1e5bf7fe168b54b5ba53c56217693be1157a21acfb78161c34441c13cea10c14

Analysis

max time kernel
150s
max time network
156s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260706-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/07/2026, 02:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-09_9f15bdd6f557e272c6e346a608541e0a_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
Size 56.5MB
Sample260709-cfd7jacw4y
SHA256 1e5bf7fe168b54b5ba53c56217693be1157a21acfb78161c34441c13cea10c14
MD5 9f15bdd6f557e272c6e346a608541e0a
SHA1 43cc37d34a3c501ff47987758c5801047a45d28b
SHA512 60d2b89ce8169525c5a0fb990e02a340b27fae0968ab41ea70d3456b0e58bf7098c111d2fd7c0841b0d9eff7203e698dacf4a61d89a1b64098164579b0dbda6e
SSDEEP 393216:u0jtDZ5f11Hov2ItdHO6rK4a3xhAGNTzmYPGrIsqG+suoRCxSRle+OBMyke17Yo9:uED5zyFuoRCxHBPdVY1ujyCc3siXRdQ
TLSH
T167D74A42A2BA05C1FDF7DA34C9E65213D673BC166F3185CF22091B2A1F776E08976722
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 16 IoCs

Run Powershell to get system information as a root user.

execution

PowerShell

T1059.001

pid	Process
5240	powershell.exe
5756	powershell.exe
4380	powershell.exe
4812	powershell.exe
5508	powershell.exe
2904	powershell.exe
5296	powershell.exe
5596	powershell.exe
5980	powershell.exe
1480	powershell.exe
4136	powershell.exe
4728	powershell.exe
1940	powershell.exe
4368	powershell.exe
4576	powershell.exe
944	powershell.exe

Enumerates processes with tasklist 1 TTPs 1 IoCs

discovery

Process Discovery

T1057

pid	Process
552	tasklist.exe

Kills process with taskkill 1 IoCs

defense_evasion

pid	Process
5568	taskkill.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 36 IoCs

pid	Process
2464	WMIC.exe
2464	WMIC.exe
2464	WMIC.exe
2464	WMIC.exe
4576	powershell.exe
4576	powershell.exe
944	powershell.exe
944	powershell.exe
4380	powershell.exe
4380	powershell.exe
4812	powershell.exe
4812	powershell.exe
4136	powershell.exe
4136	powershell.exe
5508	powershell.exe
5508	powershell.exe
4728	powershell.exe
4728	powershell.exe
2904	powershell.exe
2904	powershell.exe
5296	powershell.exe
5296	powershell.exe
1940	powershell.exe
1940	powershell.exe
5596	powershell.exe
5596	powershell.exe
5980	powershell.exe
5980	powershell.exe
4368	powershell.exe
4368	powershell.exe
1480	powershell.exe
1480	powershell.exe
5240	powershell.exe
5240	powershell.exe
5756	powershell.exe
5756	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	2464	WMIC.exe
Token: SeSecurityPrivilege	2464	WMIC.exe
Token: SeTakeOwnershipPrivilege	2464	WMIC.exe
Token: SeLoadDriverPrivilege	2464	WMIC.exe
Token: SeSystemProfilePrivilege	2464	WMIC.exe
Token: SeSystemtimePrivilege	2464	WMIC.exe
Token: SeProfSingleProcessPrivilege	2464	WMIC.exe
Token: SeIncBasePriorityPrivilege	2464	WMIC.exe
Token: SeCreatePagefilePrivilege	2464	WMIC.exe
Token: SeBackupPrivilege	2464	WMIC.exe
Token: SeRestorePrivilege	2464	WMIC.exe
Token: SeShutdownPrivilege	2464	WMIC.exe
Token: SeDebugPrivilege	2464	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2464	WMIC.exe
Token: SeRemoteShutdownPrivilege	2464	WMIC.exe
Token: SeUndockPrivilege	2464	WMIC.exe
Token: SeManageVolumePrivilege	2464	WMIC.exe
Token: 33	2464	WMIC.exe
Token: 34	2464	WMIC.exe
Token: 35	2464	WMIC.exe
Token: 36	2464	WMIC.exe
Token: SeIncreaseQuotaPrivilege	2464	WMIC.exe
Token: SeSecurityPrivilege	2464	WMIC.exe
Token: SeTakeOwnershipPrivilege	2464	WMIC.exe
Token: SeLoadDriverPrivilege	2464	WMIC.exe
Token: SeSystemProfilePrivilege	2464	WMIC.exe
Token: SeSystemtimePrivilege	2464	WMIC.exe
Token: SeProfSingleProcessPrivilege	2464	WMIC.exe
Token: SeIncBasePriorityPrivilege	2464	WMIC.exe
Token: SeCreatePagefilePrivilege	2464	WMIC.exe
Token: SeBackupPrivilege	2464	WMIC.exe
Token: SeRestorePrivilege	2464	WMIC.exe
Token: SeShutdownPrivilege	2464	WMIC.exe
Token: SeDebugPrivilege	2464	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2464	WMIC.exe
Token: SeRemoteShutdownPrivilege	2464	WMIC.exe
Token: SeUndockPrivilege	2464	WMIC.exe
Token: SeManageVolumePrivilege	2464	WMIC.exe
Token: 33	2464	WMIC.exe
Token: 34	2464	WMIC.exe
Token: 35	2464	WMIC.exe
Token: 36	2464	WMIC.exe
Token: SeDebugPrivilege	552	tasklist.exe
Token: SeDebugPrivilege	4576	powershell.exe
Token: SeIncreaseQuotaPrivilege	4576	powershell.exe
Token: SeSecurityPrivilege	4576	powershell.exe
Token: SeTakeOwnershipPrivilege	4576	powershell.exe
Token: SeLoadDriverPrivilege	4576	powershell.exe
Token: SeSystemProfilePrivilege	4576	powershell.exe
Token: SeSystemtimePrivilege	4576	powershell.exe
Token: SeProfSingleProcessPrivilege	4576	powershell.exe
Token: SeIncBasePriorityPrivilege	4576	powershell.exe
Token: SeCreatePagefilePrivilege	4576	powershell.exe
Token: SeBackupPrivilege	4576	powershell.exe
Token: SeRestorePrivilege	4576	powershell.exe
Token: SeShutdownPrivilege	4576	powershell.exe
Token: SeDebugPrivilege	4576	powershell.exe
Token: SeSystemEnvironmentPrivilege	4576	powershell.exe
Token: SeRemoteShutdownPrivilege	4576	powershell.exe
Token: SeUndockPrivilege	4576	powershell.exe
Token: SeManageVolumePrivilege	4576	powershell.exe
Token: 33	4576	powershell.exe
Token: 34	4576	powershell.exe
Token: 35	4576	powershell.exe

Suspicious use of WriteProcessMemory 41 IoCs

description	pid	Process	procid_target
PID 5512 wrote to memory of 3972	5512	2026-07-09_9f15bdd6f557e272c6e346a608541e0a_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe	88
PID 3972 wrote to memory of 2464	3972	cmd.exe	90
PID 5512 wrote to memory of 4204	5512	2026-07-09_9f15bdd6f557e272c6e346a608541e0a_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe	92
PID 4204 wrote to memory of 552	4204	cmd.exe	94
PID 5512 wrote to memory of 2564	5512	2026-07-09_9f15bdd6f557e272c6e346a608541e0a_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe	95
PID 2564 wrote to memory of 4576	2564	cmd.exe	97
PID 5512 wrote to memory of 2988	5512	2026-07-09_9f15bdd6f557e272c6e346a608541e0a_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe	98
PID 2988 wrote to memory of 5164	2988	cmd.exe	100
PID 5164 wrote to memory of 5476	5164	net.exe	101
PID 5512 wrote to memory of 5064	5512	2026-07-09_9f15bdd6f557e272c6e346a608541e0a_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe	102
PID 5064 wrote to memory of 5568	5064	cmd.exe	104
PID 5512 wrote to memory of 2156	5512	2026-07-09_9f15bdd6f557e272c6e346a608541e0a_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe	105
PID 2156 wrote to memory of 944	2156	cmd.exe	107
PID 5512 wrote to memory of 3480	5512	2026-07-09_9f15bdd6f557e272c6e346a608541e0a_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe	108
PID 3480 wrote to memory of 4380	3480	cmd.exe	110
PID 5512 wrote to memory of 1968	5512	2026-07-09_9f15bdd6f557e272c6e346a608541e0a_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe	111
PID 1968 wrote to memory of 4812	1968	cmd.exe	113
PID 5512 wrote to memory of 1720	5512	2026-07-09_9f15bdd6f557e272c6e346a608541e0a_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe	114
PID 1720 wrote to memory of 4136	1720	cmd.exe	116
PID 5512 wrote to memory of 1744	5512	2026-07-09_9f15bdd6f557e272c6e346a608541e0a_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe	118
PID 1744 wrote to memory of 5508	1744	cmd.exe	120
PID 5512 wrote to memory of 2948	5512	2026-07-09_9f15bdd6f557e272c6e346a608541e0a_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe	121
PID 2948 wrote to memory of 4728	2948	cmd.exe	123
PID 5512 wrote to memory of 3400	5512	2026-07-09_9f15bdd6f557e272c6e346a608541e0a_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe	124
PID 3400 wrote to memory of 2904	3400	cmd.exe	126
PID 5512 wrote to memory of 4920	5512	2026-07-09_9f15bdd6f557e272c6e346a608541e0a_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe	127
PID 4920 wrote to memory of 5296	4920	cmd.exe	129
PID 5512 wrote to memory of 6120	5512	2026-07-09_9f15bdd6f557e272c6e346a608541e0a_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe	130
PID 6120 wrote to memory of 1940	6120	cmd.exe	132
PID 5512 wrote to memory of 5476	5512	2026-07-09_9f15bdd6f557e272c6e346a608541e0a_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe	133
PID 5476 wrote to memory of 5596	5476	cmd.exe	135
PID 5512 wrote to memory of 2412	5512	2026-07-09_9f15bdd6f557e272c6e346a608541e0a_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe	136
PID 2412 wrote to memory of 5980	2412	cmd.exe	138
PID 5512 wrote to memory of 2200	5512	2026-07-09_9f15bdd6f557e272c6e346a608541e0a_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe	139
PID 2200 wrote to memory of 4368	2200	cmd.exe	141
PID 5512 wrote to memory of 2420	5512	2026-07-09_9f15bdd6f557e272c6e346a608541e0a_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe	142
PID 2420 wrote to memory of 1480	2420	cmd.exe	144
PID 5512 wrote to memory of 2124	5512	2026-07-09_9f15bdd6f557e272c6e346a608541e0a_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe	145
PID 2124 wrote to memory of 5240	2124	cmd.exe	147
PID 5512 wrote to memory of 3276	5512	2026-07-09_9f15bdd6f557e272c6e346a608541e0a_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe	148
PID 3276 wrote to memory of 5756	3276	cmd.exe	150

C:\Users\Admin\AppData\Local\Temp\2026-07-09_9f15bdd6f557e272c6e346a608541e0a_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-09_9f15bdd6f557e272c6e346a608541e0a_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5512
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic diskdrive get Model"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3972
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic diskdrive get Model
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2464
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4204
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:552
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -Command "(Get-CimInstance Win32_PortConnector).Count""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2564
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "(Get-CimInstance Win32_PortConnector).Count"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4576
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "net session"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2988
- - C:\Windows\system32\net.exe
    net session
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5164
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:5476
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM SecHealthUI.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5064
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM SecHealthUI.exe
    3⤵
    - Kills process with taskkill
    PID:5568
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -Command "Get-Service -Name WinDefend | Select-Object -ExpandProperty Status""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2156
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Get-Service -Name WinDefend | Select-Object -ExpandProperty Status"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:944
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -Command "$r=Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion'; $os=Get-CimInstance Win32_OperatingSystem; try { $av=Get-CimInstance -Namespace root\SecurityCenter2 -ClassName AntivirusProduct | Select-Object -ExpandProperty displayName } catch { $av = 'Not available' }; '{0}, Version {1}, OS Build {2}.{3} {4} - Antivirus: {5}' -f ($os.Caption -replace 'Microsoft ','').Trim(), $r.DisplayVersion, $r.CurrentBuild, $r.UBR, $os.OSArchitecture, ($av -join ', ')""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3480
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "$r=Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion'; $os=Get-CimInstance Win32_OperatingSystem; try { $av=Get-CimInstance -Namespace root\SecurityCenter2 -ClassName AntivirusProduct | Select-Object -ExpandProperty displayName } catch { $av = 'Not available' }; '{0}, Version {1}, OS Build {2}.{3} {4} - Antivirus: {5}' -f ($os.Caption -replace 'Microsoft ','').Trim(), $r.DisplayVersion, $r.CurrentBuild, $r.UBR, $os.OSArchitecture, ($av -join ', ')"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:4380
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -Command "$r=Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion'; $os=Get-CimInstance Win32_OperatingSystem; try { $av=Get-CimInstance -Namespace root\SecurityCenter2 -ClassName AntivirusProduct | Select-Object -ExpandProperty displayName } catch { $av = 'Not available' }; '{0}, Version {1}, OS Build {2}.{3} {4} - Antivirus: {5}' -f ($os.Caption -replace 'Microsoft ','').Trim(), $r.DisplayVersion, $r.CurrentBuild, $r.UBR, $os.OSArchitecture, ($av -join ', ')""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1968
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "$r=Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion'; $os=Get-CimInstance Win32_OperatingSystem; try { $av=Get-CimInstance -Namespace root\SecurityCenter2 -ClassName AntivirusProduct | Select-Object -ExpandProperty displayName } catch { $av = 'Not available' }; '{0}, Version {1}, OS Build {2}.{3} {4} - Antivirus: {5}' -f ($os.Caption -replace 'Microsoft ','').Trim(), $r.DisplayVersion, $r.CurrentBuild, $r.UBR, $os.OSArchitecture, ($av -join ', ')"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:4812
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -Command "$r=Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion'; $os=Get-CimInstance Win32_OperatingSystem; try { $av=Get-CimInstance -Namespace root\SecurityCenter2 -ClassName AntivirusProduct | Select-Object -ExpandProperty displayName } catch { $av = 'Not available' }; '{0}, Version {1}, OS Build {2}.{3} {4} - Antivirus: {5}' -f ($os.Caption -replace 'Microsoft ','').Trim(), $r.DisplayVersion, $r.CurrentBuild, $r.UBR, $os.OSArchitecture, ($av -join ', ')""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1720
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "$r=Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion'; $os=Get-CimInstance Win32_OperatingSystem; try { $av=Get-CimInstance -Namespace root\SecurityCenter2 -ClassName AntivirusProduct | Select-Object -ExpandProperty displayName } catch { $av = 'Not available' }; '{0}, Version {1}, OS Build {2}.{3} {4} - Antivirus: {5}' -f ($os.Caption -replace 'Microsoft ','').Trim(), $r.DisplayVersion, $r.CurrentBuild, $r.UBR, $os.OSArchitecture, ($av -join ', ')"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:4136
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -Command "$r=Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion'; $os=Get-CimInstance Win32_OperatingSystem; try { $av=Get-CimInstance -Namespace root\SecurityCenter2 -ClassName AntivirusProduct | Select-Object -ExpandProperty displayName } catch { $av = 'Not available' }; '{0}, Version {1}, OS Build {2}.{3} {4} - Antivirus: {5}' -f ($os.Caption -replace 'Microsoft ','').Trim(), $r.DisplayVersion, $r.CurrentBuild, $r.UBR, $os.OSArchitecture, ($av -join ', ')""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1744
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "$r=Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion'; $os=Get-CimInstance Win32_OperatingSystem; try { $av=Get-CimInstance -Namespace root\SecurityCenter2 -ClassName AntivirusProduct | Select-Object -ExpandProperty displayName } catch { $av = 'Not available' }; '{0}, Version {1}, OS Build {2}.{3} {4} - Antivirus: {5}' -f ($os.Caption -replace 'Microsoft ','').Trim(), $r.DisplayVersion, $r.CurrentBuild, $r.UBR, $os.OSArchitecture, ($av -join ', ')"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:5508
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -Command "$r=Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion'; $os=Get-CimInstance Win32_OperatingSystem; try { $av=Get-CimInstance -Namespace root\SecurityCenter2 -ClassName AntivirusProduct | Select-Object -ExpandProperty displayName } catch { $av = 'Not available' }; '{0}, Version {1}, OS Build {2}.{3} {4} - Antivirus: {5}' -f ($os.Caption -replace 'Microsoft ','').Trim(), $r.DisplayVersion, $r.CurrentBuild, $r.UBR, $os.OSArchitecture, ($av -join ', ')""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2948
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "$r=Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion'; $os=Get-CimInstance Win32_OperatingSystem; try { $av=Get-CimInstance -Namespace root\SecurityCenter2 -ClassName AntivirusProduct | Select-Object -ExpandProperty displayName } catch { $av = 'Not available' }; '{0}, Version {1}, OS Build {2}.{3} {4} - Antivirus: {5}' -f ($os.Caption -replace 'Microsoft ','').Trim(), $r.DisplayVersion, $r.CurrentBuild, $r.UBR, $os.OSArchitecture, ($av -join ', ')"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:4728
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -Command "$r=Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion'; $os=Get-CimInstance Win32_OperatingSystem; try { $av=Get-CimInstance -Namespace root\SecurityCenter2 -ClassName AntivirusProduct | Select-Object -ExpandProperty displayName } catch { $av = 'Not available' }; '{0}, Version {1}, OS Build {2}.{3} {4} - Antivirus: {5}' -f ($os.Caption -replace 'Microsoft ','').Trim(), $r.DisplayVersion, $r.CurrentBuild, $r.UBR, $os.OSArchitecture, ($av -join ', ')""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3400
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "$r=Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion'; $os=Get-CimInstance Win32_OperatingSystem; try { $av=Get-CimInstance -Namespace root\SecurityCenter2 -ClassName AntivirusProduct | Select-Object -ExpandProperty displayName } catch { $av = 'Not available' }; '{0}, Version {1}, OS Build {2}.{3} {4} - Antivirus: {5}' -f ($os.Caption -replace 'Microsoft ','').Trim(), $r.DisplayVersion, $r.CurrentBuild, $r.UBR, $os.OSArchitecture, ($av -join ', ')"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:2904
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -Command "$r=Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion'; $os=Get-CimInstance Win32_OperatingSystem; try { $av=Get-CimInstance -Namespace root\SecurityCenter2 -ClassName AntivirusProduct | Select-Object -ExpandProperty displayName } catch { $av = 'Not available' }; '{0}, Version {1}, OS Build {2}.{3} {4} - Antivirus: {5}' -f ($os.Caption -replace 'Microsoft ','').Trim(), $r.DisplayVersion, $r.CurrentBuild, $r.UBR, $os.OSArchitecture, ($av -join ', ')""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4920
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "$r=Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion'; $os=Get-CimInstance Win32_OperatingSystem; try { $av=Get-CimInstance -Namespace root\SecurityCenter2 -ClassName AntivirusProduct | Select-Object -ExpandProperty displayName } catch { $av = 'Not available' }; '{0}, Version {1}, OS Build {2}.{3} {4} - Antivirus: {5}' -f ($os.Caption -replace 'Microsoft ','').Trim(), $r.DisplayVersion, $r.CurrentBuild, $r.UBR, $os.OSArchitecture, ($av -join ', ')"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:5296
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -Command "$r=Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion'; $os=Get-CimInstance Win32_OperatingSystem; try { $av=Get-CimInstance -Namespace root\SecurityCenter2 -ClassName AntivirusProduct | Select-Object -ExpandProperty displayName } catch { $av = 'Not available' }; '{0}, Version {1}, OS Build {2}.{3} {4} - Antivirus: {5}' -f ($os.Caption -replace 'Microsoft ','').Trim(), $r.DisplayVersion, $r.CurrentBuild, $r.UBR, $os.OSArchitecture, ($av -join ', ')""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:6120
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "$r=Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion'; $os=Get-CimInstance Win32_OperatingSystem; try { $av=Get-CimInstance -Namespace root\SecurityCenter2 -ClassName AntivirusProduct | Select-Object -ExpandProperty displayName } catch { $av = 'Not available' }; '{0}, Version {1}, OS Build {2}.{3} {4} - Antivirus: {5}' -f ($os.Caption -replace 'Microsoft ','').Trim(), $r.DisplayVersion, $r.CurrentBuild, $r.UBR, $os.OSArchitecture, ($av -join ', ')"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:1940
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -Command "$r=Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion'; $os=Get-CimInstance Win32_OperatingSystem; try { $av=Get-CimInstance -Namespace root\SecurityCenter2 -ClassName AntivirusProduct | Select-Object -ExpandProperty displayName } catch { $av = 'Not available' }; '{0}, Version {1}, OS Build {2}.{3} {4} - Antivirus: {5}' -f ($os.Caption -replace 'Microsoft ','').Trim(), $r.DisplayVersion, $r.CurrentBuild, $r.UBR, $os.OSArchitecture, ($av -join ', ')""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5476
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "$r=Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion'; $os=Get-CimInstance Win32_OperatingSystem; try { $av=Get-CimInstance -Namespace root\SecurityCenter2 -ClassName AntivirusProduct | Select-Object -ExpandProperty displayName } catch { $av = 'Not available' }; '{0}, Version {1}, OS Build {2}.{3} {4} - Antivirus: {5}' -f ($os.Caption -replace 'Microsoft ','').Trim(), $r.DisplayVersion, $r.CurrentBuild, $r.UBR, $os.OSArchitecture, ($av -join ', ')"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:5596
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -Command "$r=Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion'; $os=Get-CimInstance Win32_OperatingSystem; try { $av=Get-CimInstance -Namespace root\SecurityCenter2 -ClassName AntivirusProduct | Select-Object -ExpandProperty displayName } catch { $av = 'Not available' }; '{0}, Version {1}, OS Build {2}.{3} {4} - Antivirus: {5}' -f ($os.Caption -replace 'Microsoft ','').Trim(), $r.DisplayVersion, $r.CurrentBuild, $r.UBR, $os.OSArchitecture, ($av -join ', ')""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2412
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "$r=Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion'; $os=Get-CimInstance Win32_OperatingSystem; try { $av=Get-CimInstance -Namespace root\SecurityCenter2 -ClassName AntivirusProduct | Select-Object -ExpandProperty displayName } catch { $av = 'Not available' }; '{0}, Version {1}, OS Build {2}.{3} {4} - Antivirus: {5}' -f ($os.Caption -replace 'Microsoft ','').Trim(), $r.DisplayVersion, $r.CurrentBuild, $r.UBR, $os.OSArchitecture, ($av -join ', ')"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:5980
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -Command "$r=Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion'; $os=Get-CimInstance Win32_OperatingSystem; try { $av=Get-CimInstance -Namespace root\SecurityCenter2 -ClassName AntivirusProduct | Select-Object -ExpandProperty displayName } catch { $av = 'Not available' }; '{0}, Version {1}, OS Build {2}.{3} {4} - Antivirus: {5}' -f ($os.Caption -replace 'Microsoft ','').Trim(), $r.DisplayVersion, $r.CurrentBuild, $r.UBR, $os.OSArchitecture, ($av -join ', ')""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2200
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "$r=Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion'; $os=Get-CimInstance Win32_OperatingSystem; try { $av=Get-CimInstance -Namespace root\SecurityCenter2 -ClassName AntivirusProduct | Select-Object -ExpandProperty displayName } catch { $av = 'Not available' }; '{0}, Version {1}, OS Build {2}.{3} {4} - Antivirus: {5}' -f ($os.Caption -replace 'Microsoft ','').Trim(), $r.DisplayVersion, $r.CurrentBuild, $r.UBR, $os.OSArchitecture, ($av -join ', ')"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:4368
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -Command "$r=Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion'; $os=Get-CimInstance Win32_OperatingSystem; try { $av=Get-CimInstance -Namespace root\SecurityCenter2 -ClassName AntivirusProduct | Select-Object -ExpandProperty displayName } catch { $av = 'Not available' }; '{0}, Version {1}, OS Build {2}.{3} {4} - Antivirus: {5}' -f ($os.Caption -replace 'Microsoft ','').Trim(), $r.DisplayVersion, $r.CurrentBuild, $r.UBR, $os.OSArchitecture, ($av -join ', ')""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2420
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "$r=Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion'; $os=Get-CimInstance Win32_OperatingSystem; try { $av=Get-CimInstance -Namespace root\SecurityCenter2 -ClassName AntivirusProduct | Select-Object -ExpandProperty displayName } catch { $av = 'Not available' }; '{0}, Version {1}, OS Build {2}.{3} {4} - Antivirus: {5}' -f ($os.Caption -replace 'Microsoft ','').Trim(), $r.DisplayVersion, $r.CurrentBuild, $r.UBR, $os.OSArchitecture, ($av -join ', ')"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:1480
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -Command "$r=Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion'; $os=Get-CimInstance Win32_OperatingSystem; try { $av=Get-CimInstance -Namespace root\SecurityCenter2 -ClassName AntivirusProduct | Select-Object -ExpandProperty displayName } catch { $av = 'Not available' }; '{0}, Version {1}, OS Build {2}.{3} {4} - Antivirus: {5}' -f ($os.Caption -replace 'Microsoft ','').Trim(), $r.DisplayVersion, $r.CurrentBuild, $r.UBR, $os.OSArchitecture, ($av -join ', ')""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2124
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "$r=Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion'; $os=Get-CimInstance Win32_OperatingSystem; try { $av=Get-CimInstance -Namespace root\SecurityCenter2 -ClassName AntivirusProduct | Select-Object -ExpandProperty displayName } catch { $av = 'Not available' }; '{0}, Version {1}, OS Build {2}.{3} {4} - Antivirus: {5}' -f ($os.Caption -replace 'Microsoft ','').Trim(), $r.DisplayVersion, $r.CurrentBuild, $r.UBR, $os.OSArchitecture, ($av -join ', ')"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:5240
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -Command "$r=Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion'; $os=Get-CimInstance Win32_OperatingSystem; try { $av=Get-CimInstance -Namespace root\SecurityCenter2 -ClassName AntivirusProduct | Select-Object -ExpandProperty displayName } catch { $av = 'Not available' }; '{0}, Version {1}, OS Build {2}.{3} {4} - Antivirus: {5}' -f ($os.Caption -replace 'Microsoft ','').Trim(), $r.DisplayVersion, $r.CurrentBuild, $r.UBR, $os.OSArchitecture, ($av -join ', ')""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3276
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "$r=Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion'; $os=Get-CimInstance Win32_OperatingSystem; try { $av=Get-CimInstance -Namespace root\SecurityCenter2 -ClassName AntivirusProduct | Select-Object -ExpandProperty displayName } catch { $av = 'Not available' }; '{0}, Version {1}, OS Build {2}.{3} {4} - Antivirus: {5}' -f ($os.Caption -replace 'Microsoft ','').Trim(), $r.DisplayVersion, $r.CurrentBuild, $r.UBR, $os.OSArchitecture, ($av -join ', ')"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:5756

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Process Discovery

T1057

Lateral Movement

Collection

Command and Control

Exfiltration

Impact