af8f9c8a49b656e3ac0eae88da7501b1c00944d606140d3477c83dcf63093678

Analysis

max time kernel
149s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
22/05/2026, 12:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Windows System Management Provider Service.exe
Size 204.0MB
Sample260522-pegx9ac15v
SHA256 af8f9c8a49b656e3ac0eae88da7501b1c00944d606140d3477c83dcf63093678
MD5 157c2342514e4c152849ef5a2bd0ad46
SHA1 d7477d42141655db824ca10fdadea1cb0d868056
SHA512 e4ff807daccb537826aaabd5c7c88bb2c77bea390c251ff6c7e328009251d05efe0aba36c4ab937f13e8d6f2655153e71c2c9f96bdf3f15381a3045c57112b50
SSDEEP 1572864:6lO7U+UY69e9lYKEIkcs585/pXIboQCHGOXhjXFPb5kUpbYxr1gtSZ/3p8tgU41F:62YXImgdeESMS
TLSH
T125A88C03E29A41D9C01DD175575AA633FEB1B80A4B24B3DF2B5447522F76EE82B3DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution spyware stealer

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\Control Panel\International\Geo\Nation	Windows System Management Provider Service.exe

Executes dropped EXE 1 IoCs

pid	Process
5408	syshelper.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
24	ip-api.com

Command and Scripting Interpreter: PowerShell 1 TTPs 13 IoCs

Run Powershell to get system information.

execution

PowerShell

T1059.001

pid	Process
2872	powershell.exe
1960	powershell.exe
1504	powershell.exe
5048	powershell.exe
2908	powershell.exe
564	powershell.exe
1840	powershell.exe
2436	powershell.exe
4196	powershell.exe
3624	powershell.exe
1760	powershell.exe
4316	powershell.exe
4308	powershell.exe

Enumerates processes with tasklist 1 TTPs 5 IoCs

discovery

Process Discovery

T1057

pid	Process
1668	tasklist.exe
1864	tasklist.exe
3376	tasklist.exe
5616	tasklist.exe
2456	tasklist.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 36 IoCs

pid	Process
1504	powershell.exe
1504	powershell.exe
1760	powershell.exe
1760	powershell.exe
2908	powershell.exe
2908	powershell.exe
564	powershell.exe
564	powershell.exe
3624	powershell.exe
3624	powershell.exe
5048	powershell.exe
5048	powershell.exe
4196	powershell.exe
4196	powershell.exe
2436	powershell.exe
2436	powershell.exe
1960	powershell.exe
1960	powershell.exe
4308	powershell.exe
4308	powershell.exe
4316	powershell.exe
4316	powershell.exe
1840	powershell.exe
1840	powershell.exe
3624	powershell.exe
1840	powershell.exe
1504	powershell.exe
2908	powershell.exe
1760	powershell.exe
564	powershell.exe
4196	powershell.exe
2436	powershell.exe
1960	powershell.exe
5048	powershell.exe
4308	powershell.exe
4316	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1284	Windows System Management Provider Service.exe
Token: SeCreatePagefilePrivilege	1284	Windows System Management Provider Service.exe
Token: SeShutdownPrivilege	1284	Windows System Management Provider Service.exe
Token: SeCreatePagefilePrivilege	1284	Windows System Management Provider Service.exe
Token: SeShutdownPrivilege	1284	Windows System Management Provider Service.exe
Token: SeCreatePagefilePrivilege	1284	Windows System Management Provider Service.exe
Token: SeShutdownPrivilege	1284	Windows System Management Provider Service.exe
Token: SeCreatePagefilePrivilege	1284	Windows System Management Provider Service.exe
Token: SeShutdownPrivilege	1284	Windows System Management Provider Service.exe
Token: SeCreatePagefilePrivilege	1284	Windows System Management Provider Service.exe
Token: SeShutdownPrivilege	1284	Windows System Management Provider Service.exe
Token: SeCreatePagefilePrivilege	1284	Windows System Management Provider Service.exe
Token: SeShutdownPrivilege	1284	Windows System Management Provider Service.exe
Token: SeCreatePagefilePrivilege	1284	Windows System Management Provider Service.exe
Token: SeShutdownPrivilege	1284	Windows System Management Provider Service.exe
Token: SeCreatePagefilePrivilege	1284	Windows System Management Provider Service.exe
Token: SeShutdownPrivilege	1284	Windows System Management Provider Service.exe
Token: SeCreatePagefilePrivilege	1284	Windows System Management Provider Service.exe
Token: SeShutdownPrivilege	1284	Windows System Management Provider Service.exe
Token: SeCreatePagefilePrivilege	1284	Windows System Management Provider Service.exe
Token: SeShutdownPrivilege	1284	Windows System Management Provider Service.exe
Token: SeCreatePagefilePrivilege	1284	Windows System Management Provider Service.exe
Token: SeShutdownPrivilege	1284	Windows System Management Provider Service.exe
Token: SeCreatePagefilePrivilege	1284	Windows System Management Provider Service.exe
Token: SeDebugPrivilege	1504	powershell.exe
Token: SeDebugPrivilege	1760	powershell.exe
Token: SeShutdownPrivilege	1284	Windows System Management Provider Service.exe
Token: SeCreatePagefilePrivilege	1284	Windows System Management Provider Service.exe
Token: SeDebugPrivilege	2908	powershell.exe
Token: SeDebugPrivilege	564	powershell.exe
Token: SeDebugPrivilege	3624	powershell.exe
Token: SeDebugPrivilege	5048	powershell.exe
Token: SeDebugPrivilege	4196	powershell.exe
Token: SeDebugPrivilege	2436	powershell.exe
Token: SeDebugPrivilege	1960	powershell.exe
Token: SeDebugPrivilege	4308	powershell.exe
Token: SeDebugPrivilege	4316	powershell.exe
Token: SeDebugPrivilege	1840	powershell.exe
Token: SeShutdownPrivilege	1284	Windows System Management Provider Service.exe
Token: SeCreatePagefilePrivilege	1284	Windows System Management Provider Service.exe
Token: SeShutdownPrivilege	1284	Windows System Management Provider Service.exe
Token: SeCreatePagefilePrivilege	1284	Windows System Management Provider Service.exe
Token: SeIncreaseQuotaPrivilege	1840	powershell.exe
Token: SeSecurityPrivilege	1840	powershell.exe
Token: SeTakeOwnershipPrivilege	1840	powershell.exe
Token: SeLoadDriverPrivilege	1840	powershell.exe
Token: SeSystemProfilePrivilege	1840	powershell.exe
Token: SeSystemtimePrivilege	1840	powershell.exe
Token: SeProfSingleProcessPrivilege	1840	powershell.exe
Token: SeIncBasePriorityPrivilege	1840	powershell.exe
Token: SeCreatePagefilePrivilege	1840	powershell.exe
Token: SeBackupPrivilege	1840	powershell.exe
Token: SeRestorePrivilege	1840	powershell.exe
Token: SeShutdownPrivilege	1840	powershell.exe
Token: SeDebugPrivilege	1840	powershell.exe
Token: SeSystemEnvironmentPrivilege	1840	powershell.exe
Token: SeRemoteShutdownPrivilege	1840	powershell.exe
Token: SeUndockPrivilege	1840	powershell.exe
Token: SeManageVolumePrivilege	1840	powershell.exe
Token: 33	1840	powershell.exe
Token: 34	1840	powershell.exe
Token: 35	1840	powershell.exe
Token: 36	1840	powershell.exe
Token: SeIncreaseQuotaPrivilege	2908	powershell.exe

Suspicious use of WriteProcessMemory 50 IoCs

description	pid	Process	procid_target
PID 1284 wrote to memory of 1580	1284	Windows System Management Provider Service.exe	91
PID 1580 wrote to memory of 3872	1580	cmd.exe	93
PID 3872 wrote to memory of 3268	3872	net.exe	94
PID 1284 wrote to memory of 1424	1284	Windows System Management Provider Service.exe	95
PID 1284 wrote to memory of 1424	1284	Windows System Management Provider Service.exe	95
PID 1284 wrote to memory of 1916	1284	Windows System Management Provider Service.exe	96
PID 1284 wrote to memory of 4332	1284	Windows System Management Provider Service.exe	100
PID 1284 wrote to memory of 3788	1284	Windows System Management Provider Service.exe	101
PID 1284 wrote to memory of 3276	1284	Windows System Management Provider Service.exe	103
PID 1284 wrote to memory of 3232	1284	Windows System Management Provider Service.exe	105
PID 1284 wrote to memory of 3748	1284	Windows System Management Provider Service.exe	106
PID 1284 wrote to memory of 3344	1284	Windows System Management Provider Service.exe	107
PID 1284 wrote to memory of 960	1284	Windows System Management Provider Service.exe	108
PID 1284 wrote to memory of 744	1284	Windows System Management Provider Service.exe	109
PID 1284 wrote to memory of 3444	1284	Windows System Management Provider Service.exe	111
PID 1284 wrote to memory of 940	1284	Windows System Management Provider Service.exe	112
PID 1284 wrote to memory of 440	1284	Windows System Management Provider Service.exe	113
PID 1284 wrote to memory of 5024	1284	Windows System Management Provider Service.exe	115
PID 1284 wrote to memory of 3524	1284	Windows System Management Provider Service.exe	117
PID 4332 wrote to memory of 1840	4332	cmd.exe	126
PID 3788 wrote to memory of 564	3788	cmd.exe	127
PID 3276 wrote to memory of 2908	3276	cmd.exe	128
PID 3232 wrote to memory of 1504	3232	cmd.exe	129
PID 3748 wrote to memory of 1760	3748	cmd.exe	130
PID 3344 wrote to memory of 3624	3344	cmd.exe	131
PID 960 wrote to memory of 5048	960	cmd.exe	132
PID 744 wrote to memory of 4196	744	cmd.exe	133
PID 3444 wrote to memory of 2436	3444	cmd.exe	134
PID 940 wrote to memory of 1960	940	cmd.exe	135
PID 440 wrote to memory of 2872	440	cmd.exe	136
PID 5024 wrote to memory of 4308	5024	cmd.exe	137
PID 3524 wrote to memory of 4316	3524	cmd.exe	138
PID 1284 wrote to memory of 6080	1284	Windows System Management Provider Service.exe	139
PID 6080 wrote to memory of 5408	6080	cmd.exe	141
PID 5408 wrote to memory of 5636	5408	syshelper.exe	142
PID 5408 wrote to memory of 5636	5408	syshelper.exe	142
PID 5408 wrote to memory of 3416	5408	syshelper.exe	145
PID 5408 wrote to memory of 3416	5408	syshelper.exe	145
PID 1284 wrote to memory of 5320	1284	Windows System Management Provider Service.exe	149
PID 5320 wrote to memory of 5448	5320	cmd.exe	151
PID 1284 wrote to memory of 4092	1284	Windows System Management Provider Service.exe	152
PID 1284 wrote to memory of 5460	1284	Windows System Management Provider Service.exe	153
PID 4092 wrote to memory of 1668	4092	cmd.exe	156
PID 5460 wrote to memory of 1864	5460	cmd.exe	157
PID 1284 wrote to memory of 4100	1284	Windows System Management Provider Service.exe	158
PID 4100 wrote to memory of 3376	4100	cmd.exe	160
PID 1284 wrote to memory of 3504	1284	Windows System Management Provider Service.exe	161
PID 3504 wrote to memory of 5616	3504	cmd.exe	163
PID 1284 wrote to memory of 5468	1284	Windows System Management Provider Service.exe	164
PID 5468 wrote to memory of 2456	5468	cmd.exe	166

C:\Users\Admin\AppData\Local\Temp\Windows System Management Provider Service.exe
"C:\Users\Admin\AppData\Local\Temp\Windows System Management Provider Service.exe"
1⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1284
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "net session"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1580
- - C:\Windows\system32\net.exe
    net session
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3872
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:3268
- C:\Users\Admin\AppData\Local\Temp\Windows System Management Provider Service.exe
  "C:\Users\Admin\AppData\Local\Temp\Windows System Management Provider Service.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\system-resource-provider" --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAAQAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1784,i,8802153837662592336,10196080671377644205,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=1656 /prefetch:2
  2⤵
  PID:1424
- C:\Users\Admin\AppData\Local\Temp\Windows System Management Provider Service.exe
  "C:\Users\Admin\AppData\Local\Temp\Windows System Management Provider Service.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\system-resource-provider" --field-trial-handle=1784,i,8802153837662592336,10196080671377644205,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=1960 /prefetch:3
  2⤵
  PID:1916
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -Command "try { $os = Get-CimInstance -ClassName Win32_OperatingSystem; $os.Caption + ' ' + $os.Version } catch { $os = Get-WmiObject -Class Win32_OperatingSystem; $os.Caption + ' ' + $os.Version }""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4332
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -Command "try { $os = Get-CimInstance -ClassName Win32_OperatingSystem; $os.Caption + ' ' + $os.Version } catch { $os = Get-WmiObject -Class Win32_OperatingSystem; $os.Caption + ' ' + $os.Version }"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1840
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -Command "try { $cpu = Get-CimInstance -ClassName Win32_Processor | Select-Object -First 1; $cpu.Name + ' (' + $cpu.NumberOfCores + ' cores, ' + [math]::Round($cpu.MaxClockSpeed/1000, 1) + ' GHz)' } catch { $cpu = Get-WmiObject -Class Win32_Processor | Select-Object -First 1; $cpu.Name }""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3788
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -Command "try { $cpu = Get-CimInstance -ClassName Win32_Processor | Select-Object -First 1; $cpu.Name + ' (' + $cpu.NumberOfCores + ' cores, ' + [math]::Round($cpu.MaxClockSpeed/1000, 1) + ' GHz)' } catch { $cpu = Get-WmiObject -Class Win32_Processor | Select-Object -First 1; $cpu.Name }"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:564
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -Command "try { $gpu = Get-CimInstance -ClassName Win32_VideoController | Where-Object { $_.Name -ne $null } | Select-Object -First 1; $vram = [math]::Round($gpu.AdapterRAM / 1GB, 2); $gpu.Name + ' (' + $vram + ' GB)' } catch { $gpu = Get-WmiObject -Class Win32_VideoController | Where-Object { $_.Name -ne $null } | Select-Object -First 1; $gpu.Name }""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3276
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -Command "try { $gpu = Get-CimInstance -ClassName Win32_VideoController | Where-Object { $_.Name -ne $null } | Select-Object -First 1; $vram = [math]::Round($gpu.AdapterRAM / 1GB, 2); $gpu.Name + ' (' + $vram + ' GB)' } catch { $gpu = Get-WmiObject -Class Win32_VideoController | Where-Object { $_.Name -ne $null } | Select-Object -First 1; $gpu.Name }"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2908
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -Command "try { $os = Get-CimInstance -ClassName Win32_OperatingSystem; $total = [math]::Round($os.TotalVisibleMemorySize / 1MB, 2); $free = [math]::Round($os.FreePhysicalMemory / 1MB, 2); $used = [math]::Round($total - $free, 2); $used.ToString() + ' GB/' + $total.ToString() + ' GB' } catch { '' }""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3232
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -Command "try { $os = Get-CimInstance -ClassName Win32_OperatingSystem; $total = [math]::Round($os.TotalVisibleMemorySize / 1MB, 2); $free = [math]::Round($os.FreePhysicalMemory / 1MB, 2); $used = [math]::Round($total - $free, 2); $used.ToString() + ' GB/' + $total.ToString() + ' GB' } catch { '' }"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1504
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -Command "try { (Get-CimInstance -Class Win32_ComputerSystemProduct).UUID } catch { (Get-WmiObject -Class Win32_ComputerSystemProduct).UUID }""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3748
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -Command "try { (Get-CimInstance -Class Win32_ComputerSystemProduct).UUID } catch { (Get-WmiObject -Class Win32_ComputerSystemProduct).UUID }"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1760
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -Command "try { Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion' -Name ProductName } catch { (Get-ItemProperty -Path 'HKLM:SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion').ProductName }""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3344
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -Command "try { Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion' -Name ProductName } catch { (Get-ItemProperty -Path 'HKLM:SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion').ProductName }"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3624
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -Command "try { (Get-CimInstance -ClassName 'Win32_NetworkAdapter' -Filter 'NetConnectionStatus = 2' | Select-Object -First 1).MACAddress } catch { (Get-WmiObject -Class Win32_NetworkAdapter -Filter 'NetConnectionStatus = 2' | Select-Object -First 1).MACAddress }""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:960
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -Command "try { (Get-CimInstance -ClassName 'Win32_NetworkAdapter' -Filter 'NetConnectionStatus = 2' | Select-Object -First 1).MACAddress } catch { (Get-WmiObject -Class Win32_NetworkAdapter -Filter 'NetConnectionStatus = 2' | Select-Object -First 1).MACAddress }"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5048
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -Command "try { (Get-NetIPAddress | Where-Object {$_.AddressFamily -eq 'IPv4' -and $_.IPAddress -ne '127.0.0.1'} | Select-Object -First 1).IPAddress } catch { (Get-WmiObject -Class Win32_NetworkAdapterConfiguration | Where-Object {$_.IPEnabled -eq $true} | Select-Object -First 1).IPAddress[0] }""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:744
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -Command "try { (Get-NetIPAddress | Where-Object {$_.AddressFamily -eq 'IPv4' -and $_.IPAddress -ne '127.0.0.1'} | Select-Object -First 1).IPAddress } catch { (Get-WmiObject -Class Win32_NetworkAdapterConfiguration | Where-Object {$_.IPEnabled -eq $true} | Select-Object -First 1).IPAddress[0] }"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4196
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -Command "$env:NUMBER_OF_PROCESSORS""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3444
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -Command "$env:NUMBER_OF_PROCESSORS"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2436
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -Command "try { $disk = Get-CimInstance -ClassName Win32_LogicalDisk -Filter 'DeviceID=\"C:\"'; $free = [math]::Round($disk.FreeSpace / 1GB, 2); $total = [math]::Round($disk.Size / 1GB, 2); $free.ToString() + ' GB/' + $total.ToString() + ' GB' } catch { '' }""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:940
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -Command "try { $disk = Get-CimInstance -ClassName Win32_LogicalDisk -Filter 'DeviceID=\"C:\"'; $free = [math]::Round($disk.FreeSpace / 1GB, 2); $total = [math]::Round($disk.Size / 1GB, 2); $free.ToString() + ' GB/' + $total.ToString() + ' GB' } catch { '' }"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1960
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -Command "try { $uptime = (Get-CimInstance -ClassName Win32_OperatingSystem).LastBootUpTime; $span = (Get-Date) - $uptime; $span.Days.ToString() + 'd ' + $span.Hours.ToString() + 'h ' + $span.Minutes.ToString() + 'm ' + $span.Seconds.ToString() + 's' } catch { '' }""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:440
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -Command "try { $uptime = (Get-CimInstance -ClassName Win32_OperatingSystem).LastBootUpTime; $span = (Get-Date) - $uptime; $span.Days.ToString() + 'd ' + $span.Hours.ToString() + 'h ' + $span.Minutes.ToString() + 'm ' + $span.Seconds.ToString() + 's' } catch { '' }"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:2872
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -Command "try { (Get-WmiObject -Query 'SELECT * FROM SoftwareLicensingService').OA3xOriginalProductKey } catch { 'N/A' }""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5024
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -Command "try { (Get-WmiObject -Query 'SELECT * FROM SoftwareLicensingService').OA3xOriginalProductKey } catch { 'N/A' }"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4308
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -Command "try { Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion' -Name CurrentBuild } catch { '0' }""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3524
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -Command "try { Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion' -Name CurrentBuild } catch { '0' }"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4316
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\AppConfigSvc_1779452337437\syshelper.exe" -k -o "C:\Users\Admin\AppData\Local\SvcProvider_1779452337453" all"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:6080
- - C:\Users\Admin\AppData\Local\Temp\AppConfigSvc_1779452337437\syshelper.exe
    "C:\Users\Admin\AppData\Local\Temp\AppConfigSvc_1779452337437\syshelper.exe" -k -o "C:\Users\Admin\AppData\Local\SvcProvider_1779452337453" all
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:5408
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe"
      4⤵
      PID:5636
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
      4⤵
      PID:3416
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg query "HKCU\Software\Valve\Steam" /v SteamPath"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5320
- - C:\Windows\system32\reg.exe
    reg query "HKCU\Software\Valve\Steam" /v SteamPath
    3⤵
    PID:5448
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq opera.exe" /FO CSV /NH"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4092
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq opera.exe" /FO CSV /NH
    3⤵
    - Enumerates processes with tasklist
    PID:1668
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq firefox.exe" /FO CSV /NH"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5460
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq firefox.exe" /FO CSV /NH
    3⤵
    - Enumerates processes with tasklist
    PID:1864
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq opera.exe" /FO CSV /NH"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4100
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq opera.exe" /FO CSV /NH
    3⤵
    - Enumerates processes with tasklist
    PID:3376
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq vivaldi.exe" /FO CSV /NH"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3504
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq vivaldi.exe" /FO CSV /NH
    3⤵
    - Enumerates processes with tasklist
    PID:5616
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq browser.exe" /FO CSV /NH"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5468
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq browser.exe" /FO CSV /NH
    3⤵
    - Enumerates processes with tasklist
    PID:2456

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5948

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5216

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ERROR.txt

Path C:\Users\Admin\AppData\Local\CoreProvider_1779452332312\Browsers\Opera\Default\ERROR.txt
Size 28B
SHA256 4744a4ba6d419bbda76bda27af85d75516b0ef36ef0e2f9e3fbbe690dd454a83
MD5 87ccff2d717e2219bbb642414ccad3a6
SHA1 63d11fecb36f06d5317d7aeb733f59313be7823b
SHA512 0e508b188d7191f1d2acf20e27d2f3fcdf11ca30c2acf4c3e2db7e98759ff047b5c3a61f8ab624b149560a1e81c3fa9468f9835f3ab75917cfa75b4a9f699618
MD5 SHA1 SHA512

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 b1f292b6199aa29c7fafbca007e5f9e3f68edcbbca1965bc828cc92dc0f18bb8
MD5 6cf293cb4d80be23433eecf74ddb5503
SHA1 24fe4752df102c2ef492954d6b046cb5512ad408
SHA512 0f91e2da0da8794b9797c7b50eb5dfd27bde4546ceb6902a776664ce887dd6f12a0dd8773d612ccc76dfd029cd280778a0f0ae17ce679b3d2ffd968dd7e94a00
TLSH
T148510F323375F1E4C8567F071E68198053BF4395EA94AF5CB298621ED92741B8F222F3
MD5 SHA1 SHA512 TLSH

Submit Download