win32_VideoController get name
    3⤵
    - Detects videocard installed
    PID:536
- - C:\Windows\system32\more.com
    more +1
    3⤵
    PID:1952
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\SoftwareProtectionPlatform' -Name BackupProductKeyDefault"
  2⤵
  PID:648
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\SoftwareProtectionPlatform' -Name BackupProductKeyDefault
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5640
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion' -Name ProductName"
  2⤵
  PID:5324
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion' -Name ProductName
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1420
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -Command "(Get-CimInstance -ClassName Win32_ComputerSystem).Model""
  2⤵
  PID:6092
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "(Get-CimInstance -ClassName Win32_ComputerSystem).Model"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:952
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -Command "Get-NetAdapter | Where-Object { $_.Status -eq 'Up' } | Select-Object -ExpandProperty Name""
  2⤵
  PID:2476
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Get-NetAdapter | Where-Object { $_.Status -eq 'Up' } | Select-Object -ExpandProperty Name"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:2800
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -Command "(Get-CimInstance -ClassName Win32_BaseBoard).Product""
  2⤵
  PID:5232
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "(Get-CimInstance -ClassName Win32_BaseBoard).Product"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:5968
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -Command "Get-CimInstance -Class Win32_BIOS | Select-Object -ExpandProperty SMBIOSBIOSVersion""
  2⤵
  PID:2648
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Get-CimInstance -Class Win32_BIOS | Select-Object -ExpandProperty SMBIOSBIOSVersion"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:1708
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v Windows_Health_Courtage_25d4i5 /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\Test.exe" /f"
  2⤵
  PID:1964
- - C:\Windows\system32\reg.exe
    reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v Windows_Health_Courtage_25d4i5 /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\Test.exe" /f
    3⤵
    - Adds Run key to start application
    PID:4632
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v Windows_Health_Courtage_25d4i5 /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\Test.exe" /f"
  2⤵
  PID:3672
- - C:\Windows\system32\reg.exe
    reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v Windows_Health_Courtage_25d4i5 /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\Test.exe" /f
    3⤵
    - Adds Run key to start application
    PID:4200
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -Command "try { $Action = New-ScheduledTaskAction -Execute "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\Test.exe"; $Trigger = New-ScheduledTaskTrigger -Daily -At "12:00PM"; $Settings = New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries -StartWhenAvailable; Register-ScheduledTask -Action $Action -Trigger $Trigger -Settings $Settings -TaskName "DailySystemUpdate_f0juyj" -Force -User $env:USERNAME; Write-Host "TASK_CREATED_SUCCESS" } catch { Write-Host "TASK_CREATED_ERROR: $($_.Exception.Message)" }""
  2⤵
  PID:1284
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "try { $Action = New-ScheduledTaskAction -Execute "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\Test.exe"; $Trigger = New-ScheduledTaskTrigger -Daily -At "12:00PM"; $Settings = New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries -StartWhenAvailable; Register-ScheduledTask -Action $Action -Trigger $Trigger -Settings $Settings -TaskName "DailySystemUpdate_f0juyj" -Force -User $env:USERNAME; Write-Host "TASK_CREATED_SUCCESS" } catch { Write-Host "TASK_CREATED_ERROR: $($_.Exception.Message)" }"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:804
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "cmd /c schtasks /create /sc onlogon /tn WindowsDriverSetupn1wwc6 /tr \"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\Test.exe\" /F /rl highest"
  2⤵
  PID:4268
- - C:\Windows\system32\cmd.exe
    cmd /c schtasks /create /sc onlogon /tn WindowsDriverSetupn1wwc6 /tr \"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\Test.exe\" /F /rl highest
    3⤵
    PID:4972
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /sc onlogon /tn WindowsDriverSetupn1wwc6 /tr \"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\Test.exe\" /F /rl highest
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:5344
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Get-ItemProperty -Path \"HKCU:\SOFTWARE\Valve\Steam\" -Name \"SteamPath\" | Select-Object -ExpandProperty SteamPath"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:6656
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "Get-PSDrive -Name C | Select-Object Used, Free | ConvertTo-Json""
  2⤵
  PID:6176
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "Get-PSDrive -Name C | Select-Object Used, Free | ConvertTo-Json"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:6472
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -Command "Get-CimInstance -Class Win32_ComputerSystemProduct | Select-Object -ExpandProperty UUID""
  2⤵
  PID:6184
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Get-CimInstance -Class Win32_ComputerSystemProduct | Select-Object -ExpandProperty UUID"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:4208
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic OS get caption, osarchitecture | more +1"
  2⤵
  PID:1588
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic OS get caption, osarchitecture
    3⤵
    PID:6500
- - C:\Windows\system32\more.com
    more +1
    3⤵
    PID:5012
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic cpu get name | more +1"
  2⤵
  PID:1296
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic cpu get name
    3⤵
    PID:1132
- - C:\Windows\system32\more.com
    more +1
    3⤵
    PID:4308
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic PATH Win32_VideoController get name | more +1"
  2⤵
  PID:2300
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic PATH Win32_VideoController get name
    3⤵
    - Detects videocard installed
    PID:6544
- - C:\Windows\system32\more.com
    more +1
    3⤵
    PID:2460
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\SoftwareProtectionPlatform' -Name BackupProductKeyDefault"
  2⤵
  PID:5752
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\SoftwareProtectionPlatform' -Name BackupProductKeyDefault
    3⤵
    PID:5564
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion' -Name ProductName"
  2⤵
  PID:3216
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion' -Name ProductName
    3⤵
    PID:2496
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -Command "(Get-CimInstance -ClassName Win32_ComputerSystem).Model""
  2⤵
  PID:1160
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "(Get-CimInstance -ClassName Win32_ComputerSystem).Model"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:6344
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -Command "Get-NetAdapter | Where-Object { $_.Status -eq 'Up' } | Select-Object -ExpandProperty Name""
  2⤵
  PID:6044
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Get-NetAdapter | Where-Object { $_.Status -eq 'Up' } | Select-Object -ExpandProperty Name"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:2744
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -Command "(Get-CimInstance -ClassName Win32_BaseBoard).Product""
  2⤵
  PID:5920
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "(Get-CimInstance -ClassName Win32_BaseBoard).Product"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:4408
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -Command "Get-CimInstance -Class Win32_BIOS | Select-Object -ExpandProperty SMBIOSBIOSVersion""
  2⤵
  PID:1936
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Get-CimInstance -Class Win32_BIOS | Select-Object -ExpandProperty SMBIOSBIOSVersion"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:4248
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -Command "Get-ScheduledTask -TaskName 'DailySystemUpdate_f0juyj' -ErrorAction SilentlyContinue | Select-Object TaskName, State""
  2⤵
  PID:2464
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Get-ScheduledTask -TaskName 'DailySystemUpdate_f0juyj' -ErrorAction SilentlyContinue | Select-Object TaskName, State"
    3⤵
    - Hide Artifacts: Ignore Process Interrupts
    PID:1700
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM chrome.exe"
  2⤵
  PID:5148
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM chrome.exe
    3⤵
    - Kills process with taskkill
    PID:6260
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM msedge.exe"
  2⤵
  PID:2684
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM msedge.exe
    3⤵
    - Kills process with taskkill
    PID:6836
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM brave.exe"
  2⤵
  PID:5100
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM brave.exe
    3⤵
    - Kills process with taskkill
    PID:4724
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM firefox.exe"
  2⤵
  PID:6192
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM firefox.exe
    3⤵
    - Kills process with taskkill
    PID:1264
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM opera.exe"
  2⤵
  PID:7024
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM opera.exe
    3⤵
    - Kills process with taskkill
    PID:3512
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM kometa.exe"
  2⤵
  PID:2044
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM kometa.exe
    3⤵
    - Kills process with taskkill
    PID:4972
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM orbitum.exe"
  2⤵
  PID:3560
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM orbitum.exe
    3⤵
    - Kills process with taskkill
    PID:6136
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM centbrowser.exe"
  2⤵
  PID:6588
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM centbrowser.exe
    3⤵
    - Kills process with taskkill
    PID:4084
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM 7star.exe"
  2⤵
  PID:7148
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM 7star.exe
    3⤵
    - Kills process with taskkill
    PID:3352
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM sputnik.exe"
  2⤵
  PID:6656
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM sputnik.exe
    3⤵
    - Kills process with taskkill
    PID:1952
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM vivaldi.exe"
  2⤵
  PID:3672
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:2648
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM vivaldi.exe
    3⤵
    - Kills process with taskkill
    PID:6432
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM epicprivacybrowser.exe"
  2⤵
  PID:4272
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM epicprivacybrowser.exe
    3⤵
    - Kills process with taskkill
    PID:4532
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM uran.exe"
  2⤵
  PID:4720
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM uran.exe
    3⤵
    - Kills process with taskkill
    PID:2032
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM yandex.exe"
  2⤵
  PID:4508
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM yandex.exe
    3⤵
    - Kills process with taskkill
    PID:6964
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM iridium.exe"
  2⤵
  PID:6716
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:5324
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM iridium.exe
    3⤵
    - Kills process with taskkill
    PID:1960
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist"
  2⤵
  PID:2180
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    PID:7084
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist"
  2⤵
  PID:1840
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    PID:3732
- C:\Users\Admin\AppData\Local\Temp\decryptor_e3f56f02-95be-4598-a47e-6341e43c8e58\decryptor.exe
  C:\Users\Admin\AppData\Local\Temp\decryptor_e3f56f02-95be-4598-a47e-6341e43c8e58\decryptor.exe
  2⤵
  - Executes dropped EXE
  PID:7076
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe"
    3⤵
    PID:4992
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
    3⤵
    PID:1528
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Compress-Archive -Path 'C:\Users\Admin\AppData\Local\Temp\decryptor_e3f56f02-95be-4598-a47e-6341e43c8e58\temp_browser_data\*' -DestinationPath 'C:\Users\Admin\AppData\Local\Temp\decryptor_e3f56f02-95be-4598-a47e-6341e43c8e58\output.zip' -Force"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:6972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" "--load-extension=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\Edge" "--disable-extensions-except=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\Edge" --disable-popup-blocking --no-first-run --no-default-browser-check --disable-session-crashed-bubble --window-size=800,600 --window-position=-32000,-32000
  2⤵
  - Checks processor information in registry
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  PID:6852
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x238,0x23c,0x240,0x234,0x25c,0x7ffddbdaf208,0x7ffddbdaf214,0x7ffddbdaf220
    3⤵
    PID:4200
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=1908,i,6136733384822855426,776304503395190171,262144 --variations-seed-version --mojo-platform-channel-handle=2260 /prefetch:3
    3⤵
    PID:5408
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2224,i,6136733384822855426,776304503395190171,262144 --variations-seed-version --mojo-platform-channel-handle=2220 /prefetch:2
    3⤵
    PID:7088
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=2560,i,6136733384822855426,776304503395190171,262144 --variations-seed-version --mojo-platform-channel-handle=2572 /prefetch:8
    3⤵
    PID:6424
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3552,i,6136733384822855426,776304503395190171,262144 --variations-seed-version --mojo-platform-channel-handle=3616 /prefetch:1
    3⤵
    PID:2264
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --instant-process --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3560,i,6136733384822855426,776304503395190171,262144 --variations-seed-version --mojo-platform-channel-handle=3572 /prefetch:1
    3⤵
    PID:7036
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --field-trial-handle=4900,i,6136733384822855426,776304503395190171,262144 --variations-seed-version --mojo-platform-channel-handle=4348 /prefetch:2
    3⤵
    PID:704
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --field-trial-handle=4056,i,6136733384822855426,776304503395190171,262144 --variations-seed-version --mojo-platform-channel-handle=5192 /prefetch:1
    3⤵
    PID:6556
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5400,i,6136733384822855426,776304503395190171,262144 --variations-seed-version --mojo-platform-channel-handle=5516 /prefetch:8
    3⤵
    PID:6640
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --field-trial-handle=5380,i,6136733384822855426,776304503395190171,262144 --variations-seed-version --mojo-platform-channel-handle=5524 /prefetch:1
    3⤵
    PID:3188
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5844,i,6136733384822855426,776304503395190171,262144 --variations-seed-version --mojo-platform-channel-handle=5868 /prefetch:8
    3⤵
    PID:2076
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5896,i,6136733384822855426,776304503395190171,262144 --variations-seed-version --mojo-platform-channel-handle=6032 /prefetch:8
    3⤵
    PID:3428
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5892,i,6136733384822855426,776304503395190171,262144 --variations-seed-version --mojo-platform-channel-handle=6036 /prefetch:8
    3⤵
    PID:3064
- - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6508,i,6136733384822855426,776304503395190171,262144 --variations-seed-version --mojo-platform-channel-handle=6552 /prefetch:8
    3⤵
    PID:4704
- - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6508,i,6136733384822855426,776304503395190171,262144 --variations-seed-version --mojo-platform-channel-handle=6552 /prefetch:8
    3⤵
    PID:2216
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=560,i,6136733384822855426,776304503395190171,262144 --variations-seed-version --mojo-platform-channel-handle=6660 /prefetch:8
    3⤵
    PID:1964
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6564,i,6136733384822855426,776304503395190171,262144 --variations-seed-version --mojo-platform-channel-handle=5776 /prefetch:8
    3⤵
    PID:1796
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6648,i,6136733384822855426,776304503395190171,262144 --variations-seed-version --mojo-platform-channel-handle=7020 /prefetch:8
    3⤵
    PID:3748
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM chrome.exe"
  2⤵
  PID:6188
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM chrome.exe
    3⤵
    - Kills process with taskkill
    PID:1196
- C:\Users\Admin\AppData\Local\Temp\Test.exe
  "C:\Users\Admin\AppData\Local\Temp\Test.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --user-data-dir="C:\Users\Admin\AppData\Roaming\resignaciones" --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAABEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=3028 --field-trial-handle=1852,i,17620316095577981938,14152744994255590304,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2
  2⤵
  PID:6520

C:\Users\Admin\AppData\Local\Temp\Test.exe
C:\Users\Admin\AppData\Local\Temp\Test.exe
1⤵
- Checks computer location settings
- Loads dropped DLL
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
PID:1536
- C:\Users\Admin\AppData\Local\Temp\Test.exe
  "C:\Users\Admin\AppData\Local\Temp\Test.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\resignaciones" --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=2288 --field-trial-handle=2292,i,8995245310663307274,17690724842971550653,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2
  2⤵
  PID:2232
- C:\Users\Admin\AppData\Local\Temp\Test.exe
  "C:\Users\Admin\AppData\Local\Temp\Test.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\resignaciones" --mojo-platform-channel-handle=2320 --field-trial-handle=2292,i,8995245310663307274,17690724842971550653,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand /prefetch:8
  2⤵
  PID:5504
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "Get-PSDrive -Name C | Select-Object Used, Free | ConvertTo-Json""
  2⤵
  PID:6048
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "Get-PSDrive -Name C | Select-Object Used, Free | ConvertTo-Json"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:5784
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -Command "Get-CimInstance -Class Win32_ComputerSystemProduct | Select-Object -ExpandProperty UUID""
  2⤵
  PID:6128
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Get-CimInstance -Class Win32_ComputerSystemProduct | Select-Object -ExpandProperty UUID"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:2108
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic OS get caption, osarchitecture | more +1"
  2⤵
  PID:5600
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic OS get caption, osarchitecture
    3⤵
    PID:2308
- - C:\Windows\system32\more.com
    more +1
    3⤵
    PID:4588
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic cpu get name | more +1"
  2⤵
  PID:2916
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic cpu get name
    3⤵
    PID:4112
- - C:\Windows\system32\more.com
    more +1
    3⤵
    PID:1152
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic PATH Win32_VideoController get name | more +1"
  2⤵
  PID:5800
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic PATH Win32_VideoController get name
    3⤵
    - Detects videocard installed
    PID:2228
- - C:\Windows\system32\more.com
    more +1
    3⤵
    PID:5720
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\SoftwareProtectionPlatform' -Name BackupProductKeyDefault"
  2⤵
  PID:1768
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\SoftwareProtectionPlatform' -Name BackupProductKeyDefault
    3⤵
    PID:3844
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion' -Name ProductName"
  2⤵
  PID:5788
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion' -Name ProductName
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2352
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -Command "(Get-CimInstance -ClassName Win32_ComputerSystem).Model""
  2⤵
  PID:3452
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "(Get-CimInstance -ClassName Win32_ComputerSystem).Model"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:5276
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -Command "Get-NetAdapter | Where-Object { $_.Status -eq 'Up' } | Select-Object -ExpandProperty Name""
  2⤵
  PID:1636
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Get-NetAdapter | Where-Object { $_.Status -eq 'Up' } | Select-Object -ExpandProperty Name"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:1908
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -Command "(Get-CimInstance -ClassName Win32_BaseBoard).Product""
  2⤵
  PID:2540
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "(Get-CimInstance -ClassName Win32_BaseBoard).Product"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:4568
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -Command "Get-CimInstance -Class Win32_BIOS | Select-Object -ExpandProperty SMBIOSBIOSVersion""
  2⤵
  PID:2396
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Get-CimInstance -Class Win32_BIOS | Select-Object -ExpandProperty SMBIOSBIOSVersion"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:5024
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg query "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "Test""
  2⤵
  PID:2136
- - C:\Windows\system32\reg.exe
    reg query "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "Test"
    3⤵
    PID:1628
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "Get-PSDrive -Name C | Select-Object Used, Free | ConvertTo-Json""
  2⤵
  PID:6792
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "Get-PSDrive -Name C | Select-Object Used, Free | ConvertTo-Json"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:4300
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -Command "Get-CimInstance -Class Win32_ComputerSystemProduct | Select-Object -ExpandProperty UUID""
  2⤵
  PID:6860
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Get-CimInstance -Class Win32_ComputerSystemProduct | Select-Object -ExpandProperty UUID"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:3100
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic OS get caption, osarchitecture | more +1"
  2⤵
  PID:2180
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic OS get caption, osarchitecture
    3⤵
    PID:7124
- - C:\Windows\system32\more.com
    more +1
    3⤵
    PID:5004
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic cpu get name | more +1"
  2⤵
  PID:1848
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic cpu get name
    3⤵
    PID:1796
- - C:\Windows\system32\more.com
    more +1
    3⤵
    PID:5292
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic PATH Win32_VideoController get name | more +1"
  2⤵
  PID:5728
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic PATH Win32_VideoController get name
    3⤵
    - Detects videocard installed
    PID:796
- - C:\Windows\system32\more.com
    more +1
    3⤵
    PID:6912
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\SoftwareProtectionPlatform' -Name BackupProductKeyDefault"
  2⤵
  PID:1988
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\SoftwareProtectionPlatform' -Name BackupProductKeyDefault
    3⤵
    PID:7072
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion' -Name ProductName"
  2⤵
  PID:6056
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion' -Name ProductName
    3⤵
    PID:6876
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -Command "(Get-CimInstance -ClassName Win32_ComputerSystem).Model""
  2⤵
  PID:6128
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "(Get-CimInstance -ClassName Win32_ComputerSystem).Model"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:7164
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -Command "Get-NetAdapter | Where-Object { $_.Status -eq 'Up' } | Select-Object -ExpandProperty Name""
  2⤵
  PID:4224
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Get-NetAdapter | Where-Object { $_.Status -eq 'Up' } | Select-Object -ExpandProperty Name"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:4684
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -Command "(Get-CimInstance -ClassName Win32_BaseBoard).Product""
  2⤵
  PID:2484
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "(Get-CimInstance -ClassName Win32_BaseBoard).Product"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:7152
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -Command "Get-CimInstance -Class Win32_BIOS | Select-Object -ExpandProperty SMBIOSBIOSVersion""
  2⤵
  PID:1036
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Get-CimInstance -Class Win32_BIOS | Select-Object -ExpandProperty SMBIOSBIOSVersion"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:3296
- C:\Users\Admin\AppData\Local\Temp\Test.exe
  "C:\Users\Admin\AppData\Local\Temp\Test.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --user-data-dir="C:\Users\Admin\AppData\Roaming\resignaciones" --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAABEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=3236 --field-trial-handle=2292,i,8995245310663307274,17690724842971550653,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2
  2⤵
  PID:4628

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\Test.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\Test.exe
1⤵
- Executes dropped EXE
PID:1444

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\Test.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\Test.exe"
1⤵
- Executes dropped EXE
PID:7016

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
1⤵
PID:5928

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
1⤵
PID:4112

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:3452

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

Defense Evasion

Hide Artifacts

T1564

Ignore Process Interrupts

T1564.011

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Process Discovery

T1057

Query Registry

System Information Discovery