2fa4f317ec84a5cc33c2c96bde803d419a5c90592ea30f27ff20a2f984fff38f

Resubmissions

20/07/2026, 23:28

260720-3f9xbagz3q

20/07/2026, 22:40

260720-2lt8dah16s8

Analysis

max time kernel
149s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
20/07/2026, 22:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Odyssey.exe
Size 191.9MB
Sample260720-2lt8dah16s
SHA256 2fa4f317ec84a5cc33c2c96bde803d419a5c90592ea30f27ff20a2f984fff38f
MD5 b1996c0b12dff00a395d7ad967b3fea3
SHA1 edea600637bb5ea2445f73abcea276483627084a
SHA512 5d5cb55fbe141528e9b99c10983cc9ef17bcf1c860e4f6bef20e85862850583d3da1a0858d78263cfdce86d33d5075bdde3e3f41e1d4dab4c7a0188925c96914
SSDEEP 1572864:uhqI5OOengTDlkGf97McvHp/i8mhllqtSIOr3alJsxjEP6H5HlTShW62Su+709x5:TOMMpBKvPTJJlf
TLSH
T164A88C03F39A50D9E01DD1759B479633EAB1B88A4324A2DF2B5407912F77EE86B3DB10
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 18 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
3444	powershell.exe
216	powershell.exe
4808	powershell.exe
364	powershell.exe
1764	powershell.exe
3676	powershell.exe
2204	powershell.exe
4392	powershell.exe
3380	powershell.exe
3956	powershell.exe
4508	powershell.exe
1864	powershell.exe
2352	powershell.exe
3860	powershell.exe
4044	powershell.exe
3292	powershell.exe
3960	powershell.exe
1804	powershell.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\Control Panel\International\Geo\Nation	Odyssey.exe

Hide Artifacts: Ignore Process Interrupts 1 TTPs 1 IoCs

Command interpreters often include specific commands/flags that ignore errors and other hangups.

defense_evasion

Ignore Process Interrupts

T1564.011

pid	Process
1804	powershell.exe

Executes a command shell one-liner 1 TTPs 5 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
384	cmd.exe
2232	cmd.exe
3572	cmd.exe
1168	cmd.exe
1092	cmd.exe

Kills process with taskkill 2 IoCs

defense_evasion

pid	Process
5632	taskkill.exe
2776	taskkill.exe

Suspicious behavior: EnumeratesProcesses 59 IoCs

pid	Process
2352	powershell.exe
2352	powershell.exe
3444	powershell.exe
3444	powershell.exe
364	powershell.exe
364	powershell.exe
1864	powershell.exe
1864	powershell.exe
4044	powershell.exe
3380	powershell.exe
4044	powershell.exe
3380	powershell.exe
1764	powershell.exe
1764	powershell.exe
1804	powershell.exe
1804	powershell.exe
3960	powershell.exe
3960	powershell.exe
2204	powershell.exe
2204	powershell.exe
3676	powershell.exe
3676	powershell.exe
216	powershell.exe
216	powershell.exe
4508	powershell.exe
4508	powershell.exe
3956	powershell.exe
3956	powershell.exe
4392	powershell.exe
4808	powershell.exe
4392	powershell.exe
4808	powershell.exe
3860	powershell.exe
3860	powershell.exe
3292	powershell.exe
3292	powershell.exe
3292	powershell.exe
2352	powershell.exe
2352	powershell.exe
4044	powershell.exe
364	powershell.exe
364	powershell.exe
3676	powershell.exe
4808	powershell.exe
3444	powershell.exe
3444	powershell.exe
216	powershell.exe
4508	powershell.exe
4392	powershell.exe
1864	powershell.exe
1864	powershell.exe
1764	powershell.exe
1804	powershell.exe
3380	powershell.exe
3380	powershell.exe
3960	powershell.exe
3956	powershell.exe
2204	powershell.exe
3860	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2776	taskkill.exe
Token: SeShutdownPrivilege	3704	Odyssey.exe
Token: SeCreatePagefilePrivilege	3704	Odyssey.exe
Token: SeDebugPrivilege	2352	powershell.exe
Token: SeDebugPrivilege	3444	powershell.exe
Token: SeDebugPrivilege	364	powershell.exe
Token: SeDebugPrivilege	1864	powershell.exe
Token: SeDebugPrivilege	4044	powershell.exe
Token: SeDebugPrivilege	3380	powershell.exe
Token: SeDebugPrivilege	1764	powershell.exe
Token: SeDebugPrivilege	1804	powershell.exe
Token: SeDebugPrivilege	3960	powershell.exe
Token: SeDebugPrivilege	216	powershell.exe
Token: SeDebugPrivilege	4508	powershell.exe
Token: SeDebugPrivilege	2204	powershell.exe
Token: SeDebugPrivilege	3676	powershell.exe
Token: SeDebugPrivilege	3292	powershell.exe
Token: SeDebugPrivilege	3956	powershell.exe
Token: SeDebugPrivilege	4808	powershell.exe
Token: SeDebugPrivilege	4392	powershell.exe
Token: SeDebugPrivilege	3860	powershell.exe
Token: SeShutdownPrivilege	3704	Odyssey.exe
Token: SeCreatePagefilePrivilege	3704	Odyssey.exe
Token: SeDebugPrivilege	5632	taskkill.exe
Token: SeShutdownPrivilege	3704	Odyssey.exe
Token: SeCreatePagefilePrivilege	3704	Odyssey.exe
Token: SeIncreaseQuotaPrivilege	3292	powershell.exe
Token: SeSecurityPrivilege	3292	powershell.exe
Token: SeTakeOwnershipPrivilege	3292	powershell.exe
Token: SeLoadDriverPrivilege	3292	powershell.exe
Token: SeSystemProfilePrivilege	3292	powershell.exe
Token: SeSystemtimePrivilege	3292	powershell.exe
Token: SeProfSingleProcessPrivilege	3292	powershell.exe
Token: SeIncBasePriorityPrivilege	3292	powershell.exe
Token: SeCreatePagefilePrivilege	3292	powershell.exe
Token: SeBackupPrivilege	3292	powershell.exe
Token: SeRestorePrivilege	3292	powershell.exe
Token: SeShutdownPrivilege	3292	powershell.exe
Token: SeDebugPrivilege	3292	powershell.exe
Token: SeSystemEnvironmentPrivilege	3292	powershell.exe
Token: SeRemoteShutdownPrivilege	3292	powershell.exe
Token: SeUndockPrivilege	3292	powershell.exe
Token: SeManageVolumePrivilege	3292	powershell.exe
Token: 33	3292	powershell.exe
Token: 34	3292	powershell.exe
Token: 35	3292	powershell.exe
Token: 36	3292	powershell.exe
Token: SeIncreaseQuotaPrivilege	2352	powershell.exe
Token: SeSecurityPrivilege	2352	powershell.exe
Token: SeTakeOwnershipPrivilege	2352	powershell.exe
Token: SeLoadDriverPrivilege	2352	powershell.exe
Token: SeSystemProfilePrivilege	2352	powershell.exe
Token: SeSystemtimePrivilege	2352	powershell.exe
Token: SeProfSingleProcessPrivilege	2352	powershell.exe
Token: SeIncBasePriorityPrivilege	2352	powershell.exe
Token: SeCreatePagefilePrivilege	2352	powershell.exe
Token: SeBackupPrivilege	2352	powershell.exe
Token: SeRestorePrivilege	2352	powershell.exe
Token: SeShutdownPrivilege	2352	powershell.exe
Token: SeDebugPrivilege	2352	powershell.exe
Token: SeSystemEnvironmentPrivilege	2352	powershell.exe
Token: SeRemoteShutdownPrivilege	2352	powershell.exe
Token: SeUndockPrivilege	2352	powershell.exe
Token: SeManageVolumePrivilege	2352	powershell.exe

Suspicious use of WriteProcessMemory 31 IoCs

description	pid	Process	procid_target
PID 3704 wrote to memory of 384	3704	Odyssey.exe	91
PID 384 wrote to memory of 4216	384	cmd.exe	93
PID 3704 wrote to memory of 2232	3704	Odyssey.exe	94
PID 3704 wrote to memory of 3572	3704	Odyssey.exe	96
PID 2232 wrote to memory of 2776	2232	cmd.exe	98
PID 3572 wrote to memory of 2364	3572	cmd.exe	99
PID 3704 wrote to memory of 1168	3704	Odyssey.exe	101
PID 3704 wrote to memory of 3860	3704	Odyssey.exe	104
PID 3704 wrote to memory of 4044	3704	Odyssey.exe	105
PID 3704 wrote to memory of 3444	3704	Odyssey.exe	106
PID 3704 wrote to memory of 2352	3704	Odyssey.exe	107
PID 3704 wrote to memory of 3380	3704	Odyssey.exe	108
PID 3704 wrote to memory of 1764	3704	Odyssey.exe	110
PID 3704 wrote to memory of 364	3704	Odyssey.exe	111
PID 3704 wrote to memory of 1864	3704	Odyssey.exe	112
PID 3704 wrote to memory of 1804	3704	Odyssey.exe	114
PID 3704 wrote to memory of 4508	3704	Odyssey.exe	115
PID 3704 wrote to memory of 3960	3704	Odyssey.exe	116
PID 3704 wrote to memory of 4392	3704	Odyssey.exe	117
PID 3704 wrote to memory of 3292	3704	Odyssey.exe	118
PID 3704 wrote to memory of 4808	3704	Odyssey.exe	119
PID 3704 wrote to memory of 3956	3704	Odyssey.exe	120
PID 3704 wrote to memory of 216	3704	Odyssey.exe	121
PID 3704 wrote to memory of 2204	3704	Odyssey.exe	126
PID 3704 wrote to memory of 3676	3704	Odyssey.exe	127
PID 3704 wrote to memory of 2668	3704	Odyssey.exe	139
PID 3704 wrote to memory of 2668	3704	Odyssey.exe	139
PID 3704 wrote to memory of 1092	3704	Odyssey.exe	140
PID 3704 wrote to memory of 876	3704	Odyssey.exe	141
PID 1092 wrote to memory of 5632	1092	cmd.exe	144
PID 3676 wrote to memory of 5492	3676	powershell.exe	145

C:\Users\Admin\AppData\Local\Temp\Odyssey.exe
"C:\Users\Admin\AppData\Local\Temp\Odyssey.exe"
1⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3704
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "chcp"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:384
- - C:\Windows\system32\chcp.com
    chcp
    3⤵
    PID:4216
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /T /IM "watcher.exe""
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2232
- - C:\Windows\system32\taskkill.exe
    taskkill /F /T /IM "watcher.exe"
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2776
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "WHERE smartctl 2>nul"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3572
- - C:\Windows\system32\where.exe
    WHERE smartctl
    3⤵
    PID:2364
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "echo %COMPUTERNAME%.%USERDNSDOMAIN%"
  2⤵
  - Executes a command shell one-liner
  PID:1168
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "Get-CimInstance Win32_DiskDrive | select Caption,Size,Status,PNPDeviceId,DeviceId,BytesPerSector,TotalCylinders,TotalHeads,TotalSectors,TotalTracks,TracksPerCylinder,SectorsPerTrack,FirmwareRevision,SerialNumber,InterfaceType | fl"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3860
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "Get-PhysicalDisk | select BusType,MediaType,FriendlyName,Model,SerialNumber,Size | fl"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4044
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "Get-CimInstance Win32_PageFileUsage | Select AllocatedBaseSize, CurrentUsage"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3444
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "Get-CimInstance Win32_baseboard | select Model,Manufacturer,Product,Version,SerialNumber,PartNumber,SKU | fl"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2352
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "Get-CimInstance Win32_physicalmemoryarray | select MaxCapacityEx, MemoryDevices | fl"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3380
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "Get-CimInstance Win32_bios | select Description,Version,Manufacturer,@{n=\"ReleaseDate\";e={$_.ReleaseDate.ToString(\"yyyy-MM-dd\")}},BuildNumber,SerialNumber,SMBIOSBIOSVersion | fl"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1764
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "Get-CimInstance Win32_PhysicalMemory | select DataWidth,TotalWidth,Capacity,BankLabel,MemoryType,SMBIOSMemoryType,ConfiguredClockSpeed,Speed,FormFactor,Manufacturer,PartNumber,SerialNumber,ConfiguredVoltage,MinVoltage,MaxVoltage,Tag | fl"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:364
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "Get-CimInstance win32_VideoController | fl *"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1864
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "gp \"HKLM:\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\*\" -ErrorAction SilentlyContinue | where MatchingDeviceId $null -NE | select MatchingDeviceId,HardwareInformation.qwMemorySize | fl"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Hide Artifacts: Ignore Process Interrupts
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1804
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "Get-CimInstance win32_desktopmonitor | fl *"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4508
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "Get-CimInstance -Namespace root\wmi -ClassName WmiMonitorBasicDisplayParams | fl"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3960
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "Add-Type -AssemblyName System.Windows.Forms; [System.Windows.Forms.Screen]::AllScreens"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4392
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "Get-CimInstance -Namespace root\wmi -ClassName WmiMonitorConnectionParams | fl"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3292
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "gwmi WmiMonitorID -Namespace root\wmi | ForEach-Object {(($_.ManufacturerName -notmatch 0 | foreach {[char]$_}) -join \"\") + \"|\" + (($_.ProductCodeID -notmatch 0 | foreach {[char]$_}) -join \"\") + \"|\" + (($_.UserFriendlyName -notmatch 0 | foreach {[char]$_}) -join \"\") + \"|\" + (($_.SerialNumberID -notmatch 0 | foreach {[char]$_}) -join \"\") + \"|\" + $_.InstanceName}"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4808
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "Get-CimInstance Win32_OperatingSystem | select Caption,SerialNumber,BuildNumber,ServicePackMajorVersion,ServicePackMinorVersion | fl"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3956
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "(Get-CimInstance Win32_ComputerSystem).HypervisorPresent"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:216
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "Add-Type -AssemblyName System.Windows.Forms; [System.Windows.Forms.SystemInformation]::TerminalServerSession"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2204
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "reg query \"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\" /v DisplayVersion"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3676
- - C:\Windows\system32\reg.exe
    "C:\Windows\system32\reg.exe" query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion" /v DisplayVersion
    3⤵
    PID:5492
- C:\Users\Admin\AppData\Local\Temp\Odyssey.exe
  "C:\Users\Admin\AppData\Local\Temp\Odyssey.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\Odyssey" --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=2488,i,15051045664918019812,7918261634085157291,262144 --enable-features=PdfUseShowSaveFilePicker --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit --variations-seed-version --mojo-platform-channel-handle=2484 /prefetch:2
  2⤵
  PID:2668
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /T /IM "mitmdump.exe""
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1092
- - C:\Windows\system32\taskkill.exe
    taskkill /F /T /IM "mitmdump.exe"
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5632
- C:\Users\Admin\AppData\Local\Temp\Odyssey.exe
  "C:\Users\Admin\AppData\Local\Temp\Odyssey.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\Odyssey" --field-trial-handle=2488,i,15051045664918019812,7918261634085157291,262144 --enable-features=PdfUseShowSaveFilePicker --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit --variations-seed-version --mojo-platform-channel-handle=2672 /prefetch:3
  2⤵
  PID:876

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Ignore Process Interrupts

T1564.011

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...