4ad8a7d5968ebe4389cbeb66d84d51d0f90ffa55b21e6e073d574102dfa2fd65

Analysis

max time kernel
150s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
07/10/2026, 20:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
mudinho.exe
Size 70.6MB
Sample261007-y589vset2w
SHA256 4ad8a7d5968ebe4389cbeb66d84d51d0f90ffa55b21e6e073d574102dfa2fd65
MD5 34bc9051e4b096fea877e241511e1448
SHA1 af7b92eaf17e887216637b9c56b36217ae770f79
SHA512 5124d7c1496cbb331dac30be66a82538ae906f5eb8617159fd6530f4d63e9b74edb4329e0850edf421d60054d86781b89ee329c2b96a67e5061232bdeaca8162
SSDEEP 1572864:532/Hwmxhzj5EUjQoaHc2i0Ul80dTOQcelKwQ4Kqx+E:59ohve/oa3UBrcelKjyL
TLSH
T138F7336D752684F1E43C3B35F6B67032D06D442A1BE948E8DB2D7190B2782C7D09AAFD
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery execution persistence privilege_escalation spyware stealer

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\Control Panel\International\Geo\Nation	Mudinho Stealer.exe

Executes dropped EXE 2 IoCs

pid	Process
1264	Mudinho Stealer.exe
452	Mudinho Stealer.exe

Loads dropped DLL 8 IoCs

pid	Process
4152	mudinho.exe
4152	mudinho.exe
4152	mudinho.exe
4152	mudinho.exe
1264	Mudinho Stealer.exe
452	Mudinho Stealer.exe
452	Mudinho Stealer.exe
452	Mudinho Stealer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Obfuscated Files or Information: Command Obfuscation 1 TTPs
Adversaries may obfuscate content during command execution to impede detection.
defense_evasion

Command Obfuscation
T1027.010

Uses WMI to collect hardware manufacturer information 2 TTPs 1 IoCs

Uses WMI to read the system manufacturer, model, baseboard or display adapter, which is often used to detect virtual machines and evade sandboxes.

defense_evasion

System Checks

T1497.001

Windows Management Instrumentation

T1047

pid	Process
4724	powershell.exe

Discovers running processes 1 TTPs 2 IoCs

Running process information can be used to identify security tools or plan follow-on actions.

discovery

Process Discovery

T1057

pid	Process
2744	tasklist.exe
224	tasklist.exe

Hide Artifacts: Ignore Process Interrupts 1 TTPs 1 IoCs

Command interpreters often include specific commands/flags that ignore errors and other hangups.

defense_evasion

Ignore Process Interrupts

T1564.011

pid	Process
4060	powershell.exe

Launches sc.exe 5 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3284	sc.exe
680	sc.exe
4600	sc.exe
2016	sc.exe
920	sc.exe

Queries system WMI classes for hardware identifiers 2 TTPs 1 IoCs

Uses WMI to read hardware serial numbers or the system UUID, commonly used to fingerprint the victim machine.

discovery

System Information Discovery

T1082

Windows Management Instrumentation

T1047

pid	Process
4724	powershell.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
3196	powershell.exe
2772	powershell.exe
1100	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4108	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	Mudinho Stealer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	Mudinho Stealer.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mudinho.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	find.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe

System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 1 IoCs

Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

discovery

Wi-Fi Discovery

T1016.002

pid	Process
2180	netsh.exe

Checks processor information in registry 2 TTPs 24 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\ProcessorNameString	Mudinho Stealer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\ProcessorNameString	Mudinho Stealer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString	Mudinho Stealer.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2	Mudinho Stealer.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3	Mudinho Stealer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\ProcessorNameString	Mudinho Stealer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\ProcessorNameString	Mudinho Stealer.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5	Mudinho Stealer.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Mudinho Stealer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	Mudinho Stealer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Mudinho Stealer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\~MHz	Mudinho Stealer.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6	Mudinho Stealer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\~MHz	Mudinho Stealer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\~MHz	Mudinho Stealer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz	Mudinho Stealer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\~MHz	Mudinho Stealer.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7	Mudinho Stealer.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	Mudinho Stealer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\ProcessorNameString	Mudinho Stealer.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4	Mudinho Stealer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\~MHz	Mudinho Stealer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\~MHz	Mudinho Stealer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\ProcessorNameString	Mudinho Stealer.exe

Modifies registry key 1 TTPs 2 IoCs

Modify Registry

T1112

pid	Process
3204	reg.exe
4644	reg.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
4152	mudinho.exe
4152	mudinho.exe
2744	tasklist.exe
2744	tasklist.exe
4724	powershell.exe
4724	powershell.exe
4724	powershell.exe
3196	powershell.exe
3196	powershell.exe
3196	powershell.exe
2772	powershell.exe
2772	powershell.exe
2772	powershell.exe
2420	powershell.exe
2420	powershell.exe
2420	powershell.exe
1100	powershell.exe
1100	powershell.exe
4060	powershell.exe
4060	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2744	tasklist.exe
Token: SeSecurityPrivilege	4152	mudinho.exe
Token: SeShutdownPrivilege	1264	Mudinho Stealer.exe
Token: SeCreatePagefilePrivilege	1264	Mudinho Stealer.exe
Token: SeDebugPrivilege	4724	powershell.exe
Token: SeShutdownPrivilege	1264	Mudinho Stealer.exe
Token: SeCreatePagefilePrivilege	1264	Mudinho Stealer.exe
Token: SeIncreaseQuotaPrivilege	4724	powershell.exe
Token: SeSecurityPrivilege	4724	powershell.exe
Token: SeTakeOwnershipPrivilege	4724	powershell.exe
Token: SeLoadDriverPrivilege	4724	powershell.exe
Token: SeSystemProfilePrivilege	4724	powershell.exe
Token: SeSystemtimePrivilege	4724	powershell.exe
Token: SeProfSingleProcessPrivilege	4724	powershell.exe
Token: SeIncBasePriorityPrivilege	4724	powershell.exe
Token: SeCreatePagefilePrivilege	4724	powershell.exe
Token: SeBackupPrivilege	4724	powershell.exe
Token: SeRestorePrivilege	4724	powershell.exe
Token: SeShutdownPrivilege	4724	powershell.exe
Token: SeDebugPrivilege	4724	powershell.exe
Token: SeSystemEnvironmentPrivilege	4724	powershell.exe
Token: SeRemoteShutdownPrivilege	4724	powershell.exe
Token: SeUndockPrivilege	4724	powershell.exe
Token: SeManageVolumePrivilege	4724	powershell.exe
Token: 33	4724	powershell.exe
Token: 34	4724	powershell.exe
Token: 35	4724	powershell.exe
Token: 36	4724	powershell.exe
Token: SeIncreaseQuotaPrivilege	4724	powershell.exe
Token: SeSecurityPrivilege	4724	powershell.exe
Token: SeTakeOwnershipPrivilege	4724	powershell.exe
Token: SeLoadDriverPrivilege	4724	powershell.exe
Token: SeSystemProfilePrivilege	4724	powershell.exe
Token: SeSystemtimePrivilege	4724	powershell.exe
Token: SeProfSingleProcessPrivilege	4724	powershell.exe
Token: SeIncBasePriorityPrivilege	4724	powershell.exe
Token: SeCreatePagefilePrivilege	4724	powershell.exe
Token: SeBackupPrivilege	4724	powershell.exe
Token: SeRestorePrivilege	4724	powershell.exe
Token: SeShutdownPrivilege	4724	powershell.exe
Token: SeDebugPrivilege	4724	powershell.exe
Token: SeSystemEnvironmentPrivilege	4724	powershell.exe
Token: SeRemoteShutdownPrivilege	4724	powershell.exe
Token: SeUndockPrivilege	4724	powershell.exe
Token: SeManageVolumePrivilege	4724	powershell.exe
Token: 33	4724	powershell.exe
Token: 34	4724	powershell.exe
Token: 35	4724	powershell.exe
Token: 36	4724	powershell.exe
Token: SeDebugPrivilege	224	tasklist.exe
Token: SeShutdownPrivilege	1264	Mudinho Stealer.exe
Token: SeCreatePagefilePrivilege	1264	Mudinho Stealer.exe
Token: SeDebugPrivilege	3196	powershell.exe
Token: SeShutdownPrivilege	1264	Mudinho Stealer.exe
Token: SeCreatePagefilePrivilege	1264	Mudinho Stealer.exe
Token: SeIncreaseQuotaPrivilege	3196	powershell.exe
Token: SeSecurityPrivilege	3196	powershell.exe
Token: SeTakeOwnershipPrivilege	3196	powershell.exe
Token: SeLoadDriverPrivilege	3196	powershell.exe
Token: SeSystemProfilePrivilege	3196	powershell.exe
Token: SeSystemtimePrivilege	3196	powershell.exe
Token: SeProfSingleProcessPrivilege	3196	powershell.exe
Token: SeIncBasePriorityPrivilege	3196	powershell.exe
Token: SeCreatePagefilePrivilege	3196	powershell.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 4152 wrote to memory of 4108	4152	mudinho.exe	86
PID 4108 wrote to memory of 2744	4108	cmd.exe	88
PID 4108 wrote to memory of 4676	4108	cmd.exe	89
PID 4152 wrote to memory of 1264	4152	mudinho.exe	96
PID 1264 wrote to memory of 452	1264	Mudinho Stealer.exe	99
PID 1264 wrote to memory of 452	1264	Mudinho Stealer.exe	99
PID 1264 wrote to memory of 4724	1264	Mudinho Stealer.exe	100
PID 1264 wrote to memory of 224	1264	Mudinho Stealer.exe	104
PID 1264 wrote to memory of 4600	1264	Mudinho Stealer.exe	106
PID 1264 wrote to memory of 2016	1264	Mudinho Stealer.exe	108
PID 1264 wrote to memory of 920	1264	Mudinho Stealer.exe	110
PID 1264 wrote to memory of 3284	1264	Mudinho Stealer.exe	112
PID 1264 wrote to memory of 680	1264	Mudinho Stealer.exe	114
PID 1264 wrote to memory of 5044	1264	Mudinho Stealer.exe	116
PID 1264 wrote to memory of 3196	1264	Mudinho Stealer.exe	118
PID 1264 wrote to memory of 2772	1264	Mudinho Stealer.exe	120
PID 2772 wrote to memory of 964	2772	powershell.exe	122
PID 964 wrote to memory of 4208	964	csc.exe	123
PID 1264 wrote to memory of 2420	1264	Mudinho Stealer.exe	124
PID 1264 wrote to memory of 3204	1264	Mudinho Stealer.exe	126
PID 1264 wrote to memory of 4644	1264	Mudinho Stealer.exe	128
PID 1264 wrote to memory of 1100	1264	Mudinho Stealer.exe	130
PID 1264 wrote to memory of 2180	1264	Mudinho Stealer.exe	132
PID 1264 wrote to memory of 4060	1264	Mudinho Stealer.exe	134

C:\Users\Admin\AppData\Local\Temp\mudinho.exe
"C:\Users\Admin\AppData\Local\Temp\mudinho.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4152
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c tasklist /FI "USERNAME eq %USERNAME%" /FI "IMAGENAME eq Mudinho Stealer.exe" /FO csv | "C:\Windows\system32\find.exe" "Mudinho Stealer.exe"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4108
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "USERNAME eq Admin" /FI "IMAGENAME eq Mudinho Stealer.exe" /FO csv
    3⤵
    - Discovers running processes
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2744
- - C:\Windows\SysWOW64\find.exe
    "C:\Windows\system32\find.exe" "Mudinho Stealer.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4676
- C:\Users\Admin\AppData\Local\Programs\mudinho\Mudinho Stealer.exe
  "C:\Users\Admin\AppData\Local\Programs\mudinho\Mudinho Stealer.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Loads dropped DLL
  - Reads the TCP/IP host and domain name from the registry
  - Checks processor information in registry
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1264
- - C:\Users\Admin\AppData\Local\Programs\mudinho\Mudinho Stealer.exe
    "C:\Users\Admin\AppData\Local\Programs\mudinho\Mudinho Stealer.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\Mudinho Stealer" --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAAAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --use-gl=angle --use-angle=swiftshader-webgl --field-trial-handle=1756,i,5480635364650975084,13910403614918910518,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=1748 /prefetch:2
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:452
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "Get-CimInstance Win32_BIOS | Select-Object Manufacturer,SerialNumber,Version | Format-List; Get-CimInstance Win32_BaseBoard | Select-Object Manufacturer,Product,SerialNumber | Format-List"
    3⤵
    - Uses WMI to collect hardware manufacturer information
    - Queries system WMI classes for hardware identifiers
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4724
- - C:\Windows\system32\tasklist.exe
    tasklist.exe /FO CSV /NH
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:224
- - C:\Windows\system32\sc.exe
    sc.exe query VMTools
    3⤵
    - Launches sc.exe
    PID:4600
- - C:\Windows\system32\sc.exe
    sc.exe query VBoxService
    3⤵
    - Launches sc.exe
    PID:2016
- - C:\Windows\system32\sc.exe
    sc.exe query qemu-ga
    3⤵
    - Launches sc.exe
    PID:920
- - C:\Windows\system32\sc.exe
    sc.exe query XenSvc
    3⤵
    - Launches sc.exe
    PID:3284
- - C:\Windows\system32\sc.exe
    sc.exe query prl_tools
    3⤵
    - Launches sc.exe
    PID:680
- - C:\Windows\system32\reg.exe
    reg.exe query "HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings" /v ProxyServer
    3⤵
    PID:5044
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "(Get-PSDrive C).Used + (Get-PSDrive C).Free"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3196
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "Add-Type -MemberDefinition '[DllImport(\"user32.dll\")] public static extern bool GetLastInputInfo(ref LASTINPUTINFO i); [StructLayout(LayoutKind.Sequential)] public struct LASTINPUTINFO { public uint cbSize; public uint dwTime; }' -Name IdleCheck -Namespace WinNative; $i = New-Object WinNative.IdleCheck+LASTINPUTINFO; $i.cbSize = 8; [WinNative.IdleCheck]::GetLastInputInfo([ref]$i) | Out-Null; Write-Output (([Environment]::TickCount - $i.dwTime) / 1000)"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:2772
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\4n1hbzgu\4n1hbzgu.cmdline"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:964
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESF77.tmp" "c:\Users\Admin\AppData\Local\Temp\4n1hbzgu\CSC2C932744E3CE47D9B7B4C67AF0AFAB24.TMP"
        5⤵
        
        PID:4208
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "Add-Type -AssemblyName System.Windows.Forms, System.Drawing; $ErrorActionPreference='Stop'; try { $vs=[System.Windows.Forms.SystemInformation]::VirtualScreen; $bw=$vs.Width; $bh=$vs.Height; $bx=$vs.X; $by=$vs.Y; if ($bw -le 0 -or $bh -le 0) { $b=[System.Windows.Forms.Screen]::PrimaryScreen.Bounds; $bw=$b.Width; $bh=$b.Height; $bx=$b.X; $by=$b.Y }; $bmp=New-Object System.Drawing.Bitmap([int]$bw,[int]$bh); $g=[System.Drawing.Graphics]::FromImage($bmp); $g.CopyFromScreen([int]$bx,[int]$by,0,0,$bmp.Size); $ms=New-Object System.IO.MemoryStream; $bmp.Save($ms,[System.Drawing.Imaging.ImageFormat]::Png); $g.Dispose(); $bmp.Dispose(); [Convert]::ToBase64String($ms.ToArray()) } catch { 'SCREENSHOT_UNAVAILABLE:' + $_.Exception.Message }"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2420
- - C:\Windows\system32\reg.exe
    reg.exe query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall
    3⤵
    - Modifies registry key
    PID:3204
- - C:\Windows\system32\reg.exe
    reg.exe query HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall
    3⤵
    - Modifies registry key
    PID:4644
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "Add-Type -AssemblyName System.Windows.Forms; $b=[System.Windows.Forms.Screen]::PrimaryScreen.Bounds; Write-Output (\"$($b.Width)x$($b.Height)\")"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:1100
- - C:\Windows\system32\netsh.exe
    netsh.exe wlan show profiles
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    - System Network Configuration Discovery: Wi-Fi Discovery
    PID:2180
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "Get-Printer -ErrorAction SilentlyContinue | Measure-Object | Select-Object -ExpandProperty Count"
    3⤵
    - Hide Artifacts: Ignore Process Interrupts
    - Suspicious behavior: EnumeratesProcesses
    PID:4060

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Windows Management Instrumentation

T1047

Persistence

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Hide Artifacts

T1564

Ignore Process Interrupts

T1564.011

Modify Registry

T1112

Obfuscated Files or Information

T1027

Command Obfuscation

T1027.010

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Wi-Fi Discovery

T1016.002

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...