Analysis
- user interaction
yes - max time kernel
120s - max time network
121s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
05/08/2026, 04:36
General
- Target https://github.com/AdventDevInc/kudu/releases/download/v1.48.0/Kudu-Setup-1.48.0.exe
- Sample260805-e795dsybpe
Score
8/10
Malware Config
Signatures
- Downloads MZ/PE file 1 IoCs
- Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 5 IoCs
- Loads dropped DLL 16 IoCs
- Reads ssh keys stored on the system 2 TTPs
Tries to access SSH used by SSH programs.
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Command and Scripting Interpreter: PowerShell 1 TTPs 6 IoCs
Run Powershell to get system information.
- Network Service Discovery 1 TTPs 1 IoCs
Attempt to gather information on host's network.
- Drops file in Program Files directory 64 IoCs
- Hide Artifacts: Ignore Process Interrupts 1 TTPs 1 IoCs
Command interpreters often include specific commands/flags that ignore errors and other hangups.
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 5 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Checks processor information in registry 2 TTPs 26 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Modifies data under HKEY_USERS 2 IoCs
- Modifies registry class 1 IoCs
- Runs net.exe
- Suspicious behavior: EnumeratesProcesses 26 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of FindShellTrayWindow 47 IoCs
- Suspicious use of SendNotifyMessage 32 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 55 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://github.com/AdventDevInc/kudu/releases/download/v1.48.0/Kudu-Setup-1.48.0.exe1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ff90109c728,0x7ff90109c734,0x7ff90109c7402⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1672,i,11297380532324854416,12258540432655086794,262144 --field-trial-handle=2008,i,5171207466386907101,3286395741221770878,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2004 /prefetch:22⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1568,i,14590985972250827447,2638251695076540663,524288 --field-trial-handle=2008,i,5171207466386907101,3286395741221770878,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2264 /prefetch:32⤵
- Downloads MZ/PE file
- System Time Discovery
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2372,i,229132381256732704,2962417084056441789,524288 --field-trial-handle=2008,i,5171207466386907101,3286395741221770878,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2380 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3216,i,12170554075984638155,201049151526799546,2097152 --field-trial-handle=2008,i,5171207466386907101,3286395741221770878,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3228 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3220,i,10879185464891775080,7510683348792853147,2097152 --field-trial-handle=2008,i,5171207466386907101,3286395741221770878,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3268 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4404,i,15553274856553601945,9029269334792404756,2097152 --field-trial-handle=2008,i,5171207466386907101,3286395741221770878,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4408 /prefetch:22⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5504,i,7133610606109785566,916120819946117660,524288 --field-trial-handle=2008,i,5171207466386907101,3286395741221770878,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5632 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=6104,i,12783918784564295693,5734009429329973852,2097152 --field-trial-handle=2008,i,5171207466386907101,3286395741221770878,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5208 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=3280,i,34486965373217733,3448667611004856054,2097152 --field-trial-handle=2008,i,5171207466386907101,3286395741221770878,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4652 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5380,i,17618378823981463572,684351079293966852,2097152 --field-trial-handle=2008,i,5171207466386907101,3286395741221770878,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5968 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6112,i,7325491087584241470,9449762467651839582,524288 --field-trial-handle=2008,i,5171207466386907101,3286395741221770878,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6072 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6120,i,2826875651053171714,648661042181515399,524288 --field-trial-handle=2008,i,5171207466386907101,3286395741221770878,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6124 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6068,i,3332723334375724680,7189783594835068765,524288 --field-trial-handle=2008,i,5171207466386907101,3286395741221770878,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5668 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=6068,i,13788869410887512922,6863234681133871871,2097152 --field-trial-handle=2008,i,5171207466386907101,3286395741221770878,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5668 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=4492,i,1543552375432641764,11647635902711648179,524288 --field-trial-handle=2008,i,5171207466386907101,3286395741221770878,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6012 /prefetch:82⤵
-
-
C:\Users\Admin\Downloads\Kudu-Setup-1.48.0.exe"C:\Users\Admin\Downloads\Kudu-Setup-1.48.0.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -C "if (Get-Command Get-CimInstance -ErrorAction SilentlyContinue) { exit 0 } else { exit 1 }"3⤵
- Hide Artifacts: Ignore Process Interrupts
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -C "if ((Get-ExecutionPolicy -Scope Process) -eq 'Restricted') { exit 1 } else { exit 0 }"3⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -C "if ((Get-CimInstance -ClassName Win32_Process | ? {$_.Path -and $_.Path.StartsWith('C:\Program Files\Kudu', 'CurrentCultureIgnoreCase')}).Count -gt 0) { exit 0 } else { exit 1 }"3⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=5640,i,12750932980121461698,12847306398481123664,2097152 --field-trial-handle=2008,i,5171207466386907101,3286395741221770878,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5484 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=5884,i,18039031974962652134,9229955738376503763,2097152 --field-trial-handle=2008,i,5171207466386907101,3286395741221770878,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5836 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵
-
C:\Program Files\Kudu\Kudu.exe"C:\Program Files\Kudu\Kudu.exe"1⤵
- Checks computer location settings
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -NonInteractive -Command "[Console]::OutputEncoding.CodePage""2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -NonInteractive -Command "[Console]::OutputEncoding.CodePage"3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
-
-
-
C:\Program Files\Kudu\Kudu.exe"C:\Program Files\Kudu\Kudu.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\kudu" --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAAAAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=d3d11-warp-webgl --field-trial-handle=1836,i,17391758617434330913,7044323950253771044,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1840,i,13699294425415516907,11953113062396278691,4 --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=1832 /prefetch:22⤵
- Executes dropped EXE
- Loads dropped DLL
- Network Service Discovery
-
-
C:\Windows\system32\cmd.execmd.exe /d /v:off /s /c chcp 65001 >nul && schtasks "%__KA0%" "%__KA1%" "%__KA2%" "%__KA3%"2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\chcp.comchcp 650013⤵
-
-
C:\Windows\system32\schtasks.exeschtasks "/Delete" "/TN" "KuduStartup" "/F"3⤵
-
-
-
C:\Program Files\Kudu\Kudu.exe"C:\Program Files\Kudu\Kudu.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\kudu" --field-trial-handle=1836,i,17391758617434330913,7044323950253771044,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1840,i,13699294425415516907,11953113062396278691,4 --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=2376 /prefetch:32⤵
- Executes dropped EXE
-
-
C:\Program Files\Kudu\Kudu.exe"C:\Program Files\Kudu\Kudu.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\kudu" --app-path="C:\Program Files\Kudu\resources\app.asar" --enable-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --field-trial-handle=1836,i,17391758617434330913,7044323950253771044,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1840,i,13699294425415516907,11953113062396278691,4 --trace-process-track-uuid=3190708990060038890 --mojo-platform-channel-handle=2572 /prefetch:12⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -NonInteractive -Command "[Console]::OutputEncoding = [System.Text.Encoding]::UTF8; $OutputEncoding = [System.Text.Encoding]::UTF8; $disabled = $false try { $v = (Get-ItemProperty -Path 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate' -Name 'ExcludeWUDriversInQualityUpdate' -ErrorAction Stop).ExcludeWUDriversInQualityUpdate if ($v -eq 1) { $disabled = $true } } catch {} try { $v = (Get-ItemProperty -Path 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\DriverSearching' -Name 'SearchOrderConfig' -ErrorAction Stop).SearchOrderConfig if ($v -eq 0) { $disabled = $true } } catch {} if ($disabled) { Write-Output 'DISABLED' } else { Write-Output 'ENABLED' } "2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\system32\net.exenet session2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 session3⤵
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -Command "[Console]::OutputEncoding = [System.Text.Encoding]::UTF8; $OutputEncoding = [System.Text.Encoding]::UTF8; $fixed = (Get-WmiObject Win32_LogicalDisk | Where-Object { $_.DriveType -eq 3 }).DeviceID -replace ':',''; Get-PSDrive -PSProvider FileSystem | Where-Object { $_.Used -ne $null -and $fixed -contains $_.Name } | ForEach-Object { \"$($_.Name)|$($_.Description)|$($_.Used)|$($_.Free)\" }"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\system32\cmd.execmd.exe /d /v:off /s /c chcp 65001>nul && scoop --version2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\chcp.comchcp 650013⤵
-
-
-
C:\Windows\system32\cmd.execmd.exe /d /v:off /s /c chcp 65001>nul && npm --version2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\chcp.comchcp 650013⤵
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -NonInteractive -Command "[Console]::OutputEncoding = [System.Text.Encoding]::UTF8; $OutputEncoding = [System.Text.Encoding]::UTF8; $ErrorActionPreference = 'Stop' $session = New-Object -ComObject Microsoft.Update.Session $searcher = $session.CreateUpdateSearcher() $criteria = \"IsInstalled=0 AND Type='Driver'\" $result = $searcher.Search($criteria) # Cache installed driver table once (expensive query) # Use Get-CimInstance (works on PS 5.1+/7+), fall back to Get-WmiObject $wmiDrivers = @() try { $wmiDrivers = @(Get-CimInstance Win32_PnPSignedDriver | Select-Object HardWareID, DriverVersion, DriverDate) } catch { try { $wmiDrivers = @(Get-WmiObject Win32_PnPSignedDriver | Select-Object HardWareID, DriverVersion, DriverDate) } catch {} } foreach ($update in $result.Updates) { $driver = $update.DriverModel $ver = $update.DriverVerDate $hwId = '' if ($update.DriverHardwareID) { $hwId = $update.DriverHardwareID } $cls = $update.DriverClass $provider = $update.DriverProvider $title = $update.Title $size = '' if ($update.MaxDownloadSize -gt 0) { $mb = [math]::Round($update.MaxDownloadSize / 1MB, 1) if ($mb -lt 0.1) { $size = '< 0.1 MB' } else { $size = \"$mb MB\" } } $verStr = '' if ($update.DriverVerDate) { $verStr = $update.DriverVerDate.ToString('yyyy-MM-dd') } # Look up current installed version from cached driver data $currentVer = '' $currentDate = '' if ($hwId -and $wmiDrivers.Count -gt 0) { $installed = $wmiDrivers | Where-Object { $_.HardWareID -eq $hwId } | Select-Object -First 1 if ($installed) { $currentVer = $installed.DriverVersion if ($installed.DriverDate) { try { if ($installed.DriverDate -is [datetime]) { $currentDate = $installed.DriverDate.ToString('yyyy-MM-dd') } else { $currentDate = ([Management.ManagementDateTimeConverter]::ToDateTime($installed.DriverDate)).ToString('yyyy-MM-dd') } } catch {} } } } $wuId = $update.Identity.UpdateID Write-Output \"DRVUPD|$($driver)|$($hwId)|$($cls)|$($currentVer)|$($currentDate)|$($wuId)|$($verStr)|$($provider)|$($title)|$($size)\" } if ($result.Updates.Count -eq 0) { Write-Output 'DRVUPD_NONE' } "2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\system32\cmd.execmd.exe /d /v:off /s /c chcp 65001 >nul && schtasks "%__KA0%" "%__KA1%" "%__KA2%" "%__KA3%"2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\chcp.comchcp 650013⤵
-
-
C:\Windows\system32\schtasks.exeschtasks "/Delete" "/TN" "KuduStartup" "/F"3⤵
-
-
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
2PowerShell
1Windows Command Shell
1Replay Monitor
Loading Replay Monitor...
Downloads
chrome_100_percent.pak
sqlite3.c
the-real-index
data_1
Network Persistent State
SCT Auditing Pending Reports
TransportSecurity
Preferences
Preferences
Preferences
Preferences
Secure Preferences
the-real-index
the-real-index~RFe585f80.TMP
the-real-index
b36b95b9-4b1e-4a7f-8bf6-bb1a8d4f3e07.tmp
b83fe029-60be-4c0a-a69c-0db3d7ad7e7a.tmp
Local State
Local State
Local State
Local State
Local State
powershell.exe.log
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
__PSScriptPolicyTest_xr1dverq.r5q.ps1
LICENSE.electron.txt
LICENSES.chromium.html
chrome_200_percent.pak
d3dcompiler_47.dll
dxcompiler.dll
dxil.dll
ffmpeg.dll
icudtl.dat
libEGL.dll
libGLESv2.dll
af.pak
am.pak
ar.pak
bg.pak
bn.pak
ca.pak
cs.pak
da.pak
de.pak
el.pak
en-GB.pak
en-US.pak
es-419.pak
es.pak
et.pak
fa.pak
fi.pak
fil.pak
fr.pak
gu.pak
he.pak
hi.pak
hr.pak
hu.pak
id.pak
it.pak
ja.pak
kn.pak
ko.pak
lt.pak
lv.pak
ml.pak
mr.pak
ms.pak
nb.pak
nl.pak
pl.pak
pt-BR.pak
pt-PT.pak
ro.pak
ru.pak
sk.pak
sl.pak
sr.pak
sv.pak
sw.pak
ta.pak
te.pak
th.pak
tr.pak
uk.pak
ur.pak
vi.pak
zh-CN.pak
zh-TW.pak
resources.pak
app-update.yml
package.json
yara-x.win32-x64-msvc.node
LICENSE
better_sqlite3.node
common.gypi
copy.js
defines.gypi
download.sh
1208.patch
sqlite3.gyp
sqlite3.h
sqlite3ext.h
test_extension.c
database.js
index.js
aggregate.js
backup.js
function.js
inspect.js
pragma.js
serialize.js
table.js
transaction.js
wrappers.js
sqlite-error.js
util.js
package.json
addon.cpp
better_sqlite3.cpp
backup.cpp
backup.hpp
database.cpp
database.hpp
statement-iterator.cpp
statement-iterator.hpp
statement.cpp
statement.hpp
bind-map.cpp
binder.cpp
constants.cpp
custom-aggregate.cpp
custom-function.cpp
custom-table.cpp
data-converter.cpp
data.cpp
helpers.cpp
macros.cpp
query-macros.cpp
row-builder.cpp
elevate.exe
icon.ico
icon.png
128x128.png
16x16.png
256x256.png
32x32.png
48x48.png
512x512.png
64x64.png
snapshot_blob.bin
v8_context_snapshot.bin
vk_swiftshader.dll
vk_swiftshader_icd.json
vulkan-1.dll
SpiderBanner.dll
StdUtils.dll
System.dll
WinShell.dll
nsExec.dll
nsis7z.dll
default.dic
Preferences
Preferences~RFe59a195.TMP
config.json
config.json
memory/764-3473-0x0000017F768E0000-0x0000017F76C35000-memory.dmp
memory/764-1546-0x00007FF90E890000-0x00007FF90E891000-memory.dmp
memory/764-1547-0x00007FF910500000-0x00007FF910501000-memory.dmp
memory/2796-310-0x0000000005AB0000-0x0000000005B16000-memory.dmp
memory/2796-322-0x0000000006740000-0x0000000006772000-memory.dmp
memory/2796-336-0x00000000076A0000-0x00000000076CA000-memory.dmp
memory/2796-337-0x00000000076D0000-0x00000000076F4000-memory.dmp
memory/2796-338-0x000000006FF00000-0x0000000070254000-memory.dmp
memory/2796-306-0x0000000004BB0000-0x0000000004BE6000-memory.dmp
memory/2796-307-0x0000000004C10000-0x0000000004C20000-memory.dmp
memory/2796-308-0x0000000005250000-0x0000000005878000-memory.dmp
memory/2796-309-0x00000000051D0000-0x00000000051F2000-memory.dmp
memory/2796-335-0x0000000007520000-0x000000000752A000-memory.dmp
memory/2796-311-0x0000000005B20000-0x0000000005B86000-memory.dmp
memory/2796-332-0x0000000007360000-0x0000000007403000-memory.dmp
memory/2796-319-0x0000000005B90000-0x0000000005EE4000-memory.dmp
memory/2796-320-0x0000000006160000-0x000000000617E000-memory.dmp
memory/2796-321-0x00000000061A0000-0x00000000061EC000-memory.dmp
memory/2796-331-0x0000000007330000-0x000000000734E000-memory.dmp
memory/2796-323-0x000000006F800000-0x000000006F84C000-memory.dmp
memory/2796-333-0x0000000007B00000-0x000000000817A000-memory.dmp
memory/2796-334-0x00000000074B0000-0x00000000074CA000-memory.dmp
memory/2796-305-0x0000000004C10000-0x0000000004C20000-memory.dmp
memory/3288-1759-0x00000119B4CA0000-0x00000119B4CCA000-memory.dmp
memory/3288-1760-0x00000119B4CA0000-0x00000119B4CC4000-memory.dmp
memory/3316-370-0x00000000061F0000-0x0000000006544000-memory.dmp
memory/3316-395-0x000000006FF80000-0x00000000702D4000-memory.dmp
memory/3316-379-0x000000006F800000-0x000000006F84C000-memory.dmp
memory/4464-363-0x0000000007C60000-0x0000000007CF6000-memory.dmp
memory/4464-355-0x000000006F800000-0x000000006F84C000-memory.dmp
memory/4464-353-0x0000000006110000-0x0000000006464000-memory.dmp
memory/4464-364-0x0000000007B90000-0x0000000007BA1000-memory.dmp
memory/5020-1499-0x0000019AD27A0000-0x0000019AD27C2000-memory.dmp