webrat | aa8f493aa9999c347111187cd8af93e6818da502820431c91400dc0b8b939365

Analysis

max time kernel
299s
max time network
301s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
18/09/2026, 16:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
SS.exe
Size 5.6MB
Sample260918-tk67jshe42
SHA256 aa8f493aa9999c347111187cd8af93e6818da502820431c91400dc0b8b939365
MD5 47439fc3b9d0045a2c6a69fd1f8182db
SHA1 7615cefa5a4cbaa5ae29deb8efcab027452799a3
SHA512 42ad85463d4def6f99117d63a4d8340d122fb6d9e4aabd90907d8164c355fb1375f3cf6ed153ef17b789925546989c554e25bfd6533f3190a7a70f1d5c623b85
SSDEEP 98304:zC7YA26J0Djx3ZMNPDZsrR7z9IGh8A0/KeszS3sGwSpUGNV3IIXu8yNuungdoj:uh2b2sNH7yWSwMUGv4wy+O
TLSH
T1D1463350A21436B0F7D9A23EABB3E827467B565600F36DCF5B4981F7653F1C12AB8036
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution webrat persistence rat trojan upx

Malware Config

Signatures

Family: WebRAT
WebRAT is a Windows RAT written in Golang.
rat webrat

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
5044	powershell.exe
5096	powershell.exe
4560	powershell.exe
4848	powershell.exe

Executes dropped EXE 3 IoCs

pid	Process
4788	Updater.exe
964	Updater.exe
3892	Updater.exe

Checks whether UAC is enabled 1 TTPs 3 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	SS.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Updater.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Updater.exe

Discovers running processes 1 TTPs 64 IoCs

Running process information can be used to identify security tools or plan follow-on actions.

discovery

Process Discovery

T1057

pid	Process
3764	tasklist.exe
4560	tasklist.exe
2796	tasklist.exe
2100	tasklist.exe
2544	tasklist.exe
3288	tasklist.exe
2952	tasklist.exe
4936	tasklist.exe
4708	tasklist.exe
2836	tasklist.exe
2460	tasklist.exe
3376	tasklist.exe
4852	tasklist.exe
3708	tasklist.exe
376	tasklist.exe
1060	tasklist.exe
4164	tasklist.exe
3816	tasklist.exe
1908	tasklist.exe
1168	tasklist.exe
2396	tasklist.exe
2460	tasklist.exe
3060	tasklist.exe
2452	tasklist.exe
4576	tasklist.exe
1788	tasklist.exe
3340	tasklist.exe
3792	tasklist.exe
3820	tasklist.exe
2288	tasklist.exe
3228	tasklist.exe
4744	tasklist.exe
4356	tasklist.exe
1780	tasklist.exe
312	tasklist.exe
4156	tasklist.exe
4196	tasklist.exe
2508	tasklist.exe
3476	tasklist.exe
1844	tasklist.exe
1716	tasklist.exe
2424	tasklist.exe
4936	tasklist.exe
4068	tasklist.exe
4128	tasklist.exe
400	tasklist.exe
2260	tasklist.exe
3288	tasklist.exe
4836	tasklist.exe
3164	tasklist.exe
4272	tasklist.exe
4424	tasklist.exe
2472	tasklist.exe
1000	tasklist.exe
2396	tasklist.exe
4180	tasklist.exe
3112	tasklist.exe
3992	tasklist.exe
1056	tasklist.exe
2476	tasklist.exe
1532	tasklist.exe
4160	tasklist.exe
1200	tasklist.exe
1280	tasklist.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3976-0-0x0000000000540000-0x0000000001340000-memory.dmp	upx
behavioral2/memory/3976-2-0x0000000000540000-0x0000000001340000-memory.dmp	upx
behavioral2/memory/3976-1-0x0000000000540000-0x0000000001340000-memory.dmp	upx
behavioral2/files/0x00180000000242da-6.dat	upx
behavioral2/memory/3976-11-0x0000000000540000-0x0000000001340000-memory.dmp	upx
behavioral2/memory/964-12-0x0000000000F70000-0x0000000001D70000-memory.dmp	upx
behavioral2/memory/4788-10-0x0000000000F70000-0x0000000001D70000-memory.dmp	upx
behavioral2/memory/4788-14-0x0000000000F70000-0x0000000001D70000-memory.dmp	upx
behavioral2/memory/964-19-0x0000000000F70000-0x0000000001D70000-memory.dmp	upx
behavioral2/memory/3892-21-0x0000000000F70000-0x0000000001D70000-memory.dmp	upx
behavioral2/memory/4788-50-0x0000000000F70000-0x0000000001D70000-memory.dmp	upx
behavioral2/memory/964-51-0x0000000000F70000-0x0000000001D70000-memory.dmp	upx
behavioral2/memory/3892-64-0x0000000000F70000-0x0000000001D70000-memory.dmp	upx
behavioral2/memory/964-66-0x0000000000F70000-0x0000000001D70000-memory.dmp	upx
behavioral2/memory/4788-65-0x0000000000F70000-0x0000000001D70000-memory.dmp	upx
behavioral2/memory/4788-67-0x0000000000F70000-0x0000000001D70000-memory.dmp	upx
behavioral2/memory/3892-68-0x0000000000F70000-0x0000000001D70000-memory.dmp	upx
behavioral2/memory/964-69-0x0000000000F70000-0x0000000001D70000-memory.dmp	upx
behavioral2/memory/964-71-0x0000000000F70000-0x0000000001D70000-memory.dmp	upx
behavioral2/memory/3892-72-0x0000000000F70000-0x0000000001D70000-memory.dmp	upx
behavioral2/memory/3892-74-0x0000000000F70000-0x0000000001D70000-memory.dmp	upx
behavioral2/memory/964-73-0x0000000000F70000-0x0000000001D70000-memory.dmp	upx
behavioral2/memory/964-75-0x0000000000F70000-0x0000000001D70000-memory.dmp	upx
behavioral2/memory/3892-76-0x0000000000F70000-0x0000000001D70000-memory.dmp	upx
behavioral2/memory/3892-77-0x0000000000F70000-0x0000000001D70000-memory.dmp	upx
behavioral2/memory/964-78-0x0000000000F70000-0x0000000001D70000-memory.dmp	upx
behavioral2/memory/3892-79-0x0000000000F70000-0x0000000001D70000-memory.dmp	upx
behavioral2/memory/964-80-0x0000000000F70000-0x0000000001D70000-memory.dmp	upx
behavioral2/memory/3892-81-0x0000000000F70000-0x0000000001D70000-memory.dmp	upx
behavioral2/memory/964-82-0x0000000000F70000-0x0000000001D70000-memory.dmp	upx
behavioral2/memory/3892-83-0x0000000000F70000-0x0000000001D70000-memory.dmp	upx
behavioral2/memory/964-84-0x0000000000F70000-0x0000000001D70000-memory.dmp	upx
behavioral2/memory/964-85-0x0000000000F70000-0x0000000001D70000-memory.dmp	upx
behavioral2/memory/3892-86-0x0000000000F70000-0x0000000001D70000-memory.dmp	upx
behavioral2/memory/964-87-0x0000000000F70000-0x0000000001D70000-memory.dmp	upx
behavioral2/memory/3892-88-0x0000000000F70000-0x0000000001D70000-memory.dmp	upx
behavioral2/memory/964-89-0x0000000000F70000-0x0000000001D70000-memory.dmp	upx
behavioral2/memory/3892-90-0x0000000000F70000-0x0000000001D70000-memory.dmp	upx
behavioral2/memory/964-91-0x0000000000F70000-0x0000000001D70000-memory.dmp	upx
behavioral2/memory/3892-92-0x0000000000F70000-0x0000000001D70000-memory.dmp	upx
behavioral2/memory/964-93-0x0000000000F70000-0x0000000001D70000-memory.dmp	upx
behavioral2/memory/3892-94-0x0000000000F70000-0x0000000001D70000-memory.dmp	upx
behavioral2/memory/3892-96-0x0000000000F70000-0x0000000001D70000-memory.dmp	upx
behavioral2/memory/964-95-0x0000000000F70000-0x0000000001D70000-memory.dmp	upx
behavioral2/memory/3892-97-0x0000000000F70000-0x0000000001D70000-memory.dmp	upx
behavioral2/memory/964-98-0x0000000000F70000-0x0000000001D70000-memory.dmp	upx
behavioral2/memory/3892-99-0x0000000000F70000-0x0000000001D70000-memory.dmp	upx
behavioral2/memory/964-100-0x0000000000F70000-0x0000000001D70000-memory.dmp	upx
behavioral2/memory/3892-101-0x0000000000F70000-0x0000000001D70000-memory.dmp	upx
behavioral2/memory/964-102-0x0000000000F70000-0x0000000001D70000-memory.dmp	upx
behavioral2/memory/3892-103-0x0000000000F70000-0x0000000001D70000-memory.dmp	upx
behavioral2/memory/964-104-0x0000000000F70000-0x0000000001D70000-memory.dmp	upx
behavioral2/memory/3892-105-0x0000000000F70000-0x0000000001D70000-memory.dmp	upx
behavioral2/memory/964-106-0x0000000000F70000-0x0000000001D70000-memory.dmp	upx
behavioral2/memory/3892-107-0x0000000000F70000-0x0000000001D70000-memory.dmp	upx
behavioral2/memory/964-108-0x0000000000F70000-0x0000000001D70000-memory.dmp	upx
behavioral2/memory/3892-109-0x0000000000F70000-0x0000000001D70000-memory.dmp	upx
behavioral2/memory/964-110-0x0000000000F70000-0x0000000001D70000-memory.dmp	upx
behavioral2/memory/3892-111-0x0000000000F70000-0x0000000001D70000-memory.dmp	upx
behavioral2/memory/964-112-0x0000000000F70000-0x0000000001D70000-memory.dmp	upx
behavioral2/memory/3892-113-0x0000000000F70000-0x0000000001D70000-memory.dmp	upx
behavioral2/memory/964-114-0x0000000000F70000-0x0000000001D70000-memory.dmp	upx
behavioral2/memory/3892-115-0x0000000000F70000-0x0000000001D70000-memory.dmp	upx
behavioral2/memory/964-116-0x0000000000F70000-0x0000000001D70000-memory.dmp	upx

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4480	schtasks.exe
4884	schtasks.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
4560	powershell.exe
4560	powershell.exe
4848	powershell.exe
4848	powershell.exe
5044	powershell.exe
5044	powershell.exe
5096	powershell.exe
5096	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4708	tasklist.exe
Token: SeDebugPrivilege	964	tasklist.exe
Token: SeDebugPrivilege	1780	tasklist.exe
Token: SeDebugPrivilege	2512	tasklist.exe
Token: SeDebugPrivilege	2476	tasklist.exe
Token: SeDebugPrivilege	3756	tasklist.exe
Token: SeDebugPrivilege	3844	tasklist.exe
Token: SeDebugPrivilege	1460	tasklist.exe
Token: SeDebugPrivilege	4196	tasklist.exe
Token: SeDebugPrivilege	2796	tasklist.exe
Token: SeDebugPrivilege	3376	tasklist.exe
Token: SeDebugPrivilege	2396	tasklist.exe
Token: SeDebugPrivilege	3820	tasklist.exe
Token: SeDebugPrivilege	2836	tasklist.exe
Token: SeDebugPrivilege	4272	tasklist.exe
Token: SeDebugPrivilege	4560	tasklist.exe
Token: SeDebugPrivilege	4580	tasklist.exe
Token: SeDebugPrivilege	4852	tasklist.exe
Token: SeDebugPrivilege	3288	tasklist.exe
Token: SeDebugPrivilege	3708	tasklist.exe
Token: SeDebugPrivilege	4520	tasklist.exe
Token: SeDebugPrivilege	3540	tasklist.exe
Token: SeDebugPrivilege	3984	tasklist.exe
Token: SeDebugPrivilege	4188	tasklist.exe
Token: SeDebugPrivilege	2284	tasklist.exe
Token: SeDebugPrivilege	376	tasklist.exe
Token: SeDebugPrivilege	4576	tasklist.exe
Token: SeDebugPrivilege	4068	tasklist.exe
Token: SeDebugPrivilege	1860	tasklist.exe
Token: SeDebugPrivilege	1684	tasklist.exe
Token: SeDebugPrivilege	2100	tasklist.exe
Token: SeDebugPrivilege	2424	tasklist.exe
Token: SeDebugPrivilege	536	tasklist.exe
Token: SeDebugPrivilege	1908	tasklist.exe
Token: SeDebugPrivilege	220	tasklist.exe
Token: SeDebugPrivilege	2288	tasklist.exe
Token: SeDebugPrivilege	3112	tasklist.exe
Token: SeDebugPrivilege	3824	tasklist.exe
Token: SeDebugPrivilege	3872	tasklist.exe
Token: SeDebugPrivilege	4180	tasklist.exe
Token: SeDebugPrivilege	1060	tasklist.exe
Token: SeDebugPrivilege	1280	tasklist.exe
Token: SeDebugPrivilege	312	tasklist.exe
Token: SeDebugPrivilege	1532	tasklist.exe
Token: SeDebugPrivilege	916	tasklist.exe
Token: SeDebugPrivilege	2544	tasklist.exe
Token: SeDebugPrivilege	4164	tasklist.exe
Token: SeDebugPrivilege	400	tasklist.exe
Token: SeDebugPrivilege	3060	tasklist.exe
Token: SeDebugPrivilege	4544	tasklist.exe
Token: SeDebugPrivilege	4236	tasklist.exe
Token: SeDebugPrivilege	2508	tasklist.exe
Token: SeDebugPrivilege	1756	tasklist.exe
Token: SeDebugPrivilege	3628	tasklist.exe
Token: SeDebugPrivilege	3996	tasklist.exe
Token: SeDebugPrivilege	1096	tasklist.exe
Token: SeDebugPrivilege	5112	tasklist.exe
Token: SeDebugPrivilege	3228	tasklist.exe
Token: SeDebugPrivilege	4704	tasklist.exe
Token: SeDebugPrivilege	3112	tasklist.exe
Token: SeDebugPrivilege	4744	tasklist.exe
Token: SeDebugPrivilege	3872	tasklist.exe
Token: SeDebugPrivilege	4560	tasklist.exe
Token: SeDebugPrivilege	4348	tasklist.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3976 wrote to memory of 4708	3976	SS.exe	85
PID 3976 wrote to memory of 964	3976	SS.exe	91
PID 3976 wrote to memory of 1780	3976	SS.exe	93
PID 3976 wrote to memory of 2512	3976	SS.exe	95
PID 3976 wrote to memory of 2476	3976	SS.exe	97
PID 3976 wrote to memory of 3756	3976	SS.exe	99
PID 3976 wrote to memory of 3844	3976	SS.exe	101
PID 3976 wrote to memory of 1460	3976	SS.exe	103
PID 3976 wrote to memory of 4196	3976	SS.exe	105
PID 3976 wrote to memory of 2796	3976	SS.exe	107
PID 3976 wrote to memory of 3376	3976	SS.exe	109
PID 3976 wrote to memory of 2396	3976	SS.exe	111
PID 3976 wrote to memory of 3820	3976	SS.exe	113
PID 3976 wrote to memory of 2836	3976	SS.exe	115
PID 3976 wrote to memory of 4272	3976	SS.exe	117
PID 3976 wrote to memory of 4560	3976	SS.exe	119
PID 3976 wrote to memory of 4580	3976	SS.exe	121
PID 3976 wrote to memory of 4852	3976	SS.exe	123
PID 3976 wrote to memory of 3288	3976	SS.exe	125
PID 3976 wrote to memory of 3708	3976	SS.exe	127
PID 3976 wrote to memory of 4520	3976	SS.exe	129
PID 3976 wrote to memory of 3540	3976	SS.exe	131
PID 3976 wrote to memory of 3984	3976	SS.exe	133
PID 3976 wrote to memory of 4188	3976	SS.exe	135
PID 3976 wrote to memory of 2284	3976	SS.exe	137
PID 3976 wrote to memory of 376	3976	SS.exe	139
PID 3976 wrote to memory of 4576	3976	SS.exe	141
PID 3976 wrote to memory of 4068	3976	SS.exe	143
PID 3976 wrote to memory of 1860	3976	SS.exe	145
PID 3976 wrote to memory of 1684	3976	SS.exe	147
PID 3976 wrote to memory of 2100	3976	SS.exe	149
PID 3976 wrote to memory of 2424	3976	SS.exe	151
PID 3976 wrote to memory of 536	3976	SS.exe	153
PID 3976 wrote to memory of 1908	3976	SS.exe	155
PID 3976 wrote to memory of 220	3976	SS.exe	157
PID 3976 wrote to memory of 2288	3976	SS.exe	159
PID 3976 wrote to memory of 3112	3976	SS.exe	161
PID 3976 wrote to memory of 3824	3976	SS.exe	163
PID 3976 wrote to memory of 3872	3976	SS.exe	165
PID 3976 wrote to memory of 4180	3976	SS.exe	167
PID 3976 wrote to memory of 1060	3976	SS.exe	169
PID 3976 wrote to memory of 1280	3976	SS.exe	171
PID 3976 wrote to memory of 312	3976	SS.exe	272
PID 3976 wrote to memory of 1532	3976	SS.exe	226
PID 3976 wrote to memory of 916	3976	SS.exe	177
PID 3976 wrote to memory of 2544	3976	SS.exe	179
PID 3976 wrote to memory of 4164	3976	SS.exe	181
PID 3976 wrote to memory of 400	3976	SS.exe	183
PID 3976 wrote to memory of 3060	3976	SS.exe	185
PID 3976 wrote to memory of 4480	3976	SS.exe	187
PID 3976 wrote to memory of 964	3976	SS.exe	190
PID 964 wrote to memory of 4544	964	Updater.exe	191
PID 4788 wrote to memory of 2508	4788	Updater.exe	290
PID 964 wrote to memory of 4236	964	Updater.exe	195
PID 964 wrote to memory of 1756	964	Updater.exe	197
PID 4788 wrote to memory of 3628	4788	Updater.exe	199
PID 964 wrote to memory of 3996	964	Updater.exe	201
PID 4788 wrote to memory of 1096	4788	Updater.exe	302
PID 964 wrote to memory of 5112	964	Updater.exe	205
PID 4788 wrote to memory of 3228	4788	Updater.exe	207
PID 964 wrote to memory of 4704	964	Updater.exe	385
PID 964 wrote to memory of 3112	964	Updater.exe	390
PID 4788 wrote to memory of 4744	4788	Updater.exe	213
PID 964 wrote to memory of 3872	964	Updater.exe	215

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\SS.exe
"C:\Users\Admin\AppData\Local\Temp\SS.exe"
1⤵
- Checks whether UAC is enabled
- Suspicious use of WriteProcessMemory
PID:3976
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq wireshark.exe" /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:4708
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq dumpcap.exe" /NH
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:964
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq procmon.exe" /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:1780
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq procmon64.exe" /NH
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2512
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq procexp.exe" /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:2476
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq procexp64.exe" /NH
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3756
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq processhacker.exe" /NH
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3844
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq x64dbg.exe" /NH
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1460
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq x32dbg.exe" /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:4196
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq ollydbg.exe" /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:2796
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq ida.exe" /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:3376
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq ida64.exe" /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:2396
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq idag.exe" /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:3820
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq idag64.exe" /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:2836
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq idaw.exe" /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:4272
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq idaw64.exe" /NH
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4560
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq fiddler.exe" /NH
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4580
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq httpdebugger.exe" /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:4852
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq httpdebuggerui.exe" /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:3288
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq dnspy.exe" /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:3708
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq pestudio.exe" /NH
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4520
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq cheatengine.exe" /NH
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3540
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq hxd.exe" /NH
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3984
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq devenv.exe" /NH
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4188
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq windbg.exe" /NH
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2284
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq immunitydebugger.exe" /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:376
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq apimonitor.exe" /NH
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4576
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq autoruns.exe" /NH
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4068
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq autorunsc.exe" /NH
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1860
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq filemon.exe" /NH
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1684
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq regmon.exe" /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:2100
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq resourcehacker.exe" /NH
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2424
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq vmtoolsd.exe" /NH
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:536
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq vmwaretray.exe" /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:1908
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq vmwareuser.exe" /NH
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:220
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq vmusrvc.exe" /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:2288
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq vmsrvc.exe" /NH
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3112
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq vboxservice.exe" /NH
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3824
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq vboxtray.exe" /NH
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3872
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq xenservice.exe" /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:4180
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq qemu-ga.exe" /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:1060
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq sandboxie.exe" /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:1280
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq sandboxiedcomlaunch.exe" /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:312
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq sandboxierpcss.exe" /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:1532
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq joeboxcontrol.exe" /NH
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:916
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq joeboxserver.exe" /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:2544
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq prl_tools.exe" /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:4164
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq prl_cc.exe" /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:400
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq vmacthlp.exe" /NH
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3060
- C:\Windows\system32\schtasks.exe
  schtasks /Create /XML C:\Users\Admin\AppData\Local\Temp\Updater_task.xml /TN Updater /F
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:4480
- C:\Users\Admin\AppData\Local\Discord\Updater.exe
  C:\Users\Admin\AppData\Local\Discord\Updater.exe --installed
  2⤵
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Suspicious use of WriteProcessMemory
  PID:964
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq wireshark.exe" /NH
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4544
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq dumpcap.exe" /NH
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4236
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq procmon.exe" /NH
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1756
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq procmon64.exe" /NH
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3996
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq procexp.exe" /NH
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:5112
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq procexp64.exe" /NH
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4704
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq processhacker.exe" /NH
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:3112
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq x64dbg.exe" /NH
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3872
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq x32dbg.exe" /NH
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4348
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq ollydbg.exe" /NH
    3⤵
    PID:4416
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq ida.exe" /NH
    3⤵
    - Discovers running processes
    PID:3288
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq ida64.exe" /NH
    3⤵
    PID:3816
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq idag.exe" /NH
    3⤵
    PID:2964
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq idag64.exe" /NH
    3⤵
    - Discovers running processes
    PID:4836
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq idaw.exe" /NH
    3⤵
    - Discovers running processes
    PID:4424
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq idaw64.exe" /NH
    3⤵
    PID:4900
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq fiddler.exe" /NH
    3⤵
    - Discovers running processes
    PID:2472
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq httpdebugger.exe" /NH
    3⤵
    - Discovers running processes
    PID:2424
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq httpdebuggerui.exe" /NH
    3⤵
    - Discovers running processes
    PID:2396
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq dnspy.exe" /NH
    3⤵
    PID:2932
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq pestudio.exe" /NH
    3⤵
    PID:3644
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq cheatengine.exe" /NH
    3⤵
    PID:1200
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq hxd.exe" /NH
    3⤵
    PID:1280
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq devenv.exe" /NH
    3⤵
    PID:3796
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq windbg.exe" /NH
    3⤵
    PID:4456
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq immunitydebugger.exe" /NH
    3⤵
    - Discovers running processes
    PID:4160
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq apimonitor.exe" /NH
    3⤵
    - Discovers running processes
    PID:4068
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq autoruns.exe" /NH
    3⤵
    PID:4488
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:2508
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq autorunsc.exe" /NH
    3⤵
    - Discovers running processes
    PID:1000
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:4900
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq filemon.exe" /NH
    3⤵
    PID:176
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq regmon.exe" /NH
    3⤵
    PID:4808
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq resourcehacker.exe" /NH
    3⤵
    PID:2944
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq vmtoolsd.exe" /NH
    3⤵
    PID:3028
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq vmwaretray.exe" /NH
    3⤵
    PID:4180
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq vmwareuser.exe" /NH
    3⤵
    PID:3644
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq vmusrvc.exe" /NH
    3⤵
    - Discovers running processes
    PID:4560
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq vmsrvc.exe" /NH
    3⤵
    - Discovers running processes
    PID:2952
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq vboxservice.exe" /NH
    3⤵
    PID:3540
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:3796
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq vboxtray.exe" /NH
    3⤵
    PID:4148
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq xenservice.exe" /NH
    3⤵
    - Discovers running processes
    PID:3816
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq qemu-ga.exe" /NH
    3⤵
    - Discovers running processes
    PID:3792
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq sandboxie.exe" /NH
    3⤵
    - Discovers running processes
    PID:4156
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq sandboxiedcomlaunch.exe" /NH
    3⤵
    PID:4424
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq sandboxierpcss.exe" /NH
    3⤵
    - Discovers running processes
    PID:4128
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq joeboxcontrol.exe" /NH
    3⤵
    - Discovers running processes
    PID:3164
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq joeboxserver.exe" /NH
    3⤵
    PID:4756
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq prl_tools.exe" /NH
    3⤵
    PID:1424
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq prl_cc.exe" /NH
    3⤵
    PID:3400
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq vmacthlp.exe" /NH
    3⤵
    PID:4380
- - C:\Windows\system32\schtasks.exe
    schtasks /Create /XML C:\Users\Admin\AppData\Local\Temp\Updater_task.xml /TN Updater /F
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4884
- - C:\Users\Admin\AppData\Local\Discord\Updater.exe
    C:\Users\Admin\AppData\Local\Discord\Updater.exe --watchdog 964 --wd-target C:\Users\Admin\AppData\Local\Discord\Updater.exe
    3⤵
    - Executes dropped EXE
    PID:3892
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "(Get-WmiObject -Query \"select Name from Win32_Processor\").Name"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:4560
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "(Get-WmiObject -Query \"Select Name from Win32_VideoController\").Name"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:4848
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "(Get-WmiObject -Query \"select Caption from Win32_OperatingSystem\").Caption"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:5044
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "(Get-WmiObject -Query \"select TotalPhysicalMemory from Win32_ComputerSystem\").TotalPhysicalMemory"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:5096

C:\Users\Admin\AppData\Local\Discord\Updater.exe
C:\Users\Admin\AppData\Local\Discord\Updater.exe
1⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of WriteProcessMemory
PID:4788
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq wireshark.exe" /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:2508
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq dumpcap.exe" /NH
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3628
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq procmon.exe" /NH
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1096
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq procmon64.exe" /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:3228
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq procexp.exe" /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:4744
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq procexp64.exe" /NH
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4560
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq processhacker.exe" /NH
  2⤵
  - Discovers running processes
  PID:3764
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq x64dbg.exe" /NH
  2⤵
  PID:4464
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:1532
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq x32dbg.exe" /NH
  2⤵
  - Discovers running processes
  PID:1168
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq ollydbg.exe" /NH
  2⤵
  PID:4724
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq ida.exe" /NH
  2⤵
  - Discovers running processes
  PID:3476
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq ida64.exe" /NH
  2⤵
  - Discovers running processes
  PID:1716
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq idag.exe" /NH
  2⤵
  - Discovers running processes
  PID:1844
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq idag64.exe" /NH
  2⤵
  PID:4756
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq idaw.exe" /NH
  2⤵
  PID:4356
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq idaw64.exe" /NH
  2⤵
  - Discovers running processes
  PID:2460
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq fiddler.exe" /NH
  2⤵
  PID:4580
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq httpdebugger.exe" /NH
  2⤵
  - Discovers running processes
  PID:4936
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:312
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq httpdebuggerui.exe" /NH
  2⤵
  PID:3288
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq dnspy.exe" /NH
  2⤵
  - Discovers running processes
  PID:1788
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq pestudio.exe" /NH
  2⤵
  PID:2280
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq cheatengine.exe" /NH
  2⤵
  PID:3536
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq hxd.exe" /NH
  2⤵
  - Discovers running processes
  PID:3992
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq devenv.exe" /NH
  2⤵
  - Discovers running processes
  PID:3340
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq windbg.exe" /NH
  2⤵
  - Discovers running processes
  PID:1056
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:1096
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq immunitydebugger.exe" /NH
  2⤵
  PID:4356
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq apimonitor.exe" /NH
  2⤵
  - Discovers running processes
  PID:2460
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq autoruns.exe" /NH
  2⤵
  PID:4220
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq autorunsc.exe" /NH
  2⤵
  - Discovers running processes
  PID:4936
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq filemon.exe" /NH
  2⤵
  - Discovers running processes
  PID:3060
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq regmon.exe" /NH
  2⤵
  PID:4496
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq resourcehacker.exe" /NH
  2⤵
  - Discovers running processes
  PID:2452
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq vmtoolsd.exe" /NH
  2⤵
  PID:1012
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq vmwaretray.exe" /NH
  2⤵
  PID:3948
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq vmwareuser.exe" /NH
  2⤵
  PID:3604
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq vmusrvc.exe" /NH
  2⤵
  - Discovers running processes
  PID:4356
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq vmsrvc.exe" /NH
  2⤵
  - Discovers running processes
  PID:1200
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq vboxservice.exe" /NH
  2⤵
  PID:2752
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq vboxtray.exe" /NH
  2⤵
  PID:4256
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq xenservice.exe" /NH
  2⤵
  PID:452
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:3476
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq qemu-ga.exe" /NH
  2⤵
  PID:1992
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq sandboxie.exe" /NH
  2⤵
  PID:2100
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq sandboxiedcomlaunch.exe" /NH
  2⤵
  PID:4140
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:4704
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq sandboxierpcss.exe" /NH
  2⤵
  - Discovers running processes
  PID:4576
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq joeboxcontrol.exe" /NH
  2⤵
  PID:1112
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq joeboxserver.exe" /NH
  2⤵
  PID:3112
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq prl_tools.exe" /NH
  2⤵
  PID:3400
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq prl_cc.exe" /NH
  2⤵
  - Discovers running processes
  PID:2260
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq vmacthlp.exe" /NH
  2⤵
  PID:1912

C:\Windows\system32\backgroundTaskHost.exe
"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca
1⤵
PID:4220

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Updater.exe

Path C:\Users\Admin\AppData\Local\Discord\Updater.exe
Size 5.6MB
SHA256 aa8f493aa9999c347111187cd8af93e6818da502820431c91400dc0b8b939365
MD5 47439fc3b9d0045a2c6a69fd1f8182db
SHA1 7615cefa5a4cbaa5ae29deb8efcab027452799a3
SHA512 42ad85463d4def6f99117d63a4d8340d122fb6d9e4aabd90907d8164c355fb1375f3cf6ed153ef17b789925546989c554e25bfd6533f3190a7a70f1d5c623b85
SSDEEP 98304:zC7YA26J0Djx3ZMNPDZsrR7z9IGh8A0/KeszS3sGwSpUGNV3IIXu8yNuungdoj:uh2b2sNH7yWSwMUGv4wy+O
TLSH
T1D1463350A21436B0F7D9A23EABB3E827467B565600F36DCF5B4981F7653F1C12AB8036
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 b1f292b6199aa29c7fafbca007e5f9e3f68edcbbca1965bc828cc92dc0f18bb8
MD5 6cf293cb4d80be23433eecf74ddb5503
SHA1 24fe4752df102c2ef492954d6b046cb5512ad408
SHA512 0f91e2da0da8794b9797c7b50eb5dfd27bde4546ceb6902a776664ce887dd6f12a0dd8773d612ccc76dfd029cd280778a0f0ae17ce679b3d2ffd968dd7e94a00
TLSH
T148510F323375F1E4C8567F071E68198053BF4395EA94AF5CB298621ED92741B8F222F3
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 64B
SHA256 3fdb51ad127b4046a8890cb9bdf470360f203ed5e4e2698b7437eb52d6e24f5d
MD5 92fc413be28b72c89d986d669b3af030
SHA1 0acb2284957bcc4f8752c363fc21d2b7b446fd0a
SHA512 a841d598d48c3e6fff8d495fc26288aca7885c71b5061d16b0b9bd983def0502986bf20366a837325063ac61e5aa0723ebff756736635ae8cd6aec5ec0c0fd92
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 64B
SHA256 a7de5177c68a64bd48b36d49e2853799f4ebcfa8e4761f7cc472f333dc5f65cf
MD5 446dd1cf97eaba21cf14d03aebc79f27
SHA1 36e4cc7367e0c7b40f4a8ace272941ea46373799
SHA512 a6d754709f30b122112ae30e5ab22486393c5021d33da4d1304c061863d2e1e79e8aeb029cae61261bb77d0e7becd53a7b0106d6ea4368b4c302464e3d941cf7
MD5 SHA1 SHA512

Submit Download

Updater_task.xml

Path C:\Users\Admin\AppData\Local\Temp\Updater_task.xml
Size 1KB
SHA256 c073886326054400298c946fd3ef0603df6bc4f6968457fcba1e82d65606ce74
MD5 f1911ec98cd6bbb4806c8aaf8b89c67f
SHA1 dee0e954cf207672553a3a01aaff844ae8bf0c83
SHA512 b6382a1f71375a0f57681eaeea245e3097795e2f28c5a0d85bf7e83935cfad53047d0cd58fcd4006d30b4cc9293ae02fbf5b2e2a7d3c0b6fe5a4f4d68767c74a
TLSH
T1F32132905C15F52F755A973ECB9153C3273E5B694AB64038D8CC4DBC648A1CA710397B
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_ev1k1uje.kxm.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ev1k1uje.kxm.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

wruntime.log

Path C:\Users\Admin\AppData\Local\Temp\wruntime.log
Size 634B
SHA256 7687235a6b92273ccd4732894c234d4f5e7b6e7b348fa52201da58ee01050dd5
MD5 12c8210fb806ea5f2da751373ba38628
SHA1 e851716fac31b86c37e5225f4bbb8ca26bd5ac26
SHA512 1b276b619db7709fbf13d6bbf05a568b36643f34f7481a15cfe8a6bd86f82b41086b621d73b2416abd793168189626d533604d1e377a4178399a4ed52b81aa35
TLSH
T1CCF07DC12ECACB2C4485807781A253ABD97064081E9AFB378675C30C31F550C6B86A31
MD5 SHA1 SHA512 TLSH

Submit Download

wruntime.log

Path C:\Users\Admin\AppData\Local\Temp\wruntime.log
Size 1KB
SHA256 2e49faaeca33ef2e21af76dea36ad6b8264e9b6a5f3fa2dcd934bd59d6ca987e
MD5 f233d5c87a53a90c4450cc54fd47931a
SHA1 dc68b11d3f81dfa641f71f3f938f0788f5ac779b
SHA512 8bec1a5ad63e2a95e3a1689e136d77a798653254a2d2069c460ab8ffd897e4ae3570505279005a41d6d790957130725653a50dcda187c1c4c2e0093711ab7dae
TLSH
T10131BFD76CCA8B79848183B79193539BC66064040EDDBB338AB5C34F31E550D7B8A275
MD5 SHA1 SHA512 TLSH

Submit Download

wruntime.log

Path C:\Users\Admin\AppData\Local\Temp\wruntime.log
Size 2KB
SHA256 c6aa046b014b922010be70147839a2fc9f25a08b54141a184308d32d77bffcf8
MD5 85c56e90842ad268c0169f89611573ea
SHA1 73e1e2863b051630edb9bd4b8a1a4eebc0645b19
SHA512 6a46672ac2e102b839cf84394c1c976adbd4148cbf00ad89a4d05b8e4126e6d477dfcf4600f79a6bad0950c698f34e9ba073dc403ca0e941f4df75e5e846b63f
TLSH
T13941AED32CCA8B748185A2B7C193139BC67164040EDD7A329AB5C38F31A910D778A379
MD5 SHA1 SHA512 TLSH

Submit Download

memory/964-102-0x0000000000F70000-0x0000000001D70000-memory.dmp

Download

memory/964-87-0x0000000000F70000-0x0000000001D70000-memory.dmp

Download

memory/964-120-0x0000000000F70000-0x0000000001D70000-memory.dmp

Download

memory/964-117-0x0000000000F70000-0x0000000001D70000-memory.dmp

Download

memory/964-116-0x0000000000F70000-0x0000000001D70000-memory.dmp

Download

memory/964-114-0x0000000000F70000-0x0000000001D70000-memory.dmp

Download

memory/964-12-0x0000000000F70000-0x0000000001D70000-memory.dmp

Download

memory/964-112-0x0000000000F70000-0x0000000001D70000-memory.dmp

Download

memory/964-110-0x0000000000F70000-0x0000000001D70000-memory.dmp

Download

memory/964-108-0x0000000000F70000-0x0000000001D70000-memory.dmp

Download

memory/964-51-0x0000000000F70000-0x0000000001D70000-memory.dmp

Download

memory/964-106-0x0000000000F70000-0x0000000001D70000-memory.dmp

Download

memory/964-104-0x0000000000F70000-0x0000000001D70000-memory.dmp

Download

memory/964-66-0x0000000000F70000-0x0000000001D70000-memory.dmp

Download

memory/964-100-0x0000000000F70000-0x0000000001D70000-memory.dmp

Download

memory/964-98-0x0000000000F70000-0x0000000001D70000-memory.dmp

Download

memory/964-95-0x0000000000F70000-0x0000000001D70000-memory.dmp

Download

memory/964-69-0x0000000000F70000-0x0000000001D70000-memory.dmp

Download

memory/964-71-0x0000000000F70000-0x0000000001D70000-memory.dmp

Download

memory/964-93-0x0000000000F70000-0x0000000001D70000-memory.dmp

Download

memory/964-91-0x0000000000F70000-0x0000000001D70000-memory.dmp

Download

memory/964-73-0x0000000000F70000-0x0000000001D70000-memory.dmp

Download

memory/964-75-0x0000000000F70000-0x0000000001D70000-memory.dmp

Download

memory/964-89-0x0000000000F70000-0x0000000001D70000-memory.dmp

Download

memory/964-19-0x0000000000F70000-0x0000000001D70000-memory.dmp

Download

memory/964-78-0x0000000000F70000-0x0000000001D70000-memory.dmp

Download

memory/964-85-0x0000000000F70000-0x0000000001D70000-memory.dmp

Download

memory/964-80-0x0000000000F70000-0x0000000001D70000-memory.dmp

Download

memory/964-84-0x0000000000F70000-0x0000000001D70000-memory.dmp

Download

memory/964-82-0x0000000000F70000-0x0000000001D70000-memory.dmp

Download

memory/3892-101-0x0000000000F70000-0x0000000001D70000-memory.dmp

Download

memory/3892-111-0x0000000000F70000-0x0000000001D70000-memory.dmp

Download

memory/3892-79-0x0000000000F70000-0x0000000001D70000-memory.dmp

Download

memory/3892-86-0x0000000000F70000-0x0000000001D70000-memory.dmp

Download

memory/3892-77-0x0000000000F70000-0x0000000001D70000-memory.dmp

Download

memory/3892-88-0x0000000000F70000-0x0000000001D70000-memory.dmp

Download

memory/3892-76-0x0000000000F70000-0x0000000001D70000-memory.dmp

Download

memory/3892-90-0x0000000000F70000-0x0000000001D70000-memory.dmp

Download

memory/3892-74-0x0000000000F70000-0x0000000001D70000-memory.dmp

Download

memory/3892-103-0x0000000000F70000-0x0000000001D70000-memory.dmp

Download

memory/3892-72-0x0000000000F70000-0x0000000001D70000-memory.dmp

Download

memory/3892-94-0x0000000000F70000-0x0000000001D70000-memory.dmp

Download

memory/3892-96-0x0000000000F70000-0x0000000001D70000-memory.dmp

Download

memory/3892-68-0x0000000000F70000-0x0000000001D70000-memory.dmp

Download

memory/3892-97-0x0000000000F70000-0x0000000001D70000-memory.dmp

Download

memory/3892-119-0x0000000000F70000-0x0000000001D70000-memory.dmp

Download

memory/3892-99-0x0000000000F70000-0x0000000001D70000-memory.dmp

Download

memory/3892-118-0x0000000000F70000-0x0000000001D70000-memory.dmp

Download

memory/3892-81-0x0000000000F70000-0x0000000001D70000-memory.dmp

Download

memory/3892-21-0x0000000000F70000-0x0000000001D70000-memory.dmp

Download

memory/3892-92-0x0000000000F70000-0x0000000001D70000-memory.dmp

Download

memory/3892-64-0x0000000000F70000-0x0000000001D70000-memory.dmp

Download

memory/3892-105-0x0000000000F70000-0x0000000001D70000-memory.dmp

Download

memory/3892-115-0x0000000000F70000-0x0000000001D70000-memory.dmp

Download

memory/3892-107-0x0000000000F70000-0x0000000001D70000-memory.dmp

Download

memory/3892-113-0x0000000000F70000-0x0000000001D70000-memory.dmp

Download

memory/3892-109-0x0000000000F70000-0x0000000001D70000-memory.dmp

Download

memory/3892-83-0x0000000000F70000-0x0000000001D70000-memory.dmp

Download

memory/3976-1-0x0000000000540000-0x0000000001340000-memory.dmp

Download

memory/3976-11-0x0000000000540000-0x0000000001340000-memory.dmp

Download

memory/3976-2-0x0000000000540000-0x0000000001340000-memory.dmp

Download

memory/3976-0-0x0000000000540000-0x0000000001340000-memory.dmp

Download

memory/4560-22-0x0000027D3D5E0000-0x0000027D3D602000-memory.dmp

Download

memory/4788-50-0x0000000000F70000-0x0000000001D70000-memory.dmp

Download

memory/4788-10-0x0000000000F70000-0x0000000001D70000-memory.dmp

Download

memory/4788-65-0x0000000000F70000-0x0000000001D70000-memory.dmp

Download

memory/4788-67-0x0000000000F70000-0x0000000001D70000-memory.dmp

Download

memory/4788-14-0x0000000000F70000-0x0000000001D70000-memory.dmp

Download