Overview

overview

10

Static

static

5

1.0.3POFU0...32.exe

windows10-2004-x64

10

1.0.3POFU0...32.exe

windows11-ltsc_2024-x64

10

1.0.3POFU0...64.exe

windows10-2004-x64

10

1.0.3POFU0...64.exe

windows11-ltsc_2024-x64

10

Analysis

  • max time kernel
    89s
  • max time network
    144s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    29/09/2026, 05:37

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    1.0.3POFU0/Pofu_Win32.exe
  • Size 4.6MB
  • Sample260929-gbfa9afb44
  • SHA256 2c45ed3b060d12ad74cab8bfa051b0910e899623f78aadb9207c782f87c24bdf
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
defense_evasiondiscoveryexecutionsnakekeyloggerkeyloggerpersistenceprivilege_escalationstealerupx

Malware Config

Signatures

  • Family: Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger
  • Snake Keylogger payload 12 IoCs
  • Modifies Windows Firewall 2 TTPs 1 IoCs
    defense_evasion
  • Executes a file named after a Windows system binary 1 TTPs 13 IoCs

    The file runs from a user directory while carrying the name of an executable that normally only exists in System32.

    defense_evasion
  • Enumerates connected drives 3 TTPs 4 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Maps connected drives based on registry 3 TTPs 2 IoCs

    Disk information is often read in order to detect sandboxing environments.

  • Network Service Discovery 1 TTPs 2 IoCs

    Attempt to gather information on host's network.

    discovery
  • Network Share Discovery 1 TTPs

    Attempt to gather information on host network.

    discovery
  • Discovers running processes 1 TTPs 1 IoCs

    Running process information can be used to identify security tools or plan follow-on actions.

    discovery
  • UPX packed file 13 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Launches sc.exe 3 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

    Using powershell.exe command.

    execution
  • Event Triggered Execution: Netsh Helper DLL 1 TTPs 6 IoCs

    Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

    persistenceprivilege_escalation
  • Executes a command shell one-liner 1 TTPs 49 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Permission Groups Discovery: Local Groups 1 TTPs

    Attempt to find local system groups and permission settings.

    discovery
  • Reads the TCP/IP host and domain name from the registry 1 TTPs 10 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Network Connections Discovery 1 TTPs 4 IoCs

    Attempt to get a listing of network connections.

    discovery
  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Gathers network information 2 TTPs 6 IoCs

    Uses commandline utility to view network configuration.

  • Gathers system information 1 TTPs 1 IoCs

    Runs systeminfo.exe.

  • Modifies registry key 1 TTPs 10 IoCs
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\1.0.3POFU0\Pofu_Win32.exe
    "C:\Users\Admin\AppData\Local\Temp\1.0.3POFU0\Pofu_Win32.exe"
    1⤵
    • Executes a file named after a Windows system binary
    • Enumerates connected drives
    • Maps connected drives based on registry
    • Reads the TCP/IP host and domain name from the registry
    • System Location Discovery: System Language Discovery
    • Checks processor information in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:5124
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c "netsh interface ip show dns"
      2⤵
      • Executes a command shell one-liner
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:5516
      • C:\Windows\SysWOW64\netsh.exe
        netsh interface ip show dns
        3⤵
        • Event Triggered Execution: Netsh Helper DLL
        • System Location Discovery: System Language Discovery
        PID:3360
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c wmic process get ProcessId,ParentProcessId /format:csv
      2⤵
      • Executes a command shell one-liner
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2552
      • C:\Windows\SysWOW64\Wbem\WMIC.exe
        wmic process get ProcessId,ParentProcessId /format:csv
        3⤵
        • Reads the TCP/IP host and domain name from the registry
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4664
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c "netstat -ano"
      2⤵
      • Executes a command shell one-liner
      • System Network Connections Discovery
      • Suspicious use of WriteProcessMemory
      PID:4784
      • C:\Windows\SysWOW64\NETSTAT.EXE
        netstat -ano
        3⤵
        • System Location Discovery: System Language Discovery
        • System Network Connections Discovery
        • Gathers network information
        • Suspicious use of AdjustPrivilegeToken
        PID:2756
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c systeminfo
      2⤵
      • Executes a command shell one-liner
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:1336
      • C:\Windows\SysWOW64\systeminfo.exe
        systeminfo
        3⤵
        • System Location Discovery: System Language Discovery
        • Gathers system information
        PID:4348
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c hostname
      2⤵
      • Executes a command shell one-liner
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:1916
      • C:\Windows\SysWOW64\HOSTNAME.EXE
        hostname
        3⤵
          PID:4884
      • C:\Windows\SysWOW64\cmd.exe
        cmd /c whoami
        2⤵
        • Executes a command shell one-liner
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:3316
        • C:\Windows\SysWOW64\whoami.exe
          whoami
          3⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          PID:4100
      • C:\Windows\SysWOW64\cmd.exe
        cmd /c "whoami /all"
        2⤵
        • Executes a command shell one-liner
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2672
        • C:\Windows\SysWOW64\whoami.exe
          whoami /all
          3⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:4596
      • C:\Windows\SysWOW64\cmd.exe
        cmd /c "query user"
        2⤵
        • Executes a command shell one-liner
        • System Location Discovery: System Language Discovery
        PID:432
      • C:\Windows\SysWOW64\cmd.exe
        cmd /c "netstat -ano"
        2⤵
        • Executes a command shell one-liner
        • System Location Discovery: System Language Discovery
        • System Network Connections Discovery
        • Suspicious use of WriteProcessMemory
        PID:4508
        • C:\Windows\SysWOW64\NETSTAT.EXE
          netstat -ano
          3⤵
          • System Network Connections Discovery
          • Gathers network information
          PID:2944
      • C:\Windows\SysWOW64\cmd.exe
        cmd /c "netstat -r"
        2⤵
        • Executes a command shell one-liner
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2376
        • C:\Windows\SysWOW64\NETSTAT.EXE
          netstat -r
          3⤵
          • System Location Discovery: System Language Discovery
          • Gathers network information
          • Suspicious use of WriteProcessMemory
          PID:876
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\system32\cmd.exe /c "C:\Windows\system32\route.exe" print
            4⤵
            • Executes a command shell one-liner
            • Suspicious use of WriteProcessMemory
            PID:1580
            • C:\Windows\SysWOW64\ROUTE.EXE
              C:\Windows\system32\route.exe print
              5⤵
              • System Location Discovery: System Language Discovery
              PID:5680
      • C:\Windows\SysWOW64\cmd.exe
        cmd /c ipconfig
        2⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:2108
        • C:\Windows\SysWOW64\ipconfig.exe
          ipconfig
          3⤵
          • System Location Discovery: System Language Discovery
          • Gathers network information
          PID:2968
      • C:\Windows\SysWOW64\cmd.exe
        cmd /c "ipconfig /all"
        2⤵
        • Executes a command shell one-liner
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:1236
        • C:\Windows\SysWOW64\ipconfig.exe
          ipconfig /all
          3⤵
          • Gathers network information
          PID:5672
      • C:\Windows\SysWOW64\cmd.exe
        cmd /c "ipconfig /displaydns"
        2⤵
        • Executes a command shell one-liner
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:3232
        • C:\Windows\SysWOW64\ipconfig.exe
          ipconfig /displaydns
          3⤵
          • Gathers network information
          PID:6036
      • C:\Windows\SysWOW64\cmd.exe
        cmd /c "arp -a"
        2⤵
        • Network Service Discovery
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:1932
        • C:\Windows\SysWOW64\ARP.EXE
          arp -a
          3⤵
          • Network Service Discovery
          PID:4900
      • C:\Windows\SysWOW64\cmd.exe
        cmd /c "net share"
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:4440
        • C:\Windows\SysWOW64\net.exe
          net share
          3⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:4556
          • C:\Windows\SysWOW64\net1.exe
            C:\Windows\system32\net1 share
            4⤵
            • System Location Discovery: System Language Discovery
            PID:788
      • C:\Windows\SysWOW64\cmd.exe
        cmd /c "net user"
        2⤵
        • Executes a command shell one-liner
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:5824
        • C:\Windows\SysWOW64\net.exe
          net user
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:3480
          • C:\Windows\SysWOW64\net1.exe
            C:\Windows\system32\net1 user
            4⤵
              PID:3520
        • C:\Windows\SysWOW64\cmd.exe
          cmd /c "net localgroup"
          2⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:1420
          • C:\Windows\SysWOW64\net.exe
            net localgroup
            3⤵
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:3716
            • C:\Windows\SysWOW64\net1.exe
              C:\Windows\system32\net1 localgroup
              4⤵
              • System Location Discovery: System Language Discovery
              PID:3696
        • C:\Windows\SysWOW64\cmd.exe
          cmd /c "tasklist /V"
          2⤵
          • Executes a command shell one-liner
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:1044
          • C:\Windows\SysWOW64\tasklist.exe
            tasklist /V
            3⤵
            • Discovers running processes
            • System Location Discovery: System Language Discovery
            PID:5608
        • C:\Windows\SysWOW64\cmd.exe
          cmd /c "sc query type= service state= all"
          2⤵
          • Executes a command shell one-liner
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:5668
          • C:\Windows\SysWOW64\sc.exe
            sc query type= service state= all
            3⤵
            • Launches sc.exe
            • System Location Discovery: System Language Discovery
            PID:4548
        • C:\Windows\SysWOW64\cmd.exe
          cmd /c "schtasks /query /fo LIST /v"
          2⤵
          • Executes a command shell one-liner
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:2720
          • C:\Windows\SysWOW64\schtasks.exe
            schtasks /query /fo LIST /v
            3⤵
              PID:5592
          • C:\Windows\SysWOW64\cmd.exe
            cmd /c "wevtutil gl Security"
            2⤵
            • Executes a command shell one-liner
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:3248
            • C:\Windows\SysWOW64\wevtutil.exe
              wevtutil gl Security
              3⤵
              • System Location Discovery: System Language Discovery
              PID:3740
          • C:\Windows\SysWOW64\cmd.exe
            cmd /c "wmic qfe list brief /format:table"
            2⤵
            • Executes a command shell one-liner
            • Suspicious use of WriteProcessMemory
            PID:4116
            • C:\Windows\SysWOW64\Wbem\WMIC.exe
              wmic qfe list brief /format:table
              3⤵
              • Reads the TCP/IP host and domain name from the registry
              PID:5392
          • C:\Windows\SysWOW64\cmd.exe
            cmd /c "wmic startup get caption,command"
            2⤵
            • Executes a command shell one-liner
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:3392
            • C:\Windows\SysWOW64\Wbem\WMIC.exe
              wmic startup get caption,command
              3⤵
              • Reads the TCP/IP host and domain name from the registry
              • System Location Discovery: System Language Discovery
              PID:5084
          • C:\Windows\SysWOW64\cmd.exe
            cmd /c "set PATH"
            2⤵
            • Executes a command shell one-liner
            • System Location Discovery: System Language Discovery
            PID:5324
          • C:\Windows\SysWOW64\cmd.exe
            cmd /c "reg query HKLM\SECURITY\Policy\PolAdtEv"
            2⤵
            • Executes a command shell one-liner
            • Suspicious use of WriteProcessMemory
            PID:3964
            • C:\Windows\SysWOW64\reg.exe
              reg query HKLM\SECURITY\Policy\PolAdtEv
              3⤵
              • Modifies registry key
              PID:4424
          • C:\Windows\SysWOW64\cmd.exe
            cmd /c "wmic useraccount get caption,SID"
            2⤵
            • Executes a command shell one-liner
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:4744
            • C:\Windows\SysWOW64\Wbem\WMIC.exe
              wmic useraccount get caption,SID
              3⤵
              • Reads the TCP/IP host and domain name from the registry
              PID:3568
          • C:\Windows\SysWOW64\cmd.exe
            cmd /c "net user Guest"
            2⤵
            • Executes a command shell one-liner
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:4396
            • C:\Windows\SysWOW64\net.exe
              net user Guest
              3⤵
              • Suspicious use of WriteProcessMemory
              PID:4112
              • C:\Windows\SysWOW64\net1.exe
                C:\Windows\system32\net1 user Guest
                4⤵
                • System Location Discovery: System Language Discovery
                PID:1280
          • C:\Windows\SysWOW64\cmd.exe
            cmd /c "reg query HKLM\SAM\SAM\Domains\Account\Users"
            2⤵
            • Executes a command shell one-liner
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:5728
            • C:\Windows\SysWOW64\reg.exe
              reg query HKLM\SAM\SAM\Domains\Account\Users
              3⤵
              • Modifies registry key
              PID:1576
          • C:\Windows\SysWOW64\cmd.exe
            cmd /c "reg query HKLM\SAM\SAM\Domains\Account\Users\Names /s /ve /z"
            2⤵
            • Executes a command shell one-liner
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:4372
            • C:\Windows\SysWOW64\reg.exe
              reg query HKLM\SAM\SAM\Domains\Account\Users\Names /s /ve /z
              3⤵
              • System Location Discovery: System Language Discovery
              • Modifies registry key
              PID:4292
          • C:\Windows\SysWOW64\cmd.exe
            cmd /c "reg query HKLM\SAM\SAM\Domains\Account\Users /s /v F 2>nul"
            2⤵
            • Executes a command shell one-liner
            • Suspicious use of WriteProcessMemory
            PID:5204
            • C:\Windows\SysWOW64\reg.exe
              reg query HKLM\SAM\SAM\Domains\Account\Users /s /v F
              3⤵
              • Modifies registry key
              PID:3396
          • C:\Windows\SysWOW64\cmd.exe
            cmd /c "bitsadmin /list /allusers /verbose"
            2⤵
            • Executes a command shell one-liner
            • System Location Discovery: System Language Discovery
            PID:3528
            • C:\Windows\SysWOW64\bitsadmin.exe
              bitsadmin /list /allusers /verbose
              3⤵
              • System Location Discovery: System Language Discovery
              PID:3424
          • C:\Windows\SysWOW64\cmd.exe
            cmd /c "route print"
            2⤵
            • Executes a command shell one-liner
            PID:912
            • C:\Windows\SysWOW64\ROUTE.EXE
              route print
              3⤵
                PID:5532
            • C:\Windows\SysWOW64\cmd.exe
              cmd /c "driverquery /v"
              2⤵
              • Executes a command shell one-liner
              • System Location Discovery: System Language Discovery
              PID:5240
              • C:\Windows\SysWOW64\driverquery.exe
                driverquery /v
                3⤵
                • System Location Discovery: System Language Discovery
                PID:5936
            • C:\Windows\SysWOW64\cmd.exe
              cmd /c "netsh advfirewall show allprofiles"
              2⤵
              • Executes a command shell one-liner
              • System Location Discovery: System Language Discovery
              PID:888
              • C:\Windows\SysWOW64\netsh.exe
                netsh advfirewall show allprofiles
                3⤵
                • Modifies Windows Firewall
                • Event Triggered Execution: Netsh Helper DLL
                • System Location Discovery: System Language Discovery
                PID:1208
            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              powershell.exe -NoProfile -Command "Get-MpPreference | Select-Object ExclusionPath,ExclusionProcess,ExclusionExtension,ExclusionIpAddress | Format-List"
              2⤵
              • Enumerates connected drives
              • Command and Scripting Interpreter: PowerShell
              PID:2088
            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              powershell.exe -NoProfile -Command Get-DnsClientCache
              2⤵
              • Enumerates connected drives
              • Command and Scripting Interpreter: PowerShell
              • System Location Discovery: System Language Discovery
              PID:2816
            • C:\Windows\SysWOW64\cmd.exe
              cmd /c "reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 2>nul"
              2⤵
              • Executes a command shell one-liner
              • System Location Discovery: System Language Discovery
              PID:4464
              • C:\Windows\SysWOW64\reg.exe
                reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
                3⤵
                • Modifies registry key
                PID:2244
            • C:\Windows\SysWOW64\cmd.exe
              cmd /c "reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce 2>nul"
              2⤵
              • Executes a command shell one-liner
              • System Location Discovery: System Language Discovery
              PID:4100
              • C:\Windows\SysWOW64\reg.exe
                reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
                3⤵
                • Modifies registry key
                PID:6088
            • C:\Windows\SysWOW64\cmd.exe
              cmd /c "reg query HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 2>nul"
              2⤵
              • Executes a command shell one-liner
              • System Location Discovery: System Language Discovery
              PID:4596
              • C:\Windows\SysWOW64\reg.exe
                reg query HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
                3⤵
                • Modifies registry key
                PID:1704
            • C:\Windows\SysWOW64\cmd.exe
              cmd /c "reg query HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce 2>nul"
              2⤵
              • Executes a command shell one-liner
              PID:2016
              • C:\Windows\SysWOW64\reg.exe
                reg query HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
                3⤵
                • Modifies registry key
                PID:2568
            • C:\Windows\SysWOW64\cmd.exe
              cmd /c "reg query HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run 2>nul"
              2⤵
              • Executes a command shell one-liner
              • System Location Discovery: System Language Discovery
              PID:4240
              • C:\Windows\SysWOW64\reg.exe
                reg query HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run
                3⤵
                • Modifies registry key
                PID:3344
            • C:\Windows\SysWOW64\cmd.exe
              cmd /c "reg query HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce 2>nul"
              2⤵
              • Executes a command shell one-liner
              • System Location Discovery: System Language Discovery
              PID:1896
              • C:\Windows\SysWOW64\reg.exe
                reg query HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce
                3⤵
                • System Location Discovery: System Language Discovery
                • Modifies registry key
                PID:5680
            • C:\Windows\SysWOW64\cmd.exe
              cmd /c "sc query type= service state= all 2>nul"
              2⤵
              • Executes a command shell one-liner
              • System Location Discovery: System Language Discovery
              PID:1448
              • C:\Windows\SysWOW64\sc.exe
                sc query type= service state= all
                3⤵
                • Launches sc.exe
                • System Location Discovery: System Language Discovery
                PID:2968
            • C:\Windows\SysWOW64\cmd.exe
              cmd /c "sc query type= service state= all 2>nul | findstr /i \"SERVICE_NAME\""
              2⤵
              • Executes a command shell one-liner
              • System Location Discovery: System Language Discovery
              PID:2064
              • C:\Windows\SysWOW64\sc.exe
                sc query type= service state= all
                3⤵
                • Launches sc.exe
                • System Location Discovery: System Language Discovery
                PID:1360
              • C:\Windows\SysWOW64\findstr.exe
                findstr /i \"SERVICE_NAME\"
                3⤵
                • System Location Discovery: System Language Discovery
                PID:6040
            • C:\Windows\SysWOW64\cmd.exe
              cmd /c "cmd /c \"dir /r C:\Windows\* 2>nul\""
              2⤵
              • Executes a command shell one-liner
              • System Location Discovery: System Language Discovery
              PID:4412
              • C:\Windows\SysWOW64\cmd.exe
                cmd /c \"dir /r C:\Windows\* 2>nul\"
                3⤵
                • Executes a command shell one-liner
                PID:1132
            • C:\Windows\SysWOW64\cmd.exe
              cmd /c "cmd /c \"dir /r C:\Windows\* 2>nul\""
              2⤵
              • Executes a command shell one-liner
              • System Location Discovery: System Language Discovery
              PID:3044
              • C:\Windows\SysWOW64\cmd.exe
                cmd /c \"dir /r C:\Windows\* 2>nul\"
                3⤵
                • Executes a command shell one-liner
                PID:3412
            • C:\Windows\SysWOW64\cmd.exe
              cmd /c "cmd /c \"dir /r C:\Users\Admin\AppData\Local\Temp\* 2>nul\""
              2⤵
              • Executes a command shell one-liner
              • System Location Discovery: System Language Discovery
              PID:3824
              • C:\Windows\SysWOW64\cmd.exe
                cmd /c \"dir /r C:\Users\Admin\AppData\Local\Temp\* 2>nul\"
                3⤵
                • Executes a command shell one-liner
                PID:2792
            • C:\Windows\SysWOW64\cmd.exe
              cmd /c "cmd /c \"dir /r C:\Users\Admin\AppData\Roaming\* 2>nul\""
              2⤵
              • Executes a command shell one-liner
              PID:4160
              • C:\Windows\SysWOW64\cmd.exe
                cmd /c \"dir /r C:\Users\Admin\AppData\Roaming\* 2>nul\"
                3⤵
                • Executes a command shell one-liner
                • System Location Discovery: System Language Discovery
                PID:2548

          Network

                MITRE ATT&CK Enterprise v16

                Reconnaissance

                Resource Development

                Initial Access

                Execution

                Command and Scripting Interpreter

                3
                T1059

                PowerShell

                1
                T1059.001

                Windows Command Shell

                1
                T1059.003

                Persistence

                Create or Modify System Process

                1
                T1543

                Windows Service

                1
                T1543.003

                Event Triggered Execution

                1
                T1546

                Netsh Helper DLL

                1
                T1546.007

                Privilege Escalation

                Create or Modify System Process

                1
                T1543

                Windows Service

                1
                T1543.003

                Event Triggered Execution

                1
                T1546

                Netsh Helper DLL

                1
                T1546.007

                Defense Evasion

                Impair Defenses

                1
                T1562

                Disable or Modify System Firewall

                1
                T1562.004

                Masquerading

                1
                T1036

                Match Legitimate Name or Location

                1
                T1036.005

                Modify Registry

                1
                T1112

                Credential Access

                Discovery

                Network Service Discovery

                1
                T1046

                Network Share Discovery

                1
                T1135

                Peripheral Device Discovery

                2
                T1120

                Permission Groups Discovery

                1
                T1069

                Local Groups

                1
                T1069.001

                Process Discovery

                1
                T1057

                Query Registry

                3
                T1012

                System Information Discovery

                5
                T1082

                System Location Discovery

                1
                T1614

                System Language Discovery

                1
                T1614.001

                System Network Configuration Discovery

                1
                T1016

                System Network Connections Discovery

                1
                T1049

                Lateral Movement

                Collection

                Command and Control

                Exfiltration

                Impact

                Replay Monitor

                Loading Replay Monitor...

                Downloads

                StartupProfileData-NonInteractive
                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                • Size 20KB
                • SHA256 cd3cc43de7059d1b781df717935d8033592a6ff001195214aaf16bb39e1ac176
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                __PSScriptPolicyTest_3tql5cup.qra.ps1
                • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_3tql5cup.qra.ps1
                • Size 60B
                • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                memory/2088-13-0x0000000005190000-0x00000000051B2000-memory.dmp
                Download

                memory/2088-28-0x00000000072E0000-0x00000000072FA000-memory.dmp
                Download

                memory/2088-30-0x0000000007550000-0x00000000075E6000-memory.dmp
                Download

                memory/2088-27-0x0000000007920000-0x0000000007F9C000-memory.dmp
                Download

                memory/2088-11-0x0000000002A80000-0x0000000002AB6000-memory.dmp
                Download

                memory/2088-12-0x00000000053E0000-0x0000000005A2A000-memory.dmp
                Download

                memory/2088-29-0x0000000007350000-0x000000000735A000-memory.dmp
                Download

                memory/2088-14-0x00000000052B0000-0x0000000005316000-memory.dmp
                Download

                memory/2088-15-0x0000000005A30000-0x0000000005A96000-memory.dmp
                Download

                memory/2088-18-0x0000000005C50000-0x0000000005FAB000-memory.dmp
                Download

                memory/2088-19-0x0000000005BE0000-0x0000000005BFE000-memory.dmp
                Download

                memory/2088-20-0x0000000005FB0000-0x0000000005FFC000-memory.dmp
                Download

                memory/2088-21-0x0000000006F60000-0x0000000006F96000-memory.dmp
                Download

                memory/2088-25-0x0000000006F40000-0x0000000006F60000-memory.dmp
                Download

                memory/2088-22-0x0000000070A60000-0x0000000070AAC000-memory.dmp
                Download

                memory/2088-26-0x00000000071A0000-0x0000000007243000-memory.dmp
                Download

                memory/2816-40-0x0000000007630000-0x000000000764A000-memory.dmp
                Download

                memory/2816-34-0x00000000059B0000-0x0000000005D0B000-memory.dmp
                Download

                memory/2816-36-0x0000000070A60000-0x0000000070AAC000-memory.dmp
                Download

                memory/2816-39-0x0000000007560000-0x0000000007570000-memory.dmp
                Download

                memory/5124-4-0x0000000000C60000-0x000000000249B000-memory.dmp
                Download

                memory/5124-41-0x0000000000C60000-0x000000000249B000-memory.dmp
                Download

                memory/5124-3-0x0000000000C60000-0x000000000249B000-memory.dmp
                Download

                memory/5124-5-0x0000000000C60000-0x000000000249B000-memory.dmp
                Download

                memory/5124-0-0x0000000000C60000-0x000000000249B000-memory.dmp
                Download

                memory/5124-8-0x0000000000C60000-0x000000000249B000-memory.dmp
                Download

                memory/5124-10-0x0000000000C60000-0x000000000249B000-memory.dmp
                Download

                memory/5124-43-0x0000000000C60000-0x000000000249B000-memory.dmp
                Download

                memory/5124-44-0x0000000000C60000-0x000000000249B000-memory.dmp
                Download

                memory/5124-45-0x0000000000C60000-0x000000000249B000-memory.dmp
                Download

                memory/5124-46-0x0000000000C60000-0x000000000249B000-memory.dmp
                Download

                memory/5124-47-0x0000000000C60000-0x000000000249B000-memory.dmp
                Download

                memory/5124-48-0x0000000000C60000-0x000000000249B000-memory.dmp
                Download