1e5bf7fe168b54b5ba53c56217693be1157a21acfb78161c34441c13cea10c14

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
09/07/2026, 02:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-09_9f15bdd6f557e272c6e346a608541e0a_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
Size 56.5MB
Sample260709-cfd7jacw4y
SHA256 1e5bf7fe168b54b5ba53c56217693be1157a21acfb78161c34441c13cea10c14
MD5 9f15bdd6f557e272c6e346a608541e0a
SHA1 43cc37d34a3c501ff47987758c5801047a45d28b
SHA512 60d2b89ce8169525c5a0fb990e02a340b27fae0968ab41ea70d3456b0e58bf7098c111d2fd7c0841b0d9eff7203e698dacf4a61d89a1b64098164579b0dbda6e
SSDEEP 393216:u0jtDZ5f11Hov2ItdHO6rK4a3xhAGNTzmYPGrIsqG+suoRCxSRle+OBMyke17Yo9:uED5zyFuoRCxHBPdVY1ujyCc3siXRdQ
TLSH
T167D74A42A2BA05C1FDF7DA34C9E65213D673BC166F3185CF22091B2A1F776E08976722
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 17 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
5388	powershell.exe
5356	powershell.exe
5828	powershell.exe
4956	powershell.exe
5620	powershell.exe
5880	powershell.exe
3264	powershell.exe
2456	powershell.exe
3828	powershell.exe
5388	powershell.exe
640	powershell.exe
5088	powershell.exe
3336	powershell.exe
1864	powershell.exe
5248	powershell.exe
3940	powershell.exe
1152	powershell.exe

Enumerates processes with tasklist 1 TTPs 1 IoCs

discovery

Process Discovery

T1057

pid	Process
2040	tasklist.exe

Kills process with taskkill 1 IoCs

defense_evasion

pid	Process
5304	taskkill.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 34 IoCs

pid	Process
5388	powershell.exe
5388	powershell.exe
5356	powershell.exe
5356	powershell.exe
3940	powershell.exe
3940	powershell.exe
5880	powershell.exe
5880	powershell.exe
3264	powershell.exe
3264	powershell.exe
5088	powershell.exe
5088	powershell.exe
1152	powershell.exe
1152	powershell.exe
640	powershell.exe
640	powershell.exe
5828	powershell.exe
5828	powershell.exe
2456	powershell.exe
2456	powershell.exe
3828	powershell.exe
3828	powershell.exe
5388	powershell.exe
5388	powershell.exe
4956	powershell.exe
4956	powershell.exe
5620	powershell.exe
5620	powershell.exe
3336	powershell.exe
3336	powershell.exe
1864	powershell.exe
1864	powershell.exe
5248	powershell.exe
5248	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	1992	WMIC.exe
Token: SeSecurityPrivilege	1992	WMIC.exe
Token: SeTakeOwnershipPrivilege	1992	WMIC.exe
Token: SeLoadDriverPrivilege	1992	WMIC.exe
Token: SeSystemProfilePrivilege	1992	WMIC.exe
Token: SeSystemtimePrivilege	1992	WMIC.exe
Token: SeProfSingleProcessPrivilege	1992	WMIC.exe
Token: SeIncBasePriorityPrivilege	1992	WMIC.exe
Token: SeCreatePagefilePrivilege	1992	WMIC.exe
Token: SeBackupPrivilege	1992	WMIC.exe
Token: SeRestorePrivilege	1992	WMIC.exe
Token: SeShutdownPrivilege	1992	WMIC.exe
Token: SeDebugPrivilege	1992	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1992	WMIC.exe
Token: SeRemoteShutdownPrivilege	1992	WMIC.exe
Token: SeUndockPrivilege	1992	WMIC.exe
Token: SeManageVolumePrivilege	1992	WMIC.exe
Token: 33	1992	WMIC.exe
Token: 34	1992	WMIC.exe
Token: 35	1992	WMIC.exe
Token: 36	1992	WMIC.exe
Token: SeIncreaseQuotaPrivilege	1992	WMIC.exe
Token: SeSecurityPrivilege	1992	WMIC.exe
Token: SeTakeOwnershipPrivilege	1992	WMIC.exe
Token: SeLoadDriverPrivilege	1992	WMIC.exe
Token: SeSystemProfilePrivilege	1992	WMIC.exe
Token: SeSystemtimePrivilege	1992	WMIC.exe
Token: SeProfSingleProcessPrivilege	1992	WMIC.exe
Token: SeIncBasePriorityPrivilege	1992	WMIC.exe
Token: SeCreatePagefilePrivilege	1992	WMIC.exe
Token: SeBackupPrivilege	1992	WMIC.exe
Token: SeRestorePrivilege	1992	WMIC.exe
Token: SeShutdownPrivilege	1992	WMIC.exe
Token: SeDebugPrivilege	1992	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1992	WMIC.exe
Token: SeRemoteShutdownPrivilege	1992	WMIC.exe
Token: SeUndockPrivilege	1992	WMIC.exe
Token: SeManageVolumePrivilege	1992	WMIC.exe
Token: 33	1992	WMIC.exe
Token: 34	1992	WMIC.exe
Token: 35	1992	WMIC.exe
Token: 36	1992	WMIC.exe
Token: SeDebugPrivilege	2040	tasklist.exe
Token: SeDebugPrivilege	5388	powershell.exe
Token: SeIncreaseQuotaPrivilege	5388	powershell.exe
Token: SeSecurityPrivilege	5388	powershell.exe
Token: SeTakeOwnershipPrivilege	5388	powershell.exe
Token: SeLoadDriverPrivilege	5388	powershell.exe
Token: SeSystemProfilePrivilege	5388	powershell.exe
Token: SeSystemtimePrivilege	5388	powershell.exe
Token: SeProfSingleProcessPrivilege	5388	powershell.exe
Token: SeIncBasePriorityPrivilege	5388	powershell.exe
Token: SeCreatePagefilePrivilege	5388	powershell.exe
Token: SeBackupPrivilege	5388	powershell.exe
Token: SeRestorePrivilege	5388	powershell.exe
Token: SeShutdownPrivilege	5388	powershell.exe
Token: SeDebugPrivilege	5388	powershell.exe
Token: SeSystemEnvironmentPrivilege	5388	powershell.exe
Token: SeRemoteShutdownPrivilege	5388	powershell.exe
Token: SeUndockPrivilege	5388	powershell.exe
Token: SeManageVolumePrivilege	5388	powershell.exe
Token: 33	5388	powershell.exe
Token: 34	5388	powershell.exe
Token: 35	5388	powershell.exe

Suspicious use of WriteProcessMemory 43 IoCs

description	pid	Process	procid_target
PID 5564 wrote to memory of 3740	5564	2026-07-09_9f15bdd6f557e272c6e346a608541e0a_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe	85
PID 3740 wrote to memory of 1992	3740	cmd.exe	87
PID 5564 wrote to memory of 5508	5564	2026-07-09_9f15bdd6f557e272c6e346a608541e0a_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe	89
PID 5508 wrote to memory of 2040	5508	cmd.exe	91
PID 5564 wrote to memory of 3096	5564	2026-07-09_9f15bdd6f557e272c6e346a608541e0a_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe	92
PID 3096 wrote to memory of 5388	3096	cmd.exe	94
PID 5564 wrote to memory of 5164	5564	2026-07-09_9f15bdd6f557e272c6e346a608541e0a_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe	95
PID 5164 wrote to memory of 448	5164	cmd.exe	97
PID 448 wrote to memory of 5152	448	net.exe	98
PID 5564 wrote to memory of 2944	5564	2026-07-09_9f15bdd6f557e272c6e346a608541e0a_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe	99
PID 2944 wrote to memory of 5304	2944	cmd.exe	101
PID 5564 wrote to memory of 1428	5564	2026-07-09_9f15bdd6f557e272c6e346a608541e0a_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe	102
PID 1428 wrote to memory of 5356	1428	cmd.exe	104
PID 5564 wrote to memory of 908	5564	2026-07-09_9f15bdd6f557e272c6e346a608541e0a_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe	105
PID 908 wrote to memory of 3940	908	cmd.exe	107
PID 5564 wrote to memory of 1252	5564	2026-07-09_9f15bdd6f557e272c6e346a608541e0a_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe	115
PID 1252 wrote to memory of 5880	1252	cmd.exe	117
PID 5564 wrote to memory of 3916	5564	2026-07-09_9f15bdd6f557e272c6e346a608541e0a_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe	118
PID 3916 wrote to memory of 3264	3916	cmd.exe	120
PID 5564 wrote to memory of 5200	5564	2026-07-09_9f15bdd6f557e272c6e346a608541e0a_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe	124
PID 5200 wrote to memory of 5088	5200	cmd.exe	126
PID 5564 wrote to memory of 4916	5564	2026-07-09_9f15bdd6f557e272c6e346a608541e0a_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe	127
PID 4916 wrote to memory of 1152	4916	cmd.exe	129
PID 5564 wrote to memory of 944	5564	2026-07-09_9f15bdd6f557e272c6e346a608541e0a_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe	130
PID 944 wrote to memory of 640	944	cmd.exe	132
PID 5564 wrote to memory of 3252	5564	2026-07-09_9f15bdd6f557e272c6e346a608541e0a_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe	133
PID 3252 wrote to memory of 5828	3252	cmd.exe	135
PID 5564 wrote to memory of 6060	5564	2026-07-09_9f15bdd6f557e272c6e346a608541e0a_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe	136
PID 6060 wrote to memory of 2456	6060	cmd.exe	138
PID 5564 wrote to memory of 560	5564	2026-07-09_9f15bdd6f557e272c6e346a608541e0a_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe	139
PID 560 wrote to memory of 3828	560	cmd.exe	141
PID 5564 wrote to memory of 5728	5564	2026-07-09_9f15bdd6f557e272c6e346a608541e0a_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe	142
PID 5728 wrote to memory of 5388	5728	cmd.exe	144
PID 5564 wrote to memory of 6004	5564	2026-07-09_9f15bdd6f557e272c6e346a608541e0a_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe	145
PID 6004 wrote to memory of 4956	6004	cmd.exe	147
PID 5564 wrote to memory of 5480	5564	2026-07-09_9f15bdd6f557e272c6e346a608541e0a_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe	148
PID 5480 wrote to memory of 5620	5480	cmd.exe	150
PID 5564 wrote to memory of 888	5564	2026-07-09_9f15bdd6f557e272c6e346a608541e0a_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe	151
PID 888 wrote to memory of 3336	888	cmd.exe	153
PID 5564 wrote to memory of 5352	5564	2026-07-09_9f15bdd6f557e272c6e346a608541e0a_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe	154
PID 5352 wrote to memory of 1864	5352	cmd.exe	156
PID 5564 wrote to memory of 3800	5564	2026-07-09_9f15bdd6f557e272c6e346a608541e0a_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe	157
PID 3800 wrote to memory of 5248	3800	cmd.exe	159

C:\Users\Admin\AppData\Local\Temp\2026-07-09_9f15bdd6f557e272c6e346a608541e0a_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-09_9f15bdd6f557e272c6e346a608541e0a_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5564
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic diskdrive get Model"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3740
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic diskdrive get Model
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1992
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5508
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:2040
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -Command "(Get-CimInstance Win32_PortConnector).Count""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3096
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "(Get-CimInstance Win32_PortConnector).Count"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5388
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "net session"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5164
- - C:\Windows\system32\net.exe
    net session
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:448
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:5152
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM SecHealthUI.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2944
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM SecHealthUI.exe
    3⤵
    - Kills process with taskkill
    PID:5304
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -Command "Get-Service -Name WinDefend | Select-Object -ExpandProperty Status""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1428
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Get-Service -Name WinDefend | Select-Object -ExpandProperty Status"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:5356
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -Command "$r=Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion'; $os=Get-CimInstance Win32_OperatingSystem; try { $av=Get-CimInstance -Namespace root\SecurityCenter2 -ClassName AntivirusProduct | Select-Object -ExpandProperty displayName } catch { $av = 'Not available' }; '{0}, Version {1}, OS Build {2}.{3} {4} - Antivirus: {5}' -f ($os.Caption -replace 'Microsoft ','').Trim(), $r.DisplayVersion, $r.CurrentBuild, $r.UBR, $os.OSArchitecture, ($av -join ', ')""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:908
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "$r=Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion'; $os=Get-CimInstance Win32_OperatingSystem; try { $av=Get-CimInstance -Namespace root\SecurityCenter2 -ClassName AntivirusProduct | Select-Object -ExpandProperty displayName } catch { $av = 'Not available' }; '{0}, Version {1}, OS Build {2}.{3} {4} - Antivirus: {5}' -f ($os.Caption -replace 'Microsoft ','').Trim(), $r.DisplayVersion, $r.CurrentBuild, $r.UBR, $os.OSArchitecture, ($av -join ', ')"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:3940
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -Command "$r=Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion'; $os=Get-CimInstance Win32_OperatingSystem; try { $av=Get-CimInstance -Namespace root\SecurityCenter2 -ClassName AntivirusProduct | Select-Object -ExpandProperty displayName } catch { $av = 'Not available' }; '{0}, Version {1}, OS Build {2}.{3} {4} - Antivirus: {5}' -f ($os.Caption -replace 'Microsoft ','').Trim(), $r.DisplayVersion, $r.CurrentBuild, $r.UBR, $os.OSArchitecture, ($av -join ', ')""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1252
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "$r=Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion'; $os=Get-CimInstance Win32_OperatingSystem; try { $av=Get-CimInstance -Namespace root\SecurityCenter2 -ClassName AntivirusProduct | Select-Object -ExpandProperty displayName } catch { $av = 'Not available' }; '{0}, Version {1}, OS Build {2}.{3} {4} - Antivirus: {5}' -f ($os.Caption -replace 'Microsoft ','').Trim(), $r.DisplayVersion, $r.CurrentBuild, $r.UBR, $os.OSArchitecture, ($av -join ', ')"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:5880
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -Command "$r=Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion'; $os=Get-CimInstance Win32_OperatingSystem; try { $av=Get-CimInstance -Namespace root\SecurityCenter2 -ClassName AntivirusProduct | Select-Object -ExpandProperty displayName } catch { $av = 'Not available' }; '{0}, Version {1}, OS Build {2}.{3} {4} - Antivirus: {5}' -f ($os.Caption -replace 'Microsoft ','').Trim(), $r.DisplayVersion, $r.CurrentBuild, $r.UBR, $os.OSArchitecture, ($av -join ', ')""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3916
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "$r=Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion'; $os=Get-CimInstance Win32_OperatingSystem; try { $av=Get-CimInstance -Namespace root\SecurityCenter2 -ClassName AntivirusProduct | Select-Object -ExpandProperty displayName } catch { $av = 'Not available' }; '{0}, Version {1}, OS Build {2}.{3} {4} - Antivirus: {5}' -f ($os.Caption -replace 'Microsoft ','').Trim(), $r.DisplayVersion, $r.CurrentBuild, $r.UBR, $os.OSArchitecture, ($av -join ', ')"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:3264
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -Command "$r=Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion'; $os=Get-CimInstance Win32_OperatingSystem; try { $av=Get-CimInstance -Namespace root\SecurityCenter2 -ClassName AntivirusProduct | Select-Object -ExpandProperty displayName } catch { $av = 'Not available' }; '{0}, Version {1}, OS Build {2}.{3} {4} - Antivirus: {5}' -f ($os.Caption -replace 'Microsoft ','').Trim(), $r.DisplayVersion, $r.CurrentBuild, $r.UBR, $os.OSArchitecture, ($av -join ', ')""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5200
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "$r=Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion'; $os=Get-CimInstance Win32_OperatingSystem; try { $av=Get-CimInstance -Namespace root\SecurityCenter2 -ClassName AntivirusProduct | Select-Object -ExpandProperty displayName } catch { $av = 'Not available' }; '{0}, Version {1}, OS Build {2}.{3} {4} - Antivirus: {5}' -f ($os.Caption -replace 'Microsoft ','').Trim(), $r.DisplayVersion, $r.CurrentBuild, $r.UBR, $os.OSArchitecture, ($av -join ', ')"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:5088
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -Command "$r=Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion'; $os=Get-CimInstance Win32_OperatingSystem; try { $av=Get-CimInstance -Namespace root\SecurityCenter2 -ClassName AntivirusProduct | Select-Object -ExpandProperty displayName } catch { $av = 'Not available' }; '{0}, Version {1}, OS Build {2}.{3} {4} - Antivirus: {5}' -f ($os.Caption -replace 'Microsoft ','').Trim(), $r.DisplayVersion, $r.CurrentBuild, $r.UBR, $os.OSArchitecture, ($av -join ', ')""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4916
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "$r=Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion'; $os=Get-CimInstance Win32_OperatingSystem; try { $av=Get-CimInstance -Namespace root\SecurityCenter2 -ClassName AntivirusProduct | Select-Object -ExpandProperty displayName } catch { $av = 'Not available' }; '{0}, Version {1}, OS Build {2}.{3} {4} - Antivirus: {5}' -f ($os.Caption -replace 'Microsoft ','').Trim(), $r.DisplayVersion, $r.CurrentBuild, $r.UBR, $os.OSArchitecture, ($av -join ', ')"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:1152
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -Command "$r=Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion'; $os=Get-CimInstance Win32_OperatingSystem; try { $av=Get-CimInstance -Namespace root\SecurityCenter2 -ClassName AntivirusProduct | Select-Object -ExpandProperty displayName } catch { $av = 'Not available' }; '{0}, Version {1}, OS Build {2}.{3} {4} - Antivirus: {5}' -f ($os.Caption -replace 'Microsoft ','').Trim(), $r.DisplayVersion, $r.CurrentBuild, $r.UBR, $os.OSArchitecture, ($av -join ', ')""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:944
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "$r=Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion'; $os=Get-CimInstance Win32_OperatingSystem; try { $av=Get-CimInstance -Namespace root\SecurityCenter2 -ClassName AntivirusProduct | Select-Object -ExpandProperty displayName } catch { $av = 'Not available' }; '{0}, Version {1}, OS Build {2}.{3} {4} - Antivirus: {5}' -f ($os.Caption -replace 'Microsoft ','').Trim(), $r.DisplayVersion, $r.CurrentBuild, $r.UBR, $os.OSArchitecture, ($av -join ', ')"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:640
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -Command "$r=Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion'; $os=Get-CimInstance Win32_OperatingSystem; try { $av=Get-CimInstance -Namespace root\SecurityCenter2 -ClassName AntivirusProduct | Select-Object -ExpandProperty displayName } catch { $av = 'Not available' }; '{0}, Version {1}, OS Build {2}.{3} {4} - Antivirus: {5}' -f ($os.Caption -replace 'Microsoft ','').Trim(), $r.DisplayVersion, $r.CurrentBuild, $r.UBR, $os.OSArchitecture, ($av -join ', ')""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3252
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "$r=Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion'; $os=Get-CimInstance Win32_OperatingSystem; try { $av=Get-CimInstance -Namespace root\SecurityCenter2 -ClassName AntivirusProduct | Select-Object -ExpandProperty displayName } catch { $av = 'Not available' }; '{0}, Version {1}, OS Build {2}.{3} {4} - Antivirus: {5}' -f ($os.Caption -replace 'Microsoft ','').Trim(), $r.DisplayVersion, $r.CurrentBuild, $r.UBR, $os.OSArchitecture, ($av -join ', ')"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:5828
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -Command "$r=Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion'; $os=Get-CimInstance Win32_OperatingSystem; try { $av=Get-CimInstance -Namespace root\SecurityCenter2 -ClassName AntivirusProduct | Select-Object -ExpandProperty displayName } catch { $av = 'Not available' }; '{0}, Version {1}, OS Build {2}.{3} {4} - Antivirus: {5}' -f ($os.Caption -replace 'Microsoft ','').Trim(), $r.DisplayVersion, $r.CurrentBuild, $r.UBR, $os.OSArchitecture, ($av -join ', ')""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:6060
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "$r=Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion'; $os=Get-CimInstance Win32_OperatingSystem; try { $av=Get-CimInstance -Namespace root\SecurityCenter2 -ClassName AntivirusProduct | Select-Object -ExpandProperty displayName } catch { $av = 'Not available' }; '{0}, Version {1}, OS Build {2}.{3} {4} - Antivirus: {5}' -f ($os.Caption -replace 'Microsoft ','').Trim(), $r.DisplayVersion, $r.CurrentBuild, $r.UBR, $os.OSArchitecture, ($av -join ', ')"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:2456
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -Command "$r=Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion'; $os=Get-CimInstance Win32_OperatingSystem; try { $av=Get-CimInstance -Namespace root\SecurityCenter2 -ClassName AntivirusProduct | Select-Object -ExpandProperty displayName } catch { $av = 'Not available' }; '{0}, Version {1}, OS Build {2}.{3} {4} - Antivirus: {5}' -f ($os.Caption -replace 'Microsoft ','').Trim(), $r.DisplayVersion, $r.CurrentBuild, $r.UBR, $os.OSArchitecture, ($av -join ', ')""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:560
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "$r=Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion'; $os=Get-CimInstance Win32_OperatingSystem; try { $av=Get-CimInstance -Namespace root\SecurityCenter2 -ClassName AntivirusProduct | Select-Object -ExpandProperty displayName } catch { $av = 'Not available' }; '{0}, Version {1}, OS Build {2}.{3} {4} - Antivirus: {5}' -f ($os.Caption -replace 'Microsoft ','').Trim(), $r.DisplayVersion, $r.CurrentBuild, $r.UBR, $os.OSArchitecture, ($av -join ', ')"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:3828
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -Command "$r=Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion'; $os=Get-CimInstance Win32_OperatingSystem; try { $av=Get-CimInstance -Namespace root\SecurityCenter2 -ClassName AntivirusProduct | Select-Object -ExpandProperty displayName } catch { $av = 'Not available' }; '{0}, Version {1}, OS Build {2}.{3} {4} - Antivirus: {5}' -f ($os.Caption -replace 'Microsoft ','').Trim(), $r.DisplayVersion, $r.CurrentBuild, $r.UBR, $os.OSArchitecture, ($av -join ', ')""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5728
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "$r=Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion'; $os=Get-CimInstance Win32_OperatingSystem; try { $av=Get-CimInstance -Namespace root\SecurityCenter2 -ClassName AntivirusProduct | Select-Object -ExpandProperty displayName } catch { $av = 'Not available' }; '{0}, Version {1}, OS Build {2}.{3} {4} - Antivirus: {5}' -f ($os.Caption -replace 'Microsoft ','').Trim(), $r.DisplayVersion, $r.CurrentBuild, $r.UBR, $os.OSArchitecture, ($av -join ', ')"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:5388
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -Command "$r=Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion'; $os=Get-CimInstance Win32_OperatingSystem; try { $av=Get-CimInstance -Namespace root\SecurityCenter2 -ClassName AntivirusProduct | Select-Object -ExpandProperty displayName } catch { $av = 'Not available' }; '{0}, Version {1}, OS Build {2}.{3} {4} - Antivirus: {5}' -f ($os.Caption -replace 'Microsoft ','').Trim(), $r.DisplayVersion, $r.CurrentBuild, $r.UBR, $os.OSArchitecture, ($av -join ', ')""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:6004
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "$r=Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion'; $os=Get-CimInstance Win32_OperatingSystem; try { $av=Get-CimInstance -Namespace root\SecurityCenter2 -ClassName AntivirusProduct | Select-Object -ExpandProperty displayName } catch { $av = 'Not available' }; '{0}, Version {1}, OS Build {2}.{3} {4} - Antivirus: {5}' -f ($os.Caption -replace 'Microsoft ','').Trim(), $r.DisplayVersion, $r.CurrentBuild, $r.UBR, $os.OSArchitecture, ($av -join ', ')"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:4956
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -Command "$r=Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion'; $os=Get-CimInstance Win32_OperatingSystem; try { $av=Get-CimInstance -Namespace root\SecurityCenter2 -ClassName AntivirusProduct | Select-Object -ExpandProperty displayName } catch { $av = 'Not available' }; '{0}, Version {1}, OS Build {2}.{3} {4} - Antivirus: {5}' -f ($os.Caption -replace 'Microsoft ','').Trim(), $r.DisplayVersion, $r.CurrentBuild, $r.UBR, $os.OSArchitecture, ($av -join ', ')""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5480
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "$r=Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion'; $os=Get-CimInstance Win32_OperatingSystem; try { $av=Get-CimInstance -Namespace root\SecurityCenter2 -ClassName AntivirusProduct | Select-Object -ExpandProperty displayName } catch { $av = 'Not available' }; '{0}, Version {1}, OS Build {2}.{3} {4} - Antivirus: {5}' -f ($os.Caption -replace 'Microsoft ','').Trim(), $r.DisplayVersion, $r.CurrentBuild, $r.UBR, $os.OSArchitecture, ($av -join ', ')"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:5620
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -Command "$r=Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion'; $os=Get-CimInstance Win32_OperatingSystem; try { $av=Get-CimInstance -Namespace root\SecurityCenter2 -ClassName AntivirusProduct | Select-Object -ExpandProperty displayName } catch { $av = 'Not available' }; '{0}, Version {1}, OS Build {2}.{3} {4} - Antivirus: {5}' -f ($os.Caption -replace 'Microsoft ','').Trim(), $r.DisplayVersion, $r.CurrentBuild, $r.UBR, $os.OSArchitecture, ($av -join ', ')""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:888
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "$r=Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion'; $os=Get-CimInstance Win32_OperatingSystem; try { $av=Get-CimInstance -Namespace root\SecurityCenter2 -ClassName AntivirusProduct | Select-Object -ExpandProperty displayName } catch { $av = 'Not available' }; '{0}, Version {1}, OS Build {2}.{3} {4} - Antivirus: {5}' -f ($os.Caption -replace 'Microsoft ','').Trim(), $r.DisplayVersion, $r.CurrentBuild, $r.UBR, $os.OSArchitecture, ($av -join ', ')"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:3336
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -Command "$r=Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion'; $os=Get-CimInstance Win32_OperatingSystem; try { $av=Get-CimInstance -Namespace root\SecurityCenter2 -ClassName AntivirusProduct | Select-Object -ExpandProperty displayName } catch { $av = 'Not available' }; '{0}, Version {1}, OS Build {2}.{3} {4} - Antivirus: {5}' -f ($os.Caption -replace 'Microsoft ','').Trim(), $r.DisplayVersion, $r.CurrentBuild, $r.UBR, $os.OSArchitecture, ($av -join ', ')""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5352
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "$r=Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion'; $os=Get-CimInstance Win32_OperatingSystem; try { $av=Get-CimInstance -Namespace root\SecurityCenter2 -ClassName AntivirusProduct | Select-Object -ExpandProperty displayName } catch { $av = 'Not available' }; '{0}, Version {1}, OS Build {2}.{3} {4} - Antivirus: {5}' -f ($os.Caption -replace 'Microsoft ','').Trim(), $r.DisplayVersion, $r.CurrentBuild, $r.UBR, $os.OSArchitecture, ($av -join ', ')"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:1864
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -Command "$r=Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion'; $os=Get-CimInstance Win32_OperatingSystem; try { $av=Get-CimInstance -Namespace root\SecurityCenter2 -ClassName AntivirusProduct | Select-Object -ExpandProperty displayName } catch { $av = 'Not available' }; '{0}, Version {1}, OS Build {2}.{3} {4} - Antivirus: {5}' -f ($os.Caption -replace 'Microsoft ','').Trim(), $r.DisplayVersion, $r.CurrentBuild, $r.UBR, $os.OSArchitecture, ($av -join ', ')""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3800
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "$r=Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion'; $os=Get-CimInstance Win32_OperatingSystem; try { $av=Get-CimInstance -Namespace root\SecurityCenter2 -ClassName AntivirusProduct | Select-Object -ExpandProperty displayName } catch { $av = 'Not available' }; '{0}, Version {1}, OS Build {2}.{3} {4} - Antivirus: {5}' -f ($os.Caption -replace 'Microsoft ','').Trim(), $r.DisplayVersion, $r.CurrentBuild, $r.UBR, $os.OSArchitecture, ($av -join ', ')"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:5248

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Process Discovery

T1057

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...