5cde0fa88d9ab654714a9bd06d4440fde080314b2f36c7a7224a76fb8ed0305e

Analysis

user interaction
yes
max time kernel
41s
max time network
66s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
29/07/2026, 17:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

Reason

Machine shutdown

General

Target
VBS.cmd
Size 96KB
Sample260729-vphv7ayanc
SHA256 5cde0fa88d9ab654714a9bd06d4440fde080314b2f36c7a7224a76fb8ed0305e
MD5 851ecaffc08a4ea60d3a4e691bb32d07
SHA1 73013bd0202c85e3b6b59d87d004b3abe3b81167
SHA512 9e3d70d592d89971ce537c39313bf5b20fe2797a29bc7cc4b82eebae78b0b91ab89c20dda269df9ab95ee2b646d653c2298a0f422767e95ad977b89115f89ac3
SSDEEP 1536:BF9Omaq2Yr+tlouo6pKOUN0kpSrdk6dQZ9ash:3Kfts
TLSH
T1F5A3B7123908185449B6B4B7AD63C20BF799C0C34162AAED78CDD06CBF7516BB2F56EC
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

execution

Malware Config

Signatures

Modifies boot configuration data using bcdedit 10 IoCs

pid	Process
3412	bcdedit.exe
2904	bcdedit.exe
1272	bcdedit.exe
5400	bcdedit.exe
2916	bcdedit.exe
4388	bcdedit.exe
4292	bcdedit.exe
4268	bcdedit.exe
1264	bcdedit.exe
1820	bcdedit.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 6 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
4396	powershell.exe
1300	powershell.exe
6072	powershell.exe
1072	powershell.exe
5016	powershell.exe
3196	powershell.exe

Drops file in Windows directory 10 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Logs\DISM\dism.log	dismhost.exe
File opened for modification	C:\Windows\Logs\DISM\dism.log	Dism.exe
File opened for modification	C:\Windows\Logs\DISM\dism.log	Dism.exe
File opened for modification	C:\Windows\Logs\DISM\dism.log	Dism.exe
File opened for modification	C:\Windows\Logs\DISM\dism.log	dismhost.exe
File opened for modification	C:\Windows\Logs\DISM\dism.log	Dism.exe
File opened for modification	C:\Windows\Logs\DISM\dism.log	dismhost.exe
File opened for modification	C:\Windows\Logs\DISM\dism.log	Dism.exe
File opened for modification	C:\Windows\Logs\DISM\dism.log	dismhost.exe
File opened for modification	C:\Windows\Logs\DISM\dism.log	dismhost.exe

Launches sc.exe 3 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
5236	sc.exe
3820	sc.exe
4168	sc.exe

Executes a command shell one-liner 1 TTPs 64 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4992	cmd.exe
2912	cmd.exe
6060	cmd.exe
5652	cmd.exe
5960	cmd.exe
4348	cmd.exe
1352	cmd.exe
2132	cmd.exe
1816	cmd.exe
3776	cmd.exe
6104	cmd.exe
2904	cmd.exe
5588	cmd.exe
2816	cmd.exe
4536	cmd.exe
2520	cmd.exe
2296	cmd.exe
824	cmd.exe
1000	cmd.exe
4284	cmd.exe
2096	cmd.exe
3940	cmd.exe
5380	cmd.exe
2884	cmd.exe
2388	cmd.exe
4524	cmd.exe
1740	cmd.exe
1276	cmd.exe
3548	cmd.exe
3252	cmd.exe
3116	cmd.exe
1828	cmd.exe
6120	cmd.exe
5888	cmd.exe
1360	cmd.exe
2956	cmd.exe
1280	cmd.exe
2676	cmd.exe
2612	cmd.exe
5956	cmd.exe
716	cmd.exe
4448	cmd.exe
2860	cmd.exe
5816	cmd.exe
2152	cmd.exe
5692	cmd.exe
2532	cmd.exe
2264	cmd.exe
2364	cmd.exe
1128	cmd.exe
5296	cmd.exe
2188	cmd.exe
4832	cmd.exe
4240	cmd.exe
4204	cmd.exe
4344	cmd.exe
2316	cmd.exe
5412	cmd.exe
2560	cmd.exe
3172	cmd.exe
4340	cmd.exe
3032	cmd.exe
2352	cmd.exe
4328	cmd.exe

Enumerates system info in registry 2 TTPs 14 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BaseBoardManufacturer	reg.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	reg.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	reg.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	reg.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	reg.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	reg.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	reg.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BaseBoardProduct	reg.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	reg.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BIOSVendor	reg.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	reg.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	reg.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	reg.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	reg.exe

Modifies registry key 1 TTPs 3 IoCs

Modify Registry

T1112

pid	Process
3732	reg.exe
4108	reg.exe
3352	reg.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 41 IoCs

pid	Process
4396	powershell.exe
4396	powershell.exe
4128	powershell.exe
4128	powershell.exe
1300	powershell.exe
1300	powershell.exe
2928	powershell.exe
2928	powershell.exe
3768	powershell.exe
3768	powershell.exe
3168	powershell.exe
3168	powershell.exe
4068	WMIC.exe
4068	WMIC.exe
4068	WMIC.exe
4068	WMIC.exe
3244	WMIC.exe
3244	WMIC.exe
3244	WMIC.exe
3244	WMIC.exe
3420	powershell.exe
3420	powershell.exe
3196	powershell.exe
3196	powershell.exe
1652	powershell.exe
1652	powershell.exe
6072	powershell.exe
6072	powershell.exe
1072	powershell.exe
1072	powershell.exe
1100	powershell.exe
1100	powershell.exe
5016	powershell.exe
5016	powershell.exe
1316	powershell.exe
1316	powershell.exe
4984	powershell.exe
4984	powershell.exe
5952	powershell.exe
5952	powershell.exe
5952	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4396	powershell.exe
Token: SeDebugPrivilege	4128	powershell.exe
Token: SeDebugPrivilege	1300	powershell.exe
Token: SeDebugPrivilege	2928	powershell.exe
Token: SeDebugPrivilege	3768	powershell.exe
Token: SeSystemEnvironmentPrivilege	3768	powershell.exe
Token: SeDebugPrivilege	3168	powershell.exe
Token: SeIncreaseQuotaPrivilege	4068	WMIC.exe
Token: SeSecurityPrivilege	4068	WMIC.exe
Token: SeTakeOwnershipPrivilege	4068	WMIC.exe
Token: SeLoadDriverPrivilege	4068	WMIC.exe
Token: SeSystemProfilePrivilege	4068	WMIC.exe
Token: SeSystemtimePrivilege	4068	WMIC.exe
Token: SeProfSingleProcessPrivilege	4068	WMIC.exe
Token: SeIncBasePriorityPrivilege	4068	WMIC.exe
Token: SeCreatePagefilePrivilege	4068	WMIC.exe
Token: SeBackupPrivilege	4068	WMIC.exe
Token: SeRestorePrivilege	4068	WMIC.exe
Token: SeShutdownPrivilege	4068	WMIC.exe
Token: SeDebugPrivilege	4068	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4068	WMIC.exe
Token: SeRemoteShutdownPrivilege	4068	WMIC.exe
Token: SeUndockPrivilege	4068	WMIC.exe
Token: SeManageVolumePrivilege	4068	WMIC.exe
Token: 33	4068	WMIC.exe
Token: 34	4068	WMIC.exe
Token: 35	4068	WMIC.exe
Token: 36	4068	WMIC.exe
Token: SeIncreaseQuotaPrivilege	4068	WMIC.exe
Token: SeSecurityPrivilege	4068	WMIC.exe
Token: SeTakeOwnershipPrivilege	4068	WMIC.exe
Token: SeLoadDriverPrivilege	4068	WMIC.exe
Token: SeSystemProfilePrivilege	4068	WMIC.exe
Token: SeSystemtimePrivilege	4068	WMIC.exe
Token: SeProfSingleProcessPrivilege	4068	WMIC.exe
Token: SeIncBasePriorityPrivilege	4068	WMIC.exe
Token: SeCreatePagefilePrivilege	4068	WMIC.exe
Token: SeBackupPrivilege	4068	WMIC.exe
Token: SeRestorePrivilege	4068	WMIC.exe
Token: SeShutdownPrivilege	4068	WMIC.exe
Token: SeDebugPrivilege	4068	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4068	WMIC.exe
Token: SeRemoteShutdownPrivilege	4068	WMIC.exe
Token: SeUndockPrivilege	4068	WMIC.exe
Token: SeManageVolumePrivilege	4068	WMIC.exe
Token: 33	4068	WMIC.exe
Token: 34	4068	WMIC.exe
Token: 35	4068	WMIC.exe
Token: 36	4068	WMIC.exe
Token: SeIncreaseQuotaPrivilege	3244	WMIC.exe
Token: SeSecurityPrivilege	3244	WMIC.exe
Token: SeTakeOwnershipPrivilege	3244	WMIC.exe
Token: SeLoadDriverPrivilege	3244	WMIC.exe
Token: SeSystemProfilePrivilege	3244	WMIC.exe
Token: SeSystemtimePrivilege	3244	WMIC.exe
Token: SeProfSingleProcessPrivilege	3244	WMIC.exe
Token: SeIncBasePriorityPrivilege	3244	WMIC.exe
Token: SeCreatePagefilePrivilege	3244	WMIC.exe
Token: SeBackupPrivilege	3244	WMIC.exe
Token: SeRestorePrivilege	3244	WMIC.exe
Token: SeShutdownPrivilege	3244	WMIC.exe
Token: SeDebugPrivilege	3244	WMIC.exe
Token: SeSystemEnvironmentPrivilege	3244	WMIC.exe
Token: SeRemoteShutdownPrivilege	3244	WMIC.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4348 wrote to memory of 5236	4348	cmd.exe	90
PID 4348 wrote to memory of 4564	4348	cmd.exe	91
PID 4348 wrote to memory of 3772	4348	cmd.exe	92
PID 4348 wrote to memory of 4240	4348	cmd.exe	93
PID 4348 wrote to memory of 2404	4348	cmd.exe	94
PID 4348 wrote to memory of 4216	4348	cmd.exe	95
PID 4348 wrote to memory of 5552	4348	cmd.exe	96
PID 4348 wrote to memory of 1276	4348	cmd.exe	97
PID 4348 wrote to memory of 1112	4348	cmd.exe	98
PID 4348 wrote to memory of 5312	4348	cmd.exe	99
PID 5312 wrote to memory of 1152	5312	cmd.exe	100
PID 5312 wrote to memory of 4896	5312	cmd.exe	101
PID 4348 wrote to memory of 3312	4348	cmd.exe	102
PID 4348 wrote to memory of 5956	4348	cmd.exe	103
PID 5956 wrote to memory of 4396	5956	cmd.exe	104
PID 4348 wrote to memory of 4592	4348	cmd.exe	105
PID 4348 wrote to memory of 1472	4348	cmd.exe	106
PID 4348 wrote to memory of 3032	4348	cmd.exe	107
PID 3032 wrote to memory of 2748	3032	cmd.exe	108
PID 4348 wrote to memory of 1828	4348	cmd.exe	109
PID 4348 wrote to memory of 2608	4348	cmd.exe	110
PID 4348 wrote to memory of 2448	4348	cmd.exe	111
PID 4348 wrote to memory of 2560	4348	cmd.exe	112
PID 2560 wrote to memory of 4532	2560	cmd.exe	113
PID 4348 wrote to memory of 2352	4348	cmd.exe	114
PID 2352 wrote to memory of 3412	2352	cmd.exe	115
PID 4348 wrote to memory of 6120	4348	cmd.exe	116
PID 6120 wrote to memory of 4128	6120	cmd.exe	117
PID 4348 wrote to memory of 3172	4348	cmd.exe	118
PID 3172 wrote to memory of 2288	3172	cmd.exe	119
PID 4348 wrote to memory of 3732	4348	cmd.exe	120
PID 4348 wrote to memory of 4084	4348	cmd.exe	121
PID 4348 wrote to memory of 4108	4348	cmd.exe	122
PID 4348 wrote to memory of 1128	4348	cmd.exe	123
PID 4348 wrote to memory of 3352	4348	cmd.exe	124
PID 1128 wrote to memory of 3820	1128	cmd.exe	127
PID 1128 wrote to memory of 2956	1128	cmd.exe	128
PID 1128 wrote to memory of 4480	1128	cmd.exe	129
PID 1128 wrote to memory of 992	1128	cmd.exe	130
PID 1128 wrote to memory of 3940	1128	cmd.exe	131
PID 1128 wrote to memory of 1284	1128	cmd.exe	132
PID 1128 wrote to memory of 5784	1128	cmd.exe	133
PID 1128 wrote to memory of 1404	1128	cmd.exe	134
PID 1128 wrote to memory of 620	1128	cmd.exe	135
PID 1128 wrote to memory of 4992	1128	cmd.exe	136
PID 4992 wrote to memory of 924	4992	cmd.exe	137
PID 4992 wrote to memory of 4516	4992	cmd.exe	138
PID 1128 wrote to memory of 2912	1128	cmd.exe	139
PID 1128 wrote to memory of 5888	1128	cmd.exe	140
PID 5888 wrote to memory of 1300	5888	cmd.exe	141
PID 1128 wrote to memory of 5484	1128	cmd.exe	142
PID 1128 wrote to memory of 5648	1128	cmd.exe	143
PID 1128 wrote to memory of 2884	1128	cmd.exe	144
PID 2884 wrote to memory of 4772	2884	cmd.exe	145
PID 1128 wrote to memory of 6060	1128	cmd.exe	146
PID 1128 wrote to memory of 5268	1128	cmd.exe	147
PID 1128 wrote to memory of 4728	1128	cmd.exe	148
PID 1128 wrote to memory of 2388	1128	cmd.exe	149
PID 2388 wrote to memory of 5936	2388	cmd.exe	150
PID 1128 wrote to memory of 4524	1128	cmd.exe	151
PID 4524 wrote to memory of 2904	4524	cmd.exe	152
PID 1128 wrote to memory of 4448	1128	cmd.exe	153
PID 4448 wrote to memory of 2928	4448	cmd.exe	154
PID 1128 wrote to memory of 5652	1128	cmd.exe	155

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\VBS.cmd"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4348
- C:\Windows\System32\sc.exe
  "C:\Windows\System32\sc.exe" query Null
  2⤵
  - Launches sc.exe
  PID:5236
- C:\Windows\System32\find.exe
  find /i "RUNNING"
  2⤵
  PID:4564
- C:\Windows\System32\findstr.exe
  findstr /v "$" "VBS.cmd"
  2⤵
  PID:3772
- C:\Windows\System32\cmd.exe
  C:\Windows\System32\cmd.exe /S /D /c" echo "C:\Users\Admin\AppData\Local\Temp\VBS.cmd" "
  2⤵
  PID:4240
- C:\Windows\System32\find.exe
  find /i "C:\Users\Admin\AppData\Local\Temp"
  2⤵
  PID:2404
- C:\Windows\System32\net.exe
  net use C:
  2⤵
  PID:4216
- C:\Windows\System32\cmd.exe
  C:\Windows\System32\cmd.exe /S /D /c" echo "" "
  2⤵
  PID:5552
- C:\Windows\System32\find.exe
  find /i "-el"
  2⤵
  PID:1276
- C:\Windows\System32\fltMC.exe
  fltmc
  2⤵
  PID:1112
- C:\Windows\System32\cmd.exe
  C:\Windows\System32\cmd.exe /c echo prompt $E| cmd
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5312
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /S /D /c" echo prompt $E"
    3⤵
    PID:1152
- - C:\Windows\System32\cmd.exe
    cmd
    3⤵
    PID:4896
- C:\Windows\System32\cmd.exe
  C:\Windows\System32\cmd.exe /c ver
  2⤵
  PID:3312
- C:\Windows\System32\cmd.exe
  C:\Windows\System32\cmd.exe /c "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c $AssemblyBuilder = [AppDomain]::CurrentDomain.DefineDynamicAssembly(4, 1); $ModuleBuilder = $AssemblyBuilder.DefineDynamicModule(2, $False); $TypeBuilder = $ModuleBuilder.DefineType(0); $meth = $TypeBuilder.DefinePInvokeMethod('BrandingFormatString', 'winbrand.dll', 'Public, Static', 1, [String], @([String]), 1, 3); $meth.SetImplementationFlags(128); $TypeBuilder.CreateType()::BrandingFormatString('%WINDOWS_LONG%') -replace [string][char]0xa9, '' -replace [string][char]0xae, '' -replace [string][char]0x2122, ''"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5956
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c $AssemblyBuilder = [AppDomain]::CurrentDomain.DefineDynamicAssembly(4, 1); $ModuleBuilder = $AssemblyBuilder.DefineDynamicModule(2, $False); $TypeBuilder = $ModuleBuilder.DefineType(0); $meth = $TypeBuilder.DefinePInvokeMethod('BrandingFormatString', 'winbrand.dll', 'Public, Static', 1, [String], @([String]), 1, 3); $meth.SetImplementationFlags(128); $TypeBuilder.CreateType()::BrandingFormatString('%WINDOWS_LONG%') -replace [string][char]0xa9, '' -replace [string][char]0xae, '' -replace [string][char]0x2122, ''
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4396
- C:\Windows\System32\cmd.exe
  C:\Windows\System32\cmd.exe /S /D /c" echo "Windows 11 IoT Enterprise LTSC" "
  2⤵
  PID:4592
- C:\Windows\System32\find.exe
  find /i "Windows"
  2⤵
  PID:1472
- C:\Windows\System32\cmd.exe
  C:\Windows\System32\cmd.exe /c reg query "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Environment" /v PROCESSOR_ARCHITECTURE 2>nul
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3032
- - C:\Windows\System32\reg.exe
    reg query "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Environment" /v PROCESSOR_ARCHITECTURE
    3⤵
    PID:2748
- C:\Windows\System32\cmd.exe
  C:\Windows\System32\cmd.exe /c ver
  2⤵
  - Executes a command shell one-liner
  PID:1828
- C:\Windows\System32\reg.exe
  reg query "HKCU\Console" /v ForceV2
  2⤵
  PID:2608
- C:\Windows\System32\find.exe
  find /i "0x0"
  2⤵
  PID:2448
- C:\Windows\System32\cmd.exe
  C:\Windows\System32\cmd.exe /c reg query "HKCU\Console" /v VirtualTerminalLevel 2>nul
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2560
- - C:\Windows\System32\reg.exe
    reg query "HKCU\Console" /v VirtualTerminalLevel
    3⤵
    PID:4532
- C:\Windows\System32\cmd.exe
  C:\Windows\System32\cmd.exe /c bcdedit /enum {current} /v 2>nul
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2352
- - C:\Windows\System32\bcdedit.exe
    bcdedit /enum {current} /v
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:3412
- C:\Windows\System32\cmd.exe
  C:\Windows\System32\cmd.exe /c C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "if ($PSVersionTable.PSEdition -ne 'Core') {$f=[IO.File]::ReadAllText($env:_cmdf) -split ':pstst';. ([scriptblock]::Create($f[1]))}" 2>nul
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:6120
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "if ($PSVersionTable.PSEdition -ne 'Core') {$f=[IO.File]::ReadAllText($env:_cmdf) -split ':pstst';. ([scriptblock]::Create($f[1]))}"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4128
- C:\Windows\System32\cmd.exe
  C:\Windows\System32\cmd.exe /c mode con
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3172
- - C:\Windows\System32\mode.com
    mode con
    3⤵
    PID:2288
- C:\Windows\System32\reg.exe
  reg query HKCU\Console /v QuickEdit
  2⤵
  - Modifies registry key
  PID:3732
- C:\Windows\System32\find.exe
  find /i "0x0"
  2⤵
  PID:4084
- C:\Windows\System32\reg.exe
  reg add HKCU\Console /v QuickEdit /t REG_DWORD /d 0 /f
  2⤵
  - Modifies registry key
  PID:4108
- C:\Windows\System32\cmd.exe
  cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\VBS.cmd" -qedit"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1128
- - C:\Windows\System32\sc.exe
    "C:\Windows\System32\sc.exe" query Null
    3⤵
    - Launches sc.exe
    PID:3820
- - C:\Windows\System32\find.exe
    find /i "RUNNING"
    3⤵
    PID:2956
- - C:\Windows\System32\findstr.exe
    findstr /v "$" "VBS.cmd"
    3⤵
    PID:4480
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /S /D /c" echo "C:\Users\Admin\AppData\Local\Temp\VBS.cmd" "
    3⤵
    PID:992
- - C:\Windows\System32\find.exe
    find /i "C:\Users\Admin\AppData\Local\Temp"
    3⤵
    PID:3940
- - C:\Windows\System32\net.exe
    net use C:
    3⤵
    PID:1284
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /S /D /c" echo "-qedit" "
    3⤵
    PID:5784
- - C:\Windows\System32\find.exe
    find /i "-el"
    3⤵
    PID:1404
- - C:\Windows\System32\fltMC.exe
    fltmc
    3⤵
    PID:620
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /c echo prompt $E| cmd
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4992
  - - C:\Windows\System32\cmd.exe
      C:\Windows\System32\cmd.exe /S /D /c" echo prompt $E"
      4⤵
      PID:924
  - - C:\Windows\System32\cmd.exe
      cmd
      4⤵
      PID:4516
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /c ver
    3⤵
    - Executes a command shell one-liner
    PID:2912
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /c "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c $AssemblyBuilder = [AppDomain]::CurrentDomain.DefineDynamicAssembly(4, 1); $ModuleBuilder = $AssemblyBuilder.DefineDynamicModule(2, $False); $TypeBuilder = $ModuleBuilder.DefineType(0); $meth = $TypeBuilder.DefinePInvokeMethod('BrandingFormatString', 'winbrand.dll', 'Public, Static', 1, [String], @([String]), 1, 3); $meth.SetImplementationFlags(128); $TypeBuilder.CreateType()::BrandingFormatString('%WINDOWS_LONG%') -replace [string][char]0xa9, '' -replace [string][char]0xae, '' -replace [string][char]0x2122, ''"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5888
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c $AssemblyBuilder = [AppDomain]::CurrentDomain.DefineDynamicAssembly(4, 1); $ModuleBuilder = $AssemblyBuilder.DefineDynamicModule(2, $False); $TypeBuilder = $ModuleBuilder.DefineType(0); $meth = $TypeBuilder.DefinePInvokeMethod('BrandingFormatString', 'winbrand.dll', 'Public, Static', 1, [String], @([String]), 1, 3); $meth.SetImplementationFlags(128); $TypeBuilder.CreateType()::BrandingFormatString('%WINDOWS_LONG%') -replace [string][char]0xa9, '' -replace [string][char]0xae, '' -replace [string][char]0x2122, ''
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1300
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /S /D /c" echo "Windows 11 IoT Enterprise LTSC" "
    3⤵
    PID:5484
- - C:\Windows\System32\find.exe
    find /i "Windows"
    3⤵
    PID:5648
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /c reg query "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Environment" /v PROCESSOR_ARCHITECTURE 2>nul
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2884
  - - C:\Windows\System32\reg.exe
      reg query "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Environment" /v PROCESSOR_ARCHITECTURE
      4⤵
      PID:4772
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /c ver
    3⤵
    - Executes a command shell one-liner
    PID:6060
- - C:\Windows\System32\reg.exe
    reg query "HKCU\Console" /v ForceV2
    3⤵
    PID:5268
- - C:\Windows\System32\find.exe
    find /i "0x0"
    3⤵
    PID:4728
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /c reg query "HKCU\Console" /v VirtualTerminalLevel 2>nul
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2388
  - - C:\Windows\System32\reg.exe
      reg query "HKCU\Console" /v VirtualTerminalLevel
      4⤵
      PID:5936
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /c bcdedit /enum {current} /v 2>nul
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4524
  - - C:\Windows\System32\bcdedit.exe
      bcdedit /enum {current} /v
      4⤵
      Modifies boot configuration data using bcdedit
      PID:2904
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /c C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "if ($PSVersionTable.PSEdition -ne 'Core') {$f=[IO.File]::ReadAllText($env:_cmdf) -split ':pstst';. ([scriptblock]::Create($f[1]))}" 2>nul
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4448
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "if ($PSVersionTable.PSEdition -ne 'Core') {$f=[IO.File]::ReadAllText($env:_cmdf) -split ':pstst';. ([scriptblock]::Create($f[1]))}"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2928
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /c mode con
    3⤵
    - Executes a command shell one-liner
    PID:5652
  - - C:\Windows\System32\mode.com
      mode con
      4⤵
      PID:1608
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /c reg query "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /v Desktop
    3⤵
    - Executes a command shell one-liner
    PID:1352
  - - C:\Windows\System32\reg.exe
      reg query "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /v Desktop
      4⤵
      PID:2256
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /c reg query "HKLM\HARDWARE\DESCRIPTION\System\BIOS" /v BaseBoardManufacturer 2>nul | findstr /i "Parallels"
    3⤵
    - Executes a command shell one-liner
    PID:1000
  - - C:\Windows\System32\reg.exe
      reg query "HKLM\HARDWARE\DESCRIPTION\System\BIOS" /v BaseBoardManufacturer
      4⤵
      Enumerates system info in registry
      PID:2556
  - - C:\Windows\System32\findstr.exe
      findstr /i "Parallels"
      4⤵
      PID:4444
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /c reg query "HKLM\HARDWARE\DESCRIPTION\System\BIOS" /v BaseBoardProduct 2>nul | findstr /i "Parallels"
    3⤵
    - Executes a command shell one-liner
    PID:1740
  - - C:\Windows\System32\reg.exe
      reg query "HKLM\HARDWARE\DESCRIPTION\System\BIOS" /v BaseBoardProduct
      4⤵
      Enumerates system info in registry
      PID:764
  - - C:\Windows\System32\findstr.exe
      findstr /i "Parallels"
      4⤵
      PID:4648
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /c reg query "HKLM\HARDWARE\DESCRIPTION\System\BIOS" /v BIOSVendor 2>nul | findstr /i "Parallels"
    3⤵
    - Executes a command shell one-liner
    PID:4284
  - - C:\Windows\System32\reg.exe
      reg query "HKLM\HARDWARE\DESCRIPTION\System\BIOS" /v BIOSVendor
      4⤵
      Enumerates system info in registry
      PID:5432
  - - C:\Windows\System32\findstr.exe
      findstr /i "Parallels"
      4⤵
      PID:4668
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /c reg query "HKLM\HARDWARE\DESCRIPTION\System\BIOS" /v SystemFamily 2>nul | findstr /i "Parallels"
    3⤵
    - Executes a command shell one-liner
    PID:4536
  - - C:\Windows\System32\reg.exe
      reg query "HKLM\HARDWARE\DESCRIPTION\System\BIOS" /v SystemFamily
      4⤵
      Enumerates system info in registry
      PID:4272
  - - C:\Windows\System32\findstr.exe
      findstr /i "Parallels"
      4⤵
      PID:6048
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /c reg query "HKLM\HARDWARE\DESCRIPTION\System\BIOS" /v SystemManufacturer 2>nul | findstr /i "Parallels"
    3⤵
    - Executes a command shell one-liner
    PID:2860
  - - C:\Windows\System32\reg.exe
      reg query "HKLM\HARDWARE\DESCRIPTION\System\BIOS" /v SystemManufacturer
      4⤵
      Enumerates system info in registry
      PID:1264
  - - C:\Windows\System32\findstr.exe
      findstr /i "Parallels"
      4⤵
      PID:1172
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /c reg query "HKLM\HARDWARE\DESCRIPTION\System\BIOS" /v SystemProductName 2>nul | findstr /i "Parallels"
    3⤵
    - Executes a command shell one-liner
    PID:4328
  - - C:\Windows\System32\reg.exe
      reg query "HKLM\HARDWARE\DESCRIPTION\System\BIOS" /v SystemProductName
      4⤵
      Enumerates system info in registry
      PID:4296
  - - C:\Windows\System32\findstr.exe
      findstr /i "Parallels"
      4⤵
      PID:2988
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /c reg query "HKLM\HARDWARE\DESCRIPTION\System\BIOS" /v SystemSKU 2>nul | findstr /i "Parallels"
    3⤵
    - Executes a command shell one-liner
    PID:1360
  - - C:\Windows\System32\reg.exe
      reg query "HKLM\HARDWARE\DESCRIPTION\System\BIOS" /v SystemSKU
      4⤵
      Enumerates system info in registry
      PID:1988
  - - C:\Windows\System32\findstr.exe
      findstr /i "Parallels"
      4⤵
      PID:3180
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /c C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "try{Confirm-SecureBootUEFI}catch [System.PlatformNotSupportedException]{$false}catch{if($_.Exception.Message.Contains('0xC0000100')){$false}}" 2>nul
    3⤵
    - Executes a command shell one-liner
    PID:5816
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "try{Confirm-SecureBootUEFI}catch [System.PlatformNotSupportedException]{$false}catch{if($_.Exception.Message.Contains('0xC0000100')){$false}}"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3768
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "&{$W=$Host.UI.RawUI.WindowSize;$B=$Host.UI.RawUI.BufferSize;$W.Height=32;$B.Height=300;$Host.UI.RawUI.WindowSize=$W;$Host.UI.RawUI.BufferSize=$B;}"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3168
- - C:\Windows\System32\choice.exe
    choice /C:1234 /N /M "[1] Continue [2] Exit [3] Revert Changes [4] Troubleshoot:
    3⤵
    PID:5672
- - C:\Windows\System32\cmd.exe
    cmd /c "wmic path Win32_ComputerSystem get CreationClassName /value"
    3⤵
    PID:1664
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic path Win32_ComputerSystem get CreationClassName /value
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4068
- - C:\Windows\System32\find.exe
    find /i "computersystem"
    3⤵
    PID:4604
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /c wmic path Win32_ComputerSystem get CreationClassName /value 2>nul | find /i "computersystem"
    3⤵
    - Executes a command shell one-liner
    PID:2152
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic path Win32_ComputerSystem get CreationClassName /value
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3244
  - - C:\Windows\System32\find.exe
      find /i "computersystem"
      4⤵
      PID:4876
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /c C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "(Get-CimInstance Win32_ComputerSystem).HypervisorPresent"
    3⤵
    - Executes a command shell one-liner
    PID:5296
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "(Get-CimInstance Win32_ComputerSystem).HypervisorPresent"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:3420
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /c C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "(Get-CimInstance -ClassName Win32_Processor).VirtualizationFirmwareEnabled"
    3⤵
    - Executes a command shell one-liner
    PID:1276
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "(Get-CimInstance -ClassName Win32_Processor).VirtualizationFirmwareEnabled"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:3196
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /c C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "$t=Add-Type -PassThru -MemberDefinition '[DllImport(\"ntdll.dll\")] public static extern uint NtQuerySystemInformation(int c,IntPtr b,uint s,out uint r);' -Name CI2 -Namespace w2; $p=[Runtime.InteropServices.Marshal]::AllocHGlobal(8); [Runtime.InteropServices.Marshal]::WriteInt32($p,8); $r=[uint32]0; $t::NtQuerySystemInformation(103,$p,8,[ref]$r)|Out-Null; $o=[uint32][Runtime.InteropServices.Marshal]::ReadInt32($p,4); if(-not($o -band 1)){0}elseif($o -band 2){1}else{2}" 2>nul
    3⤵
    - Executes a command shell one-liner
    PID:4340
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "$t=Add-Type -PassThru -MemberDefinition '[DllImport(\"ntdll.dll\")] public static extern uint NtQuerySystemInformation(int c,IntPtr b,uint s,out uint r);' -Name CI2 -Namespace w2; $p=[Runtime.InteropServices.Marshal]::AllocHGlobal(8); [Runtime.InteropServices.Marshal]::WriteInt32($p,8); $r=[uint32]0; $t::NtQuerySystemInformation(103,$p,8,[ref]$r)|Out-Null; $o=[uint32][Runtime.InteropServices.Marshal]::ReadInt32($p,4); if(-not($o -band 1)){0}elseif($o -band 2){1}else{2}"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:1652
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\xja3obp1\xja3obp1.cmdline"
        5⤵
        
        PID:2596
      - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES81B9.tmp" "c:\Users\Admin\AppData\Local\Temp\xja3obp1\CSC17F2CD1C52BF48EA9264CDCF1BCB3672.TMP"
        6⤵
        
        PID:600
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /c reg query "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\WindowsHello" /v Enabled 2>nul
    3⤵
    - Executes a command shell one-liner
    PID:2096
  - - C:\Windows\System32\reg.exe
      reg query "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\WindowsHello" /v Enabled
      4⤵
      PID:2104
- - C:\Windows\System32\fltMC.exe
    fltmc
    3⤵
    PID:5124
- - C:\Windows\System32\findstr.exe
    findstr /i "FACEIT"
    3⤵
    PID:2592
- - C:\Windows\System32\sc.exe
    sc query MacType
    3⤵
    - Launches sc.exe
    PID:4168
- - C:\Windows\System32\findstr.exe
    findstr /i "RUNNING"
    3⤵
    PID:5016
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /c reg query "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard" /s 2>nul
    3⤵
    - Executes a command shell one-liner
    PID:2520
  - - C:\Windows\System32\reg.exe
      reg query "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard" /s
      4⤵
      PID:3264
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /c reg query "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard" /v Locked 2>nul
    3⤵
    - Executes a command shell one-liner
    PID:2132
  - - C:\Windows\System32\reg.exe
      reg query "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard" /v Locked
      4⤵
      PID:204
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /c reg query "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\HypervisorEnforcedCodeIntegrity" /v Locked 2>nul
    3⤵
    - Executes a command shell one-liner
    PID:1816
  - - C:\Windows\System32\reg.exe
      reg query "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\HypervisorEnforcedCodeIntegrity" /v Locked
      4⤵
      PID:2992
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /c reg query "HKLM\SYSTEM\CurrentControlSet\Control\Lsa" /v LsaCfgFlags 2>nul
    3⤵
    - Executes a command shell one-liner
    PID:2956
  - - C:\Windows\System32\reg.exe
      reg query "HKLM\SYSTEM\CurrentControlSet\Control\Lsa" /v LsaCfgFlags
      4⤵
      PID:5748
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /c reg query "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard" /v Mandatory 2>nul
    3⤵
    - Executes a command shell one-liner
    PID:2188
  - - C:\Windows\System32\reg.exe
      reg query "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard" /v Mandatory
      4⤵
      PID:992
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /c reg query "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\SecureBiometrics" /v Enabled 2>nul
    3⤵
    - Executes a command shell one-liner
    PID:3940
  - - C:\Windows\System32\reg.exe
      reg query "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\SecureBiometrics" /v Enabled
      4⤵
      PID:6052
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /c reg query "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios" /v SecureBiometrics 2>nul
    3⤵
    - Executes a command shell one-liner
    PID:1280
  - - C:\Windows\System32\reg.exe
      reg query "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios" /v SecureBiometrics
      4⤵
      PID:5784
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /c reg query "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\WindowsHelloSecureBiometrics" /v Enabled 2>nul
    3⤵
    - Executes a command shell one-liner
    PID:2296
  - - C:\Windows\System32\reg.exe
      reg query "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\WindowsHelloSecureBiometrics" /v Enabled
      4⤵
      PID:620
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /c reg query "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\SecureFingerprint" /v Enabled 2>nul
    3⤵
    PID:4796
  - - C:\Windows\System32\reg.exe
      reg query "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\SecureFingerprint" /v Enabled
      4⤵
      PID:4792
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /c reg query "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios" /v SecureFingerprint 2>nul
    3⤵
    - Executes a command shell one-liner
    PID:3548
  - - C:\Windows\System32\reg.exe
      reg query "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios" /v SecureFingerprint
      4⤵
      PID:2912
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /c reg query "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\WindowsHelloSecureFingerprint" /v Enabled 2>nul
    3⤵
    - Executes a command shell one-liner
    PID:5692
  - - C:\Windows\System32\reg.exe
      reg query "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\WindowsHelloSecureFingerprint" /v Enabled
      4⤵
      PID:1500
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /c reg query "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\HyperGuard" /v Enabled 2>nul
    3⤵
    - Executes a command shell one-liner
    PID:3776
  - - C:\Windows\System32\reg.exe
      reg query "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\HyperGuard" /v Enabled
      4⤵
      PID:5660
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /c reg query "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\Host-Guardian" /v Enabled 2>nul
    3⤵
    - Executes a command shell one-liner
    PID:5588
  - - C:\Windows\System32\reg.exe
      reg query "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\Host-Guardian" /v Enabled
      4⤵
      PID:1752
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /c reg query "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard" /v EnableVirtualizationBasedSecurity 2>nul
    3⤵
    - Executes a command shell one-liner
    PID:2532
  - - C:\Windows\System32\reg.exe
      reg query "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard" /v EnableVirtualizationBasedSecurity
      4⤵
      PID:2512
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /c reg query "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard" /v RequirePlatformSecurityFeatures 2>nul
    3⤵
    - Executes a command shell one-liner
    PID:3252
  - - C:\Windows\System32\reg.exe
      reg query "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard" /v RequirePlatformSecurityFeatures
      4⤵
      PID:5484
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /c reg query "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\SystemGuard" /v Enabled 2>nul
    3⤵
    - Executes a command shell one-liner
    PID:3116
  - - C:\Windows\System32\reg.exe
      reg query "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\SystemGuard" /v Enabled
      4⤵
      PID:4772
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /c C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "(Get-CimInstance -ClassName Win32_DeviceGuard -Namespace root\Microsoft\Windows\DeviceGuard).SecurityServicesRunning" 2>nul
    3⤵
    - Executes a command shell one-liner
    PID:5960
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "(Get-CimInstance -ClassName Win32_DeviceGuard -Namespace root\Microsoft\Windows\DeviceGuard).SecurityServicesRunning"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:6072
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /c reg query "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\HypervisorEnforcedCodeIntegrity" /v Enabled 2>nul
    3⤵
    - Executes a command shell one-liner
    PID:5380
  - - C:\Windows\System32\reg.exe
      reg query "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\HypervisorEnforcedCodeIntegrity" /v Enabled
      4⤵
      PID:4416
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /c C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "(Get-CimInstance -ClassName Win32_DeviceGuard -Namespace root\Microsoft\Windows\DeviceGuard).SecurityServicesRunning" 2>nul
    3⤵
    - Executes a command shell one-liner
    PID:4344
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "(Get-CimInstance -ClassName Win32_DeviceGuard -Namespace root\Microsoft\Windows\DeviceGuard).SecurityServicesRunning"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:1072
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /c reg query "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard" /v DisableHypervisorEnforcedPagingTranslation 2>nul
    3⤵
    - Executes a command shell one-liner
    PID:4832
  - - C:\Windows\System32\reg.exe
      reg query "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard" /v DisableHypervisorEnforcedPagingTranslation
      4⤵
      PID:2932
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /c reg query "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\CredentialGuard" /v Enabled 2>nul
    3⤵
    PID:2680
  - - C:\Windows\System32\reg.exe
      reg query "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\CredentialGuard" /v Enabled
      4⤵
      PID:5108
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /c reg query "HKLM\SYSTEM\CurrentControlSet\Control\Lsa" /v LsaCfgFlags 2>nul
    3⤵
    - Executes a command shell one-liner
    PID:2676
  - - C:\Windows\System32\reg.exe
      reg query "HKLM\SYSTEM\CurrentControlSet\Control\Lsa" /v LsaCfgFlags
      4⤵
      PID:4452
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /c reg query "HKLM\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard" /v LsaCfgFlags 2>nul
    3⤵
    - Executes a command shell one-liner
    PID:2264
  - - C:\Windows\System32\reg.exe
      reg query "HKLM\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard" /v LsaCfgFlags
      4⤵
      PID:5828
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /c C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "$d=Add-Type -MemberDefinition '[DllImport(\"ntdll.dll\")] public static extern int NtQuerySystemInformation(uint a,IntPtr b,uint c,IntPtr d);' -Name n -Namespace w -PassThru;$p=[Runtime.InteropServices.Marshal]::AllocHGlobal(4);$r=[Runtime.InteropServices.Marshal]::AllocHGlobal(4);$ret=$d::NtQuerySystemInformation(196,$p,4,$r);if($ret -eq 0){$f=[uint32][Runtime.InteropServices.Marshal]::ReadInt32($p);if(($f -band 0x01)-ne 0 -or (($f -band 0x20)-ne 0 -and ($f -band 0x10)-ne 0)){Write-Output 1}else{Write-Output 0}}else{Write-Output 0}" 2>nul
    3⤵
    - Executes a command shell one-liner
    PID:824
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "$d=Add-Type -MemberDefinition '[DllImport(\"ntdll.dll\")] public static extern int NtQuerySystemInformation(uint a,IntPtr b,uint c,IntPtr d);' -Name n -Namespace w -PassThru;$p=[Runtime.InteropServices.Marshal]::AllocHGlobal(4);$r=[Runtime.InteropServices.Marshal]::AllocHGlobal(4);$ret=$d::NtQuerySystemInformation(196,$p,4,$r);if($ret -eq 0){$f=[uint32][Runtime.InteropServices.Marshal]::ReadInt32($p);if(($f -band 0x01)-ne 0 -or (($f -band 0x20)-ne 0 -and ($f -band 0x10)-ne 0)){Write-Output 1}else{Write-Output 0}}else{Write-Output 0}"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:1100
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\2sshxrco\2sshxrco.cmdline"
        5⤵
        
        PID:4936
      - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES91B7.tmp" "c:\Users\Admin\AppData\Local\Temp\2sshxrco\CSC262CB5FBAC3E408AABD99CE742197856.TMP"
        6⤵
        
        PID:4644
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /c bcdedit /enum {c0a23914-7be3-11f1-8f87-db87fe0923f2} 2>nul | findstr /i "hypervisorlaunchtype"
    3⤵
    - Executes a command shell one-liner
    PID:2316
  - - C:\Windows\System32\bcdedit.exe
      bcdedit /enum {c0a23914-7be3-11f1-8f87-db87fe0923f2}
      4⤵
      Modifies boot configuration data using bcdedit
      PID:1272
  - - C:\Windows\System32\findstr.exe
      findstr /i "hypervisorlaunchtype"
      4⤵
      PID:5448
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /c bcdedit /enum {hypervisorsettings} 2>nul | findstr /i "hypervisorlaunchtype"
    3⤵
    PID:3120
  - - C:\Windows\System32\bcdedit.exe
      bcdedit /enum {hypervisorsettings}
      4⤵
      Modifies boot configuration data using bcdedit
      PID:5400
  - - C:\Windows\System32\findstr.exe
      findstr /i "hypervisorlaunchtype"
      4⤵
      PID:3768
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /c bcdedit /enum {bootloadersettings} 2>nul | findstr /i "hypervisorlaunchtype"
    3⤵
    PID:4304
  - - C:\Windows\System32\bcdedit.exe
      bcdedit /enum {bootloadersettings}
      4⤵
      Modifies boot configuration data using bcdedit
      PID:2916
  - - C:\Windows\System32\findstr.exe
      findstr /i "hypervisorlaunchtype"
      4⤵
      PID:2968
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /c dism /online /english /Get-FeatureInfo /FeatureName:Microsoft-Windows-Subsystem-Linux 2>nul | findstr /i "State"
    3⤵
    - Executes a command shell one-liner
    PID:5412
  - - C:\Windows\System32\Dism.exe
      dism /online /english /Get-FeatureInfo /FeatureName:Microsoft-Windows-Subsystem-Linux
      4⤵
      Drops file in Windows directory
      PID:5280
    - - C:\Windows\System32\Dism\dismhost.exe
        
        C:\Windows\System32\Dism\dismhost.exe {01DA3390-2D1F-4B07-8B38-2FCC48F9F078}
        5⤵
        Drops file in Windows directory
        
        PID:3828
  - - C:\Windows\System32\findstr.exe
      findstr /i "State"
      4⤵
      PID:3168
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /c dism /online /english /Get-FeatureInfo /FeatureName:Containers-DisposableClientVM 2>nul | findstr /i "State"
    3⤵
    PID:4604
  - - C:\Windows\System32\Dism.exe
      dism /online /english /Get-FeatureInfo /FeatureName:Containers-DisposableClientVM
      4⤵
      Drops file in Windows directory
      PID:5636
    - - C:\Windows\System32\Dism\dismhost.exe
        
        C:\Windows\System32\Dism\dismhost.exe {63DEADA2-EEAC-4185-807F-8791A4529002}
        5⤵
        Drops file in Windows directory
        
        PID:1236
  - - C:\Windows\System32\findstr.exe
      findstr /i "State"
      4⤵
      PID:2072
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /c dism /online /english /Get-FeatureInfo /FeatureName:Microsoft-Hyper-V-All 2>nul | findstr /i "State"
    3⤵
    - Executes a command shell one-liner
    PID:4240
  - - C:\Windows\System32\Dism.exe
      dism /online /english /Get-FeatureInfo /FeatureName:Microsoft-Hyper-V-All
      4⤵
      Drops file in Windows directory
      PID:4100
    - - C:\Windows\System32\Dism\dismhost.exe
        
        C:\Windows\System32\Dism\dismhost.exe {0548D54A-A2BD-42D2-AC82-70E4FD69F560}
        5⤵
        Drops file in Windows directory
        
        PID:636
  - - C:\Windows\System32\findstr.exe
      findstr /i "State"
      4⤵
      PID:5112
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /c dism /online /english /Get-FeatureInfo /FeatureName:VirtualMachinePlatform 2>nul | findstr /i "State"
    3⤵
    - Executes a command shell one-liner
    PID:2612
  - - C:\Windows\System32\Dism.exe
      dism /online /english /Get-FeatureInfo /FeatureName:VirtualMachinePlatform
      4⤵
      Drops file in Windows directory
      PID:1152
    - - C:\Windows\System32\Dism\dismhost.exe
        
        C:\Windows\System32\Dism\dismhost.exe {F32213EB-3ECE-4849-B69E-2ECC87C9C5FD}
        5⤵
        Drops file in Windows directory
        
        PID:4636
  - - C:\Windows\System32\findstr.exe
      findstr /i "State"
      4⤵
      PID:3084
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /c dism /online /english /Get-FeatureInfo /FeatureName:HypervisorPlatform 2>nul | findstr /i "State"
    3⤵
    PID:600
  - - C:\Windows\System32\Dism.exe
      dism /online /english /Get-FeatureInfo /FeatureName:HypervisorPlatform
      4⤵
      Drops file in Windows directory
      PID:2712
    - - C:\Windows\System32\Dism\dismhost.exe
        
        C:\Windows\System32\Dism\dismhost.exe {2C9E6913-55BE-4B32-8F02-95477B4B4EB1}
        5⤵
        Drops file in Windows directory
        
        PID:3464
  - - C:\Windows\System32\findstr.exe
      findstr /i "State"
      4⤵
      PID:5028
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /c C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "(Get-CimInstance -ClassName Win32_DeviceGuard -Namespace root\Microsoft\Windows\DeviceGuard).VirtualizationBasedSecurityStatus" 2>nul
    3⤵
    PID:4148
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "(Get-CimInstance -ClassName Win32_DeviceGuard -Namespace root\Microsoft\Windows\DeviceGuard).VirtualizationBasedSecurityStatus"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:5016
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /c C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "(Get-CimInstance Win32_ComputerSystem).HypervisorPresent" 2>nul
    3⤵
    - Executes a command shell one-liner
    PID:6104
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "(Get-CimInstance Win32_ComputerSystem).HypervisorPresent"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:1316
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /c bcdedit /enum {c0a23914-7be3-11f1-8f87-db87fe0923f2} 2>nul | findstr /i "vsmlaunchtype"
    3⤵
    - Executes a command shell one-liner
    PID:2816
  - - C:\Windows\System32\bcdedit.exe
      bcdedit /enum {c0a23914-7be3-11f1-8f87-db87fe0923f2}
      4⤵
      Modifies boot configuration data using bcdedit
      PID:4388
  - - C:\Windows\System32\findstr.exe
      findstr /i "vsmlaunchtype"
      4⤵
      PID:5564
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /c reg query "HKLM\SYSTEM\CurrentControlSet\Control\CI\Policy" /v VerifiedAndReputablePolicyState 2>nul
    3⤵
    - Executes a command shell one-liner
    PID:2904
  - - C:\Windows\System32\reg.exe
      reg query "HKLM\SYSTEM\CurrentControlSet\Control\CI\Policy" /v VerifiedAndReputablePolicyState
      4⤵
      PID:1732
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /c C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "(Get-CimInstance -Namespace root\SecurityCenter2 -Class AntiVirusProduct | Where-Object displayName -eq 'Bitdefender Antivirus').displayName"
    3⤵
    - Executes a command shell one-liner
    PID:2364
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "(Get-CimInstance -Namespace root\SecurityCenter2 -Class AntiVirusProduct | Where-Object displayName -eq 'Bitdefender Antivirus').displayName"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:4984
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "if ((Get-Process explorer).Modules.ModuleName -like '*MacType*'){exit 3}"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5952
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /c bcdedit /enum {c0a23914-7be3-11f1-8f87-db87fe0923f2} 2>nul | findstr /i "testsigning"
    3⤵
    - Executes a command shell one-liner
    PID:716
  - - C:\Windows\System32\bcdedit.exe
      bcdedit /enum {c0a23914-7be3-11f1-8f87-db87fe0923f2}
      4⤵
      Modifies boot configuration data using bcdedit
      PID:4292
  - - C:\Windows\System32\findstr.exe
      findstr /i "testsigning"
      4⤵
      PID:5432
- - C:\Windows\System32\bcdedit.exe
    bcdedit /set {c0a23914-7be3-11f1-8f87-db87fe0923f2} testsigning on
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:4268
- - C:\Windows\System32\reg.exe
    reg add "HKLM\SOFTWARE\ManageVBS" /v TestSigning /t REG_DWORD /d 1 /f
    3⤵
    PID:4452
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /c bcdedit /enum {c0a23914-7be3-11f1-8f87-db87fe0923f2} 2>nul | findstr /i "bootmenupolicy"
    3⤵
    PID:3672
  - - C:\Windows\System32\bcdedit.exe
      bcdedit /enum {c0a23914-7be3-11f1-8f87-db87fe0923f2}
      4⤵
      Modifies boot configuration data using bcdedit
      PID:1264
  - - C:\Windows\System32\findstr.exe
      findstr /i "bootmenupolicy"
      4⤵
      PID:3180
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /c bcdedit /enum all 2>nul | findstr /i "advancedoptions"
    3⤵
    - Executes a command shell one-liner
    PID:4204
  - - C:\Windows\System32\bcdedit.exe
      bcdedit /enum all
      4⤵
      Modifies boot configuration data using bcdedit
      PID:1820
  - - C:\Windows\System32\findstr.exe
      findstr /i "advancedoptions"
      4⤵
      PID:3308
- - C:\Windows\System32\choice.exe
    choice /C:12 /N /M "[1] Restart Now [2] Restart Later:
    3⤵
    PID:4644
- - C:\Windows\System32\shutdown.exe
    shutdown /r /t 0
    3⤵
    PID:4872
- C:\Windows\System32\reg.exe
  reg add HKCU\Console /v QuickEdit /t REG_DWORD /d 1 /f
  2⤵
  - Modifies registry key
  PID:3352

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa398e855 /state1:0x41c64e6d
1⤵
PID:3240

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:4876

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k CameraMonitor
1⤵
PID:5284

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact