05d2d9b4e0bd7f66541fb5f8f1534a95822d37e1ccbfc741e5890489694a5e28

Analysis

user interaction
yes
max time kernel
148s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
22/08/2026, 22:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
iontemp.exe
Size 4.5MB
Sample260822-2cfcvsgf43
SHA256 05d2d9b4e0bd7f66541fb5f8f1534a95822d37e1ccbfc741e5890489694a5e28
MD5 04a28a66dc4c969cdf7c4668fe50d11b
SHA1 9cf48c18bdfa8d285e9c91fb9d24992196b5b62c
SHA512 74be4fb91ee40db7defb1ab9f013615a7c924da07b8f60e082d2d6d78a9bae513218c208504ddc1d8da04e28d5acc866599e1d7c835cc894eb30c86412190f8f
SSDEEP 98304:OFbjgUXdZdz7H87fy+iOh+CGVfkzpm09O2lyigQwyZlz:OFvTRz7hNOh+XdkzpnO2po4
TLSH
T1CB2633B432D32C46F2BF9E792FE6A5454238DE9B346D4733268138027DDA369350726E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

defense_evasion execution themida trojan

Malware Config

Signatures

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	iontemp.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	iontemp.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	iontemp.exe

Themida packer 19 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
behavioral1/memory/888-0-0x00007FF61F780000-0x00007FF620317000-memory.dmp	themida
behavioral1/memory/888-1-0x00007FF61F780000-0x00007FF620317000-memory.dmp	themida
behavioral1/memory/888-3-0x00007FF61F780000-0x00007FF620317000-memory.dmp	themida
behavioral1/memory/888-2-0x00007FF61F780000-0x00007FF620317000-memory.dmp	themida
behavioral1/memory/888-4-0x00007FF61F780000-0x00007FF620317000-memory.dmp	themida
behavioral1/memory/888-7-0x00007FF61F780000-0x00007FF620317000-memory.dmp	themida
behavioral1/memory/888-6-0x00007FF61F780000-0x00007FF620317000-memory.dmp	themida
behavioral1/memory/888-5-0x00007FF61F780000-0x00007FF620317000-memory.dmp	themida
behavioral1/memory/888-9-0x00007FF61F780000-0x00007FF620317000-memory.dmp	themida
behavioral1/memory/888-10-0x00007FF61F780000-0x00007FF620317000-memory.dmp	themida
behavioral1/memory/888-11-0x00007FF61F780000-0x00007FF620317000-memory.dmp	themida
behavioral1/memory/888-13-0x00007FF61F780000-0x00007FF620317000-memory.dmp	themida
behavioral1/memory/888-14-0x00007FF61F780000-0x00007FF620317000-memory.dmp	themida
behavioral1/memory/888-15-0x00007FF61F780000-0x00007FF620317000-memory.dmp	themida
behavioral1/memory/888-16-0x00007FF61F780000-0x00007FF620317000-memory.dmp	themida
behavioral1/memory/888-26-0x00007FF61F780000-0x00007FF620317000-memory.dmp	themida
behavioral1/memory/888-27-0x00007FF61F780000-0x00007FF620317000-memory.dmp	themida
behavioral1/memory/888-36-0x00007FF61F780000-0x00007FF620317000-memory.dmp	themida
behavioral1/memory/888-37-0x00007FF61F780000-0x00007FF620317000-memory.dmp	themida

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	iontemp.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
888	iontemp.exe

Executes a command shell one-liner 1 TTPs 39 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3760	cmd.exe
516	cmd.exe
2012	cmd.exe
568	cmd.exe
3340	cmd.exe
1420	cmd.exe
2300	cmd.exe
3888	cmd.exe
5032	cmd.exe
4800	cmd.exe
1908	cmd.exe
2560	cmd.exe
1788	cmd.exe
4432	cmd.exe
4576	cmd.exe
2984	cmd.exe
3612	cmd.exe
1440	cmd.exe
4532	cmd.exe
1116	cmd.exe
744	cmd.exe
1196	cmd.exe
5020	cmd.exe
4640	cmd.exe
1276	cmd.exe
1740	cmd.exe
3140	cmd.exe
4204	cmd.exe
2776	cmd.exe
4500	cmd.exe
4316	cmd.exe
1028	cmd.exe
3880	cmd.exe
2912	cmd.exe
2528	cmd.exe
3504	cmd.exe
2268	cmd.exe
616	cmd.exe
5068	cmd.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
888	iontemp.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	1916	WMIC.exe
Token: SeSecurityPrivilege	1916	WMIC.exe
Token: SeTakeOwnershipPrivilege	1916	WMIC.exe
Token: SeLoadDriverPrivilege	1916	WMIC.exe
Token: SeSystemProfilePrivilege	1916	WMIC.exe
Token: SeSystemtimePrivilege	1916	WMIC.exe
Token: SeProfSingleProcessPrivilege	1916	WMIC.exe
Token: SeIncBasePriorityPrivilege	1916	WMIC.exe
Token: SeCreatePagefilePrivilege	1916	WMIC.exe
Token: SeBackupPrivilege	1916	WMIC.exe
Token: SeRestorePrivilege	1916	WMIC.exe
Token: SeShutdownPrivilege	1916	WMIC.exe
Token: SeDebugPrivilege	1916	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1916	WMIC.exe
Token: SeRemoteShutdownPrivilege	1916	WMIC.exe
Token: SeUndockPrivilege	1916	WMIC.exe
Token: SeManageVolumePrivilege	1916	WMIC.exe
Token: 33	1916	WMIC.exe
Token: 34	1916	WMIC.exe
Token: 35	1916	WMIC.exe
Token: 36	1916	WMIC.exe
Token: SeIncreaseQuotaPrivilege	1916	WMIC.exe
Token: SeSecurityPrivilege	1916	WMIC.exe
Token: SeTakeOwnershipPrivilege	1916	WMIC.exe
Token: SeLoadDriverPrivilege	1916	WMIC.exe
Token: SeSystemProfilePrivilege	1916	WMIC.exe
Token: SeSystemtimePrivilege	1916	WMIC.exe
Token: SeProfSingleProcessPrivilege	1916	WMIC.exe
Token: SeIncBasePriorityPrivilege	1916	WMIC.exe
Token: SeCreatePagefilePrivilege	1916	WMIC.exe
Token: SeBackupPrivilege	1916	WMIC.exe
Token: SeRestorePrivilege	1916	WMIC.exe
Token: SeShutdownPrivilege	1916	WMIC.exe
Token: SeDebugPrivilege	1916	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1916	WMIC.exe
Token: SeRemoteShutdownPrivilege	1916	WMIC.exe
Token: SeUndockPrivilege	1916	WMIC.exe
Token: SeManageVolumePrivilege	1916	WMIC.exe
Token: 33	1916	WMIC.exe
Token: 34	1916	WMIC.exe
Token: 35	1916	WMIC.exe
Token: 36	1916	WMIC.exe
Token: SeIncreaseQuotaPrivilege	1124	WMIC.exe
Token: SeSecurityPrivilege	1124	WMIC.exe
Token: SeTakeOwnershipPrivilege	1124	WMIC.exe
Token: SeLoadDriverPrivilege	1124	WMIC.exe
Token: SeSystemProfilePrivilege	1124	WMIC.exe
Token: SeSystemtimePrivilege	1124	WMIC.exe
Token: SeProfSingleProcessPrivilege	1124	WMIC.exe
Token: SeIncBasePriorityPrivilege	1124	WMIC.exe
Token: SeCreatePagefilePrivilege	1124	WMIC.exe
Token: SeBackupPrivilege	1124	WMIC.exe
Token: SeRestorePrivilege	1124	WMIC.exe
Token: SeShutdownPrivilege	1124	WMIC.exe
Token: SeDebugPrivilege	1124	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1124	WMIC.exe
Token: SeRemoteShutdownPrivilege	1124	WMIC.exe
Token: SeUndockPrivilege	1124	WMIC.exe
Token: SeManageVolumePrivilege	1124	WMIC.exe
Token: 33	1124	WMIC.exe
Token: 34	1124	WMIC.exe
Token: 35	1124	WMIC.exe
Token: 36	1124	WMIC.exe
Token: SeIncreaseQuotaPrivilege	1124	WMIC.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
888	iontemp.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 888 wrote to memory of 2528	888	iontemp.exe	100
PID 2528 wrote to memory of 1916	2528	cmd.exe	102
PID 888 wrote to memory of 3504	888	iontemp.exe	103
PID 3504 wrote to memory of 1124	3504	cmd.exe	105
PID 888 wrote to memory of 568	888	iontemp.exe	106
PID 568 wrote to memory of 3556	568	cmd.exe	108
PID 888 wrote to memory of 3340	888	iontemp.exe	110
PID 3340 wrote to memory of 812	3340	cmd.exe	112
PID 888 wrote to memory of 5032	888	iontemp.exe	113
PID 5032 wrote to memory of 1244	5032	cmd.exe	115
PID 888 wrote to memory of 1788	888	iontemp.exe	116
PID 1788 wrote to memory of 1424	1788	cmd.exe	118
PID 888 wrote to memory of 4500	888	iontemp.exe	119
PID 4500 wrote to memory of 1576	4500	cmd.exe	121
PID 888 wrote to memory of 1420	888	iontemp.exe	122
PID 1420 wrote to memory of 2540	1420	cmd.exe	124
PID 888 wrote to memory of 4800	888	iontemp.exe	125
PID 4800 wrote to memory of 1668	4800	cmd.exe	127
PID 888 wrote to memory of 3140	888	iontemp.exe	128
PID 3140 wrote to memory of 4168	3140	cmd.exe	130
PID 888 wrote to memory of 3880	888	iontemp.exe	131
PID 3880 wrote to memory of 4324	3880	cmd.exe	133
PID 888 wrote to memory of 2268	888	iontemp.exe	134
PID 2268 wrote to memory of 1272	2268	cmd.exe	136
PID 888 wrote to memory of 4316	888	iontemp.exe	137
PID 4316 wrote to memory of 1168	4316	cmd.exe	139
PID 888 wrote to memory of 4204	888	iontemp.exe	142
PID 4204 wrote to memory of 2320	4204	cmd.exe	144
PID 888 wrote to memory of 1196	888	iontemp.exe	145
PID 1196 wrote to memory of 4028	1196	cmd.exe	147
PID 888 wrote to memory of 1908	888	iontemp.exe	148
PID 1908 wrote to memory of 4936	1908	cmd.exe	150
PID 888 wrote to memory of 616	888	iontemp.exe	151
PID 616 wrote to memory of 2580	616	cmd.exe	153
PID 888 wrote to memory of 2300	888	iontemp.exe	154
PID 2300 wrote to memory of 1740	2300	cmd.exe	156
PID 888 wrote to memory of 5020	888	iontemp.exe	157
PID 5020 wrote to memory of 952	5020	cmd.exe	159
PID 888 wrote to memory of 4432	888	iontemp.exe	160
PID 4432 wrote to memory of 4944	4432	cmd.exe	162
PID 888 wrote to memory of 4640	888	iontemp.exe	163
PID 4640 wrote to memory of 4324	4640	cmd.exe	165
PID 888 wrote to memory of 4576	888	iontemp.exe	166
PID 4576 wrote to memory of 1272	4576	cmd.exe	168
PID 888 wrote to memory of 5068	888	iontemp.exe	169
PID 5068 wrote to memory of 2100	5068	cmd.exe	171
PID 888 wrote to memory of 2984	888	iontemp.exe	172
PID 2984 wrote to memory of 2680	2984	cmd.exe	174
PID 888 wrote to memory of 3760	888	iontemp.exe	175
PID 3760 wrote to memory of 3096	3760	cmd.exe	177
PID 888 wrote to memory of 516	888	iontemp.exe	178
PID 516 wrote to memory of 4364	516	cmd.exe	180
PID 888 wrote to memory of 1116	888	iontemp.exe	181
PID 1116 wrote to memory of 1256	1116	cmd.exe	183
PID 888 wrote to memory of 744	888	iontemp.exe	184
PID 744 wrote to memory of 2836	744	cmd.exe	186
PID 888 wrote to memory of 2012	888	iontemp.exe	187
PID 2012 wrote to memory of 4736	2012	cmd.exe	189
PID 888 wrote to memory of 3612	888	iontemp.exe	190
PID 3612 wrote to memory of 2736	3612	cmd.exe	192
PID 888 wrote to memory of 1276	888	iontemp.exe	193
PID 1276 wrote to memory of 4428	1276	cmd.exe	195
PID 888 wrote to memory of 1440	888	iontemp.exe	196
PID 1440 wrote to memory of 4216	1440	cmd.exe	198

C:\Users\Admin\AppData\Local\Temp\iontemp.exe
"C:\Users\Admin\AppData\Local\Temp\iontemp.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:888
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c wmic csproduct get uuid 2>nul
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2528
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic csproduct get uuid
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1916
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c wmic diskdrive get serialnumber
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3504
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic diskdrive get serialnumber
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1124
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c getmac /fo csv /v
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:568
- - C:\Windows\system32\getmac.exe
    getmac /fo csv /v
    3⤵
    PID:3556
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c reg query "HKLM\SYSTEM\CurrentControlSet\Control\Class\{4d36e972-e325-11ce-bfc1-08002be10318}\0000" /v NetworkAddress 2>nul
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3340
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SYSTEM\CurrentControlSet\Control\Class\{4d36e972-e325-11ce-bfc1-08002be10318}\0000" /v NetworkAddress
    3⤵
    PID:812
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c reg query "HKLM\SYSTEM\CurrentControlSet\Control\Class\{4d36e972-e325-11ce-bfc1-08002be10318}\0001" /v NetworkAddress 2>nul
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5032
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SYSTEM\CurrentControlSet\Control\Class\{4d36e972-e325-11ce-bfc1-08002be10318}\0001" /v NetworkAddress
    3⤵
    PID:1244
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c reg query "HKLM\SYSTEM\CurrentControlSet\Control\Class\{4d36e972-e325-11ce-bfc1-08002be10318}\0002" /v NetworkAddress 2>nul
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1788
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SYSTEM\CurrentControlSet\Control\Class\{4d36e972-e325-11ce-bfc1-08002be10318}\0002" /v NetworkAddress
    3⤵
    PID:1424
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c reg query "HKLM\SYSTEM\CurrentControlSet\Control\Class\{4d36e972-e325-11ce-bfc1-08002be10318}\0003" /v NetworkAddress 2>nul
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4500
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SYSTEM\CurrentControlSet\Control\Class\{4d36e972-e325-11ce-bfc1-08002be10318}\0003" /v NetworkAddress
    3⤵
    PID:1576
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c reg query "HKLM\SYSTEM\CurrentControlSet\Control\Class\{4d36e972-e325-11ce-bfc1-08002be10318}\0004" /v NetworkAddress 2>nul
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1420
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SYSTEM\CurrentControlSet\Control\Class\{4d36e972-e325-11ce-bfc1-08002be10318}\0004" /v NetworkAddress
    3⤵
    PID:2540
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c reg query "HKLM\SYSTEM\CurrentControlSet\Control\Class\{4d36e972-e325-11ce-bfc1-08002be10318}\0005" /v NetworkAddress 2>nul
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4800
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SYSTEM\CurrentControlSet\Control\Class\{4d36e972-e325-11ce-bfc1-08002be10318}\0005" /v NetworkAddress
    3⤵
    PID:1668
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c reg query "HKLM\SYSTEM\CurrentControlSet\Control\Class\{4d36e972-e325-11ce-bfc1-08002be10318}\0006" /v NetworkAddress 2>nul
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3140
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SYSTEM\CurrentControlSet\Control\Class\{4d36e972-e325-11ce-bfc1-08002be10318}\0006" /v NetworkAddress
    3⤵
    PID:4168
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c reg query "HKLM\SYSTEM\CurrentControlSet\Control\Class\{4d36e972-e325-11ce-bfc1-08002be10318}\0007" /v NetworkAddress 2>nul
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3880
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SYSTEM\CurrentControlSet\Control\Class\{4d36e972-e325-11ce-bfc1-08002be10318}\0007" /v NetworkAddress
    3⤵
    PID:4324
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c reg query "HKLM\SYSTEM\CurrentControlSet\Control\Class\{4d36e972-e325-11ce-bfc1-08002be10318}\0008" /v NetworkAddress 2>nul
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2268
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SYSTEM\CurrentControlSet\Control\Class\{4d36e972-e325-11ce-bfc1-08002be10318}\0008" /v NetworkAddress
    3⤵
    PID:1272
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c reg query "HKLM\SYSTEM\CurrentControlSet\Control\Class\{4d36e972-e325-11ce-bfc1-08002be10318}\0009" /v NetworkAddress 2>nul
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4316
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SYSTEM\CurrentControlSet\Control\Class\{4d36e972-e325-11ce-bfc1-08002be10318}\0009" /v NetworkAddress
    3⤵
    PID:1168
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c wmic csproduct get uuid 2>nul
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4204
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic csproduct get uuid
    3⤵
    PID:2320
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c wmic diskdrive get serialnumber
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1196
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic diskdrive get serialnumber
    3⤵
    PID:4028
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c getmac /fo csv /v
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1908
- - C:\Windows\system32\getmac.exe
    getmac /fo csv /v
    3⤵
    PID:4936
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c reg query "HKLM\SYSTEM\CurrentControlSet\Control\Class\{4d36e972-e325-11ce-bfc1-08002be10318}\0000" /v NetworkAddress 2>nul
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:616
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SYSTEM\CurrentControlSet\Control\Class\{4d36e972-e325-11ce-bfc1-08002be10318}\0000" /v NetworkAddress
    3⤵
    PID:2580
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c reg query "HKLM\SYSTEM\CurrentControlSet\Control\Class\{4d36e972-e325-11ce-bfc1-08002be10318}\0001" /v NetworkAddress 2>nul
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2300
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SYSTEM\CurrentControlSet\Control\Class\{4d36e972-e325-11ce-bfc1-08002be10318}\0001" /v NetworkAddress
    3⤵
    PID:1740
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c reg query "HKLM\SYSTEM\CurrentControlSet\Control\Class\{4d36e972-e325-11ce-bfc1-08002be10318}\0002" /v NetworkAddress 2>nul
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5020
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SYSTEM\CurrentControlSet\Control\Class\{4d36e972-e325-11ce-bfc1-08002be10318}\0002" /v NetworkAddress
    3⤵
    PID:952
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c reg query "HKLM\SYSTEM\CurrentControlSet\Control\Class\{4d36e972-e325-11ce-bfc1-08002be10318}\0003" /v NetworkAddress 2>nul
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4432
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SYSTEM\CurrentControlSet\Control\Class\{4d36e972-e325-11ce-bfc1-08002be10318}\0003" /v NetworkAddress
    3⤵
    PID:4944
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c reg query "HKLM\SYSTEM\CurrentControlSet\Control\Class\{4d36e972-e325-11ce-bfc1-08002be10318}\0004" /v NetworkAddress 2>nul
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4640
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SYSTEM\CurrentControlSet\Control\Class\{4d36e972-e325-11ce-bfc1-08002be10318}\0004" /v NetworkAddress
    3⤵
    PID:4324
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c reg query "HKLM\SYSTEM\CurrentControlSet\Control\Class\{4d36e972-e325-11ce-bfc1-08002be10318}\0005" /v NetworkAddress 2>nul
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4576
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SYSTEM\CurrentControlSet\Control\Class\{4d36e972-e325-11ce-bfc1-08002be10318}\0005" /v NetworkAddress
    3⤵
    PID:1272
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c reg query "HKLM\SYSTEM\CurrentControlSet\Control\Class\{4d36e972-e325-11ce-bfc1-08002be10318}\0006" /v NetworkAddress 2>nul
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5068
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SYSTEM\CurrentControlSet\Control\Class\{4d36e972-e325-11ce-bfc1-08002be10318}\0006" /v NetworkAddress
    3⤵
    PID:2100
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c reg query "HKLM\SYSTEM\CurrentControlSet\Control\Class\{4d36e972-e325-11ce-bfc1-08002be10318}\0007" /v NetworkAddress 2>nul
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2984
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SYSTEM\CurrentControlSet\Control\Class\{4d36e972-e325-11ce-bfc1-08002be10318}\0007" /v NetworkAddress
    3⤵
    PID:2680
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c reg query "HKLM\SYSTEM\CurrentControlSet\Control\Class\{4d36e972-e325-11ce-bfc1-08002be10318}\0008" /v NetworkAddress 2>nul
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3760
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SYSTEM\CurrentControlSet\Control\Class\{4d36e972-e325-11ce-bfc1-08002be10318}\0008" /v NetworkAddress
    3⤵
    PID:3096
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c reg query "HKLM\SYSTEM\CurrentControlSet\Control\Class\{4d36e972-e325-11ce-bfc1-08002be10318}\0009" /v NetworkAddress 2>nul
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:516
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SYSTEM\CurrentControlSet\Control\Class\{4d36e972-e325-11ce-bfc1-08002be10318}\0009" /v NetworkAddress
    3⤵
    PID:4364
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c wmic csproduct get uuid 2>nul
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1116
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic csproduct get uuid
    3⤵
    PID:1256
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c wmic diskdrive get serialnumber
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:744
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic diskdrive get serialnumber
    3⤵
    PID:2836
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c getmac /fo csv /v
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2012
- - C:\Windows\system32\getmac.exe
    getmac /fo csv /v
    3⤵
    PID:4736
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c reg query "HKLM\SYSTEM\CurrentControlSet\Control\Class\{4d36e972-e325-11ce-bfc1-08002be10318}\0000" /v NetworkAddress 2>nul
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3612
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SYSTEM\CurrentControlSet\Control\Class\{4d36e972-e325-11ce-bfc1-08002be10318}\0000" /v NetworkAddress
    3⤵
    PID:2736
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c reg query "HKLM\SYSTEM\CurrentControlSet\Control\Class\{4d36e972-e325-11ce-bfc1-08002be10318}\0001" /v NetworkAddress 2>nul
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1276
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SYSTEM\CurrentControlSet\Control\Class\{4d36e972-e325-11ce-bfc1-08002be10318}\0001" /v NetworkAddress
    3⤵
    PID:4428
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c reg query "HKLM\SYSTEM\CurrentControlSet\Control\Class\{4d36e972-e325-11ce-bfc1-08002be10318}\0002" /v NetworkAddress 2>nul
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1440
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SYSTEM\CurrentControlSet\Control\Class\{4d36e972-e325-11ce-bfc1-08002be10318}\0002" /v NetworkAddress
    3⤵
    PID:4216
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c reg query "HKLM\SYSTEM\CurrentControlSet\Control\Class\{4d36e972-e325-11ce-bfc1-08002be10318}\0003" /v NetworkAddress 2>nul
  2⤵
  - Executes a command shell one-liner
  PID:2776
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SYSTEM\CurrentControlSet\Control\Class\{4d36e972-e325-11ce-bfc1-08002be10318}\0003" /v NetworkAddress
    3⤵
    PID:2832
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c reg query "HKLM\SYSTEM\CurrentControlSet\Control\Class\{4d36e972-e325-11ce-bfc1-08002be10318}\0004" /v NetworkAddress 2>nul
  2⤵
  - Executes a command shell one-liner
  PID:2912
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SYSTEM\CurrentControlSet\Control\Class\{4d36e972-e325-11ce-bfc1-08002be10318}\0004" /v NetworkAddress
    3⤵
    PID:1636
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c reg query "HKLM\SYSTEM\CurrentControlSet\Control\Class\{4d36e972-e325-11ce-bfc1-08002be10318}\0005" /v NetworkAddress 2>nul
  2⤵
  - Executes a command shell one-liner
  PID:1740
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SYSTEM\CurrentControlSet\Control\Class\{4d36e972-e325-11ce-bfc1-08002be10318}\0005" /v NetworkAddress
    3⤵
    PID:2860
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c reg query "HKLM\SYSTEM\CurrentControlSet\Control\Class\{4d36e972-e325-11ce-bfc1-08002be10318}\0006" /v NetworkAddress 2>nul
  2⤵
  - Executes a command shell one-liner
  PID:2560
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SYSTEM\CurrentControlSet\Control\Class\{4d36e972-e325-11ce-bfc1-08002be10318}\0006" /v NetworkAddress
    3⤵
    PID:4944
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c reg query "HKLM\SYSTEM\CurrentControlSet\Control\Class\{4d36e972-e325-11ce-bfc1-08002be10318}\0007" /v NetworkAddress 2>nul
  2⤵
  - Executes a command shell one-liner
  PID:1028
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SYSTEM\CurrentControlSet\Control\Class\{4d36e972-e325-11ce-bfc1-08002be10318}\0007" /v NetworkAddress
    3⤵
    PID:3768
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c reg query "HKLM\SYSTEM\CurrentControlSet\Control\Class\{4d36e972-e325-11ce-bfc1-08002be10318}\0008" /v NetworkAddress 2>nul
  2⤵
  - Executes a command shell one-liner
  PID:3888
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SYSTEM\CurrentControlSet\Control\Class\{4d36e972-e325-11ce-bfc1-08002be10318}\0008" /v NetworkAddress
    3⤵
    PID:1656
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c reg query "HKLM\SYSTEM\CurrentControlSet\Control\Class\{4d36e972-e325-11ce-bfc1-08002be10318}\0009" /v NetworkAddress 2>nul
  2⤵
  - Executes a command shell one-liner
  PID:4532
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SYSTEM\CurrentControlSet\Control\Class\{4d36e972-e325-11ce-bfc1-08002be10318}\0009" /v NetworkAddress
    3⤵
    PID:1396

C:\Windows\system32\werfault.exe
werfault.exe /h /shared Global\1788617b2a334ea5bc7f2567c2f6fdf5 /t 2468 /p 888
1⤵
PID:5100

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/888-0-0x00007FF61F780000-0x00007FF620317000-memory.dmp

Download

memory/888-1-0x00007FF61F780000-0x00007FF620317000-memory.dmp

Download

memory/888-3-0x00007FF61F780000-0x00007FF620317000-memory.dmp

Download

memory/888-2-0x00007FF61F780000-0x00007FF620317000-memory.dmp

Download

memory/888-4-0x00007FF61F780000-0x00007FF620317000-memory.dmp

Download

memory/888-7-0x00007FF61F780000-0x00007FF620317000-memory.dmp

Download

memory/888-6-0x00007FF61F780000-0x00007FF620317000-memory.dmp

Download

memory/888-8-0x00007FF61F925000-0x00007FF61F926000-memory.dmp

Download

memory/888-5-0x00007FF61F780000-0x00007FF620317000-memory.dmp

Download

memory/888-9-0x00007FF61F780000-0x00007FF620317000-memory.dmp

Download

memory/888-10-0x00007FF61F780000-0x00007FF620317000-memory.dmp

Download

memory/888-11-0x00007FF61F780000-0x00007FF620317000-memory.dmp

Download

memory/888-13-0x00007FF61F780000-0x00007FF620317000-memory.dmp

Download

memory/888-14-0x00007FF61F780000-0x00007FF620317000-memory.dmp

Download

memory/888-15-0x00007FF61F780000-0x00007FF620317000-memory.dmp

Download

memory/888-16-0x00007FF61F780000-0x00007FF620317000-memory.dmp

Download

memory/888-26-0x00007FF61F780000-0x00007FF620317000-memory.dmp

Download

memory/888-27-0x00007FF61F780000-0x00007FF620317000-memory.dmp

Download

memory/888-36-0x00007FF61F780000-0x00007FF620317000-memory.dmp

Download

memory/888-37-0x00007FF61F780000-0x00007FF620317000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads