5cde0fa88d9ab654714a9bd06d4440fde080314b2f36c7a7224a76fb8ed0305e

Analysis

user interaction
yes
max time kernel
28s
max time network
45s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
15/08/2026, 14:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

Reason

Machine shutdown

General

Target
VBS.cmd
Size 96KB
Sample260815-rb643syshx
SHA256 5cde0fa88d9ab654714a9bd06d4440fde080314b2f36c7a7224a76fb8ed0305e
MD5 851ecaffc08a4ea60d3a4e691bb32d07
SHA1 73013bd0202c85e3b6b59d87d004b3abe3b81167
SHA512 9e3d70d592d89971ce537c39313bf5b20fe2797a29bc7cc4b82eebae78b0b91ab89c20dda269df9ab95ee2b646d653c2298a0f422767e95ad977b89115f89ac3
SSDEEP 1536:BF9Omaq2Yr+tlouo6pKOUN0kpSrdk6dQZ9ash:3Kfts
TLSH
T1F5A3B7123908185449B6B4B7AD63C20BF799C0C34162AAED78CDD06CBF7516BB2F56EC
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

execution

Malware Config

Signatures

Modifies boot configuration data using bcdedit 10 IoCs

pid	Process
4588	bcdedit.exe
2016	bcdedit.exe
5684	bcdedit.exe
2800	bcdedit.exe
3852	bcdedit.exe
5960	bcdedit.exe
6020	bcdedit.exe
3932	bcdedit.exe
5012	bcdedit.exe
3760	bcdedit.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 6 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
5448	powershell.exe
3684	powershell.exe
4324	powershell.exe
3684	powershell.exe
740	powershell.exe
3304	powershell.exe

Launches sc.exe 3 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
5676	sc.exe
2808	sc.exe
260	sc.exe

Executes a command shell one-liner 1 TTPs 64 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1476	cmd.exe
1760	cmd.exe
1412	cmd.exe
2248	cmd.exe
1324	cmd.exe
248	cmd.exe
2400	cmd.exe
3152	cmd.exe
3212	cmd.exe
4900	cmd.exe
1540	cmd.exe
3244	cmd.exe
1672	cmd.exe
1564	cmd.exe
1320	cmd.exe
4100	cmd.exe
6108	cmd.exe
2240	cmd.exe
3248	cmd.exe
4632	cmd.exe
3884	cmd.exe
876	cmd.exe
6036	cmd.exe
2092	cmd.exe
5568	cmd.exe
5912	cmd.exe
2372	cmd.exe
5332	cmd.exe
1740	cmd.exe
3404	cmd.exe
6088	cmd.exe
1108	cmd.exe
5616	cmd.exe
4376	cmd.exe
5132	cmd.exe
6128	cmd.exe
3076	cmd.exe
4860	cmd.exe
2328	cmd.exe
6076	cmd.exe
3188	cmd.exe
1756	cmd.exe
4792	cmd.exe
5556	cmd.exe
5800	cmd.exe
5600	cmd.exe
3560	cmd.exe
2660	cmd.exe
1348	cmd.exe
2016	cmd.exe
3904	cmd.exe
3640	cmd.exe
3816	cmd.exe
2712	cmd.exe
3720	cmd.exe
4640	cmd.exe
3184	cmd.exe
816	cmd.exe
1364	cmd.exe
3788	cmd.exe
4764	cmd.exe
3224	cmd.exe
6064	cmd.exe
1808	cmd.exe

Enumerates system info in registry 2 TTPs 14 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BaseBoardProduct	reg.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	reg.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BIOSVendor	reg.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	reg.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	reg.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	reg.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BaseBoardManufacturer	reg.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	reg.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	reg.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	reg.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	reg.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	reg.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	reg.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	reg.exe

Modifies registry key 1 TTPs 3 IoCs

Modify Registry

T1112

pid	Process
2236	reg.exe
252	reg.exe
244	reg.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 30 IoCs

pid	Process
5448	powershell.exe
5448	powershell.exe
3964	powershell.exe
3964	powershell.exe
3684	powershell.exe
3684	powershell.exe
1504	powershell.exe
1504	powershell.exe
5200	powershell.exe
5200	powershell.exe
1616	powershell.exe
1616	powershell.exe
4056	WMIC.exe
4056	WMIC.exe
4056	WMIC.exe
4056	WMIC.exe
3692	WMIC.exe
3692	WMIC.exe
3692	WMIC.exe
3692	WMIC.exe
5552	powershell.exe
5552	powershell.exe
4324	powershell.exe
4324	powershell.exe
3256	powershell.exe
3256	powershell.exe
3684	powershell.exe
3684	powershell.exe
740	powershell.exe
740	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	5448	powershell.exe
Token: SeDebugPrivilege	3964	powershell.exe
Token: SeDebugPrivilege	3684	powershell.exe
Token: SeDebugPrivilege	1504	powershell.exe
Token: SeDebugPrivilege	5200	powershell.exe
Token: SeSystemEnvironmentPrivilege	5200	powershell.exe
Token: SeDebugPrivilege	1616	powershell.exe
Token: SeIncreaseQuotaPrivilege	4056	WMIC.exe
Token: SeSecurityPrivilege	4056	WMIC.exe
Token: SeTakeOwnershipPrivilege	4056	WMIC.exe
Token: SeLoadDriverPrivilege	4056	WMIC.exe
Token: SeSystemProfilePrivilege	4056	WMIC.exe
Token: SeSystemtimePrivilege	4056	WMIC.exe
Token: SeProfSingleProcessPrivilege	4056	WMIC.exe
Token: SeIncBasePriorityPrivilege	4056	WMIC.exe
Token: SeCreatePagefilePrivilege	4056	WMIC.exe
Token: SeBackupPrivilege	4056	WMIC.exe
Token: SeRestorePrivilege	4056	WMIC.exe
Token: SeShutdownPrivilege	4056	WMIC.exe
Token: SeDebugPrivilege	4056	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4056	WMIC.exe
Token: SeRemoteShutdownPrivilege	4056	WMIC.exe
Token: SeUndockPrivilege	4056	WMIC.exe
Token: SeManageVolumePrivilege	4056	WMIC.exe
Token: 33	4056	WMIC.exe
Token: 34	4056	WMIC.exe
Token: 35	4056	WMIC.exe
Token: 36	4056	WMIC.exe
Token: SeIncreaseQuotaPrivilege	4056	WMIC.exe
Token: SeSecurityPrivilege	4056	WMIC.exe
Token: SeTakeOwnershipPrivilege	4056	WMIC.exe
Token: SeLoadDriverPrivilege	4056	WMIC.exe
Token: SeSystemProfilePrivilege	4056	WMIC.exe
Token: SeSystemtimePrivilege	4056	WMIC.exe
Token: SeProfSingleProcessPrivilege	4056	WMIC.exe
Token: SeIncBasePriorityPrivilege	4056	WMIC.exe
Token: SeCreatePagefilePrivilege	4056	WMIC.exe
Token: SeBackupPrivilege	4056	WMIC.exe
Token: SeRestorePrivilege	4056	WMIC.exe
Token: SeShutdownPrivilege	4056	WMIC.exe
Token: SeDebugPrivilege	4056	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4056	WMIC.exe
Token: SeRemoteShutdownPrivilege	4056	WMIC.exe
Token: SeUndockPrivilege	4056	WMIC.exe
Token: SeManageVolumePrivilege	4056	WMIC.exe
Token: 33	4056	WMIC.exe
Token: 34	4056	WMIC.exe
Token: 35	4056	WMIC.exe
Token: 36	4056	WMIC.exe
Token: SeIncreaseQuotaPrivilege	3692	WMIC.exe
Token: SeSecurityPrivilege	3692	WMIC.exe
Token: SeTakeOwnershipPrivilege	3692	WMIC.exe
Token: SeLoadDriverPrivilege	3692	WMIC.exe
Token: SeSystemProfilePrivilege	3692	WMIC.exe
Token: SeSystemtimePrivilege	3692	WMIC.exe
Token: SeProfSingleProcessPrivilege	3692	WMIC.exe
Token: SeIncBasePriorityPrivilege	3692	WMIC.exe
Token: SeCreatePagefilePrivilege	3692	WMIC.exe
Token: SeBackupPrivilege	3692	WMIC.exe
Token: SeRestorePrivilege	3692	WMIC.exe
Token: SeShutdownPrivilege	3692	WMIC.exe
Token: SeDebugPrivilege	3692	WMIC.exe
Token: SeSystemEnvironmentPrivilege	3692	WMIC.exe
Token: SeRemoteShutdownPrivilege	3692	WMIC.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1756 wrote to memory of 5676	1756	cmd.exe	90
PID 1756 wrote to memory of 4916	1756	cmd.exe	91
PID 1756 wrote to memory of 1336	1756	cmd.exe	92
PID 1756 wrote to memory of 5340	1756	cmd.exe	93
PID 1756 wrote to memory of 4152	1756	cmd.exe	94
PID 1756 wrote to memory of 4332	1756	cmd.exe	95
PID 1756 wrote to memory of 1380	1756	cmd.exe	96
PID 1756 wrote to memory of 3652	1756	cmd.exe	97
PID 1756 wrote to memory of 5672	1756	cmd.exe	98
PID 1756 wrote to memory of 3248	1756	cmd.exe	99
PID 3248 wrote to memory of 4368	3248	cmd.exe	100
PID 3248 wrote to memory of 4536	3248	cmd.exe	101
PID 1756 wrote to memory of 4792	1756	cmd.exe	102
PID 1756 wrote to memory of 3224	1756	cmd.exe	103
PID 3224 wrote to memory of 5448	3224	cmd.exe	104
PID 1756 wrote to memory of 3256	1756	cmd.exe	105
PID 1756 wrote to memory of 1824	1756	cmd.exe	106
PID 1756 wrote to memory of 5556	1756	cmd.exe	107
PID 5556 wrote to memory of 732	5556	cmd.exe	108
PID 1756 wrote to memory of 3904	1756	cmd.exe	109
PID 1756 wrote to memory of 3492	1756	cmd.exe	110
PID 1756 wrote to memory of 2860	1756	cmd.exe	111
PID 1756 wrote to memory of 6088	1756	cmd.exe	112
PID 6088 wrote to memory of 5456	6088	cmd.exe	113
PID 1756 wrote to memory of 1760	1756	cmd.exe	114
PID 1760 wrote to memory of 4588	1760	cmd.exe	115
PID 1756 wrote to memory of 3008	1756	cmd.exe	116
PID 3008 wrote to memory of 3964	3008	cmd.exe	117
PID 1756 wrote to memory of 6064	1756	cmd.exe	118
PID 6064 wrote to memory of 1764	6064	cmd.exe	119
PID 1756 wrote to memory of 2236	1756	cmd.exe	120
PID 1756 wrote to memory of 420	1756	cmd.exe	121
PID 1756 wrote to memory of 252	1756	cmd.exe	122
PID 1756 wrote to memory of 248	1756	cmd.exe	123
PID 1756 wrote to memory of 244	1756	cmd.exe	124
PID 248 wrote to memory of 2808	248	cmd.exe	127
PID 248 wrote to memory of 6060	248	cmd.exe	128
PID 248 wrote to memory of 5352	248	cmd.exe	129
PID 248 wrote to memory of 1612	248	cmd.exe	130
PID 248 wrote to memory of 4860	248	cmd.exe	131
PID 248 wrote to memory of 4420	248	cmd.exe	132
PID 248 wrote to memory of 644	248	cmd.exe	133
PID 248 wrote to memory of 1220	248	cmd.exe	134
PID 248 wrote to memory of 3476	248	cmd.exe	135
PID 248 wrote to memory of 5800	248	cmd.exe	136
PID 5800 wrote to memory of 3636	5800	cmd.exe	137
PID 5800 wrote to memory of 3320	5800	cmd.exe	138
PID 248 wrote to memory of 2400	248	cmd.exe	139
PID 248 wrote to memory of 3152	248	cmd.exe	140
PID 3152 wrote to memory of 3684	3152	cmd.exe	141
PID 248 wrote to memory of 4172	248	cmd.exe	142
PID 248 wrote to memory of 4888	248	cmd.exe	143
PID 248 wrote to memory of 3640	248	cmd.exe	144
PID 3640 wrote to memory of 4656	3640	cmd.exe	145
PID 248 wrote to memory of 4632	248	cmd.exe	146
PID 248 wrote to memory of 2940	248	cmd.exe	147
PID 248 wrote to memory of 2824	248	cmd.exe	148
PID 248 wrote to memory of 1412	248	cmd.exe	149
PID 1412 wrote to memory of 2736	1412	cmd.exe	150
PID 248 wrote to memory of 816	248	cmd.exe	151
PID 816 wrote to memory of 2016	816	cmd.exe	152
PID 248 wrote to memory of 5132	248	cmd.exe	153
PID 5132 wrote to memory of 1504	5132	cmd.exe	154
PID 248 wrote to memory of 1348	248	cmd.exe	155

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\VBS.cmd"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1756
- C:\Windows\System32\sc.exe
  "C:\Windows\System32\sc.exe" query Null
  2⤵
  - Launches sc.exe
  PID:5676
- C:\Windows\System32\find.exe
  find /i "RUNNING"
  2⤵
  PID:4916
- C:\Windows\System32\findstr.exe
  findstr /v "$" "VBS.cmd"
  2⤵
  PID:1336
- C:\Windows\System32\cmd.exe
  C:\Windows\System32\cmd.exe /S /D /c" echo "C:\Users\Admin\AppData\Local\Temp\VBS.cmd" "
  2⤵
  PID:5340
- C:\Windows\System32\find.exe
  find /i "C:\Users\Admin\AppData\Local\Temp"
  2⤵
  PID:4152
- C:\Windows\System32\net.exe
  net use C:
  2⤵
  PID:4332
- C:\Windows\System32\cmd.exe
  C:\Windows\System32\cmd.exe /S /D /c" echo "" "
  2⤵
  PID:1380
- C:\Windows\System32\find.exe
  find /i "-el"
  2⤵
  PID:3652
- C:\Windows\System32\fltMC.exe
  fltmc
  2⤵
  PID:5672
- C:\Windows\System32\cmd.exe
  C:\Windows\System32\cmd.exe /c echo prompt $E| cmd
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3248
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /S /D /c" echo prompt $E"
    3⤵
    PID:4368
- - C:\Windows\System32\cmd.exe
    cmd
    3⤵
    PID:4536
- C:\Windows\System32\cmd.exe
  C:\Windows\System32\cmd.exe /c ver
  2⤵
  - Executes a command shell one-liner
  PID:4792
- C:\Windows\System32\cmd.exe
  C:\Windows\System32\cmd.exe /c "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c $AssemblyBuilder = [AppDomain]::CurrentDomain.DefineDynamicAssembly(4, 1); $ModuleBuilder = $AssemblyBuilder.DefineDynamicModule(2, $False); $TypeBuilder = $ModuleBuilder.DefineType(0); $meth = $TypeBuilder.DefinePInvokeMethod('BrandingFormatString', 'winbrand.dll', 'Public, Static', 1, [String], @([String]), 1, 3); $meth.SetImplementationFlags(128); $TypeBuilder.CreateType()::BrandingFormatString('%WINDOWS_LONG%') -replace [string][char]0xa9, '' -replace [string][char]0xae, '' -replace [string][char]0x2122, ''"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3224
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c $AssemblyBuilder = [AppDomain]::CurrentDomain.DefineDynamicAssembly(4, 1); $ModuleBuilder = $AssemblyBuilder.DefineDynamicModule(2, $False); $TypeBuilder = $ModuleBuilder.DefineType(0); $meth = $TypeBuilder.DefinePInvokeMethod('BrandingFormatString', 'winbrand.dll', 'Public, Static', 1, [String], @([String]), 1, 3); $meth.SetImplementationFlags(128); $TypeBuilder.CreateType()::BrandingFormatString('%WINDOWS_LONG%') -replace [string][char]0xa9, '' -replace [string][char]0xae, '' -replace [string][char]0x2122, ''
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5448
- C:\Windows\System32\cmd.exe
  C:\Windows\System32\cmd.exe /S /D /c" echo "Windows 11 IoT Enterprise LTSC" "
  2⤵
  PID:3256
- C:\Windows\System32\find.exe
  find /i "Windows"
  2⤵
  PID:1824
- C:\Windows\System32\cmd.exe
  C:\Windows\System32\cmd.exe /c reg query "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Environment" /v PROCESSOR_ARCHITECTURE 2>nul
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5556
- - C:\Windows\System32\reg.exe
    reg query "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Environment" /v PROCESSOR_ARCHITECTURE
    3⤵
    PID:732
- C:\Windows\System32\cmd.exe
  C:\Windows\System32\cmd.exe /c ver
  2⤵
  - Executes a command shell one-liner
  PID:3904
- C:\Windows\System32\reg.exe
  reg query "HKCU\Console" /v ForceV2
  2⤵
  PID:3492
- C:\Windows\System32\find.exe
  find /i "0x0"
  2⤵
  PID:2860
- C:\Windows\System32\cmd.exe
  C:\Windows\System32\cmd.exe /c reg query "HKCU\Console" /v VirtualTerminalLevel 2>nul
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:6088
- - C:\Windows\System32\reg.exe
    reg query "HKCU\Console" /v VirtualTerminalLevel
    3⤵
    PID:5456
- C:\Windows\System32\cmd.exe
  C:\Windows\System32\cmd.exe /c bcdedit /enum {current} /v 2>nul
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1760
- - C:\Windows\System32\bcdedit.exe
    bcdedit /enum {current} /v
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:4588
- C:\Windows\System32\cmd.exe
  C:\Windows\System32\cmd.exe /c C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "if ($PSVersionTable.PSEdition -ne 'Core') {$f=[IO.File]::ReadAllText($env:_cmdf) -split ':pstst';. ([scriptblock]::Create($f[1]))}" 2>nul
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3008
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "if ($PSVersionTable.PSEdition -ne 'Core') {$f=[IO.File]::ReadAllText($env:_cmdf) -split ':pstst';. ([scriptblock]::Create($f[1]))}"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3964
- C:\Windows\System32\cmd.exe
  C:\Windows\System32\cmd.exe /c mode con
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:6064
- - C:\Windows\System32\mode.com
    mode con
    3⤵
    PID:1764
- C:\Windows\System32\reg.exe
  reg query HKCU\Console /v QuickEdit
  2⤵
  - Modifies registry key
  PID:2236
- C:\Windows\System32\find.exe
  find /i "0x0"
  2⤵
  PID:420
- C:\Windows\System32\reg.exe
  reg add HKCU\Console /v QuickEdit /t REG_DWORD /d 0 /f
  2⤵
  - Modifies registry key
  PID:252
- C:\Windows\System32\cmd.exe
  cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\VBS.cmd" -qedit"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:248
- - C:\Windows\System32\sc.exe
    "C:\Windows\System32\sc.exe" query Null
    3⤵
    - Launches sc.exe
    PID:2808
- - C:\Windows\System32\find.exe
    find /i "RUNNING"
    3⤵
    PID:6060
- - C:\Windows\System32\findstr.exe
    findstr /v "$" "VBS.cmd"
    3⤵
    PID:5352
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /S /D /c" echo "C:\Users\Admin\AppData\Local\Temp\VBS.cmd" "
    3⤵
    PID:1612
- - C:\Windows\System32\find.exe
    find /i "C:\Users\Admin\AppData\Local\Temp"
    3⤵
    PID:4860
- - C:\Windows\System32\net.exe
    net use C:
    3⤵
    PID:4420
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /S /D /c" echo "-qedit" "
    3⤵
    PID:644
- - C:\Windows\System32\find.exe
    find /i "-el"
    3⤵
    PID:1220
- - C:\Windows\System32\fltMC.exe
    fltmc
    3⤵
    PID:3476
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /c echo prompt $E| cmd
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5800
  - - C:\Windows\System32\cmd.exe
      C:\Windows\System32\cmd.exe /S /D /c" echo prompt $E"
      4⤵
      PID:3636
  - - C:\Windows\System32\cmd.exe
      cmd
      4⤵
      PID:3320
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /c ver
    3⤵
    - Executes a command shell one-liner
    PID:2400
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /c "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c $AssemblyBuilder = [AppDomain]::CurrentDomain.DefineDynamicAssembly(4, 1); $ModuleBuilder = $AssemblyBuilder.DefineDynamicModule(2, $False); $TypeBuilder = $ModuleBuilder.DefineType(0); $meth = $TypeBuilder.DefinePInvokeMethod('BrandingFormatString', 'winbrand.dll', 'Public, Static', 1, [String], @([String]), 1, 3); $meth.SetImplementationFlags(128); $TypeBuilder.CreateType()::BrandingFormatString('%WINDOWS_LONG%') -replace [string][char]0xa9, '' -replace [string][char]0xae, '' -replace [string][char]0x2122, ''"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3152
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c $AssemblyBuilder = [AppDomain]::CurrentDomain.DefineDynamicAssembly(4, 1); $ModuleBuilder = $AssemblyBuilder.DefineDynamicModule(2, $False); $TypeBuilder = $ModuleBuilder.DefineType(0); $meth = $TypeBuilder.DefinePInvokeMethod('BrandingFormatString', 'winbrand.dll', 'Public, Static', 1, [String], @([String]), 1, 3); $meth.SetImplementationFlags(128); $TypeBuilder.CreateType()::BrandingFormatString('%WINDOWS_LONG%') -replace [string][char]0xa9, '' -replace [string][char]0xae, '' -replace [string][char]0x2122, ''
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3684
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /S /D /c" echo "Windows 11 IoT Enterprise LTSC" "
    3⤵
    PID:4172
- - C:\Windows\System32\find.exe
    find /i "Windows"
    3⤵
    PID:4888
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /c reg query "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Environment" /v PROCESSOR_ARCHITECTURE 2>nul
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3640
  - - C:\Windows\System32\reg.exe
      reg query "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Environment" /v PROCESSOR_ARCHITECTURE
      4⤵
      PID:4656
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /c ver
    3⤵
    - Executes a command shell one-liner
    PID:4632
- - C:\Windows\System32\reg.exe
    reg query "HKCU\Console" /v ForceV2
    3⤵
    PID:2940
- - C:\Windows\System32\find.exe
    find /i "0x0"
    3⤵
    PID:2824
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /c reg query "HKCU\Console" /v VirtualTerminalLevel 2>nul
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1412
  - - C:\Windows\System32\reg.exe
      reg query "HKCU\Console" /v VirtualTerminalLevel
      4⤵
      PID:2736
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /c bcdedit /enum {current} /v 2>nul
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:816
  - - C:\Windows\System32\bcdedit.exe
      bcdedit /enum {current} /v
      4⤵
      Modifies boot configuration data using bcdedit
      PID:2016
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /c C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "if ($PSVersionTable.PSEdition -ne 'Core') {$f=[IO.File]::ReadAllText($env:_cmdf) -split ':pstst';. ([scriptblock]::Create($f[1]))}" 2>nul
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5132
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "if ($PSVersionTable.PSEdition -ne 'Core') {$f=[IO.File]::ReadAllText($env:_cmdf) -split ':pstst';. ([scriptblock]::Create($f[1]))}"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1504
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /c mode con
    3⤵
    - Executes a command shell one-liner
    PID:1348
  - - C:\Windows\System32\mode.com
      mode con
      4⤵
      PID:3444
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /c reg query "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /v Desktop
    3⤵
    PID:3672
  - - C:\Windows\System32\reg.exe
      reg query "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /v Desktop
      4⤵
      PID:3500
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /c reg query "HKLM\HARDWARE\DESCRIPTION\System\BIOS" /v BaseBoardManufacturer 2>nul | findstr /i "Parallels"
    3⤵
    - Executes a command shell one-liner
    PID:1564
  - - C:\Windows\System32\reg.exe
      reg query "HKLM\HARDWARE\DESCRIPTION\System\BIOS" /v BaseBoardManufacturer
      4⤵
      Enumerates system info in registry
      PID:4360
  - - C:\Windows\System32\findstr.exe
      findstr /i "Parallels"
      4⤵
      PID:4800
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /c reg query "HKLM\HARDWARE\DESCRIPTION\System\BIOS" /v BaseBoardProduct 2>nul | findstr /i "Parallels"
    3⤵
    - Executes a command shell one-liner
    PID:3816
  - - C:\Windows\System32\reg.exe
      reg query "HKLM\HARDWARE\DESCRIPTION\System\BIOS" /v BaseBoardProduct
      4⤵
      Enumerates system info in registry
      PID:1848
  - - C:\Windows\System32\findstr.exe
      findstr /i "Parallels"
      4⤵
      PID:5604
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /c reg query "HKLM\HARDWARE\DESCRIPTION\System\BIOS" /v BIOSVendor 2>nul | findstr /i "Parallels"
    3⤵
    - Executes a command shell one-liner
    PID:1808
  - - C:\Windows\System32\reg.exe
      reg query "HKLM\HARDWARE\DESCRIPTION\System\BIOS" /v BIOSVendor
      4⤵
      Enumerates system info in registry
      PID:1596
  - - C:\Windows\System32\findstr.exe
      findstr /i "Parallels"
      4⤵
      PID:3880
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /c reg query "HKLM\HARDWARE\DESCRIPTION\System\BIOS" /v SystemFamily 2>nul | findstr /i "Parallels"
    3⤵
    - Executes a command shell one-liner
    PID:6128
  - - C:\Windows\System32\reg.exe
      reg query "HKLM\HARDWARE\DESCRIPTION\System\BIOS" /v SystemFamily
      4⤵
      Enumerates system info in registry
      PID:1868
  - - C:\Windows\System32\findstr.exe
      findstr /i "Parallels"
      4⤵
      PID:1088
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /c reg query "HKLM\HARDWARE\DESCRIPTION\System\BIOS" /v SystemManufacturer 2>nul | findstr /i "Parallels"
    3⤵
    PID:4600
  - - C:\Windows\System32\reg.exe
      reg query "HKLM\HARDWARE\DESCRIPTION\System\BIOS" /v SystemManufacturer
      4⤵
      Enumerates system info in registry
      PID:2972
  - - C:\Windows\System32\findstr.exe
      findstr /i "Parallels"
      4⤵
      PID:2472
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /c reg query "HKLM\HARDWARE\DESCRIPTION\System\BIOS" /v SystemProductName 2>nul | findstr /i "Parallels"
    3⤵
    - Executes a command shell one-liner
    PID:2248
  - - C:\Windows\System32\reg.exe
      reg query "HKLM\HARDWARE\DESCRIPTION\System\BIOS" /v SystemProductName
      4⤵
      Enumerates system info in registry
      PID:5768
  - - C:\Windows\System32\findstr.exe
      findstr /i "Parallels"
      4⤵
      PID:2060
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /c reg query "HKLM\HARDWARE\DESCRIPTION\System\BIOS" /v SystemSKU 2>nul | findstr /i "Parallels"
    3⤵
    - Executes a command shell one-liner
    PID:2712
  - - C:\Windows\System32\reg.exe
      reg query "HKLM\HARDWARE\DESCRIPTION\System\BIOS" /v SystemSKU
      4⤵
      Enumerates system info in registry
      PID:3536
  - - C:\Windows\System32\findstr.exe
      findstr /i "Parallels"
      4⤵
      PID:1996
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /c C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "try{Confirm-SecureBootUEFI}catch [System.PlatformNotSupportedException]{$false}catch{if($_.Exception.Message.Contains('0xC0000100')){$false}}" 2>nul
    3⤵
    - Executes a command shell one-liner
    PID:2092
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "try{Confirm-SecureBootUEFI}catch [System.PlatformNotSupportedException]{$false}catch{if($_.Exception.Message.Contains('0xC0000100')){$false}}"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:5200
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "&{$W=$Host.UI.RawUI.WindowSize;$B=$Host.UI.RawUI.BufferSize;$W.Height=32;$B.Height=300;$Host.UI.RawUI.WindowSize=$W;$Host.UI.RawUI.BufferSize=$B;}"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1616
- - C:\Windows\System32\choice.exe
    choice /C:1234 /N /M "[1] Continue [2] Exit [3] Revert Changes [4] Troubleshoot:
    3⤵
    PID:3100
- - C:\Windows\System32\cmd.exe
    cmd /c "wmic path Win32_ComputerSystem get CreationClassName /value"
    3⤵
    PID:5796
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic path Win32_ComputerSystem get CreationClassName /value
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4056
- - C:\Windows\System32\find.exe
    find /i "computersystem"
    3⤵
    PID:4304
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /c wmic path Win32_ComputerSystem get CreationClassName /value 2>nul | find /i "computersystem"
    3⤵
    - Executes a command shell one-liner
    PID:3212
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic path Win32_ComputerSystem get CreationClassName /value
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3692
  - - C:\Windows\System32\find.exe
      find /i "computersystem"
      4⤵
      PID:5228
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /c C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "(Get-CimInstance Win32_ComputerSystem).HypervisorPresent"
    3⤵
    - Executes a command shell one-liner
    PID:3076
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "(Get-CimInstance Win32_ComputerSystem).HypervisorPresent"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:5552
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /c C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "(Get-CimInstance -ClassName Win32_Processor).VirtualizationFirmwareEnabled"
    3⤵
    - Executes a command shell one-liner
    PID:1108
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "(Get-CimInstance -ClassName Win32_Processor).VirtualizationFirmwareEnabled"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:4324
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /c C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "$t=Add-Type -PassThru -MemberDefinition '[DllImport(\"ntdll.dll\")] public static extern uint NtQuerySystemInformation(int c,IntPtr b,uint s,out uint r);' -Name CI2 -Namespace w2; $p=[Runtime.InteropServices.Marshal]::AllocHGlobal(8); [Runtime.InteropServices.Marshal]::WriteInt32($p,8); $r=[uint32]0; $t::NtQuerySystemInformation(103,$p,8,[ref]$r)|Out-Null; $o=[uint32][Runtime.InteropServices.Marshal]::ReadInt32($p,4); if(-not($o -band 1)){0}elseif($o -band 2){1}else{2}" 2>nul
    3⤵
    PID:4620
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "$t=Add-Type -PassThru -MemberDefinition '[DllImport(\"ntdll.dll\")] public static extern uint NtQuerySystemInformation(int c,IntPtr b,uint s,out uint r);' -Name CI2 -Namespace w2; $p=[Runtime.InteropServices.Marshal]::AllocHGlobal(8); [Runtime.InteropServices.Marshal]::WriteInt32($p,8); $r=[uint32]0; $t::NtQuerySystemInformation(103,$p,8,[ref]$r)|Out-Null; $o=[uint32][Runtime.InteropServices.Marshal]::ReadInt32($p,4); if(-not($o -band 1)){0}elseif($o -band 2){1}else{2}"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:3256
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\sn3jpnd1\sn3jpnd1.cmdline"
        5⤵
        
        PID:4700
      - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES43F5.tmp" "c:\Users\Admin\AppData\Local\Temp\sn3jpnd1\CSCF0603AB948164F7A80F735741785565F.TMP"
        6⤵
        
        PID:2832
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /c reg query "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\WindowsHello" /v Enabled 2>nul
    3⤵
    PID:1384
  - - C:\Windows\System32\reg.exe
      reg query "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\WindowsHello" /v Enabled
      4⤵
      PID:5836
- - C:\Windows\System32\fltMC.exe
    fltmc
    3⤵
    PID:3964
- - C:\Windows\System32\findstr.exe
    findstr /i "FACEIT"
    3⤵
    PID:3472
- - C:\Windows\System32\sc.exe
    sc query MacType
    3⤵
    - Launches sc.exe
    PID:260
- - C:\Windows\System32\findstr.exe
    findstr /i "RUNNING"
    3⤵
    PID:308
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /c reg query "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard" /s 2>nul
    3⤵
    - Executes a command shell one-liner
    PID:5568
  - - C:\Windows\System32\reg.exe
      reg query "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard" /s
      4⤵
      PID:2564
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /c reg query "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard" /v Locked 2>nul
    3⤵
    - Executes a command shell one-liner
    PID:1320
  - - C:\Windows\System32\reg.exe
      reg query "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard" /v Locked
      4⤵
      PID:4340
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /c reg query "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\HypervisorEnforcedCodeIntegrity" /v Locked 2>nul
    3⤵
    - Executes a command shell one-liner
    PID:4100
  - - C:\Windows\System32\reg.exe
      reg query "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\HypervisorEnforcedCodeIntegrity" /v Locked
      4⤵
      PID:2596
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /c reg query "HKLM\SYSTEM\CurrentControlSet\Control\Lsa" /v LsaCfgFlags 2>nul
    3⤵
    PID:4432
  - - C:\Windows\System32\reg.exe
      reg query "HKLM\SYSTEM\CurrentControlSet\Control\Lsa" /v LsaCfgFlags
      4⤵
      PID:1192
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /c reg query "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard" /v Mandatory 2>nul
    3⤵
    - Executes a command shell one-liner
    PID:5616
  - - C:\Windows\System32\reg.exe
      reg query "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard" /v Mandatory
      4⤵
      PID:2592
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /c reg query "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\SecureBiometrics" /v Enabled 2>nul
    3⤵
    - Executes a command shell one-liner
    PID:1364
  - - C:\Windows\System32\reg.exe
      reg query "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\SecureBiometrics" /v Enabled
      4⤵
      PID:2808
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /c reg query "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios" /v SecureBiometrics 2>nul
    3⤵
    - Executes a command shell one-liner
    PID:3720
  - - C:\Windows\System32\reg.exe
      reg query "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios" /v SecureBiometrics
      4⤵
      PID:1508
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /c reg query "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\WindowsHelloSecureBiometrics" /v Enabled 2>nul
    3⤵
    - Executes a command shell one-liner
    PID:1324
  - - C:\Windows\System32\reg.exe
      reg query "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\WindowsHelloSecureBiometrics" /v Enabled
      4⤵
      PID:2908
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /c reg query "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\SecureFingerprint" /v Enabled 2>nul
    3⤵
    - Executes a command shell one-liner
    PID:4860
  - - C:\Windows\System32\reg.exe
      reg query "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\SecureFingerprint" /v Enabled
      4⤵
      PID:5052
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /c reg query "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios" /v SecureFingerprint 2>nul
    3⤵
    PID:3324
  - - C:\Windows\System32\reg.exe
      reg query "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios" /v SecureFingerprint
      4⤵
      PID:644
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /c reg query "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\WindowsHelloSecureFingerprint" /v Enabled 2>nul
    3⤵
    - Executes a command shell one-liner
    PID:4376
  - - C:\Windows\System32\reg.exe
      reg query "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\WindowsHelloSecureFingerprint" /v Enabled
      4⤵
      PID:3476
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /c reg query "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\HyperGuard" /v Enabled 2>nul
    3⤵
    PID:1316
  - - C:\Windows\System32\reg.exe
      reg query "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\HyperGuard" /v Enabled
      4⤵
      PID:4460
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /c reg query "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\Host-Guardian" /v Enabled 2>nul
    3⤵
    - Executes a command shell one-liner
    PID:5912
  - - C:\Windows\System32\reg.exe
      reg query "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\Host-Guardian" /v Enabled
      4⤵
      PID:2400
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /c reg query "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard" /v EnableVirtualizationBasedSecurity 2>nul
    3⤵
    - Executes a command shell one-liner
    PID:2328
  - - C:\Windows\System32\reg.exe
      reg query "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard" /v EnableVirtualizationBasedSecurity
      4⤵
      PID:5080
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /c reg query "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard" /v RequirePlatformSecurityFeatures 2>nul
    3⤵
    - Executes a command shell one-liner
    PID:4900
  - - C:\Windows\System32\reg.exe
      reg query "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard" /v RequirePlatformSecurityFeatures
      4⤵
      PID:3680
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /c reg query "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\SystemGuard" /v Enabled 2>nul
    3⤵
    - Executes a command shell one-liner
    PID:6076
  - - C:\Windows\System32\reg.exe
      reg query "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\SystemGuard" /v Enabled
      4⤵
      PID:1164
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /c C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "(Get-CimInstance -ClassName Win32_DeviceGuard -Namespace root\Microsoft\Windows\DeviceGuard).SecurityServicesRunning" 2>nul
    3⤵
    - Executes a command shell one-liner
    PID:1540
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "(Get-CimInstance -ClassName Win32_DeviceGuard -Namespace root\Microsoft\Windows\DeviceGuard).SecurityServicesRunning"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:3684
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /c reg query "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\HypervisorEnforcedCodeIntegrity" /v Enabled 2>nul
    3⤵
    - Executes a command shell one-liner
    PID:4640
  - - C:\Windows\System32\reg.exe
      reg query "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\HypervisorEnforcedCodeIntegrity" /v Enabled
      4⤵
      PID:2376
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /c C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "(Get-CimInstance -ClassName Win32_DeviceGuard -Namespace root\Microsoft\Windows\DeviceGuard).SecurityServicesRunning" 2>nul
    3⤵
    - Executes a command shell one-liner
    PID:2016
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "(Get-CimInstance -ClassName Win32_DeviceGuard -Namespace root\Microsoft\Windows\DeviceGuard).SecurityServicesRunning"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:740
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /c reg query "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard" /v DisableHypervisorEnforcedPagingTranslation 2>nul
    3⤵
    - Executes a command shell one-liner
    PID:3244
  - - C:\Windows\System32\reg.exe
      reg query "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard" /v DisableHypervisorEnforcedPagingTranslation
      4⤵
      PID:3768
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /c reg query "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\CredentialGuard" /v Enabled 2>nul
    3⤵
    - Executes a command shell one-liner
    PID:5600
  - - C:\Windows\System32\reg.exe
      reg query "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\CredentialGuard" /v Enabled
      4⤵
      PID:2476
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /c reg query "HKLM\SYSTEM\CurrentControlSet\Control\Lsa" /v LsaCfgFlags 2>nul
    3⤵
    - Executes a command shell one-liner
    PID:3188
  - - C:\Windows\System32\reg.exe
      reg query "HKLM\SYSTEM\CurrentControlSet\Control\Lsa" /v LsaCfgFlags
      4⤵
      PID:6000
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /c reg query "HKLM\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard" /v LsaCfgFlags 2>nul
    3⤵
    - Executes a command shell one-liner
    PID:3884
  - - C:\Windows\System32\reg.exe
      reg query "HKLM\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard" /v LsaCfgFlags
      4⤵
      PID:3396
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /c C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "$d=Add-Type -MemberDefinition '[DllImport(\"ntdll.dll\")] public static extern int NtQuerySystemInformation(uint a,IntPtr b,uint c,IntPtr d);' -Name n -Namespace w -PassThru;$p=[Runtime.InteropServices.Marshal]::AllocHGlobal(4);$r=[Runtime.InteropServices.Marshal]::AllocHGlobal(4);$ret=$d::NtQuerySystemInformation(196,$p,4,$r);if($ret -eq 0){$f=[uint32][Runtime.InteropServices.Marshal]::ReadInt32($p);if(($f -band 0x01)-ne 0 -or (($f -band 0x20)-ne 0 -and ($f -band 0x10)-ne 0)){Write-Output 1}else{Write-Output 0}}else{Write-Output 0}" 2>nul
    3⤵
    - Executes a command shell one-liner
    PID:1672
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "$d=Add-Type -MemberDefinition '[DllImport(\"ntdll.dll\")] public static extern int NtQuerySystemInformation(uint a,IntPtr b,uint c,IntPtr d);' -Name n -Namespace w -PassThru;$p=[Runtime.InteropServices.Marshal]::AllocHGlobal(4);$r=[Runtime.InteropServices.Marshal]::AllocHGlobal(4);$ret=$d::NtQuerySystemInformation(196,$p,4,$r);if($ret -eq 0){$f=[uint32][Runtime.InteropServices.Marshal]::ReadInt32($p);if(($f -band 0x01)-ne 0 -or (($f -band 0x20)-ne 0 -and ($f -band 0x10)-ne 0)){Write-Output 1}else{Write-Output 0}}else{Write-Output 0}"
      4⤵
      PID:372
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\niyq0rfs\niyq0rfs.cmdline"
        5⤵
        
        PID:5532
      - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES52D9.tmp" "c:\Users\Admin\AppData\Local\Temp\niyq0rfs\CSC26A665B13DCD4882B7FEC31816C23A6.TMP"
        6⤵
        
        PID:5844
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /c bcdedit /enum {c0a23914-7be3-11f1-8f87-db87fe0923f2} 2>nul | findstr /i "hypervisorlaunchtype"
    3⤵
    - Executes a command shell one-liner
    PID:3560
  - - C:\Windows\System32\bcdedit.exe
      bcdedit /enum {c0a23914-7be3-11f1-8f87-db87fe0923f2}
      4⤵
      Modifies boot configuration data using bcdedit
      PID:5684
  - - C:\Windows\System32\findstr.exe
      findstr /i "hypervisorlaunchtype"
      4⤵
      PID:5564
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /c bcdedit /enum {hypervisorsettings} 2>nul | findstr /i "hypervisorlaunchtype"
    3⤵
    - Executes a command shell one-liner
    PID:6108
  - - C:\Windows\System32\bcdedit.exe
      bcdedit /enum {hypervisorsettings}
      4⤵
      Modifies boot configuration data using bcdedit
      PID:2800
  - - C:\Windows\System32\findstr.exe
      findstr /i "hypervisorlaunchtype"
      4⤵
      PID:1152
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /c bcdedit /enum {bootloadersettings} 2>nul | findstr /i "hypervisorlaunchtype"
    3⤵
    - Executes a command shell one-liner
    PID:2240
  - - C:\Windows\System32\bcdedit.exe
      bcdedit /enum {bootloadersettings}
      4⤵
      Modifies boot configuration data using bcdedit
      PID:3852
  - - C:\Windows\System32\findstr.exe
      findstr /i "hypervisorlaunchtype"
      4⤵
      PID:4724
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /c dism /online /english /Get-FeatureInfo /FeatureName:Microsoft-Windows-Subsystem-Linux 2>nul | findstr /i "State"
    3⤵
    - Executes a command shell one-liner
    PID:2372
  - - C:\Windows\System32\Dism.exe
      dism /online /english /Get-FeatureInfo /FeatureName:Microsoft-Windows-Subsystem-Linux
      4⤵
      PID:5472
    - - C:\Windows\System32\Dism\dismhost.exe
        
        C:\Windows\System32\Dism\dismhost.exe {DD96E681-F6C6-4EE8-8594-80C3DE0D5303}
        5⤵
        
        PID:4232
  - - C:\Windows\System32\findstr.exe
      findstr /i "State"
      4⤵
      PID:1592
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /c dism /online /english /Get-FeatureInfo /FeatureName:Containers-DisposableClientVM 2>nul | findstr /i "State"
    3⤵
    - Executes a command shell one-liner
    PID:5332
  - - C:\Windows\System32\Dism.exe
      dism /online /english /Get-FeatureInfo /FeatureName:Containers-DisposableClientVM
      4⤵
      PID:4188
    - - C:\Windows\System32\Dism\dismhost.exe
        
        C:\Windows\System32\Dism\dismhost.exe {F55A4855-048D-4B12-B840-077439194445}
        5⤵
        
        PID:4924
  - - C:\Windows\System32\findstr.exe
      findstr /i "State"
      4⤵
      PID:5216
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /c dism /online /english /Get-FeatureInfo /FeatureName:Microsoft-Hyper-V-All 2>nul | findstr /i "State"
    3⤵
    PID:1376
  - - C:\Windows\System32\Dism.exe
      dism /online /english /Get-FeatureInfo /FeatureName:Microsoft-Hyper-V-All
      4⤵
      PID:1388
    - - C:\Windows\System32\Dism\dismhost.exe
        
        C:\Windows\System32\Dism\dismhost.exe {172E7AB6-2B21-4443-A2A3-A32F5556DB9D}
        5⤵
        
        PID:4328
  - - C:\Windows\System32\findstr.exe
      findstr /i "State"
      4⤵
      PID:1380
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /c dism /online /english /Get-FeatureInfo /FeatureName:VirtualMachinePlatform 2>nul | findstr /i "State"
    3⤵
    - Executes a command shell one-liner
    PID:3184
  - - C:\Windows\System32\Dism.exe
      dism /online /english /Get-FeatureInfo /FeatureName:VirtualMachinePlatform
      4⤵
      PID:3528
    - - C:\Windows\System32\Dism\dismhost.exe
        
        C:\Windows\System32\Dism\dismhost.exe {607B36D7-8480-4EC1-A6BD-13B3F7AB54DE}
        5⤵
        
        PID:5096
  - - C:\Windows\System32\findstr.exe
      findstr /i "State"
      4⤵
      PID:5448
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /c dism /online /english /Get-FeatureInfo /FeatureName:HypervisorPlatform 2>nul | findstr /i "State"
    3⤵
    - Executes a command shell one-liner
    PID:1740
  - - C:\Windows\System32\Dism.exe
      dism /online /english /Get-FeatureInfo /FeatureName:HypervisorPlatform
      4⤵
      PID:4708
    - - C:\Windows\System32\Dism\dismhost.exe
        
        C:\Windows\System32\Dism\dismhost.exe {870DB828-0721-4755-A444-7A668FA49199}
        5⤵
        
        PID:5408
  - - C:\Windows\System32\findstr.exe
      findstr /i "State"
      4⤵
      PID:1344
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /c C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "(Get-CimInstance -ClassName Win32_DeviceGuard -Namespace root\Microsoft\Windows\DeviceGuard).VirtualizationBasedSecurityStatus" 2>nul
    3⤵
    PID:3388
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "(Get-CimInstance -ClassName Win32_DeviceGuard -Namespace root\Microsoft\Windows\DeviceGuard).VirtualizationBasedSecurityStatus"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:3304
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /c C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "(Get-CimInstance Win32_ComputerSystem).HypervisorPresent" 2>nul
    3⤵
    - Executes a command shell one-liner
    PID:876
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "(Get-CimInstance Win32_ComputerSystem).HypervisorPresent"
      4⤵
      PID:2064
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /c bcdedit /enum {c0a23914-7be3-11f1-8f87-db87fe0923f2} 2>nul | findstr /i "vsmlaunchtype"
    3⤵
    - Executes a command shell one-liner
    PID:3404
  - - C:\Windows\System32\bcdedit.exe
      bcdedit /enum {c0a23914-7be3-11f1-8f87-db87fe0923f2}
      4⤵
      Modifies boot configuration data using bcdedit
      PID:5960
  - - C:\Windows\System32\findstr.exe
      findstr /i "vsmlaunchtype"
      4⤵
      PID:3320
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /c reg query "HKLM\SYSTEM\CurrentControlSet\Control\CI\Policy" /v VerifiedAndReputablePolicyState 2>nul
    3⤵
    - Executes a command shell one-liner
    PID:3788
  - - C:\Windows\System32\reg.exe
      reg query "HKLM\SYSTEM\CurrentControlSet\Control\CI\Policy" /v VerifiedAndReputablePolicyState
      4⤵
      PID:2784
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /c C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "(Get-CimInstance -Namespace root\SecurityCenter2 -Class AntiVirusProduct | Where-Object displayName -eq 'Bitdefender Antivirus').displayName"
    3⤵
    - Executes a command shell one-liner
    PID:6036
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "(Get-CimInstance -Namespace root\SecurityCenter2 -Class AntiVirusProduct | Where-Object displayName -eq 'Bitdefender Antivirus').displayName"
      4⤵
      PID:1440
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "if ((Get-Process explorer).Modules.ModuleName -like '*MacType*'){exit 3}"
    3⤵
    PID:5304
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /c bcdedit /enum {c0a23914-7be3-11f1-8f87-db87fe0923f2} 2>nul | findstr /i "testsigning"
    3⤵
    - Executes a command shell one-liner
    PID:2660
  - - C:\Windows\System32\bcdedit.exe
      bcdedit /enum {c0a23914-7be3-11f1-8f87-db87fe0923f2}
      4⤵
      Modifies boot configuration data using bcdedit
      PID:6020
  - - C:\Windows\System32\findstr.exe
      findstr /i "testsigning"
      4⤵
      PID:4212
- - C:\Windows\System32\bcdedit.exe
    bcdedit /set {c0a23914-7be3-11f1-8f87-db87fe0923f2} testsigning on
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:3932
- - C:\Windows\System32\reg.exe
    reg add "HKLM\SOFTWARE\ManageVBS" /v TestSigning /t REG_DWORD /d 1 /f
    3⤵
    PID:2244
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /c bcdedit /enum {c0a23914-7be3-11f1-8f87-db87fe0923f2} 2>nul | findstr /i "bootmenupolicy"
    3⤵
    - Executes a command shell one-liner
    PID:1476
  - - C:\Windows\System32\bcdedit.exe
      bcdedit /enum {c0a23914-7be3-11f1-8f87-db87fe0923f2}
      4⤵
      Modifies boot configuration data using bcdedit
      PID:5012
  - - C:\Windows\System32\findstr.exe
      findstr /i "bootmenupolicy"
      4⤵
      PID:1960
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /c bcdedit /enum all 2>nul | findstr /i "advancedoptions"
    3⤵
    - Executes a command shell one-liner
    PID:4764
  - - C:\Windows\System32\bcdedit.exe
      bcdedit /enum all
      4⤵
      Modifies boot configuration data using bcdedit
      PID:3760
  - - C:\Windows\System32\findstr.exe
      findstr /i "advancedoptions"
      4⤵
      PID:3268
- - C:\Windows\System32\choice.exe
    choice /C:12 /N /M "[1] Restart Now [2] Restart Later:
    3⤵
    PID:1160
- - C:\Windows\System32\shutdown.exe
    shutdown /r /t 0
    3⤵
    PID:1284
- C:\Windows\System32\reg.exe
  reg add HKCU\Console /v QuickEdit /t REG_DWORD /d 1 /f
  2⤵
  - Modifies registry key
  PID:244

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa398e855 /state1:0x41c64e6d
1⤵
PID:2440

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k CameraMonitor
1⤵
PID:3164

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact