0b303d320b87fb4de99537b1651eb27020a0e94fe8720a0a2b5332a135c6ade5

Analysis

max time kernel
900s
max time network
410s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
02/06/2026, 23:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
SteamUpdate.exe 1.23.5-7.89.msi
Size 96.5MB
Sample260602-24s32af16m
SHA256 0b303d320b87fb4de99537b1651eb27020a0e94fe8720a0a2b5332a135c6ade5
MD5 5c68ec0a481d4cc2d8c9cdbed5303b6c
SHA1 fe4b8fbb13d0e1271ffd7013342dec8169cf1064
SHA512 1b9932d33e82dea2494115f4c06db28629f5be2f5c6d45363530aea47f26cd07d7b0866d03ae860cd26fb26bc052112ec7bb6dac5719085415a71bb48285adc7
SSDEEP 3145728:CUrkKPAYXqEFvqdlFLlYmyGW0UKRSyLFxP2:CUdhXqwvaHlYm1W0UiXLLP
TLSH
T1842833577751D77AC05CAC3F34327579D313CE0A089824AAA86ABD08057B768263FBF9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery execution persistence privilege_escalation ransomware spyware stealer

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 43 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
5056	powershell.exe
4792	powershell.exe
3568	powershell.exe
1676	powershell.exe
5816	powershell.exe
332	powershell.exe
4712	powershell.exe
4680	powershell.exe
4464	powershell.exe
2092	powershell.exe
4632	powershell.exe
5804	powershell.exe
3484	powershell.exe
332	powershell.exe
1880	powershell.exe
4020	powershell.exe
5460	powershell.exe
3048	powershell.exe
4828	powershell.exe
788	powershell.exe
1072	powershell.exe
4784	powershell.exe
1000	powershell.exe
3220	powershell.exe
5676	powershell.exe
2636	powershell.exe
4512	powershell.exe
5652	powershell.exe
3232	powershell.exe
1816	powershell.exe
2900	powershell.exe
4740	powershell.exe
800	powershell.exe
3152	powershell.exe
4220	powershell.exe
1644	powershell.exe
3776	powershell.exe
5704	powershell.exe
1216	powershell.exe
4240	powershell.exe
652	powershell.exe
792	powershell.exe
3796	powershell.exe

Modifies Windows Firewall 2 TTPs 1 IoCs

defense_evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
2648	netsh.exe

Executes dropped EXE 4 IoCs

pid	Process
2948	SteamUpdate.exe.exe
5068	SteamUpdate.exe.exe
3848	SteamUpdate.exe.exe
4472	SteamUpdate.exe.exe

Loads dropped DLL 12 IoCs

pid	Process
2948	SteamUpdate.exe.exe
2948	SteamUpdate.exe.exe
2948	SteamUpdate.exe.exe
5068	SteamUpdate.exe.exe
3848	SteamUpdate.exe.exe
5068	SteamUpdate.exe.exe
5068	SteamUpdate.exe.exe
5068	SteamUpdate.exe.exe
5068	SteamUpdate.exe.exe
5068	SteamUpdate.exe.exe
4472	SteamUpdate.exe.exe
4472	SteamUpdate.exe.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Contacts third-party web service commonly abused for C2 1 TTPs 4 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
4	discord.com
11	discord.com
12	discord.com
16	discord.com

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe

Looks up external IP address via web service 3 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
4	ip-api.com
8	ipapi.co
4	ipapi.co

Obfuscated Files or Information: Command Obfuscation 1 TTPs
Adversaries may obfuscate content during command execution to impede detection.
defense_evasion

Command Obfuscation
T1027.010

Enumerates processes with tasklist 1 TTPs 6 IoCs

discovery

Process Discovery

T1057

pid	Process
4932	tasklist.exe
4048	tasklist.exe
4752	tasklist.exe
4524	tasklist.exe
4680	tasklist.exe
5912	tasklist.exe

Drops file in Windows directory 12 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\SystemTemp\~DF911CE212149F085C.TMP	msiexec.exe
File created	C:\Windows\Installer\SourceHash{880121C6-4634-491B-A16A-49ABD06DF39B}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI5119.tmp	msiexec.exe
File created	C:\Windows\Installer\e584d23.msi	msiexec.exe
File created	C:\Windows\SystemTemp\~DF94A2D6230F3BDD1A.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DF525488528E6316AC.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\e584d21.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\SystemTemp\~DF2CAB68D190E1FE16.TMP	msiexec.exe
File created	C:\Windows\Installer\e584d21.msi	msiexec.exe

Hide Artifacts: Ignore Process Interrupts 1 TTPs 1 IoCs

Command interpreters often include specific commands/flags that ignore errors and other hangups.

defense_evasion

Ignore Process Interrupts

T1564.011

pid	Process
652	powershell.exe

Launches sc.exe 1 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2772	sc.exe

Event Triggered Execution: Netsh Helper DLL 1 TTPs 9 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 4 IoCs

Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

discovery

Wi-Fi Discovery

T1016.002

pid	Process
3668	cmd.exe
5776	netsh.exe
448	cmd.exe
5432	netsh.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 00000000040000009849ce13e51016660000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff0000000027010100000800009849ce130000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed35000000ffffffff0000000007000100006809009849ce13000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff350000000000000005000000ffffffff000000000700010000f8ff1a9849ce13000000000000f0ff350000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d9849ce13000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe

Checks processor information in registry 2 TTPs 30 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\~MHz	SteamUpdate.exe.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\~MHz	SteamUpdate.exe.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	reg.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	SteamUpdate.exe.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3	SteamUpdate.exe.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	reg.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	SteamUpdate.exe.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	SteamUpdate.exe.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\ProcessorNameString	SteamUpdate.exe.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\FeatureSet	reg.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2	SteamUpdate.exe.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\~MHz	SteamUpdate.exe.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\ProcessorNameString	SteamUpdate.exe.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7	SteamUpdate.exe.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\ProcessorNameString	SteamUpdate.exe.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\FeatureSet	reg.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\ProcessorNameString	SteamUpdate.exe.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5	SteamUpdate.exe.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\~MHz	SteamUpdate.exe.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6	SteamUpdate.exe.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\FeatureSet	reg.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz	SteamUpdate.exe.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\ProcessorNameString	SteamUpdate.exe.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4	SteamUpdate.exe.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\~MHz	SteamUpdate.exe.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\~MHz	SteamUpdate.exe.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\ProcessorNameString	SteamUpdate.exe.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	reg.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	SteamUpdate.exe.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString	SteamUpdate.exe.exe

Gathers network information 2 TTPs 1 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
1628	ipconfig.exe

Kills process with taskkill 21 IoCs

defense_evasion

pid	Process
2136	taskkill.exe
5392	taskkill.exe
3204	taskkill.exe
3448	taskkill.exe
2996	taskkill.exe
2572	taskkill.exe
3620	taskkill.exe
5380	taskkill.exe
4544	taskkill.exe
3868	taskkill.exe
4896	taskkill.exe
5388	taskkill.exe
3956	taskkill.exe
3236	taskkill.exe
4060	taskkill.exe
2540	taskkill.exe
2820	taskkill.exe
1676	taskkill.exe
2632	taskkill.exe
2740	taskkill.exe
4272	taskkill.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1124	msiexec.exe
1124	msiexec.exe
4740	powershell.exe
4740	powershell.exe
3484	powershell.exe
3484	powershell.exe
3048	powershell.exe
3048	powershell.exe
1216	powershell.exe
1216	powershell.exe
4240	powershell.exe
4240	powershell.exe
5704	powershell.exe
5704	powershell.exe
3048	powershell.exe
1216	powershell.exe
3484	powershell.exe
4240	powershell.exe
5704	powershell.exe
5056	powershell.exe
5056	powershell.exe
2636	powershell.exe
2636	powershell.exe
800	powershell.exe
800	powershell.exe
3152	powershell.exe
3152	powershell.exe
1712	powershell.exe
1712	powershell.exe
4784	powershell.exe
4784	powershell.exe
332	powershell.exe
332	powershell.exe
1000	powershell.exe
1000	powershell.exe
652	powershell.exe
652	powershell.exe
4512	powershell.exe
4512	powershell.exe
792	powershell.exe
792	powershell.exe
3796	powershell.exe
3796	powershell.exe
3568	powershell.exe
3568	powershell.exe
1000	powershell.exe
4792	powershell.exe
4220	powershell.exe
4792	powershell.exe
4220	powershell.exe
4512	powershell.exe
3220	powershell.exe
3220	powershell.exe
1816	powershell.exe
1816	powershell.exe
3796	powershell.exe
3568	powershell.exe
332	powershell.exe
652	powershell.exe
792	powershell.exe
4792	powershell.exe
4220	powershell.exe
3220	powershell.exe
1816	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4992	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4992	msiexec.exe
Token: SeSecurityPrivilege	1124	msiexec.exe
Token: SeCreateTokenPrivilege	4992	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	4992	msiexec.exe
Token: SeLockMemoryPrivilege	4992	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4992	msiexec.exe
Token: SeMachineAccountPrivilege	4992	msiexec.exe
Token: SeTcbPrivilege	4992	msiexec.exe
Token: SeSecurityPrivilege	4992	msiexec.exe
Token: SeTakeOwnershipPrivilege	4992	msiexec.exe
Token: SeLoadDriverPrivilege	4992	msiexec.exe
Token: SeSystemProfilePrivilege	4992	msiexec.exe
Token: SeSystemtimePrivilege	4992	msiexec.exe
Token: SeProfSingleProcessPrivilege	4992	msiexec.exe
Token: SeIncBasePriorityPrivilege	4992	msiexec.exe
Token: SeCreatePagefilePrivilege	4992	msiexec.exe
Token: SeCreatePermanentPrivilege	4992	msiexec.exe
Token: SeBackupPrivilege	4992	msiexec.exe
Token: SeRestorePrivilege	4992	msiexec.exe
Token: SeShutdownPrivilege	4992	msiexec.exe
Token: SeDebugPrivilege	4992	msiexec.exe
Token: SeAuditPrivilege	4992	msiexec.exe
Token: SeSystemEnvironmentPrivilege	4992	msiexec.exe
Token: SeChangeNotifyPrivilege	4992	msiexec.exe
Token: SeRemoteShutdownPrivilege	4992	msiexec.exe
Token: SeUndockPrivilege	4992	msiexec.exe
Token: SeSyncAgentPrivilege	4992	msiexec.exe
Token: SeEnableDelegationPrivilege	4992	msiexec.exe
Token: SeManageVolumePrivilege	4992	msiexec.exe
Token: SeImpersonatePrivilege	4992	msiexec.exe
Token: SeCreateGlobalPrivilege	4992	msiexec.exe
Token: SeBackupPrivilege	1916	vssvc.exe
Token: SeRestorePrivilege	1916	vssvc.exe
Token: SeAuditPrivilege	1916	vssvc.exe
Token: SeBackupPrivilege	1124	msiexec.exe
Token: SeRestorePrivilege	1124	msiexec.exe
Token: SeRestorePrivilege	1124	msiexec.exe
Token: SeTakeOwnershipPrivilege	1124	msiexec.exe
Token: SeBackupPrivilege	2504	srtasks.exe
Token: SeRestorePrivilege	2504	srtasks.exe
Token: SeSecurityPrivilege	2504	srtasks.exe
Token: SeTakeOwnershipPrivilege	2504	srtasks.exe
Token: SeRestorePrivilege	1124	msiexec.exe
Token: SeTakeOwnershipPrivilege	1124	msiexec.exe
Token: SeBackupPrivilege	2504	srtasks.exe
Token: SeRestorePrivilege	2504	srtasks.exe
Token: SeSecurityPrivilege	2504	srtasks.exe
Token: SeTakeOwnershipPrivilege	2504	srtasks.exe
Token: SeRestorePrivilege	1124	msiexec.exe
Token: SeTakeOwnershipPrivilege	1124	msiexec.exe
Token: SeRestorePrivilege	1124	msiexec.exe
Token: SeTakeOwnershipPrivilege	1124	msiexec.exe
Token: SeRestorePrivilege	1124	msiexec.exe
Token: SeTakeOwnershipPrivilege	1124	msiexec.exe
Token: SeRestorePrivilege	1124	msiexec.exe
Token: SeTakeOwnershipPrivilege	1124	msiexec.exe
Token: SeRestorePrivilege	1124	msiexec.exe
Token: SeTakeOwnershipPrivilege	1124	msiexec.exe
Token: SeRestorePrivilege	1124	msiexec.exe
Token: SeTakeOwnershipPrivilege	1124	msiexec.exe
Token: SeRestorePrivilege	1124	msiexec.exe
Token: SeTakeOwnershipPrivilege	1124	msiexec.exe
Token: SeRestorePrivilege	1124	msiexec.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
4992	msiexec.exe
4992	msiexec.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1124 wrote to memory of 2504	1124	msiexec.exe	84
PID 1124 wrote to memory of 2948	1124	msiexec.exe	86
PID 2948 wrote to memory of 5160	2948	SteamUpdate.exe.exe	88
PID 5160 wrote to memory of 4644	5160	cmd.exe	90
PID 2948 wrote to memory of 448	2948	SteamUpdate.exe.exe	91
PID 448 wrote to memory of 5432	448	cmd.exe	93
PID 2948 wrote to memory of 3004	2948	SteamUpdate.exe.exe	94
PID 3004 wrote to memory of 4636	3004	cmd.exe	96
PID 2948 wrote to memory of 5772	2948	SteamUpdate.exe.exe	97
PID 5772 wrote to memory of 4740	5772	cmd.exe	99
PID 2948 wrote to memory of 916	2948	SteamUpdate.exe.exe	100
PID 2948 wrote to memory of 4780	2948	SteamUpdate.exe.exe	101
PID 2948 wrote to memory of 3600	2948	SteamUpdate.exe.exe	102
PID 2948 wrote to memory of 4472	2948	SteamUpdate.exe.exe	104
PID 2948 wrote to memory of 4416	2948	SteamUpdate.exe.exe	105
PID 2948 wrote to memory of 4044	2948	SteamUpdate.exe.exe	106
PID 2948 wrote to memory of 2540	2948	SteamUpdate.exe.exe	195
PID 2948 wrote to memory of 3936	2948	SteamUpdate.exe.exe	108
PID 2948 wrote to memory of 1152	2948	SteamUpdate.exe.exe	109
PID 2948 wrote to memory of 4132	2948	SteamUpdate.exe.exe	110
PID 2948 wrote to memory of 560	2948	SteamUpdate.exe.exe	111
PID 2948 wrote to memory of 3344	2948	SteamUpdate.exe.exe	112
PID 2948 wrote to memory of 5244	2948	SteamUpdate.exe.exe	193
PID 2948 wrote to memory of 3992	2948	SteamUpdate.exe.exe	114
PID 2948 wrote to memory of 4464	2948	SteamUpdate.exe.exe	115
PID 2948 wrote to memory of 5480	2948	SteamUpdate.exe.exe	116
PID 2948 wrote to memory of 5692	2948	SteamUpdate.exe.exe	117
PID 2948 wrote to memory of 4060	2948	SteamUpdate.exe.exe	243
PID 2948 wrote to memory of 3292	2948	SteamUpdate.exe.exe	242
PID 2948 wrote to memory of 4336	2948	SteamUpdate.exe.exe	120
PID 2948 wrote to memory of 3368	2948	SteamUpdate.exe.exe	121
PID 2948 wrote to memory of 1492	2948	SteamUpdate.exe.exe	122
PID 2948 wrote to memory of 4536	2948	SteamUpdate.exe.exe	124
PID 2948 wrote to memory of 5232	2948	SteamUpdate.exe.exe	126
PID 2948 wrote to memory of 5472	2948	SteamUpdate.exe.exe	127
PID 2948 wrote to memory of 5980	2948	SteamUpdate.exe.exe	128
PID 2948 wrote to memory of 5656	2948	SteamUpdate.exe.exe	130
PID 2948 wrote to memory of 2620	2948	SteamUpdate.exe.exe	132
PID 2948 wrote to memory of 660	2948	SteamUpdate.exe.exe	134
PID 2948 wrote to memory of 4964	2948	SteamUpdate.exe.exe	137
PID 2948 wrote to memory of 3088	2948	SteamUpdate.exe.exe	139
PID 2948 wrote to memory of 3484	2948	SteamUpdate.exe.exe	142
PID 2948 wrote to memory of 3048	2948	SteamUpdate.exe.exe	145
PID 2948 wrote to memory of 4240	2948	SteamUpdate.exe.exe	147
PID 2948 wrote to memory of 1216	2948	SteamUpdate.exe.exe	150
PID 2948 wrote to memory of 5704	2948	SteamUpdate.exe.exe	152
PID 2948 wrote to memory of 4756	2948	SteamUpdate.exe.exe	155
PID 2948 wrote to memory of 5068	2948	SteamUpdate.exe.exe	174
PID 2948 wrote to memory of 5068	2948	SteamUpdate.exe.exe	174
PID 2948 wrote to memory of 3848	2948	SteamUpdate.exe.exe	175
PID 4536 wrote to memory of 4164	4536	cmd.exe	176
PID 4756 wrote to memory of 3236	4756	cmd.exe	177
PID 2948 wrote to memory of 5356	2948	SteamUpdate.exe.exe	178
PID 2948 wrote to memory of 3668	2948	SteamUpdate.exe.exe	180
PID 3668 wrote to memory of 5776	3668	cmd.exe	236
PID 2948 wrote to memory of 784	2948	SteamUpdate.exe.exe	184
PID 784 wrote to memory of 3448	784	cmd.exe	279
PID 2948 wrote to memory of 2000	2948	SteamUpdate.exe.exe	187
PID 2000 wrote to memory of 5380	2000	cmd.exe	189
PID 2948 wrote to memory of 4984	2948	SteamUpdate.exe.exe	190
PID 4984 wrote to memory of 4060	4984	cmd.exe	243
PID 2948 wrote to memory of 5244	2948	SteamUpdate.exe.exe	193
PID 5244 wrote to memory of 2540	5244	cmd.exe	195
PID 2948 wrote to memory of 5088	2948	SteamUpdate.exe.exe	196

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I "C:\Users\Admin\AppData\Local\Temp\SteamUpdate.exe 1.23.5-7.89.msi"
1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4992

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1124
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2504
- C:\Users\Admin\AppData\Local\Programs\steamupdate.exe\SteamUpdate.exe.exe
  "C:\Users\Admin\AppData\Local\Programs\steamupdate.exe\SteamUpdate.exe.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Checks processor information in registry
  - Suspicious use of WriteProcessMemory
  PID:2948
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "chcp"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5160
  - - C:\Windows\system32\chcp.com
      chcp
      4⤵
      PID:4644
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "netsh wlan show profiles"
    3⤵
    - System Network Configuration Discovery: Wi-Fi Discovery
    - Suspicious use of WriteProcessMemory
    PID:448
  - - C:\Windows\system32\netsh.exe
      netsh wlan show profiles
      4⤵
      Event Triggered Execution: Netsh Helper DLL
      System Network Configuration Discovery: Wi-Fi Discovery
      PID:5432
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "wmic /namespace:\\root\SecurityCenter2 path AntiVirusProduct get displayName,productState,instanceGuid /format:list"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3004
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic /namespace:\\root\SecurityCenter2 path AntiVirusProduct get displayName,productState,instanceGuid /format:list
      4⤵
      PID:4636
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "Get-MpComputerStatus | ConvertTo-Json -Depth 10""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5772
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -Command "Get-MpComputerStatus | ConvertTo-Json -Depth 10"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:4740
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "openssl version"
    3⤵
    PID:916
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "npm -v"
    3⤵
    PID:4780
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "pm2.cmd -v"
    3⤵
    PID:3600
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "yarn --version"
    3⤵
    PID:4472
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "gulp.cmd --version"
    3⤵
    PID:4416
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "brew --version"
    3⤵
    PID:4044
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tsc.cmd --version"
    3⤵
    PID:2540
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "grunt.cmd --version"
    3⤵
    PID:3936
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "git --version"
    3⤵
    PID:1152
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "apachectl -v 2>&1"
    3⤵
    PID:4132
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "nginx -v 2>&1"
    3⤵
    PID:560
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "mysql -V"
    3⤵
    PID:3344
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "php -v"
    3⤵
    PID:5244
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "redis-server --version"
    3⤵
    PID:3992
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "docker --version"
    3⤵
    PID:4464
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "postconf -d | grep mail_version"
    3⤵
    PID:5480
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "mongod --version"
    3⤵
    PID:5692
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "perl -v"
    3⤵
    PID:4060
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "python -V 2>&1"
    3⤵
    PID:3292
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "python3 -V 2>&1"
    3⤵
    PID:4336
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "pip -V 2>&1"
    3⤵
    PID:3368
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "pip3 -V 2>&1"
    3⤵
    PID:1492
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "java -version 2>&1"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4536
  - - C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
      java -version
      4⤵
      PID:4164
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "gcc -dumpversion"
    3⤵
    PID:5232
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""undefined\VBoxManage.exe" -v 2>&1"
    3⤵
    PID:5472
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "bash --version"
    3⤵
    PID:5980
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "zsh --version"
    3⤵
    PID:5656
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "fish --version"
    3⤵
    PID:2620
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "bun -v"
    3⤵
    PID:660
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "deno -v"
    3⤵
    PID:4964
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "node -v"
    3⤵
    PID:3088
- - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "Get-CimInstance Win32_Service | select caption | fl"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:3484
- - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command $PSVersionTable
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:3048
- - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "gci \"HKLM:\SOFTWARE\Microsoft\NET Framework Setup\NDP\" -recurse | gp -name Version,Release -EA 0 | where { $_.PSChildName -match \"^(?!S)\p{L}\"} | select PSChildName, Version, Release"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:4240
- - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "Get-CimInstance Win32_Process | select-Object ProcessId,ParentProcessId,ExecutionState,Caption,CommandLine,ExecutablePath,UserModeTime,KernelModeTime,WorkingSetSize,Priority,PageFileUsage, @{n=\"CreationDate\";e={$_.CreationDate.ToString(\"yyyy-MM-dd HH:mm:ss\")}} | fl"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:1216
- - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "Get-CimInstance Win32_Process | select-Object ProcessId,ParentProcessId,ExecutionState,Caption,CommandLine,ExecutablePath,UserModeTime,KernelModeTime,WorkingSetSize,Priority,PageFileUsage, @{n=\"CreationDate\";e={$_.CreationDate.ToString(\"yyyy-MM-dd HH:mm:ss\")}} | fl"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:5704
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM chrome.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4756
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM chrome.exe
      4⤵
      Kills process with taskkill
      PID:3236
- - C:\Users\Admin\AppData\Local\Programs\steamupdate.exe\SteamUpdate.exe.exe
    "C:\Users\Admin\AppData\Local\Programs\steamupdate.exe\SteamUpdate.exe.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\steamupdate.exe" --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=2548 --field-trial-handle=2552,i,6158071841429249510,9220051749338535608,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:5068
- - C:\Users\Admin\AppData\Local\Programs\steamupdate.exe\SteamUpdate.exe.exe
    "C:\Users\Admin\AppData\Local\Programs\steamupdate.exe\SteamUpdate.exe.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\steamupdate.exe" --mojo-platform-channel-handle=2732 --field-trial-handle=2552,i,6158071841429249510,9220051749338535608,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand /prefetch:8
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:3848
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "gcc --version"
    3⤵
    PID:5356
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "netsh wlan show profiles"
    3⤵
    - System Network Configuration Discovery: Wi-Fi Discovery
    - Suspicious use of WriteProcessMemory
    PID:3668
  - - C:\Windows\system32\netsh.exe
      netsh wlan show profiles
      4⤵
      Event Triggered Execution: Netsh Helper DLL
      System Network Configuration Discovery: Wi-Fi Discovery
      PID:5776
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM msedge.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:784
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM msedge.exe
      4⤵
      Kills process with taskkill
      PID:3448
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM brave.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2000
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM brave.exe
      4⤵
      Kills process with taskkill
      PID:5380
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM firefox.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4984
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM firefox.exe
      4⤵
      Kills process with taskkill
      PID:4060
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM opera.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5244
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM opera.exe
      4⤵
      Kills process with taskkill
      PID:2540
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM kometa.exe"
    3⤵
    PID:5088
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM kometa.exe
      4⤵
      Kills process with taskkill
      PID:2740
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM orbitum.exe"
    3⤵
    PID:5040
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM orbitum.exe
      4⤵
      Kills process with taskkill
      PID:4272
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM centbrowser.exe"
    3⤵
    PID:4532
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM centbrowser.exe
      4⤵
      Kills process with taskkill
      PID:2996
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM 7star.exe"
    3⤵
    PID:3092
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM 7star.exe
      4⤵
      Kills process with taskkill
      PID:2820
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM sputnik.exe"
    3⤵
    PID:5188
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM sputnik.exe
      4⤵
      Kills process with taskkill
      PID:4544
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM vivaldi.exe"
    3⤵
    PID:664
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM vivaldi.exe
      4⤵
      Kills process with taskkill
      PID:3868
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM epicprivacybrowser.exe"
    3⤵
    PID:5216
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM epicprivacybrowser.exe
      4⤵
      Kills process with taskkill
      PID:2136
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM uran.exe"
    3⤵
    PID:5116
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM uran.exe
      4⤵
      Kills process with taskkill
      PID:1676
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM yandex.exe"
    3⤵
    PID:4352
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM yandex.exe
      4⤵
      Kills process with taskkill
      PID:2572
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM iridium.exe"
    3⤵
    PID:4540
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM iridium.exe
      4⤵
      Kills process with taskkill
      PID:4896
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM tor.exe"
    3⤵
    PID:5176
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM tor.exe
      4⤵
      Kills process with taskkill
      PID:2632
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM waterfox.exe"
    3⤵
    PID:4456
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM waterfox.exe
      4⤵
      Kills process with taskkill
      PID:5388
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM arc.exe"
    3⤵
    PID:1864
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM arc.exe
      4⤵
      Kills process with taskkill
      PID:5392
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "wmic product get name,version,vendor,installDate /format:list"
    3⤵
    PID:4232
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:5776
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic product get name,version,vendor,installDate /format:list
      4⤵
      PID:4520
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "ipconfig /all"
    3⤵
    PID:3696
  - - C:\Windows\system32\ipconfig.exe
      ipconfig /all
      4⤵
      Gathers network information
      PID:1628
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "route print"
    3⤵
    PID:3292
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:4060
  - - C:\Windows\system32\ROUTE.EXE
      route print
      4⤵
      PID:5036
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "wmic service get name,displayName,state,startMode,pathName /format:list"
    3⤵
    PID:5984
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic service get name,displayName,state,startMode,pathName /format:list
      4⤵
      PID:3228
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "reg query "HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0" /v FeatureSet"
    3⤵
    PID:5852
  - - C:\Windows\system32\reg.exe
      reg query "HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0" /v FeatureSet
      4⤵
      Checks processor information in registry
      PID:2152
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SOFTWARE\Microsoft\Cryptography" /v MachineGuid"
    3⤵
    PID:5492
  - - C:\Windows\system32\reg.exe
      reg query "HKLM\SOFTWARE\Microsoft\Cryptography" /v MachineGuid
      4⤵
      PID:3312
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "netsh advfirewall show allprofiles state"
    3⤵
    PID:5696
  - - C:\Windows\system32\netsh.exe
      netsh advfirewall show allprofiles state
      4⤵
      Modifies Windows Firewall
      Event Triggered Execution: Netsh Helper DLL
      PID:2648
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "Get-MpComputerStatus | Select-Object -ExpandProperty AntivirusEnabled""
    3⤵
    PID:2584
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -Command "Get-MpComputerStatus | Select-Object -ExpandProperty AntivirusEnabled"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:5056
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "Get-HotFix | Sort-Object InstalledOn -Descending | Select-Object -First 1 | Select-Object -ExpandProperty InstalledOn""
    3⤵
    PID:4236
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -Command "Get-HotFix | Sort-Object InstalledOn -Descending | Select-Object -First 1 | Select-Object -ExpandProperty InstalledOn"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:2636
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v EnableLUA"
    3⤵
    PID:5124
  - - C:\Windows\system32\reg.exe
      reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v EnableLUA
      4⤵
      PID:1212
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "Get-VpnConnection | Where-Object {$_.ConnectionStatus -eq 'Connected'} | Select-Object -First 1""
    3⤵
    PID:1380
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -Command "Get-VpnConnection | Where-Object {$_.ConnectionStatus -eq 'Connected'} | Select-Object -First 1"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:800
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "net session"
    3⤵
    PID:5756
  - - C:\Windows\system32\net.exe
      net session
      4⤵
      PID:4592
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        5⤵
        
        PID:2172
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "[bool](([System.Security.Principal.WindowsIdentity]::GetCurrent()).groups -match 'S-1-5-32-544')""
    3⤵
    PID:3740
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -Command "[bool](([System.Security.Principal.WindowsIdentity]::GetCurrent()).groups -match 'S-1-5-32-544')"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:3152
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -EncodedCommand JABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQA9ACcAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQAnACAAJABwAD0AQAAoACkAIAB0AHIAeQAgAHsAIAAgACAAJABjAD0ARwBlAHQALQBDAGkAbQBJAG4AcwB0AGEAbgBjAGUAIAAtAE4AYQBtAGUAcwBwAGEAYwBlACAAcgBvAG8AdAAvAFMAZQBjAHUAcgBpAHQAeQBDAGUAbgB0AGUAcgAyACAALQBDAGwAYQBzAHMATgBhAG0AZQAgAEEAbgB0AGkAVgBpAHIAdQBzAFAAcgBvAGQAdQBjAHQAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAIAAgACAAaQBmACAAKAAkAGMAKQAgAHsAIABmAG8AcgBlAGEAYwBoACAAKAAkAHgAIABpAG4AIABAACgAJABjACkAKQAgAHsAIAAkAHAAKwA9AFsAUABTAEMAdQBzAHQAbwBtAE8AYgBqAGUAYwB0AF0AQAB7AE4APQBbAHMAdAByAGkAbgBnAF0AJAB4AC4AZABpAHMAcABsAGEAeQBOAGEAbQBlADsAUwA9AFsAaQBuAHQANgA0AF0AJAB4AC4AcAByAG8AZAB1AGMAdABTAHQAYQB0AGUAfQAgAH0AIAB9ACAAfQAgAGMAYQB0AGMAaAAgAHsAfQAgAGkAZgAgACgAJABwAC4AQwBvAHUAbgB0ACAALQBlAHEAIAAwACkAIAB7ACAAdAByAHkAIAB7ACAAIAAgACQAdwA9AEcAZQB0AC0AVwBtAGkATwBiAGoAZQBjAHQAIAAtAE4AYQBtAGUAcwBwAGEAYwBlACAAcgBvAG8AdABcAFMAZQBjAHUAcgBpAHQAeQBDAGUAbgB0AGUAcgAyACAALQBDAGwAYQBzAHMAIABBAG4AdABpAFYAaQByAHUAcwBQAHIAbwBkAHUAYwB0ACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlACAAIAAgAGkAZgAgACgAJAB3ACkAIAB7ACAAZgBvAHIAZQBhAGMAaAAgACgAJAB4ACAAaQBuACAAQAAoACQAdwApACkAIAB7ACAAJABwACsAPQBbAFAAUwBDAHUAcwB0AG8AbQBPAGIAagBlAGMAdABdAEAAewBOAD0AWwBzAHQAcgBpAG4AZwBdACQAeAAuAGQAaQBzAHAAbABhAHkATgBhAG0AZQA7AFMAPQBbAGkAbgB0ADYANABdACQAeAAuAHAAcgBvAGQAdQBjAHQAUwB0AGEAdABlAH0AIAB9ACAAfQAgAH0AIABjAGEAdABjAGgAIAB7AH0AIAB9ACAAJABkAD0AJABuAHUAbABsACAAdAByAHkAIAB7ACAAIAAgACQAbQA9AEcAZQB0AC0ATQBwAEMAbwBtAHAAdQB0AGUAcgBTAHQAYQB0AHUAcwAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQAgACAAIABpAGYAIAAoACQAbQApACAAewAgACAAIAAgACAAJABkAD0AWwBQAFMAQwB1AHMAdABvAG0ATwBiAGoAZQBjAHQAXQBAAHsAQQBFAD0AJABtAC4AQQBuAHQAaQB2AGkAcgB1AHMARQBuAGEAYgBsAGUAZAA7AFIAVAA9ACQAbQAuAFIAZQBhAGwAVABpAG0AZQBQAHIAbwB0AGUAYwB0AGkAbwBuAEUAbgBhAGIAbABlAGQAOwBBAE0APQAkAG0ALgBBAE0AUwBlAHIAdgBpAGMAZQBFAG4AYQBiAGwAZQBkADsAUgBNAD0AWwBzAHQAcgBpAG4AZwBdACQAbQAuAEEATQBSAHUAbgBuAGkAbgBnAE0AbwBkAGUAfQAgACAAIAB9ACAAfQAgAGMAYQB0AGMAaAAgAHsAfQAgAFsAUABTAEMAdQBzAHQAbwBtAE8AYgBqAGUAYwB0AF0AQAB7AFAAPQAkAHAAOwBEAD0AJABkAH0AfABDAG8AbgB2AGUAcgB0AFQAbwAtAEoAcwBvAG4AIAAtAEMAbwBtAHAAcgBlAHMAcwAgAC0ARABlAHAAdABoACAANgA="
    3⤵
    PID:5292
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -EncodedCommand JABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQA9ACcAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQAnACAAJABwAD0AQAAoACkAIAB0AHIAeQAgAHsAIAAgACAAJABjAD0ARwBlAHQALQBDAGkAbQBJAG4AcwB0AGEAbgBjAGUAIAAtAE4AYQBtAGUAcwBwAGEAYwBlACAAcgBvAG8AdAAvAFMAZQBjAHUAcgBpAHQAeQBDAGUAbgB0AGUAcgAyACAALQBDAGwAYQBzAHMATgBhAG0AZQAgAEEAbgB0AGkAVgBpAHIAdQBzAFAAcgBvAGQAdQBjAHQAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAIAAgACAAaQBmACAAKAAkAGMAKQAgAHsAIABmAG8AcgBlAGEAYwBoACAAKAAkAHgAIABpAG4AIABAACgAJABjACkAKQAgAHsAIAAkAHAAKwA9AFsAUABTAEMAdQBzAHQAbwBtAE8AYgBqAGUAYwB0AF0AQAB7AE4APQBbAHMAdAByAGkAbgBnAF0AJAB4AC4AZABpAHMAcABsAGEAeQBOAGEAbQBlADsAUwA9AFsAaQBuAHQANgA0AF0AJAB4AC4AcAByAG8AZAB1AGMAdABTAHQAYQB0AGUAfQAgAH0AIAB9ACAAfQAgAGMAYQB0AGMAaAAgAHsAfQAgAGkAZgAgACgAJABwAC4AQwBvAHUAbgB0ACAALQBlAHEAIAAwACkAIAB7ACAAdAByAHkAIAB7ACAAIAAgACQAdwA9AEcAZQB0AC0AVwBtAGkATwBiAGoAZQBjAHQAIAAtAE4AYQBtAGUAcwBwAGEAYwBlACAAcgBvAG8AdABcAFMAZQBjAHUAcgBpAHQAeQBDAGUAbgB0AGUAcgAyACAALQBDAGwAYQBzAHMAIABBAG4AdABpAFYAaQByAHUAcwBQAHIAbwBkAHUAYwB0ACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlACAAIAAgAGkAZgAgACgAJAB3ACkAIAB7ACAAZgBvAHIAZQBhAGMAaAAgACgAJAB4ACAAaQBuACAAQAAoACQAdwApACkAIAB7ACAAJABwACsAPQBbAFAAUwBDAHUAcwB0AG8AbQBPAGIAagBlAGMAdABdAEAAewBOAD0AWwBzAHQAcgBpAG4AZwBdACQAeAAuAGQAaQBzAHAAbABhAHkATgBhAG0AZQA7AFMAPQBbAGkAbgB0ADYANABdACQAeAAuAHAAcgBvAGQAdQBjAHQAUwB0AGEAdABlAH0AIAB9ACAAfQAgAH0AIABjAGEAdABjAGgAIAB7AH0AIAB9ACAAJABkAD0AJABuAHUAbABsACAAdAByAHkAIAB7ACAAIAAgACQAbQA9AEcAZQB0AC0ATQBwAEMAbwBtAHAAdQB0AGUAcgBTAHQAYQB0AHUAcwAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQAgACAAIABpAGYAIAAoACQAbQApACAAewAgACAAIAAgACAAJABkAD0AWwBQAFMAQwB1AHMAdABvAG0ATwBiAGoAZQBjAHQAXQBAAHsAQQBFAD0AJABtAC4AQQBuAHQAaQB2AGkAcgB1AHMARQBuAGEAYgBsAGUAZAA7AFIAVAA9ACQAbQAuAFIAZQBhAGwAVABpAG0AZQBQAHIAbwB0AGUAYwB0AGkAbwBuAEUAbgBhAGIAbABlAGQAOwBBAE0APQAkAG0ALgBBAE0AUwBlAHIAdgBpAGMAZQBFAG4AYQBiAGwAZQBkADsAUgBNAD0AWwBzAHQAcgBpAG4AZwBdACQAbQAuAEEATQBSAHUAbgBuAGkAbgBnAE0AbwBkAGUAfQAgACAAIAB9ACAAfQAgAGMAYQB0AGMAaAAgAHsAfQAgAFsAUABTAEMAdQBzAHQAbwBtAE8AYgBqAGUAYwB0AF0AQAB7AFAAPQAkAHAAOwBEAD0AJABkAH0AfABDAG8AbgB2AGUAcgB0AFQAbwAtAEoAcwBvAG4AIAAtAEMAbwBtAHAAcgBlAHMAcwAgAC0ARABlAHAAdABoACAANgA=
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:1712
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "(Get-MpComputerStatus).AntivirusEnabled""
    3⤵
    PID:3448
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -Command "(Get-MpComputerStatus).AntivirusEnabled"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:4784
- - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "Get-WmiObject Win32_logicaldisk | select Access,Caption,FileSystem,FreeSpace,Size | fl"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:332
- - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "Get-CimInstance win32_VideoController | fl *"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:4512
- - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "gp \"HKLM:\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\*\" -ErrorAction SilentlyContinue | where MatchingDeviceId $null -NE | select MatchingDeviceId,HardwareInformation.qwMemorySize | fl"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Hide Artifacts: Ignore Process Interrupts
    - Suspicious behavior: EnumeratesProcesses
    PID:652
- - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "Get-CimInstance win32_desktopmonitor | fl *"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:4792
- - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "Get-CimInstance -Namespace root\wmi -ClassName WmiMonitorBasicDisplayParams | fl"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:792
- - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "Add-Type -AssemblyName System.Windows.Forms; [System.Windows.Forms.Screen]::AllScreens"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:1816
- - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "Get-CimInstance -Namespace root\wmi -ClassName WmiMonitorConnectionParams | fl"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:3796
- - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "gwmi WmiMonitorID -Namespace root\wmi | ForEach-Object {(($_.ManufacturerName -notmatch 0 | foreach {[char]$_}) -join \"\") + \"|\" + (($_.ProductCodeID -notmatch 0 | foreach {[char]$_}) -join \"\") + \"|\" + (($_.UserFriendlyName -notmatch 0 | foreach {[char]$_}) -join \"\") + \"|\" + (($_.SerialNumberID -notmatch 0 | foreach {[char]$_}) -join \"\") + \"|\" + $_.InstanceName}"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:1000
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "reg query "HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0" /v FeatureSet"
    3⤵
    PID:5540
  - - C:\Windows\system32\reg.exe
      reg query "HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0" /v FeatureSet
      4⤵
      Checks processor information in registry
      PID:5944
- - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "Get-CimInstance Win32_processor | select Name, Revision, L2CacheSize, L3CacheSize, Manufacturer, MaxClockSpeed, Description, UpgradeMethod, Caption, NumberOfLogicalProcessors, NumberOfCores | fl"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:3220
- - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "Get-CimInstance Win32_CacheMemory | select CacheType,InstalledSize,Level | fl"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:3568
- - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "(Get-CimInstance Win32_ComputerSystem).HypervisorPresent"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:4220
- - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "Get-CimInstance Win32_processor | select Name, Revision, L2CacheSize, L3CacheSize, Manufacturer, MaxClockSpeed, Description, UpgradeMethod, Caption, NumberOfLogicalProcessors, NumberOfCores | fl"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:5652
- - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "Get-CimInstance Win32_CacheMemory | select CacheType,InstalledSize,Level | fl"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:1644
- - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "(Get-CimInstance Win32_ComputerSystem).HypervisorPresent"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:1880
- - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "Get-CimInstance Win32_PageFileUsage | Select AllocatedBaseSize, CurrentUsage"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:1676
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "echo %COMPUTERNAME%.%USERDNSDOMAIN%"
    3⤵
    PID:2988
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:1816
- - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "Get-CimInstance Win32_OperatingSystem | select Caption,SerialNumber,BuildNumber,ServicePackMajorVersion,ServicePackMinorVersion | fl"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:4020
- - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "(Get-CimInstance Win32_ComputerSystem).HypervisorPresent"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:5816
- - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "Add-Type -AssemblyName System.Windows.Forms; [System.Windows.Forms.SystemInformation]::TerminalServerSession"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:3232
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "reg query "HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0" /v FeatureSet"
    3⤵
    PID:1076
  - - C:\Windows\system32\reg.exe
      reg query "HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0" /v FeatureSet
      4⤵
      Checks processor information in registry
      PID:220
- - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "Get-CimInstance Win32_PageFileUsage | Select AllocatedBaseSize, CurrentUsage"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:4464
- - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "Get-CimInstance Win32_processor | select Name, Revision, L2CacheSize, L3CacheSize, Manufacturer, MaxClockSpeed, Description, UpgradeMethod, Caption, NumberOfLogicalProcessors, NumberOfCores | fl"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:4712
- - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "Get-CimInstance Win32_CacheMemory | select CacheType,InstalledSize,Level | fl"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:4828
- - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "(Get-CimInstance Win32_ComputerSystem).HypervisorPresent"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:332
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:2172
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "findstr /C:"Detected boot environment" "%windir%\Panther\setupact.log""
    3⤵
    PID:4240
  - - C:\Windows\system32\findstr.exe
      findstr /C:"Detected boot environment" "C:\Windows\Panther\setupact.log"
      4⤵
      PID:4348
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "(Get-WmiObject -Class SoftwareLicensingService).OA3xOriginalProductKey""
    3⤵
    PID:6044
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -Command "(Get-WmiObject -Class SoftwareLicensingService).OA3xOriginalProductKey"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:5676
- - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "Get-WmiObject Win32_logicaldisk | select Access,Caption,FileSystem,FreeSpace,Size | fl"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:2900
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:5392
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "echo %COMPUTERNAME%.%USERDNSDOMAIN%"
    3⤵
    PID:5232
- - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "Get-CimInstance Win32_OperatingSystem | select Caption,SerialNumber,BuildNumber,ServicePackMajorVersion,ServicePackMinorVersion | fl"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:2092
- - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "(Get-CimInstance Win32_ComputerSystem).HypervisorPresent"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:1072
- - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "Add-Type -AssemblyName System.Windows.Forms; [System.Windows.Forms.SystemInformation]::TerminalServerSession"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:788
- - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "Get-CimInstance Win32_PageFileUsage | Select AllocatedBaseSize, CurrentUsage"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:4632
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "findstr /C:"Detected boot environment" "%windir%\Panther\setupact.log""
    3⤵
    PID:1092
  - - C:\Windows\system32\findstr.exe
      findstr /C:"Detected boot environment" "C:\Windows\Panther\setupact.log"
      4⤵
      PID:4080
- - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "Get-WmiObject Win32_logicaldisk | select Access,Caption,FileSystem,FreeSpace,Size | fl"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:4680
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:4464
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "echo %COMPUTERNAME%.%USERDNSDOMAIN%"
    3⤵
    PID:4940
- - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "Get-CimInstance Win32_OperatingSystem | select Caption,SerialNumber,BuildNumber,ServicePackMajorVersion,ServicePackMinorVersion | fl"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:5460
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:2636
- - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "(Get-CimInstance Win32_ComputerSystem).HypervisorPresent"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:3776
- - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "Add-Type -AssemblyName System.Windows.Forms; [System.Windows.Forms.SystemInformation]::TerminalServerSession"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:5804
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:1880
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "findstr /C:"Detected boot environment" "%windir%\Panther\setupact.log""
    3⤵
    PID:5212
  - - C:\Windows\system32\findstr.exe
      findstr /C:"Detected boot environment" "C:\Windows\Panther\setupact.log"
      4⤵
      PID:1220
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "py -3 --version"
    3⤵
    PID:5800
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "py --version"
    3⤵
    PID:3180
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "python --version"
    3⤵
    PID:2408
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "python3 --version"
    3⤵
    PID:5128
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "taskkill /IM javaw.exe /F"
    3⤵
    PID:4620
  - - C:\Windows\system32\taskkill.exe
      taskkill /IM javaw.exe /F
      4⤵
      Kills process with taskkill
      PID:3620
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "taskkill /IM EpicGamesLauncher.exe /F"
    3⤵
    PID:1528
  - - C:\Windows\system32\taskkill.exe
      taskkill /IM EpicGamesLauncher.exe /F
      4⤵
      Kills process with taskkill
      PID:3204
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "taskkill /IM Steam.exe /F"
    3⤵
    PID:2424
  - - C:\Windows\system32\taskkill.exe
      taskkill /IM Steam.exe /F
      4⤵
      Kills process with taskkill
      PID:3956
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "sc config node DisplayName= "System Settings Provider""
    3⤵
    PID:916
  - - C:\Windows\system32\sc.exe
      sc config node DisplayName= "System Settings Provider"
      4⤵
      Launches sc.exe
      PID:2772
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist | findstr /i svchost.exe"
    3⤵
    PID:6036
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:4048
  - - C:\Windows\system32\findstr.exe
      findstr /i svchost.exe
      4⤵
      PID:1972
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist | findstr /i winlogon.exe"
    3⤵
    PID:3632
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:4752
  - - C:\Windows\system32\findstr.exe
      findstr /i winlogon.exe
      4⤵
      PID:4660
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist | findstr /i services.exe"
    3⤵
    PID:5340
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:4524
  - - C:\Windows\system32\findstr.exe
      findstr /i services.exe
      4⤵
      PID:5172
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist | findstr /i explorer.exe"
    3⤵
    PID:668
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:5912
  - - C:\Windows\system32\findstr.exe
      findstr /i explorer.exe
      4⤵
      PID:4964
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist | findstr /i dllhost.exe"
    3⤵
    PID:4060
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:4932
  - - C:\Windows\system32\findstr.exe
      findstr /i dllhost.exe
      4⤵
      PID:2624
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist | findstr /i taskhostw.exe"
    3⤵
    PID:2820
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:4680
  - - C:\Windows\system32\findstr.exe
      findstr /i taskhostw.exe
      4⤵
      PID:3340
- - C:\Users\Admin\AppData\Local\Programs\steamupdate.exe\SteamUpdate.exe.exe
    "C:\Users\Admin\AppData\Local\Programs\steamupdate.exe\SteamUpdate.exe.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --user-data-dir="C:\Users\Admin\AppData\Roaming\steamupdate.exe" --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAABEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1816 --field-trial-handle=2552,i,6158071841429249510,9220051749338535608,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:4472

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:1916

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Hide Artifacts

T1564

Ignore Process Interrupts

T1564.011

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Obfuscated Files or Information

T1027

Command Obfuscation

T1027.010

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Wi-Fi Discovery

T1016.002

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e584d22.rbs

Path C:\Config.Msi\e584d22.rbs
Size 41KB
SHA256 569f01df00672b2c00999e576b221f539074100b0e74f329e126a7b313be645a
MD5 a5f478c132c44c49249f15ad0f1d47b1
SHA1 adc427b6b51d6537e3579be407010a1885211a6d
SHA512 f9459a9c63ac41248a46eca5257f974f66d84ae5c5ed9a57648f7c21fb02f96a8c2d6dc67881989b0b4bff4c15aec62b3cb36dbb903f7191c99ba8f7e8747b32
SSDEEP 768:hoFBRJ0Znm4+S7uVGNGPVU0lYNba/8wIcrFqI6LliwAoEyTJX1gQNZkwpvNLqbBc:2FBRJ0Znm4+S7uVGNGPVU0WNba/8wIcu
TLSH
T1F61343854866C0EDC591457F6760B68EC2EADE04FAA77D0D430ACE0E1E666CDF9CD08B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 4KB
SHA256 e27390d57580e3dfba07bec3d8e430203bbc91e90f6937079b3fd52abc721bd4
MD5 dbbd2d4458d7e8094846420da595dfc3
SHA1 267cb47b904f14a519d2bd73abfdb30e1a06e1a6
SHA512 480e7ca865b811f79f35fcfe7a9ac0280b48d1f9459873d18f000db55c72d53345cf3a10075c1ac407439545f699ce2a7bef38b00b4e19439edf384b00045531
SSDEEP 96:iq4uYqGEo9xx+incqKXq3qotzYNYr7aqCiNLm7RIz+cBPzQh0nRAy6FcxZcosQSm:iq4uYqGEUdncqKXq3qotzYuWq2Iz+wx
TLSH
T11D91EE323375E0D5C8263F07192C19C463AF439AEA54AF48B258620EED2714BDF122F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download