Overview

overview

9

Static

static

3

2026-08-25...om.exe

windows10-2004-x64

9

2026-08-25...om.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    72s
  • max time network
    114s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260710-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    26/08/2026, 02:44

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-25_f1770f73137ab3ae08e56421a26b1108_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
  • Size 16.4MB
  • Sample260826-c8enrsysbx
  • SHA256 c6209f2fb42efb89cfde0a14cb6957e30b927a02ddb4639b96ca3f04ab2bac78
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoveryexecutionpersistenceprivilege_escalation

Malware Config

Signatures

  • Command and Scripting Interpreter: PowerShell 1 TTPs 33 IoCs

    Using powershell.exe command.

    execution
  • Loads dropped DLL 60 IoCs
  • Power Settings 1 TTPs 4 IoCs

    powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.

    persistence
  • Hide Artifacts: Ignore Process Interrupts 1 TTPs 5 IoCs

    Command interpreters often include specific commands/flags that ignore errors and other hangups.

    defense_evasion
  • Event Triggered Execution: Netsh Helper DLL 1 TTPs 6 IoCs

    Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

    persistenceprivilege_escalation
  • System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 1 IoCs

    Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 41 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-25_f1770f73137ab3ae08e56421a26b1108_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-25_f1770f73137ab3ae08e56421a26b1108_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1176
    • C:\Users\Admin\AppData\Local\Temp\2026-08-25_f1770f73137ab3ae08e56421a26b1108_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
      "C:\Users\Admin\AppData\Local\Temp\2026-08-25_f1770f73137ab3ae08e56421a26b1108_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe"
      2⤵
      • Loads dropped DLL
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:5904
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell -NoProfile -ExecutionPolicy Bypass -Command "$os=Get-CimInstance Win32_OperatingSystem;$cs=Get-CimInstance Win32_ComputerSystem;$csp=Get-CimInstance Win32_ComputerSystemProduct;$page=Get-CimInstance Win32_PageFileUsage;$activePlan=(powercfg /getactivescheme 2>$null|Out-String).Trim();$secureBoot=$null;try{$secureBoot=Confirm-SecureBootUEFI -ErrorAction Stop}catch{};$tpm=$null;try{$tpm=Get-Tpm|Select-Object TpmPresent,TpmReady,ManagedAuthLevel,ManufacturerIdTxt,ManufacturerVersion}catch{};[PSCustomObject]@{Caption=$os.Caption;Version=$os.Version;Build=$os.BuildNumber;Architecture=$os.OSArchitecture;InstallDate=$os.InstallDate;LastBoot=$os.LastBootUpTime;RegisteredUser=$os.RegisteredUser;SerialNumber=$os.SerialNumber;WindowsDirectory=$os.WindowsDirectory;SystemDirectory=$os.SystemDirectory;ComputerManufacturer=$cs.Manufacturer;ComputerModel=$cs.Model;SystemFamily=$csp.Version;SystemSku=$csp.SKUNumber;TotalPhysicalMemoryBytes=$cs.TotalPhysicalMemory;VirtualizationFirmwareEnabled=$cs.VirtualizationFirmwareEnabled;HypervisorPresent=$cs.HypervisorPresent;SecureBoot=$secureBoot;ActivePowerPlan=$activePlan;PageFiles=@($page|ForEach-Object{[PSCustomObject]@{Name=$_.Name;AllocatedBaseSizeMB=$_.AllocatedBaseSize;CurrentUsageMB=$_.CurrentUsage;PeakUsageMB=$_.PeakUsage}});TPM=$tpm}|ConvertTo-Json -Depth 6 -Compress"
        3⤵
        • Power Settings
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:5256
        • C:\Windows\system32\powercfg.exe
          "C:\Windows\system32\powercfg.exe" /getactivescheme
          4⤵
          • Power Settings
          PID:1304
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell -NoProfile -ExecutionPolicy Bypass -Command "$cs=Get-CimInstance Win32_ComputerSystem;$prod=Get-CimInstance Win32_ComputerSystemProduct;$bios=Get-CimInstance Win32_BIOS;[PSCustomObject]@{Manufacturer=$cs.Manufacturer;Model=$cs.Model;SystemType=$cs.SystemType;Domain=$cs.Domain;Workgroup=$cs.Workgroup;PartOfDomain=$cs.PartOfDomain;ProductName=$prod.Name;ProductVersion=$prod.Version;ProductSerial=$prod.IdentifyingNumber;BIOSVersion=(($bios.SMBIOSBIOSVersion -join '; '));SMBIOSMajor=$bios.SMBIOSMajorVersion;SMBIOSMinor=$bios.SMBIOSMinorVersion}|ConvertTo-Json -Depth 4 -Compress"
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        PID:1236
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell -NoProfile -ExecutionPolicy Bypass -Command "Get-CimInstance SoftwareLicensingProduct|Where-Object{$_.PartialProductKey -and $_.Name -like 'Windows*'}|ForEach-Object{[PSCustomObject]@{Name=$_.Name;Description=$_.Description;LicenseStatus=$_.LicenseStatus;PartialProductKey=$_.PartialProductKey;GracePeriodMinutes=$_.GracePeriodRemaining}}|Select-Object -Unique Name,Description,LicenseStatus,PartialProductKey,GracePeriodMinutes|ConvertTo-Json -Depth 4 -Compress"
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        PID:3832
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell -NoProfile -ExecutionPolicy Bypass -Command "Get-CimInstance Win32_Processor|ForEach-Object{[PSCustomObject]@{Name=$_.Name;Manufacturer=$_.Manufacturer;PhysicalCores=$_.NumberOfCores;LogicalProcessors=$_.NumberOfLogicalProcessors;BaseClockMHz=$_.CurrentClockSpeed;MaxClockMHz=$_.MaxClockSpeed;Socket=$_.SocketDesignation;Architecture=$_.Architecture;L2CacheKB=$_.L2CacheSize;L3CacheKB=$_.L3CacheSize;AddressWidth=$_.AddressWidth;DataWidth=$_.DataWidth;VirtualizationFirmwareEnabled=$_.VirtualizationFirmwareEnabled;SecondLevelAddressTranslationExtensions=$_.SecondLevelAddressTranslationExtensions;VMMonitorModeExtensions=$_.VMMonitorModeExtensions;Status=$_.Status}}|ConvertTo-Json -Depth 5 -Compress"
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        PID:5924
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell -NoProfile -ExecutionPolicy Bypass -Command "Get-CimInstance Win32_VideoController|ForEach-Object{[PSCustomObject]@{Name=$_.Name;Manufacturer=$_.AdapterCompatibility;VRAMBytes=$_.AdapterRAM;DriverVersion=$_.DriverVersion;DriverDate=$_.DriverDate;VideoProcessor=$_.VideoProcessor;CurrentBitsPerPixel=$_.CurrentBitsPerPixel;Resolution=\"$($_.CurrentHorizontalResolution)x$($_.CurrentVerticalResolution)\";HorizontalResolution=$_.CurrentHorizontalResolution;VerticalResolution=$_.CurrentVerticalResolution;RefreshRate=$_.CurrentRefreshRate;PNPDeviceID=$_.PNPDeviceID;DeviceID=$_.DeviceID;Status=$_.Status;VideoModeDescription=$_.VideoModeDescription}}|ConvertTo-Json -Depth 5 -Compress"
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        PID:5928
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell -NoProfile -ExecutionPolicy Bypass -Command "Get-CimInstance Win32_BaseBoard|ForEach-Object{[PSCustomObject]@{Manufacturer=$_.Manufacturer;Model=$_.Product;Version=$_.Version;Serial=$_.SerialNumber;PartNumber=$_.PartNumber;HostingBoard=$_.HostingBoard;Status=$_.Status}}|ConvertTo-Json -Depth 4 -Compress"
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        PID:5512
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell -NoProfile -ExecutionPolicy Bypass -Command "Get-CimInstance Win32_BIOS|ForEach-Object{[PSCustomObject]@{Manufacturer=$_.Manufacturer;Name=$_.Name;Version=$_.SMBIOSBIOSVersion;ReleaseDate=$_.ReleaseDate;Serial=$_.SerialNumber;SMBIOSMajor=$_.SMBIOSMajorVersion;SMBIOSMinor=$_.SMBIOSMinorVersion;Status=$_.Status}}|ConvertTo-Json -Depth 4 -Compress"
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        PID:1576
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell -NoProfile -ExecutionPolicy Bypass -Command "Get-CimInstance Win32_PhysicalMemory|ForEach-Object{[PSCustomObject]@{Manufacturer=$_.Manufacturer;PartNumber=$_.PartNumber;CapacityBytes=$_.Capacity;SpeedMHz=$_.Speed;ConfiguredSpeedMHz=$_.ConfiguredClockSpeed;ConfiguredVoltage=$_.ConfiguredVoltage;MinVoltage=$_.MinVoltage;MaxVoltage=$_.MaxVoltage;Slot=$_.DeviceLocator;BankLabel=$_.BankLabel;Serial=$_.SerialNumber;SMBIOSMemoryType=$_.SMBIOSMemoryType;FormFactor=$_.FormFactor;DataWidth=$_.DataWidth;TotalWidth=$_.TotalWidth;TypeDetail=$_.TypeDetail}}|ConvertTo-Json -Depth 5 -Compress"
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        PID:4224
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell -NoProfile -ExecutionPolicy Bypass -Command "$modules=@(Get-CimInstance Win32_PhysicalMemory);$cs=Get-CimInstance Win32_ComputerSystem;[PSCustomObject]@{InstalledCapacityBytes=($modules|Measure-Object Capacity -Sum).Sum;ModuleCount=$modules.Count;AvailableRamSlots=$null;PhysicalMemoryBytes=$cs.TotalPhysicalMemory;ErrorCorrection=(($modules|Select-Object -First 1).DataWidth)}|ConvertTo-Json -Depth 4 -Compress"
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        PID:5712
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell -NoProfile -ExecutionPolicy Bypass -Command "Get-CimInstance Win32_DiskDrive|ForEach-Object{[PSCustomObject]@{Model=$_.Model;Manufacturer=$_.Manufacturer;Serial=$_.SerialNumber;Interface=$_.InterfaceType;MediaType=$_.MediaType;SizeBytes=$_.Size;Firmware=$_.FirmwareRevision;DeviceID=$_.DeviceID;PNPDeviceID=$_.PNPDeviceID;Status=$_.Status;BytesPerSector=$_.BytesPerSector;Partitions=$_.Partitions}}|ConvertTo-Json -Depth 5 -Compress"
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        PID:1800
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell -NoProfile -ExecutionPolicy Bypass -Command "try{Get-PhysicalDisk|ForEach-Object{[PSCustomObject]@{FriendlyName=$_.FriendlyName;SerialNumber=$_.SerialNumber;MediaType=$_.MediaType;BusType=$_.BusType;SizeBytes=$_.Size;HealthStatus=$_.HealthStatus;OperationalStatus=$_.OperationalStatus;Usage=$_.Usage;FirmwareVersion=$_.FirmwareVersion;CanPool=$_.CanPool;SpindleSpeed=$_.SpindleSpeed}}|ConvertTo-Json -Depth 5 -Compress}catch{@()|ConvertTo-Json -Compress}"
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        PID:4992
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell -NoProfile -ExecutionPolicy Bypass -Command "$result=@();try{$disks=@(Get-PhysicalDisk);foreach($d in $disks){try{$r=Get-StorageReliabilityCounter -PhysicalDisk $d -ErrorAction Stop;$result+=[PSCustomObject]@{FriendlyName=$d.FriendlyName;SerialNumber=$d.SerialNumber;TemperatureC=$r.Temperature;ReadErrorsTotal=$r.ReadErrorsTotal;ReadErrorsUncorrected=$r.ReadErrorsUncorrected;WriteErrorsTotal=$r.WriteErrorsTotal;WriteErrorsUncorrected=$r.WriteErrorsUncorrected;Wear=$r.Wear;PowerOnHours=$r.PowerOnHours;PowerCycleCount=$r.PowerCycleCount;ReadLatencyMax=$r.ReadLatencyMax;WriteLatencyMax=$r.WriteLatencyMax}}catch{}}catch{};$result|ConvertTo-Json -Depth 6 -Compress"
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        PID:5880
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell -NoProfile -ExecutionPolicy Bypass -Command "try{Get-Volume|ForEach-Object{[PSCustomObject]@{DriveLetter=$_.DriveLetter;Path=$_.Path;FileSystem=$_.FileSystem;FileSystemLabel=$_.FileSystemLabel;SizeBytes=$_.Size;SizeRemainingBytes=$_.SizeRemaining;HealthStatus=$_.HealthStatus;OperationalStatus=$_.OperationalStatus;DriveType=$_.DriveType}}|ConvertTo-Json -Depth 5 -Compress}catch{@()|ConvertTo-Json -Compress}"
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        PID:1680
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell -NoProfile -ExecutionPolicy Bypass -Command "try{Get-Partition|ForEach-Object{[PSCustomObject]@{DiskNumber=$_.DiskNumber;PartitionNumber=$_.PartitionNumber;DriveLetter=$_.DriveLetter;SizeBytes=$_.Size;OffsetBytes=$_.Offset;Type=$_.Type;GptType=$_.GptType;IsBoot=$_.IsBoot;IsSystem=$_.IsSystem;IsActive=$_.IsActive}}|ConvertTo-Json -Depth 5 -Compress}catch{@()|ConvertTo-Json -Compress}"
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        PID:3996
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell -NoProfile -ExecutionPolicy Bypass -Command "$monitors=@(Get-CimInstance -Namespace root\wmi -ClassName WmiMonitorID -ErrorAction SilentlyContinue);$basic=@(Get-CimInstance -Namespace root\wmi -ClassName WmiMonitorBasicDisplayParams -ErrorAction SilentlyContinue);$result=foreach($monitor in $monitors){$manufacturer=-join ($monitor.ManufacturerName|Where-Object{$_ -ne 0}|ForEach-Object{[char]$_});$product=-join ($monitor.ProductCodeID|Where-Object{$_ -ne 0}|ForEach-Object{[char]$_});$serial=-join ($monitor.SerialNumberID|Where-Object{$_ -ne 0}|ForEach-Object{[char]$_});$user=-join ($monitor.UserFriendlyName|Where-Object{$_ -ne 0}|ForEach-Object{[char]$_});$instance=-join ($monitor.InstanceName|Where-Object{$_ -ne 0}|ForEach-Object{[char]$_});[PSCustomObject]@{Manufacturer=$manufacturer;ProductCode=$product;Serial=$serial;UserFriendlyName=$user;InstanceName=$instance;Active=$monitor.Active}};$result|ConvertTo-Json -Depth 5 -Compress"
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        PID:5396
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell -NoProfile -ExecutionPolicy Bypass -Command "Get-CimInstance -Namespace root\wmi -ClassName WmiMonitorBasicDisplayParams -ErrorAction SilentlyContinue|ForEach-Object{[PSCustomObject]@{InstanceName=$_.InstanceName;Active=$_.Active;MaxHorizontalImageSizeCm=$_.MaxHorizontalImageSize;MaxVerticalImageSizeCm=$_.MaxVerticalImageSize;VideoInputType=$_.VideoInputType}}|ConvertTo-Json -Depth 4 -Compress"
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        PID:2660
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell -NoProfile -ExecutionPolicy Bypass -Command "Get-CimInstance Win32_DesktopMonitor|ForEach-Object{[PSCustomObject]@{Name=$_.Name;MonitorType=$_.MonitorType;PNPDeviceID=$_.PNPDeviceID;ScreenHeight=$_.ScreenHeight;ScreenWidth=$_.ScreenWidth;Status=$_.Status}}|ConvertTo-Json -Depth 4 -Compress"
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        PID:5928
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell -NoProfile -ExecutionPolicy Bypass -Command "Get-NetAdapter -ErrorAction SilentlyContinue|ForEach-Object{[PSCustomObject]@{Name=$_.Name;InterfaceDescription=$_.InterfaceDescription;Manufacturer=$_.Manufacturer;MacAddress=$_.MacAddress;LinkSpeed=$_.LinkSpeed;Status=$_.Status;MediaType=$_.MediaType;DriverInformation=($null);ifIndex=$_.ifIndex;Virtual=$_.Virtual}}|ConvertTo-Json -Depth 5 -Compress"
        3⤵
        • Hide Artifacts: Ignore Process Interrupts
        • Suspicious behavior: EnumeratesProcesses
        PID:5512
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell -NoProfile -ExecutionPolicy Bypass -Command "Get-NetIPConfiguration -ErrorAction SilentlyContinue|ForEach-Object{[PSCustomObject]@{InterfaceAlias=$_.InterfaceAlias;InterfaceIndex=$_.InterfaceIndex;IPv4Address=@($_.IPv4Address|ForEach-Object{$_.IPAddress});IPv6Address=@($_.IPv6Address|ForEach-Object{$_.IPAddress});IPv4DefaultGateway=@($_.IPv4DefaultGateway|ForEach-Object{$_.NextHop});IPv6DefaultGateway=@($_.IPv6DefaultGateway|ForEach-Object{$_.NextHop});DNSServers=@($_.DNSServer|ForEach-Object{$_.ServerAddresses});NetProfileName=(Get-NetConnectionProfile -InterfaceIndex $_.InterfaceIndex -ErrorAction SilentlyContinue).Name;NetworkCategory=(Get-NetConnectionProfile -InterfaceIndex $_.InterfaceIndex -ErrorAction SilentlyContinue).NetworkCategory}}|ConvertTo-Json -Depth 7 -Compress"
        3⤵
        • Hide Artifacts: Ignore Process Interrupts
        • Suspicious behavior: EnumeratesProcesses
        PID:5348
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell -NoProfile -ExecutionPolicy Bypass -Command "Get-DnsClientServerAddress -ErrorAction SilentlyContinue|ForEach-Object{[PSCustomObject]@{InterfaceAlias=$_.InterfaceAlias;AddressFamily=$_.AddressFamily;ServerAddresses=@($_.ServerAddresses)}}|Where-Object{$_.ServerAddresses.Count -gt 0}|ConvertTo-Json -Depth 5 -Compress"
        3⤵
        • Hide Artifacts: Ignore Process Interrupts
        • Suspicious behavior: EnumeratesProcesses
        PID:1676
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell -NoProfile -ExecutionPolicy Bypass -Command "try{Get-NetTCPConnection -ErrorAction Stop|Sort-Object State,RemoteAddress|Select-Object -First 50|ForEach-Object{[PSCustomObject]@{LocalAddress=$_.LocalAddress;LocalPort=$_.LocalPort;RemoteAddress=$_.RemoteAddress;RemotePort=$_.RemotePort;State=$_.State;OwningProcess=$_.OwningProcess}}|ConvertTo-Json -Depth 5 -Compress}catch{@()|ConvertTo-Json -Compress}"
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        PID:1528
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell -NoProfile -ExecutionPolicy Bypass -Command "try{Get-NetTCPConnection -State Listen -ErrorAction Stop|Sort-Object LocalPort|Select-Object -First 100|ForEach-Object{[PSCustomObject]@{LocalAddress=$_.LocalAddress;LocalPort=$_.LocalPort;OwningProcess=$_.OwningProcess}}|ConvertTo-Json -Depth 5 -Compress}catch{@()|ConvertTo-Json -Compress}"
        3⤵
        • Command and Scripting Interpreter: PowerShell
        PID:5992
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell -NoProfile -ExecutionPolicy Bypass -Command "netsh wlan show interfaces 2>$null"
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious use of WriteProcessMemory
        PID:4104
        • C:\Windows\system32\netsh.exe
          "C:\Windows\system32\netsh.exe" wlan show interfaces
          4⤵
          • Event Triggered Execution: Netsh Helper DLL
          PID:6056
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell -NoProfile -ExecutionPolicy Bypass -Command "netsh wlan show networks mode=bssid 2>$null"
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious use of WriteProcessMemory
        PID:5976
        • C:\Windows\system32\netsh.exe
          "C:\Windows\system32\netsh.exe" wlan show networks mode=bssid
          4⤵
          • Event Triggered Execution: Netsh Helper DLL
          PID:2836
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell -NoProfile -ExecutionPolicy Bypass -Command "$temps=Get-CimInstance -Namespace root/wmi -ClassName MSAcpi_ThermalZoneTemperature -ErrorAction SilentlyContinue;$result=foreach($temp in $temps){$celsius=($temp.CurrentTemperature/10)-273.15;[PSCustomObject]@{Zone=$temp.InstanceName;TemperatureC=[math]::Round($celsius,1);CriticalTripPointC=if($temp.CriticalTripPoint){[math]::Round(($temp.CriticalTripPoint/10)-273.15,1)}else{$null};PassiveTripPointC=if($temp.PassiveTripPoint){[math]::Round(($temp.PassiveTripPoint/10)-273.15,1)}else{$null}}};$result|ConvertTo-Json -Depth 5 -Compress"
        3⤵
        • Command and Scripting Interpreter: PowerShell
        PID:3048
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell -NoProfile -ExecutionPolicy Bypass -Command "$result=@();$providers=@(@{Namespace='root\LibreHardwareMonitor';Name='LibreHardwareMonitor'},@{Namespace='root\OpenHardwareMonitor';Name='OpenHardwareMonitor'});foreach($provider in $providers){try{$sensors=Get-CimInstance -Namespace $provider.Namespace -ClassName Sensor -ErrorAction Stop;foreach($sensor in $sensors){$result+=[PSCustomObject]@{Name=$sensor.Name;Hardware=$sensor.Hardware;SensorType=$sensor.SensorType;Value=$sensor.Value;Min=$sensor.Min;Max=$sensor.Max;Index=$sensor.Index;InstanceId=$sensor.InstanceId;Provider=$provider.Name}};if($result.Count -gt 0){break}}catch{}};$result|ConvertTo-Json -Depth 6 -Compress"
        3⤵
        • Command and Scripting Interpreter: PowerShell
        PID:2420
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell -NoProfile -ExecutionPolicy Bypass -Command "Get-CimInstance Win32_Battery -ErrorAction SilentlyContinue|ForEach-Object{[PSCustomObject]@{Name=$_.Name;DeviceID=$_.DeviceID;Status=$_.Status;BatteryStatus=$_.BatteryStatus;EstimatedChargeRemaining=$_.EstimatedChargeRemaining;EstimatedRunTimeMinutes=$_.EstimatedRunTime;DesignVoltage=$_.DesignVoltage;Chemistry=$_.Chemistry;Availability=$_.Availability}}|ConvertTo-Json -Depth 5 -Compress"
        3⤵
        • Hide Artifacts: Ignore Process Interrupts
        PID:2844
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell -NoProfile -ExecutionPolicy Bypass -Command "powercfg /getactivescheme 2>$null"
        3⤵
        • Power Settings
        • Suspicious use of WriteProcessMemory
        PID:5928
        • C:\Windows\system32\powercfg.exe
          "C:\Windows\system32\powercfg.exe" /getactivescheme
          4⤵
          • Power Settings
          PID:4176
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell -NoProfile -ExecutionPolicy Bypass -Command "$paths=@('HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall\*','HKLM:\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\*','HKCU:\Software\Microsoft\Windows\CurrentVersion\Uninstall\*');$result=foreach($path in $paths){try{Get-ItemProperty $path -ErrorAction SilentlyContinue|Where-Object{$_.DisplayName}|ForEach-Object{[PSCustomObject]@{Name=$_.DisplayName;Version=$_.DisplayVersion;Publisher=$_.Publisher;InstallDate=$_.InstallDate;InstallLocation=$_.InstallLocation}}}catch{}};$result|Where-Object{$_.Name}|Sort-Object Name -Unique|Select-Object -First 250|ConvertTo-Json -Depth 4 -Compress"
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Hide Artifacts: Ignore Process Interrupts
        PID:2304
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell -NoProfile -ExecutionPolicy Bypass -Command "$items=@();$locations=@('HKLM:\Software\Microsoft\Windows\CurrentVersion\Run','HKLM:\Software\Microsoft\Windows\CurrentVersion\RunOnce','HKLM:\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run','HKCU:\Software\Microsoft\Windows\CurrentVersion\Run','HKCU:\Software\Microsoft\Windows\CurrentVersion\RunOnce');foreach($path in $locations){try{$props=Get-ItemProperty -Path $path -ErrorAction Stop;foreach($property in $props.PSObject.Properties){if($property.Name -notlike 'PS*'){$items+=[PSCustomObject]@{Location=$path;Name=$property.Name;Command=[string]$property.Value}}}}catch{}};try{Get-CimInstance Win32_StartupCommand|ForEach-Object{$items+=[PSCustomObject]@{Location=$_.Location;Name=$_.Name;Command=$_.Command;User=$_.User}};catch{}};$items|ConvertTo-Json -Depth 5 -Compress"
        3⤵
        • Command and Scripting Interpreter: PowerShell
        PID:5324
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell -NoProfile -ExecutionPolicy Bypass -Command "try{Get-CimInstance Win32_Service|Where-Object{$_.State -eq 'Running' -or $_.StartMode -eq 'Auto'}|ForEach-Object{[PSCustomObject]@{Name=$_.Name;DisplayName=$_.DisplayName;State=$_.State;StartMode=$_.StartMode;StartName=$_.StartName;PathName=$_.PathName}}|Sort-Object State,Name|Select-Object -First 250|ConvertTo-Json -Depth 5 -Compress}catch{@()|ConvertTo-Json -Compress}"
        3⤵
        • Command and Scripting Interpreter: PowerShell
        PID:3232
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell -NoProfile -ExecutionPolicy Bypass -Command "try{Get-MpComputerStatus|Select-Object AMServiceEnabled,AntivirusEnabled,AntispywareEnabled,BehaviorMonitorEnabled,IoavProtectionEnabled,NISEnabled,RealTimeProtectionEnabled,AntivirusSignatureVersion,AntispywareSignatureVersion,QuickScanAge,FullScanAge|ConvertTo-Json -Compress}catch{@()|ConvertTo-Json -Compress}"
        3⤵
        • Command and Scripting Interpreter: PowerShell
        PID:6100
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell -NoProfile -ExecutionPolicy Bypass -Command "try{Get-NetFirewallProfile|ForEach-Object{[PSCustomObject]@{Name=$_.Name;Enabled=$_.Enabled;DefaultInboundAction=$_.DefaultInboundAction;DefaultOutboundAction=$_.DefaultOutboundAction}}|ConvertTo-Json -Compress}catch{@()|ConvertTo-Json -Compress}"
        3⤵
        • Command and Scripting Interpreter: PowerShell
        PID:3284
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell -NoProfile -ExecutionPolicy Bypass -Command "try{Get-BitLockerVolume|ForEach-Object{[PSCustomObject]@{MountPoint=$_.MountPoint;VolumeStatus=$_.VolumeStatus;ProtectionStatus=$_.ProtectionStatus;EncryptionMethod=$_.EncryptionMethod;EncryptionPercentage=$_.EncryptionPercentage}}|ConvertTo-Json -Compress}catch{@()|ConvertTo-Json -Compress}"
        3⤵
        • Command and Scripting Interpreter: PowerShell
        PID:5476
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell -NoProfile -ExecutionPolicy Bypass -Command "try{Get-Tpm|Select-Object TpmPresent,TpmReady,ManufacturerIdTxt,ManufacturerVersion,ManagedAuthLevel|ConvertTo-Json -Compress}catch{@()|ConvertTo-Json -Compress}"
        3⤵
        • Command and Scripting Interpreter: PowerShell
        PID:1144
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell -NoProfile -ExecutionPolicy Bypass -Command "try{Get-WinEvent -FilterHashtable @{LogName='System';Level=1,2,3} -MaxEvents 20 -ErrorAction Stop|ForEach-Object{[PSCustomObject]@{TimeCreated=$_.TimeCreated;Id=$_.Id;Level=$_.LevelDisplayName;Provider=$_.ProviderName;Message=$_.Message}}|ConvertTo-Json -Depth 5 -Compress}catch{@()|ConvertTo-Json -Compress}"
        3⤵
        • Command and Scripting Interpreter: PowerShell
        PID:1364
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell -NoProfile -ExecutionPolicy Bypass -Command "try{Get-WinEvent -FilterHashtable @{LogName='Application';Level=1,2,3} -MaxEvents 20 -ErrorAction Stop|ForEach-Object{[PSCustomObject]@{TimeCreated=$_.TimeCreated;Id=$_.Id;Level=$_.LevelDisplayName;Provider=$_.ProviderName;Message=$_.Message}}|ConvertTo-Json -Depth 5 -Compress}catch{@()|ConvertTo-Json -Compress}"
        3⤵
        • Command and Scripting Interpreter: PowerShell
        PID:5308
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell -NoProfile -ExecutionPolicy Bypass -Command "try{Get-PnpDevice -PresentOnly -ErrorAction Stop|Group-Object Class|ForEach-Object{[PSCustomObject]@{Class=$_.Name;Count=$_.Count}}|Sort-Object Class|ConvertTo-Json -Depth 4 -Compress}catch{@()|ConvertTo-Json -Compress}"
        3⤵
        • Command and Scripting Interpreter: PowerShell
        PID:2344
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell -NoProfile -ExecutionPolicy Bypass -Command "try{Get-PnpDevice -ErrorAction Stop|Where-Object{$_.Status -ne 'OK'}|Select-Object -First 100 Class,FriendlyName,InstanceId,Manufacturer,Status,ProblemCode|ConvertTo-Json -Depth 5 -Compress}catch{@()|ConvertTo-Json -Compress}"
        3⤵
        • Command and Scripting Interpreter: PowerShell
        PID:4828
      • C:\Windows\SYSTEM32\netsh.exe
        netsh wlan show profiles
        3⤵
        • System Network Configuration Discovery: Wi-Fi Discovery
        PID:4108

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        VCRUNTIME140.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI11762\VCRUNTIME140.dll
        • Size 97KB
        • SHA256 c73763d5d8557b32158441f6782d810e68c7b40b22e1a62b7c404ee1ee15e2b4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VCRUNTIME140_1.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI11762\VCRUNTIME140_1.dll
        • Size 28KB
        • SHA256 c42541c9b19c07a0ccf642cb21c08b0f469c853c50dec3d49dd3558cfce68ec4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _bz2.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI11762\_bz2.pyd
        • Size 71KB
        • SHA256 7f5f0c5f950fc9d046e5da1c14c3563e988b191e87768d8fa852dec8c04dfced
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _ctypes.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI11762\_ctypes.pyd
        • Size 111KB
        • SHA256 acf656fc55b0a7a0a807d9327b2991f45ed27b9ff22f9e481f71310665525c41
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _hashlib.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI11762\_hashlib.pyd
        • Size 53KB
        • SHA256 844447fd61a2116abbe719a4c0d876fd20c26de5136e9997e7f6b01915a6685a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _lzma.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI11762\_lzma.pyd
        • Size 143KB
        • SHA256 94fdf2f849db3b2d8d8476c36bb2db54f66b1a153c460e1331168baaf3384f8d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _queue.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI11762\_queue.pyd
        • Size 20KB
        • SHA256 a5fc131a0951c32818958ac59fc76cd4a1a809ffbcd6ab37694c76862c411f28
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _socket.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI11762\_socket.pyd
        • Size 70KB
        • SHA256 bbe7c76c3fb3064c9b2ce5c4f64106c33deed23e8fb164f4023d450f3f1b6dcf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _sqlite3.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI11762\_sqlite3.pyd
        • Size 109KB
        • SHA256 b2efdac2cf5fc0a7e7bdd95547d76e06153ee7f987b032744741fcb25fddac54
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _ssl.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI11762\_ssl.pyd
        • Size 161KB
        • SHA256 5e7ea94958a8b514dcb184c48181e6d36cee9981f87a43516c6e9b10710106aa
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _wmi.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI11762\_wmi.pyd
        • Size 25KB
        • SHA256 5003ae167979518ca3f0aecc58930f2e2f10457901b9fd0daa64e8d3d8d39902
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        base_library.zip
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI11762\base_library.zip
        • Size 1.3MB
        • SHA256 0bf83a59cfe6ee5f146bc01e5408113d44d6f8307c9cdacaa51af0fc336ec99f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libcrypto-3.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI11762\libcrypto-3.dll
        • Size 5.0MB
        • SHA256 4260c335599ab25e2d436d8c6209821fefe1431afa911067ce472c1ed410ba00
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libffi-8.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI11762\libffi-8.dll
        • Size 27KB
        • SHA256 649eb8073367686da9f7392892fbb810298d0434d2561bb542c94b0078db725a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libssl-3.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI11762\libssl-3.dll
        • Size 762KB
        • SHA256 68bab513eb79c5320f4bc1dc8a2d2a579c732b600ef930010df32c046b5d023d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _psutil_windows.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI11762\psutil\_psutil_windows.pyd
        • Size 65KB
        • SHA256 c17fdf6bbaa9c02583b4ea7e9b0574e6ae5c259c2a16433ed8e76940b8df5040
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        python3.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI11762\python3.dll
        • Size 54KB
        • SHA256 e658f6b1d3d57ac25a494c54608e4cfd80b841e34cf0e62e23229202bae721b0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        python312.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI11762\python312.dll
        • Size 6.6MB
        • SHA256 d17eb34dd0a1f6435895fc104219d3d0ec97b1900ca1dc3d472314eef9250d65
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        select.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI11762\select.pyd
        • Size 18KB
        • SHA256 ae7af4a4ed2121a65c4ef91b91fb93a64f25755443104369ebfb9d3938321080
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Lorem ipsum.txt
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI11762\setuptools\_vendor\jaraco\text\Lorem ipsum.txt
        • Size 1KB
        • SHA256 37fedcffbf73c4eb9f058f47677cb33203a436ff9390e4d38a8e01c9dad28e0b
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        sqlite3.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI11762\sqlite3.dll
        • Size 1.5MB
        • SHA256 1eef57ee6d701613a710e22f40d3559a30da44aa42adf1fdf778a683c3f28dc9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        __PSScriptPolicyTest_oucfduv1.ojf.ps1
        • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_oucfduv1.ojf.ps1
        • Size 60B
        • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        memory/3284-325-0x00000200F9580000-0x00000200F958E000-memory.dmp
        Download

        memory/4992-224-0x0000028329470000-0x000002832947A000-memory.dmp
        Download

        memory/5256-163-0x0000021BFFAE0000-0x0000021BFFAEA000-memory.dmp
        Download

        memory/5256-164-0x0000021BFFB20000-0x0000021BFFB4A000-memory.dmp
        Download

        memory/5256-165-0x0000021BFFB20000-0x0000021BFFB44000-memory.dmp
        Download

        memory/5256-158-0x0000021BFFA50000-0x0000021BFFA72000-memory.dmp
        Download

        memory/5256-168-0x0000021BFFB20000-0x0000021BFFB3E000-memory.dmp
        Download

        memory/5256-171-0x0000021BFFB20000-0x0000021BFFB2A000-memory.dmp
        Download

        memory/5256-172-0x0000021C001D0000-0x0000021C00392000-memory.dmp
        Download

        memory/5256-173-0x0000021B80A80000-0x0000021B80FA8000-memory.dmp
        Download

        memory/5256-162-0x0000021BFFDA0000-0x0000021BFFE52000-memory.dmp
        Download

        memory/5256-161-0x0000021BFFAC0000-0x0000021BFFADE000-memory.dmp
        Download

        memory/5348-263-0x000001F35A880000-0x000001F35A890000-memory.dmp
        Download

        memory/5348-264-0x000001F35ADE0000-0x000001F35ADFA000-memory.dmp
        Download