7baffcf112328168106efac1c9d7865c3a97100491aabbb7e3f3ecbf3bf86ff6

Analysis

max time kernel
149s
max time network
137s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
05/06/2026, 04:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-05_5e21086d71d7d1184277feb37f3629c5_akira_glassworm_icedid_megazord_njrat_quasar-rat_rusty-s.exe
Size 112.0MB
Sample260605-ff33facs2r
SHA256 7baffcf112328168106efac1c9d7865c3a97100491aabbb7e3f3ecbf3bf86ff6
MD5 5e21086d71d7d1184277feb37f3629c5
SHA1 b069812f72fdff652b3bc8b90697204471eb396c
SHA512 b9dd82a36f99fe18390cde98f8050c48032e8212e67c3c6a15747c887d71b5e0c2165216687198f505dedbfb65b79a38fc5dd93a184db48fb9272bc4ffcd1156
SSDEEP 1572864:xAXffHRdXmZF8CY8EpRIf2pjmom3H7S7u+VYVXqwb:83iXtqwb
TLSH
T1E5486C43B2A75098E4BBC97582D65323E5337C8A1F3069EF15845B312F73AE09B39B25
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 12 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
1612	powershell.exe
2216	powershell.exe
4720	powershell.exe
440	powershell.exe
2548	powershell.exe
3292	powershell.exe
688	powershell.exe
5012	powershell.exe
3160	powershell.exe
1100	powershell.exe
228	powershell.exe
3720	powershell.exe

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
1	api.ipify.org
20	api.ipify.org

Suspicious behavior: EnumeratesProcesses 22 IoCs

pid	Process
1100	powershell.exe
1100	powershell.exe
228	powershell.exe
228	powershell.exe
440	powershell.exe
440	powershell.exe
3720	powershell.exe
3720	powershell.exe
1612	powershell.exe
1612	powershell.exe
2216	powershell.exe
2216	powershell.exe
4720	powershell.exe
4720	powershell.exe
2548	powershell.exe
2548	powershell.exe
3292	powershell.exe
3292	powershell.exe
688	powershell.exe
688	powershell.exe
5012	powershell.exe
5012	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	1100	powershell.exe
Token: SeDebugPrivilege	228	powershell.exe
Token: SeIncreaseQuotaPrivilege	228	powershell.exe
Token: SeSecurityPrivilege	228	powershell.exe
Token: SeTakeOwnershipPrivilege	228	powershell.exe
Token: SeLoadDriverPrivilege	228	powershell.exe
Token: SeSystemProfilePrivilege	228	powershell.exe
Token: SeSystemtimePrivilege	228	powershell.exe
Token: SeProfSingleProcessPrivilege	228	powershell.exe
Token: SeIncBasePriorityPrivilege	228	powershell.exe
Token: SeCreatePagefilePrivilege	228	powershell.exe
Token: SeBackupPrivilege	228	powershell.exe
Token: SeRestorePrivilege	228	powershell.exe
Token: SeShutdownPrivilege	228	powershell.exe
Token: SeDebugPrivilege	228	powershell.exe
Token: SeSystemEnvironmentPrivilege	228	powershell.exe
Token: SeRemoteShutdownPrivilege	228	powershell.exe
Token: SeUndockPrivilege	228	powershell.exe
Token: SeManageVolumePrivilege	228	powershell.exe
Token: 33	228	powershell.exe
Token: 34	228	powershell.exe
Token: 35	228	powershell.exe
Token: 36	228	powershell.exe
Token: SeDebugPrivilege	440	powershell.exe
Token: SeIncreaseQuotaPrivilege	440	powershell.exe
Token: SeSecurityPrivilege	440	powershell.exe
Token: SeTakeOwnershipPrivilege	440	powershell.exe
Token: SeLoadDriverPrivilege	440	powershell.exe
Token: SeSystemProfilePrivilege	440	powershell.exe
Token: SeSystemtimePrivilege	440	powershell.exe
Token: SeProfSingleProcessPrivilege	440	powershell.exe
Token: SeIncBasePriorityPrivilege	440	powershell.exe
Token: SeCreatePagefilePrivilege	440	powershell.exe
Token: SeBackupPrivilege	440	powershell.exe
Token: SeRestorePrivilege	440	powershell.exe
Token: SeShutdownPrivilege	440	powershell.exe
Token: SeDebugPrivilege	440	powershell.exe
Token: SeSystemEnvironmentPrivilege	440	powershell.exe
Token: SeRemoteShutdownPrivilege	440	powershell.exe
Token: SeUndockPrivilege	440	powershell.exe
Token: SeManageVolumePrivilege	440	powershell.exe
Token: 33	440	powershell.exe
Token: 34	440	powershell.exe
Token: 35	440	powershell.exe
Token: 36	440	powershell.exe
Token: SeDebugPrivilege	3720	powershell.exe
Token: SeIncreaseQuotaPrivilege	3720	powershell.exe
Token: SeSecurityPrivilege	3720	powershell.exe
Token: SeTakeOwnershipPrivilege	3720	powershell.exe
Token: SeLoadDriverPrivilege	3720	powershell.exe
Token: SeSystemProfilePrivilege	3720	powershell.exe
Token: SeSystemtimePrivilege	3720	powershell.exe
Token: SeProfSingleProcessPrivilege	3720	powershell.exe
Token: SeIncBasePriorityPrivilege	3720	powershell.exe
Token: SeCreatePagefilePrivilege	3720	powershell.exe
Token: SeBackupPrivilege	3720	powershell.exe
Token: SeRestorePrivilege	3720	powershell.exe
Token: SeShutdownPrivilege	3720	powershell.exe
Token: SeDebugPrivilege	3720	powershell.exe
Token: SeSystemEnvironmentPrivilege	3720	powershell.exe
Token: SeRemoteShutdownPrivilege	3720	powershell.exe
Token: SeUndockPrivilege	3720	powershell.exe
Token: SeManageVolumePrivilege	3720	powershell.exe
Token: 33	3720	powershell.exe

Suspicious use of WriteProcessMemory 29 IoCs

description	pid	Process	procid_target
PID 4948 wrote to memory of 2424	4948	2026-06-05_5e21086d71d7d1184277feb37f3629c5_akira_glassworm_icedid_megazord_njrat_quasar-rat_rusty-s.exe	83
PID 2424 wrote to memory of 3160	2424	cmd.exe	85
PID 4948 wrote to memory of 3792	4948	2026-06-05_5e21086d71d7d1184277feb37f3629c5_akira_glassworm_icedid_megazord_njrat_quasar-rat_rusty-s.exe	86
PID 3792 wrote to memory of 1100	3792	cmd.exe	88
PID 1100 wrote to memory of 4728	1100	powershell.exe	89
PID 4948 wrote to memory of 4696	4948	2026-06-05_5e21086d71d7d1184277feb37f3629c5_akira_glassworm_icedid_megazord_njrat_quasar-rat_rusty-s.exe	90
PID 4696 wrote to memory of 228	4696	cmd.exe	92
PID 4948 wrote to memory of 1944	4948	2026-06-05_5e21086d71d7d1184277feb37f3629c5_akira_glassworm_icedid_megazord_njrat_quasar-rat_rusty-s.exe	94
PID 1944 wrote to memory of 440	1944	cmd.exe	96
PID 4948 wrote to memory of 4292	4948	2026-06-05_5e21086d71d7d1184277feb37f3629c5_akira_glassworm_icedid_megazord_njrat_quasar-rat_rusty-s.exe	99
PID 4292 wrote to memory of 3720	4292	cmd.exe	101
PID 4948 wrote to memory of 2908	4948	2026-06-05_5e21086d71d7d1184277feb37f3629c5_akira_glassworm_icedid_megazord_njrat_quasar-rat_rusty-s.exe	102
PID 2908 wrote to memory of 1612	2908	cmd.exe	104
PID 4948 wrote to memory of 5020	4948	2026-06-05_5e21086d71d7d1184277feb37f3629c5_akira_glassworm_icedid_megazord_njrat_quasar-rat_rusty-s.exe	105
PID 5020 wrote to memory of 2216	5020	cmd.exe	107
PID 4948 wrote to memory of 2456	4948	2026-06-05_5e21086d71d7d1184277feb37f3629c5_akira_glassworm_icedid_megazord_njrat_quasar-rat_rusty-s.exe	109
PID 2456 wrote to memory of 4720	2456	cmd.exe	111
PID 4948 wrote to memory of 2452	4948	2026-06-05_5e21086d71d7d1184277feb37f3629c5_akira_glassworm_icedid_megazord_njrat_quasar-rat_rusty-s.exe	112
PID 2452 wrote to memory of 1288	2452	cmd.exe	114
PID 4948 wrote to memory of 768	4948	2026-06-05_5e21086d71d7d1184277feb37f3629c5_akira_glassworm_icedid_megazord_njrat_quasar-rat_rusty-s.exe	115
PID 768 wrote to memory of 228	768	cmd.exe	117
PID 4948 wrote to memory of 2552	4948	2026-06-05_5e21086d71d7d1184277feb37f3629c5_akira_glassworm_icedid_megazord_njrat_quasar-rat_rusty-s.exe	118
PID 2552 wrote to memory of 2548	2552	cmd.exe	120
PID 4948 wrote to memory of 4384	4948	2026-06-05_5e21086d71d7d1184277feb37f3629c5_akira_glassworm_icedid_megazord_njrat_quasar-rat_rusty-s.exe	121
PID 4384 wrote to memory of 3292	4384	cmd.exe	123
PID 4948 wrote to memory of 3992	4948	2026-06-05_5e21086d71d7d1184277feb37f3629c5_akira_glassworm_icedid_megazord_njrat_quasar-rat_rusty-s.exe	124
PID 3992 wrote to memory of 688	3992	cmd.exe	126
PID 4948 wrote to memory of 1924	4948	2026-06-05_5e21086d71d7d1184277feb37f3629c5_akira_glassworm_icedid_megazord_njrat_quasar-rat_rusty-s.exe	129
PID 1924 wrote to memory of 5012	1924	cmd.exe	131

C:\Users\Admin\AppData\Local\Temp\2026-06-05_5e21086d71d7d1184277feb37f3629c5_akira_glassworm_icedid_megazord_njrat_quasar-rat_rusty-s.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-05_5e21086d71d7d1184277feb37f3629c5_akira_glassworm_icedid_megazord_njrat_quasar-rat_rusty-s.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4948
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "Add-Type -MemberDefinition '[DllImport(\\"kernel32.dll\\",SetLastError=true)]public static extern uint GetSystemFirmwareTable(uint sig,uint id,IntPtr buf,uint sz);public static string R(){uint n=GetSystemFirmwareTable(0x52534D42,0,IntPtr.Zero,0);if(n==0)return\\"\\";IntPtr b=Marshal.AllocHGlobal((int)n);GetSystemFirmwareTable(0x52534D42,0,b,n);byte[] d=new byte[(int)System.Math.Min(n,8192u)];Marshal.Copy(b,d,0,d.Length);Marshal.FreeHGlobal(b);var s=new System.Text.StringBuilder();var c=new System.Text.StringBuilder();foreach(byte x in d){if(x>=0x20&&x<0x7F)c.Append((char)x);else{if(c.Length>=4){s.Append(c);s.Append(\\"|\\");}c.Clear();}}return s.ToString();}' -Name R1 -Namespace HW -Using System.Runtime.InteropServices; [HW.R1]::R()""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2424
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "Add-Type -MemberDefinition '[DllImport(\\"kernel32.dll\\",SetLastError=true)]public static extern uint GetSystemFirmwareTable(uint sig,uint id,IntPtr buf,uint sz);public static string R(){uint n=GetSystemFirmwareTable(0x52534D42,0,IntPtr.Zero,0);if(n==0)return\\"\\";IntPtr b=Marshal.AllocHGlobal((int)n);GetSystemFirmwareTable(0x52534D42,0,b,n);byte[] d=new byte[(int)System.Math.Min(n,8192u)];Marshal.Copy(b,d,0,d.Length);Marshal.FreeHGlobal(b);var s=new System.Text.StringBuilder();var c=new System.Text.StringBuilder();foreach(byte x in d){if(x>=0x20&&x<0x7F)c.Append((char)x);else{if(c.Length>=4){s.Append(c);s.Append(\\"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:3160
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "Add-Type -MemberDefinition '[DllImport(\\"kernel32.dll\\",SetLastError=true)]public static extern uint EnumSystemFirmwareTables(uint sig,IntPtr buf,uint sz);public static string L(){uint n=EnumSystemFirmwareTables(0x41435049,IntPtr.Zero,0);if(n==0)return\\"\\";IntPtr b=Marshal.AllocHGlobal((int)n);EnumSystemFirmwareTables(0x41435049,b,n);var r=new System.Text.StringBuilder();for(int i=0;i<(int)(n/4);i++){byte[] s=new byte[4];Marshal.Copy(b+i*4,s,0,4);r.Append(System.Text.Encoding.ASCII.GetString(s));r.Append(\\",\\");}Marshal.FreeHGlobal(b);return r.ToString();}' -Name R2 -Namespace HW2 -Using System.Runtime.InteropServices; [HW2.R2]::L()""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3792
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "Add-Type -MemberDefinition '[DllImport(\\"kernel32.dll\\",SetLastError=true)]public static extern uint EnumSystemFirmwareTables(uint sig,IntPtr buf,uint sz);public static string L(){uint n=EnumSystemFirmwareTables(0x41435049,IntPtr.Zero,0);if(n==0)return\\"\\";IntPtr b=Marshal.AllocHGlobal((int)n);EnumSystemFirmwareTables(0x41435049,b,n);var r=new System.Text.StringBuilder();for(int i=0;i<(int)(n/4);i++){byte[] s=new byte[4];Marshal.Copy(b+i*4,s,0,4);r.Append(System.Text.Encoding.ASCII.GetString(s));r.Append(\\",\\");}Marshal.FreeHGlobal(b);return r.ToString();}' -Name R2 -Namespace HW2 -Using System.Runtime.InteropServices; [HW2.R2]::L()"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1100
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\3cymlvif\3cymlvif.cmdline"
      4⤵
      PID:4728
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "Get-CimInstance -ClassName Win32_DiskDrive | Select-Object Model | Format-List""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4696
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "Get-CimInstance -ClassName Win32_DiskDrive | Select-Object Model | Format-List"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:228
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "Get-CimInstance -ClassName Win32_BIOS | Select-Object Manufacturer | Format-List""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1944
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "Get-CimInstance -ClassName Win32_BIOS | Select-Object Manufacturer | Format-List"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:440
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "Get-CimInstance -ClassName Win32_ComputerSystem | Select-Object Manufacturer | Format-List""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4292
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "Get-CimInstance -ClassName Win32_ComputerSystem | Select-Object Manufacturer | Format-List"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3720
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "Get-CimInstance -ClassName Win32_PhysicalMemory | Select-Object Manufacturer,Speed | Format-List""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2908
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "Get-CimInstance -ClassName Win32_PhysicalMemory | Select-Object Manufacturer,Speed | Format-List"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:1612
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "Get-CimInstance -ClassName Win32_SoundDevice | Select-Object Name | Format-List""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5020
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "Get-CimInstance -ClassName Win32_SoundDevice | Select-Object Name | Format-List"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:2216
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "Get-CimInstance -ClassName Win32_BaseBoard | Select-Object Manufacturer,Product | Format-List""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2456
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "Get-CimInstance -ClassName Win32_BaseBoard | Select-Object Manufacturer,Product | Format-List"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:4720
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic baseboard get Manufacturer /format:list"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2452
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic baseboard get Manufacturer /format:list
    3⤵
    PID:1288
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic baseboard get Product /format:list"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:768
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic baseboard get Product /format:list
    3⤵
    PID:228
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "Get-CimInstance -ClassName Win32_DiskDrive | Select-Object PNPDeviceID | Format-List""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2552
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "Get-CimInstance -ClassName Win32_DiskDrive | Select-Object PNPDeviceID | Format-List"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:2548
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "Get-CimInstance -ClassName Win32_PnPEntity | Select-Object Name | Format-List""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4384
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "Get-CimInstance -ClassName Win32_PnPEntity | Select-Object Name | Format-List"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:3292
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "Get-CimInstance -ClassName Win32_DiskDrive | Select-Object Size | Format-List""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3992
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "Get-CimInstance -ClassName Win32_DiskDrive | Select-Object Size | Format-List"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:688
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -WindowStyle Hidden -Command "Add-Type -AssemblyName System.Windows.Forms,System.Drawing;$b=[System.Windows.Forms.Screen]::PrimaryScreen.Bounds;$bmp=New-Object Drawing.Bitmap($b.Width,$b.Height);$g=[Drawing.Graphics]::FromImage($bmp);$g.CopyFromScreen($b.Location,[Drawing.Point]::Empty,$b.Size);$ms=New-Object IO.MemoryStream;$bmp.Save($ms,[Drawing.Imaging.ImageFormat]::Jpeg);[Convert]::ToBase64String($ms.ToArray())""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1924
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -WindowStyle Hidden -Command "Add-Type -AssemblyName System.Windows.Forms,System.Drawing;$b=[System.Windows.Forms.Screen]::PrimaryScreen.Bounds;$bmp=New-Object Drawing.Bitmap($b.Width,$b.Height);$g=[Drawing.Graphics]::FromImage($bmp);$g.CopyFromScreen($b.Location,[Drawing.Point]::Empty,$b.Size);$ms=New-Object IO.MemoryStream;$bmp.Save($ms,[Drawing.Imaging.ImageFormat]::Jpeg);[Convert]::ToBase64String($ms.ToArray())"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:5012

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...