ad9879857a02474a6b392a87376b8e8432068f26677416a92057581cf052c89e

Analysis

max time kernel
148s
max time network
128s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/09/2026, 02:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
KMSServersManager.cmd
Size 13KB
Sample260930-clq4aat19j
SHA256 ad9879857a02474a6b392a87376b8e8432068f26677416a92057581cf052c89e
MD5 fbdfc905c71a57f06c2b97b17d943229
SHA1 6de22867edc18beecc70b484ac7caae26f547da3
SHA512 65368e30a05525507f0bd602db1185d68a3c9df7ca7c73dae8fa626d5eb9d3767c7e1c92410c8c75cb24e8d80aa2b548fce828f7e5513e2288dbb14ee4979648
SSDEEP 192:wyxVcF3JBkW3bOZnZ8FYPJSDlXrCse77J4mFwQClajohL41hin40Cgi/U0+cNX/8:3IOZRxdYqWWin45/UMXnYoqoAz
TLSH
T1025295442C4982A710B8F3B26E0154477BDF41FF2A76CBE832915499B7DE62583BE3E1
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

discovery execution

Malware Config

Signatures

Executes a VBScript file via the Windows Script Host. 1 TTPs 4 IoCs

execution

Visual Basic

T1059.005

pid	Process
476	cscript.exe
3368	cscript.exe
940	cscript.exe
5400	cscript.exe

Executes a command shell one-liner 1 TTPs 9 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5688	cmd.exe
4056	cmd.exe
3000	cmd.exe
1728	cmd.exe
5360	cmd.exe
3688	cmd.exe
708	cmd.exe
1132	cmd.exe
1252	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 16 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	cscript.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	cscript.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	cscript.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	cscript.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	cscript.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	cscript.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	cscript.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	cscript.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WMIC.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sed.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vlmcs.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
5708	PING.EXE

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
5708	PING.EXE

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
4240	WMIC.exe
4240	WMIC.exe
4240	WMIC.exe
4240	WMIC.exe
2380	WMIC.exe
2380	WMIC.exe
2380	WMIC.exe
2380	WMIC.exe
888	WMIC.exe
888	WMIC.exe
888	WMIC.exe
888	WMIC.exe
3764	WMIC.exe
3764	WMIC.exe
3764	WMIC.exe
3764	WMIC.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	4240	WMIC.exe
Token: SeSecurityPrivilege	4240	WMIC.exe
Token: SeTakeOwnershipPrivilege	4240	WMIC.exe
Token: SeLoadDriverPrivilege	4240	WMIC.exe
Token: SeSystemProfilePrivilege	4240	WMIC.exe
Token: SeSystemtimePrivilege	4240	WMIC.exe
Token: SeProfSingleProcessPrivilege	4240	WMIC.exe
Token: SeIncBasePriorityPrivilege	4240	WMIC.exe
Token: SeCreatePagefilePrivilege	4240	WMIC.exe
Token: SeBackupPrivilege	4240	WMIC.exe
Token: SeRestorePrivilege	4240	WMIC.exe
Token: SeShutdownPrivilege	4240	WMIC.exe
Token: SeDebugPrivilege	4240	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4240	WMIC.exe
Token: SeRemoteShutdownPrivilege	4240	WMIC.exe
Token: SeUndockPrivilege	4240	WMIC.exe
Token: SeManageVolumePrivilege	4240	WMIC.exe
Token: 33	4240	WMIC.exe
Token: 34	4240	WMIC.exe
Token: 35	4240	WMIC.exe
Token: 36	4240	WMIC.exe
Token: SeIncreaseQuotaPrivilege	4240	WMIC.exe
Token: SeSecurityPrivilege	4240	WMIC.exe
Token: SeTakeOwnershipPrivilege	4240	WMIC.exe
Token: SeLoadDriverPrivilege	4240	WMIC.exe
Token: SeSystemProfilePrivilege	4240	WMIC.exe
Token: SeSystemtimePrivilege	4240	WMIC.exe
Token: SeProfSingleProcessPrivilege	4240	WMIC.exe
Token: SeIncBasePriorityPrivilege	4240	WMIC.exe
Token: SeCreatePagefilePrivilege	4240	WMIC.exe
Token: SeBackupPrivilege	4240	WMIC.exe
Token: SeRestorePrivilege	4240	WMIC.exe
Token: SeShutdownPrivilege	4240	WMIC.exe
Token: SeDebugPrivilege	4240	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4240	WMIC.exe
Token: SeRemoteShutdownPrivilege	4240	WMIC.exe
Token: SeUndockPrivilege	4240	WMIC.exe
Token: SeManageVolumePrivilege	4240	WMIC.exe
Token: 33	4240	WMIC.exe
Token: 34	4240	WMIC.exe
Token: 35	4240	WMIC.exe
Token: 36	4240	WMIC.exe
Token: SeRestorePrivilege	4472	vlmcs.exe
Token: SeBackupPrivilege	4472	vlmcs.exe
Token: SeDebugPrivilege	4472	vlmcs.exe
Token: SeRestorePrivilege	936	vlmcs.exe
Token: SeBackupPrivilege	936	vlmcs.exe
Token: SeDebugPrivilege	936	vlmcs.exe
Token: SeIncreaseQuotaPrivilege	2380	WMIC.exe
Token: SeSecurityPrivilege	2380	WMIC.exe
Token: SeTakeOwnershipPrivilege	2380	WMIC.exe
Token: SeLoadDriverPrivilege	2380	WMIC.exe
Token: SeSystemProfilePrivilege	2380	WMIC.exe
Token: SeSystemtimePrivilege	2380	WMIC.exe
Token: SeProfSingleProcessPrivilege	2380	WMIC.exe
Token: SeIncBasePriorityPrivilege	2380	WMIC.exe
Token: SeCreatePagefilePrivilege	2380	WMIC.exe
Token: SeBackupPrivilege	2380	WMIC.exe
Token: SeRestorePrivilege	2380	WMIC.exe
Token: SeShutdownPrivilege	2380	WMIC.exe
Token: SeDebugPrivilege	2380	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2380	WMIC.exe
Token: SeRemoteShutdownPrivilege	2380	WMIC.exe
Token: SeUndockPrivilege	2380	WMIC.exe

Suspicious use of WriteProcessMemory 39 IoCs

description	pid	Process	procid_target
PID 1132 wrote to memory of 1372	1132	cmd.exe	88
PID 1132 wrote to memory of 3000	1132	cmd.exe	90
PID 1132 wrote to memory of 1252	1132	cmd.exe	91
PID 1132 wrote to memory of 5688	1132	cmd.exe	92
PID 1132 wrote to memory of 1728	1132	cmd.exe	93
PID 1728 wrote to memory of 4240	1728	cmd.exe	94
PID 1132 wrote to memory of 1300	1132	cmd.exe	96
PID 1132 wrote to memory of 5708	1132	cmd.exe	97
PID 1132 wrote to memory of 4608	1132	cmd.exe	98
PID 1132 wrote to memory of 4548	1132	cmd.exe	99
PID 1132 wrote to memory of 4472	1132	cmd.exe	100
PID 1132 wrote to memory of 936	1132	cmd.exe	101
PID 1132 wrote to memory of 5936	1132	cmd.exe	102
PID 1132 wrote to memory of 4144	1132	cmd.exe	103
PID 1132 wrote to memory of 4196	1132	cmd.exe	104
PID 1132 wrote to memory of 4388	1132	cmd.exe	105
PID 1132 wrote to memory of 2760	1132	cmd.exe	106
PID 1132 wrote to memory of 3716	1132	cmd.exe	107
PID 1132 wrote to memory of 2512	1132	cmd.exe	108
PID 1132 wrote to memory of 1292	1132	cmd.exe	109
PID 1132 wrote to memory of 4908	1132	cmd.exe	110
PID 1132 wrote to memory of 4976	1132	cmd.exe	111
PID 1132 wrote to memory of 5360	1132	cmd.exe	112
PID 5360 wrote to memory of 2380	5360	cmd.exe	113
PID 1132 wrote to memory of 476	1132	cmd.exe	114
PID 1132 wrote to memory of 3364	1132	cmd.exe	115
PID 1132 wrote to memory of 3368	1132	cmd.exe	117
PID 1132 wrote to memory of 820	1132	cmd.exe	118
PID 1132 wrote to memory of 1456	1132	cmd.exe	119
PID 1132 wrote to memory of 3688	1132	cmd.exe	120
PID 3688 wrote to memory of 888	3688	cmd.exe	121
PID 1132 wrote to memory of 940	1132	cmd.exe	122
PID 1132 wrote to memory of 3256	1132	cmd.exe	123
PID 1132 wrote to memory of 5400	1132	cmd.exe	124
PID 1132 wrote to memory of 1892	1132	cmd.exe	125
PID 1132 wrote to memory of 3652	1132	cmd.exe	126
PID 1132 wrote to memory of 708	1132	cmd.exe	127
PID 708 wrote to memory of 3764	708	cmd.exe	128
PID 1132 wrote to memory of 4056	1132	cmd.exe	130

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\KMSServersManager.cmd"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1132
- C:\Windows\system32\chcp.com
  chcp 65001
  2⤵
  PID:1372
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ver
  2⤵
  - Executes a command shell one-liner
  PID:3000
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c dir /b /s /a-d "C:\Program Files\Microsoft Office\ospp.vbs" 2>nul
  2⤵
  - Executes a command shell one-liner
  PID:1252
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ver
  2⤵
  - Executes a command shell one-liner
  PID:5688
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c "wmic.exe Path Win32_OperatingSystem Get Caption /Value" 2>nul
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1728
- - C:\Windows\system32\Wbem\WMIC.exe
    wmic.exe Path Win32_OperatingSystem Get Caption /Value
    3⤵
    - Reads the TCP/IP host and domain name from the registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4240
- C:\Windows\system32\reg.exe
  "C:\Windows\system32\reg.exe" query "HKU\S-1-5-19"
  2⤵
  PID:1300
- C:\Windows\system32\PING.EXE
  "C:\Windows\system32\ping.exe" -n 1 google.com
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:5708
- C:\Windows\system32\reg.exe
  "C:\Windows\system32\reg.exe" add "HKCU\Software\Microsoft\Windows Script Host\Settings" /v "Enabled" /t REG_DWORD /d "1" /f
  2⤵
  PID:4608
- C:\Windows\system32\reg.exe
  "C:\Windows\system32\reg.exe" add "HKLM\Software\Microsoft\Windows Script Host\Settings" /v "Enabled" /t REG_DWORD /d "1" /f
  2⤵
  PID:4548
- C:\Users\Admin\AppData\Local\Temp\vlmcs.exe
  "C:\Users\Admin\AppData\Local\Temp\vlmcs.exe" -l 1 -p 192.168.100.2
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4472
- C:\Users\Admin\AppData\Local\Temp\vlmcs.exe
  "C:\Users\Admin\AppData\Local\Temp\vlmcs.exe" -l 1 -p vlm.freemyip.com:43615
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:936
- C:\Windows\system32\reg.exe
  "C:\Windows\system32\reg.exe" delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform\55C92734-D682-4D71-983E-D6EC3F16059F" /f
  2⤵
  PID:5936
- C:\Windows\system32\reg.exe
  "C:\Windows\system32\reg.exe" delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform\0FF1CE15-A989-479D-AF46-F275C6370663" /f
  2⤵
  PID:4144
- C:\Windows\system32\reg.exe
  "C:\Windows\system32\reg.exe" add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform" /f /v "KeyManagementServiceName" /d "vlm.freemyip.com" /t "REG_SZ"
  2⤵
  PID:4196
- C:\Windows\system32\reg.exe
  "C:\Windows\system32\reg.exe" add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform" /f /v "KeyManagementServicePort" /d "43615" /t "REG_SZ"
  2⤵
  PID:4388
- C:\Windows\system32\reg.exe
  "C:\Windows\system32\reg.exe" add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform" /f /v "UserOperations" /d "1" /t "REG_DWORD"
  2⤵
  PID:2760
- C:\Windows\system32\reg.exe
  "C:\Windows\system32\reg.exe" delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform\55C92734-D682-4D71-983E-D6EC3F16059F" /f /reg:32
  2⤵
  PID:3716
- C:\Windows\system32\reg.exe
  "C:\Windows\system32\reg.exe" delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform\0FF1CE15-A989-479D-AF46-F275C6370663" /f /reg:32
  2⤵
  PID:2512
- C:\Windows\system32\reg.exe
  "C:\Windows\system32\reg.exe" add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform" /f /v "KeyManagementServiceName" /d "vlm.freemyip.com" /t "REG_SZ" /reg:32
  2⤵
  PID:1292
- C:\Windows\system32\reg.exe
  "C:\Windows\system32\reg.exe" add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform" /f /v "KeyManagementServicePort" /d "43615" /t "REG_SZ" /reg:32
  2⤵
  PID:4908
- C:\Windows\system32\reg.exe
  "C:\Windows\system32\reg.exe" add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform" /f /v "UserOperations" /d "1" /t "REG_DWORD" /reg:32
  2⤵
  PID:4976
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c "C:\Windows\system32\wbem\wmic.exe path SoftwareLicensingProduct where (Name LIKE 'Windows%' and PartialProductKey IS NOT NULL) get Description,GracePeriodRemaining,ID,LicenseFamily,LicenseStatus,Name,PartialProductKey /VALUE" 2>nul
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5360
- - C:\Windows\system32\wbem\WMIC.exe
    C:\Windows\system32\wbem\wmic.exe path SoftwareLicensingProduct where (Name LIKE 'Windows%' and PartialProductKey IS NOT NULL) get Description,GracePeriodRemaining,ID,LicenseFamily,LicenseStatus,Name,PartialProductKey /VALUE
    3⤵
    - Reads the TCP/IP host and domain name from the registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2380
- C:\Windows\system32\cscript.exe
  "C:\Windows\system32\cscript.exe" //NOLOGO "C:\Users\Admin\AppData\Local\Temp\slmgr.vbs" /dlv 6c4de1b8-24bb-4c17-9a77-7b939414c298
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  - Reads the TCP/IP host and domain name from the registry
  PID:476
- C:\Users\Admin\AppData\Local\Temp\sed.exe
  "C:\Users\Admin\AppData\Local\Temp\sed.exe" "s/Windows(R) Operating System, /Windows(R), /; s/Windows Operating System - Windows(R) 7, /Windows(R) 7, /; /Activation ID:/d; /Installation ID:/d; /Application ID:/d; /time:/d; /count:/d; /URL:/d; /PID:/d; /(CMID):/d; /version:/d; /client information/d; /activation information:/d; /^$/d; s/^/ /"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3364
- C:\Windows\system32\cscript.exe
  "C:\Windows\system32\cscript.exe" //NOLOGO "C:\Users\Admin\AppData\Local\Temp\slmgr.vbs" /xpr 6c4de1b8-24bb-4c17-9a77-7b939414c298
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  - Reads the TCP/IP host and domain name from the registry
  PID:3368
- C:\Users\Admin\AppData\Local\Temp\sed.exe
  "C:\Users\Admin\AppData\Local\Temp\sed.exe" "/^$/d; s/^/ /"
  2⤵
  PID:820
- C:\Users\Admin\AppData\Local\Temp\sed.exe
  "C:\Users\Admin\AppData\Local\Temp\sed.exe" "1d"
  2⤵
  PID:1456
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c "C:\Windows\system32\wbem\wmic.exe path SoftwareLicensingProduct where (Name LIKE 'Office%' and PartialProductKey IS NOT NULL) get ID /VALUE" 2>nul
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3688
- - C:\Windows\system32\wbem\WMIC.exe
    C:\Windows\system32\wbem\wmic.exe path SoftwareLicensingProduct where (Name LIKE 'Office%' and PartialProductKey IS NOT NULL) get ID /VALUE
    3⤵
    - Reads the TCP/IP host and domain name from the registry
    - Suspicious behavior: EnumeratesProcesses
    PID:888
- C:\Windows\system32\cscript.exe
  "C:\Windows\system32\cscript.exe" //NOLOGO "C:\Users\Admin\AppData\Local\Temp\slmgr.vbs" /dlv 85dd8b5f-eaa4-4af3-a628-cce9e77c9a03
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  - Reads the TCP/IP host and domain name from the registry
  PID:940
- C:\Users\Admin\AppData\Local\Temp\sed.exe
  "C:\Users\Admin\AppData\Local\Temp\sed.exe" "/Activation ID:/d; /Installation ID:/d; /Application ID:/d; /time:/d; /count:/d; /URL:/d; /PID:/d; /(CMID):/d; /version:/d; /client information/d; /activation information:/d; /^$/d; s/^/ /"
  2⤵
  PID:3256
- C:\Windows\system32\cscript.exe
  "C:\Windows\system32\cscript.exe" //NOLOGO "C:\Users\Admin\AppData\Local\Temp\slmgr.vbs" /xpr 85dd8b5f-eaa4-4af3-a628-cce9e77c9a03
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  - Reads the TCP/IP host and domain name from the registry
  PID:5400
- C:\Users\Admin\AppData\Local\Temp\sed.exe
  "C:\Users\Admin\AppData\Local\Temp\sed.exe" "/^$/d; s/^/ /"
  2⤵
  PID:1892
- C:\Users\Admin\AppData\Local\Temp\sed.exe
  "C:\Users\Admin\AppData\Local\Temp\sed.exe" "1d"
  2⤵
  PID:3652
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c "C:\Windows\system32\wbem\wmic.exe path OfficeSoftwareProtectionProduct where (Name LIKE 'Office%' and PartialProductKey IS NOT NULL) get ID /VALUE" 2>nul
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:708
- - C:\Windows\system32\wbem\WMIC.exe
    C:\Windows\system32\wbem\wmic.exe path OfficeSoftwareProtectionProduct where (Name LIKE 'Office%' and PartialProductKey IS NOT NULL) get ID /VALUE
    3⤵
    - Reads the TCP/IP host and domain name from the registry
    - Suspicious behavior: EnumeratesProcesses
    PID:3764
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd.exe" /c exit /b 0
  2⤵
  - Executes a command shell one-liner
  PID:4056

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Visual Basic

T1059.005

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Remote System Discovery

T1018

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/936-12-0x0000000061000000-0x00000000614F0000-memory.dmp

Download

memory/936-13-0x0000000000400000-0x0000000000412000-memory.dmp

Download

memory/936-15-0x000000006FC40000-0x000000006FC62000-memory.dmp

Download

memory/936-16-0x0000000061000000-0x00000000614F0000-memory.dmp

Download

memory/4472-0-0x0000000061000000-0x00000000614F0000-memory.dmp

Download

memory/4472-1-0x0000000000E00000-0x00000000012F0000-memory.dmp

Download

memory/4472-2-0x0000000061000000-0x00000000614F0000-memory.dmp

Download

memory/4472-3-0x0000000000400000-0x0000000000412000-memory.dmp

Download

memory/4472-4-0x000000006FC40000-0x000000006FC62000-memory.dmp

Download

memory/4472-10-0x000000006FC40000-0x000000006FC62000-memory.dmp

Download

memory/4472-11-0x0000000061000000-0x00000000614F0000-memory.dmp

Download