05d2d9b4e0bd7f66541fb5f8f1534a95822d37e1ccbfc741e5890489694a5e28

Analysis

user interaction
yes
max time kernel
149s
max time network
138s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
22/08/2026, 22:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
iontemp.exe
Size 4.5MB
Sample260822-2cfcvsgf43
SHA256 05d2d9b4e0bd7f66541fb5f8f1534a95822d37e1ccbfc741e5890489694a5e28
MD5 04a28a66dc4c969cdf7c4668fe50d11b
SHA1 9cf48c18bdfa8d285e9c91fb9d24992196b5b62c
SHA512 74be4fb91ee40db7defb1ab9f013615a7c924da07b8f60e082d2d6d78a9bae513218c208504ddc1d8da04e28d5acc866599e1d7c835cc894eb30c86412190f8f
SSDEEP 98304:OFbjgUXdZdz7H87fy+iOh+CGVfkzpm09O2lyigQwyZlz:OFvTRz7hNOh+XdkzpnO2po4
TLSH
T1CB2633B432D32C46F2BF9E792FE6A5454238DE9B346D4733268138027DDA369350726E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

defense_evasion execution persistence themida trojan

Malware Config

Signatures

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	iontemp.exe

Sets service image path in registry 3 TTPs 1 IoCs

This determines the executable launched when a service starts. It can be used to establish persistence.

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Windows Service

T1543.003

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\fIjcHRpTwaVsIUmcF\ImagePath = "\\??\\C:\\Users\\Admin\\AppData\\Local\\Temp\\fIjcHRpTwaVsIUmcF"	iontemp.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	iontemp.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	iontemp.exe

Themida packer 15 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
behavioral2/memory/828-0-0x00007FF66E540000-0x00007FF66F0D7000-memory.dmp	themida
behavioral2/memory/828-1-0x00007FF66E540000-0x00007FF66F0D7000-memory.dmp	themida
behavioral2/memory/828-2-0x00007FF66E540000-0x00007FF66F0D7000-memory.dmp	themida
behavioral2/memory/828-3-0x00007FF66E540000-0x00007FF66F0D7000-memory.dmp	themida
behavioral2/memory/828-6-0x00007FF66E540000-0x00007FF66F0D7000-memory.dmp	themida
behavioral2/memory/828-7-0x00007FF66E540000-0x00007FF66F0D7000-memory.dmp	themida
behavioral2/memory/828-5-0x00007FF66E540000-0x00007FF66F0D7000-memory.dmp	themida
behavioral2/memory/828-4-0x00007FF66E540000-0x00007FF66F0D7000-memory.dmp	themida
behavioral2/memory/828-9-0x00007FF66E540000-0x00007FF66F0D7000-memory.dmp	themida
behavioral2/memory/828-10-0x00007FF66E540000-0x00007FF66F0D7000-memory.dmp	themida
behavioral2/memory/828-11-0x00007FF66E540000-0x00007FF66F0D7000-memory.dmp	themida
behavioral2/memory/828-17-0x00007FF66E540000-0x00007FF66F0D7000-memory.dmp	themida
behavioral2/memory/828-31-0x00007FF66E540000-0x00007FF66F0D7000-memory.dmp	themida
behavioral2/memory/828-33-0x00007FF66E540000-0x00007FF66F0D7000-memory.dmp	themida
behavioral2/memory/828-34-0x00007FF66E540000-0x00007FF66F0D7000-memory.dmp	themida

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	iontemp.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
828	iontemp.exe

Executes a command shell one-liner 1 TTPs 40 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2404	cmd.exe
3680	cmd.exe
2632	cmd.exe
3264	cmd.exe
6040	cmd.exe
6096	cmd.exe
2972	cmd.exe
5896	cmd.exe
5028	cmd.exe
3276	cmd.exe
4140	cmd.exe
3460	cmd.exe
5912	cmd.exe
888	cmd.exe
2384	cmd.exe
4800	cmd.exe
4880	cmd.exe
4452	cmd.exe
4104	cmd.exe
4680	cmd.exe
5264	cmd.exe
5268	cmd.exe
3856	cmd.exe
2224	cmd.exe
1704	cmd.exe
4268	cmd.exe
5636	cmd.exe
3416	cmd.exe
3500	cmd.exe
3212	cmd.exe
4112	cmd.exe
4552	cmd.exe
2340	cmd.exe
3248	cmd.exe
3712	cmd.exe
2068	cmd.exe
4356	cmd.exe
5876	cmd.exe
1436	cmd.exe
1716	cmd.exe

Suspicious behavior: EnumeratesProcesses 24 IoCs

pid	Process
1216	WMIC.exe
1216	WMIC.exe
1216	WMIC.exe
1216	WMIC.exe
2472	WMIC.exe
2472	WMIC.exe
2472	WMIC.exe
2472	WMIC.exe
1696	WMIC.exe
1696	WMIC.exe
1696	WMIC.exe
1696	WMIC.exe
4596	WMIC.exe
4596	WMIC.exe
4596	WMIC.exe
4596	WMIC.exe
1136	WMIC.exe
1136	WMIC.exe
1136	WMIC.exe
1136	WMIC.exe
5400	WMIC.exe
5400	WMIC.exe
5400	WMIC.exe
5400	WMIC.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
828	iontemp.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
828	iontemp.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	1216	WMIC.exe
Token: SeSecurityPrivilege	1216	WMIC.exe
Token: SeTakeOwnershipPrivilege	1216	WMIC.exe
Token: SeLoadDriverPrivilege	1216	WMIC.exe
Token: SeSystemProfilePrivilege	1216	WMIC.exe
Token: SeSystemtimePrivilege	1216	WMIC.exe
Token: SeProfSingleProcessPrivilege	1216	WMIC.exe
Token: SeIncBasePriorityPrivilege	1216	WMIC.exe
Token: SeCreatePagefilePrivilege	1216	WMIC.exe
Token: SeBackupPrivilege	1216	WMIC.exe
Token: SeRestorePrivilege	1216	WMIC.exe
Token: SeShutdownPrivilege	1216	WMIC.exe
Token: SeDebugPrivilege	1216	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1216	WMIC.exe
Token: SeRemoteShutdownPrivilege	1216	WMIC.exe
Token: SeUndockPrivilege	1216	WMIC.exe
Token: SeManageVolumePrivilege	1216	WMIC.exe
Token: 33	1216	WMIC.exe
Token: 34	1216	WMIC.exe
Token: 35	1216	WMIC.exe
Token: 36	1216	WMIC.exe
Token: SeIncreaseQuotaPrivilege	1216	WMIC.exe
Token: SeSecurityPrivilege	1216	WMIC.exe
Token: SeTakeOwnershipPrivilege	1216	WMIC.exe
Token: SeLoadDriverPrivilege	1216	WMIC.exe
Token: SeSystemProfilePrivilege	1216	WMIC.exe
Token: SeSystemtimePrivilege	1216	WMIC.exe
Token: SeProfSingleProcessPrivilege	1216	WMIC.exe
Token: SeIncBasePriorityPrivilege	1216	WMIC.exe
Token: SeCreatePagefilePrivilege	1216	WMIC.exe
Token: SeBackupPrivilege	1216	WMIC.exe
Token: SeRestorePrivilege	1216	WMIC.exe
Token: SeShutdownPrivilege	1216	WMIC.exe
Token: SeDebugPrivilege	1216	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1216	WMIC.exe
Token: SeRemoteShutdownPrivilege	1216	WMIC.exe
Token: SeUndockPrivilege	1216	WMIC.exe
Token: SeManageVolumePrivilege	1216	WMIC.exe
Token: 33	1216	WMIC.exe
Token: 34	1216	WMIC.exe
Token: 35	1216	WMIC.exe
Token: 36	1216	WMIC.exe
Token: SeIncreaseQuotaPrivilege	2472	WMIC.exe
Token: SeSecurityPrivilege	2472	WMIC.exe
Token: SeTakeOwnershipPrivilege	2472	WMIC.exe
Token: SeLoadDriverPrivilege	2472	WMIC.exe
Token: SeSystemProfilePrivilege	2472	WMIC.exe
Token: SeSystemtimePrivilege	2472	WMIC.exe
Token: SeProfSingleProcessPrivilege	2472	WMIC.exe
Token: SeIncBasePriorityPrivilege	2472	WMIC.exe
Token: SeCreatePagefilePrivilege	2472	WMIC.exe
Token: SeBackupPrivilege	2472	WMIC.exe
Token: SeRestorePrivilege	2472	WMIC.exe
Token: SeShutdownPrivilege	2472	WMIC.exe
Token: SeDebugPrivilege	2472	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2472	WMIC.exe
Token: SeRemoteShutdownPrivilege	2472	WMIC.exe
Token: SeUndockPrivilege	2472	WMIC.exe
Token: SeManageVolumePrivilege	2472	WMIC.exe
Token: 33	2472	WMIC.exe
Token: 34	2472	WMIC.exe
Token: 35	2472	WMIC.exe
Token: 36	2472	WMIC.exe
Token: SeIncreaseQuotaPrivilege	2472	WMIC.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
828	iontemp.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 828 wrote to memory of 3680	828	iontemp.exe	90
PID 3680 wrote to memory of 1216	3680	cmd.exe	92
PID 828 wrote to memory of 5912	828	iontemp.exe	94
PID 5912 wrote to memory of 2472	5912	cmd.exe	96
PID 828 wrote to memory of 2340	828	iontemp.exe	97
PID 2340 wrote to memory of 3412	2340	cmd.exe	99
PID 828 wrote to memory of 3500	828	iontemp.exe	101
PID 3500 wrote to memory of 2096	3500	cmd.exe	103
PID 828 wrote to memory of 6096	828	iontemp.exe	104
PID 6096 wrote to memory of 5652	6096	cmd.exe	106
PID 828 wrote to memory of 5876	828	iontemp.exe	107
PID 5876 wrote to memory of 3220	5876	cmd.exe	109
PID 828 wrote to memory of 888	828	iontemp.exe	110
PID 888 wrote to memory of 1716	888	cmd.exe	112
PID 828 wrote to memory of 4452	828	iontemp.exe	113
PID 4452 wrote to memory of 4132	4452	cmd.exe	115
PID 828 wrote to memory of 4104	828	iontemp.exe	116
PID 4104 wrote to memory of 2128	4104	cmd.exe	118
PID 828 wrote to memory of 3856	828	iontemp.exe	119
PID 3856 wrote to memory of 4556	3856	cmd.exe	121
PID 828 wrote to memory of 2632	828	iontemp.exe	122
PID 2632 wrote to memory of 3536	2632	cmd.exe	124
PID 828 wrote to memory of 2384	828	iontemp.exe	125
PID 2384 wrote to memory of 3244	2384	cmd.exe	127
PID 828 wrote to memory of 2224	828	iontemp.exe	128
PID 2224 wrote to memory of 4380	2224	cmd.exe	130
PID 828 wrote to memory of 2404	828	iontemp.exe	131
PID 2404 wrote to memory of 1696	2404	cmd.exe	133
PID 828 wrote to memory of 3248	828	iontemp.exe	134
PID 3248 wrote to memory of 4596	3248	cmd.exe	136
PID 828 wrote to memory of 3212	828	iontemp.exe	137
PID 3212 wrote to memory of 4092	3212	cmd.exe	139
PID 828 wrote to memory of 4680	828	iontemp.exe	140
PID 4680 wrote to memory of 992	4680	cmd.exe	142
PID 828 wrote to memory of 4112	828	iontemp.exe	143
PID 4112 wrote to memory of 5252	4112	cmd.exe	145
PID 828 wrote to memory of 1436	828	iontemp.exe	146
PID 1436 wrote to memory of 6024	1436	cmd.exe	148
PID 828 wrote to memory of 2972	828	iontemp.exe	149
PID 2972 wrote to memory of 4580	2972	cmd.exe	151
PID 828 wrote to memory of 5896	828	iontemp.exe	152
PID 5896 wrote to memory of 2292	5896	cmd.exe	154
PID 828 wrote to memory of 5028	828	iontemp.exe	155
PID 5028 wrote to memory of 5156	5028	cmd.exe	157
PID 828 wrote to memory of 3276	828	iontemp.exe	158
PID 3276 wrote to memory of 3664	3276	cmd.exe	160
PID 828 wrote to memory of 4552	828	iontemp.exe	161
PID 4552 wrote to memory of 4996	4552	cmd.exe	163
PID 828 wrote to memory of 4800	828	iontemp.exe	164
PID 4800 wrote to memory of 1888	4800	cmd.exe	166
PID 828 wrote to memory of 5264	828	iontemp.exe	167
PID 5264 wrote to memory of 4288	5264	cmd.exe	169
PID 828 wrote to memory of 3712	828	iontemp.exe	170
PID 3712 wrote to memory of 1136	3712	cmd.exe	172
PID 828 wrote to memory of 1704	828	iontemp.exe	173
PID 1704 wrote to memory of 4256	1704	cmd.exe	175
PID 828 wrote to memory of 2068	828	iontemp.exe	176
PID 2068 wrote to memory of 5400	2068	cmd.exe	178
PID 828 wrote to memory of 1716	828	iontemp.exe	179
PID 1716 wrote to memory of 2492	1716	cmd.exe	181
PID 828 wrote to memory of 4356	828	iontemp.exe	182
PID 4356 wrote to memory of 4860	4356	cmd.exe	184
PID 828 wrote to memory of 3264	828	iontemp.exe	185
PID 3264 wrote to memory of 2932	3264	cmd.exe	187

C:\Users\Admin\AppData\Local\Temp\iontemp.exe
"C:\Users\Admin\AppData\Local\Temp\iontemp.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Sets service image path in registry
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious behavior: LoadsDriver
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:828
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c wmic csproduct get uuid 2>nul
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3680
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic csproduct get uuid
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1216
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c wmic diskdrive get serialnumber
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5912
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic diskdrive get serialnumber
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2472
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c getmac /fo csv /v
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2340
- - C:\Windows\system32\getmac.exe
    getmac /fo csv /v
    3⤵
    PID:3412
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c reg query "HKLM\SYSTEM\CurrentControlSet\Control\Class\{4d36e972-e325-11ce-bfc1-08002be10318}\0000" /v NetworkAddress 2>nul
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3500
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SYSTEM\CurrentControlSet\Control\Class\{4d36e972-e325-11ce-bfc1-08002be10318}\0000" /v NetworkAddress
    3⤵
    PID:2096
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c reg query "HKLM\SYSTEM\CurrentControlSet\Control\Class\{4d36e972-e325-11ce-bfc1-08002be10318}\0001" /v NetworkAddress 2>nul
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:6096
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SYSTEM\CurrentControlSet\Control\Class\{4d36e972-e325-11ce-bfc1-08002be10318}\0001" /v NetworkAddress
    3⤵
    PID:5652
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c reg query "HKLM\SYSTEM\CurrentControlSet\Control\Class\{4d36e972-e325-11ce-bfc1-08002be10318}\0002" /v NetworkAddress 2>nul
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5876
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SYSTEM\CurrentControlSet\Control\Class\{4d36e972-e325-11ce-bfc1-08002be10318}\0002" /v NetworkAddress
    3⤵
    PID:3220
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c reg query "HKLM\SYSTEM\CurrentControlSet\Control\Class\{4d36e972-e325-11ce-bfc1-08002be10318}\0003" /v NetworkAddress 2>nul
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:888
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SYSTEM\CurrentControlSet\Control\Class\{4d36e972-e325-11ce-bfc1-08002be10318}\0003" /v NetworkAddress
    3⤵
    PID:1716
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c reg query "HKLM\SYSTEM\CurrentControlSet\Control\Class\{4d36e972-e325-11ce-bfc1-08002be10318}\0004" /v NetworkAddress 2>nul
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4452
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SYSTEM\CurrentControlSet\Control\Class\{4d36e972-e325-11ce-bfc1-08002be10318}\0004" /v NetworkAddress
    3⤵
    PID:4132
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c reg query "HKLM\SYSTEM\CurrentControlSet\Control\Class\{4d36e972-e325-11ce-bfc1-08002be10318}\0005" /v NetworkAddress 2>nul
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4104
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SYSTEM\CurrentControlSet\Control\Class\{4d36e972-e325-11ce-bfc1-08002be10318}\0005" /v NetworkAddress
    3⤵
    PID:2128
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c reg query "HKLM\SYSTEM\CurrentControlSet\Control\Class\{4d36e972-e325-11ce-bfc1-08002be10318}\0006" /v NetworkAddress 2>nul
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3856
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SYSTEM\CurrentControlSet\Control\Class\{4d36e972-e325-11ce-bfc1-08002be10318}\0006" /v NetworkAddress
    3⤵
    PID:4556
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c reg query "HKLM\SYSTEM\CurrentControlSet\Control\Class\{4d36e972-e325-11ce-bfc1-08002be10318}\0007" /v NetworkAddress 2>nul
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2632
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SYSTEM\CurrentControlSet\Control\Class\{4d36e972-e325-11ce-bfc1-08002be10318}\0007" /v NetworkAddress
    3⤵
    PID:3536
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c reg query "HKLM\SYSTEM\CurrentControlSet\Control\Class\{4d36e972-e325-11ce-bfc1-08002be10318}\0008" /v NetworkAddress 2>nul
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2384
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SYSTEM\CurrentControlSet\Control\Class\{4d36e972-e325-11ce-bfc1-08002be10318}\0008" /v NetworkAddress
    3⤵
    PID:3244
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c reg query "HKLM\SYSTEM\CurrentControlSet\Control\Class\{4d36e972-e325-11ce-bfc1-08002be10318}\0009" /v NetworkAddress 2>nul
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2224
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SYSTEM\CurrentControlSet\Control\Class\{4d36e972-e325-11ce-bfc1-08002be10318}\0009" /v NetworkAddress
    3⤵
    PID:4380
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c wmic csproduct get uuid 2>nul
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2404
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic csproduct get uuid
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1696
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c wmic diskdrive get serialnumber
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3248
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic diskdrive get serialnumber
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4596
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c getmac /fo csv /v
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3212
- - C:\Windows\system32\getmac.exe
    getmac /fo csv /v
    3⤵
    PID:4092
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c reg query "HKLM\SYSTEM\CurrentControlSet\Control\Class\{4d36e972-e325-11ce-bfc1-08002be10318}\0000" /v NetworkAddress 2>nul
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4680
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SYSTEM\CurrentControlSet\Control\Class\{4d36e972-e325-11ce-bfc1-08002be10318}\0000" /v NetworkAddress
    3⤵
    PID:992
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c reg query "HKLM\SYSTEM\CurrentControlSet\Control\Class\{4d36e972-e325-11ce-bfc1-08002be10318}\0001" /v NetworkAddress 2>nul
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4112
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SYSTEM\CurrentControlSet\Control\Class\{4d36e972-e325-11ce-bfc1-08002be10318}\0001" /v NetworkAddress
    3⤵
    PID:5252
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c reg query "HKLM\SYSTEM\CurrentControlSet\Control\Class\{4d36e972-e325-11ce-bfc1-08002be10318}\0002" /v NetworkAddress 2>nul
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1436
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SYSTEM\CurrentControlSet\Control\Class\{4d36e972-e325-11ce-bfc1-08002be10318}\0002" /v NetworkAddress
    3⤵
    PID:6024
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c reg query "HKLM\SYSTEM\CurrentControlSet\Control\Class\{4d36e972-e325-11ce-bfc1-08002be10318}\0003" /v NetworkAddress 2>nul
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2972
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SYSTEM\CurrentControlSet\Control\Class\{4d36e972-e325-11ce-bfc1-08002be10318}\0003" /v NetworkAddress
    3⤵
    PID:4580
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c reg query "HKLM\SYSTEM\CurrentControlSet\Control\Class\{4d36e972-e325-11ce-bfc1-08002be10318}\0004" /v NetworkAddress 2>nul
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5896
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SYSTEM\CurrentControlSet\Control\Class\{4d36e972-e325-11ce-bfc1-08002be10318}\0004" /v NetworkAddress
    3⤵
    PID:2292
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c reg query "HKLM\SYSTEM\CurrentControlSet\Control\Class\{4d36e972-e325-11ce-bfc1-08002be10318}\0005" /v NetworkAddress 2>nul
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5028
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SYSTEM\CurrentControlSet\Control\Class\{4d36e972-e325-11ce-bfc1-08002be10318}\0005" /v NetworkAddress
    3⤵
    PID:5156
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c reg query "HKLM\SYSTEM\CurrentControlSet\Control\Class\{4d36e972-e325-11ce-bfc1-08002be10318}\0006" /v NetworkAddress 2>nul
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3276
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SYSTEM\CurrentControlSet\Control\Class\{4d36e972-e325-11ce-bfc1-08002be10318}\0006" /v NetworkAddress
    3⤵
    PID:3664
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c reg query "HKLM\SYSTEM\CurrentControlSet\Control\Class\{4d36e972-e325-11ce-bfc1-08002be10318}\0007" /v NetworkAddress 2>nul
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4552
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SYSTEM\CurrentControlSet\Control\Class\{4d36e972-e325-11ce-bfc1-08002be10318}\0007" /v NetworkAddress
    3⤵
    PID:4996
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c reg query "HKLM\SYSTEM\CurrentControlSet\Control\Class\{4d36e972-e325-11ce-bfc1-08002be10318}\0008" /v NetworkAddress 2>nul
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4800
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SYSTEM\CurrentControlSet\Control\Class\{4d36e972-e325-11ce-bfc1-08002be10318}\0008" /v NetworkAddress
    3⤵
    PID:1888
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c reg query "HKLM\SYSTEM\CurrentControlSet\Control\Class\{4d36e972-e325-11ce-bfc1-08002be10318}\0009" /v NetworkAddress 2>nul
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5264
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SYSTEM\CurrentControlSet\Control\Class\{4d36e972-e325-11ce-bfc1-08002be10318}\0009" /v NetworkAddress
    3⤵
    PID:4288
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c wmic csproduct get uuid 2>nul
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3712
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic csproduct get uuid
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1136
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c reg query "HKLM\SOFTWARE\Microsoft\Cryptography" /v MachineGuid 2>nul
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1704
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SOFTWARE\Microsoft\Cryptography" /v MachineGuid
    3⤵
    PID:4256
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c wmic diskdrive get serialnumber
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2068
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic diskdrive get serialnumber
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5400
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c getmac /fo csv /v
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1716
- - C:\Windows\system32\getmac.exe
    getmac /fo csv /v
    3⤵
    PID:2492
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c reg query "HKLM\SYSTEM\CurrentControlSet\Control\Class\{4d36e972-e325-11ce-bfc1-08002be10318}\0000" /v NetworkAddress 2>nul
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4356
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SYSTEM\CurrentControlSet\Control\Class\{4d36e972-e325-11ce-bfc1-08002be10318}\0000" /v NetworkAddress
    3⤵
    PID:4860
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c reg query "HKLM\SYSTEM\CurrentControlSet\Control\Class\{4d36e972-e325-11ce-bfc1-08002be10318}\0001" /v NetworkAddress 2>nul
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3264
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SYSTEM\CurrentControlSet\Control\Class\{4d36e972-e325-11ce-bfc1-08002be10318}\0001" /v NetworkAddress
    3⤵
    PID:2932
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c reg query "HKLM\SYSTEM\CurrentControlSet\Control\Class\{4d36e972-e325-11ce-bfc1-08002be10318}\0002" /v NetworkAddress 2>nul
  2⤵
  - Executes a command shell one-liner
  PID:4268
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SYSTEM\CurrentControlSet\Control\Class\{4d36e972-e325-11ce-bfc1-08002be10318}\0002" /v NetworkAddress
    3⤵
    PID:1440
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c reg query "HKLM\SYSTEM\CurrentControlSet\Control\Class\{4d36e972-e325-11ce-bfc1-08002be10318}\0003" /v NetworkAddress 2>nul
  2⤵
  - Executes a command shell one-liner
  PID:4880
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SYSTEM\CurrentControlSet\Control\Class\{4d36e972-e325-11ce-bfc1-08002be10318}\0003" /v NetworkAddress
    3⤵
    PID:6072
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c reg query "HKLM\SYSTEM\CurrentControlSet\Control\Class\{4d36e972-e325-11ce-bfc1-08002be10318}\0004" /v NetworkAddress 2>nul
  2⤵
  - Executes a command shell one-liner
  PID:6040
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SYSTEM\CurrentControlSet\Control\Class\{4d36e972-e325-11ce-bfc1-08002be10318}\0004" /v NetworkAddress
    3⤵
    PID:688
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c reg query "HKLM\SYSTEM\CurrentControlSet\Control\Class\{4d36e972-e325-11ce-bfc1-08002be10318}\0005" /v NetworkAddress 2>nul
  2⤵
  - Executes a command shell one-liner
  PID:5636
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SYSTEM\CurrentControlSet\Control\Class\{4d36e972-e325-11ce-bfc1-08002be10318}\0005" /v NetworkAddress
    3⤵
    PID:5956
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c reg query "HKLM\SYSTEM\CurrentControlSet\Control\Class\{4d36e972-e325-11ce-bfc1-08002be10318}\0006" /v NetworkAddress 2>nul
  2⤵
  - Executes a command shell one-liner
  PID:3416
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SYSTEM\CurrentControlSet\Control\Class\{4d36e972-e325-11ce-bfc1-08002be10318}\0006" /v NetworkAddress
    3⤵
    PID:4588
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c reg query "HKLM\SYSTEM\CurrentControlSet\Control\Class\{4d36e972-e325-11ce-bfc1-08002be10318}\0007" /v NetworkAddress 2>nul
  2⤵
  - Executes a command shell one-liner
  PID:4140
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SYSTEM\CurrentControlSet\Control\Class\{4d36e972-e325-11ce-bfc1-08002be10318}\0007" /v NetworkAddress
    3⤵
    PID:4988
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c reg query "HKLM\SYSTEM\CurrentControlSet\Control\Class\{4d36e972-e325-11ce-bfc1-08002be10318}\0008" /v NetworkAddress 2>nul
  2⤵
  - Executes a command shell one-liner
  PID:3460
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SYSTEM\CurrentControlSet\Control\Class\{4d36e972-e325-11ce-bfc1-08002be10318}\0008" /v NetworkAddress
    3⤵
    PID:3788
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c reg query "HKLM\SYSTEM\CurrentControlSet\Control\Class\{4d36e972-e325-11ce-bfc1-08002be10318}\0009" /v NetworkAddress 2>nul
  2⤵
  - Executes a command shell one-liner
  PID:5268
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SYSTEM\CurrentControlSet\Control\Class\{4d36e972-e325-11ce-bfc1-08002be10318}\0009" /v NetworkAddress
    3⤵
    PID:4056