Overview
overview
7Static
static
3investigate 1.0.0.exe
windows10-ltsc_2021-x64
7investigate 1.0.0.exe
windows11-21h2-x64
7$PLUGINSDI...ls.dll
windows10-ltsc_2021-x64
3$PLUGINSDI...ls.dll
windows11-21h2-x64
3$PLUGINSDI...em.dll
windows10-ltsc_2021-x64
3$PLUGINSDI...em.dll
windows11-21h2-x64
3LICENSES.c...m.html
windows10-ltsc_2021-x64
3LICENSES.c...m.html
windows11-21h2-x64
3d3dcompiler_47.dll
windows10-ltsc_2021-x64
1d3dcompiler_47.dll
windows11-21h2-x64
1dxcompiler.dll
windows10-ltsc_2021-x64
1dxcompiler.dll
windows11-21h2-x64
1dxil.dll
windows10-ltsc_2021-x64
1dxil.dll
windows11-21h2-x64
1ffmpeg.dll
windows10-ltsc_2021-x64
1ffmpeg.dll
windows11-21h2-x64
1investigate.exe
windows10-ltsc_2021-x64
7investigate.exe
windows11-21h2-x64
7libEGL.dll
windows10-ltsc_2021-x64
1libEGL.dll
windows11-21h2-x64
1libGLESv2.dll
windows10-ltsc_2021-x64
1libGLESv2.dll
windows11-21h2-x64
1resources/app/main.js
windows10-ltsc_2021-x64
3resources/app/main.js
windows11-21h2-x64
3resources/elevate.exe
windows10-ltsc_2021-x64
3resources/elevate.exe
windows11-21h2-x64
3vk_swiftshader.dll
windows10-ltsc_2021-x64
1vk_swiftshader.dll
windows11-21h2-x64
1vulkan-1.dll
windows10-ltsc_2021-x64
1vulkan-1.dll
windows11-21h2-x64
1$PLUGINSDI...7z.dll
windows10-ltsc_2021-x64
3$PLUGINSDI...7z.dll
windows11-21h2-x64
3Analysis
- max time kernel
149s - max time network
165s - platform
windows10-ltsc_2021_x64 - resource
win10ltsc2021-20260911-en - resource tags
arch:x64arch:x86image:win10ltsc2021-20260911-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows - submitted
23/10/2026, 23:34
Static task
static1
Behavioral task
behavioral1
Sample
investigate 1.0.0.exe
Resource
win10ltsc2021-20260911-en
windows10-ltsc_2021-x64
Behavioral task
behavioral2
Sample
investigate 1.0.0.exe
Resource
win11-20260911-en
windows11-21h2-x64
Behavioral task
behavioral3
Sample
$PLUGINSDIR/StdUtils.dll
Resource
win10ltsc2021-20260911-en
windows10-ltsc_2021-x64
Behavioral task
behavioral4
Sample
$PLUGINSDIR/StdUtils.dll
Resource
win11-20260911-en
windows11-21h2-x64
Behavioral task
behavioral5
Sample
$PLUGINSDIR/System.dll
Resource
win10ltsc2021-20260911-en
windows10-ltsc_2021-x64
Behavioral task
behavioral6
Sample
$PLUGINSDIR/System.dll
Resource
win11-20260911-en
windows11-21h2-x64
Behavioral task
behavioral7
Sample
LICENSES.chromium.html
Resource
win10ltsc2021-20260911-en
windows10-ltsc_2021-x64
Behavioral task
behavioral8
Sample
LICENSES.chromium.html
Resource
win11-20260911-en
windows11-21h2-x64
Behavioral task
behavioral9
Sample
d3dcompiler_47.dll
Resource
win10ltsc2021-20260911-en
windows10-ltsc_2021-x64
Behavioral task
behavioral10
Sample
d3dcompiler_47.dll
Resource
win11-20260911-en
windows11-21h2-x64
Behavioral task
behavioral11
Sample
dxcompiler.dll
Resource
win10ltsc2021-20260911-en
windows10-ltsc_2021-x64
Behavioral task
behavioral12
Sample
dxcompiler.dll
Resource
win11-20260911-en
windows11-21h2-x64
Behavioral task
behavioral13
Sample
dxil.dll
Resource
win10ltsc2021-20260911-en
windows10-ltsc_2021-x64
Behavioral task
behavioral14
Sample
dxil.dll
Resource
win11-20260911-en
windows11-21h2-x64
Behavioral task
behavioral15
Sample
ffmpeg.dll
Resource
win10ltsc2021-20260911-en
windows10-ltsc_2021-x64
Behavioral task
behavioral16
Sample
ffmpeg.dll
Resource
win11-20260911-en
windows11-21h2-x64
Behavioral task
behavioral17
Sample
investigate.exe
Resource
win10ltsc2021-20260911-en
windows10-ltsc_2021-x64
Behavioral task
behavioral18
Sample
investigate.exe
Resource
win11-20260911-en
windows11-21h2-x64
Behavioral task
behavioral19
Sample
libEGL.dll
Resource
win10ltsc2021-20260911-en
windows10-ltsc_2021-x64
Behavioral task
behavioral20
Sample
libEGL.dll
Resource
win11-20260911-en
windows11-21h2-x64
Behavioral task
behavioral21
Sample
libGLESv2.dll
Resource
win10ltsc2021-20260911-en
windows10-ltsc_2021-x64
Behavioral task
behavioral22
Sample
libGLESv2.dll
Resource
win11-20260911-en
windows11-21h2-x64
Behavioral task
behavioral23
Sample
resources/app/main.js
Resource
win10ltsc2021-20260911-en
windows10-ltsc_2021-x64
Behavioral task
behavioral24
Sample
resources/app/main.js
Resource
win11-20260911-en
windows11-21h2-x64
Behavioral task
behavioral25
Sample
resources/elevate.exe
Resource
win10ltsc2021-20260911-en
windows10-ltsc_2021-x64
Behavioral task
behavioral26
Sample
resources/elevate.exe
Resource
win11-20260911-en
windows11-21h2-x64
Behavioral task
behavioral27
Sample
vk_swiftshader.dll
Resource
win10ltsc2021-20260911-en
windows10-ltsc_2021-x64
Behavioral task
behavioral28
Sample
vk_swiftshader.dll
Resource
win11-20260911-en
windows11-21h2-x64
Behavioral task
behavioral29
Sample
vulkan-1.dll
Resource
win10ltsc2021-20260911-en
windows10-ltsc_2021-x64
Behavioral task
behavioral30
Sample
vulkan-1.dll
Resource
win11-20260911-en
windows11-21h2-x64
Behavioral task
behavioral31
Sample
$PLUGINSDIR/nsis7z.dll
Resource
win10ltsc2021-20260911-en
windows10-ltsc_2021-x64
Behavioral task
behavioral32
Sample
$PLUGINSDIR/nsis7z.dll
Resource
win11-20260911-en
windows11-21h2-x64
General
- Target investigate.exe
- Size 204.0MB
- Sample261023-3kshtsv13l
- SHA256 f9a9f2a00d2b34450b2bac5e25f23bd1789354d29b1227efd2190cad6a4108ba
- MD5 7472fb7037b0a59dde776ec06e26c1b6
- SHA1 5f87a47688fb8f6bb7d7d69db59d8a320baa2b6b
- SHA512 5c71529a14c40132f7f5fe73e7b6951fc062cde95124bb1b53b6c53db4ca152a4a99439500b70c9930bd1451c6c030237b6b79f8163868c93c7f7cb7a987ce97
- SSDEEP 1572864:kUA5i06ZdKezyhS+0geqdEPz9utcH1jZuSbWOTTpuHeAsBeBtCWo7lBJaxzSt+RK:nyU+QNnEcI7K
- TLSH T1EAA88C03E29A41D9C01DD175575A9233FEB1B80A4B24B7DF2B9447522F66EF82B3DB20
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-4003929486-1233426720-3594832368-1000\Control Panel\International\Geo\Nation investigate.exe -
pid Process 4944 investigate.exe - Uses WMI to collect hardware manufacturer information 2 TTPs 1 IoCs
Uses WMI to read the system manufacturer, model, baseboard or display adapter, which is often used to detect virtual machines and evade sandboxes.
pid Process 868 WMIC.exe - Queries system WMI classes for hardware identifiers 2 TTPs 1 IoCs
Uses WMI to read hardware serial numbers or the system UUID, commonly used to fingerprint the victim machine.
pid Process 4344 WMIC.exe - Executes a command shell one-liner 1 TTPs 5 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 2424 cmd.exe 3480 cmd.exe 1080 cmd.exe 4840 cmd.exe 3644 cmd.exe - Reads the TCP/IP host and domain name from the registry 1 TTPs 12 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain investigate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain WMIC.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain WMIC.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname WMIC.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain WMIC.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain investigate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname investigate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname WMIC.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain WMIC.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname WMIC.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname WMIC.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname investigate.exe - Checks processor information in registry 2 TTPs 24 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz investigate.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz investigate.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\~MHz investigate.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\ProcessorNameString investigate.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\ProcessorNameString investigate.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString investigate.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1 investigate.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString investigate.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\ProcessorNameString investigate.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3 investigate.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\~MHz investigate.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2 investigate.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\~MHz investigate.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\ProcessorNameString investigate.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6 investigate.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7 investigate.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\~MHz investigate.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\ProcessorNameString investigate.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 investigate.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4 investigate.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\~MHz investigate.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\ProcessorNameString investigate.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5 investigate.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\~MHz investigate.exe - Collects information from the system 1 TTPs 1 IoCs
Uses WMIC.exe to find detailed system information.
pid Process 2384 WMIC.exe - Detects videocard installed 1 TTPs 1 IoCs
Uses WMIC.exe to determine videocard installed.
pid Process 1960 WMIC.exe - Runs net.exe
- Suspicious behavior: EnumeratesProcesses 16 IoCs
pid Process 2384 WMIC.exe 2384 WMIC.exe 2384 WMIC.exe 2384 WMIC.exe 1960 WMIC.exe 1960 WMIC.exe 1960 WMIC.exe 1960 WMIC.exe 868 WMIC.exe 868 WMIC.exe 868 WMIC.exe 868 WMIC.exe 4344 WMIC.exe 4344 WMIC.exe 4344 WMIC.exe 4344 WMIC.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 2384 WMIC.exe Token: SeSecurityPrivilege 2384 WMIC.exe Token: SeTakeOwnershipPrivilege 2384 WMIC.exe Token: SeLoadDriverPrivilege 2384 WMIC.exe Token: SeSystemProfilePrivilege 2384 WMIC.exe Token: SeSystemtimePrivilege 2384 WMIC.exe Token: SeProfSingleProcessPrivilege 2384 WMIC.exe Token: SeIncBasePriorityPrivilege 2384 WMIC.exe Token: SeCreatePagefilePrivilege 2384 WMIC.exe Token: SeBackupPrivilege 2384 WMIC.exe Token: SeRestorePrivilege 2384 WMIC.exe Token: SeShutdownPrivilege 2384 WMIC.exe Token: SeDebugPrivilege 2384 WMIC.exe Token: SeSystemEnvironmentPrivilege 2384 WMIC.exe Token: SeRemoteShutdownPrivilege 2384 WMIC.exe Token: SeUndockPrivilege 2384 WMIC.exe Token: SeManageVolumePrivilege 2384 WMIC.exe Token: 33 2384 WMIC.exe Token: 34 2384 WMIC.exe Token: 35 2384 WMIC.exe Token: 36 2384 WMIC.exe Token: SeShutdownPrivilege 4808 investigate.exe Token: SeCreatePagefilePrivilege 4808 investigate.exe Token: SeIncreaseQuotaPrivilege 2384 WMIC.exe Token: SeSecurityPrivilege 2384 WMIC.exe Token: SeTakeOwnershipPrivilege 2384 WMIC.exe Token: SeLoadDriverPrivilege 2384 WMIC.exe Token: SeSystemProfilePrivilege 2384 WMIC.exe Token: SeSystemtimePrivilege 2384 WMIC.exe Token: SeProfSingleProcessPrivilege 2384 WMIC.exe Token: SeIncBasePriorityPrivilege 2384 WMIC.exe Token: SeCreatePagefilePrivilege 2384 WMIC.exe Token: SeBackupPrivilege 2384 WMIC.exe Token: SeRestorePrivilege 2384 WMIC.exe Token: SeShutdownPrivilege 2384 WMIC.exe Token: SeDebugPrivilege 2384 WMIC.exe Token: SeSystemEnvironmentPrivilege 2384 WMIC.exe Token: SeRemoteShutdownPrivilege 2384 WMIC.exe Token: SeUndockPrivilege 2384 WMIC.exe Token: SeManageVolumePrivilege 2384 WMIC.exe Token: 33 2384 WMIC.exe Token: 34 2384 WMIC.exe Token: 35 2384 WMIC.exe Token: 36 2384 WMIC.exe Token: SeIncreaseQuotaPrivilege 1960 WMIC.exe Token: SeSecurityPrivilege 1960 WMIC.exe Token: SeTakeOwnershipPrivilege 1960 WMIC.exe Token: SeLoadDriverPrivilege 1960 WMIC.exe Token: SeSystemProfilePrivilege 1960 WMIC.exe Token: SeSystemtimePrivilege 1960 WMIC.exe Token: SeProfSingleProcessPrivilege 1960 WMIC.exe Token: SeIncBasePriorityPrivilege 1960 WMIC.exe Token: SeCreatePagefilePrivilege 1960 WMIC.exe Token: SeBackupPrivilege 1960 WMIC.exe Token: SeRestorePrivilege 1960 WMIC.exe Token: SeShutdownPrivilege 1960 WMIC.exe Token: SeDebugPrivilege 1960 WMIC.exe Token: SeSystemEnvironmentPrivilege 1960 WMIC.exe Token: SeRemoteShutdownPrivilege 1960 WMIC.exe Token: SeUndockPrivilege 1960 WMIC.exe Token: SeManageVolumePrivilege 1960 WMIC.exe Token: 33 1960 WMIC.exe Token: 34 1960 WMIC.exe Token: 35 1960 WMIC.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 4808 investigate.exe - Suspicious use of WriteProcessMemory 14 IoCs
description pid Process procid_target PID 4808 wrote to memory of 4944 4808 investigate.exe 85 PID 4808 wrote to memory of 4944 4808 investigate.exe 85 PID 4808 wrote to memory of 696 4808 investigate.exe 86 PID 4808 wrote to memory of 3644 4808 investigate.exe 87 PID 3644 wrote to memory of 1460 3644 cmd.exe 89 PID 1460 wrote to memory of 2556 1460 net.exe 90 PID 4808 wrote to memory of 2424 4808 investigate.exe 93 PID 2424 wrote to memory of 2384 2424 cmd.exe 95 PID 4808 wrote to memory of 3480 4808 investigate.exe 96 PID 3480 wrote to memory of 1960 3480 cmd.exe 98 PID 4808 wrote to memory of 1080 4808 investigate.exe 99 PID 1080 wrote to memory of 868 1080 cmd.exe 101 PID 4808 wrote to memory of 4840 4808 investigate.exe 102 PID 4840 wrote to memory of 4344 4840 cmd.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\investigate.exe"C:\Users\Admin\AppData\Local\Temp\investigate.exe"1⤵
- Checks computer location settings
- Reads the TCP/IP host and domain name from the registry
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4808 -
C:\Users\Admin\AppData\Local\Temp\investigate.exe"C:\Users\Admin\AppData\Local\Temp\investigate.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\investigate" --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAAAAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=d3d11-warp-webgl --field-trial-handle=1760,i,3642123610356416156,16568421380162225222,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=1756 /prefetch:22⤵
- Network Service Discovery
PID:4944
-
-
C:\Users\Admin\AppData\Local\Temp\investigate.exe"C:\Users\Admin\AppData\Local\Temp\investigate.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\investigate" --field-trial-handle=1760,i,3642123610356416156,16568421380162225222,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=2264 /prefetch:32⤵
- Reads the TCP/IP host and domain name from the registry
PID:696
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "net session"2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3644 -
C:\Windows\system32\net.exenet session3⤵
- Suspicious use of WriteProcessMemory
PID:1460 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 session4⤵PID:2556
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic logicaldisk get size /value"2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2424 -
C:\Windows\System32\Wbem\WMIC.exewmic logicaldisk get size /value3⤵
- Reads the TCP/IP host and domain name from the registry
- Collects information from the system
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2384
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic path win32_VideoController get name /value"2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3480 -
C:\Windows\System32\Wbem\WMIC.exewmic path win32_VideoController get name /value3⤵
- Reads the TCP/IP host and domain name from the registry
- Detects videocard installed
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1960
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic baseboard get manufacturer,product /value"2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1080 -
C:\Windows\System32\Wbem\WMIC.exewmic baseboard get manufacturer,product /value3⤵
- Uses WMI to collect hardware manufacturer information
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
PID:868
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic bios get serialnumber,version /value"2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4840 -
C:\Windows\System32\Wbem\WMIC.exewmic bios get serialnumber,version /value3⤵
- Queries system WMI classes for hardware identifiers
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
PID:4344
-
-
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
1Windows Command Shell
1Windows Management Instrumentation
2Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Roaming\investigate\Code Cache\wasm\index-dir\temp-index
- Size 48B
- SHA256 149a1fd0846cc73f320e7b74e9a521796ee4d4cccbd6f8b067ef484995ae64f0
- MD5 dad3f7e224762b4a4e66db5d1a422de6
- SHA1 5cb24d8d598273ff2f26a560b572a4b0a1c9b30f
- SHA512 b86e6142961dd99b787212342daa7d82c6959a33595c1abe6f2d33b96faf47b9d4fe935881f9cd01822e34c653c5be877e751e008ca2f45faabd995696fcd39b
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\investigate\Local Storage\leveldb\CURRENT
- Size 16B
- SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
- MD5 46295cac801e5d4857d09837238a6394
- SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
- SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
- MD5 SHA1 SHA512