14974c1316cc05dee713122176dc44089e77fd4784cf153355f56ee1ea99a87b

Analysis

max time kernel
120s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
15/04/2026, 03:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
sparkle.exe
Size 212.4MB
Sample260415-ee672aes7j
SHA256 14974c1316cc05dee713122176dc44089e77fd4784cf153355f56ee1ea99a87b
MD5 a11b7119c29f55e2476d5a0f04de2496
SHA1 73a44198498349582dc28ec82d97dfe57b28e470
SHA512 c1088e327efe18f7eaa8121bf34c69e57242f5e59e06f472ffb5b2a05fbe0d35fa733cbb4548f81e0199b180f9509b8dafee315d37d9f5e47c7c1a790ea97576
SSDEEP 1572864:nfXoDQCi/etwxAgy9k/CljnWqIJQkezlLMNGjpR8n+WX9ov4Ma0gmsLCKZaZWE/b:fusCD7lHjlbqE
TLSH
T175B88C03E29A41D9C01DD175575AA233FE71B8454B28B6DF2BA407522F76EF82B3DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion execution spyware stealer

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 21 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
5336	powershell.exe
5124	powershell.exe
5236	powershell.exe
1488	powershell.exe
5840	powershell.exe
1584	powershell.exe
4040	powershell.exe
2988	powershell.exe
5636	powershell.exe
4912	powershell.exe
1872	powershell.exe
2536	powershell.exe
5348	powershell.exe
2704	powershell.exe
6120	powershell.exe
4104	powershell.exe
1620	powershell.exe
1332	powershell.exe
4748	powershell.exe
5980	powershell.exe
5828	powershell.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000\Control Panel\International\Geo\Nation	sparkle.exe
Key value queried	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000\Control Panel\International\Geo\Nation	sparkle.exe

Reads ssh keys stored on the system 2 TTPs
Tries to access SSH used by SSH programs.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Hide Artifacts: Ignore Process Interrupts 1 TTPs 1 IoCs

Command interpreters often include specific commands/flags that ignore errors and other hangups.

defense_evasion

Ignore Process Interrupts

T1564.011

pid	Process
5980	powershell.exe

Checks processor information in registry 2 TTPs 26 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\~MHz	sparkle.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	sparkle.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString	sparkle.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5	sparkle.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\~MHz	sparkle.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\ProcessorNameString	sparkle.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\~MHz	sparkle.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	sparkle.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz	sparkle.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\~MHz	sparkle.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4	sparkle.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6	sparkle.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7	sparkle.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	sparkle.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	sparkle.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2	sparkle.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\ProcessorNameString	sparkle.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\~MHz	sparkle.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\ProcessorNameString	sparkle.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\ProcessorNameString	sparkle.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\ProcessorNameString	sparkle.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3	sparkle.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\ProcessorNameString	sparkle.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\~MHz	sparkle.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	reg.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\FeatureSet	reg.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4748	powershell.exe
4748	powershell.exe
5348	powershell.exe
5348	powershell.exe
5980	powershell.exe
5980	powershell.exe
6120	powershell.exe
6120	powershell.exe
5828	powershell.exe
5828	powershell.exe
1584	powershell.exe
1620	powershell.exe
1584	powershell.exe
1620	powershell.exe
5236	powershell.exe
5236	powershell.exe
5840	powershell.exe
5840	powershell.exe
5636	powershell.exe
5636	powershell.exe
2704	powershell.exe
2704	powershell.exe
2988	powershell.exe
2988	powershell.exe
5124	powershell.exe
5124	powershell.exe
2536	powershell.exe
2536	powershell.exe
4040	powershell.exe
4040	powershell.exe
1332	powershell.exe
1332	powershell.exe
5336	powershell.exe
5336	powershell.exe
4748	powershell.exe
4748	powershell.exe
5840	powershell.exe
5828	powershell.exe
5980	powershell.exe
5348	powershell.exe
5348	powershell.exe
2988	powershell.exe
2536	powershell.exe
5124	powershell.exe
2704	powershell.exe
1620	powershell.exe
5636	powershell.exe
6120	powershell.exe
6120	powershell.exe
1332	powershell.exe
1584	powershell.exe
1584	powershell.exe
5236	powershell.exe
4040	powershell.exe
5336	powershell.exe
4912	powershell.exe
4912	powershell.exe
4104	powershell.exe
4104	powershell.exe
1488	powershell.exe
1488	powershell.exe
4912	powershell.exe
4104	powershell.exe
1488	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1552	sparkle.exe
Token: SeCreatePagefilePrivilege	1552	sparkle.exe
Token: SeShutdownPrivilege	1552	sparkle.exe
Token: SeCreatePagefilePrivilege	1552	sparkle.exe
Token: SeShutdownPrivilege	1552	sparkle.exe
Token: SeCreatePagefilePrivilege	1552	sparkle.exe
Token: SeDebugPrivilege	4748	powershell.exe
Token: SeDebugPrivilege	5348	powershell.exe
Token: SeDebugPrivilege	5980	powershell.exe
Token: SeDebugPrivilege	6120	powershell.exe
Token: SeDebugPrivilege	5828	powershell.exe
Token: SeDebugPrivilege	1584	powershell.exe
Token: SeDebugPrivilege	1620	powershell.exe
Token: SeDebugPrivilege	5236	powershell.exe
Token: SeDebugPrivilege	5840	powershell.exe
Token: SeDebugPrivilege	5636	powershell.exe
Token: SeDebugPrivilege	2704	powershell.exe
Token: SeDebugPrivilege	2988	powershell.exe
Token: SeDebugPrivilege	2536	powershell.exe
Token: SeDebugPrivilege	5124	powershell.exe
Token: SeDebugPrivilege	4040	powershell.exe
Token: SeDebugPrivilege	1332	powershell.exe
Token: SeDebugPrivilege	5336	powershell.exe
Token: SeShutdownPrivilege	1552	sparkle.exe
Token: SeCreatePagefilePrivilege	1552	sparkle.exe
Token: SeShutdownPrivilege	1552	sparkle.exe
Token: SeCreatePagefilePrivilege	1552	sparkle.exe
Token: SeIncreaseQuotaPrivilege	5840	powershell.exe
Token: SeSecurityPrivilege	5840	powershell.exe
Token: SeTakeOwnershipPrivilege	5840	powershell.exe
Token: SeLoadDriverPrivilege	5840	powershell.exe
Token: SeSystemProfilePrivilege	5840	powershell.exe
Token: SeSystemtimePrivilege	5840	powershell.exe
Token: SeProfSingleProcessPrivilege	5840	powershell.exe
Token: SeIncBasePriorityPrivilege	5840	powershell.exe
Token: SeCreatePagefilePrivilege	5840	powershell.exe
Token: SeBackupPrivilege	5840	powershell.exe
Token: SeRestorePrivilege	5840	powershell.exe
Token: SeShutdownPrivilege	5840	powershell.exe
Token: SeDebugPrivilege	5840	powershell.exe
Token: SeSystemEnvironmentPrivilege	5840	powershell.exe
Token: SeRemoteShutdownPrivilege	5840	powershell.exe
Token: SeUndockPrivilege	5840	powershell.exe
Token: SeManageVolumePrivilege	5840	powershell.exe
Token: 33	5840	powershell.exe
Token: 34	5840	powershell.exe
Token: 35	5840	powershell.exe
Token: 36	5840	powershell.exe
Token: SeIncreaseQuotaPrivilege	4748	powershell.exe
Token: SeSecurityPrivilege	4748	powershell.exe
Token: SeTakeOwnershipPrivilege	4748	powershell.exe
Token: SeLoadDriverPrivilege	4748	powershell.exe
Token: SeSystemProfilePrivilege	4748	powershell.exe
Token: SeSystemtimePrivilege	4748	powershell.exe
Token: SeProfSingleProcessPrivilege	4748	powershell.exe
Token: SeIncBasePriorityPrivilege	4748	powershell.exe
Token: SeCreatePagefilePrivilege	4748	powershell.exe
Token: SeBackupPrivilege	4748	powershell.exe
Token: SeRestorePrivilege	4748	powershell.exe
Token: SeShutdownPrivilege	4748	powershell.exe
Token: SeDebugPrivilege	4748	powershell.exe
Token: SeSystemEnvironmentPrivilege	4748	powershell.exe
Token: SeRemoteShutdownPrivilege	4748	powershell.exe
Token: SeUndockPrivilege	4748	powershell.exe

Suspicious use of WriteProcessMemory 36 IoCs

description	pid	Process	procid_target
PID 1552 wrote to memory of 2788	1552	sparkle.exe	85
PID 2788 wrote to memory of 3924	2788	cmd.exe	87
PID 1552 wrote to memory of 4596	1552	sparkle.exe	88
PID 1552 wrote to memory of 4596	1552	sparkle.exe	88
PID 1552 wrote to memory of 5344	1552	sparkle.exe	89
PID 1552 wrote to memory of 5248	1552	sparkle.exe	90
PID 1552 wrote to memory of 1760	1552	sparkle.exe	91
PID 1552 wrote to memory of 6104	1552	sparkle.exe	93
PID 6104 wrote to memory of 2484	6104	cmd.exe	95
PID 1552 wrote to memory of 5336	1552	sparkle.exe	96
PID 1552 wrote to memory of 5980	1552	sparkle.exe	97
PID 1552 wrote to memory of 5236	1552	sparkle.exe	98
PID 1552 wrote to memory of 4748	1552	sparkle.exe	99
PID 1552 wrote to memory of 6120	1552	sparkle.exe	100
PID 1552 wrote to memory of 1332	1552	sparkle.exe	102
PID 1552 wrote to memory of 5636	1552	sparkle.exe	103
PID 1552 wrote to memory of 2988	1552	sparkle.exe	104
PID 1552 wrote to memory of 1620	1552	sparkle.exe	105
PID 1552 wrote to memory of 1584	1552	sparkle.exe	106
PID 1552 wrote to memory of 2704	1552	sparkle.exe	107
PID 1552 wrote to memory of 5840	1552	sparkle.exe	108
PID 1552 wrote to memory of 5348	1552	sparkle.exe	109
PID 1552 wrote to memory of 2536	1552	sparkle.exe	110
PID 1552 wrote to memory of 4040	1552	sparkle.exe	112
PID 1552 wrote to memory of 5828	1552	sparkle.exe	113
PID 1552 wrote to memory of 5124	1552	sparkle.exe	114
PID 1552 wrote to memory of 3036	1552	sparkle.exe	115
PID 3036 wrote to memory of 2860	3036	cmd.exe	132
PID 1552 wrote to memory of 4104	1552	sparkle.exe	133
PID 1552 wrote to memory of 4912	1552	sparkle.exe	134
PID 1552 wrote to memory of 1488	1552	sparkle.exe	135
PID 2704 wrote to memory of 4528	2704	powershell.exe	139
PID 1552 wrote to memory of 4432	1552	sparkle.exe	143
PID 4432 wrote to memory of 5500	4432	cmd.exe	145
PID 1552 wrote to memory of 2164	1552	sparkle.exe	151
PID 2164 wrote to memory of 1872	2164	cmd.exe	153

C:\Users\Admin\AppData\Local\Temp\sparkle.exe
"C:\Users\Admin\AppData\Local\Temp\sparkle.exe"
1⤵
- Checks computer location settings
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1552
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "chcp"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2788
- - C:\Windows\system32\chcp.com
    chcp
    3⤵
    PID:3924
- C:\Users\Admin\AppData\Local\Temp\sparkle.exe
  "C:\Users\Admin\AppData\Local\Temp\sparkle.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\sparkle" --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAAQAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1712,i,12511434161247825315,4342258901526814362,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1716,i,8078286496975441641,780414259192903021,4 --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=1708 /prefetch:2
  2⤵
  PID:4596
- C:\Users\Admin\AppData\Local\Temp\sparkle.exe
  "C:\Users\Admin\AppData\Local\Temp\sparkle.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\sparkle" --field-trial-handle=1712,i,12511434161247825315,4342258901526814362,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1716,i,8078286496975441641,780414259192903021,4 --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=2068 /prefetch:3
  2⤵
  PID:5344
- C:\Users\Admin\AppData\Local\Temp\sparkle.exe
  "C:\Users\Admin\AppData\Local\Temp\sparkle.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\sparkle" --app-path="C:\Users\Admin\AppData\Local\Temp\resources\app.asar" --no-sandbox --no-zygote --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --field-trial-handle=1712,i,12511434161247825315,4342258901526814362,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1716,i,8078286496975441641,780414259192903021,4 --trace-process-track-uuid=3190708990060038890 --mojo-platform-channel-handle=2476 /prefetch:1
  2⤵
  - Checks computer location settings
  PID:5248
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "echo %COMPUTERNAME%.%USERDNSDOMAIN%"
  2⤵
  PID:1760
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "WHERE smartctl 2>nul"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:6104
- - C:\Windows\system32\where.exe
    WHERE smartctl
    3⤵
    PID:2484
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "$OutputEncoding = [System.Console]::OutputEncoding = [System.Console]::InputEncoding = [System.Text.Encoding]::UTF8 ; Get-CimInstance win32_VideoController | fl *"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5336
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "$OutputEncoding = [System.Console]::OutputEncoding = [System.Console]::InputEncoding = [System.Text.Encoding]::UTF8 ; gp \"HKLM:\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\*\" -ErrorAction SilentlyContinue | where MatchingDeviceId $null -NE | select MatchingDeviceId,HardwareInformation.qwMemorySize | fl"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Hide Artifacts: Ignore Process Interrupts
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5980
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "$OutputEncoding = [System.Console]::OutputEncoding = [System.Console]::InputEncoding = [System.Text.Encoding]::UTF8 ; Get-CimInstance win32_desktopmonitor | fl *"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5236
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "$OutputEncoding = [System.Console]::OutputEncoding = [System.Console]::InputEncoding = [System.Text.Encoding]::UTF8 ; Get-CimInstance -Namespace root\wmi -ClassName WmiMonitorBasicDisplayParams | fl"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4748
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "$OutputEncoding = [System.Console]::OutputEncoding = [System.Console]::InputEncoding = [System.Text.Encoding]::UTF8 ; Add-Type -AssemblyName System.Windows.Forms; [System.Windows.Forms.Screen]::AllScreens"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:6120
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "$OutputEncoding = [System.Console]::OutputEncoding = [System.Console]::InputEncoding = [System.Text.Encoding]::UTF8 ; Get-CimInstance -Namespace root\wmi -ClassName WmiMonitorConnectionParams | fl"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1332
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "$OutputEncoding = [System.Console]::OutputEncoding = [System.Console]::InputEncoding = [System.Text.Encoding]::UTF8 ; gwmi WmiMonitorID -Namespace root\wmi | ForEach-Object {(($_.ManufacturerName -notmatch 0 | foreach {[char]$_}) -join \"\") + \"|\" + (($_.ProductCodeID -notmatch 0 | foreach {[char]$_}) -join \"\") + \"|\" + (($_.UserFriendlyName -notmatch 0 | foreach {[char]$_}) -join \"\") + \"|\" + (($_.SerialNumberID -notmatch 0 | foreach {[char]$_}) -join \"\") + \"|\" + $_.InstanceName}"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5636
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "$OutputEncoding = [System.Console]::OutputEncoding = [System.Console]::InputEncoding = [System.Text.Encoding]::UTF8 ; Get-CimInstance Win32_OperatingSystem | select Caption,SerialNumber,BuildNumber,ServicePackMajorVersion,ServicePackMinorVersion | fl"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2988
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "$OutputEncoding = [System.Console]::OutputEncoding = [System.Console]::InputEncoding = [System.Text.Encoding]::UTF8 ; (Get-CimInstance Win32_ComputerSystem).HypervisorPresent"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1620
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "$OutputEncoding = [System.Console]::OutputEncoding = [System.Console]::InputEncoding = [System.Text.Encoding]::UTF8 ; Add-Type -AssemblyName System.Windows.Forms; [System.Windows.Forms.SystemInformation]::TerminalServerSession"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1584
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "$OutputEncoding = [System.Console]::OutputEncoding = [System.Console]::InputEncoding = [System.Text.Encoding]::UTF8 ; reg query \"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\" /v DisplayVersion"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2704
- - C:\Windows\system32\reg.exe
    "C:\Windows\system32\reg.exe" query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion" /v DisplayVersion
    3⤵
    PID:4528
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "$OutputEncoding = [System.Console]::OutputEncoding = [System.Console]::InputEncoding = [System.Text.Encoding]::UTF8 ; Get-CimInstance Win32_PhysicalMemory | select DataWidth,TotalWidth,Capacity,BankLabel,MemoryType,SMBIOSMemoryType,ConfiguredClockSpeed,Speed,FormFactor,Manufacturer,PartNumber,SerialNumber,ConfiguredVoltage,MinVoltage,MaxVoltage,Tag | fl"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5840
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "$OutputEncoding = [System.Console]::OutputEncoding = [System.Console]::InputEncoding = [System.Text.Encoding]::UTF8 ; Get-CimInstance Win32_DiskDrive | select Caption,Size,Status,PNPDeviceId,DeviceId,BytesPerSector,TotalCylinders,TotalHeads,TotalSectors,TotalTracks,TracksPerCylinder,SectorsPerTrack,FirmwareRevision,SerialNumber,InterfaceType | fl"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5348
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "$OutputEncoding = [System.Console]::OutputEncoding = [System.Console]::InputEncoding = [System.Text.Encoding]::UTF8 ; Get-PhysicalDisk | select BusType,MediaType,FriendlyName,Model,SerialNumber,Size | fl"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2536
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "$OutputEncoding = [System.Console]::OutputEncoding = [System.Console]::InputEncoding = [System.Text.Encoding]::UTF8 ; Get-WmiObject Win32_logicaldisk | select Access,Caption,FileSystem,FreeSpace,Size | fl"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4040
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "$OutputEncoding = [System.Console]::OutputEncoding = [System.Console]::InputEncoding = [System.Text.Encoding]::UTF8 ; Get-CimInstance -ClassName Win32_LogicalDisk | select Caption,DriveType,Name,FileSystem,Size,VolumeSerialNumber,VolumeName | fl"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5828
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "$OutputEncoding = [System.Console]::OutputEncoding = [System.Console]::InputEncoding = [System.Text.Encoding]::UTF8 ; Get-WmiObject -Class Win32_diskdrive | Select-Object -Property PNPDeviceId,DeviceID, Model, Size, @{L='Partitions'; E={$_.GetRelated('Win32_DiskPartition').GetRelated('Win32_LogicalDisk') | Select-Object -Property DeviceID, VolumeName, Size, FreeSpace}} | fl"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5124
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg query "HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0" /v FeatureSet"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3036
- - C:\Windows\system32\reg.exe
    reg query "HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0" /v FeatureSet
    3⤵
    - Checks processor information in registry
    PID:2860
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "$OutputEncoding = [System.Console]::OutputEncoding = [System.Console]::InputEncoding = [System.Text.Encoding]::UTF8 ; Get-CimInstance Win32_processor | select Name, Revision, L2CacheSize, L3CacheSize, Manufacturer, MaxClockSpeed, Description, UpgradeMethod, Caption, NumberOfLogicalProcessors, NumberOfCores | fl"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:4104
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "$OutputEncoding = [System.Console]::OutputEncoding = [System.Console]::InputEncoding = [System.Text.Encoding]::UTF8 ; Get-CimInstance Win32_CacheMemory | select CacheType,InstalledSize,Level | fl"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:4912
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "$OutputEncoding = [System.Console]::OutputEncoding = [System.Console]::InputEncoding = [System.Text.Encoding]::UTF8 ; (Get-CimInstance Win32_ComputerSystem).HypervisorPresent"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:1488
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "findstr /C:"Detected boot environment" "%windir%\Panther\setupact.log""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4432
- - C:\Windows\system32\findstr.exe
    findstr /C:"Detected boot environment" "C:\Windows\Panther\setupact.log"
    3⤵
    PID:5500
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Roaming\sparkle\scripts\GetWindowsVersion-1776226432420.ps1""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2164
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Roaming\sparkle\scripts\GetWindowsVersion-1776226432420.ps1"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:1872

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Ignore Process Interrupts

T1564.011

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...