4ad8a7d5968ebe4389cbeb66d84d51d0f90ffa55b21e6e073d574102dfa2fd65

Analysis

max time kernel
150s
max time network
132s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
07/10/2026, 20:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
mudinho.exe
Size 70.6MB
Sample261007-y589vset2w
SHA256 4ad8a7d5968ebe4389cbeb66d84d51d0f90ffa55b21e6e073d574102dfa2fd65
MD5 34bc9051e4b096fea877e241511e1448
SHA1 af7b92eaf17e887216637b9c56b36217ae770f79
SHA512 5124d7c1496cbb331dac30be66a82538ae906f5eb8617159fd6530f4d63e9b74edb4329e0850edf421d60054d86781b89ee329c2b96a67e5061232bdeaca8162
SSDEEP 1572864:532/Hwmxhzj5EUjQoaHc2i0Ul80dTOQcelKwQ4Kqx+E:59ohve/oa3UBrcelKjyL
TLSH
T138F7336D752684F1E43C3B35F6B67032D06D442A1BE948E8DB2D7190B2782C7D09AAFD
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery execution persistence privilege_escalation spyware stealer

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
5488	Mudinho Stealer.exe
5672	Mudinho Stealer.exe

Loads dropped DLL 8 IoCs

pid	Process
2516	mudinho.exe
2516	mudinho.exe
2516	mudinho.exe
2516	mudinho.exe
5488	Mudinho Stealer.exe
5672	Mudinho Stealer.exe
5672	Mudinho Stealer.exe
5672	Mudinho Stealer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Obfuscated Files or Information: Command Obfuscation 1 TTPs
Adversaries may obfuscate content during command execution to impede detection.
defense_evasion

Command Obfuscation
T1027.010

Uses WMI to collect hardware manufacturer information 2 TTPs 1 IoCs

Uses WMI to read the system manufacturer, model, baseboard or display adapter, which is often used to detect virtual machines and evade sandboxes.

defense_evasion

System Checks

T1497.001

Windows Management Instrumentation

T1047

pid	Process
6032	powershell.exe

Discovers running processes 1 TTPs 2 IoCs

Running process information can be used to identify security tools or plan follow-on actions.

discovery

Process Discovery

T1057

pid	Process
2784	tasklist.exe
5356	tasklist.exe

Hide Artifacts: Ignore Process Interrupts 1 TTPs 1 IoCs

Command interpreters often include specific commands/flags that ignore errors and other hangups.

defense_evasion

Ignore Process Interrupts

T1564.011

pid	Process
5756	powershell.exe

Launches sc.exe 5 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
352	sc.exe
252	sc.exe
4392	sc.exe
3056	sc.exe
5508	sc.exe

Queries system WMI classes for hardware identifiers 2 TTPs 1 IoCs

Uses WMI to read hardware serial numbers or the system UUID, commonly used to fingerprint the victim machine.

discovery

System Information Discovery

T1082

Windows Management Instrumentation

T1047

pid	Process
6032	powershell.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
5076	powershell.exe
3752	powershell.exe
3772	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4376	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	Mudinho Stealer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	Mudinho Stealer.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mudinho.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	find.exe

System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 1 IoCs

Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

discovery

Wi-Fi Discovery

T1016.002

pid	Process
4932	netsh.exe

Checks processor information in registry 2 TTPs 24 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\~MHz	Mudinho Stealer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\ProcessorNameString	Mudinho Stealer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString	Mudinho Stealer.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2	Mudinho Stealer.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3	Mudinho Stealer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\~MHz	Mudinho Stealer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\~MHz	Mudinho Stealer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\ProcessorNameString	Mudinho Stealer.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7	Mudinho Stealer.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Mudinho Stealer.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	Mudinho Stealer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz	Mudinho Stealer.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4	Mudinho Stealer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\ProcessorNameString	Mudinho Stealer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Mudinho Stealer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\ProcessorNameString	Mudinho Stealer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\~MHz	Mudinho Stealer.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5	Mudinho Stealer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\ProcessorNameString	Mudinho Stealer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	Mudinho Stealer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\~MHz	Mudinho Stealer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\ProcessorNameString	Mudinho Stealer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\~MHz	Mudinho Stealer.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6	Mudinho Stealer.exe

Modifies registry key 1 TTPs 2 IoCs

Modify Registry

T1112

pid	Process
1444	reg.exe
2444	reg.exe

Suspicious behavior: EnumeratesProcesses 22 IoCs

pid	Process
2516	mudinho.exe
2516	mudinho.exe
2784	tasklist.exe
2784	tasklist.exe
6032	powershell.exe
6032	powershell.exe
6032	powershell.exe
5076	powershell.exe
5076	powershell.exe
5076	powershell.exe
3752	powershell.exe
3752	powershell.exe
3752	powershell.exe
4824	powershell.exe
4824	powershell.exe
4824	powershell.exe
3772	powershell.exe
3772	powershell.exe
3772	powershell.exe
5756	powershell.exe
5756	powershell.exe
5756	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2784	tasklist.exe
Token: SeSecurityPrivilege	2516	mudinho.exe
Token: SeDebugPrivilege	6032	powershell.exe
Token: SeIncreaseQuotaPrivilege	6032	powershell.exe
Token: SeSecurityPrivilege	6032	powershell.exe
Token: SeTakeOwnershipPrivilege	6032	powershell.exe
Token: SeLoadDriverPrivilege	6032	powershell.exe
Token: SeSystemProfilePrivilege	6032	powershell.exe
Token: SeSystemtimePrivilege	6032	powershell.exe
Token: SeProfSingleProcessPrivilege	6032	powershell.exe
Token: SeIncBasePriorityPrivilege	6032	powershell.exe
Token: SeCreatePagefilePrivilege	6032	powershell.exe
Token: SeBackupPrivilege	6032	powershell.exe
Token: SeRestorePrivilege	6032	powershell.exe
Token: SeShutdownPrivilege	6032	powershell.exe
Token: SeDebugPrivilege	6032	powershell.exe
Token: SeSystemEnvironmentPrivilege	6032	powershell.exe
Token: SeRemoteShutdownPrivilege	6032	powershell.exe
Token: SeUndockPrivilege	6032	powershell.exe
Token: SeManageVolumePrivilege	6032	powershell.exe
Token: 33	6032	powershell.exe
Token: 34	6032	powershell.exe
Token: 35	6032	powershell.exe
Token: 36	6032	powershell.exe
Token: SeIncreaseQuotaPrivilege	6032	powershell.exe
Token: SeSecurityPrivilege	6032	powershell.exe
Token: SeTakeOwnershipPrivilege	6032	powershell.exe
Token: SeLoadDriverPrivilege	6032	powershell.exe
Token: SeSystemProfilePrivilege	6032	powershell.exe
Token: SeSystemtimePrivilege	6032	powershell.exe
Token: SeProfSingleProcessPrivilege	6032	powershell.exe
Token: SeIncBasePriorityPrivilege	6032	powershell.exe
Token: SeCreatePagefilePrivilege	6032	powershell.exe
Token: SeBackupPrivilege	6032	powershell.exe
Token: SeRestorePrivilege	6032	powershell.exe
Token: SeShutdownPrivilege	6032	powershell.exe
Token: SeDebugPrivilege	6032	powershell.exe
Token: SeSystemEnvironmentPrivilege	6032	powershell.exe
Token: SeRemoteShutdownPrivilege	6032	powershell.exe
Token: SeUndockPrivilege	6032	powershell.exe
Token: SeManageVolumePrivilege	6032	powershell.exe
Token: 33	6032	powershell.exe
Token: 34	6032	powershell.exe
Token: 35	6032	powershell.exe
Token: 36	6032	powershell.exe
Token: SeShutdownPrivilege	5488	Mudinho Stealer.exe
Token: SeCreatePagefilePrivilege	5488	Mudinho Stealer.exe
Token: SeDebugPrivilege	5356	tasklist.exe
Token: SeShutdownPrivilege	5488	Mudinho Stealer.exe
Token: SeCreatePagefilePrivilege	5488	Mudinho Stealer.exe
Token: SeDebugPrivilege	5076	powershell.exe
Token: SeIncreaseQuotaPrivilege	5076	powershell.exe
Token: SeSecurityPrivilege	5076	powershell.exe
Token: SeTakeOwnershipPrivilege	5076	powershell.exe
Token: SeLoadDriverPrivilege	5076	powershell.exe
Token: SeSystemProfilePrivilege	5076	powershell.exe
Token: SeSystemtimePrivilege	5076	powershell.exe
Token: SeProfSingleProcessPrivilege	5076	powershell.exe
Token: SeIncBasePriorityPrivilege	5076	powershell.exe
Token: SeCreatePagefilePrivilege	5076	powershell.exe
Token: SeBackupPrivilege	5076	powershell.exe
Token: SeRestorePrivilege	5076	powershell.exe
Token: SeShutdownPrivilege	5076	powershell.exe
Token: SeDebugPrivilege	5076	powershell.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 2516 wrote to memory of 4376	2516	mudinho.exe	89
PID 4376 wrote to memory of 2784	4376	cmd.exe	91
PID 4376 wrote to memory of 5708	4376	cmd.exe	92
PID 2516 wrote to memory of 5488	2516	mudinho.exe	95
PID 5488 wrote to memory of 6032	5488	Mudinho Stealer.exe	96
PID 5488 wrote to memory of 5672	5488	Mudinho Stealer.exe	97
PID 5488 wrote to memory of 5672	5488	Mudinho Stealer.exe	97
PID 5488 wrote to memory of 5356	5488	Mudinho Stealer.exe	99
PID 5488 wrote to memory of 4392	5488	Mudinho Stealer.exe	101
PID 5488 wrote to memory of 3056	5488	Mudinho Stealer.exe	103
PID 5488 wrote to memory of 5508	5488	Mudinho Stealer.exe	105
PID 5488 wrote to memory of 352	5488	Mudinho Stealer.exe	107
PID 5488 wrote to memory of 252	5488	Mudinho Stealer.exe	109
PID 5488 wrote to memory of 5824	5488	Mudinho Stealer.exe	111
PID 5488 wrote to memory of 5076	5488	Mudinho Stealer.exe	113
PID 5488 wrote to memory of 3752	5488	Mudinho Stealer.exe	115
PID 3752 wrote to memory of 5484	3752	powershell.exe	117
PID 5484 wrote to memory of 3136	5484	csc.exe	118
PID 5488 wrote to memory of 4824	5488	Mudinho Stealer.exe	119
PID 5488 wrote to memory of 2444	5488	Mudinho Stealer.exe	121
PID 5488 wrote to memory of 1444	5488	Mudinho Stealer.exe	123
PID 5488 wrote to memory of 3772	5488	Mudinho Stealer.exe	125
PID 5488 wrote to memory of 4932	5488	Mudinho Stealer.exe	127
PID 5488 wrote to memory of 5756	5488	Mudinho Stealer.exe	129

C:\Users\Admin\AppData\Local\Temp\mudinho.exe
"C:\Users\Admin\AppData\Local\Temp\mudinho.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2516
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c tasklist /FI "USERNAME eq %USERNAME%" /FI "IMAGENAME eq Mudinho Stealer.exe" /FO csv | "C:\Windows\system32\find.exe" "Mudinho Stealer.exe"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4376
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "USERNAME eq Admin" /FI "IMAGENAME eq Mudinho Stealer.exe" /FO csv
    3⤵
    - Discovers running processes
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2784
- - C:\Windows\SysWOW64\find.exe
    "C:\Windows\system32\find.exe" "Mudinho Stealer.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5708
- C:\Users\Admin\AppData\Local\Programs\mudinho\Mudinho Stealer.exe
  "C:\Users\Admin\AppData\Local\Programs\mudinho\Mudinho Stealer.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Reads the TCP/IP host and domain name from the registry
  - Checks processor information in registry
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:5488
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "Get-CimInstance Win32_BIOS | Select-Object Manufacturer,SerialNumber,Version | Format-List; Get-CimInstance Win32_BaseBoard | Select-Object Manufacturer,Product,SerialNumber | Format-List"
    3⤵
    - Uses WMI to collect hardware manufacturer information
    - Queries system WMI classes for hardware identifiers
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:6032
- - C:\Users\Admin\AppData\Local\Programs\mudinho\Mudinho Stealer.exe
    "C:\Users\Admin\AppData\Local\Programs\mudinho\Mudinho Stealer.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\Mudinho Stealer" --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAAAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --use-gl=angle --use-angle=swiftshader-webgl --field-trial-handle=1728,i,4890817400309349331,5667327723521479102,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=1704 /prefetch:2
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:5672
- - C:\Windows\system32\tasklist.exe
    tasklist.exe /FO CSV /NH
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:5356
- - C:\Windows\system32\sc.exe
    sc.exe query VMTools
    3⤵
    - Launches sc.exe
    PID:4392
- - C:\Windows\system32\sc.exe
    sc.exe query VBoxService
    3⤵
    - Launches sc.exe
    PID:3056
- - C:\Windows\system32\sc.exe
    sc.exe query qemu-ga
    3⤵
    - Launches sc.exe
    PID:5508
- - C:\Windows\system32\sc.exe
    sc.exe query XenSvc
    3⤵
    - Launches sc.exe
    PID:352
- - C:\Windows\system32\sc.exe
    sc.exe query prl_tools
    3⤵
    - Launches sc.exe
    PID:252
- - C:\Windows\system32\reg.exe
    reg.exe query "HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings" /v ProxyServer
    3⤵
    PID:5824
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "(Get-PSDrive C).Used + (Get-PSDrive C).Free"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5076
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "Add-Type -MemberDefinition '[DllImport(\"user32.dll\")] public static extern bool GetLastInputInfo(ref LASTINPUTINFO i); [StructLayout(LayoutKind.Sequential)] public struct LASTINPUTINFO { public uint cbSize; public uint dwTime; }' -Name IdleCheck -Namespace WinNative; $i = New-Object WinNative.IdleCheck+LASTINPUTINFO; $i.cbSize = 8; [WinNative.IdleCheck]::GetLastInputInfo([ref]$i) | Out-Null; Write-Output (([Environment]::TickCount - $i.dwTime) / 1000)"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:3752
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\5igzjeaz\5igzjeaz.cmdline"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:5484
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES889F.tmp" "c:\Users\Admin\AppData\Local\Temp\5igzjeaz\CSC2FD34F5446FE4E39865F6393390DC3.TMP"
        5⤵
        
        PID:3136
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "Add-Type -AssemblyName System.Windows.Forms, System.Drawing; $ErrorActionPreference='Stop'; try { $vs=[System.Windows.Forms.SystemInformation]::VirtualScreen; $bw=$vs.Width; $bh=$vs.Height; $bx=$vs.X; $by=$vs.Y; if ($bw -le 0 -or $bh -le 0) { $b=[System.Windows.Forms.Screen]::PrimaryScreen.Bounds; $bw=$b.Width; $bh=$b.Height; $bx=$b.X; $by=$b.Y }; $bmp=New-Object System.Drawing.Bitmap([int]$bw,[int]$bh); $g=[System.Drawing.Graphics]::FromImage($bmp); $g.CopyFromScreen([int]$bx,[int]$by,0,0,$bmp.Size); $ms=New-Object System.IO.MemoryStream; $bmp.Save($ms,[System.Drawing.Imaging.ImageFormat]::Png); $g.Dispose(); $bmp.Dispose(); [Convert]::ToBase64String($ms.ToArray()) } catch { 'SCREENSHOT_UNAVAILABLE:' + $_.Exception.Message }"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4824
- - C:\Windows\system32\reg.exe
    reg.exe query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall
    3⤵
    - Modifies registry key
    PID:2444
- - C:\Windows\system32\reg.exe
    reg.exe query HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall
    3⤵
    - Modifies registry key
    PID:1444
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "Add-Type -AssemblyName System.Windows.Forms; $b=[System.Windows.Forms.Screen]::PrimaryScreen.Bounds; Write-Output (\"$($b.Width)x$($b.Height)\")"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:3772
- - C:\Windows\system32\netsh.exe
    netsh.exe wlan show profiles
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    - System Network Configuration Discovery: Wi-Fi Discovery
    PID:4932
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "Get-Printer -ErrorAction SilentlyContinue | Measure-Object | Select-Object -ExpandProperty Count"
    3⤵
    - Hide Artifacts: Ignore Process Interrupts
    - Suspicious behavior: EnumeratesProcesses
    PID:5756

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Windows Management Instrumentation

T1047

Persistence

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Hide Artifacts

T1564

Ignore Process Interrupts

T1564.011

Modify Registry

T1112

Obfuscated Files or Information

T1027

Command Obfuscation

T1027.010

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Wi-Fi Discovery

T1016.002

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact