093c4cfa423821efd53e0b04e18845f5301a2fc93206429f3622a5f4a91a308b

Analysis

max time kernel
149s
max time network
129s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
17/10/2026, 06:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
app-knowledge-export.exe
Size 5.4MB
Sample261017-hf1cnaythy
SHA256 093c4cfa423821efd53e0b04e18845f5301a2fc93206429f3622a5f4a91a308b
MD5 c16abae26018eb4f1a37bf585754547c
SHA1 12177bbce2e1d4b501060fc2f8c157b7e59572fc
SHA512 deb4144a8510c767d53f5bb622ffc551bd47a39aae36a62a3765703d61f467cd6420fcb4c24cce86ac693379d322690f48c70c1977758250401e1720aa880c7f
SSDEEP 49152:lcZ4634BOzxbFg8waV3jVbnHlj6RNjLjv+D0XaOZa+UUEolqyKyTbrz11I:uvq+ww0z1
TLSH
T1CA466C18DB692E7B848D7576A8060D336A20657B1F11342E339CD25C2F8ED6F81BD2BD
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

defense_evasion discovery execution persistence privilege_escalation

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
4216	powershell.exe
4696	powershell.exe
3256	powershell.exe

Modifies boot configuration data using bcdedit 1 IoCs

pid	Process
4320	bcdedit.exe

Power Settings 1 TTPs 7 IoCs

powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.

persistence

Power Settings

T1653

pid	Process
2140	powercfg.exe
5636	powercfg.exe
5160	powercfg.exe
2496	powercfg.exe
4500	powercfg.exe
1620	powercfg.exe
2484	powercfg.exe

Uses WMI to collect hardware manufacturer information 2 TTPs 3 IoCs

Uses WMI to read the system manufacturer, model, baseboard or display adapter, which is often used to detect virtual machines and evade sandboxes.

defense_evasion

System Checks

T1497.001

Windows Management Instrumentation

T1047

pid	Process
2640	powershell.exe
3184	wmic.exe
1872	powershell.exe

Hide Artifacts: Ignore Process Interrupts 1 TTPs 7 IoCs

Command interpreters often include specific commands/flags that ignore errors and other hangups.

defense_evasion

Ignore Process Interrupts

T1564.011

pid	Process
4364	powershell.exe
5884	powershell.exe
5924	powershell.exe
4828	powershell.exe
4060	powershell.exe
4668	powershell.exe
3256	powershell.exe

Event Triggered Execution: Netsh Helper DLL 1 TTPs 9 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 10 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	wmic.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	wmic.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	wmic.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	wmic.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	wmic.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	wmic.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	wmic.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	wmic.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	wmic.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	wmic.exe

Modifies registry key 1 TTPs 58 IoCs

Modify Registry

T1112

pid	Process
2476	reg.exe
1504	reg.exe
3700	reg.exe
4168	reg.exe
1056	reg.exe
2100	reg.exe
4824	reg.exe
4904	reg.exe
5072	reg.exe
4744	reg.exe
948	reg.exe
3188	reg.exe
3400	reg.exe
2080	reg.exe
5088	reg.exe
6060	reg.exe
3844	reg.exe
5204	reg.exe
4896	reg.exe
2364	reg.exe
6000	reg.exe
760	reg.exe
3228	reg.exe
4480	reg.exe
944	reg.exe
3352	reg.exe
4528	reg.exe
3016	reg.exe
3588	reg.exe
544	reg.exe
4780	reg.exe
3220	reg.exe
256	reg.exe
3392	reg.exe
2496	reg.exe
1516	reg.exe
3520	reg.exe
2840	reg.exe
5632	reg.exe
5444	reg.exe
1664	reg.exe
5828	reg.exe
4228	reg.exe
3244	reg.exe
1068	reg.exe
3104	reg.exe
2172	reg.exe
5804	reg.exe
5916	reg.exe
2580	reg.exe
2888	reg.exe
3236	reg.exe
4352	reg.exe
4600	reg.exe
2144	reg.exe
1260	reg.exe
4756	reg.exe
6040	reg.exe

Suspicious behavior: EnumeratesProcesses 52 IoCs

pid	Process
1820	wmic.exe
1820	wmic.exe
1820	wmic.exe
1820	wmic.exe
252	wmic.exe
252	wmic.exe
252	wmic.exe
252	wmic.exe
2640	powershell.exe
2640	powershell.exe
2640	powershell.exe
3184	wmic.exe
3184	wmic.exe
3184	wmic.exe
3184	wmic.exe
1872	powershell.exe
1872	powershell.exe
5688	wmic.exe
5688	wmic.exe
5688	wmic.exe
5688	wmic.exe
3428	wmic.exe
3428	wmic.exe
3428	wmic.exe
3428	wmic.exe
4216	powershell.exe
4216	powershell.exe
4216	powershell.exe
4364	powershell.exe
4364	powershell.exe
4364	powershell.exe
5884	powershell.exe
5884	powershell.exe
5884	powershell.exe
5924	powershell.exe
5924	powershell.exe
5924	powershell.exe
4828	powershell.exe
4828	powershell.exe
4828	powershell.exe
4696	powershell.exe
4696	powershell.exe
4696	powershell.exe
4060	powershell.exe
4060	powershell.exe
4060	powershell.exe
4668	powershell.exe
4668	powershell.exe
4668	powershell.exe
3256	powershell.exe
3256	powershell.exe
3256	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	1820	wmic.exe
Token: SeSecurityPrivilege	1820	wmic.exe
Token: SeTakeOwnershipPrivilege	1820	wmic.exe
Token: SeLoadDriverPrivilege	1820	wmic.exe
Token: SeSystemProfilePrivilege	1820	wmic.exe
Token: SeSystemtimePrivilege	1820	wmic.exe
Token: SeProfSingleProcessPrivilege	1820	wmic.exe
Token: SeIncBasePriorityPrivilege	1820	wmic.exe
Token: SeCreatePagefilePrivilege	1820	wmic.exe
Token: SeBackupPrivilege	1820	wmic.exe
Token: SeRestorePrivilege	1820	wmic.exe
Token: SeShutdownPrivilege	1820	wmic.exe
Token: SeDebugPrivilege	1820	wmic.exe
Token: SeSystemEnvironmentPrivilege	1820	wmic.exe
Token: SeRemoteShutdownPrivilege	1820	wmic.exe
Token: SeUndockPrivilege	1820	wmic.exe
Token: SeManageVolumePrivilege	1820	wmic.exe
Token: 33	1820	wmic.exe
Token: 34	1820	wmic.exe
Token: 35	1820	wmic.exe
Token: 36	1820	wmic.exe
Token: SeIncreaseQuotaPrivilege	1820	wmic.exe
Token: SeSecurityPrivilege	1820	wmic.exe
Token: SeTakeOwnershipPrivilege	1820	wmic.exe
Token: SeLoadDriverPrivilege	1820	wmic.exe
Token: SeSystemProfilePrivilege	1820	wmic.exe
Token: SeSystemtimePrivilege	1820	wmic.exe
Token: SeProfSingleProcessPrivilege	1820	wmic.exe
Token: SeIncBasePriorityPrivilege	1820	wmic.exe
Token: SeCreatePagefilePrivilege	1820	wmic.exe
Token: SeBackupPrivilege	1820	wmic.exe
Token: SeRestorePrivilege	1820	wmic.exe
Token: SeShutdownPrivilege	1820	wmic.exe
Token: SeDebugPrivilege	1820	wmic.exe
Token: SeSystemEnvironmentPrivilege	1820	wmic.exe
Token: SeRemoteShutdownPrivilege	1820	wmic.exe
Token: SeUndockPrivilege	1820	wmic.exe
Token: SeManageVolumePrivilege	1820	wmic.exe
Token: 33	1820	wmic.exe
Token: 34	1820	wmic.exe
Token: 35	1820	wmic.exe
Token: 36	1820	wmic.exe
Token: SeIncreaseQuotaPrivilege	252	wmic.exe
Token: SeSecurityPrivilege	252	wmic.exe
Token: SeTakeOwnershipPrivilege	252	wmic.exe
Token: SeLoadDriverPrivilege	252	wmic.exe
Token: SeSystemProfilePrivilege	252	wmic.exe
Token: SeSystemtimePrivilege	252	wmic.exe
Token: SeProfSingleProcessPrivilege	252	wmic.exe
Token: SeIncBasePriorityPrivilege	252	wmic.exe
Token: SeCreatePagefilePrivilege	252	wmic.exe
Token: SeBackupPrivilege	252	wmic.exe
Token: SeRestorePrivilege	252	wmic.exe
Token: SeShutdownPrivilege	252	wmic.exe
Token: SeDebugPrivilege	252	wmic.exe
Token: SeSystemEnvironmentPrivilege	252	wmic.exe
Token: SeRemoteShutdownPrivilege	252	wmic.exe
Token: SeUndockPrivilege	252	wmic.exe
Token: SeManageVolumePrivilege	252	wmic.exe
Token: 33	252	wmic.exe
Token: 34	252	wmic.exe
Token: 35	252	wmic.exe
Token: 36	252	wmic.exe
Token: SeDebugPrivilege	2640	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3464 wrote to memory of 4320	3464	app-knowledge-export.exe	90
PID 3464 wrote to memory of 1820	3464	app-knowledge-export.exe	92
PID 3464 wrote to memory of 252	3464	app-knowledge-export.exe	95
PID 3464 wrote to memory of 2640	3464	app-knowledge-export.exe	97
PID 3464 wrote to memory of 3184	3464	app-knowledge-export.exe	99
PID 3464 wrote to memory of 1872	3464	app-knowledge-export.exe	101
PID 3464 wrote to memory of 5688	3464	app-knowledge-export.exe	103
PID 3464 wrote to memory of 3428	3464	app-knowledge-export.exe	105
PID 3464 wrote to memory of 5088	3464	app-knowledge-export.exe	107
PID 3464 wrote to memory of 948	3464	app-knowledge-export.exe	109
PID 3464 wrote to memory of 1516	3464	app-knowledge-export.exe	111
PID 3464 wrote to memory of 2404	3464	app-knowledge-export.exe	113
PID 3464 wrote to memory of 2144	3464	app-knowledge-export.exe	115
PID 3464 wrote to memory of 1664	3464	app-knowledge-export.exe	117
PID 3464 wrote to memory of 6060	3464	app-knowledge-export.exe	119
PID 3464 wrote to memory of 4528	3464	app-knowledge-export.exe	121
PID 3464 wrote to memory of 4704	3464	app-knowledge-export.exe	123
PID 3464 wrote to memory of 5816	3464	app-knowledge-export.exe	125
PID 3464 wrote to memory of 2976	3464	app-knowledge-export.exe	127
PID 3464 wrote to memory of 3844	3464	app-knowledge-export.exe	129
PID 3464 wrote to memory of 3104	3464	app-knowledge-export.exe	131
PID 3464 wrote to memory of 4116	3464	app-knowledge-export.exe	133
PID 3464 wrote to memory of 1224	3464	app-knowledge-export.exe	135
PID 3464 wrote to memory of 4856	3464	app-knowledge-export.exe	137
PID 3464 wrote to memory of 5624	3464	app-knowledge-export.exe	139
PID 3464 wrote to memory of 5264	3464	app-knowledge-export.exe	141
PID 3464 wrote to memory of 4896	3464	app-knowledge-export.exe	143
PID 3464 wrote to memory of 1136	3464	app-knowledge-export.exe	145
PID 3464 wrote to memory of 4216	3464	app-knowledge-export.exe	147
PID 3464 wrote to memory of 4432	3464	app-knowledge-export.exe	151
PID 3464 wrote to memory of 3228	3464	app-knowledge-export.exe	153
PID 3464 wrote to memory of 4068	3464	app-knowledge-export.exe	155
PID 3464 wrote to memory of 4516	3464	app-knowledge-export.exe	157
PID 3464 wrote to memory of 5756	3464	app-knowledge-export.exe	214
PID 3464 wrote to memory of 5968	3464	app-knowledge-export.exe	161
PID 3464 wrote to memory of 4364	3464	app-knowledge-export.exe	163
PID 3464 wrote to memory of 5884	3464	app-knowledge-export.exe	165
PID 3464 wrote to memory of 5924	3464	app-knowledge-export.exe	167
PID 3464 wrote to memory of 4828	3464	app-knowledge-export.exe	169
PID 3464 wrote to memory of 3116	3464	app-knowledge-export.exe	171
PID 3464 wrote to memory of 4824	3464	app-knowledge-export.exe	173
PID 3464 wrote to memory of 3700	3464	app-knowledge-export.exe	175
PID 3464 wrote to memory of 3188	3464	app-knowledge-export.exe	177
PID 3464 wrote to memory of 4700	3464	app-knowledge-export.exe	179
PID 3464 wrote to memory of 3588	3464	app-knowledge-export.exe	181
PID 3464 wrote to memory of 4768	3464	app-knowledge-export.exe	183
PID 3464 wrote to memory of 4480	3464	app-knowledge-export.exe	185
PID 3464 wrote to memory of 4904	3464	app-knowledge-export.exe	187
PID 3464 wrote to memory of 2496	3464	app-knowledge-export.exe	269
PID 3464 wrote to memory of 4500	3464	app-knowledge-export.exe	191
PID 3464 wrote to memory of 4880	3464	app-knowledge-export.exe	264
PID 3464 wrote to memory of 5752	3464	app-knowledge-export.exe	195
PID 3464 wrote to memory of 2492	3464	app-knowledge-export.exe	268
PID 3464 wrote to memory of 2364	3464	app-knowledge-export.exe	199
PID 3464 wrote to memory of 5852	3464	app-knowledge-export.exe	201
PID 3464 wrote to memory of 4636	3464	app-knowledge-export.exe	203
PID 3464 wrote to memory of 2076	3464	app-knowledge-export.exe	205
PID 3464 wrote to memory of 6064	3464	app-knowledge-export.exe	207
PID 3464 wrote to memory of 3040	3464	app-knowledge-export.exe	337
PID 3464 wrote to memory of 1260	3464	app-knowledge-export.exe	211
PID 3464 wrote to memory of 3400	3464	app-knowledge-export.exe	213
PID 3464 wrote to memory of 1620	3464	app-knowledge-export.exe	215
PID 3464 wrote to memory of 2580	3464	app-knowledge-export.exe	287
PID 3464 wrote to memory of 2888	3464	app-knowledge-export.exe	219

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\app-knowledge-export.exe
"C:\Users\Admin\AppData\Local\Temp\app-knowledge-export.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3464
- C:\Windows\system32\bcdedit.exe
  "bcdedit" /enum {current}
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:4320
- C:\Windows\System32\Wbem\wmic.exe
  "wmic" cpu get Name,Manufacturer /format:list
  2⤵
  - Reads the TCP/IP host and domain name from the registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1820
- C:\Windows\System32\Wbem\wmic.exe
  "wmic" "path win32_videocontroller" get Name /format:list
  2⤵
  - Reads the TCP/IP host and domain name from the registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:252
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -NoLogo -Command "Get-CimInstance win32_videocontroller | ForEach-Object { Write-Output ('Name={0}' -f $_.Name); Write-Output '' }"
  2⤵
  - Uses WMI to collect hardware manufacturer information
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2640
- C:\Windows\System32\Wbem\wmic.exe
  "wmic" baseboard get Manufacturer /format:list
  2⤵
  - Uses WMI to collect hardware manufacturer information
  - Reads the TCP/IP host and domain name from the registry
  - Suspicious behavior: EnumeratesProcesses
  PID:3184
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -NoLogo -Command "Get-CimInstance Win32_BaseBoard | ForEach-Object { Write-Output ('Manufacturer={0}' -f $_.Manufacturer); Write-Output '' }"
  2⤵
  - Uses WMI to collect hardware manufacturer information
  - Suspicious behavior: EnumeratesProcesses
  PID:1872
- C:\Windows\System32\Wbem\wmic.exe
  "wmic" os get Caption /format:list
  2⤵
  - Reads the TCP/IP host and domain name from the registry
  - Suspicious behavior: EnumeratesProcesses
  PID:5688
- C:\Windows\System32\Wbem\wmic.exe
  "wmic" computersystem get pcsystemtype /value
  2⤵
  - Reads the TCP/IP host and domain name from the registry
  - Suspicious behavior: EnumeratesProcesses
  PID:3428
- C:\Windows\system32\reg.exe
  "reg" query HKLM\SYSTEM\CurrentControlSet\Control\GraphicsDrivers /v DisableOverlays
  2⤵
  - Modifies registry key
  PID:5088
- C:\Windows\system32\reg.exe
  "reg" query HKLM\SYSTEM\CurrentControlSet\Services\mouclass\Parameters /v MouseDataQueueSize
  2⤵
  - Modifies registry key
  PID:948
- C:\Windows\system32\reg.exe
  "reg" query HKLM\SYSTEM\CurrentControlSet\Services\kbdclass\Parameters /v KeyboardDataQueueSize
  2⤵
  - Modifies registry key
  PID:1516
- C:\Windows\system32\reg.exe
  "reg" query "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\kernel" /v GlobalTimerResolutionRequests
  2⤵
  PID:2404
- C:\Windows\system32\reg.exe
  "reg" query HKLM\SYSTEM\CurrentControlSet\Control\GraphicsDrivers /v HwSchMode
  2⤵
  - Modifies registry key
  PID:2144
- C:\Windows\system32\reg.exe
  "reg" query HKLM\SYSTEM\CurrentControlSet\Control\GraphicsDrivers /v HwSchMode
  2⤵
  - Modifies registry key
  PID:1664
- C:\Windows\system32\reg.exe
  "reg" query HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard /v EnableVirtualizationBasedSecurity
  2⤵
  - Modifies registry key
  PID:6060
- C:\Windows\system32\reg.exe
  "reg" query HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\HypervisorEnforcedCodeIntegrity /v Enabled
  2⤵
  - Modifies registry key
  PID:4528
- C:\Windows\system32\reg.exe
  "reg" query "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management" /v FeatureSettingsOverride
  2⤵
  PID:4704
- C:\Windows\system32\reg.exe
  "reg" query "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management" /v FeatureSettingsOverrideMask
  2⤵
  PID:5816
- C:\Windows\system32\reg.exe
  "reg" query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\csrss.exe\PerfOptions" /v CpuPriorityClass
  2⤵
  PID:2976
- C:\Windows\system32\reg.exe
  "reg" query HKLM\SYSTEM\CurrentControlSet\Control\GraphicsDrivers\Scheduler /v EnablePreemption
  2⤵
  - Modifies registry key
  PID:3844
- C:\Windows\system32\reg.exe
  "reg" query HKLM\SYSTEM\CurrentControlSet\Control\GraphicsDrivers\Scheduler /v DisableCoalescedTimerExpiration
  2⤵
  - Modifies registry key
  PID:3104
- C:\Windows\system32\reg.exe
  "reg" query "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management" /v LargeSystemCache
  2⤵
  PID:4116
- C:\Windows\system32\reg.exe
  "reg" query "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management" /v DisablePagingExecutive
  2⤵
  PID:1224
- C:\Windows\system32\reg.exe
  "reg" query "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management\PrefetchParameters" /v EnablePrefetcher
  2⤵
  PID:4856
- C:\Windows\system32\reg.exe
  "reg" query "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management\PrefetchParameters" /v EnableSuperfetch
  2⤵
  PID:5624
- C:\Windows\system32\fsutil.exe
  "fsutil" behavior query disablelastaccess
  2⤵
  PID:5264
- C:\Windows\system32\reg.exe
  "reg" query HKLM\SYSTEM\CurrentControlSet\Control\FileSystem /v NtfsMemoryUsage
  2⤵
  - Modifies registry key
  PID:4896
- C:\Windows\system32\fsutil.exe
  "fsutil" behavior query disable8dot3
  2⤵
  PID:1136
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -Command "(Get-NetAdapter | Where-Object { $_.Status -eq 'Up' -and $_.InterfaceDescription -notmatch 'Virtual|Loopback' } | Sort-Object -Property LinkSpeed -Descending | Select-Object -First 1).Name"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:4216
- C:\Windows\system32\reg.exe
  "reg" query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Multimedia\SystemProfile" /v NetworkThrottlingIndex
  2⤵
  PID:4432
- C:\Windows\system32\reg.exe
  "reg" query HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces
  2⤵
  - Modifies registry key
  PID:3228
- C:\Windows\system32\reg.exe
  "reg" query HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{1f7051be-a641-411d-b20e-d9495a934032} /v TcpAckFrequency
  2⤵
  PID:4068
- C:\Windows\system32\reg.exe
  "reg" query HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{3f7612b1-ae39-11f1-9b2b-806e6f6e6963} /v TcpAckFrequency
  2⤵
  PID:4516
- C:\Windows\system32\reg.exe
  "reg" query HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{df9b7cb5-d1fe-4aa3-a994-910cf9a3eb0d} /v TcpAckFrequency
  2⤵
  PID:5756
- C:\Windows\system32\netsh.exe
  "netsh" int tcp show global
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:5968
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -Command "(Get-NetAdapterAdvancedProperty -Name 'Ethernet' -DisplayName 'Interrupt Moderation' -ErrorAction SilentlyContinue).DisplayValue"
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  - Suspicious behavior: EnumeratesProcesses
  PID:4364
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -Command "(Get-NetAdapterAdvancedProperty -Name 'Ethernet' -DisplayName 'Energy-Efficient Ethernet' -ErrorAction SilentlyContinue).DisplayValue"
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  - Suspicious behavior: EnumeratesProcesses
  PID:5884
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -Command "(Get-NetAdapterPowerManagement -Name 'Ethernet' -ErrorAction SilentlyContinue).AllowComputerToTurnOffDevice"
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  - Suspicious behavior: EnumeratesProcesses
  PID:5924
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -Command "(Get-NetAdapterLso -Name 'Ethernet' -ErrorAction SilentlyContinue).IPv4Enabled"
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  - Suspicious behavior: EnumeratesProcesses
  PID:4828
- C:\Windows\system32\reg.exe
  "reg" query "HKLM\SOFTWARE\Policies\Microsoft\Windows\Windows Search" /v AllowCortana
  2⤵
  PID:3116
- C:\Windows\system32\reg.exe
  "reg" query HKLM\SOFTWARE\Policies\Microsoft\Windows\DataCollection /v AllowTelemetry
  2⤵
  - Modifies registry key
  PID:4824
- C:\Windows\system32\reg.exe
  "reg" query HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\GameDVR /v AppCaptureEnabled
  2⤵
  - Modifies registry key
  PID:3700
- C:\Windows\system32\reg.exe
  "reg" query HKCU\System\GameConfigStore /v GameDVR_FSEBehaviorMode
  2⤵
  - Modifies registry key
  PID:3188
- C:\Windows\system32\reg.exe
  "reg" query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Multimedia\SystemProfile\Tasks\Audio" /v "Scheduling Category"
  2⤵
  PID:4700
- C:\Windows\system32\reg.exe
  "reg" query HKCU\Software\Microsoft\Windows\CurrentVersion\Audio /v DisableSystemEffects
  2⤵
  - Modifies registry key
  PID:3588
- C:\Windows\system32\reg.exe
  "reg" query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Multimedia\SystemProfile" /v SystemResponsiveness
  2⤵
  PID:4768
- C:\Windows\system32\reg.exe
  "reg" query HKCU\Software\Microsoft\Multimedia\Audio /v UserDuckingPreference
  2⤵
  - Modifies registry key
  PID:4480
- C:\Windows\system32\reg.exe
  "reg" query HKLM\SYSTEM\CurrentControlSet\Services\USB /v DisableSelectiveSuspend
  2⤵
  - Modifies registry key
  PID:4904
- C:\Windows\system32\powercfg.exe
  "powercfg" /query SCHEME_CURRENT 501a4d13-42af-4429-9fd1-a8218c268e20 ee12f906-d277-404b-b6da-e5fa1a576df5
  2⤵
  - Power Settings
  PID:2496
- C:\Windows\system32\powercfg.exe
  "powercfg" /getactivescheme
  2⤵
  - Power Settings
  PID:4500
- C:\Windows\system32\reg.exe
  "reg" query "HKCU\Software\NVIDIA Corporation\Global\NVTweak" /v "Threaded optimization"
  2⤵
  PID:4880
- C:\Windows\system32\reg.exe
  "reg" query "HKCU\Software\NVIDIA Corporation\Global\NVTweak" /v NVShaderCacheMaxSize
  2⤵
  PID:5752
- C:\Windows\system32\reg.exe
  "reg" query "HKCU\Software\NVIDIA Corporation\Global\NVTweak" /v CPLPreRenderLimit
  2⤵
  PID:2492
- C:\Windows\system32\reg.exe
  "reg" query HKCU\Software\Microsoft\Windows\CurrentVersion\GameDVR /v AppCaptureEnabled
  2⤵
  - Modifies registry key
  PID:2364
- C:\Windows\system32\reg.exe
  "reg" query "HKCU\Control Panel\Mouse" /v MouseSpeed
  2⤵
  PID:5852
- C:\Windows\system32\reg.exe
  "reg" query "HKCU\Control Panel\Mouse" /v MouseThreshold1
  2⤵
  PID:4636
- C:\Windows\system32\reg.exe
  "reg" query "HKCU\Control Panel\Mouse" /v MouseThreshold2
  2⤵
  PID:2076
- C:\Windows\system32\reg.exe
  "reg" query "HKCU\Control Panel\Accessibility\StickyKeys" /v Flags
  2⤵
  PID:6064
- C:\Windows\system32\reg.exe
  "reg" query "HKCU\Control Panel\Accessibility\Keyboard Response" /v Flags
  2⤵
  PID:3040
- C:\Windows\system32\reg.exe
  "reg" query HKLM\SYSTEM\CurrentControlSet\Control\PriorityControl /v Win32PrioritySeparation
  2⤵
  - Modifies registry key
  PID:1260
- C:\Windows\system32\reg.exe
  "reg" query HKLM\SYSTEM\CurrentControlSet\Control\Power\PowerSettings\54533251-82be-4824-96c1-47b60b740d00\0cc5b647-c1df-4637-891a-dec35c318583 /v ValueMax
  2⤵
  - Modifies registry key
  PID:3400
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:5756
- C:\Windows\system32\powercfg.exe
  "powercfg" /query SCHEME_CURRENT SUB_PROCESSOR PROCTHROTTLEMIN
  2⤵
  - Power Settings
  PID:1620
- C:\Windows\system32\reg.exe
  "reg" query HKLM\SYSTEM\CurrentControlSet\Services\WSearch /v Start
  2⤵
  - Modifies registry key
  PID:2580
- C:\Windows\system32\reg.exe
  "reg" query HKCU\Software\Microsoft\Windows\CurrentVersion\BackgroundAccessApplications /v GlobalUserDisabled
  2⤵
  - Modifies registry key
  PID:2888
- C:\Windows\system32\reg.exe
  "reg" query HKLM\SOFTWARE\Policies\Microsoft\Windows\DeliveryOptimization /v DODownloadMode
  2⤵
  - Modifies registry key
  PID:3236
- C:\Windows\system32\reg.exe
  "reg" query HKLM\SOFTWARE\Policies\Microsoft\Windows\GameDVR /v AllowGameDVR
  2⤵
  - Modifies registry key
  PID:544
- C:\Windows\system32\reg.exe
  "reg" query HKLM\SYSTEM\CurrentControlSet\Services\xbgm /v Start
  2⤵
  - Modifies registry key
  PID:2172
- C:\Windows\system32\reg.exe
  "reg" query "HKCU\Control Panel\Cursors" /v ContactVisualization
  2⤵
  PID:760
- C:\Windows\system32\reg.exe
  "reg" query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Multimedia\SystemProfile\Tasks\Games" /v "GPU Priority"
  2⤵
  PID:5664
- C:\Windows\system32\reg.exe
  "reg" query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Multimedia\SystemProfile\Tasks\Games" /v Priority
  2⤵
  PID:1992
- C:\Windows\system32\reg.exe
  "reg" query "HKCU\Control Panel\Desktop" /v MenuShowDelay
  2⤵
  PID:5028
- C:\Windows\system32\reg.exe
  "reg" query HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters /v EnableTFO
  2⤵
  - Modifies registry key
  PID:6000
- C:\Windows\system32\reg.exe
  "reg" query HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\ContentDeliveryManager /v SubscribedContent-338389Enabled
  2⤵
  - Modifies registry key
  PID:3520
- C:\Windows\system32\reg.exe
  "reg" query HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\ContentDeliveryManager /v RotatingLockScreenEnabled
  2⤵
  - Modifies registry key
  PID:5828
- C:\Windows\system32\reg.exe
  "reg" query HKLM\SOFTWARE\Policies\Microsoft\Windows\System /v AllowClipboardHistory
  2⤵
  - Modifies registry key
  PID:2840
- C:\Windows\system32\reg.exe
  "reg" query HKLM\SOFTWARE\Policies\Microsoft\Windows\System /v EnableActivityFeed
  2⤵
  - Modifies registry key
  PID:5632
- C:\Windows\system32\reg.exe
  "reg" query HKLM\SOFTWARE\Policies\Microsoft\Windows\System /v PublishUserActivities
  2⤵
  - Modifies registry key
  PID:944
- C:\Windows\system32\reg.exe
  "reg" query HKCU\SOFTWARE\Policies\Microsoft\Windows\Explorer /v DisableSearchBoxSuggestions
  2⤵
  - Modifies registry key
  PID:4228
- C:\Windows\system32\reg.exe
  "reg" query HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Search /v BingSearchEnabled
  2⤵
  - Modifies registry key
  PID:4780
- C:\Windows\system32\reg.exe
  "reg" query HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Themes\Personalize /v EnableTransparency
  2⤵
  - Modifies registry key
  PID:4352
- C:\Windows\system32\reg.exe
  "reg" query HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\ContentDeliveryManager /v OemPreInstalledAppsEnabled
  2⤵
  - Modifies registry key
  PID:4756
- C:\Windows\system32\reg.exe
  "reg" query HKLM\SYSTEM\CurrentControlSet\Services\DiagTrack /v Start
  2⤵
  - Modifies registry key
  PID:4168
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -Command (Get-MMAgent).MemoryCompression
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:4696
- C:\Windows\system32\schtasks.exe
  "schtasks" /Query /TN \Microsoft\Windows\Defrag\ScheduledDefrag
  2⤵
  PID:2532
- C:\Windows\system32\fsutil.exe
  "fsutil" behavior query DisableDeleteNotify
  2⤵
  PID:2244
- C:\Windows\system32\reg.exe
  "reg" query HKCU\Software\Microsoft\Windows\CurrentVersion\StorageSense\Parameters\StoragePolicy /v 01
  2⤵
  - Modifies registry key
  PID:5804
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:4880
- C:\Windows\system32\reg.exe
  "reg" query "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Power" /v HiberbootEnabled
  2⤵
  PID:5432
- C:\Windows\system32\reg.exe
  "reg" query "HKLM\SYSTEM\CurrentControlSet\Control\Remote Assistance" /v fAllowToGetHelp
  2⤵
  PID:2316
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:2492
- C:\Windows\system32\reg.exe
  "reg" query HKLM\SYSTEM\CurrentControlSet\Services\Spooler /v Start
  2⤵
  - Modifies registry key
  PID:2496
- C:\Windows\system32\reg.exe
  "reg" query "HKLM\SOFTWARE\Microsoft\Windows\Windows Error Reporting" /v Disabled
  2⤵
  PID:5568
- C:\Windows\system32\netsh.exe
  "netsh" int tcp show supplemental
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:4724
- C:\Windows\system32\reg.exe
  "reg" query HKLM\SYSTEM\CurrentControlSet\Control\GraphicsDrivers /v TdrDelay
  2⤵
  - Modifies registry key
  PID:3016
- C:\Windows\system32\reg.exe
  "reg" query HKLM\SYSTEM\CurrentControlSet\Control\GraphicsDrivers\Scheduler /v EnablePreemption
  2⤵
  - Modifies registry key
  PID:2476
- C:\Windows\system32\reg.exe
  "reg" query HKLM\SYSTEM\CurrentControlSet\Control\GraphicsDrivers\Scheduler /v PreemptionLevel
  2⤵
  - Modifies registry key
  PID:6040
- C:\Windows\system32\reg.exe
  "reg" query HKLM\SYSTEM\CurrentControlSet\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 /v EnableULPS
  2⤵
  - Modifies registry key
  PID:5916
- C:\Windows\system32\reg.exe
  "reg" query HKLM\SYSTEM\CurrentControlSet\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0001 /v EnableULPS
  2⤵
  - Modifies registry key
  PID:1504
- C:\Windows\system32\reg.exe
  "reg" query HKLM\SYSTEM\CurrentControlSet\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0002 /v EnableULPS
  2⤵
  - Modifies registry key
  PID:3244
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:2580
- C:\Windows\system32\reg.exe
  "reg" query HKLM\SYSTEM\CurrentControlSet\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0003 /v EnableULPS
  2⤵
  - Modifies registry key
  PID:1056
- C:\Windows\system32\reg.exe
  "reg" query HKLM\SYSTEM\CurrentControlSet\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0004 /v EnableULPS
  2⤵
  - Modifies registry key
  PID:3352
- C:\Windows\system32\reg.exe
  "reg" query HKLM\SYSTEM\CurrentControlSet\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0005 /v EnableULPS
  2⤵
  - Modifies registry key
  PID:5204
- C:\Windows\system32\reg.exe
  "reg" query HKLM\SYSTEM\CurrentControlSet\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0006 /v EnableULPS
  2⤵
  - Modifies registry key
  PID:3220
- C:\Windows\system32\reg.exe
  "reg" query HKLM\SYSTEM\CurrentControlSet\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0007 /v EnableULPS
  2⤵
  - Modifies registry key
  PID:760
- C:\Windows\system32\reg.exe
  "reg" query HKLM\SYSTEM\CurrentControlSet\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0008 /v EnableULPS
  2⤵
  - Modifies registry key
  PID:2080
- C:\Windows\system32\reg.exe
  "reg" query HKLM\SYSTEM\CurrentControlSet\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0009 /v EnableULPS
  2⤵
  - Modifies registry key
  PID:4600
- C:\Windows\system32\reg.exe
  "reg" query HKLM\SYSTEM\CurrentControlSet\Services\WpnService /v Start
  2⤵
  - Modifies registry key
  PID:5444
- C:\Windows\system32\reg.exe
  "reg" query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\Maintenance" /v MaintenanceDisabled
  2⤵
  PID:3280
- C:\Windows\system32\reg.exe
  "reg" query HKLM\SYSTEM\CurrentControlSet\Control\Power /v CsEnabled
  2⤵
  - Modifies registry key
  PID:256
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -Command "Get-NetAdapterAdvancedProperty -Name * -RegistryKeyword '*ReceiveBuffers' -ErrorAction SilentlyContinue | Select-Object -First 1 -ExpandProperty RegistryValue"
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  - Suspicious behavior: EnumeratesProcesses
  PID:4060
- C:\Windows\system32\reg.exe
  "reg" query HKLM\SYSTEM\CurrentControlSet\Control\GraphicsDrivers /v SwapEffectUpgradeCache
  2⤵
  - Modifies registry key
  PID:5072
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -Command "Get-NetAdapterAdvancedProperty -Name * -RegistryKeyword '*ITR' -ErrorAction SilentlyContinue | Select-Object -First 1 -ExpandProperty RegistryValue"
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  - Suspicious behavior: EnumeratesProcesses
  PID:4668
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:4780
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -Command "Get-ItemProperty 'HKLM:\SYSTEM\CurrentControlSet\Enum\PCI\VEN_10DE*\*\Device Parameters\Interrupt Management\Affinity Policy' -ErrorAction SilentlyContinue | Select-Object -ExpandProperty DevicePolicy -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Hide Artifacts: Ignore Process Interrupts
  - Suspicious behavior: EnumeratesProcesses
  PID:3256
- C:\Windows\system32\secedit.exe
  "secedit" /export /cfg C:\Users\Admin\AppData\Local\Temp\pulse_secpol_query.cfg
  2⤵
  PID:4972
- C:\Windows\system32\whoami.exe
  "whoami" /user /fo csv /nh
  2⤵
  PID:708
- C:\Windows\system32\powercfg.exe
  "powercfg" /query SCHEME_CURRENT 54533251-82be-4824-96c1-47b60b740d00 be337238-0d82-4146-a960-4f3749d470c7
  2⤵
  - Power Settings
  PID:2484
- C:\Windows\system32\powercfg.exe
  "powercfg" /query SCHEME_CURRENT 54533251-82be-4824-96c1-47b60b740d00 bae08b81-2d5e-4688-ad6a-13243356654b
  2⤵
  - Power Settings
  PID:2140
- C:\Windows\system32\powercfg.exe
  "powercfg" /q SCHEME_CURRENT 54533251-82be-4824-96c1-47b60b740d00 5d76a2ca-e8c0-402f-a133-2158492d58ad
  2⤵
  - Power Settings
  PID:5636
- C:\Windows\system32\reg.exe
  "reg" query HKLM\SYSTEM\CurrentControlSet\Control /v WaitToKillServiceTimeout
  2⤵
  - Modifies registry key
  PID:3392
- C:\Windows\system32\netsh.exe
  "netsh" int tcp show global
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:5612
- C:\Windows\system32\reg.exe
  "reg" query HKCU\Software\Microsoft\DirectX\GraphicsSettings /v DirectXUserGlobalSettings
  2⤵
  - Modifies registry key
  PID:2100
- C:\Windows\system32\powercfg.exe
  "powercfg" /q SCHEME_CURRENT 54533251-82be-4824-96c1-47b60b740d00 619b7505-003b-4e82-b7a6-4dd29c300971
  2⤵
  - Power Settings
  PID:5160
- C:\Windows\system32\reg.exe
  "reg" query HKCU\Software\Policies\Microsoft\Windows\WindowsCopilot /v TurnOffWindowsCopilot
  2⤵
  - Modifies registry key
  PID:1068
- C:\Windows\system32\reg.exe
  "reg" query HKCU\Software\Policies\Microsoft\Windows\WindowsAI /v DisableAIDataAnalysis
  2⤵
  - Modifies registry key
  PID:4744
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:3040

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Management Instrumentation

T1047

Persistence

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Power Settings

T1653

Privilege Escalation

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Hide Artifacts

T1564

Ignore Process Interrupts

T1564.011

Modify Registry

T1112

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Credential Access

Discovery

Query Registry

T1012

System Network Configuration Discovery

T1016

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact