7eed74905b8dc1f73309f9e63b457c93790dd41c3d227ab1486cc9ebd84faa7d

Analysis

max time kernel
150s
max time network
158s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260618-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260618-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
28/06/2026, 18:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-28_d6191a0025f04f336b95fe9897255197_blankgrabber_cobalt-strike_coinminer_funksec_glassworm_i.exe
Size 69.4MB
Sample260628-xe277acv2k
SHA256 7eed74905b8dc1f73309f9e63b457c93790dd41c3d227ab1486cc9ebd84faa7d
MD5 d6191a0025f04f336b95fe9897255197
SHA1 ce71e55536d47edbbd6196c799b450d677c7772e
SHA512 007ec909b74fb4b4182f5b714b4552e719335d668b196ce5f2ce99257157ccc4948e86f759e6aab8f9d2afc7e53235781637392c3a945592c70c1776cbcd06c5
SSDEEP 393216:L5P3pCzfv9l0A6LUJoBycFuVJas+7+uBzgkJKTpEdN5gsbtFKx2Xinsp0AIXvVTr:LpQftOi9AiIyvJEoBxOWbcFO
TLSH
T18EF75A42A7EA04D5F9F7AA3489F65213D673BC062F3085DB324C172A1F736E09976722
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 9 IoCs

Run Powershell to get system information as a root user.

execution

PowerShell

T1059.001

pid	Process
7048	powershell.exe
1776	powershell.exe
5136	powershell.exe
1772	powershell.exe
5216	powershell.exe
3664	powershell.exe
6312	powershell.exe
2700	powershell.exe
3448	powershell.exe

Enumerates processes with tasklist 1 TTPs 1 IoCs

discovery

Process Discovery

T1057

pid	Process
5780	tasklist.exe

Checks processor information in registry 2 TTPs 24 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\~MHz	2026-06-28_d6191a0025f04f336b95fe9897255197_blankgrabber_cobalt-strike_coinminer_funksec_glassworm_i.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\ProcessorNameString	2026-06-28_d6191a0025f04f336b95fe9897255197_blankgrabber_cobalt-strike_coinminer_funksec_glassworm_i.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\~MHz	2026-06-28_d6191a0025f04f336b95fe9897255197_blankgrabber_cobalt-strike_coinminer_funksec_glassworm_i.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7	2026-06-28_d6191a0025f04f336b95fe9897255197_blankgrabber_cobalt-strike_coinminer_funksec_glassworm_i.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\~MHz	2026-06-28_d6191a0025f04f336b95fe9897255197_blankgrabber_cobalt-strike_coinminer_funksec_glassworm_i.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\ProcessorNameString	2026-06-28_d6191a0025f04f336b95fe9897255197_blankgrabber_cobalt-strike_coinminer_funksec_glassworm_i.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	2026-06-28_d6191a0025f04f336b95fe9897255197_blankgrabber_cobalt-strike_coinminer_funksec_glassworm_i.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	2026-06-28_d6191a0025f04f336b95fe9897255197_blankgrabber_cobalt-strike_coinminer_funksec_glassworm_i.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5	2026-06-28_d6191a0025f04f336b95fe9897255197_blankgrabber_cobalt-strike_coinminer_funksec_glassworm_i.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\~MHz	2026-06-28_d6191a0025f04f336b95fe9897255197_blankgrabber_cobalt-strike_coinminer_funksec_glassworm_i.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\ProcessorNameString	2026-06-28_d6191a0025f04f336b95fe9897255197_blankgrabber_cobalt-strike_coinminer_funksec_glassworm_i.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString	2026-06-28_d6191a0025f04f336b95fe9897255197_blankgrabber_cobalt-strike_coinminer_funksec_glassworm_i.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2	2026-06-28_d6191a0025f04f336b95fe9897255197_blankgrabber_cobalt-strike_coinminer_funksec_glassworm_i.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\ProcessorNameString	2026-06-28_d6191a0025f04f336b95fe9897255197_blankgrabber_cobalt-strike_coinminer_funksec_glassworm_i.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4	2026-06-28_d6191a0025f04f336b95fe9897255197_blankgrabber_cobalt-strike_coinminer_funksec_glassworm_i.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\ProcessorNameString	2026-06-28_d6191a0025f04f336b95fe9897255197_blankgrabber_cobalt-strike_coinminer_funksec_glassworm_i.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6	2026-06-28_d6191a0025f04f336b95fe9897255197_blankgrabber_cobalt-strike_coinminer_funksec_glassworm_i.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\~MHz	2026-06-28_d6191a0025f04f336b95fe9897255197_blankgrabber_cobalt-strike_coinminer_funksec_glassworm_i.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	2026-06-28_d6191a0025f04f336b95fe9897255197_blankgrabber_cobalt-strike_coinminer_funksec_glassworm_i.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\~MHz	2026-06-28_d6191a0025f04f336b95fe9897255197_blankgrabber_cobalt-strike_coinminer_funksec_glassworm_i.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3	2026-06-28_d6191a0025f04f336b95fe9897255197_blankgrabber_cobalt-strike_coinminer_funksec_glassworm_i.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\ProcessorNameString	2026-06-28_d6191a0025f04f336b95fe9897255197_blankgrabber_cobalt-strike_coinminer_funksec_glassworm_i.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	2026-06-28_d6191a0025f04f336b95fe9897255197_blankgrabber_cobalt-strike_coinminer_funksec_glassworm_i.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz	2026-06-28_d6191a0025f04f336b95fe9897255197_blankgrabber_cobalt-strike_coinminer_funksec_glassworm_i.exe

Kills process with taskkill 1 IoCs

defense_evasion

pid	Process
3316	taskkill.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
3664	powershell.exe
3664	powershell.exe
5136	powershell.exe
5136	powershell.exe
1772	powershell.exe
1772	powershell.exe
5216	powershell.exe
5216	powershell.exe
2700	powershell.exe
2700	powershell.exe
1776	powershell.exe
1776	powershell.exe
1776	powershell.exe
3448	powershell.exe
3448	powershell.exe
6312	powershell.exe
6312	powershell.exe
7048	powershell.exe
7048	powershell.exe
7048	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	5780	tasklist.exe
Token: SeDebugPrivilege	3664	powershell.exe
Token: SeDebugPrivilege	5136	powershell.exe
Token: SeDebugPrivilege	1772	powershell.exe
Token: SeDebugPrivilege	3316	taskkill.exe
Token: SeDebugPrivilege	5216	powershell.exe
Token: SeIncreaseQuotaPrivilege	5216	powershell.exe
Token: SeSecurityPrivilege	5216	powershell.exe
Token: SeTakeOwnershipPrivilege	5216	powershell.exe
Token: SeLoadDriverPrivilege	5216	powershell.exe
Token: SeSystemProfilePrivilege	5216	powershell.exe
Token: SeSystemtimePrivilege	5216	powershell.exe
Token: SeProfSingleProcessPrivilege	5216	powershell.exe
Token: SeIncBasePriorityPrivilege	5216	powershell.exe
Token: SeCreatePagefilePrivilege	5216	powershell.exe
Token: SeBackupPrivilege	5216	powershell.exe
Token: SeRestorePrivilege	5216	powershell.exe
Token: SeShutdownPrivilege	5216	powershell.exe
Token: SeDebugPrivilege	5216	powershell.exe
Token: SeSystemEnvironmentPrivilege	5216	powershell.exe
Token: SeRemoteShutdownPrivilege	5216	powershell.exe
Token: SeUndockPrivilege	5216	powershell.exe
Token: SeManageVolumePrivilege	5216	powershell.exe
Token: 33	5216	powershell.exe
Token: 34	5216	powershell.exe
Token: 35	5216	powershell.exe
Token: 36	5216	powershell.exe
Token: SeDebugPrivilege	2700	powershell.exe
Token: SeIncreaseQuotaPrivilege	2700	powershell.exe
Token: SeSecurityPrivilege	2700	powershell.exe
Token: SeTakeOwnershipPrivilege	2700	powershell.exe
Token: SeLoadDriverPrivilege	2700	powershell.exe
Token: SeSystemProfilePrivilege	2700	powershell.exe
Token: SeSystemtimePrivilege	2700	powershell.exe
Token: SeProfSingleProcessPrivilege	2700	powershell.exe
Token: SeIncBasePriorityPrivilege	2700	powershell.exe
Token: SeCreatePagefilePrivilege	2700	powershell.exe
Token: SeBackupPrivilege	2700	powershell.exe
Token: SeRestorePrivilege	2700	powershell.exe
Token: SeShutdownPrivilege	2700	powershell.exe
Token: SeDebugPrivilege	2700	powershell.exe
Token: SeSystemEnvironmentPrivilege	2700	powershell.exe
Token: SeRemoteShutdownPrivilege	2700	powershell.exe
Token: SeUndockPrivilege	2700	powershell.exe
Token: SeManageVolumePrivilege	2700	powershell.exe
Token: 33	2700	powershell.exe
Token: 34	2700	powershell.exe
Token: 35	2700	powershell.exe
Token: 36	2700	powershell.exe
Token: SeDebugPrivilege	1776	powershell.exe
Token: SeIncreaseQuotaPrivilege	1776	powershell.exe
Token: SeSecurityPrivilege	1776	powershell.exe
Token: SeTakeOwnershipPrivilege	1776	powershell.exe
Token: SeLoadDriverPrivilege	1776	powershell.exe
Token: SeSystemProfilePrivilege	1776	powershell.exe
Token: SeSystemtimePrivilege	1776	powershell.exe
Token: SeProfSingleProcessPrivilege	1776	powershell.exe
Token: SeIncBasePriorityPrivilege	1776	powershell.exe
Token: SeCreatePagefilePrivilege	1776	powershell.exe
Token: SeBackupPrivilege	1776	powershell.exe
Token: SeRestorePrivilege	1776	powershell.exe
Token: SeShutdownPrivilege	1776	powershell.exe
Token: SeDebugPrivilege	1776	powershell.exe
Token: SeSystemEnvironmentPrivilege	1776	powershell.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 5548 wrote to memory of 5764	5548	2026-06-28_d6191a0025f04f336b95fe9897255197_blankgrabber_cobalt-strike_coinminer_funksec_glassworm_i.exe	90
PID 5764 wrote to memory of 5780	5764	cmd.exe	92
PID 5548 wrote to memory of 2952	5548	2026-06-28_d6191a0025f04f336b95fe9897255197_blankgrabber_cobalt-strike_coinminer_funksec_glassworm_i.exe	94
PID 2952 wrote to memory of 3664	2952	cmd.exe	96
PID 5548 wrote to memory of 4824	5548	2026-06-28_d6191a0025f04f336b95fe9897255197_blankgrabber_cobalt-strike_coinminer_funksec_glassworm_i.exe	97
PID 4824 wrote to memory of 5136	4824	cmd.exe	99
PID 5548 wrote to memory of 6344	5548	2026-06-28_d6191a0025f04f336b95fe9897255197_blankgrabber_cobalt-strike_coinminer_funksec_glassworm_i.exe	100
PID 6344 wrote to memory of 1772	6344	cmd.exe	102
PID 5548 wrote to memory of 2860	5548	2026-06-28_d6191a0025f04f336b95fe9897255197_blankgrabber_cobalt-strike_coinminer_funksec_glassworm_i.exe	103
PID 2860 wrote to memory of 6672	2860	cmd.exe	105
PID 6672 wrote to memory of 6092	6672	net.exe	106
PID 5548 wrote to memory of 4292	5548	2026-06-28_d6191a0025f04f336b95fe9897255197_blankgrabber_cobalt-strike_coinminer_funksec_glassworm_i.exe	107
PID 4292 wrote to memory of 3316	4292	cmd.exe	109
PID 5548 wrote to memory of 5216	5548	2026-06-28_d6191a0025f04f336b95fe9897255197_blankgrabber_cobalt-strike_coinminer_funksec_glassworm_i.exe	110
PID 5548 wrote to memory of 5948	5548	2026-06-28_d6191a0025f04f336b95fe9897255197_blankgrabber_cobalt-strike_coinminer_funksec_glassworm_i.exe	113
PID 5948 wrote to memory of 4104	5948	cmd.exe	115
PID 4104 wrote to memory of 5080	4104	net.exe	116
PID 5548 wrote to memory of 2700	5548	2026-06-28_d6191a0025f04f336b95fe9897255197_blankgrabber_cobalt-strike_coinminer_funksec_glassworm_i.exe	117
PID 5548 wrote to memory of 620	5548	2026-06-28_d6191a0025f04f336b95fe9897255197_blankgrabber_cobalt-strike_coinminer_funksec_glassworm_i.exe	120
PID 620 wrote to memory of 1776	620	cmd.exe	122
PID 5548 wrote to memory of 436	5548	2026-06-28_d6191a0025f04f336b95fe9897255197_blankgrabber_cobalt-strike_coinminer_funksec_glassworm_i.exe	124
PID 436 wrote to memory of 6392	436	cmd.exe	126
PID 6392 wrote to memory of 2520	6392	net.exe	127
PID 5548 wrote to memory of 3448	5548	2026-06-28_d6191a0025f04f336b95fe9897255197_blankgrabber_cobalt-strike_coinminer_funksec_glassworm_i.exe	128
PID 5548 wrote to memory of 6496	5548	2026-06-28_d6191a0025f04f336b95fe9897255197_blankgrabber_cobalt-strike_coinminer_funksec_glassworm_i.exe	130
PID 6496 wrote to memory of 6900	6496	cmd.exe	132
PID 6900 wrote to memory of 6516	6900	net.exe	133
PID 5548 wrote to memory of 6312	5548	2026-06-28_d6191a0025f04f336b95fe9897255197_blankgrabber_cobalt-strike_coinminer_funksec_glassworm_i.exe	134
PID 5548 wrote to memory of 3944	5548	2026-06-28_d6191a0025f04f336b95fe9897255197_blankgrabber_cobalt-strike_coinminer_funksec_glassworm_i.exe	136
PID 3944 wrote to memory of 7048	3944	cmd.exe	138

C:\Users\Admin\AppData\Local\Temp\2026-06-28_d6191a0025f04f336b95fe9897255197_blankgrabber_cobalt-strike_coinminer_funksec_glassworm_i.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-28_d6191a0025f04f336b95fe9897255197_blankgrabber_cobalt-strike_coinminer_funksec_glassworm_i.exe"
1⤵
- Checks processor information in registry
- Suspicious use of WriteProcessMemory
PID:5548
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5764
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:5780
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -Command "(Get-WmiObject Win32_PortConnector).Count""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2952
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "(Get-WmiObject Win32_PortConnector).Count"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3664
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -Command "Get-WmiObject Win32_DiskDrive | Select-Object -ExpandProperty Model""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4824
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Get-WmiObject Win32_DiskDrive | Select-Object -ExpandProperty Model"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5136
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -Command "(Get-WmiObject Win32_VideoController).Name""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:6344
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "(Get-WmiObject Win32_VideoController).Name"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1772
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "net session"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2860
- - C:\Windows\system32\net.exe
    net session
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:6672
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:6092
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM SecHealthUI.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4292
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM SecHealthUI.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3316
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Get-Volume | Where-Object { $_.DriveLetter } | Select-Object -ExpandProperty DriveLetter"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5216
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "net session"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5948
- - C:\Windows\system32\net.exe
    net session
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4104
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:5080
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionPath 'F:\'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2700
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -Command "$r=Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion'; $os=Get-CimInstance Win32_OperatingSystem; $ver=if($r.PSObject.Properties['DisplayVersion'] -and $r.DisplayVersion){$r.DisplayVersion}else{if($r.PSObject.Properties['ReleaseId'] -and $r.ReleaseId){$r.ReleaseId}else{'N/A'}}; $av=Get-CimInstance -Namespace root\SecurityCenter2 -ClassName AntiVirusProduct -ErrorAction SilentlyContinue | Select-Object -ExpandProperty displayName; if(-not $av){$av='Not available'}; $ubr=if($r.PSObject.Properties['UBR'] -and $r.UBR){$r.UBR}else{'0'}; '{0}, Version {1}, OS Build {2}.{3} {4} - Antivirus: {5}' -f ($os.Caption -replace 'Microsoft ','').Trim(), $ver, $r.CurrentBuild, $ubr, $os.OSArchitecture, ($av -join ', ')""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:620
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "$r=Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion'; $os=Get-CimInstance Win32_OperatingSystem; $ver=if($r.PSObject.Properties['DisplayVersion'] -and $r.DisplayVersion){$r.DisplayVersion}else{if($r.PSObject.Properties['ReleaseId'] -and $r.ReleaseId){$r.ReleaseId}else{'N/A'}}; $av=Get-CimInstance -Namespace root\SecurityCenter2 -ClassName AntiVirusProduct -ErrorAction SilentlyContinue | Select-Object -ExpandProperty displayName; if(-not $av){$av='Not available'}; $ubr=if($r.PSObject.Properties['UBR'] -and $r.UBR){$r.UBR}else{'0'}; '{0}, Version {1}, OS Build {2}.{3} {4} - Antivirus: {5}' -f ($os.Caption -replace 'Microsoft ','').Trim(), $ver, $r.CurrentBuild, $ubr, $os.OSArchitecture, ($av -join ', ')"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1776
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "net session"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:436
- - C:\Windows\system32\net.exe
    net session
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:6392
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:2520
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionPath 'F:\'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:3448
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "net session"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:6496
- - C:\Windows\system32\net.exe
    net session
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:6900
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:6516
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionPath 'F:\'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:6312
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -Command "$r=Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion'; $os=Get-CimInstance Win32_OperatingSystem; $ver=if($r.PSObject.Properties['DisplayVersion'] -and $r.DisplayVersion){$r.DisplayVersion}else{if($r.PSObject.Properties['ReleaseId'] -and $r.ReleaseId){$r.ReleaseId}else{'N/A'}}; $av=Get-CimInstance -Namespace root\SecurityCenter2 -ClassName AntiVirusProduct -ErrorAction SilentlyContinue | Select-Object -ExpandProperty displayName; if(-not $av){$av='Not available'}; $ubr=if($r.PSObject.Properties['UBR'] -and $r.UBR){$r.UBR}else{'0'}; '{0}, Version {1}, OS Build {2}.{3} {4} - Antivirus: {5}' -f ($os.Caption -replace 'Microsoft ','').Trim(), $ver, $r.CurrentBuild, $ubr, $os.OSArchitecture, ($av -join ', ')""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3944
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "$r=Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion'; $os=Get-CimInstance Win32_OperatingSystem; $ver=if($r.PSObject.Properties['DisplayVersion'] -and $r.DisplayVersion){$r.DisplayVersion}else{if($r.PSObject.Properties['ReleaseId'] -and $r.ReleaseId){$r.ReleaseId}else{'N/A'}}; $av=Get-CimInstance -Namespace root\SecurityCenter2 -ClassName AntiVirusProduct -ErrorAction SilentlyContinue | Select-Object -ExpandProperty displayName; if(-not $av){$av='Not available'}; $ubr=if($r.PSObject.Properties['UBR'] -and $r.UBR){$r.UBR}else{'0'}; '{0}, Version {1}, OS Build {2}.{3} {4} - Antivirus: {5}' -f ($os.Caption -replace 'Microsoft ','').Trim(), $ver, $r.CurrentBuild, $ubr, $os.OSArchitecture, ($av -join ', ')"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:7048

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact