0523f925c30670d859aefa2c248b26bb5587c143a14ceac579e816cffbe8266e

Analysis

user interaction
yes
max time kernel
398s
max time network
385s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
23/04/2026, 12:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a.exe
Size 7.4MB
Sample260423-pe2mnact9v
SHA256 0523f925c30670d859aefa2c248b26bb5587c143a14ceac579e816cffbe8266e
MD5 f775b3c0681a875734be04211bb8e56e
SHA1 6f8f8e7b2bd18d89a0c570fc7f261a99661405c2
SHA512 4ed39126a8fd38c9199489df4daa175925af6eaee6c1e256aa46d333f45ec1b643bb2efc00de23bb9308ca7f7226281c1160d1dd6ae2985066780661d72607ca
SSDEEP 49152:oZSuLnx9K8Cn+pPmCgplCq6bSJC/ICIzi2fgBwocZbca5qoi2s0PSZM+YH3D0Ar3:oAt8WVjuIlzicg6ZpeoTL9aNE
TLSH
T1A5764A43ECA545E9C1E9E1308A669213BF72BC484B2127D72B60F7286F76BD07E78750
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

defense_evasion discovery execution spyware trojan

Malware Config

Signatures

Enumerates VirtualBox registry keys 2 TTPs 5 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxGuest	al-khaser_x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxMouse	al-khaser_x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxService	al-khaser_x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxSF	al-khaser_x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxVideo	al-khaser_x64.exe

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 3 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	al-khaser_x64.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\FADT\VBOX__	al-khaser_x64.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\RSDT\VBOX__	al-khaser_x64.exe

Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions	al-khaser_x64.exe

Looks for VMWare Tools registry key 2 TTPs 1 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools	al-khaser_x64.exe

Checks BIOS information in registry 2 TTPs 3 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	al-khaser_x64.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	al-khaser_x64.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	al-khaser_x64.exe

Executes dropped EXE 1 IoCs

pid	Process
2324	al-khaser_x64.exe

Identifies Wine through registry keys 2 TTPs 1 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000\SOFTWARE\Wine	al-khaser_x64.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 16 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
2092	powershell.exe
2564	powershell.exe
4788	powershell.exe
3980	powershell.exe
4788	powershell.exe
368	powershell.exe
4656	powershell.exe
2820	powershell.exe
824	powershell.exe
2676	powershell.exe
2040	powershell.exe
772	powershell.exe
5004	powershell.exe
1424	powershell.exe
2964	powershell.exe
1040	powershell.exe

Looks up external IP address via web service 3 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
29	api.ipify.org
30	api.ipify.org
48	ip-api.com

Maps connected drives based on registry 3 TTPs 3 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0	al-khaser_x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	al-khaser_x64.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\Count	al-khaser_x64.exe

Checks system information in the registry 2 TTPs 2 IoCs

System information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	al-khaser_x64.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	al-khaser_x64.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs

pid	Process
2324	al-khaser_x64.exe
2324	al-khaser_x64.exe
2324	al-khaser_x64.exe

Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs

Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\VBoxMiniRdrDN	al-khaser_x64.exe

Hide Artifacts: Ignore Process Interrupts 1 TTPs 3 IoCs

Command interpreters often include specific commands/flags that ignore errors and other hangups.

defense_evasion

Ignore Process Interrupts

T1564.011

pid	Process
4360	powershell.exe
220	powershell.exe
1040	powershell.exe

Modifies trusted root certificate store through registry 1 TTPs 2 IoCs

A root certificate was added, modified, or removed in the trusted certificate store registry paths.

defense_evasion

Install Root Certificate

T1553.004

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e14000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	a.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 5c0000000100000004000000001000001900000001000000100000002fe1f70bb05d7c92335bc5e05b984da60f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f63030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e814000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e20000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	a.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1520	dotnet.exe

Checks SCSI registry key(s) 3 TTPs 8 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	al-khaser_x64.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	al-khaser_x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	al-khaser_x64.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	al-khaser_x64.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	al-khaser_x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe

Modifies registry key 1 TTPs 4 IoCs

Modify Registry

T1112

pid	Process
2452	reg.exe
1060	reg.exe
3904	reg.exe
4356	reg.exe

Modifies system certificate store 2 TTPs 6 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1CBCA5DB2D52A7F693B674DE5F05A1D0C957DF0	a.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1CBCA5DB2D52A7F693B674DE5F05A1D0C957DF0\Blob = 0f00000001000000300000000b043572c899dec43efd590cfce610cf443a6315925ebfe589f7506907e44824608489581c7ca0e041458514cf157614090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c06200000001000000200000004ff460d54b9c86dabfbcfc5712e0400d2bed3fbc4d4fbdaa86e06adcd2a9ad7a0b00000001000000180000005300650063007400690067006f00200045004300430000001400000001000000140000003ae10986d4cf19c29676744976dce035c663639a1d0000000100000010000000280cf6042c30a2646644ba7286a3aa97030000000100000014000000d1cbca5db2d52a7f693b674de5f05a1d0c957df02000000001000000930200003082028f30820215a00302010202105c8b99c55a94c5d27156decd8980cc26300a06082a8648ce3d040303308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374204543432043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374204543432043657274696669636174696f6e20417574686f726974793076301006072a8648ce3d020106052b81040022036200041aac545aa9f96823e77ad5246f53c65ad84babc6d5b6d1e67371aedd9cd60c61fddba08903b80514ec57ceee5d3fe221b3cef7d48a79e0a3837e2d97d061c4f199dc259163ab7f30a3b470e2c7a1339cf3bf2e5c53b15fb37d327f8a34e37979a3423040301d0603551d0e041604143ae10986d4cf19c29676744976dce035c663639a300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300a06082a8648ce3d040303036800306502303667a11608dce49700411d4ebee16301cf3baa421164a09d94390211795c7b1dfa64b9ee1642b3bf8ac209c4ece4b14d023100e92a61478c524a4b4e1870f6d644d66ef583ba6d58bd24d95648eaefc4a24681886a3a46d1a99b4dc961dad15d576a18	a.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1CBCA5DB2D52A7F693B674DE5F05A1D0C957DF0\Blob = 040000000100000010000000fa68bcd9b57fadfdc91d068328cc24c1030000000100000014000000d1cbca5db2d52a7f693b674de5f05a1d0c957df01d0000000100000010000000280cf6042c30a2646644ba7286a3aa971400000001000000140000003ae10986d4cf19c29676744976dce035c663639a0b00000001000000180000005300650063007400690067006f00200045004300430000006200000001000000200000004ff460d54b9c86dabfbcfc5712e0400d2bed3fbc4d4fbdaa86e06adcd2a9ad7a53000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f00000001000000300000000b043572c899dec43efd590cfce610cf443a6315925ebfe589f7506907e44824608489581c7ca0e041458514cf1576142000000001000000930200003082028f30820215a00302010202105c8b99c55a94c5d27156decd8980cc26300a06082a8648ce3d040303308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374204543432043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374204543432043657274696669636174696f6e20417574686f726974793076301006072a8648ce3d020106052b81040022036200041aac545aa9f96823e77ad5246f53c65ad84babc6d5b6d1e67371aedd9cd60c61fddba08903b80514ec57ceee5d3fe221b3cef7d48a79e0a3837e2d97d061c4f199dc259163ab7f30a3b470e2c7a1339cf3bf2e5c53b15fb37d327f8a34e37979a3423040301d0603551d0e041604143ae10986d4cf19c29676744976dce035c663639a300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300a06082a8648ce3d040303036800306502303667a11608dce49700411d4ebee16301cf3baa421164a09d94390211795c7b1dfa64b9ee1642b3bf8ac209c4ece4b14d023100e92a61478c524a4b4e1870f6d644d66ef583ba6d58bd24d95648eaefc4a24681886a3a46d1a99b4dc961dad15d576a18	a.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1CBCA5DB2D52A7F693B674DE5F05A1D0C957DF0\Blob = 19000000010000001000000076935b5c5a037216daaf8aac76df42c10f00000001000000300000000b043572c899dec43efd590cfce610cf443a6315925ebfe589f7506907e44824608489581c7ca0e041458514cf157614090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c06200000001000000200000004ff460d54b9c86dabfbcfc5712e0400d2bed3fbc4d4fbdaa86e06adcd2a9ad7a0b00000001000000180000005300650063007400690067006f00200045004300430000001400000001000000140000003ae10986d4cf19c29676744976dce035c663639a1d0000000100000010000000280cf6042c30a2646644ba7286a3aa97030000000100000014000000d1cbca5db2d52a7f693b674de5f05a1d0c957df0040000000100000010000000fa68bcd9b57fadfdc91d068328cc24c12000000001000000930200003082028f30820215a00302010202105c8b99c55a94c5d27156decd8980cc26300a06082a8648ce3d040303308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374204543432043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374204543432043657274696669636174696f6e20417574686f726974793076301006072a8648ce3d020106052b81040022036200041aac545aa9f96823e77ad5246f53c65ad84babc6d5b6d1e67371aedd9cd60c61fddba08903b80514ec57ceee5d3fe221b3cef7d48a79e0a3837e2d97d061c4f199dc259163ab7f30a3b470e2c7a1339cf3bf2e5c53b15fb37d327f8a34e37979a3423040301d0603551d0e041604143ae10986d4cf19c29676744976dce035c663639a300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300a06082a8648ce3d040303036800306502303667a11608dce49700411d4ebee16301cf3baa421164a09d94390211795c7b1dfa64b9ee1642b3bf8ac209c4ece4b14d023100e92a61478c524a4b4e1870f6d644d66ef583ba6d58bd24d95648eaefc4a24681886a3a46d1a99b4dc961dad15d576a18	a.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1CBCA5DB2D52A7F693B674DE5F05A1D0C957DF0\Blob = 5c000000010000000400000080010000040000000100000010000000fa68bcd9b57fadfdc91d068328cc24c1030000000100000014000000d1cbca5db2d52a7f693b674de5f05a1d0c957df01d0000000100000010000000280cf6042c30a2646644ba7286a3aa971400000001000000140000003ae10986d4cf19c29676744976dce035c663639a0b00000001000000180000005300650063007400690067006f00200045004300430000006200000001000000200000004ff460d54b9c86dabfbcfc5712e0400d2bed3fbc4d4fbdaa86e06adcd2a9ad7a53000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f00000001000000300000000b043572c899dec43efd590cfce610cf443a6315925ebfe589f7506907e44824608489581c7ca0e041458514cf15761419000000010000001000000076935b5c5a037216daaf8aac76df42c12000000001000000930200003082028f30820215a00302010202105c8b99c55a94c5d27156decd8980cc26300a06082a8648ce3d040303308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374204543432043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374204543432043657274696669636174696f6e20417574686f726974793076301006072a8648ce3d020106052b81040022036200041aac545aa9f96823e77ad5246f53c65ad84babc6d5b6d1e67371aedd9cd60c61fddba08903b80514ec57ceee5d3fe221b3cef7d48a79e0a3837e2d97d061c4f199dc259163ab7f30a3b470e2c7a1339cf3bf2e5c53b15fb37d327f8a34e37979a3423040301d0603551d0e041604143ae10986d4cf19c29676744976dce035c663639a300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300a06082a8648ce3d040303036800306502303667a11608dce49700411d4ebee16301cf3baa421164a09d94390211795c7b1dfa64b9ee1642b3bf8ac209c4ece4b14d023100e92a61478c524a4b4e1870f6d644d66ef583ba6d58bd24d95648eaefc4a24681886a3a46d1a99b4dc961dad15d576a18	a.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8	a.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
368	powershell.exe
368	powershell.exe
772	powershell.exe
772	powershell.exe
2092	powershell.exe
2092	powershell.exe
4788	powershell.exe
4788	powershell.exe
4656	powershell.exe
4656	powershell.exe
2820	powershell.exe
2820	powershell.exe
5004	powershell.exe
5004	powershell.exe
2564	powershell.exe
2564	powershell.exe
1424	powershell.exe
1424	powershell.exe
824	powershell.exe
824	powershell.exe
2964	powershell.exe
2964	powershell.exe
2676	powershell.exe
2676	powershell.exe
3980	powershell.exe
3980	powershell.exe
4788	powershell.exe
4788	powershell.exe
4788	powershell.exe
4360	powershell.exe
4360	powershell.exe
220	powershell.exe
220	powershell.exe
1040	powershell.exe
1040	powershell.exe
2040	powershell.exe
2040	powershell.exe
2324	al-khaser_x64.exe
2324	al-khaser_x64.exe
2324	al-khaser_x64.exe
2324	al-khaser_x64.exe
2324	al-khaser_x64.exe
2324	al-khaser_x64.exe
2324	al-khaser_x64.exe
2324	al-khaser_x64.exe
2324	al-khaser_x64.exe
2324	al-khaser_x64.exe
2324	al-khaser_x64.exe
2324	al-khaser_x64.exe
2324	al-khaser_x64.exe
2324	al-khaser_x64.exe
2324	al-khaser_x64.exe
2324	al-khaser_x64.exe
2324	al-khaser_x64.exe
2324	al-khaser_x64.exe
2324	al-khaser_x64.exe
2324	al-khaser_x64.exe
2324	al-khaser_x64.exe
2324	al-khaser_x64.exe
2324	al-khaser_x64.exe
2324	al-khaser_x64.exe
4364	taskmgr.exe
4364	taskmgr.exe
4364	taskmgr.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	368	powershell.exe
Token: SeDebugPrivilege	772	powershell.exe
Token: SeIncreaseQuotaPrivilege	772	powershell.exe
Token: SeSecurityPrivilege	772	powershell.exe
Token: SeTakeOwnershipPrivilege	772	powershell.exe
Token: SeLoadDriverPrivilege	772	powershell.exe
Token: SeSystemProfilePrivilege	772	powershell.exe
Token: SeSystemtimePrivilege	772	powershell.exe
Token: SeProfSingleProcessPrivilege	772	powershell.exe
Token: SeIncBasePriorityPrivilege	772	powershell.exe
Token: SeCreatePagefilePrivilege	772	powershell.exe
Token: SeBackupPrivilege	772	powershell.exe
Token: SeRestorePrivilege	772	powershell.exe
Token: SeShutdownPrivilege	772	powershell.exe
Token: SeDebugPrivilege	772	powershell.exe
Token: SeSystemEnvironmentPrivilege	772	powershell.exe
Token: SeRemoteShutdownPrivilege	772	powershell.exe
Token: SeUndockPrivilege	772	powershell.exe
Token: SeManageVolumePrivilege	772	powershell.exe
Token: 33	772	powershell.exe
Token: 34	772	powershell.exe
Token: 35	772	powershell.exe
Token: 36	772	powershell.exe
Token: SeDebugPrivilege	2092	powershell.exe
Token: SeIncreaseQuotaPrivilege	2092	powershell.exe
Token: SeSecurityPrivilege	2092	powershell.exe
Token: SeTakeOwnershipPrivilege	2092	powershell.exe
Token: SeLoadDriverPrivilege	2092	powershell.exe
Token: SeSystemProfilePrivilege	2092	powershell.exe
Token: SeSystemtimePrivilege	2092	powershell.exe
Token: SeProfSingleProcessPrivilege	2092	powershell.exe
Token: SeIncBasePriorityPrivilege	2092	powershell.exe
Token: SeCreatePagefilePrivilege	2092	powershell.exe
Token: SeBackupPrivilege	2092	powershell.exe
Token: SeRestorePrivilege	2092	powershell.exe
Token: SeShutdownPrivilege	2092	powershell.exe
Token: SeDebugPrivilege	2092	powershell.exe
Token: SeSystemEnvironmentPrivilege	2092	powershell.exe
Token: SeRemoteShutdownPrivilege	2092	powershell.exe
Token: SeUndockPrivilege	2092	powershell.exe
Token: SeManageVolumePrivilege	2092	powershell.exe
Token: 33	2092	powershell.exe
Token: 34	2092	powershell.exe
Token: 35	2092	powershell.exe
Token: 36	2092	powershell.exe
Token: SeDebugPrivilege	4788	powershell.exe
Token: SeIncreaseQuotaPrivilege	4788	powershell.exe
Token: SeSecurityPrivilege	4788	powershell.exe
Token: SeTakeOwnershipPrivilege	4788	powershell.exe
Token: SeLoadDriverPrivilege	4788	powershell.exe
Token: SeSystemProfilePrivilege	4788	powershell.exe
Token: SeSystemtimePrivilege	4788	powershell.exe
Token: SeProfSingleProcessPrivilege	4788	powershell.exe
Token: SeIncBasePriorityPrivilege	4788	powershell.exe
Token: SeCreatePagefilePrivilege	4788	powershell.exe
Token: SeBackupPrivilege	4788	powershell.exe
Token: SeRestorePrivilege	4788	powershell.exe
Token: SeShutdownPrivilege	4788	powershell.exe
Token: SeDebugPrivilege	4788	powershell.exe
Token: SeSystemEnvironmentPrivilege	4788	powershell.exe
Token: SeRemoteShutdownPrivilege	4788	powershell.exe
Token: SeUndockPrivilege	4788	powershell.exe
Token: SeManageVolumePrivilege	4788	powershell.exe
Token: 33	4788	powershell.exe

Suspicious use of FindShellTrayWindow 31 IoCs

pid	Process
4364	taskmgr.exe
4364	taskmgr.exe
4364	taskmgr.exe
4364	taskmgr.exe
4364	taskmgr.exe
4364	taskmgr.exe
4364	taskmgr.exe
4364	taskmgr.exe
4364	taskmgr.exe
4364	taskmgr.exe
4364	taskmgr.exe
4364	taskmgr.exe
4364	taskmgr.exe
4364	taskmgr.exe
4364	taskmgr.exe
4364	taskmgr.exe
4364	taskmgr.exe
4364	taskmgr.exe
4364	taskmgr.exe
4364	taskmgr.exe
4364	taskmgr.exe
4364	taskmgr.exe
4364	taskmgr.exe
4364	taskmgr.exe
4364	taskmgr.exe
4364	taskmgr.exe
4364	taskmgr.exe
4364	taskmgr.exe
4364	taskmgr.exe
4364	taskmgr.exe
4364	taskmgr.exe

Suspicious use of SendNotifyMessage 30 IoCs

pid	Process
4364	taskmgr.exe
4364	taskmgr.exe
4364	taskmgr.exe
4364	taskmgr.exe
4364	taskmgr.exe
4364	taskmgr.exe
4364	taskmgr.exe
4364	taskmgr.exe
4364	taskmgr.exe
4364	taskmgr.exe
4364	taskmgr.exe
4364	taskmgr.exe
4364	taskmgr.exe
4364	taskmgr.exe
4364	taskmgr.exe
4364	taskmgr.exe
4364	taskmgr.exe
4364	taskmgr.exe
4364	taskmgr.exe
4364	taskmgr.exe
4364	taskmgr.exe
4364	taskmgr.exe
4364	taskmgr.exe
4364	taskmgr.exe
4364	taskmgr.exe
4364	taskmgr.exe
4364	taskmgr.exe
4364	taskmgr.exe
4364	taskmgr.exe
4364	taskmgr.exe

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 3308 wrote to memory of 1852	3308	a.exe	86
PID 3308 wrote to memory of 368	3308	a.exe	87
PID 3308 wrote to memory of 772	3308	a.exe	88
PID 3308 wrote to memory of 2092	3308	a.exe	90
PID 3308 wrote to memory of 4788	3308	a.exe	91
PID 3308 wrote to memory of 4656	3308	a.exe	92
PID 3308 wrote to memory of 2820	3308	a.exe	93
PID 3308 wrote to memory of 5004	3308	a.exe	99
PID 3308 wrote to memory of 2564	3308	a.exe	100
PID 3308 wrote to memory of 1424	3308	a.exe	101
PID 3308 wrote to memory of 824	3308	a.exe	104
PID 3308 wrote to memory of 2964	3308	a.exe	105
PID 3308 wrote to memory of 2676	3308	a.exe	106
PID 3308 wrote to memory of 3980	3308	a.exe	107
PID 3308 wrote to memory of 4788	3308	a.exe	108
PID 3308 wrote to memory of 4360	3308	a.exe	109
PID 3308 wrote to memory of 220	3308	a.exe	110
PID 3308 wrote to memory of 1040	3308	a.exe	113
PID 3308 wrote to memory of 2452	3308	a.exe	114
PID 3308 wrote to memory of 1060	3308	a.exe	115
PID 3308 wrote to memory of 3904	3308	a.exe	116
PID 3308 wrote to memory of 4356	3308	a.exe	117
PID 3308 wrote to memory of 2040	3308	a.exe	118
PID 3308 wrote to memory of 4980	3308	a.exe	122
PID 3308 wrote to memory of 1972	3308	a.exe	123
PID 3308 wrote to memory of 1520	3308	a.exe	124
PID 3308 wrote to memory of 2432	3308	a.exe	125
PID 3308 wrote to memory of 2324	3308	a.exe	128

C:\Users\Admin\AppData\Local\Temp\a.exe
"C:\Users\Admin\AppData\Local\Temp\a.exe"
1⤵
- Modifies trusted root certificate store through registry
- Modifies system certificate store
- Suspicious use of WriteProcessMemory
PID:3308
- C:\Windows\system32\cmd.exe
  cmd /c ver
  2⤵
  PID:1852
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command [System.Environment]::OSVersion.Version.ToString()
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:368
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "(Get-CimInstance Win32_OperatingSystem).LastBootUpTime.ToString('o')"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:772
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Get-CimInstance Win32_Processor | Select-Object Name, Manufacturer | ConvertTo-Json"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2092
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Get-CimInstance Win32_OperatingSystem | Select-Object TotalVisibleMemorySize, FreePhysicalMemory | ConvertTo-Json"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4788
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Get-CimInstance Win32_DiskDrive | Select-Object Model, SerialNumber, InterfaceType | ConvertTo-Json"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:4656
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Get-NetAdapter | Select-Object Name, MacAddress, Status | ConvertTo-Json"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:2820
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Get-NetIPAddress | Select-Object InterfaceAlias, IPAddress, PrefixLength, AddressFamily | ConvertTo-Json"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:5004
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Get-NetRoute | Where-Object { $_.DestinationPrefix -eq '0.0.0.0/0' -or $_.DestinationPrefix -eq '::/0' } | Select-Object DestinationPrefix, NextHop, InterfaceAlias | ConvertTo-Json"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:2564
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Get-DnsClientServerAddress | Select-Object ServerAddresses | ConvertTo-Json"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:1424
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Get-CimInstance Win32_BIOS | Select-Object Manufacturer, SMBIOSBIOSVersion, SerialNumber | ConvertTo-Json"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:824
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Get-CimInstance Win32_BaseBoard | Select-Object Manufacturer, Product | ConvertTo-Json"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:2964
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Get-CimInstance Win32_ComputerSystem | Select-Object Manufacturer, Model | ConvertTo-Json"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:2676
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Get-CimInstance Win32_PnPEntity | Where-Object { $_.PNPDeviceID -like 'PCI*' } | Select-Object Name, DeviceID | ConvertTo-Json"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:3980
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Get-Process | Select-Object -ExpandProperty ProcessName"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:4788
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Get-ChildItem 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall' -ErrorAction SilentlyContinue | ForEach-Object { Get-ItemProperty $_.PSPath -ErrorAction SilentlyContinue } | Where-Object { $_.DisplayName } | Select-Object DisplayName, DisplayVersion, Publisher | ConvertTo-Json"
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  - Suspicious behavior: EnumeratesProcesses
  PID:4360
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Get-ChildItem 'HKLM:\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall' -ErrorAction SilentlyContinue | ForEach-Object { Get-ItemProperty $_.PSPath -ErrorAction SilentlyContinue } | Where-Object { $_.DisplayName } | Select-Object DisplayName, DisplayVersion, Publisher | ConvertTo-Json"
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  - Suspicious behavior: EnumeratesProcesses
  PID:220
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Get-ChildItem 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall' -ErrorAction SilentlyContinue | ForEach-Object { Get-ItemProperty $_.PSPath -ErrorAction SilentlyContinue } | Where-Object { $_.DisplayName } | Select-Object DisplayName, DisplayVersion, Publisher | ConvertTo-Json"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Hide Artifacts: Ignore Process Interrupts
  - Suspicious behavior: EnumeratesProcesses
  PID:1040
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\VisualStudio\14.0\VC\Runtimes\x64 /v Version
  2⤵
  - Modifies registry key
  PID:2452
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\VisualStudio\14.0\VC\Runtimes\x86 /v Version
  2⤵
  - Modifies registry key
  PID:1060
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\WOW6432Node\Microsoft\VisualStudio\14.0\VC\Runtimes\x64 /v Version
  2⤵
  - Modifies registry key
  PID:3904
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\WOW6432Node\Microsoft\VisualStudio\14.0\VC\Runtimes\x86 /v Version
  2⤵
  - Modifies registry key
  PID:4356
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Get-CimInstance Win32_Product | Where-Object { $_.Name -like '*Visual C++*' -or $_.Name -like '*Visual Studio*Runtime*' } | Select-Object Name, Version | ConvertTo-Json"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:2040
- C:\Windows\system32\reg.exe
  reg query "HKLM\SOFTWARE\Microsoft\NET Framework Setup\NDP\v4\Full" /v Release
  2⤵
  PID:4980
- C:\Windows\system32\reg.exe
  reg query "HKLM\SOFTWARE\Microsoft\NET Framework Setup\NDP\v4\Full" /v Version
  2⤵
  PID:1972
- C:\Program Files\dotnet\dotnet.exe
  dotnet --list-runtimes
  2⤵
  - System Time Discovery
  PID:1520
- C:\Program Files\dotnet\dotnet.exe
  dotnet --list-sdks
  2⤵
  PID:2432
- C:\Users\Admin\AppData\Local\Temp\al-khaser\al-khaser_x64.exe
  C:\Users\Admin\AppData\Local\Temp\al-khaser\al-khaser_x64.exe
  2⤵
  - Enumerates VirtualBox registry keys
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Looks for VirtualBox Guest Additions in registry
  - Looks for VMWare Tools registry key
  - Checks BIOS information in registry
  - Executes dropped EXE
  - Identifies Wine through registry keys
  - Maps connected drives based on registry
  - Checks system information in the registry
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Checks for VirtualBox DLLs, possible anti-VM trick
  - Checks SCSI registry key(s)
  - Suspicious behavior: EnumeratesProcesses
  PID:2324

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
PID:4772

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
PID:1792

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4364

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Ignore Process Interrupts

T1564.011

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...