3ef7dc5aab132ad3c78c7e1eecb2bdca5d6fe2cebbd7b6ae3fbc985169b83dae

Analysis

max time kernel
67s
max time network
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
28/07/2026, 09:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
3ef7dc5aab132ad3c78c7e1eecb2bdca5d6fe2cebbd7b6ae3fbc985169b83dae.exe
Size 4.6MB
Sample260728-kzxrzsshpc
SHA256 3ef7dc5aab132ad3c78c7e1eecb2bdca5d6fe2cebbd7b6ae3fbc985169b83dae
MD5 1279be47936285ac3b89db1e63954d16
SHA1 f5a64d2ac68c64987d430903b780fb646a9103c0
SHA512 d9c99f1de2e6b4b5b01c778bc2d3c907627d2852106ca4c61524c831804baa72075a54bb9c297ac9dc330e0f62d0ff3423401e11f97d152708c0fc2e67fd10b5
SSDEEP 98304:Uv8cIed5JMqZdoerV1SlkBsGaP/FwuVCW5H15u9Ho2p8oAy3yaEfEeG/T7:i8cIed5JMqZdoerV1SlkBsGaP/FwuVC7
TLSH
T10726F943A5974CD9C9D6E77491CB6236A735BC69CA392B3A9704CB312E537C0E93EB00
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

defense_evasion discovery execution persistence privilege_escalation ransomware

Malware Config

Signatures

Renames multiple (51) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Modifies Windows Firewall 2 TTPs 1 IoCs

defense_evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
5592	netsh.exe

Checks BIOS information in registry 2 TTPs 1 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	3ef7dc5aab132ad3c78c7e1eecb2bdca5d6fe2cebbd7b6ae3fbc985169b83dae.exe

Network Service Discovery 1 TTPs 4 IoCs

Attempt to gather information on host's network.

discovery

Network Service Discovery

T1046

pid	Process
716	arp.exe
4652	ARP.EXE
1008	arp.exe
4536	ARP.EXE

Command and Scripting Interpreter: PowerShell 1 TTPs 58 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
5664	powershell.exe
5768	powershell.exe
4812	powershell.exe
1136	powershell.exe
1632	powershell.exe
200	powershell.exe
4380	powershell.exe
5336	powershell.exe
1704	powershell.exe
6004	powershell.exe
4544	powershell.exe
4568	powershell.exe
4712	powershell.exe
2732	powershell.exe
3652	powershell.exe
3868	powershell.exe
5060	powershell.exe
3640	powershell.exe
5332	powershell.exe
5996	powershell.exe
2944	powershell.exe
2900	powershell.exe
2220	powershell.exe
4196	powershell.exe
4128	powershell.exe
6004	powershell.exe
3352	powershell.exe
1820	powershell.exe
5324	powershell.exe
3476	powershell.exe
2444	powershell.exe
5124	powershell.exe
5644	powershell.exe
5960	powershell.exe
1832	powershell.exe
4552	powershell.exe
1884	powershell.exe
3092	powershell.exe
3132	powershell.exe
3440	powershell.exe
5980	powershell.exe
5768	powershell.exe
3704	powershell.exe
1492	powershell.exe
5420	powershell.exe
1084	powershell.exe
1688	powershell.exe
3476	powershell.exe
6108	powershell.exe
4248	powershell.exe
5956	powershell.exe
1056	powershell.exe
4924	powershell.exe
3644	powershell.exe
4196	powershell.exe
2548	powershell.exe
5920	powershell.exe
4384	powershell.exe

Event Triggered Execution: Netsh Helper DLL 1 TTPs 12 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

System Network Connections Discovery 1 TTPs 1 IoCs

Attempt to get a listing of network connections.

discovery

System Network Connections Discovery

T1049

pid	Process
5080	netstat.exe

Checks SCSI registry key(s) 3 TTPs 21 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	3ef7dc5aab132ad3c78c7e1eecb2bdca5d6fe2cebbd7b6ae3fbc985169b83dae.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	3ef7dc5aab132ad3c78c7e1eecb2bdca5d6fe2cebbd7b6ae3fbc985169b83dae.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM	3ef7dc5aab132ad3c78c7e1eecb2bdca5d6fe2cebbd7b6ae3fbc985169b83dae.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	3ef7dc5aab132ad3c78c7e1eecb2bdca5d6fe2cebbd7b6ae3fbc985169b83dae.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	3ef7dc5aab132ad3c78c7e1eecb2bdca5d6fe2cebbd7b6ae3fbc985169b83dae.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ClassGUID	3ef7dc5aab132ad3c78c7e1eecb2bdca5d6fe2cebbd7b6ae3fbc985169b83dae.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\LocationInformation	3ef7dc5aab132ad3c78c7e1eecb2bdca5d6fe2cebbd7b6ae3fbc985169b83dae.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW	3ef7dc5aab132ad3c78c7e1eecb2bdca5d6fe2cebbd7b6ae3fbc985169b83dae.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ClassGUID	3ef7dc5aab132ad3c78c7e1eecb2bdca5d6fe2cebbd7b6ae3fbc985169b83dae.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\ClassGUID	3ef7dc5aab132ad3c78c7e1eecb2bdca5d6fe2cebbd7b6ae3fbc985169b83dae.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A	3ef7dc5aab132ad3c78c7e1eecb2bdca5d6fe2cebbd7b6ae3fbc985169b83dae.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	3ef7dc5aab132ad3c78c7e1eecb2bdca5d6fe2cebbd7b6ae3fbc985169b83dae.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	3ef7dc5aab132ad3c78c7e1eecb2bdca5d6fe2cebbd7b6ae3fbc985169b83dae.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	3ef7dc5aab132ad3c78c7e1eecb2bdca5d6fe2cebbd7b6ae3fbc985169b83dae.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW	3ef7dc5aab132ad3c78c7e1eecb2bdca5d6fe2cebbd7b6ae3fbc985169b83dae.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW	3ef7dc5aab132ad3c78c7e1eecb2bdca5d6fe2cebbd7b6ae3fbc985169b83dae.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A	3ef7dc5aab132ad3c78c7e1eecb2bdca5d6fe2cebbd7b6ae3fbc985169b83dae.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A	3ef7dc5aab132ad3c78c7e1eecb2bdca5d6fe2cebbd7b6ae3fbc985169b83dae.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM	3ef7dc5aab132ad3c78c7e1eecb2bdca5d6fe2cebbd7b6ae3fbc985169b83dae.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM	3ef7dc5aab132ad3c78c7e1eecb2bdca5d6fe2cebbd7b6ae3fbc985169b83dae.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\ClassGUID	3ef7dc5aab132ad3c78c7e1eecb2bdca5d6fe2cebbd7b6ae3fbc985169b83dae.exe

Checks processor information in registry 2 TTPs 7 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	powershell.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor	powershell.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	powershell.exe
Key value enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	powershell.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	powershell.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	3ef7dc5aab132ad3c78c7e1eecb2bdca5d6fe2cebbd7b6ae3fbc985169b83dae.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	3ef7dc5aab132ad3c78c7e1eecb2bdca5d6fe2cebbd7b6ae3fbc985169b83dae.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	3ef7dc5aab132ad3c78c7e1eecb2bdca5d6fe2cebbd7b6ae3fbc985169b83dae.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	3ef7dc5aab132ad3c78c7e1eecb2bdca5d6fe2cebbd7b6ae3fbc985169b83dae.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BaseBoardManufacturer	3ef7dc5aab132ad3c78c7e1eecb2bdca5d6fe2cebbd7b6ae3fbc985169b83dae.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BaseBoardProduct	3ef7dc5aab132ad3c78c7e1eecb2bdca5d6fe2cebbd7b6ae3fbc985169b83dae.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BaseBoardVersion	3ef7dc5aab132ad3c78c7e1eecb2bdca5d6fe2cebbd7b6ae3fbc985169b83dae.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	3ef7dc5aab132ad3c78c7e1eecb2bdca5d6fe2cebbd7b6ae3fbc985169b83dae.exe

Gathers network information 2 TTPs 7 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
2344	ipconfig.exe
1656	ipconfig.exe
3320	ipconfig.exe
4348	ipconfig.exe
5964	ipconfig.exe
5420	ipconfig.exe
5080	netstat.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4128	powershell.exe
4128	powershell.exe
5392	wmic.exe
5392	wmic.exe
5392	wmic.exe
5392	wmic.exe
4544	powershell.exe
4544	powershell.exe
5980	powershell.exe
5980	powershell.exe
2768	wmic.exe
2768	wmic.exe
2768	wmic.exe
2768	wmic.exe
3940	wmic.exe
3940	wmic.exe
3940	wmic.exe
3940	wmic.exe
4568	powershell.exe
4568	powershell.exe
5332	powershell.exe
5332	powershell.exe
2316	wmic.exe
2316	wmic.exe
2316	wmic.exe
2316	wmic.exe
3860	wmic.exe
3860	wmic.exe
3860	wmic.exe
3860	wmic.exe
1356	wmic.exe
1356	wmic.exe
1356	wmic.exe
1356	wmic.exe
5124	powershell.exe
5124	powershell.exe
5956	powershell.exe
5956	powershell.exe
5956	powershell.exe
3428	WMIC.exe
3428	WMIC.exe
3428	WMIC.exe
3428	WMIC.exe
1704	powershell.exe
1704	powershell.exe
1704	powershell.exe
6004	powershell.exe
6004	powershell.exe
3352	powershell.exe
3352	powershell.exe
4712	powershell.exe
4712	powershell.exe
4712	powershell.exe
6108	powershell.exe
6108	powershell.exe
6108	powershell.exe
5664	powershell.exe
5664	powershell.exe
5664	powershell.exe
5768	powershell.exe
5768	powershell.exe
5768	powershell.exe
4380	powershell.exe
4380	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4128	powershell.exe
Token: SeIncreaseQuotaPrivilege	4128	powershell.exe
Token: SeSecurityPrivilege	4128	powershell.exe
Token: SeTakeOwnershipPrivilege	4128	powershell.exe
Token: SeLoadDriverPrivilege	4128	powershell.exe
Token: SeSystemProfilePrivilege	4128	powershell.exe
Token: SeSystemtimePrivilege	4128	powershell.exe
Token: SeProfSingleProcessPrivilege	4128	powershell.exe
Token: SeIncBasePriorityPrivilege	4128	powershell.exe
Token: SeCreatePagefilePrivilege	4128	powershell.exe
Token: SeBackupPrivilege	4128	powershell.exe
Token: SeRestorePrivilege	4128	powershell.exe
Token: SeShutdownPrivilege	4128	powershell.exe
Token: SeDebugPrivilege	4128	powershell.exe
Token: SeSystemEnvironmentPrivilege	4128	powershell.exe
Token: SeRemoteShutdownPrivilege	4128	powershell.exe
Token: SeUndockPrivilege	4128	powershell.exe
Token: SeManageVolumePrivilege	4128	powershell.exe
Token: 33	4128	powershell.exe
Token: 34	4128	powershell.exe
Token: 35	4128	powershell.exe
Token: 36	4128	powershell.exe
Token: SeIncreaseQuotaPrivilege	4128	powershell.exe
Token: SeSecurityPrivilege	4128	powershell.exe
Token: SeTakeOwnershipPrivilege	4128	powershell.exe
Token: SeLoadDriverPrivilege	4128	powershell.exe
Token: SeSystemProfilePrivilege	4128	powershell.exe
Token: SeSystemtimePrivilege	4128	powershell.exe
Token: SeProfSingleProcessPrivilege	4128	powershell.exe
Token: SeIncBasePriorityPrivilege	4128	powershell.exe
Token: SeCreatePagefilePrivilege	4128	powershell.exe
Token: SeBackupPrivilege	4128	powershell.exe
Token: SeRestorePrivilege	4128	powershell.exe
Token: SeShutdownPrivilege	4128	powershell.exe
Token: SeDebugPrivilege	4128	powershell.exe
Token: SeSystemEnvironmentPrivilege	4128	powershell.exe
Token: SeRemoteShutdownPrivilege	4128	powershell.exe
Token: SeUndockPrivilege	4128	powershell.exe
Token: SeManageVolumePrivilege	4128	powershell.exe
Token: 33	4128	powershell.exe
Token: 34	4128	powershell.exe
Token: 35	4128	powershell.exe
Token: 36	4128	powershell.exe
Token: SeIncreaseQuotaPrivilege	4128	powershell.exe
Token: SeSecurityPrivilege	4128	powershell.exe
Token: SeTakeOwnershipPrivilege	4128	powershell.exe
Token: SeLoadDriverPrivilege	4128	powershell.exe
Token: SeSystemProfilePrivilege	4128	powershell.exe
Token: SeSystemtimePrivilege	4128	powershell.exe
Token: SeProfSingleProcessPrivilege	4128	powershell.exe
Token: SeIncBasePriorityPrivilege	4128	powershell.exe
Token: SeCreatePagefilePrivilege	4128	powershell.exe
Token: SeBackupPrivilege	4128	powershell.exe
Token: SeRestorePrivilege	4128	powershell.exe
Token: SeShutdownPrivilege	4128	powershell.exe
Token: SeDebugPrivilege	4128	powershell.exe
Token: SeSystemEnvironmentPrivilege	4128	powershell.exe
Token: SeRemoteShutdownPrivilege	4128	powershell.exe
Token: SeUndockPrivilege	4128	powershell.exe
Token: SeManageVolumePrivilege	4128	powershell.exe
Token: 33	4128	powershell.exe
Token: 34	4128	powershell.exe
Token: 35	4128	powershell.exe
Token: 36	4128	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5824 wrote to memory of 4128	5824	3ef7dc5aab132ad3c78c7e1eecb2bdca5d6fe2cebbd7b6ae3fbc985169b83dae.exe	90
PID 5824 wrote to memory of 5392	5824	3ef7dc5aab132ad3c78c7e1eecb2bdca5d6fe2cebbd7b6ae3fbc985169b83dae.exe	93
PID 5824 wrote to memory of 4544	5824	3ef7dc5aab132ad3c78c7e1eecb2bdca5d6fe2cebbd7b6ae3fbc985169b83dae.exe	95
PID 5824 wrote to memory of 5980	5824	3ef7dc5aab132ad3c78c7e1eecb2bdca5d6fe2cebbd7b6ae3fbc985169b83dae.exe	97
PID 5824 wrote to memory of 2768	5824	3ef7dc5aab132ad3c78c7e1eecb2bdca5d6fe2cebbd7b6ae3fbc985169b83dae.exe	99
PID 5824 wrote to memory of 3940	5824	3ef7dc5aab132ad3c78c7e1eecb2bdca5d6fe2cebbd7b6ae3fbc985169b83dae.exe	101
PID 5824 wrote to memory of 4568	5824	3ef7dc5aab132ad3c78c7e1eecb2bdca5d6fe2cebbd7b6ae3fbc985169b83dae.exe	103
PID 5824 wrote to memory of 5332	5824	3ef7dc5aab132ad3c78c7e1eecb2bdca5d6fe2cebbd7b6ae3fbc985169b83dae.exe	105
PID 5824 wrote to memory of 2316	5824	3ef7dc5aab132ad3c78c7e1eecb2bdca5d6fe2cebbd7b6ae3fbc985169b83dae.exe	107
PID 5824 wrote to memory of 3860	5824	3ef7dc5aab132ad3c78c7e1eecb2bdca5d6fe2cebbd7b6ae3fbc985169b83dae.exe	109
PID 5824 wrote to memory of 1356	5824	3ef7dc5aab132ad3c78c7e1eecb2bdca5d6fe2cebbd7b6ae3fbc985169b83dae.exe	111
PID 5824 wrote to memory of 5124	5824	3ef7dc5aab132ad3c78c7e1eecb2bdca5d6fe2cebbd7b6ae3fbc985169b83dae.exe	113
PID 5824 wrote to memory of 5956	5824	3ef7dc5aab132ad3c78c7e1eecb2bdca5d6fe2cebbd7b6ae3fbc985169b83dae.exe	116
PID 5956 wrote to memory of 3428	5956	powershell.exe	118
PID 5824 wrote to memory of 1704	5824	3ef7dc5aab132ad3c78c7e1eecb2bdca5d6fe2cebbd7b6ae3fbc985169b83dae.exe	119
PID 5824 wrote to memory of 6004	5824	3ef7dc5aab132ad3c78c7e1eecb2bdca5d6fe2cebbd7b6ae3fbc985169b83dae.exe	121
PID 5824 wrote to memory of 3352	5824	3ef7dc5aab132ad3c78c7e1eecb2bdca5d6fe2cebbd7b6ae3fbc985169b83dae.exe	123
PID 5824 wrote to memory of 4712	5824	3ef7dc5aab132ad3c78c7e1eecb2bdca5d6fe2cebbd7b6ae3fbc985169b83dae.exe	125
PID 5824 wrote to memory of 6108	5824	3ef7dc5aab132ad3c78c7e1eecb2bdca5d6fe2cebbd7b6ae3fbc985169b83dae.exe	129
PID 5824 wrote to memory of 5664	5824	3ef7dc5aab132ad3c78c7e1eecb2bdca5d6fe2cebbd7b6ae3fbc985169b83dae.exe	131
PID 5824 wrote to memory of 5768	5824	3ef7dc5aab132ad3c78c7e1eecb2bdca5d6fe2cebbd7b6ae3fbc985169b83dae.exe	169
PID 5824 wrote to memory of 4380	5824	3ef7dc5aab132ad3c78c7e1eecb2bdca5d6fe2cebbd7b6ae3fbc985169b83dae.exe	135
PID 5824 wrote to memory of 5644	5824	3ef7dc5aab132ad3c78c7e1eecb2bdca5d6fe2cebbd7b6ae3fbc985169b83dae.exe	137
PID 5824 wrote to memory of 3132	5824	3ef7dc5aab132ad3c78c7e1eecb2bdca5d6fe2cebbd7b6ae3fbc985169b83dae.exe	139
PID 5824 wrote to memory of 4812	5824	3ef7dc5aab132ad3c78c7e1eecb2bdca5d6fe2cebbd7b6ae3fbc985169b83dae.exe	141
PID 5824 wrote to memory of 1820	5824	3ef7dc5aab132ad3c78c7e1eecb2bdca5d6fe2cebbd7b6ae3fbc985169b83dae.exe	143
PID 5824 wrote to memory of 5996	5824	3ef7dc5aab132ad3c78c7e1eecb2bdca5d6fe2cebbd7b6ae3fbc985169b83dae.exe	145
PID 5824 wrote to memory of 5604	5824	3ef7dc5aab132ad3c78c7e1eecb2bdca5d6fe2cebbd7b6ae3fbc985169b83dae.exe	147
PID 5824 wrote to memory of 3452	5824	3ef7dc5aab132ad3c78c7e1eecb2bdca5d6fe2cebbd7b6ae3fbc985169b83dae.exe	149
PID 5824 wrote to memory of 4256	5824	3ef7dc5aab132ad3c78c7e1eecb2bdca5d6fe2cebbd7b6ae3fbc985169b83dae.exe	151
PID 5824 wrote to memory of 3320	5824	3ef7dc5aab132ad3c78c7e1eecb2bdca5d6fe2cebbd7b6ae3fbc985169b83dae.exe	153
PID 5824 wrote to memory of 3352	5824	3ef7dc5aab132ad3c78c7e1eecb2bdca5d6fe2cebbd7b6ae3fbc985169b83dae.exe	155
PID 5824 wrote to memory of 248	5824	3ef7dc5aab132ad3c78c7e1eecb2bdca5d6fe2cebbd7b6ae3fbc985169b83dae.exe	157
PID 5824 wrote to memory of 1128	5824	3ef7dc5aab132ad3c78c7e1eecb2bdca5d6fe2cebbd7b6ae3fbc985169b83dae.exe	159
PID 5824 wrote to memory of 3440	5824	3ef7dc5aab132ad3c78c7e1eecb2bdca5d6fe2cebbd7b6ae3fbc985169b83dae.exe	161
PID 5824 wrote to memory of 4248	5824	3ef7dc5aab132ad3c78c7e1eecb2bdca5d6fe2cebbd7b6ae3fbc985169b83dae.exe	165
PID 5824 wrote to memory of 3644	5824	3ef7dc5aab132ad3c78c7e1eecb2bdca5d6fe2cebbd7b6ae3fbc985169b83dae.exe	167
PID 5824 wrote to memory of 5768	5824	3ef7dc5aab132ad3c78c7e1eecb2bdca5d6fe2cebbd7b6ae3fbc985169b83dae.exe	206
PID 5824 wrote to memory of 5964	5824	3ef7dc5aab132ad3c78c7e1eecb2bdca5d6fe2cebbd7b6ae3fbc985169b83dae.exe	171
PID 5824 wrote to memory of 716	5824	3ef7dc5aab132ad3c78c7e1eecb2bdca5d6fe2cebbd7b6ae3fbc985169b83dae.exe	173
PID 5824 wrote to memory of 5960	5824	3ef7dc5aab132ad3c78c7e1eecb2bdca5d6fe2cebbd7b6ae3fbc985169b83dae.exe	175
PID 5960 wrote to memory of 5420	5960	powershell.exe	210
PID 5824 wrote to memory of 1688	5824	3ef7dc5aab132ad3c78c7e1eecb2bdca5d6fe2cebbd7b6ae3fbc985169b83dae.exe	178
PID 1688 wrote to memory of 4652	1688	powershell.exe	180
PID 5824 wrote to memory of 5040	5824	3ef7dc5aab132ad3c78c7e1eecb2bdca5d6fe2cebbd7b6ae3fbc985169b83dae.exe	181
PID 5824 wrote to memory of 2772	5824	3ef7dc5aab132ad3c78c7e1eecb2bdca5d6fe2cebbd7b6ae3fbc985169b83dae.exe	183
PID 5824 wrote to memory of 4300	5824	3ef7dc5aab132ad3c78c7e1eecb2bdca5d6fe2cebbd7b6ae3fbc985169b83dae.exe	185
PID 5824 wrote to memory of 1832	5824	3ef7dc5aab132ad3c78c7e1eecb2bdca5d6fe2cebbd7b6ae3fbc985169b83dae.exe	187
PID 5824 wrote to memory of 2732	5824	3ef7dc5aab132ad3c78c7e1eecb2bdca5d6fe2cebbd7b6ae3fbc985169b83dae.exe	189
PID 5824 wrote to memory of 5324	5824	3ef7dc5aab132ad3c78c7e1eecb2bdca5d6fe2cebbd7b6ae3fbc985169b83dae.exe	191
PID 5824 wrote to memory of 2944	5824	3ef7dc5aab132ad3c78c7e1eecb2bdca5d6fe2cebbd7b6ae3fbc985169b83dae.exe	193
PID 5824 wrote to memory of 5336	5824	3ef7dc5aab132ad3c78c7e1eecb2bdca5d6fe2cebbd7b6ae3fbc985169b83dae.exe	195
PID 5824 wrote to memory of 1136	5824	3ef7dc5aab132ad3c78c7e1eecb2bdca5d6fe2cebbd7b6ae3fbc985169b83dae.exe	197
PID 5824 wrote to memory of 3476	5824	3ef7dc5aab132ad3c78c7e1eecb2bdca5d6fe2cebbd7b6ae3fbc985169b83dae.exe	237
PID 5824 wrote to memory of 1884	5824	3ef7dc5aab132ad3c78c7e1eecb2bdca5d6fe2cebbd7b6ae3fbc985169b83dae.exe	201
PID 5824 wrote to memory of 5080	5824	3ef7dc5aab132ad3c78c7e1eecb2bdca5d6fe2cebbd7b6ae3fbc985169b83dae.exe	203
PID 5824 wrote to memory of 1008	5824	3ef7dc5aab132ad3c78c7e1eecb2bdca5d6fe2cebbd7b6ae3fbc985169b83dae.exe	205
PID 5824 wrote to memory of 3652	5824	3ef7dc5aab132ad3c78c7e1eecb2bdca5d6fe2cebbd7b6ae3fbc985169b83dae.exe	207
PID 3652 wrote to memory of 4536	3652	powershell.exe	209
PID 5824 wrote to memory of 5420	5824	3ef7dc5aab132ad3c78c7e1eecb2bdca5d6fe2cebbd7b6ae3fbc985169b83dae.exe	210
PID 5420 wrote to memory of 2344	5420	powershell.exe	212
PID 5824 wrote to memory of 3868	5824	3ef7dc5aab132ad3c78c7e1eecb2bdca5d6fe2cebbd7b6ae3fbc985169b83dae.exe	213
PID 3868 wrote to memory of 1656	3868	powershell.exe	215
PID 5824 wrote to memory of 1056	5824	3ef7dc5aab132ad3c78c7e1eecb2bdca5d6fe2cebbd7b6ae3fbc985169b83dae.exe	216

C:\Users\Admin\AppData\Local\Temp\3ef7dc5aab132ad3c78c7e1eecb2bdca5d6fe2cebbd7b6ae3fbc985169b83dae.exe
"C:\Users\Admin\AppData\Local\Temp\3ef7dc5aab132ad3c78c7e1eecb2bdca5d6fe2cebbd7b6ae3fbc985169b83dae.exe"
1⤵
- Checks BIOS information in registry
- Checks SCSI registry key(s)
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of WriteProcessMemory
PID:5824
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -EP Bypass -File "C:\Users\Admin\AppData\Local\Temp\fp_3500.tmp.ps1"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4128
- C:\Windows\System32\Wbem\wmic.exe
  wmic path Win32_VideoController get PNPDeviceID /format:list
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5392
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -EP Bypass -File "C:\Users\Admin\AppData\Local\Temp\fp_6D96.tmp.ps1"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:4544
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -EP Bypass -File "C:\Users\Admin\AppData\Local\Temp\fp_6FF8.tmp.ps1"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:5980
- C:\Windows\System32\Wbem\wmic.exe
  wmic sounddev get PNPDeviceID /format:list
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2768
- C:\Windows\System32\Wbem\wmic.exe
  wmic memorychip get PartNumber,Speed /format:list
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3940
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -EP Bypass -File "C:\Users\Admin\AppData\Local\Temp\fp_746E.tmp.ps1"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:4568
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -EP Bypass -File "C:\Users\Admin\AppData\Local\Temp\fp_771E.tmp.ps1"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  PID:5332
- C:\Windows\System32\Wbem\wmic.exe
  wmic bios get SMBIOSBIOSVersion,ReleaseDate /format:list
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2316
- C:\Windows\System32\Wbem\wmic.exe
  wmic memorychip get DeviceLocator,BankLabel /format:list
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3860
- C:\Windows\System32\Wbem\wmic.exe
  wmic memorychip get Manufacturer /format:list
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1356
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -EP Bypass -File "C:\Users\Admin\AppData\Local\Temp\fp_7AE8.tmp.ps1"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:5124
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -EP Bypass -File "C:\Users\Admin\AppData\Local\Temp\fp_85D6.tmp.ps1"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:5956
- - C:\Windows\System32\Wbem\WMIC.exe
    "C:\Windows\System32\Wbem\WMIC.exe" diskdrive get size /format:list
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3428
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -EP Bypass -File "C:\Users\Admin\AppData\Local\Temp\fp_87CB.tmp.ps1"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:1704
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -EP Bypass -File "C:\Users\Admin\AppData\Local\Temp\fp_8ACA.tmp.ps1"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:6004
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -EP Bypass -File "C:\Users\Admin\AppData\Local\Temp\fp_8EF1.tmp.ps1"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:3352
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -EP Bypass -File "C:\Users\Admin\AppData\Local\Temp\fp_91F0.tmp.ps1"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:4712
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -EP Bypass -File "C:\Users\Admin\AppData\Local\Temp\fp_C833.tmp.ps1"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:6108
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -EP Bypass -File "C:\Users\Admin\AppData\Local\Temp\fp_CA86.tmp.ps1"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:5664
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -EP Bypass -File "C:\Users\Admin\AppData\Local\Temp\fp_CBDF.tmp.ps1"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:5768
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -EP Bypass -File "C:\Users\Admin\AppData\Local\Temp\fp_CD76.tmp.ps1"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:4380
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -EP Bypass -File "C:\Users\Admin\AppData\Local\Temp\fp_CF0D.tmp.ps1"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:5644
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -EP Bypass -File "C:\Users\Admin\AppData\Local\Temp\fp_D17F.tmp.ps1"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:3132
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -EP Bypass -File "C:\Users\Admin\AppData\Local\Temp\fp_D3D2.tmp.ps1"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:4812
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -EP Bypass -File "C:\Users\Admin\AppData\Local\Temp\fp_D52B.tmp.ps1"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:1820
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -EP Bypass -File "C:\Users\Admin\AppData\Local\Temp\fp_D6D2.tmp.ps1"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:5996
- C:\Windows\System32\Wbem\wmic.exe
  wmic nic get MACAddress /format:list
  2⤵
  PID:5604
- C:\Windows\System32\Wbem\wmic.exe
  wmic nic get NetConnectionStatus /format:list
  2⤵
  PID:3452
- C:\Windows\System32\Wbem\wmic.exe
  wmic nic get AdapterType /format:list
  2⤵
  PID:4256
- C:\Windows\SYSTEM32\netsh.exe
  "netsh" wlan show interfaces
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:3320
- C:\Windows\System32\Wbem\wmic.exe
  wmic nic get Description /format:list
  2⤵
  PID:3352
- C:\Windows\System32\Wbem\wmic.exe
  wmic nic get Manufacturer /format:list
  2⤵
  PID:248
- C:\Windows\System32\Wbem\wmic.exe
  wmic nic get PNPDeviceID /format:list
  2⤵
  PID:1128
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -EP Bypass -File "C:\Users\Admin\AppData\Local\Temp\fp_DEA3.tmp.ps1"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:3440
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -EP Bypass -File "C:\Users\Admin\AppData\Local\Temp\fp_E74E.tmp.ps1"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:4248
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -EP Bypass -File "C:\Users\Admin\AppData\Local\Temp\fp_ED0C.tmp.ps1"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:3644
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -EP Bypass -File "C:\Users\Admin\AppData\Local\Temp\fp_EE84.tmp.ps1"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:5768
- C:\Windows\SYSTEM32\ipconfig.exe
  "ipconfig"
  2⤵
  - Gathers network information
  PID:5964
- C:\Windows\SYSTEM32\arp.exe
  "arp" -a
  2⤵
  - Network Service Discovery
  PID:716
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -EP Bypass -File "C:\Users\Admin\AppData\Local\Temp\fp_F164.tmp.ps1"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of WriteProcessMemory
  PID:5960
- - C:\Windows\system32\ipconfig.exe
    "C:\Windows\system32\ipconfig.exe"
    3⤵
    - Gathers network information
    PID:5420
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -EP Bypass -File "C:\Users\Admin\AppData\Local\Temp\fp_F28D.tmp.ps1"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of WriteProcessMemory
  PID:1688
- - C:\Windows\system32\ARP.EXE
    "C:\Windows\system32\ARP.EXE" -a
    3⤵
    - Network Service Discovery
    PID:4652
- C:\Windows\System32\Wbem\wmic.exe
  wmic nic get Index /format:list
  2⤵
  PID:5040
- C:\Windows\System32\Wbem\wmic.exe
  wmic nic get InterfaceIndex /format:list
  2⤵
  PID:2772
- C:\Windows\System32\Wbem\wmic.exe
  wmic nic get PhysicalAdapter /format:list
  2⤵
  PID:4300
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -EP Bypass -File "C:\Users\Admin\AppData\Local\Temp\fp_F628.tmp.ps1"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:1832
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -EP Bypass -File "C:\Users\Admin\AppData\Local\Temp\fp_F7CF.tmp.ps1"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:2732
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -EP Bypass -File "C:\Users\Admin\AppData\Local\Temp\fp_F9B5.tmp.ps1"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:5324
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -EP Bypass -File "C:\Users\Admin\AppData\Local\Temp\fp_FB2D.tmp.ps1"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:2944
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -EP Bypass -File "C:\Users\Admin\AppData\Local\Temp\fp_FCC4.tmp.ps1"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:5336
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -EP Bypass -File "C:\Users\Admin\AppData\Local\Temp\fp_30E.tmp.ps1"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:1136
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -EP Bypass -File "C:\Users\Admin\AppData\Local\Temp\fp_92A.tmp.ps1"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:3476
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -EP Bypass -File "C:\Users\Admin\AppData\Local\Temp\fp_E5B.tmp.ps1"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:1884
- C:\Windows\SYSTEM32\netstat.exe
  "netstat" -ano
  2⤵
  - System Network Connections Discovery
  - Gathers network information
  PID:5080
- C:\Windows\SYSTEM32\arp.exe
  "arp" -a
  2⤵
  - Network Service Discovery
  PID:1008
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:5768
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -EP Bypass -File "C:\Users\Admin\AppData\Local\Temp\fp_10CD.tmp.ps1"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of WriteProcessMemory
  PID:3652
- - C:\Windows\system32\ARP.EXE
    "C:\Windows\system32\ARP.EXE" -a
    3⤵
    - Network Service Discovery
    PID:4536
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -EP Bypass -File "C:\Users\Admin\AppData\Local\Temp\fp_1235.tmp.ps1"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of WriteProcessMemory
  PID:5420
- - C:\Windows\system32\ipconfig.exe
    "C:\Windows\system32\ipconfig.exe"
    3⤵
    - Gathers network information
    PID:2344
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -EP Bypass -File "C:\Users\Admin\AppData\Local\Temp\fp_136F.tmp.ps1"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of WriteProcessMemory
  PID:3868
- - C:\Windows\system32\ipconfig.exe
    "C:\Windows\system32\ipconfig.exe"
    3⤵
    - Gathers network information
    PID:1656
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -EP Bypass -File "C:\Users\Admin\AppData\Local\Temp\fp_1489.tmp.ps1"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:1056
- - C:\Windows\system32\netsh.exe
    "C:\Windows\system32\netsh.exe" wlan show networks
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:2452
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -EP Bypass -File "C:\Users\Admin\AppData\Local\Temp\fp_1739.tmp.ps1"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:4196
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -EP Bypass -File "C:\Users\Admin\AppData\Local\Temp\fp_1D65.tmp.ps1"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:5060
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -EP Bypass -File "C:\Users\Admin\AppData\Local\Temp\fp_22F3.tmp.ps1"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:2900
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -EP Bypass -File "C:\Users\Admin\AppData\Local\Temp\fp_247B.tmp.ps1"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:1632
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -EP Bypass -File "C:\Users\Admin\AppData\Local\Temp\fp_25E3.tmp.ps1"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:3092
- - C:\Windows\system32\ROUTE.EXE
    "C:\Windows\system32\ROUTE.EXE" print
    3⤵
    PID:4864
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -EP Bypass -File "C:\Users\Admin\AppData\Local\Temp\fp_277B.tmp.ps1"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:3640
- - C:\Windows\system32\ROUTE.EXE
    "C:\Windows\system32\ROUTE.EXE" print
    3⤵
    PID:5840
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -EP Bypass -File "C:\Users\Admin\AppData\Local\Temp\fp_28B4.tmp.ps1"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:4552
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -EP Bypass -File "C:\Users\Admin\AppData\Local\Temp\fp_29FD.tmp.ps1"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:2548
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -EP Bypass -File "C:\Users\Admin\AppData\Local\Temp\fp_2B56.tmp.ps1"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:3476
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -EP Bypass -File "C:\Users\Admin\AppData\Local\Temp\fp_2DD8.tmp.ps1"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:3704
- C:\Windows\SYSTEM32\netsh.exe
  "netsh" interface ipv6 show address
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:2316
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -EP Bypass -File "C:\Users\Admin\AppData\Local\Temp\fp_3088.tmp.ps1"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:5920
- - C:\Windows\system32\netsh.exe
    "C:\Windows\system32\netsh.exe" interface ipv6 show address
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:724
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -EP Bypass -File "C:\Users\Admin\AppData\Local\Temp\fp_3319.tmp.ps1"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:1084
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -EP Bypass -File "C:\Users\Admin\AppData\Local\Temp\fp_3608.tmp.ps1"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:2220
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -EP Bypass -File "C:\Users\Admin\AppData\Local\Temp\fp_38E8.tmp.ps1"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:4924
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:2452
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -EP Bypass -File "C:\Users\Admin\AppData\Local\Temp\fp_402C.tmp.ps1"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:4196
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -EP Bypass -File "C:\Users\Admin\AppData\Local\Temp\fp_46A5.tmp.ps1"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:6004
- C:\Windows\SYSTEM32\netsh.exe
  "netsh" wlan show interfaces
  2⤵
  PID:4368
- C:\Windows\SYSTEM32\netsh.exe
  "netsh" wlan show drivers
  2⤵
  PID:2688
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -EP Bypass -File "C:\Users\Admin\AppData\Local\Temp\fp_4D5D.tmp.ps1"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:200
- - C:\Windows\system32\ipconfig.exe
    "C:\Windows\system32\ipconfig.exe"
    3⤵
    - Gathers network information
    PID:3320
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -EP Bypass -File "C:\Users\Admin\AppData\Local\Temp\fp_4F14.tmp.ps1"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:2444
- - C:\Windows\system32\ipconfig.exe
    "C:\Windows\system32\ipconfig.exe"
    3⤵
    - Gathers network information
    PID:4348
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -EP Bypass -File "C:\Users\Admin\AppData\Local\Temp\fp_507C.tmp.ps1"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:4384
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -EP Bypass -File "C:\Users\Admin\AppData\Local\Temp\fp_52FE.tmp.ps1"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:1492
- - C:\Windows\system32\netsh.exe
    "C:\Windows\system32\netsh.exe" advfirewall firewall show rule name=all
    3⤵
    - Modifies Windows Firewall
    PID:5592

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Credential Access

Discovery

Network Service Discovery

T1046

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Network Connections Discovery

T1049

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...