0b9b7ae90a83f394f9da7226b030a3b1bfb4539f0460573952d923595bc627e8

Analysis

max time kernel
119s
max time network
124s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
15/04/2026, 03:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
sparkle-2.17.0-setup.exe
Size 88.8MB
Sample260415-ee672aes7j
SHA256 0b9b7ae90a83f394f9da7226b030a3b1bfb4539f0460573952d923595bc627e8
MD5 cf846f4d022a14a9d31de998c23d6340
SHA1 969b364a267a4cc7eef7e5b2fa28602472f9839e
SHA512 457fb0f849b20d1fa8cc2b03525b8f1b72b45d96428a04029048c40a0b63db7cbf6034b56df56c2a3dc41dfa5c5f79f4beb7b4a89a7f87626f748402fbe38d93
SSDEEP 1572864:lvM9Tnh/QK6+CZI6ZXXYq5LlIT5csdu06ySah0q34JS4fVdldKJ:dM9TniO6tXYq5RUcodnJiVnds
TLSH
T1AC18339FD3802A3FC48C5AFAF5331053E8B476813B958C7B9218B17D26ED28F599851B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery execution spyware stealer

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 23 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
1892	powershell.exe
1584	powershell.exe
5952	powershell.exe
3896	powershell.exe
3220	powershell.exe
6120	powershell.exe
2212	powershell.exe
1520	powershell.exe
5028	powershell.exe
1860	powershell.exe
4212	powershell.exe
2584	powershell.exe
3248	powershell.exe
3160	powershell.exe
5052	powershell.exe
2236	powershell.exe
4576	powershell.exe
2360	powershell.exe
736	powershell.exe
5204	powershell.exe
3280	powershell.exe
3376	powershell.exe
1736	powershell.exe

Executes dropped EXE 4 IoCs

pid	Process
5440	sparkle.exe
2952	sparkle.exe
1504	sparkle.exe
4996	sparkle.exe

Loads dropped DLL 16 IoCs

pid	Process
1452	sparkle-2.17.0-setup.exe
1452	sparkle-2.17.0-setup.exe
1452	sparkle-2.17.0-setup.exe
1452	sparkle-2.17.0-setup.exe
1452	sparkle-2.17.0-setup.exe
1452	sparkle-2.17.0-setup.exe
1452	sparkle-2.17.0-setup.exe
1452	sparkle-2.17.0-setup.exe
1452	sparkle-2.17.0-setup.exe
2952	sparkle.exe
2952	sparkle.exe
2952	sparkle.exe
2952	sparkle.exe
2952	sparkle.exe
2952	sparkle.exe
4996	sparkle.exe

Reads ssh keys stored on the system 2 TTPs
Tries to access SSH used by SSH programs.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	sparkle.exe

Hide Artifacts: Ignore Process Interrupts 1 TTPs 2 IoCs

Command interpreters often include specific commands/flags that ignore errors and other hangups.

defense_evasion

Ignore Process Interrupts

T1564.011

pid	Process
5000	powershell.exe
3280	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sparkle-2.17.0-setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe

Checks processor information in registry 2 TTPs 26 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6	sparkle.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\~MHz	sparkle.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	sparkle.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\ProcessorNameString	sparkle.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\ProcessorNameString	sparkle.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	sparkle.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	sparkle.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	sparkle.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2	sparkle.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\~MHz	sparkle.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5	sparkle.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\ProcessorNameString	sparkle.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	reg.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz	sparkle.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString	sparkle.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\ProcessorNameString	sparkle.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\ProcessorNameString	sparkle.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7	sparkle.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\~MHz	sparkle.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\FeatureSet	reg.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\~MHz	sparkle.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3	sparkle.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\~MHz	sparkle.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\ProcessorNameString	sparkle.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4	sparkle.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\~MHz	sparkle.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5000	powershell.exe
5000	powershell.exe
3248	powershell.exe
3248	powershell.exe
1452	sparkle-2.17.0-setup.exe
1452	sparkle-2.17.0-setup.exe
736	powershell.exe
736	powershell.exe
3376	powershell.exe
3376	powershell.exe
3280	powershell.exe
3280	powershell.exe
2212	powershell.exe
2212	powershell.exe
1860	powershell.exe
1860	powershell.exe
6120	powershell.exe
6120	powershell.exe
1584	powershell.exe
1584	powershell.exe
4576	powershell.exe
4576	powershell.exe
1892	powershell.exe
1892	powershell.exe
2360	powershell.exe
2360	powershell.exe
5204	powershell.exe
5204	powershell.exe
1736	powershell.exe
2584	powershell.exe
2584	powershell.exe
1736	powershell.exe
4212	powershell.exe
4212	powershell.exe
3220	powershell.exe
3220	powershell.exe
3160	powershell.exe
3160	powershell.exe
2236	powershell.exe
2236	powershell.exe
5052	powershell.exe
5052	powershell.exe
6120	powershell.exe
1892	powershell.exe
3220	powershell.exe
2236	powershell.exe
3280	powershell.exe
3280	powershell.exe
2212	powershell.exe
1860	powershell.exe
1860	powershell.exe
4576	powershell.exe
2584	powershell.exe
4212	powershell.exe
1736	powershell.exe
3160	powershell.exe
3376	powershell.exe
3376	powershell.exe
2360	powershell.exe
2360	powershell.exe
5204	powershell.exe
5204	powershell.exe
1584	powershell.exe
1584	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	5000	powershell.exe
Token: SeDebugPrivilege	3248	powershell.exe
Token: SeDebugPrivilege	736	powershell.exe
Token: SeIncreaseQuotaPrivilege	736	powershell.exe
Token: SeSecurityPrivilege	736	powershell.exe
Token: SeTakeOwnershipPrivilege	736	powershell.exe
Token: SeLoadDriverPrivilege	736	powershell.exe
Token: SeSystemProfilePrivilege	736	powershell.exe
Token: SeSystemtimePrivilege	736	powershell.exe
Token: SeProfSingleProcessPrivilege	736	powershell.exe
Token: SeIncBasePriorityPrivilege	736	powershell.exe
Token: SeCreatePagefilePrivilege	736	powershell.exe
Token: SeBackupPrivilege	736	powershell.exe
Token: SeRestorePrivilege	736	powershell.exe
Token: SeShutdownPrivilege	736	powershell.exe
Token: SeDebugPrivilege	736	powershell.exe
Token: SeSystemEnvironmentPrivilege	736	powershell.exe
Token: SeRemoteShutdownPrivilege	736	powershell.exe
Token: SeUndockPrivilege	736	powershell.exe
Token: SeManageVolumePrivilege	736	powershell.exe
Token: 33	736	powershell.exe
Token: 34	736	powershell.exe
Token: 35	736	powershell.exe
Token: 36	736	powershell.exe
Token: SeSecurityPrivilege	1452	sparkle-2.17.0-setup.exe
Token: SeShutdownPrivilege	5440	sparkle.exe
Token: SeCreatePagefilePrivilege	5440	sparkle.exe
Token: SeShutdownPrivilege	5440	sparkle.exe
Token: SeCreatePagefilePrivilege	5440	sparkle.exe
Token: SeShutdownPrivilege	5440	sparkle.exe
Token: SeCreatePagefilePrivilege	5440	sparkle.exe
Token: SeDebugPrivilege	3376	powershell.exe
Token: SeDebugPrivilege	3280	powershell.exe
Token: SeShutdownPrivilege	5440	sparkle.exe
Token: SeCreatePagefilePrivilege	5440	sparkle.exe
Token: SeDebugPrivilege	2212	powershell.exe
Token: SeDebugPrivilege	1860	powershell.exe
Token: SeDebugPrivilege	6120	powershell.exe
Token: SeDebugPrivilege	1584	powershell.exe
Token: SeDebugPrivilege	4576	powershell.exe
Token: SeDebugPrivilege	1892	powershell.exe
Token: SeDebugPrivilege	2360	powershell.exe
Token: SeDebugPrivilege	5204	powershell.exe
Token: SeDebugPrivilege	1736	powershell.exe
Token: SeDebugPrivilege	2584	powershell.exe
Token: SeDebugPrivilege	4212	powershell.exe
Token: SeDebugPrivilege	3220	powershell.exe
Token: SeDebugPrivilege	3160	powershell.exe
Token: SeDebugPrivilege	2236	powershell.exe
Token: SeDebugPrivilege	5052	powershell.exe
Token: SeShutdownPrivilege	5440	sparkle.exe
Token: SeCreatePagefilePrivilege	5440	sparkle.exe
Token: SeDebugPrivilege	5028	powershell.exe
Token: SeDebugPrivilege	5952	powershell.exe
Token: SeDebugPrivilege	1520	powershell.exe
Token: SeShutdownPrivilege	5440	sparkle.exe
Token: SeCreatePagefilePrivilege	5440	sparkle.exe
Token: SeIncreaseQuotaPrivilege	6120	powershell.exe
Token: SeSecurityPrivilege	6120	powershell.exe
Token: SeTakeOwnershipPrivilege	6120	powershell.exe
Token: SeLoadDriverPrivilege	6120	powershell.exe
Token: SeSystemProfilePrivilege	6120	powershell.exe
Token: SeSystemtimePrivilege	6120	powershell.exe
Token: SeProfSingleProcessPrivilege	6120	powershell.exe

Suspicious use of WriteProcessMemory 39 IoCs

description	pid	Process	procid_target
PID 1452 wrote to memory of 5000	1452	sparkle-2.17.0-setup.exe	79
PID 1452 wrote to memory of 3248	1452	sparkle-2.17.0-setup.exe	81
PID 1452 wrote to memory of 736	1452	sparkle-2.17.0-setup.exe	83
PID 5440 wrote to memory of 4332	5440	sparkle.exe	88
PID 4332 wrote to memory of 3704	4332	cmd.exe	90
PID 5440 wrote to memory of 2952	5440	sparkle.exe	91
PID 5440 wrote to memory of 2952	5440	sparkle.exe	91
PID 5440 wrote to memory of 1504	5440	sparkle.exe	92
PID 5440 wrote to memory of 4996	5440	sparkle.exe	93
PID 5440 wrote to memory of 5712	5440	sparkle.exe	94
PID 5440 wrote to memory of 2860	5440	sparkle.exe	96
PID 2860 wrote to memory of 3372	2860	cmd.exe	98
PID 5440 wrote to memory of 1860	5440	sparkle.exe	99
PID 5440 wrote to memory of 3280	5440	sparkle.exe	100
PID 5440 wrote to memory of 3160	5440	sparkle.exe	101
PID 5440 wrote to memory of 3376	5440	sparkle.exe	102
PID 5440 wrote to memory of 2212	5440	sparkle.exe	103
PID 5440 wrote to memory of 1736	5440	sparkle.exe	104
PID 5440 wrote to memory of 1584	5440	sparkle.exe	105
PID 5440 wrote to memory of 6120	5440	sparkle.exe	106
PID 5440 wrote to memory of 2360	5440	sparkle.exe	107
PID 5440 wrote to memory of 4576	5440	sparkle.exe	108
PID 5440 wrote to memory of 1892	5440	sparkle.exe	109
PID 5440 wrote to memory of 2584	5440	sparkle.exe	110
PID 5440 wrote to memory of 3220	5440	sparkle.exe	111
PID 5440 wrote to memory of 2236	5440	sparkle.exe	112
PID 5440 wrote to memory of 5052	5440	sparkle.exe	113
PID 5440 wrote to memory of 5204	5440	sparkle.exe	114
PID 5440 wrote to memory of 4212	5440	sparkle.exe	115
PID 5440 wrote to memory of 3340	5440	sparkle.exe	116
PID 3340 wrote to memory of 2648	3340	cmd.exe	135
PID 5440 wrote to memory of 5028	5440	sparkle.exe	136
PID 5440 wrote to memory of 1520	5440	sparkle.exe	137
PID 5440 wrote to memory of 5952	5440	sparkle.exe	138
PID 1892 wrote to memory of 332	1892	powershell.exe	142
PID 5440 wrote to memory of 2744	5440	sparkle.exe	144
PID 2744 wrote to memory of 5224	2744	cmd.exe	146
PID 5440 wrote to memory of 2120	5440	sparkle.exe	148
PID 2120 wrote to memory of 3896	2120	cmd.exe	150

C:\Users\Admin\AppData\Local\Temp\sparkle-2.17.0-setup.exe
"C:\Users\Admin\AppData\Local\Temp\sparkle-2.17.0-setup.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1452
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -C "if (Get-Command Get-CimInstance -ErrorAction SilentlyContinue) { exit 0 } else { exit 1 }"
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5000
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -C "if ((Get-ExecutionPolicy -Scope Process) -eq 'Restricted') { exit 1 } else { exit 0 }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3248
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -C "if ((Get-CimInstance -ClassName Win32_Process | ? {$_.Path -and $_.Path.StartsWith('C:\Users\Admin\AppData\Local\Programs\sparkle', 'CurrentCultureIgnoreCase')}).Count -gt 0) { exit 0 } else { exit 1 }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:736

C:\Users\Admin\AppData\Local\Programs\sparkle\sparkle.exe
"C:\Users\Admin\AppData\Local\Programs\sparkle\sparkle.exe"
1⤵
- Executes dropped EXE
- Drops file in Windows directory
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5440
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "chcp"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4332
- - C:\Windows\system32\chcp.com
    chcp
    3⤵
    PID:3704
- C:\Users\Admin\AppData\Local\Programs\sparkle\sparkle.exe
  "C:\Users\Admin\AppData\Local\Programs\sparkle\sparkle.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\sparkle" --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAAQAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1620,i,10404119064111695267,15392372908217878700,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1624,i,4331507828680441852,15257185340763434936,4 --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=1616 /prefetch:2
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:2952
- C:\Users\Admin\AppData\Local\Programs\sparkle\sparkle.exe
  "C:\Users\Admin\AppData\Local\Programs\sparkle\sparkle.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\sparkle" --field-trial-handle=1620,i,10404119064111695267,15392372908217878700,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1624,i,4331507828680441852,15257185340763434936,4 --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=2108 /prefetch:11
  2⤵
  - Executes dropped EXE
  PID:1504
- C:\Users\Admin\AppData\Local\Programs\sparkle\sparkle.exe
  "C:\Users\Admin\AppData\Local\Programs\sparkle\sparkle.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\sparkle" --app-path="C:\Users\Admin\AppData\Local\Programs\sparkle\resources\app.asar" --no-sandbox --no-zygote --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --field-trial-handle=1620,i,10404119064111695267,15392372908217878700,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1624,i,4331507828680441852,15257185340763434936,4 --trace-process-track-uuid=3190708990060038890 --mojo-platform-channel-handle=2460 /prefetch:1
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:4996
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "echo %COMPUTERNAME%.%USERDNSDOMAIN%"
  2⤵
  PID:5712
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "WHERE smartctl 2>nul"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2860
- - C:\Windows\system32\where.exe
    WHERE smartctl
    3⤵
    PID:3372
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "$OutputEncoding = [System.Console]::OutputEncoding = [System.Console]::InputEncoding = [System.Text.Encoding]::UTF8 ; Get-CimInstance win32_VideoController | fl *"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1860
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "$OutputEncoding = [System.Console]::OutputEncoding = [System.Console]::InputEncoding = [System.Text.Encoding]::UTF8 ; gp \"HKLM:\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\*\" -ErrorAction SilentlyContinue | where MatchingDeviceId $null -NE | select MatchingDeviceId,HardwareInformation.qwMemorySize | fl"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Hide Artifacts: Ignore Process Interrupts
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3280
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "$OutputEncoding = [System.Console]::OutputEncoding = [System.Console]::InputEncoding = [System.Text.Encoding]::UTF8 ; Get-CimInstance win32_desktopmonitor | fl *"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3160
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "$OutputEncoding = [System.Console]::OutputEncoding = [System.Console]::InputEncoding = [System.Text.Encoding]::UTF8 ; Get-CimInstance -Namespace root\wmi -ClassName WmiMonitorBasicDisplayParams | fl"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3376
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "$OutputEncoding = [System.Console]::OutputEncoding = [System.Console]::InputEncoding = [System.Text.Encoding]::UTF8 ; Add-Type -AssemblyName System.Windows.Forms; [System.Windows.Forms.Screen]::AllScreens"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2212
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "$OutputEncoding = [System.Console]::OutputEncoding = [System.Console]::InputEncoding = [System.Text.Encoding]::UTF8 ; Get-CimInstance -Namespace root\wmi -ClassName WmiMonitorConnectionParams | fl"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1736
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "$OutputEncoding = [System.Console]::OutputEncoding = [System.Console]::InputEncoding = [System.Text.Encoding]::UTF8 ; gwmi WmiMonitorID -Namespace root\wmi | ForEach-Object {(($_.ManufacturerName -notmatch 0 | foreach {[char]$_}) -join \"\") + \"|\" + (($_.ProductCodeID -notmatch 0 | foreach {[char]$_}) -join \"\") + \"|\" + (($_.UserFriendlyName -notmatch 0 | foreach {[char]$_}) -join \"\") + \"|\" + (($_.SerialNumberID -notmatch 0 | foreach {[char]$_}) -join \"\") + \"|\" + $_.InstanceName}"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1584
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "$OutputEncoding = [System.Console]::OutputEncoding = [System.Console]::InputEncoding = [System.Text.Encoding]::UTF8 ; Get-CimInstance Win32_OperatingSystem | select Caption,SerialNumber,BuildNumber,ServicePackMajorVersion,ServicePackMinorVersion | fl"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:6120
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "$OutputEncoding = [System.Console]::OutputEncoding = [System.Console]::InputEncoding = [System.Text.Encoding]::UTF8 ; (Get-CimInstance Win32_ComputerSystem).HypervisorPresent"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2360
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "$OutputEncoding = [System.Console]::OutputEncoding = [System.Console]::InputEncoding = [System.Text.Encoding]::UTF8 ; Add-Type -AssemblyName System.Windows.Forms; [System.Windows.Forms.SystemInformation]::TerminalServerSession"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4576
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "$OutputEncoding = [System.Console]::OutputEncoding = [System.Console]::InputEncoding = [System.Text.Encoding]::UTF8 ; reg query \"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\" /v DisplayVersion"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1892
- - C:\Windows\system32\reg.exe
    "C:\Windows\system32\reg.exe" query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion" /v DisplayVersion
    3⤵
    PID:332
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "$OutputEncoding = [System.Console]::OutputEncoding = [System.Console]::InputEncoding = [System.Text.Encoding]::UTF8 ; Get-CimInstance Win32_PhysicalMemory | select DataWidth,TotalWidth,Capacity,BankLabel,MemoryType,SMBIOSMemoryType,ConfiguredClockSpeed,Speed,FormFactor,Manufacturer,PartNumber,SerialNumber,ConfiguredVoltage,MinVoltage,MaxVoltage,Tag | fl"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2584
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "$OutputEncoding = [System.Console]::OutputEncoding = [System.Console]::InputEncoding = [System.Text.Encoding]::UTF8 ; Get-CimInstance Win32_DiskDrive | select Caption,Size,Status,PNPDeviceId,DeviceId,BytesPerSector,TotalCylinders,TotalHeads,TotalSectors,TotalTracks,TracksPerCylinder,SectorsPerTrack,FirmwareRevision,SerialNumber,InterfaceType | fl"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3220
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "$OutputEncoding = [System.Console]::OutputEncoding = [System.Console]::InputEncoding = [System.Text.Encoding]::UTF8 ; Get-PhysicalDisk | select BusType,MediaType,FriendlyName,Model,SerialNumber,Size | fl"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2236
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "$OutputEncoding = [System.Console]::OutputEncoding = [System.Console]::InputEncoding = [System.Text.Encoding]::UTF8 ; Get-WmiObject Win32_logicaldisk | select Access,Caption,FileSystem,FreeSpace,Size | fl"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5052
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "$OutputEncoding = [System.Console]::OutputEncoding = [System.Console]::InputEncoding = [System.Text.Encoding]::UTF8 ; Get-CimInstance -ClassName Win32_LogicalDisk | select Caption,DriveType,Name,FileSystem,Size,VolumeSerialNumber,VolumeName | fl"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5204
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "$OutputEncoding = [System.Console]::OutputEncoding = [System.Console]::InputEncoding = [System.Text.Encoding]::UTF8 ; Get-WmiObject -Class Win32_diskdrive | Select-Object -Property PNPDeviceId,DeviceID, Model, Size, @{L='Partitions'; E={$_.GetRelated('Win32_DiskPartition').GetRelated('Win32_LogicalDisk') | Select-Object -Property DeviceID, VolumeName, Size, FreeSpace}} | fl"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4212
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg query "HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0" /v FeatureSet"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3340
- - C:\Windows\system32\reg.exe
    reg query "HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0" /v FeatureSet
    3⤵
    - Checks processor information in registry
    PID:2648
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "$OutputEncoding = [System.Console]::OutputEncoding = [System.Console]::InputEncoding = [System.Text.Encoding]::UTF8 ; Get-CimInstance Win32_processor | select Name, Revision, L2CacheSize, L3CacheSize, Manufacturer, MaxClockSpeed, Description, UpgradeMethod, Caption, NumberOfLogicalProcessors, NumberOfCores | fl"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:5028
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "$OutputEncoding = [System.Console]::OutputEncoding = [System.Console]::InputEncoding = [System.Text.Encoding]::UTF8 ; Get-CimInstance Win32_CacheMemory | select CacheType,InstalledSize,Level | fl"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:1520
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "$OutputEncoding = [System.Console]::OutputEncoding = [System.Console]::InputEncoding = [System.Text.Encoding]::UTF8 ; (Get-CimInstance Win32_ComputerSystem).HypervisorPresent"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:5952
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "findstr /C:"Detected boot environment" "%windir%\Panther\setupact.log""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2744
- - C:\Windows\system32\findstr.exe
    findstr /C:"Detected boot environment" "C:\Windows\Panther\setupact.log"
    3⤵
    PID:5224
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Roaming\sparkle\scripts\GetWindowsVersion-1776226437841.ps1""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2120
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Roaming\sparkle\scripts\GetWindowsVersion-1776226437841.ps1"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:3896

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Ignore Process Interrupts

T1564.011

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 3KB
SHA256 18d5722b4bdd546da121b4c8756096755cab8cb7c40126d93644910d9292f343
MD5 918925b4ffb522c4188485a5e84ab6ed
SHA1 f53ee7bacfae671d898075778f668cbf727c5d5e
SHA512 82d4b87cc804c393a5c812a4dc327743ae928a44f8fd52902410ba43dfae738254e94437b0482c86a93dea416fcb87a34ed892f8541c7508545b3c98dfd4d8ea
TLSH
T1C771DF323375B0D889163F47192D59C463BF8365FA54AF4CB698624ED92700B9F222F3
MD5 SHA1 SHA512 TLSH

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
Size 2KB
SHA256 56b3adbf18e46f82c8075f712785ea8e59e3125a90ce26b8b0d20687401340d6
MD5 9957e974f5f56a44037770c8a45dfb1e
SHA1 799090afbb1a0f8ce52605687d1013278a68516d
SHA512 3967c71752cebb57254c981d715077ebd988ca8b9cab6d81aa3207770139958cbd95991d2aa0c690a7aa5908f37cba8053f388896014bbe4e47b42436cc915a6
TLSH
T1A64149303221B5D84D436F1205286AC9A2EF478AAFAC9F5CB569231DCD2A44BD7221F3
MD5 SHA1 SHA512 TLSH

Submit Download

ModuleAnalysisCache

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
Size 61KB
SHA256 eac79146599354ee6c44e0af03ab76f049305db0c500b3e143b8d220b4efecf3
MD5 ed24abb252577d8393acaedebc2762ff
SHA1 d962fee8afd1133f66e0c4748687eaaa40afc2e7
SHA512 169a6d9616a22c44866f31ce3423e6bee0242389e80c7b22082f2ae89bc47be25beb6e5046867618a4b25b71f9f577194cc3d1e364dc46821d33a89fa9dc0203
SSDEEP 1536:KflJd+h4iUxTYkzvd5fKQOUpeE711kDa5ljNC+jH0IMjMFYoe9V3CNBQkj2QOdBT:KflJd+qiUTYkzvd5fKQOUpeE711kDa5S
TLSH
T15C538392E9204E75E2E65F3EF15622627D30394690F8113211DC25EFA9879930B1FBFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download