1e6dd9cd5b41f23ab79fcccfc27a6abb4bd794f5f8a8377fc87d1e29f1a26e50

Analysis

user interaction
yes
max time kernel
49s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
23/07/2026, 22:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
exodus.exe
Size 9.7MB
Sample260723-19dd4ayajd
SHA256 1e6dd9cd5b41f23ab79fcccfc27a6abb4bd794f5f8a8377fc87d1e29f1a26e50
MD5 2e605c90e5af342b5a6a92350372abe7
SHA1 c841dc0d3b56600e11c5f1f4954388eceea0d941
SHA512 3626634dbe14b7fe2206626f43ed88fa247445fba18347d13ff9689d532f3a655dd664b25f408987e90008a447b71a80500e9438759198476b71f1362339f901
SSDEEP 196608:vnnhcd3wxjNEpXEpXnH2ph1iut1/1QpL0uQg+HCMPWh+WtK7voKgpVFBZ:/hA6SpXEAphVtrQSg+HzC+GK7vFgtB
TLSH
T17BA6339C63E015FAF8B7413D99A1D43192B279812F13C2FB07E14E1A1E3B6E54E386E5
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 54 IoCs

Run Powershell to get system information as a root user.

execution

PowerShell

T1059.001

pid	Process
1748	powershell.exe
5468	powershell.exe
4376	powershell.exe
3976	powershell.exe
5744	powershell.exe
3712	powershell.exe
5624	powershell.exe
4308	powershell.exe
5052	powershell.exe
4656	powershell.exe
400	powershell.exe
6140	powershell.exe
1548	powershell.exe
5212	powershell.exe
5188	powershell.exe
4300	powershell.exe
2424	powershell.exe
5748	powershell.exe
904	powershell.exe
1824	powershell.exe
1272	powershell.exe
3372	powershell.exe
5052	powershell.exe
1604	powershell.exe
2616	powershell.exe
3376	powershell.exe
4736	powershell.exe
252	powershell.exe
4280	powershell.exe
2080	powershell.exe
2072	powershell.exe
5752	powershell.exe
4204	powershell.exe
2352	powershell.exe
4532	powershell.exe
1156	powershell.exe
2140	powershell.exe
3408	powershell.exe
6028	powershell.exe
5836	powershell.exe
6044	powershell.exe
1760	powershell.exe
5628	powershell.exe
4512	powershell.exe
4376	powershell.exe
1944	powershell.exe
1480	powershell.exe
2936	powershell.exe
1556	powershell.exe
3292	powershell.exe
4836	powershell.exe
3416	powershell.exe
4768	powershell.exe
968	powershell.exe

Loads dropped DLL 17 IoCs

pid	Process
4960	exodus.exe
4960	exodus.exe
4960	exodus.exe
4960	exodus.exe
4960	exodus.exe
4960	exodus.exe
4960	exodus.exe
4960	exodus.exe
4960	exodus.exe
4960	exodus.exe
4960	exodus.exe
4960	exodus.exe
4960	exodus.exe
4960	exodus.exe
4960	exodus.exe
4960	exodus.exe
4960	exodus.exe

Contacts third-party web service commonly abused for C2 1 TTPs 3 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
16	discord.com
28	discord.com
29	discord.com

Looks up external IP address via web service 3 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
1	api.ipify.org
7	api.ipify.org
16	ip-api.com

Hide Artifacts: Ignore Process Interrupts 1 TTPs 13 IoCs

Command interpreters often include specific commands/flags that ignore errors and other hangups.

defense_evasion

Ignore Process Interrupts

T1564.011

pid	Process
968	powershell.exe
3536	powershell.exe
1940	powershell.exe
5828	powershell.exe
5560	powershell.exe
5588	powershell.exe
4696	powershell.exe
4428	powershell.exe
4676	powershell.exe
4876	powershell.exe
2068	powershell.exe
1488	powershell.exe
4524	powershell.exe

Executes a command shell one-liner 1 TTPs 16 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4592	cmd.exe
1292	cmd.exe
5608	cmd.exe
5820	cmd.exe
6084	cmd.exe
2416	cmd.exe
5760	cmd.exe
3748	cmd.exe
4224	cmd.exe
1764	cmd.exe
1492	cmd.exe
1844	cmd.exe
2868	cmd.exe
5404	cmd.exe
2012	cmd.exe
5240	cmd.exe

System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 2 IoCs

Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

discovery

Wi-Fi Discovery

T1016.002

pid	Process
1156	powershell.exe
4196	netsh.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	taskmgr.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2616	powershell.exe
2616	powershell.exe
4280	powershell.exe
4280	powershell.exe
2080	powershell.exe
2080	powershell.exe
3408	powershell.exe
3408	powershell.exe
3976	powershell.exe
3976	powershell.exe
2424	powershell.exe
2424	powershell.exe
2072	powershell.exe
2072	powershell.exe
6028	powershell.exe
6028	powershell.exe
5752	powershell.exe
5752	powershell.exe
3380	WMIC.exe
3380	WMIC.exe
3380	WMIC.exe
3380	WMIC.exe
5164	WMIC.exe
5164	WMIC.exe
5164	WMIC.exe
5164	WMIC.exe
4424	WMIC.exe
4424	WMIC.exe
4424	WMIC.exe
4424	WMIC.exe
3564	WMIC.exe
3564	WMIC.exe
3564	WMIC.exe
3564	WMIC.exe
2148	WMIC.exe
2148	WMIC.exe
2148	WMIC.exe
2148	WMIC.exe
904	WMIC.exe
904	WMIC.exe
904	WMIC.exe
904	WMIC.exe
4656	powershell.exe
4656	powershell.exe
5320	WMIC.exe
5320	WMIC.exe
5320	WMIC.exe
5320	WMIC.exe
4248	WMIC.exe
4248	WMIC.exe
4248	WMIC.exe
4248	WMIC.exe
2740	WMIC.exe
2740	WMIC.exe
2740	WMIC.exe
2740	WMIC.exe
4912	WMIC.exe
4912	WMIC.exe
4912	WMIC.exe
4912	WMIC.exe
3984	WMIC.exe
3984	WMIC.exe
3984	WMIC.exe
3984	WMIC.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2616	powershell.exe
Token: SeIncreaseQuotaPrivilege	2616	powershell.exe
Token: SeSecurityPrivilege	2616	powershell.exe
Token: SeTakeOwnershipPrivilege	2616	powershell.exe
Token: SeLoadDriverPrivilege	2616	powershell.exe
Token: SeSystemProfilePrivilege	2616	powershell.exe
Token: SeSystemtimePrivilege	2616	powershell.exe
Token: SeProfSingleProcessPrivilege	2616	powershell.exe
Token: SeIncBasePriorityPrivilege	2616	powershell.exe
Token: SeCreatePagefilePrivilege	2616	powershell.exe
Token: SeBackupPrivilege	2616	powershell.exe
Token: SeRestorePrivilege	2616	powershell.exe
Token: SeShutdownPrivilege	2616	powershell.exe
Token: SeDebugPrivilege	2616	powershell.exe
Token: SeSystemEnvironmentPrivilege	2616	powershell.exe
Token: SeRemoteShutdownPrivilege	2616	powershell.exe
Token: SeUndockPrivilege	2616	powershell.exe
Token: SeManageVolumePrivilege	2616	powershell.exe
Token: 33	2616	powershell.exe
Token: 34	2616	powershell.exe
Token: 35	2616	powershell.exe
Token: 36	2616	powershell.exe
Token: SeDebugPrivilege	4280	powershell.exe
Token: SeIncreaseQuotaPrivilege	4280	powershell.exe
Token: SeSecurityPrivilege	4280	powershell.exe
Token: SeTakeOwnershipPrivilege	4280	powershell.exe
Token: SeLoadDriverPrivilege	4280	powershell.exe
Token: SeSystemProfilePrivilege	4280	powershell.exe
Token: SeSystemtimePrivilege	4280	powershell.exe
Token: SeProfSingleProcessPrivilege	4280	powershell.exe
Token: SeIncBasePriorityPrivilege	4280	powershell.exe
Token: SeCreatePagefilePrivilege	4280	powershell.exe
Token: SeBackupPrivilege	4280	powershell.exe
Token: SeRestorePrivilege	4280	powershell.exe
Token: SeShutdownPrivilege	4280	powershell.exe
Token: SeDebugPrivilege	4280	powershell.exe
Token: SeSystemEnvironmentPrivilege	4280	powershell.exe
Token: SeRemoteShutdownPrivilege	4280	powershell.exe
Token: SeUndockPrivilege	4280	powershell.exe
Token: SeManageVolumePrivilege	4280	powershell.exe
Token: 33	4280	powershell.exe
Token: 34	4280	powershell.exe
Token: 35	4280	powershell.exe
Token: 36	4280	powershell.exe
Token: SeDebugPrivilege	2080	powershell.exe
Token: SeIncreaseQuotaPrivilege	2080	powershell.exe
Token: SeSecurityPrivilege	2080	powershell.exe
Token: SeTakeOwnershipPrivilege	2080	powershell.exe
Token: SeLoadDriverPrivilege	2080	powershell.exe
Token: SeSystemProfilePrivilege	2080	powershell.exe
Token: SeSystemtimePrivilege	2080	powershell.exe
Token: SeProfSingleProcessPrivilege	2080	powershell.exe
Token: SeIncBasePriorityPrivilege	2080	powershell.exe
Token: SeCreatePagefilePrivilege	2080	powershell.exe
Token: SeBackupPrivilege	2080	powershell.exe
Token: SeRestorePrivilege	2080	powershell.exe
Token: SeShutdownPrivilege	2080	powershell.exe
Token: SeDebugPrivilege	2080	powershell.exe
Token: SeSystemEnvironmentPrivilege	2080	powershell.exe
Token: SeRemoteShutdownPrivilege	2080	powershell.exe
Token: SeUndockPrivilege	2080	powershell.exe
Token: SeManageVolumePrivilege	2080	powershell.exe
Token: 33	2080	powershell.exe
Token: 34	2080	powershell.exe

Suspicious use of FindShellTrayWindow 21 IoCs

pid	Process
5156	taskmgr.exe
5156	taskmgr.exe
5156	taskmgr.exe
5156	taskmgr.exe
5156	taskmgr.exe
5156	taskmgr.exe
5156	taskmgr.exe
5156	taskmgr.exe
5156	taskmgr.exe
5156	taskmgr.exe
5156	taskmgr.exe
5156	taskmgr.exe
5156	taskmgr.exe
5156	taskmgr.exe
5156	taskmgr.exe
5156	taskmgr.exe
5156	taskmgr.exe
5156	taskmgr.exe
5156	taskmgr.exe
5156	taskmgr.exe
5156	taskmgr.exe

Suspicious use of SendNotifyMessage 21 IoCs

pid	Process
5156	taskmgr.exe
5156	taskmgr.exe
5156	taskmgr.exe
5156	taskmgr.exe
5156	taskmgr.exe
5156	taskmgr.exe
5156	taskmgr.exe
5156	taskmgr.exe
5156	taskmgr.exe
5156	taskmgr.exe
5156	taskmgr.exe
5156	taskmgr.exe
5156	taskmgr.exe
5156	taskmgr.exe
5156	taskmgr.exe
5156	taskmgr.exe
5156	taskmgr.exe
5156	taskmgr.exe
5156	taskmgr.exe
5156	taskmgr.exe
5156	taskmgr.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5156	taskmgr.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2064 wrote to memory of 4960	2064	exodus.exe	90
PID 4960 wrote to memory of 2616	4960	exodus.exe	92
PID 4960 wrote to memory of 4280	4960	exodus.exe	93
PID 4960 wrote to memory of 2080	4960	exodus.exe	94
PID 4960 wrote to memory of 3408	4960	exodus.exe	95
PID 4960 wrote to memory of 3976	4960	exodus.exe	96
PID 4960 wrote to memory of 2424	4960	exodus.exe	97
PID 4960 wrote to memory of 2072	4960	exodus.exe	98
PID 4960 wrote to memory of 6028	4960	exodus.exe	99
PID 4960 wrote to memory of 5752	4960	exodus.exe	100
PID 4960 wrote to memory of 2416	4960	exodus.exe	101
PID 2416 wrote to memory of 3380	2416	cmd.exe	102
PID 4960 wrote to memory of 5760	4960	exodus.exe	103
PID 5760 wrote to memory of 5164	5760	cmd.exe	104
PID 4960 wrote to memory of 4592	4960	exodus.exe	105
PID 4592 wrote to memory of 4424	4592	cmd.exe	106
PID 4960 wrote to memory of 1292	4960	exodus.exe	107
PID 1292 wrote to memory of 3564	1292	cmd.exe	108
PID 4960 wrote to memory of 3748	4960	exodus.exe	109
PID 3748 wrote to memory of 2148	3748	cmd.exe	110
PID 4960 wrote to memory of 1844	4960	exodus.exe	111
PID 1844 wrote to memory of 904	1844	cmd.exe	145
PID 4960 wrote to memory of 4656	4960	exodus.exe	113
PID 4960 wrote to memory of 5608	4960	exodus.exe	114
PID 5608 wrote to memory of 5320	5608	cmd.exe	115
PID 4960 wrote to memory of 2868	4960	exodus.exe	116
PID 2868 wrote to memory of 4248	2868	cmd.exe	117
PID 4960 wrote to memory of 4224	4960	exodus.exe	118
PID 4224 wrote to memory of 2740	4224	cmd.exe	119
PID 4960 wrote to memory of 5404	4960	exodus.exe	120
PID 5404 wrote to memory of 4912	5404	cmd.exe	121
PID 4960 wrote to memory of 1764	4960	exodus.exe	122
PID 1764 wrote to memory of 3984	1764	cmd.exe	123
PID 4960 wrote to memory of 2012	4960	exodus.exe	124
PID 2012 wrote to memory of 5888	2012	cmd.exe	125
PID 4960 wrote to memory of 5820	4960	exodus.exe	126
PID 5820 wrote to memory of 5864	5820	cmd.exe	127
PID 4960 wrote to memory of 6084	4960	exodus.exe	128
PID 6084 wrote to memory of 1960	6084	cmd.exe	129
PID 4960 wrote to memory of 1492	4960	exodus.exe	130
PID 1492 wrote to memory of 5972	1492	cmd.exe	131
PID 4960 wrote to memory of 5240	4960	exodus.exe	132
PID 5240 wrote to memory of 4568	5240	cmd.exe	133
PID 4960 wrote to memory of 4512	4960	exodus.exe	134
PID 4960 wrote to memory of 400	4960	exodus.exe	152
PID 4960 wrote to memory of 6140	4960	exodus.exe	136
PID 4960 wrote to memory of 4836	4960	exodus.exe	137
PID 4960 wrote to memory of 5748	4960	exodus.exe	138
PID 4960 wrote to memory of 5744	4960	exodus.exe	139
PID 4960 wrote to memory of 3416	4960	exodus.exe	140
PID 4960 wrote to memory of 1548	4960	exodus.exe	141
PID 4960 wrote to memory of 4376	4960	exodus.exe	142
PID 4960 wrote to memory of 1944	4960	exodus.exe	143
PID 4960 wrote to memory of 4204	4960	exodus.exe	144
PID 4960 wrote to memory of 904	4960	exodus.exe	145
PID 4960 wrote to memory of 2352	4960	exodus.exe	146
PID 4960 wrote to memory of 5836	4960	exodus.exe	147
PID 4960 wrote to memory of 3376	4960	exodus.exe	148
PID 4960 wrote to memory of 5212	4960	exodus.exe	149
PID 4960 wrote to memory of 2140	4960	exodus.exe	150
PID 4960 wrote to memory of 5052	4960	exodus.exe	168
PID 4960 wrote to memory of 1480	4960	exodus.exe	155
PID 4960 wrote to memory of 2936	4960	exodus.exe	157
PID 4960 wrote to memory of 5188	4960	exodus.exe	158

C:\Users\Admin\AppData\Local\Temp\exodus.exe
"C:\Users\Admin\AppData\Local\Temp\exodus.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2064
- C:\Users\Admin\AppData\Local\Temp\exodus.exe
  "C:\Users\Admin\AppData\Local\Temp\exodus.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:4960
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "(Get-CimInstance Win32_OperatingSystem).Caption"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2616
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "(Get-CimInstance Win32_OperatingSystem).BuildNumber"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4280
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "(Get-CimInstance Win32_OperatingSystem).InstallDate.ToString('yyyy-MM-dd HH:mm:ss')"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2080
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "(Get-CimInstance Win32_OperatingSystem).LastBootUpTime.ToString('yyyy-MM-dd HH:mm:ss')"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:3408
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "$boot = (Get-CimInstance Win32_OperatingSystem).LastBootUpTime; $span = (Get-Date) - $boot; '{0}d {1}h {2}m' -f $span.Days, $span.Hours, $span.Minutes"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:3976
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "(Get-CimInstance Win32_ComputerSystem).Domain"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:2424
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "(Get-CimInstance Win32_ComputerSystem).SystemType"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:2072
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command [System.Globalization.CultureInfo]::CurrentCulture.DisplayName
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:6028
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command [System.TimeZoneInfo]::Local.DisplayName
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:5752
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic computersystem get manufacturer /value"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2416
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic computersystem get manufacturer /value
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:3380
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic computersystem get model /value"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5760
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic computersystem get model /value
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:5164
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic bios get serialnumber /value"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4592
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic bios get serialnumber /value
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:4424
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic baseboard get product /value"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1292
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic baseboard get product /value
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:3564
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic baseboard get manufacturer /value"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3748
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic baseboard get manufacturer /value
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:2148
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic bios get SMBIOSBIOSVersion /value"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1844
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic bios get SMBIOSBIOSVersion /value
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:904
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "(Get-CimInstance Win32_BIOS).ReleaseDate.ToString('yyyy-MM-dd')"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:4656
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic cpu get name /value"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5608
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic cpu get name /value
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:5320
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic cpu get NumberOfCores /value"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2868
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic cpu get NumberOfCores /value
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:4248
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic cpu get NumberOfLogicalProcessors /value"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4224
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic cpu get NumberOfLogicalProcessors /value
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:2740
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic cpu get MaxClockSpeed /value"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5404
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic cpu get MaxClockSpeed /value
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:4912
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic cpu get SocketDesignation /value"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1764
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic cpu get SocketDesignation /value
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:3984
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic cpu get L2CacheSize /value"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2012
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic cpu get L2CacheSize /value
      4⤵
      PID:5888
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic cpu get L3CacheSize /value"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5820
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic cpu get L3CacheSize /value
      4⤵
      PID:5864
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic cpu get CurrentVoltage /value"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:6084
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic cpu get CurrentVoltage /value
      4⤵
      PID:1960
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic cpu get Status /value"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1492
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic cpu get Status /value
      4⤵
      PID:5972
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic cpu get LoadPercentage /value"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5240
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic cpu get LoadPercentage /value
      4⤵
      PID:4568
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "(Get-CimInstance Win32_VideoController | Select -First 1).Name"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:4512
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "(Get-CimInstance Win32_VideoController | Select -First 1).DriverVersion"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:400
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "(Get-CimInstance Win32_VideoController | Select -First 1).DriverDate.ToString('yyyy-MM-dd')"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:6140
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "[math]::Round((Get-CimInstance Win32_VideoController | Select -First 1).AdapterRAM / 1GB, 1)"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:4836
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "$g = Get-CimInstance Win32_VideoController | Select -First 1; \"$($g.CurrentHorizontalResolution)x$($g.CurrentVerticalResolution)\""
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:5748
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "(Get-CimInstance Win32_VideoController | Select -First 1).CurrentRefreshRate"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:5744
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "Get-CimInstance Win32_VideoController | ForEach-Object { $_.Name }"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:3416
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "[math]::Round((Get-CimInstance Win32_ComputerSystem).TotalPhysicalMemory / 1GB, 2)"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:1548
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "[math]::Round((Get-CimInstance Win32_OperatingSystem).FreePhysicalMemory / 1MB, 2)"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:4376
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "(Get-CimInstance Win32_PhysicalMemory).Count"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:1944
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "(Get-CimInstance Win32_PhysicalMemoryArray).MemoryDevices"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:4204
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "(Get-CimInstance Win32_PhysicalMemory | Select -First 1).Speed"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:904
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "(Get-CimInstance Win32_PhysicalMemory | Select -First 1).SMBIOSMemoryType"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:2352
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "Get-CimInstance Win32_PhysicalMemory | ForEach-Object { \"$([math]::Round($_.Capacity/1GB))GB $($_.Speed)MHz $($_.Manufacturer)\" }"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:5836
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "Get-CimInstance Win32_DiskDrive | ForEach-Object { \"$($_.Model) | $([math]::Round($_.Size/1GB, 1)) GB | $($_.MediaType)\" }"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:3376
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "Get-CimInstance Win32_LogicalDisk | Where-Object {$_.DriveType -eq 3} | ForEach-Object { \"$($_.DeviceID) $([math]::Round($_.FreeSpace/1GB,1))/$([math]::Round($_.Size/1GB,1)) GB free\" }"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:5212
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "(Get-CimInstance Win32_NetworkAdapterConfiguration | Where-Object {$_.IPEnabled -eq $true} | Select -First 1).MACAddress"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:2140
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "Get-NetAdapter | Where-Object {$_.Status -eq 'Up'} | ForEach-Object { \"$($_.Name) | $($_.InterfaceDescription) | $($_.LinkSpeed)\" }"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:5052
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "(Get-DnsClientServerAddress -AddressFamily IPv4 | Where-Object {$_.ServerAddresses} | Select -First 1).ServerAddresses -join ', '"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:1480
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "(Get-NetRoute -DestinationPrefix '0.0.0.0/0' | Select -First 1).NextHop"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:2936
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "Get-CimInstance Win32_SoundDevice | ForEach-Object { $_.Name }"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:5188
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "$b = Get-CimInstance Win32_Battery; if ($b) { \"$($b.EstimatedChargeRemaining)% | $($b.BatteryStatus)\" } else { 'No battery (Desktop)' }"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:4300
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "Get-CimInstance Win32_DesktopMonitor | ForEach-Object { $_.Name }"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:6044
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "Get-CimInstance Win32_Printer | ForEach-Object { $_.Name }"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:1824
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "Get-CimInstance Win32_StartupCommand | ForEach-Object { $_.Name }"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:1272
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command (Get-Process).Count
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:3712
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "Get-Process | Sort-Object WorkingSet64 -Descending | Select -First 5 | ForEach-Object { \"$($_.Name) - $([math]::Round($_.WorkingSet64/1MB, 1)) MB\" }"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:4768
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "Get-Process | Sort-Object CPU -Descending | Select -First 5 | ForEach-Object { \"$($_.Name) - $([math]::Round($_.CPU, 1))s\" }"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:3372
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "(Get-CimInstance -Namespace root/SecurityCenter2 -ClassName AntiVirusProduct -ErrorAction SilentlyContinue | Select -First 1).displayName"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:1748
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "$f = Get-NetFirewallProfile | ForEach-Object { \"$($_.Name):$($_.Enabled)\" }; $f -join ', '"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:5468
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "(Get-ItemProperty HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System).EnableLUA"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:5052
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "(Get-CimInstance SoftwareLicensingProduct | Where-Object {$_.PartialProductKey} | Select -First 1).LicenseStatus"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:1556
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "((Get-ItemProperty HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall\*) + (Get-ItemProperty HKLM:\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\* -ErrorAction SilentlyContinue) | Where-Object {$_.DisplayName}).Count"
    3⤵
    - Hide Artifacts: Ignore Process Interrupts
    PID:4876
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "((Get-ItemProperty HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall\*) + (Get-ItemProperty HKLM:\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\* -ErrorAction SilentlyContinue)) | Where-Object {$_.DisplayName} | Sort-Object DisplayName | Select -First 15 | ForEach-Object { $_.DisplayName }"
    3⤵
    - Hide Artifacts: Ignore Process Interrupts
    PID:2068
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "$u = Get-HotFix | Sort-Object InstalledOn -Descending -ErrorAction SilentlyContinue | Select -First 1; if ($u) { \"$($u.HotFixID) ($($u.InstalledOn.ToString('yyyy-MM-dd')))\" } else { 'Unknown' }"
    3⤵
    - Hide Artifacts: Ignore Process Interrupts
    PID:1488
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "try { $s = New-Object -ComObject Microsoft.Update.Session; $sr = $s.CreateUpdateSearcher(); $r = $sr.Search('IsInstalled=0'); $r.Updates.Count } catch { 'N/A' }"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:4736
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "(Get-Service | Where-Object {$_.Status -eq 'Running'}).Count"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:252
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command (Get-Service).Count
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:4532
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "foreach ($svc in @('WinDefend','wuauserv','Spooler','BITS','W32Time','Dnscache','LanmanServer','RemoteRegistry')) { $s = Get-Service -Name $svc -ErrorAction SilentlyContinue; if ($s) { \"$($s.DisplayName): $($s.Status)\" } }"
    3⤵
    - Hide Artifacts: Ignore Process Interrupts
    PID:4524
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "Get-CimInstance Win32_USBControllerDevice | ForEach-Object { $dep = [wmi]$_.Dependent; if ($dep.Description) { $dep.Description } } | Select-Object -Unique | Select -First 10"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:1604
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "Get-LocalUser | ForEach-Object { \"$($_.Name) | Enabled:$($_.Enabled) | LastLogon:$($_.LastLogon.ToString('yyyy-MM-dd') ?? 'Never')\" }"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:5624
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "(Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\NET Framework Setup\NDP\v4\Full' -ErrorAction SilentlyContinue).Version"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Hide Artifacts: Ignore Process Interrupts
    PID:968
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command $PSVersionTable.PSVersion.ToString()
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:4308
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "Get-SmbShare -ErrorAction SilentlyContinue | Where-Object {$_.Name -notlike '*$'} | ForEach-Object { \"$($_.Name) -> $($_.Path)\" }"
    3⤵
    - Hide Artifacts: Ignore Process Interrupts
    PID:5560
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "netsh wlan show profiles | Select-String 'All User Profile' | ForEach-Object { ($_ -split ':',2)[1].Trim() }"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - System Network Configuration Discovery: Wi-Fi Discovery
    PID:1156
  - - C:\Windows\system32\netsh.exe
      "C:\Windows\system32\netsh.exe" wlan show profiles
      4⤵
      System Network Configuration Discovery: Wi-Fi Discovery
      PID:4196
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "Get-EventLog -LogName System -EntryType Error -Newest 5 -ErrorAction SilentlyContinue | ForEach-Object { \"$($_.TimeGenerated.ToString('MM-dd HH:mm')) $($_.Source): $($_.Message.Substring(0, [Math]::Min(60, $_.Message.Length)))\" }"
    3⤵
    - Hide Artifacts: Ignore Process Interrupts
    PID:5588
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "Get-CimInstance Win32_PnPEntity | Where-Object { $_.PNPClass -eq 'Camera' -or $_.PNPClass -eq 'Image' } | ForEach-Object { $_.Name }"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:1760
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "$h = Get-WindowsOptionalFeature -Online -FeatureName Microsoft-Hyper-V -ErrorAction SilentlyContinue; if ($h) { $h.State } else { 'Not available' }"
    3⤵
    - Hide Artifacts: Ignore Process Interrupts
    PID:4696
  - - C:\Windows\System32\Dism\dismhost.exe
      C:\Windows\System32\Dism\dismhost.exe {6DB270A7-143E-47F0-A40D-7A2C7F74CC2A}
      4⤵
      PID:6088
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "if (Get-Command wsl -ErrorAction SilentlyContinue) { $d = wsl -l -q 2>&1; if ($LASTEXITCODE -eq 0) { 'Installed' } else { 'Not configured' } } else { 'Not installed' }"
    3⤵
    - Hide Artifacts: Ignore Process Interrupts
    PID:3536
  - - C:\Windows\system32\wsl.exe
      "C:\Windows\system32\wsl.exe" -l -q
      4⤵
      PID:1172
    - - C:\Windows\system32\msiexec.exe
        
        C:\Windows\system32\msiexec.exe /quiet /i "C:\Users\Admin\AppData\Local\Temp\wsl.2.7.10.0.x64.msi" SKIPVALIDATION=1 /L*V C:\Users\Admin\AppData\Local\Temp\wsl-install-logs.txt
        5⤵
        
        PID:3096
    - - C:\Program Files\WSL\wsl.exe
        
        wsl.exe --install --no-distribution
        5⤵
        
        PID:1760
      - C:\Windows\system32\dism.exe
        
        C:\Windows\system32\dism.exe /Online /NoRestart /enable-feature /featurename:VirtualMachinePlatform
        6⤵
        
        PID:3940
        
        C:\Windows\System32\Dism\dismhost.exe
        
        C:\Windows\System32\Dism\dismhost.exe {D21ED705-0FB9-4F77-9EF4-722F33F56266}
        7⤵
        
        PID:2720
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "Get-PhysicalDisk -ErrorAction SilentlyContinue | ForEach-Object { \"$($_.FriendlyName) | $($_.MediaType) | Health: $($_.HealthStatus) | $([math]::Round($_.Size/1GB))GB\" }"
    3⤵
    - Hide Artifacts: Ignore Process Interrupts
    PID:1940
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "Get-NetTCPConnection -State Established -ErrorAction SilentlyContinue | Select -First 10 | ForEach-Object { \"$($_.LocalAddress):$($_.LocalPort) -> $($_.RemoteAddress):$($_.RemotePort) (PID: $($_.OwningProcess))\" }"
    3⤵
    - Hide Artifacts: Ignore Process Interrupts
    PID:4428
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "Get-ScheduledTask | Where-Object {$_.State -eq 'Ready' -or $_.State -eq 'Running'} | Select-Object -First 10 | ForEach-Object { $_.TaskName }"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:5628
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "$user = [System.Security.Principal.WindowsIdentity]::GetCurrent().Name; Get-LocalGroup | Where-Object { Get-LocalGroupMember -Group $_.Name -Member $user -ErrorAction SilentlyContinue } | ForEach-Object { $_.Name }"
    3⤵
    - Hide Artifacts: Ignore Process Interrupts
    PID:4676
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "Get-EventLog -LogName Application -EntryType Error -Source 'Application Error' -Newest 5 -ErrorAction SilentlyContinue | ForEach-Object { \"$($_.TimeGenerated.ToString('MM-dd HH:mm')): $($_.Message.Split(\"`n\")[0])\" }"
    3⤵
    - Hide Artifacts: Ignore Process Interrupts
    PID:5828
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -ExecutionPolicy Bypass -File C:\Users\Admin\AppData\Local\Temp\_MEI20642\location.ps1
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:4376
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -ExecutionPolicy Bypass -File C:\Users\Admin\AppData\Local\Temp\_MEI20642\screenshot.ps1 C:\Users\Admin\AppData\Local\Temp\screenshot_0004fd2f.png
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:3292

C:\Windows\System32\sihclient.exe
C:\Windows\System32\sihclient.exe /cv 3QaDyppnz0+mO0dZtFO6mA.0.2
1⤵
PID:400

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:5156

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:3244

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
PID:5708
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding C1D5DC07A469195BA1E7E5C6FE58A677
  2⤵
  PID:2068
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding 5AD3C191B183E7BB9CB269C7F860D78E E Global\MSI0000
  2⤵
  PID:6040

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k AppReadiness -p -s AppReadiness
1⤵
PID:2816

C:\Program Files\WSL\wslservice.exe
"C:\Program Files\WSL\wslservice.exe"
1⤵
PID:2660

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Ignore Process Interrupts

T1564.011

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Wi-Fi Discovery

T1016.002

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e5a7d23.rbs

Path C:\Config.Msi\e5a7d23.rbs
Size 130KB
SHA256 d7b44c74ab27faa8481187bb315fdbf2278e510fd88926ec11d60cf679974fc9
MD5 9cc40df2b15e40237b56f6b0cf349e50
SHA1 a375ca0429bb86fc43b681f3cf6163c2192b94ba
SHA512 af9e333fbce41a444faad8c4b24fdcbac80436f3f39b70321a5f5de9aa7b3bb469806b0d3d746a4b43303e56b30b6c938cffa4608c256ad5681cb373530a25d0
SSDEEP 1536:7Rcmq+Nng8Mowvb6a3K+mzZiQpIJR+zWla8M0rbZZQ0BTD8C1lGS75hUUkkxMOGs:uJSn+d7TdhPw+
TLSH
T1ABD312A15C2DC2E1A0127C944781BD8D4DC4DD624BA1B82E33FEA76BEDD49D4CE7A2C0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WSL Settings.lnk

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WSL Settings.lnk
Size 2KB
SHA256 7ea1c791f52dc6ee0468a424807c45bf02d0ca5d83266f3d75aa6bd6916e43ac
MD5 82253eac326d635a074f50b070988507
SHA1 b1440a2760b99beaa79c8e6e9abe4ddc90f9300d
SHA512 42a213ffd8a22290f653fba6ef835696b2c1d13f3f7e5c86cb25526ba850ca703bbeac7bffa4f6d8eeaec50b70b7cd55d1817849e20880e94643093b2e43ca19
TLSH
T16451CE406AF82315D3B68BB2FE957217A460EC236D01DF130204C6C55E754D0E4A7F3E
MD5 SHA1 SHA512 TLSH

Submit Download

WSL Settings.lnk~RFe5abe21.TMP

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WSL Settings.lnk~RFe5abe21.TMP
Size 2KB
SHA256 035b23bf3f8ae7f08803fee51073125cb0f6f674d568f9037403cd7de616d9aa
MD5 2bf004aaf83a809e95d086f3c56a736a
SHA1 cd4a09a4ad18110db2af0559d186b41a21b45428
SHA512 250234b430fb79f0436914c0c159fb7266eadf9b81bb7214384d7fd47c22474f7496f1e1809898b38e613e55095da9701c18f45dd09ae18fddcdfee6927b4e4a
TLSH
T1D551BB401AF42319D3B68BB2FE997213B461EC636D51DF020204C6C95E358E0E4A3F3E
MD5 SHA1 SHA512 TLSH

Submit Download

WSL.lnk

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WSL.lnk
Size 2KB
SHA256 f93e73785b31bf94ab224022b93c017d3413f4417c6a6fa61535d37d7f256132
MD5 0aa202547b39f0738aacade89ae84193
SHA1 f565fc80c9a6fdd05cc793383d02e2c32536fa6f
SHA512 4b3fea877408d292105e1e3ea1e53f20c99963e55d9869a852340815d7b0f932f1cc1964cd5320c41a177c99b76a6103a31ea0a2d84c71590892f85e5672f796
TLSH
T11C51CA400AF42315E3B68BB6FE957627E661EC639D40DF020208D6C55D348A0E8B3F3A
MD5 SHA1 SHA512 TLSH

Submit Download

WSL.lnk

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WSL.lnk
Size 2KB
SHA256 0712f1b72de227f0af0877fb66549984493a7f5219d18e280204e1799ded3ea2
MD5 c9653aae520644b02e59b0e162d117fa
SHA1 1654aff4ebe5591e43309edd6401dbae2a8bebbb
SHA512 19ccfe3cdc2fd6bfcd4ecbc8a54c6ecf66d11c539325395e2970b93d2cbdea5431cd4f307a0df93ea6e998b7b9b2ff6e45b2d046542aee4df591c233fb051e70
TLSH
T1A951AC415AF41315D3B68BB6FE957227F561EC639D40DF020208D6C55D358E0E8B3F2A
MD5 SHA1 SHA512 TLSH

Submit Download

WSL.lnk~RFe5abe02.TMP

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WSL.lnk~RFe5abe02.TMP
Size 2KB
SHA256 6406652a7d956b7ac9060e7bd1b50345d536f5c2f29911a645f0b32a37835672
MD5 7bfdaa5a79da1c7c7624be1648feb1c7
SHA1 c09bc8308a3f5275c1484b81094b2c89060f4db3
SHA512 7b18efcc1d831dd7fa73b0187b7780cc0b072e6a534a03a70a32873142d8eec290f09cc9a3e0d29c907c59dd548fdb58c715cd9385b5ac7f91dfc27896ffb605
TLSH
T1535168401AF41315D3B68BB6FE957227F561EC635E80DF420248D6955E358E0E4B3F3A
MD5 SHA1 SHA512 TLSH

Submit Download