71e4e36cbd5ef5182b2619eba567766c63866ed00b74c8d4ba0f2356b6725f1a

Analysis

max time kernel
148s
max time network
146s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/10/2026, 21:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
spoofer.exe
Size 11.5MB
Sample261009-1cs4aacv2p
SHA256 71e4e36cbd5ef5182b2619eba567766c63866ed00b74c8d4ba0f2356b6725f1a
MD5 0505b681e4d2110dcb009409c27b3e9f
SHA1 511a49274ea9415dfd9758e3e66b0c12f0044d8d
SHA512 4d8d26cc6b1e28507451ffb71d19178c6800941f5460f144a111112640169d28bc84525f39d7e52a3e5b94cbed9d7e7508dfed5d836dd5c6548d36c0c241b0c7
SSDEEP 196608:vDVkyzTAhV0I3UMhD0hpMXfpVAmLaRuBsKLRL:p5u+I3qspVAmsu2K
TLSH
T150C68D16E7AA49E5D0B3923489669667F3B2BC500FB4C7DF3298160A1F737E04D39B12
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

defense_evasion discovery execution

Malware Config

Signatures

Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions	spoofer.exe

Looks for VMWare Tools registry key 2 TTPs 1 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools	spoofer.exe

Uses WMI to collect hardware manufacturer information 2 TTPs 1 IoCs

Uses WMI to read the system manufacturer, model, baseboard or display adapter, which is often used to detect virtual machines and evade sandboxes.

defense_evasion

System Checks

T1497.001

Windows Management Instrumentation

T1047

pid	Process
2184	WMIC.exe

Queries system WMI classes for hardware identifiers 2 TTPs 5 IoCs

Uses WMI to read hardware serial numbers or the system UUID, commonly used to fingerprint the victim machine.

discovery

System Information Discovery

T1082

Windows Management Instrumentation

T1047

pid	Process
3600	WMIC.exe
1124	WMIC.exe
5884	WMIC.exe
2396	WMIC.exe
824	WMIC.exe

Executes a command shell one-liner 1 TTPs 16 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4876	cmd.exe
2796	cmd.exe
5832	cmd.exe
5860	cmd.exe
4340	cmd.exe
4268	cmd.exe
5968	cmd.exe
5332	cmd.exe
3000	cmd.exe
5072	cmd.exe
3848	cmd.exe
3152	cmd.exe
3756	cmd.exe
1096	cmd.exe
424	cmd.exe
5980	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 32 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WMIC.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	spoofer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BIOSVendor	spoofer.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5764	WMIC.exe
5764	WMIC.exe
5764	WMIC.exe
5764	WMIC.exe
6036	WMIC.exe
6036	WMIC.exe
6036	WMIC.exe
6036	WMIC.exe
2736	WMIC.exe
2736	WMIC.exe
2736	WMIC.exe
2736	WMIC.exe
1124	WMIC.exe
1124	WMIC.exe
1124	WMIC.exe
1124	WMIC.exe
3044	WMIC.exe
3044	WMIC.exe
3044	WMIC.exe
3044	WMIC.exe
1928	WMIC.exe
1928	WMIC.exe
1928	WMIC.exe
1928	WMIC.exe
6020	WMIC.exe
6020	WMIC.exe
6020	WMIC.exe
6020	WMIC.exe
3016	WMIC.exe
3016	WMIC.exe
3016	WMIC.exe
3016	WMIC.exe
2184	WMIC.exe
2184	WMIC.exe
2184	WMIC.exe
2184	WMIC.exe
5884	WMIC.exe
5884	WMIC.exe
5884	WMIC.exe
5884	WMIC.exe
3328	WMIC.exe
3328	WMIC.exe
3328	WMIC.exe
3328	WMIC.exe
2840	WMIC.exe
2840	WMIC.exe
2840	WMIC.exe
2840	WMIC.exe
3188	WMIC.exe
3188	WMIC.exe
3188	WMIC.exe
3188	WMIC.exe
2396	WMIC.exe
2396	WMIC.exe
2396	WMIC.exe
2396	WMIC.exe
824	WMIC.exe
824	WMIC.exe
824	WMIC.exe
824	WMIC.exe
3600	WMIC.exe
3600	WMIC.exe
3600	WMIC.exe
3600	WMIC.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4852	spoofer.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	5764	WMIC.exe
Token: SeSecurityPrivilege	5764	WMIC.exe
Token: SeTakeOwnershipPrivilege	5764	WMIC.exe
Token: SeLoadDriverPrivilege	5764	WMIC.exe
Token: SeSystemProfilePrivilege	5764	WMIC.exe
Token: SeSystemtimePrivilege	5764	WMIC.exe
Token: SeProfSingleProcessPrivilege	5764	WMIC.exe
Token: SeIncBasePriorityPrivilege	5764	WMIC.exe
Token: SeCreatePagefilePrivilege	5764	WMIC.exe
Token: SeBackupPrivilege	5764	WMIC.exe
Token: SeRestorePrivilege	5764	WMIC.exe
Token: SeShutdownPrivilege	5764	WMIC.exe
Token: SeDebugPrivilege	5764	WMIC.exe
Token: SeSystemEnvironmentPrivilege	5764	WMIC.exe
Token: SeRemoteShutdownPrivilege	5764	WMIC.exe
Token: SeUndockPrivilege	5764	WMIC.exe
Token: SeManageVolumePrivilege	5764	WMIC.exe
Token: 33	5764	WMIC.exe
Token: 34	5764	WMIC.exe
Token: 35	5764	WMIC.exe
Token: 36	5764	WMIC.exe
Token: SeIncreaseQuotaPrivilege	5764	WMIC.exe
Token: SeSecurityPrivilege	5764	WMIC.exe
Token: SeTakeOwnershipPrivilege	5764	WMIC.exe
Token: SeLoadDriverPrivilege	5764	WMIC.exe
Token: SeSystemProfilePrivilege	5764	WMIC.exe
Token: SeSystemtimePrivilege	5764	WMIC.exe
Token: SeProfSingleProcessPrivilege	5764	WMIC.exe
Token: SeIncBasePriorityPrivilege	5764	WMIC.exe
Token: SeCreatePagefilePrivilege	5764	WMIC.exe
Token: SeBackupPrivilege	5764	WMIC.exe
Token: SeRestorePrivilege	5764	WMIC.exe
Token: SeShutdownPrivilege	5764	WMIC.exe
Token: SeDebugPrivilege	5764	WMIC.exe
Token: SeSystemEnvironmentPrivilege	5764	WMIC.exe
Token: SeRemoteShutdownPrivilege	5764	WMIC.exe
Token: SeUndockPrivilege	5764	WMIC.exe
Token: SeManageVolumePrivilege	5764	WMIC.exe
Token: 33	5764	WMIC.exe
Token: 34	5764	WMIC.exe
Token: 35	5764	WMIC.exe
Token: 36	5764	WMIC.exe
Token: SeIncreaseQuotaPrivilege	6036	WMIC.exe
Token: SeSecurityPrivilege	6036	WMIC.exe
Token: SeTakeOwnershipPrivilege	6036	WMIC.exe
Token: SeLoadDriverPrivilege	6036	WMIC.exe
Token: SeSystemProfilePrivilege	6036	WMIC.exe
Token: SeSystemtimePrivilege	6036	WMIC.exe
Token: SeProfSingleProcessPrivilege	6036	WMIC.exe
Token: SeIncBasePriorityPrivilege	6036	WMIC.exe
Token: SeCreatePagefilePrivilege	6036	WMIC.exe
Token: SeBackupPrivilege	6036	WMIC.exe
Token: SeRestorePrivilege	6036	WMIC.exe
Token: SeShutdownPrivilege	6036	WMIC.exe
Token: SeDebugPrivilege	6036	WMIC.exe
Token: SeSystemEnvironmentPrivilege	6036	WMIC.exe
Token: SeRemoteShutdownPrivilege	6036	WMIC.exe
Token: SeUndockPrivilege	6036	WMIC.exe
Token: SeManageVolumePrivilege	6036	WMIC.exe
Token: 33	6036	WMIC.exe
Token: 34	6036	WMIC.exe
Token: 35	6036	WMIC.exe
Token: 36	6036	WMIC.exe
Token: SeIncreaseQuotaPrivilege	6036	WMIC.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4852	spoofer.exe

Suspicious use of WriteProcessMemory 32 IoCs

description	pid	Process	procid_target
PID 4852 wrote to memory of 424	4852	spoofer.exe	90
PID 424 wrote to memory of 5764	424	cmd.exe	91
PID 4852 wrote to memory of 5832	4852	spoofer.exe	93
PID 5832 wrote to memory of 6036	5832	cmd.exe	94
PID 4852 wrote to memory of 4268	4852	spoofer.exe	95
PID 4268 wrote to memory of 2736	4268	cmd.exe	96
PID 4852 wrote to memory of 3848	4852	spoofer.exe	97
PID 3848 wrote to memory of 1124	3848	cmd.exe	98
PID 4852 wrote to memory of 5860	4852	spoofer.exe	99
PID 5860 wrote to memory of 3044	5860	cmd.exe	100
PID 4852 wrote to memory of 3152	4852	spoofer.exe	101
PID 3152 wrote to memory of 1928	3152	cmd.exe	102
PID 4852 wrote to memory of 4340	4852	spoofer.exe	103
PID 4340 wrote to memory of 6020	4340	cmd.exe	104
PID 4852 wrote to memory of 5968	4852	spoofer.exe	105
PID 5968 wrote to memory of 3016	5968	cmd.exe	106
PID 4852 wrote to memory of 5980	4852	spoofer.exe	107
PID 5980 wrote to memory of 2184	5980	cmd.exe	108
PID 4852 wrote to memory of 5332	4852	spoofer.exe	109
PID 5332 wrote to memory of 5884	5332	cmd.exe	110
PID 4852 wrote to memory of 4876	4852	spoofer.exe	111
PID 4876 wrote to memory of 3328	4876	cmd.exe	112
PID 4852 wrote to memory of 2796	4852	spoofer.exe	113
PID 2796 wrote to memory of 2840	2796	cmd.exe	114
PID 4852 wrote to memory of 3756	4852	spoofer.exe	115
PID 3756 wrote to memory of 3188	3756	cmd.exe	116
PID 4852 wrote to memory of 3000	4852	spoofer.exe	117
PID 3000 wrote to memory of 2396	3000	cmd.exe	118
PID 4852 wrote to memory of 5072	4852	spoofer.exe	119
PID 5072 wrote to memory of 824	5072	cmd.exe	120
PID 4852 wrote to memory of 1096	4852	spoofer.exe	121
PID 1096 wrote to memory of 3600	1096	cmd.exe	122

C:\Users\Admin\AppData\Local\Temp\spoofer.exe
"C:\Users\Admin\AppData\Local\Temp\spoofer.exe"
1⤵
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Enumerates system info in registry
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4852
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c wmic computersystem get Name
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:424
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic computersystem get Name
    3⤵
    - Reads the TCP/IP host and domain name from the registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5764
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c wmic cpu get Name
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5832
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic cpu get Name
    3⤵
    - Reads the TCP/IP host and domain name from the registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:6036
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c wmic computersystem get TotalPhysicalMemory
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4268
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic computersystem get TotalPhysicalMemory
    3⤵
    - Reads the TCP/IP host and domain name from the registry
    - Suspicious behavior: EnumeratesProcesses
    PID:2736
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c wmic bios get SerialNumber
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3848
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic bios get SerialNumber
    3⤵
    - Queries system WMI classes for hardware identifiers
    - Reads the TCP/IP host and domain name from the registry
    - Suspicious behavior: EnumeratesProcesses
    PID:1124
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c wmic os get SerialNumber
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5860
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic os get SerialNumber
    3⤵
    - Reads the TCP/IP host and domain name from the registry
    - Suspicious behavior: EnumeratesProcesses
    PID:3044
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c wmic computersystem get SystemType
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3152
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic computersystem get SystemType
    3⤵
    - Reads the TCP/IP host and domain name from the registry
    - Suspicious behavior: EnumeratesProcesses
    PID:1928
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c wmic os get Version
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4340
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic os get Version
    3⤵
    - Reads the TCP/IP host and domain name from the registry
    - Suspicious behavior: EnumeratesProcesses
    PID:6020
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c wmic os get BuildNumber
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5968
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic os get BuildNumber
    3⤵
    - Reads the TCP/IP host and domain name from the registry
    - Suspicious behavior: EnumeratesProcesses
    PID:3016
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c wmic baseboard get Product
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5980
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic baseboard get Product
    3⤵
    - Uses WMI to collect hardware manufacturer information
    - Reads the TCP/IP host and domain name from the registry
    - Suspicious behavior: EnumeratesProcesses
    PID:2184
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c wmic baseboard get SerialNumber
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5332
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic baseboard get SerialNumber
    3⤵
    - Queries system WMI classes for hardware identifiers
    - Reads the TCP/IP host and domain name from the registry
    - Suspicious behavior: EnumeratesProcesses
    PID:5884
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c wmic csproduct get IdentifyingNumber
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4876
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic csproduct get IdentifyingNumber
    3⤵
    - Reads the TCP/IP host and domain name from the registry
    - Suspicious behavior: EnumeratesProcesses
    PID:3328
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c wmic nic get MACAddress
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2796
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic nic get MACAddress
    3⤵
    - Reads the TCP/IP host and domain name from the registry
    - Suspicious behavior: EnumeratesProcesses
    PID:2840
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c wmic bios get Version
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3756
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic bios get Version
    3⤵
    - Reads the TCP/IP host and domain name from the registry
    - Suspicious behavior: EnumeratesProcesses
    PID:3188
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c wmic csproduct get uuid
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3000
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic csproduct get uuid
    3⤵
    - Queries system WMI classes for hardware identifiers
    - Reads the TCP/IP host and domain name from the registry
    - Suspicious behavior: EnumeratesProcesses
    PID:2396
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c wmic cpu get SerialNumber
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5072
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic cpu get SerialNumber
    3⤵
    - Queries system WMI classes for hardware identifiers
    - Reads the TCP/IP host and domain name from the registry
    - Suspicious behavior: EnumeratesProcesses
    PID:824
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c wmic cpu get ProcessorId
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1096
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic cpu get ProcessorId
    3⤵
    - Queries system WMI classes for hardware identifiers
    - Reads the TCP/IP host and domain name from the registry
    - Suspicious behavior: EnumeratesProcesses
    PID:3600