webrat | aa8f493aa9999c347111187cd8af93e6818da502820431c91400dc0b8b939365

Analysis

max time kernel
300s
max time network
300s
platform
windows11-21h2_x64
resource
win11-20260911-en
resource tags

arch:x64arch:x86image:win11-20260911-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
18/09/2026, 16:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
SS.exe
Size 5.6MB
Sample260918-tk67jshe42
SHA256 aa8f493aa9999c347111187cd8af93e6818da502820431c91400dc0b8b939365
MD5 47439fc3b9d0045a2c6a69fd1f8182db
SHA1 7615cefa5a4cbaa5ae29deb8efcab027452799a3
SHA512 42ad85463d4def6f99117d63a4d8340d122fb6d9e4aabd90907d8164c355fb1375f3cf6ed153ef17b789925546989c554e25bfd6533f3190a7a70f1d5c623b85
SSDEEP 98304:zC7YA26J0Djx3ZMNPDZsrR7z9IGh8A0/KeszS3sGwSpUGNV3IIXu8yNuungdoj:uh2b2sNH7yWSwMUGv4wy+O
TLSH
T1D1463350A21436B0F7D9A23EABB3E827467B565600F36DCF5B4981F7653F1C12AB8036
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution webrat persistence rat trojan upx

Malware Config

Signatures

Family: WebRAT
WebRAT is a Windows RAT written in Golang.
rat webrat

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
2348	powershell.exe
5364	powershell.exe
1360	powershell.exe
3636	powershell.exe

Executes dropped EXE 3 IoCs

pid	Process
1724	Updater.exe
1928	Updater.exe
1544	Updater.exe

Checks whether UAC is enabled 1 TTPs 3 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	SS.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Updater.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Updater.exe

Discovers running processes 1 TTPs 64 IoCs

Running process information can be used to identify security tools or plan follow-on actions.

discovery

Process Discovery

T1057

pid	Process
1628	tasklist.exe
2508	tasklist.exe
5264	tasklist.exe
2100	tasklist.exe
2212	tasklist.exe
2248	tasklist.exe
1592	tasklist.exe
4580	tasklist.exe
4864	tasklist.exe
5236	tasklist.exe
3364	tasklist.exe
988	tasklist.exe
5740	tasklist.exe
1840	tasklist.exe
1960	tasklist.exe
3016	tasklist.exe
5484	tasklist.exe
4112	tasklist.exe
6120	tasklist.exe
2476	tasklist.exe
3868	tasklist.exe
3872	tasklist.exe
5404	tasklist.exe
748	tasklist.exe
5620	tasklist.exe
3536	tasklist.exe
5316	tasklist.exe
3972	tasklist.exe
5944	tasklist.exe
4036	tasklist.exe
3388	tasklist.exe
4580	tasklist.exe
5616	tasklist.exe
6048	tasklist.exe
556	tasklist.exe
4988	tasklist.exe
2248	tasklist.exe
4852	tasklist.exe
2512	tasklist.exe
3792	tasklist.exe
4368	tasklist.exe
1624	tasklist.exe
3048	tasklist.exe
3248	tasklist.exe
2648	tasklist.exe
2056	tasklist.exe
2800	tasklist.exe
4544	tasklist.exe
4480	tasklist.exe
5524	tasklist.exe
5368	tasklist.exe
5248	tasklist.exe
2572	tasklist.exe
3900	tasklist.exe
4284	tasklist.exe
3472	tasklist.exe
4048	tasklist.exe
2568	tasklist.exe
3924	tasklist.exe
1244	tasklist.exe
6080	tasklist.exe
1540	tasklist.exe
4732	tasklist.exe
3244	tasklist.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral3/memory/2124-0-0x00000000002F0000-0x00000000010F0000-memory.dmp	upx
behavioral3/files/0x001800000002b7e7-6.dat	upx
behavioral3/memory/1724-8-0x0000000000DF0000-0x0000000001BF0000-memory.dmp	upx
behavioral3/memory/2124-11-0x00000000002F0000-0x00000000010F0000-memory.dmp	upx
behavioral3/memory/1928-12-0x0000000000DF0000-0x0000000001BF0000-memory.dmp	upx
behavioral3/memory/1544-17-0x0000000000DF0000-0x0000000001BF0000-memory.dmp	upx
behavioral3/memory/1724-54-0x0000000000DF0000-0x0000000001BF0000-memory.dmp	upx
behavioral3/memory/1724-56-0x0000000000DF0000-0x0000000001BF0000-memory.dmp	upx
behavioral3/memory/1928-57-0x0000000000DF0000-0x0000000001BF0000-memory.dmp	upx
behavioral3/memory/1928-55-0x0000000000DF0000-0x0000000001BF0000-memory.dmp	upx
behavioral3/memory/1544-59-0x0000000000DF0000-0x0000000001BF0000-memory.dmp	upx
behavioral3/memory/1928-60-0x0000000000DF0000-0x0000000001BF0000-memory.dmp	upx
behavioral3/memory/1724-61-0x0000000000DF0000-0x0000000001BF0000-memory.dmp	upx
behavioral3/memory/1928-62-0x0000000000DF0000-0x0000000001BF0000-memory.dmp	upx
behavioral3/memory/1544-63-0x0000000000DF0000-0x0000000001BF0000-memory.dmp	upx
behavioral3/memory/1724-64-0x0000000000DF0000-0x0000000001BF0000-memory.dmp	upx
behavioral3/memory/1544-66-0x0000000000DF0000-0x0000000001BF0000-memory.dmp	upx
behavioral3/memory/1724-67-0x0000000000DF0000-0x0000000001BF0000-memory.dmp	upx
behavioral3/memory/1544-68-0x0000000000DF0000-0x0000000001BF0000-memory.dmp	upx
behavioral3/memory/1724-69-0x0000000000DF0000-0x0000000001BF0000-memory.dmp	upx
behavioral3/memory/1544-70-0x0000000000DF0000-0x0000000001BF0000-memory.dmp	upx
behavioral3/memory/1724-71-0x0000000000DF0000-0x0000000001BF0000-memory.dmp	upx
behavioral3/memory/1544-72-0x0000000000DF0000-0x0000000001BF0000-memory.dmp	upx
behavioral3/memory/1724-73-0x0000000000DF0000-0x0000000001BF0000-memory.dmp	upx
behavioral3/memory/1544-74-0x0000000000DF0000-0x0000000001BF0000-memory.dmp	upx
behavioral3/memory/1724-75-0x0000000000DF0000-0x0000000001BF0000-memory.dmp	upx
behavioral3/memory/1544-76-0x0000000000DF0000-0x0000000001BF0000-memory.dmp	upx
behavioral3/memory/1724-77-0x0000000000DF0000-0x0000000001BF0000-memory.dmp	upx
behavioral3/memory/1544-78-0x0000000000DF0000-0x0000000001BF0000-memory.dmp	upx
behavioral3/memory/1724-79-0x0000000000DF0000-0x0000000001BF0000-memory.dmp	upx
behavioral3/memory/1544-80-0x0000000000DF0000-0x0000000001BF0000-memory.dmp	upx
behavioral3/memory/1724-81-0x0000000000DF0000-0x0000000001BF0000-memory.dmp	upx
behavioral3/memory/1544-82-0x0000000000DF0000-0x0000000001BF0000-memory.dmp	upx
behavioral3/memory/1724-83-0x0000000000DF0000-0x0000000001BF0000-memory.dmp	upx
behavioral3/memory/1544-84-0x0000000000DF0000-0x0000000001BF0000-memory.dmp	upx
behavioral3/memory/1724-85-0x0000000000DF0000-0x0000000001BF0000-memory.dmp	upx
behavioral3/memory/1544-86-0x0000000000DF0000-0x0000000001BF0000-memory.dmp	upx
behavioral3/memory/1724-87-0x0000000000DF0000-0x0000000001BF0000-memory.dmp	upx
behavioral3/memory/1544-88-0x0000000000DF0000-0x0000000001BF0000-memory.dmp	upx
behavioral3/memory/1724-89-0x0000000000DF0000-0x0000000001BF0000-memory.dmp	upx
behavioral3/memory/1544-90-0x0000000000DF0000-0x0000000001BF0000-memory.dmp	upx
behavioral3/memory/1724-91-0x0000000000DF0000-0x0000000001BF0000-memory.dmp	upx
behavioral3/memory/1544-92-0x0000000000DF0000-0x0000000001BF0000-memory.dmp	upx
behavioral3/memory/1724-93-0x0000000000DF0000-0x0000000001BF0000-memory.dmp	upx
behavioral3/memory/1544-94-0x0000000000DF0000-0x0000000001BF0000-memory.dmp	upx
behavioral3/memory/1724-95-0x0000000000DF0000-0x0000000001BF0000-memory.dmp	upx
behavioral3/memory/1544-96-0x0000000000DF0000-0x0000000001BF0000-memory.dmp	upx
behavioral3/memory/1724-97-0x0000000000DF0000-0x0000000001BF0000-memory.dmp	upx
behavioral3/memory/1544-98-0x0000000000DF0000-0x0000000001BF0000-memory.dmp	upx
behavioral3/memory/1724-99-0x0000000000DF0000-0x0000000001BF0000-memory.dmp	upx
behavioral3/memory/1544-100-0x0000000000DF0000-0x0000000001BF0000-memory.dmp	upx
behavioral3/memory/1724-101-0x0000000000DF0000-0x0000000001BF0000-memory.dmp	upx
behavioral3/memory/1544-102-0x0000000000DF0000-0x0000000001BF0000-memory.dmp	upx
behavioral3/memory/1724-103-0x0000000000DF0000-0x0000000001BF0000-memory.dmp	upx
behavioral3/memory/1544-104-0x0000000000DF0000-0x0000000001BF0000-memory.dmp	upx
behavioral3/memory/1724-105-0x0000000000DF0000-0x0000000001BF0000-memory.dmp	upx
behavioral3/memory/1544-106-0x0000000000DF0000-0x0000000001BF0000-memory.dmp	upx
behavioral3/memory/1724-107-0x0000000000DF0000-0x0000000001BF0000-memory.dmp	upx
behavioral3/memory/1544-108-0x0000000000DF0000-0x0000000001BF0000-memory.dmp	upx
behavioral3/memory/1724-109-0x0000000000DF0000-0x0000000001BF0000-memory.dmp	upx
behavioral3/memory/1544-110-0x0000000000DF0000-0x0000000001BF0000-memory.dmp	upx
behavioral3/memory/1724-111-0x0000000000DF0000-0x0000000001BF0000-memory.dmp	upx
behavioral3/memory/1544-112-0x0000000000DF0000-0x0000000001BF0000-memory.dmp	upx
behavioral3/memory/1724-113-0x0000000000DF0000-0x0000000001BF0000-memory.dmp	upx

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1644	schtasks.exe
4672	schtasks.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
2348	powershell.exe
2348	powershell.exe
5364	powershell.exe
5364	powershell.exe
1360	powershell.exe
1360	powershell.exe
3636	powershell.exe
3636	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	5008	tasklist.exe
Token: SeDebugPrivilege	3388	tasklist.exe
Token: SeDebugPrivilege	484	tasklist.exe
Token: SeDebugPrivilege	5248	tasklist.exe
Token: SeDebugPrivilege	4480	tasklist.exe
Token: SeDebugPrivilege	2632	tasklist.exe
Token: SeDebugPrivilege	2408	tasklist.exe
Token: SeDebugPrivilege	5236	tasklist.exe
Token: SeDebugPrivilege	4580	tasklist.exe
Token: SeDebugPrivilege	1644	tasklist.exe
Token: SeDebugPrivilege	1724	tasklist.exe
Token: SeDebugPrivilege	2712	tasklist.exe
Token: SeDebugPrivilege	3792	tasklist.exe
Token: SeDebugPrivilege	5484	tasklist.exe
Token: SeDebugPrivilege	5080	tasklist.exe
Token: SeDebugPrivilege	4568	tasklist.exe
Token: SeDebugPrivilege	2512	tasklist.exe
Token: SeDebugPrivilege	6080	tasklist.exe
Token: SeDebugPrivilege	2572	tasklist.exe
Token: SeDebugPrivilege	3900	tasklist.exe
Token: SeDebugPrivilege	1540	tasklist.exe
Token: SeDebugPrivilege	2800	tasklist.exe
Token: SeDebugPrivilege	2724	tasklist.exe
Token: SeDebugPrivilege	1776	tasklist.exe
Token: SeDebugPrivilege	1084	tasklist.exe
Token: SeDebugPrivilege	5404	tasklist.exe
Token: SeDebugPrivilege	6076	tasklist.exe
Token: SeDebugPrivilege	748	tasklist.exe
Token: SeDebugPrivilege	6000	tasklist.exe
Token: SeDebugPrivilege	236	tasklist.exe
Token: SeDebugPrivilege	3364	tasklist.exe
Token: SeDebugPrivilege	6092	tasklist.exe
Token: SeDebugPrivilege	1636	tasklist.exe
Token: SeDebugPrivilege	3256	tasklist.exe
Token: SeDebugPrivilege	4368	tasklist.exe
Token: SeDebugPrivilege	2444	tasklist.exe
Token: SeDebugPrivilege	1628	tasklist.exe
Token: SeDebugPrivilege	1528	tasklist.exe
Token: SeDebugPrivilege	5616	tasklist.exe
Token: SeDebugPrivilege	4700	tasklist.exe
Token: SeDebugPrivilege	5100	tasklist.exe
Token: SeDebugPrivilege	5196	tasklist.exe
Token: SeDebugPrivilege	4912	tasklist.exe
Token: SeDebugPrivilege	3112	tasklist.exe
Token: SeDebugPrivilege	4284	tasklist.exe
Token: SeDebugPrivilege	2212	tasklist.exe
Token: SeDebugPrivilege	4852	tasklist.exe
Token: SeDebugPrivilege	4112	tasklist.exe
Token: SeDebugPrivilege	3472	tasklist.exe
Token: SeDebugPrivilege	2248	tasklist.exe
Token: SeDebugPrivilege	1840	tasklist.exe
Token: SeDebugPrivilege	5524	tasklist.exe
Token: SeDebugPrivilege	5620	tasklist.exe
Token: SeDebugPrivilege	564	tasklist.exe
Token: SeDebugPrivilege	5312	tasklist.exe
Token: SeDebugPrivilege	1624	tasklist.exe
Token: SeDebugPrivilege	2620	tasklist.exe
Token: SeDebugPrivilege	1196	tasklist.exe
Token: SeDebugPrivilege	896	tasklist.exe
Token: SeDebugPrivilege	1592	tasklist.exe
Token: SeDebugPrivilege	5476	tasklist.exe
Token: SeDebugPrivilege	4048	tasklist.exe
Token: SeDebugPrivilege	3536	tasklist.exe
Token: SeDebugPrivilege	988	tasklist.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2124 wrote to memory of 5008	2124	SS.exe	80
PID 2124 wrote to memory of 3388	2124	SS.exe	83
PID 2124 wrote to memory of 484	2124	SS.exe	85
PID 2124 wrote to memory of 5248	2124	SS.exe	87
PID 2124 wrote to memory of 4480	2124	SS.exe	89
PID 2124 wrote to memory of 2632	2124	SS.exe	91
PID 2124 wrote to memory of 2408	2124	SS.exe	93
PID 2124 wrote to memory of 5236	2124	SS.exe	95
PID 2124 wrote to memory of 4580	2124	SS.exe	97
PID 2124 wrote to memory of 1644	2124	SS.exe	99
PID 2124 wrote to memory of 1724	2124	SS.exe	101
PID 2124 wrote to memory of 2712	2124	SS.exe	103
PID 2124 wrote to memory of 3792	2124	SS.exe	105
PID 2124 wrote to memory of 5484	2124	SS.exe	107
PID 2124 wrote to memory of 5080	2124	SS.exe	109
PID 2124 wrote to memory of 4568	2124	SS.exe	111
PID 2124 wrote to memory of 2512	2124	SS.exe	113
PID 2124 wrote to memory of 6080	2124	SS.exe	115
PID 2124 wrote to memory of 2572	2124	SS.exe	117
PID 2124 wrote to memory of 3900	2124	SS.exe	119
PID 2124 wrote to memory of 1540	2124	SS.exe	121
PID 2124 wrote to memory of 2800	2124	SS.exe	123
PID 2124 wrote to memory of 2724	2124	SS.exe	125
PID 2124 wrote to memory of 1776	2124	SS.exe	127
PID 2124 wrote to memory of 1084	2124	SS.exe	129
PID 2124 wrote to memory of 5404	2124	SS.exe	131
PID 2124 wrote to memory of 6076	2124	SS.exe	133
PID 2124 wrote to memory of 748	2124	SS.exe	135
PID 2124 wrote to memory of 6000	2124	SS.exe	137
PID 2124 wrote to memory of 236	2124	SS.exe	139
PID 2124 wrote to memory of 3364	2124	SS.exe	141
PID 2124 wrote to memory of 6092	2124	SS.exe	143
PID 2124 wrote to memory of 1636	2124	SS.exe	145
PID 2124 wrote to memory of 3256	2124	SS.exe	147
PID 2124 wrote to memory of 4368	2124	SS.exe	149
PID 2124 wrote to memory of 2444	2124	SS.exe	151
PID 2124 wrote to memory of 1628	2124	SS.exe	235
PID 2124 wrote to memory of 1528	2124	SS.exe	155
PID 2124 wrote to memory of 5616	2124	SS.exe	157
PID 2124 wrote to memory of 4700	2124	SS.exe	159
PID 2124 wrote to memory of 5100	2124	SS.exe	161
PID 2124 wrote to memory of 5196	2124	SS.exe	163
PID 2124 wrote to memory of 4912	2124	SS.exe	165
PID 2124 wrote to memory of 3112	2124	SS.exe	167
PID 2124 wrote to memory of 4284	2124	SS.exe	169
PID 2124 wrote to memory of 2212	2124	SS.exe	171
PID 2124 wrote to memory of 4852	2124	SS.exe	173
PID 2124 wrote to memory of 4112	2124	SS.exe	175
PID 2124 wrote to memory of 3472	2124	SS.exe	177
PID 2124 wrote to memory of 1644	2124	SS.exe	179
PID 2124 wrote to memory of 1724	2124	SS.exe	182
PID 1724 wrote to memory of 2248	1724	Updater.exe	271
PID 1928 wrote to memory of 1840	1928	Updater.exe	185
PID 1724 wrote to memory of 5620	1724	Updater.exe	274
PID 1928 wrote to memory of 5524	1928	Updater.exe	189
PID 1724 wrote to memory of 564	1724	Updater.exe	191
PID 1928 wrote to memory of 1624	1928	Updater.exe	193
PID 1724 wrote to memory of 5312	1724	Updater.exe	195
PID 1724 wrote to memory of 2620	1724	Updater.exe	197
PID 1928 wrote to memory of 1196	1928	Updater.exe	199
PID 1724 wrote to memory of 896	1724	Updater.exe	201
PID 1928 wrote to memory of 1592	1928	Updater.exe	382
PID 1724 wrote to memory of 5476	1724	Updater.exe	205
PID 1724 wrote to memory of 4048	1724	Updater.exe	207

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\SS.exe
"C:\Users\Admin\AppData\Local\Temp\SS.exe"
1⤵
- Checks whether UAC is enabled
- Suspicious use of WriteProcessMemory
PID:2124
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq wireshark.exe" /NH
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:5008
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq dumpcap.exe" /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:3388
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq procmon.exe" /NH
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:484
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq procmon64.exe" /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:5248
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq procexp.exe" /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:4480
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq procexp64.exe" /NH
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2632
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq processhacker.exe" /NH
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2408
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq x64dbg.exe" /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:5236
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq x32dbg.exe" /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:4580
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq ollydbg.exe" /NH
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1644
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq ida.exe" /NH
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1724
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq ida64.exe" /NH
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2712
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq idag.exe" /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:3792
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq idag64.exe" /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:5484
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq idaw.exe" /NH
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:5080
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq idaw64.exe" /NH
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4568
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq fiddler.exe" /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:2512
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq httpdebugger.exe" /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:6080
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq httpdebuggerui.exe" /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:2572
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq dnspy.exe" /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:3900
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq pestudio.exe" /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:1540
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq cheatengine.exe" /NH
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2800
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq hxd.exe" /NH
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2724
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq devenv.exe" /NH
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1776
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq windbg.exe" /NH
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1084
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq immunitydebugger.exe" /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:5404
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq apimonitor.exe" /NH
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:6076
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq autoruns.exe" /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:748
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq autorunsc.exe" /NH
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:6000
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq filemon.exe" /NH
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:236
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq regmon.exe" /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:3364
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq resourcehacker.exe" /NH
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:6092
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq vmtoolsd.exe" /NH
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1636
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq vmwaretray.exe" /NH
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3256
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq vmwareuser.exe" /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:4368
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq vmusrvc.exe" /NH
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2444
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq vmsrvc.exe" /NH
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1628
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq vboxservice.exe" /NH
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1528
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq vboxtray.exe" /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:5616
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq xenservice.exe" /NH
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4700
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq qemu-ga.exe" /NH
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:5100
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq sandboxie.exe" /NH
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:5196
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq sandboxiedcomlaunch.exe" /NH
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4912
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq sandboxierpcss.exe" /NH
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3112
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq joeboxcontrol.exe" /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:4284
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq joeboxserver.exe" /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:2212
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq prl_tools.exe" /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:4852
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq prl_cc.exe" /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:4112
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq vmacthlp.exe" /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:3472
- C:\Windows\system32\schtasks.exe
  schtasks /Create /XML C:\Users\Admin\AppData\Local\Temp\Updater_task.xml /TN Updater /F
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:1644
- C:\Users\Admin\AppData\Local\Discord\Updater.exe
  C:\Users\Admin\AppData\Local\Discord\Updater.exe --installed
  2⤵
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Suspicious use of WriteProcessMemory
  PID:1724
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq wireshark.exe" /NH
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:2248
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq dumpcap.exe" /NH
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:5620
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq procmon.exe" /NH
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:564
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq procmon64.exe" /NH
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:5312
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq procexp.exe" /NH
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2620
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq procexp64.exe" /NH
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:896
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq processhacker.exe" /NH
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:5476
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq x64dbg.exe" /NH
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:4048
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq x32dbg.exe" /NH
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:988
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq ollydbg.exe" /NH
    3⤵
    PID:1504
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq ida.exe" /NH
    3⤵
    PID:232
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq ida64.exe" /NH
    3⤵
    PID:2944
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq idag.exe" /NH
    3⤵
    PID:6092
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq idag64.exe" /NH
    3⤵
    - Discovers running processes
    PID:1960
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq idaw.exe" /NH
    3⤵
    PID:756
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq idaw64.exe" /NH
    3⤵
    PID:1480
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq fiddler.exe" /NH
    3⤵
    PID:4144
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq httpdebugger.exe" /NH
    3⤵
    - Discovers running processes
    PID:2568
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq httpdebuggerui.exe" /NH
    3⤵
    PID:1508
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq dnspy.exe" /NH
    3⤵
    PID:3420
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq pestudio.exe" /NH
    3⤵
    - Discovers running processes
    PID:3048
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq cheatengine.exe" /NH
    3⤵
    PID:3824
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq hxd.exe" /NH
    3⤵
    PID:2056
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq devenv.exe" /NH
    3⤵
    - Discovers running processes
    PID:4580
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq windbg.exe" /NH
    3⤵
    - Discovers running processes
    PID:6048
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq immunitydebugger.exe" /NH
    3⤵
    PID:1640
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq apimonitor.exe" /NH
    3⤵
    - Discovers running processes
    PID:3924
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:5620
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq autoruns.exe" /NH
    3⤵
    PID:5748
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq autorunsc.exe" /NH
    3⤵
    - Discovers running processes
    PID:5368
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq filemon.exe" /NH
    3⤵
    - Discovers running processes
    PID:5316
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq regmon.exe" /NH
    3⤵
    - Discovers running processes
    PID:2800
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq resourcehacker.exe" /NH
    3⤵
    - Discovers running processes
    PID:3016
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq vmtoolsd.exe" /NH
    3⤵
    PID:3536
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq vmwaretray.exe" /NH
    3⤵
    - Discovers running processes
    PID:4544
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq vmwareuser.exe" /NH
    3⤵
    PID:5824
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq vmusrvc.exe" /NH
    3⤵
    PID:5656
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq vmsrvc.exe" /NH
    3⤵
    - Discovers running processes
    PID:3972
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:6092
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq vboxservice.exe" /NH
    3⤵
    PID:2052
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq vboxtray.exe" /NH
    3⤵
    PID:5328
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq xenservice.exe" /NH
    3⤵
    - Discovers running processes
    PID:4732
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq qemu-ga.exe" /NH
    3⤵
    - Discovers running processes
    PID:3244
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq sandboxie.exe" /NH
    3⤵
    PID:1508
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq sandboxiedcomlaunch.exe" /NH
    3⤵
    - Discovers running processes
    PID:5944
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq sandboxierpcss.exe" /NH
    3⤵
    - Discovers running processes
    PID:556
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq joeboxcontrol.exe" /NH
    3⤵
    - Discovers running processes
    PID:2476
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq joeboxserver.exe" /NH
    3⤵
    PID:5092
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq prl_tools.exe" /NH
    3⤵
    - Discovers running processes
    PID:2056
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq prl_cc.exe" /NH
    3⤵
    - Discovers running processes
    PID:5264
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq vmacthlp.exe" /NH
    3⤵
    PID:5244
- - C:\Windows\system32\schtasks.exe
    schtasks /Create /XML C:\Users\Admin\AppData\Local\Temp\Updater_task.xml /TN Updater /F
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4672
- - C:\Users\Admin\AppData\Local\Discord\Updater.exe
    C:\Users\Admin\AppData\Local\Discord\Updater.exe --watchdog 1724 --wd-target C:\Users\Admin\AppData\Local\Discord\Updater.exe
    3⤵
    - Executes dropped EXE
    PID:1544
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "(Get-WmiObject -Query \"select Name from Win32_Processor\").Name"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:2348
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "(Get-WmiObject -Query \"Select Name from Win32_VideoController\").Name"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:5364
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "(Get-WmiObject -Query \"select Caption from Win32_OperatingSystem\").Caption"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:1360
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "(Get-WmiObject -Query \"select TotalPhysicalMemory from Win32_ComputerSystem\").TotalPhysicalMemory"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:3636
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:5288

C:\Users\Admin\AppData\Local\Discord\Updater.exe
C:\Users\Admin\AppData\Local\Discord\Updater.exe
1⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of WriteProcessMemory
PID:1928
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq wireshark.exe" /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:1840
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq dumpcap.exe" /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:5524
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq procmon.exe" /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:1624
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq procmon64.exe" /NH
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1196
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq procexp.exe" /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:1592
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq procexp64.exe" /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:3536
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq processhacker.exe" /NH
  2⤵
  PID:3736
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq x64dbg.exe" /NH
  2⤵
  PID:5656
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq x32dbg.exe" /NH
  2⤵
  PID:1516
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq ollydbg.exe" /NH
  2⤵
  PID:3988
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq ida.exe" /NH
  2⤵
  - Discovers running processes
  PID:1628
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq ida64.exe" /NH
  2⤵
  PID:2452
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq idag.exe" /NH
  2⤵
  PID:4900
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq idag64.exe" /NH
  2⤵
  PID:3400
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq idaw.exe" /NH
  2⤵
  PID:4332
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq idaw64.exe" /NH
  2⤵
  - Discovers running processes
  PID:3248
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq fiddler.exe" /NH
  2⤵
  PID:1064
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq httpdebugger.exe" /NH
  2⤵
  PID:6004
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq httpdebuggerui.exe" /NH
  2⤵
  - Discovers running processes
  PID:2248
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq dnspy.exe" /NH
  2⤵
  PID:4380
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq pestudio.exe" /NH
  2⤵
  - Discovers running processes
  PID:2648
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq cheatengine.exe" /NH
  2⤵
  - Discovers running processes
  PID:1244
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq hxd.exe" /NH
  2⤵
  PID:4920
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq devenv.exe" /NH
  2⤵
  PID:2144
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq windbg.exe" /NH
  2⤵
  PID:5200
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:988
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq immunitydebugger.exe" /NH
  2⤵
  PID:5288
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq apimonitor.exe" /NH
  2⤵
  - Discovers running processes
  PID:2508
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq autoruns.exe" /NH
  2⤵
  PID:1548
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq autorunsc.exe" /NH
  2⤵
  - Discovers running processes
  PID:6120
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq filemon.exe" /NH
  2⤵
  PID:5964
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:1480
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq regmon.exe" /NH
  2⤵
  PID:4592
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq resourcehacker.exe" /NH
  2⤵
  PID:1852
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq vmtoolsd.exe" /NH
  2⤵
  - Discovers running processes
  PID:4864
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq vmwaretray.exe" /NH
  2⤵
  - Discovers running processes
  PID:4036
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq vmwareuser.exe" /NH
  2⤵
  - Discovers running processes
  PID:3868
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq vmusrvc.exe" /NH
  2⤵
  PID:1064
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq vmsrvc.exe" /NH
  2⤵
  - Discovers running processes
  PID:4988
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq vboxservice.exe" /NH
  2⤵
  - Discovers running processes
  PID:2100
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq vboxtray.exe" /NH
  2⤵
  PID:4492
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq xenservice.exe" /NH
  2⤵
  PID:1224
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq qemu-ga.exe" /NH
  2⤵
  - Discovers running processes
  PID:5740
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq sandboxie.exe" /NH
  2⤵
  PID:6112
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq sandboxiedcomlaunch.exe" /NH
  2⤵
  PID:5892
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:3016
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq sandboxierpcss.exe" /NH
  2⤵
  PID:1456
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq joeboxcontrol.exe" /NH
  2⤵
  - Discovers running processes
  PID:3872
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq joeboxserver.exe" /NH
  2⤵
  PID:1592
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq prl_tools.exe" /NH
  2⤵
  PID:5600
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:3972
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq prl_cc.exe" /NH
  2⤵
  PID:1572
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq vmacthlp.exe" /NH
  2⤵
  PID:4516

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Updater.exe

Path C:\Users\Admin\AppData\Local\Discord\Updater.exe
Size 5.6MB
SHA256 aa8f493aa9999c347111187cd8af93e6818da502820431c91400dc0b8b939365
MD5 47439fc3b9d0045a2c6a69fd1f8182db
SHA1 7615cefa5a4cbaa5ae29deb8efcab027452799a3
SHA512 42ad85463d4def6f99117d63a4d8340d122fb6d9e4aabd90907d8164c355fb1375f3cf6ed153ef17b789925546989c554e25bfd6533f3190a7a70f1d5c623b85
SSDEEP 98304:zC7YA26J0Djx3ZMNPDZsrR7z9IGh8A0/KeszS3sGwSpUGNV3IIXu8yNuungdoj:uh2b2sNH7yWSwMUGv4wy+O
TLSH
T1D1463350A21436B0F7D9A23EABB3E827467B565600F36DCF5B4981F7653F1C12AB8036
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 43244c0820ec5074e654ecd149fa744f51b2c1522e90285567713dae64b62f59
MD5 88dc70c361a22feac57b031dd9c1f02f
SHA1 a9b4732260c2a323750022a73480f229ce25d46d
SHA512 19c0532741ebc9751390e6c5ca593a81493652f25c74c8cab29a8b5b1f1efef8d511254a04f50b0c4a20724bae10d96d52af7a76b0c85ddc5f020d4cac41100c
TLSH
T13551DF313375B1D489163F47192C19C423BF4355FA94AF4CB698620ED92740B9F222F3
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 3a3dd2d4bdfc17d64262f4dc86ceb242ecf743f2da0412eb60074557a741a5eb
MD5 d6b84d4be64de661c778642e3a7f6ff7
SHA1 714900a833208d39d6a4d0a96c671372dc5a12dd
SHA512 7fb33a924af54810bb8c69a0c4a126b1ba6ade4944f098ab8334c0a6c8fee91c7d8e25465c79deed6f6f7fe2000366831f801691dd950051a37c850722907c77
TLSH
T108115333B79CC235C8E915BA1088AE11B1B5C3C7049EDE8F7A84C109E67F99ADB645E4
MD5 SHA1 SHA512 TLSH

Submit Download

Updater_task.xml

Path C:\Users\Admin\AppData\Local\Temp\Updater_task.xml
Size 1KB
SHA256 c073886326054400298c946fd3ef0603df6bc4f6968457fcba1e82d65606ce74
MD5 f1911ec98cd6bbb4806c8aaf8b89c67f
SHA1 dee0e954cf207672553a3a01aaff844ae8bf0c83
SHA512 b6382a1f71375a0f57681eaeea245e3097795e2f28c5a0d85bf7e83935cfad53047d0cd58fcd4006d30b4cc9293ae02fbf5b2e2a7d3c0b6fe5a4f4d68767c74a
TLSH
T1F32132905C15F52F755A973ECB9153C3273E5B694AB64038D8CC4DBC648A1CA710397B
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_wx12itpy.k4t.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_wx12itpy.k4t.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

wruntime.log

Path C:\Users\Admin\AppData\Local\Temp\wruntime.log
Size 634B
SHA256 9bf268d4b835d298a3de005d0d4c3e21ffc0e3fc9ba11672f76682b0452c6d5a
MD5 ad8ca6cc68c04bf9ec6ff1b046f774f9
SHA1 ee8e4d69a54bc0581716532caf5479b0076b2c8b
SHA512 10002ad7bf6ba7cd3b57ce557f9040b7f11fed9f7aa3e6aab6ab2e7e1ed325577accdfbbad98bcdc32095a6d4199517335216cd432eebc08de782fea2f8cf8bc
TLSH
T13FF07DC12ECA873F6886817B89D2138B857075081FC9FFB1A675C70C21F550CAB97236
MD5 SHA1 SHA512 TLSH

Submit Download

wruntime.log

Path C:\Users\Admin\AppData\Local\Temp\wruntime.log
Size 1KB
SHA256 9e2f43f9ec6791071daa8030838569b19087281eef1a10425fa0120868ec86f2
MD5 b4fa9656c5c3975e415ee463dd46ace4
SHA1 9e3b0a6e954cc6ba56450cd6a3e251f6ca59ba42
SHA512 b5b41b0967d0a371bd1674c93896e548f2f5033214af213a38a50ef9e482b7f0fbc3ac3e8e1dc7f1761cc7ad9721223d5958c3970fff0f3be6562d74ed58754a
TLSH
T17E317DC62CCA87395886837B85D3138B8670B5184FC9BE719AF5C34F21E550C6B9637A
MD5 SHA1 SHA512 TLSH

Submit Download

wruntime.log

Path C:\Users\Admin\AppData\Local\Temp\wruntime.log
Size 1KB
SHA256 4d8bc2b1a31791f5af8c330321dd775e8f4ef9c4a38cfaa9a486fa5ec4168f1b
MD5 c95105e13772488a438f8305265c4bca
SHA1 ee7e347f941ee443d17d5e1a77e916e5d840ec3f
SHA512 49cd02da0f50429f38a501c05ee25ff9aab44026379ea2834cd87cadc4f5e510ceffca6c212870717d8599c5bc46b22aa0fca93148cf9f279ded10151cee47c7
TLSH
T153318DD72CCA4639888583BB8593138BC671B4144FC9BE7199B5C30F21E910C7796379
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1544-59-0x0000000000DF0000-0x0000000001BF0000-memory.dmp

Download

memory/1544-94-0x0000000000DF0000-0x0000000001BF0000-memory.dmp

Download

memory/1544-110-0x0000000000DF0000-0x0000000001BF0000-memory.dmp

Download

memory/1544-112-0x0000000000DF0000-0x0000000001BF0000-memory.dmp

Download

memory/1544-114-0x0000000000DF0000-0x0000000001BF0000-memory.dmp

Download

memory/1544-116-0x0000000000DF0000-0x0000000001BF0000-memory.dmp

Download

memory/1544-108-0x0000000000DF0000-0x0000000001BF0000-memory.dmp

Download

memory/1544-106-0x0000000000DF0000-0x0000000001BF0000-memory.dmp

Download

memory/1544-104-0x0000000000DF0000-0x0000000001BF0000-memory.dmp

Download

memory/1544-102-0x0000000000DF0000-0x0000000001BF0000-memory.dmp

Download

memory/1544-80-0x0000000000DF0000-0x0000000001BF0000-memory.dmp

Download

memory/1544-100-0x0000000000DF0000-0x0000000001BF0000-memory.dmp

Download

memory/1544-98-0x0000000000DF0000-0x0000000001BF0000-memory.dmp

Download

memory/1544-96-0x0000000000DF0000-0x0000000001BF0000-memory.dmp

Download

memory/1544-63-0x0000000000DF0000-0x0000000001BF0000-memory.dmp

Download

memory/1544-17-0x0000000000DF0000-0x0000000001BF0000-memory.dmp

Download

memory/1544-66-0x0000000000DF0000-0x0000000001BF0000-memory.dmp

Download

memory/1544-92-0x0000000000DF0000-0x0000000001BF0000-memory.dmp

Download

memory/1544-68-0x0000000000DF0000-0x0000000001BF0000-memory.dmp

Download

memory/1544-90-0x0000000000DF0000-0x0000000001BF0000-memory.dmp

Download

memory/1544-70-0x0000000000DF0000-0x0000000001BF0000-memory.dmp

Download

memory/1544-88-0x0000000000DF0000-0x0000000001BF0000-memory.dmp

Download

memory/1544-72-0x0000000000DF0000-0x0000000001BF0000-memory.dmp

Download

memory/1544-86-0x0000000000DF0000-0x0000000001BF0000-memory.dmp

Download

memory/1544-74-0x0000000000DF0000-0x0000000001BF0000-memory.dmp

Download

memory/1544-84-0x0000000000DF0000-0x0000000001BF0000-memory.dmp

Download

memory/1544-76-0x0000000000DF0000-0x0000000001BF0000-memory.dmp

Download

memory/1544-82-0x0000000000DF0000-0x0000000001BF0000-memory.dmp

Download

memory/1544-78-0x0000000000DF0000-0x0000000001BF0000-memory.dmp

Download

memory/1724-61-0x0000000000DF0000-0x0000000001BF0000-memory.dmp

Download

memory/1724-107-0x0000000000DF0000-0x0000000001BF0000-memory.dmp

Download

memory/1724-81-0x0000000000DF0000-0x0000000001BF0000-memory.dmp

Download

memory/1724-77-0x0000000000DF0000-0x0000000001BF0000-memory.dmp

Download

memory/1724-83-0x0000000000DF0000-0x0000000001BF0000-memory.dmp

Download

memory/1724-75-0x0000000000DF0000-0x0000000001BF0000-memory.dmp

Download

memory/1724-85-0x0000000000DF0000-0x0000000001BF0000-memory.dmp

Download

memory/1724-73-0x0000000000DF0000-0x0000000001BF0000-memory.dmp

Download

memory/1724-87-0x0000000000DF0000-0x0000000001BF0000-memory.dmp

Download

memory/1724-71-0x0000000000DF0000-0x0000000001BF0000-memory.dmp

Download

memory/1724-89-0x0000000000DF0000-0x0000000001BF0000-memory.dmp

Download

memory/1724-69-0x0000000000DF0000-0x0000000001BF0000-memory.dmp

Download

memory/1724-91-0x0000000000DF0000-0x0000000001BF0000-memory.dmp

Download

memory/1724-67-0x0000000000DF0000-0x0000000001BF0000-memory.dmp

Download

memory/1724-93-0x0000000000DF0000-0x0000000001BF0000-memory.dmp

Download

memory/1724-64-0x0000000000DF0000-0x0000000001BF0000-memory.dmp

Download

memory/1724-95-0x0000000000DF0000-0x0000000001BF0000-memory.dmp

Download

memory/1724-117-0x0000000000DF0000-0x0000000001BF0000-memory.dmp

Download

memory/1724-97-0x0000000000DF0000-0x0000000001BF0000-memory.dmp

Download

memory/1724-8-0x0000000000DF0000-0x0000000001BF0000-memory.dmp

Download

memory/1724-99-0x0000000000DF0000-0x0000000001BF0000-memory.dmp

Download

memory/1724-115-0x0000000000DF0000-0x0000000001BF0000-memory.dmp

Download

memory/1724-101-0x0000000000DF0000-0x0000000001BF0000-memory.dmp

Download

memory/1724-113-0x0000000000DF0000-0x0000000001BF0000-memory.dmp

Download

memory/1724-103-0x0000000000DF0000-0x0000000001BF0000-memory.dmp

Download

memory/1724-111-0x0000000000DF0000-0x0000000001BF0000-memory.dmp

Download

memory/1724-105-0x0000000000DF0000-0x0000000001BF0000-memory.dmp

Download

memory/1724-56-0x0000000000DF0000-0x0000000001BF0000-memory.dmp

Download

memory/1724-79-0x0000000000DF0000-0x0000000001BF0000-memory.dmp

Download

memory/1724-54-0x0000000000DF0000-0x0000000001BF0000-memory.dmp

Download

memory/1724-109-0x0000000000DF0000-0x0000000001BF0000-memory.dmp

Download

memory/1928-57-0x0000000000DF0000-0x0000000001BF0000-memory.dmp

Download

memory/1928-12-0x0000000000DF0000-0x0000000001BF0000-memory.dmp

Download

memory/1928-55-0x0000000000DF0000-0x0000000001BF0000-memory.dmp

Download

memory/1928-60-0x0000000000DF0000-0x0000000001BF0000-memory.dmp

Download

memory/1928-62-0x0000000000DF0000-0x0000000001BF0000-memory.dmp

Download

memory/2124-11-0x00000000002F0000-0x00000000010F0000-memory.dmp

Download

memory/2124-0-0x00000000002F0000-0x00000000010F0000-memory.dmp

Download

memory/2348-24-0x000001ABEA8C0000-0x000001ABEA8E2000-memory.dmp

Download