a0e6ed5b731e71f7c0f75eeb82c584c5c0b3d7f0154527ae71c9723cfb89ccdd

Analysis

max time kernel
150s
max time network
126s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
25/08/2026, 04:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-24_ac8fd7d2704129fa4835634fc3f5811d_frostygoop_ghostlocker_glassworm_hive_luca-stealer_salatstealer_sliver.exe
Size 40.0MB
Sample260825-e5bh2swhkb
SHA256 a0e6ed5b731e71f7c0f75eeb82c584c5c0b3d7f0154527ae71c9723cfb89ccdd
MD5 ac8fd7d2704129fa4835634fc3f5811d
SHA1 8fca2937a5ff3e0a863af32ad625cdf80f45222d
SHA512 3d0a7bc7bff3beccf000e1cee577597d866864897a64e8be731a0733d7529c8e28e4ec80bbbd7748490379b54a827a4c90e8ba8f6535fb8e36e9d9761d181920
SSDEEP 786432:12t5hhR+Q5ZpRXRsDgwpWPo55bLNWX5w446cdYO01AOednR0ogRpQ7fG:UhRnZUXYg5gpX4VCOQGR0oU
TLSH
T18C972312FCE214F9C5BEE134866193627AF1786443303BD71E98A5BA1BB6FD46A3D310
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery execution spyware stealer

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
5152	node.exe

Loads dropped DLL 2 IoCs

pid	Process
5152	node.exe
5152	node.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
1	discord.com
8	discord.com

Discovers running processes 1 TTPs 9 IoCs

Running process information can be used to identify security tools or plan follow-on actions.

discovery

Process Discovery

T1057

pid	Process
4208	tasklist.exe
1684	tasklist.exe
4516	tasklist.exe
5192	tasklist.exe
4916	tasklist.exe
5064	tasklist.exe
1364	tasklist.exe
5492	tasklist.exe
1548	tasklist.exe

Hide Artifacts: Ignore Process Interrupts 1 TTPs 2 IoCs

Command interpreters often include specific commands/flags that ignore errors and other hangups.

defense_evasion

Ignore Process Interrupts

T1564.011

pid	Process
3660	cmd.exe
1800	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 19 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
3480	powershell.exe
2564	powershell.exe
5384	powershell.exe
2208	powershell.exe
5360	powershell.exe
6048	powershell.exe
4544	powershell.exe
1264	powershell.exe
2908	powershell.exe
5608	powershell.exe
4284	powershell.exe
5692	powershell.exe
4336	powershell.exe
4480	powershell.exe
920	powershell.exe
5980	powershell.exe
5984	powershell.exe
200	powershell.exe
2980	powershell.exe

Executes a command shell one-liner 1 TTPs 44 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4380	cmd.exe
3480	cmd.exe
3308	cmd.exe
2376	cmd.exe
2880	cmd.exe
2576	cmd.exe
1256	cmd.exe
3356	cmd.exe
5968	cmd.exe
2652	cmd.exe
6116	cmd.exe
5552	cmd.exe
248	cmd.exe
1144	cmd.exe
5548	cmd.exe
3420	cmd.exe
3916	cmd.exe
932	cmd.exe
5488	cmd.exe
1536	cmd.exe
1980	cmd.exe
1784	cmd.exe
6100	cmd.exe
5960	cmd.exe
2388	cmd.exe
5904	cmd.exe
1688	cmd.exe
1436	cmd.exe
4672	cmd.exe
3184	cmd.exe
2836	cmd.exe
4404	cmd.exe
2868	cmd.exe
2064	cmd.exe
5252	cmd.exe
1168	cmd.exe
6092	cmd.exe
5268	cmd.exe
5848	cmd.exe
4508	cmd.exe
4160	cmd.exe
2004	cmd.exe
2428	cmd.exe
960	cmd.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	reg.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	reg.exe

Kills process with taskkill 12 IoCs

defense_evasion

pid	Process
3284	taskkill.exe
5064	taskkill.exe
1104	taskkill.exe
1160	taskkill.exe
3908	taskkill.exe
1328	taskkill.exe
5216	taskkill.exe
1164	taskkill.exe
6124	taskkill.exe
5880	taskkill.exe
3936	taskkill.exe
5136	taskkill.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5152	node.exe
5152	node.exe
5152	node.exe
5152	node.exe
5152	node.exe
5152	node.exe
1800	powershell.exe
1800	powershell.exe
2980	powershell.exe
2980	powershell.exe
2980	powershell.exe
2980	powershell.exe
2908	powershell.exe
2908	powershell.exe
2908	powershell.exe
2908	powershell.exe
5692	powershell.exe
5692	powershell.exe
5692	powershell.exe
5692	powershell.exe
3480	powershell.exe
3480	powershell.exe
3480	powershell.exe
3480	powershell.exe
5360	powershell.exe
5360	powershell.exe
5360	powershell.exe
5360	powershell.exe
2564	powershell.exe
2564	powershell.exe
2564	powershell.exe
2564	powershell.exe
4336	powershell.exe
4336	powershell.exe
4336	powershell.exe
4336	powershell.exe
5384	powershell.exe
5384	powershell.exe
5384	powershell.exe
5384	powershell.exe
4480	powershell.exe
4480	powershell.exe
4480	powershell.exe
4480	powershell.exe
920	powershell.exe
920	powershell.exe
920	powershell.exe
920	powershell.exe
5980	powershell.exe
5980	powershell.exe
5980	powershell.exe
5980	powershell.exe
6048	powershell.exe
6048	powershell.exe
6048	powershell.exe
6048	powershell.exe
2208	powershell.exe
2208	powershell.exe
2208	powershell.exe
2208	powershell.exe
5608	powershell.exe
5608	powershell.exe
5608	powershell.exe
5608	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	1800	powershell.exe
Token: SeIncreaseQuotaPrivilege	1800	powershell.exe
Token: SeSecurityPrivilege	1800	powershell.exe
Token: SeTakeOwnershipPrivilege	1800	powershell.exe
Token: SeLoadDriverPrivilege	1800	powershell.exe
Token: SeSystemProfilePrivilege	1800	powershell.exe
Token: SeSystemtimePrivilege	1800	powershell.exe
Token: SeProfSingleProcessPrivilege	1800	powershell.exe
Token: SeIncBasePriorityPrivilege	1800	powershell.exe
Token: SeCreatePagefilePrivilege	1800	powershell.exe
Token: SeBackupPrivilege	1800	powershell.exe
Token: SeRestorePrivilege	1800	powershell.exe
Token: SeShutdownPrivilege	1800	powershell.exe
Token: SeDebugPrivilege	1800	powershell.exe
Token: SeSystemEnvironmentPrivilege	1800	powershell.exe
Token: SeRemoteShutdownPrivilege	1800	powershell.exe
Token: SeUndockPrivilege	1800	powershell.exe
Token: SeManageVolumePrivilege	1800	powershell.exe
Token: 33	1800	powershell.exe
Token: 34	1800	powershell.exe
Token: 35	1800	powershell.exe
Token: 36	1800	powershell.exe
Token: SeDebugPrivilege	1328	taskkill.exe
Token: SeDebugPrivilege	5216	taskkill.exe
Token: SeDebugPrivilege	5880	taskkill.exe
Token: SeDebugPrivilege	3936	taskkill.exe
Token: SeDebugPrivilege	5136	taskkill.exe
Token: SeDebugPrivilege	3284	taskkill.exe
Token: SeDebugPrivilege	5064	taskkill.exe
Token: SeDebugPrivilege	1104	taskkill.exe
Token: SeDebugPrivilege	1160	taskkill.exe
Token: SeDebugPrivilege	1164	taskkill.exe
Token: SeDebugPrivilege	3908	taskkill.exe
Token: SeDebugPrivilege	6124	taskkill.exe
Token: SeDebugPrivilege	5152	node.exe
Token: SeDebugPrivilege	5152	node.exe
Token: SeDebugPrivilege	2980	powershell.exe
Token: SeDebugPrivilege	4208	tasklist.exe
Token: SeDebugPrivilege	2908	powershell.exe
Token: SeDebugPrivilege	5152	node.exe
Token: SeDebugPrivilege	5152	node.exe
Token: SeDebugPrivilege	5692	powershell.exe
Token: SeDebugPrivilege	4916	tasklist.exe
Token: SeDebugPrivilege	3480	powershell.exe
Token: SeDebugPrivilege	5152	node.exe
Token: SeDebugPrivilege	5152	node.exe
Token: SeDebugPrivilege	5360	powershell.exe
Token: SeDebugPrivilege	1684	tasklist.exe
Token: SeDebugPrivilege	2564	powershell.exe
Token: SeDebugPrivilege	5152	node.exe
Token: SeDebugPrivilege	5152	node.exe
Token: SeDebugPrivilege	4336	powershell.exe
Token: SeDebugPrivilege	4516	tasklist.exe
Token: SeDebugPrivilege	5384	powershell.exe
Token: SeDebugPrivilege	5152	node.exe
Token: SeDebugPrivilege	5152	node.exe
Token: SeDebugPrivilege	4480	powershell.exe
Token: SeDebugPrivilege	5064	tasklist.exe
Token: SeDebugPrivilege	920	powershell.exe
Token: SeDebugPrivilege	5152	node.exe
Token: SeDebugPrivilege	5152	node.exe
Token: SeDebugPrivilege	5980	powershell.exe
Token: SeDebugPrivilege	1364	tasklist.exe
Token: SeDebugPrivilege	6048	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2584 wrote to memory of 5152	2584	2026-08-24_ac8fd7d2704129fa4835634fc3f5811d_frostygoop_ghostlocker_glassworm_hive_luca-stealer_salatstealer_sliver.exe	90
PID 5152 wrote to memory of 2376	5152	node.exe	91
PID 2376 wrote to memory of 1468	2376	cmd.exe	93
PID 5152 wrote to memory of 3660	5152	node.exe	94
PID 3660 wrote to memory of 1800	3660	cmd.exe	96
PID 5152 wrote to memory of 2064	5152	node.exe	98
PID 2064 wrote to memory of 4892	2064	cmd.exe	100
PID 4892 wrote to memory of 2256	4892	net.exe	101
PID 5152 wrote to memory of 6100	5152	node.exe	102
PID 6100 wrote to memory of 1328	6100	cmd.exe	104
PID 5152 wrote to memory of 3356	5152	node.exe	105
PID 3356 wrote to memory of 5216	3356	cmd.exe	107
PID 5152 wrote to memory of 3420	5152	node.exe	108
PID 3420 wrote to memory of 5880	3420	cmd.exe	110
PID 5152 wrote to memory of 3916	5152	node.exe	111
PID 3916 wrote to memory of 3936	3916	cmd.exe	113
PID 5152 wrote to memory of 5968	5152	node.exe	114
PID 5968 wrote to memory of 5136	5968	cmd.exe	116
PID 5152 wrote to memory of 4380	5152	node.exe	117
PID 4380 wrote to memory of 3284	4380	cmd.exe	119
PID 5152 wrote to memory of 932	5152	node.exe	120
PID 932 wrote to memory of 5064	932	cmd.exe	122
PID 5152 wrote to memory of 5488	5152	node.exe	123
PID 5488 wrote to memory of 1104	5488	cmd.exe	125
PID 5152 wrote to memory of 6092	5152	node.exe	126
PID 6092 wrote to memory of 1160	6092	cmd.exe	128
PID 5152 wrote to memory of 5268	5152	node.exe	129
PID 5268 wrote to memory of 1164	5268	cmd.exe	131
PID 5152 wrote to memory of 2836	5152	node.exe	132
PID 2836 wrote to memory of 3908	2836	cmd.exe	134
PID 5152 wrote to memory of 2652	5152	node.exe	135
PID 2652 wrote to memory of 6124	2652	cmd.exe	137
PID 5152 wrote to memory of 5252	5152	node.exe	138
PID 5252 wrote to memory of 2980	5252	cmd.exe	140
PID 5152 wrote to memory of 5960	5152	node.exe	141
PID 5960 wrote to memory of 4208	5960	cmd.exe	143
PID 5152 wrote to memory of 6116	5152	node.exe	144
PID 6116 wrote to memory of 2908	6116	cmd.exe	146
PID 5152 wrote to memory of 4404	5152	node.exe	147
PID 4404 wrote to memory of 5692	4404	cmd.exe	149
PID 5152 wrote to memory of 1536	5152	node.exe	150
PID 1536 wrote to memory of 4916	1536	cmd.exe	202
PID 5152 wrote to memory of 5552	5152	node.exe	153
PID 5552 wrote to memory of 3480	5552	cmd.exe	204
PID 5152 wrote to memory of 1168	5152	node.exe	156
PID 1168 wrote to memory of 5360	1168	cmd.exe	158
PID 5152 wrote to memory of 2388	5152	node.exe	159
PID 2388 wrote to memory of 1684	2388	cmd.exe	161
PID 5152 wrote to memory of 2880	5152	node.exe	162
PID 2880 wrote to memory of 2564	2880	cmd.exe	164
PID 5152 wrote to memory of 5904	5152	node.exe	165
PID 5904 wrote to memory of 4336	5904	cmd.exe	167
PID 5152 wrote to memory of 5848	5152	node.exe	168
PID 5848 wrote to memory of 4516	5848	cmd.exe	170
PID 5152 wrote to memory of 248	5152	node.exe	171
PID 248 wrote to memory of 5384	248	cmd.exe	173
PID 5152 wrote to memory of 4508	5152	node.exe	174
PID 4508 wrote to memory of 4480	4508	cmd.exe	176
PID 5152 wrote to memory of 1144	5152	node.exe	177
PID 1144 wrote to memory of 5064	1144	cmd.exe	179
PID 5152 wrote to memory of 4160	5152	node.exe	180
PID 4160 wrote to memory of 920	4160	cmd.exe	182
PID 5152 wrote to memory of 1980	5152	node.exe	183
PID 1980 wrote to memory of 5980	1980	cmd.exe	185

C:\Users\Admin\AppData\Local\Temp\2026-08-24_ac8fd7d2704129fa4835634fc3f5811d_frostygoop_ghostlocker_glassworm_hive_luca-stealer_salatstealer_sliver.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-24_ac8fd7d2704129fa4835634fc3f5811d_frostygoop_ghostlocker_glassworm_hive_luca-stealer_salatstealer_sliver.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2584
- C:\Users\Admin\AppData\Local\Temp\caxa\applications\browser-tool\uuav8oq6ok\0\node_modules\.bin\node.exe
  C:\Users\Admin\AppData\Local\Temp/caxa/applications/browser-tool\uuav8oq6ok/0/node_modules/.bin/node C:\Users\Admin\AppData\Local\Temp/caxa/applications/browser-tool\uuav8oq6ok/0/index.js
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:5152
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "chcp 65001 >nul 2>&1"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2376
  - - C:\Windows\system32\chcp.com
      chcp 65001
      4⤵
      PID:1468
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -NonInteractive -Command "(Get-CimInstance Win32_Process -Filter 'ProcessId=2584' -ErrorAction SilentlyContinue).ExecutablePath""
    3⤵
    - Hide Artifacts: Ignore Process Interrupts
    - Suspicious use of WriteProcessMemory
    PID:3660
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoProfile -NonInteractive -Command "(Get-CimInstance Win32_Process -Filter 'ProcessId=2584' -ErrorAction SilentlyContinue).ExecutablePath"
      4⤵
      Hide Artifacts: Ignore Process Interrupts
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1800
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "net session"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2064
  - - C:\Windows\system32\net.exe
      net session
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4892
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        5⤵
        
        PID:2256
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM chrome.exe /T 2>nul"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:6100
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM chrome.exe /T
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:1328
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM brave.exe /T 2>nul"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3356
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM brave.exe /T
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:5216
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM msedge.exe /T 2>nul"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3420
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM msedge.exe /T
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:5880
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM opera.exe /T 2>nul"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3916
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM opera.exe /T
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:3936
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM vivaldi.exe /T 2>nul"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5968
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM vivaldi.exe /T
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:5136
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM browser.exe /T 2>nul"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4380
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM browser.exe /T
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:3284
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM Brave.exe /T 2>nul"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:932
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM Brave.exe /T
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:5064
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM brave_browser /T 2>nul"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5488
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM brave_browser /T
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:1104
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM BraveBrowser /T 2>nul"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:6092
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM BraveBrowser /T
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:1160
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM brave.exe /T 2>nul"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5268
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM brave.exe /T
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:1164
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM MicrosoftEdge.exe /T 2>nul"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2836
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM MicrosoftEdge.exe /T
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:3908
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM msedge.exe /T 2>nul"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2652
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM msedge.exe /T
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:6124
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "Get-Process lsass | Select-Object -ExpandProperty Id""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5252
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -Command "Get-Process lsass | Select-Object -ExpandProperty Id"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2980
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq lsass.exe" /NH /FO CSV"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5960
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq lsass.exe" /NH /FO CSV
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:4208
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "Get-Process winlogon | Select-Object -ExpandProperty Id""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:6116
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -Command "Get-Process winlogon | Select-Object -ExpandProperty Id"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2908
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "Get-Process lsass | Select-Object -ExpandProperty Id""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4404
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -Command "Get-Process lsass | Select-Object -ExpandProperty Id"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:5692
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq lsass.exe" /NH /FO CSV"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1536
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq lsass.exe" /NH /FO CSV
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:4916
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "Get-Process winlogon | Select-Object -ExpandProperty Id""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5552
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -Command "Get-Process winlogon | Select-Object -ExpandProperty Id"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3480
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "Get-Process lsass | Select-Object -ExpandProperty Id""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1168
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -Command "Get-Process lsass | Select-Object -ExpandProperty Id"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:5360
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq lsass.exe" /NH /FO CSV"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2388
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq lsass.exe" /NH /FO CSV
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:1684
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "Get-Process winlogon | Select-Object -ExpandProperty Id""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2880
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -Command "Get-Process winlogon | Select-Object -ExpandProperty Id"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2564
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "Get-Process lsass | Select-Object -ExpandProperty Id""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5904
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -Command "Get-Process lsass | Select-Object -ExpandProperty Id"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4336
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq lsass.exe" /NH /FO CSV"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5848
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq lsass.exe" /NH /FO CSV
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:4516
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "Get-Process winlogon | Select-Object -ExpandProperty Id""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:248
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -Command "Get-Process winlogon | Select-Object -ExpandProperty Id"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:5384
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "Get-Process lsass | Select-Object -ExpandProperty Id""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4508
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -Command "Get-Process lsass | Select-Object -ExpandProperty Id"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4480
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq lsass.exe" /NH /FO CSV"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1144
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq lsass.exe" /NH /FO CSV
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:5064
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "Get-Process winlogon | Select-Object -ExpandProperty Id""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4160
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -Command "Get-Process winlogon | Select-Object -ExpandProperty Id"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:920
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "Get-Process lsass | Select-Object -ExpandProperty Id""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1980
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -Command "Get-Process lsass | Select-Object -ExpandProperty Id"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:5980
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq lsass.exe" /NH /FO CSV"
    3⤵
    - Executes a command shell one-liner
    PID:2004
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq lsass.exe" /NH /FO CSV
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:1364
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "Get-Process winlogon | Select-Object -ExpandProperty Id""
    3⤵
    - Executes a command shell one-liner
    PID:1688
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -Command "Get-Process winlogon | Select-Object -ExpandProperty Id"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:6048
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "Get-Process lsass | Select-Object -ExpandProperty Id""
    3⤵
    - Executes a command shell one-liner
    PID:1436
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -Command "Get-Process lsass | Select-Object -ExpandProperty Id"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:2208
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq lsass.exe" /NH /FO CSV"
    3⤵
    - Executes a command shell one-liner
    PID:2428
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq lsass.exe" /NH /FO CSV
      4⤵
      Discovers running processes
      PID:5492
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "Get-Process winlogon | Select-Object -ExpandProperty Id""
    3⤵
    - Executes a command shell one-liner
    PID:2868
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -Command "Get-Process winlogon | Select-Object -ExpandProperty Id"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:5608
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "Get-Process lsass | Select-Object -ExpandProperty Id""
    3⤵
    - Executes a command shell one-liner
    PID:1784
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:4916
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -Command "Get-Process lsass | Select-Object -ExpandProperty Id"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:4284
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq lsass.exe" /NH /FO CSV"
    3⤵
    - Executes a command shell one-liner
    PID:3480
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq lsass.exe" /NH /FO CSV
      4⤵
      Discovers running processes
      PID:1548
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "Get-Process winlogon | Select-Object -ExpandProperty Id""
    3⤵
    - Executes a command shell one-liner
    PID:3308
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -Command "Get-Process winlogon | Select-Object -ExpandProperty Id"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:4544
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "Get-Process lsass | Select-Object -ExpandProperty Id""
    3⤵
    - Executes a command shell one-liner
    PID:4672
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -Command "Get-Process lsass | Select-Object -ExpandProperty Id"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:5984
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq lsass.exe" /NH /FO CSV"
    3⤵
    - Executes a command shell one-liner
    PID:2576
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq lsass.exe" /NH /FO CSV
      4⤵
      Discovers running processes
      PID:5192
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "Get-Process winlogon | Select-Object -ExpandProperty Id""
    3⤵
    - Executes a command shell one-liner
    PID:3184
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -Command "Get-Process winlogon | Select-Object -ExpandProperty Id"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:200
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion" /v ProductName"
    3⤵
    - Executes a command shell one-liner
    PID:1256
  - - C:\Windows\system32\reg.exe
      reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion" /v ProductName
      4⤵
      PID:4972
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\HARDWARE\DESCRIPTION\System\CentralProcessor\0" /v ProcessorNameString"
    3⤵
    - Executes a command shell one-liner
    PID:960
  - - C:\Windows\system32\reg.exe
      reg query "HKLM\HARDWARE\DESCRIPTION\System\CentralProcessor\0" /v ProcessorNameString
      4⤵
      Checks processor information in registry
      PID:5264
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "Get-WmiObject Win32_VideoController | Select-Object -ExpandProperty Name""
    3⤵
    - Executes a command shell one-liner
    PID:5548
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -Command "Get-WmiObject Win32_VideoController | Select-Object -ExpandProperty Name"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:1264

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Ignore Process Interrupts

T1564.011

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact