9ba743108b097264d90ff2acf66bb5f2afa72c5682929ea3820ee36bf9010b25

Analysis

max time kernel
148s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
24/10/2026, 17:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
GHXSTLY Tweaks 1.0.0.exe
Size 71.3MB
Sample261024-wfzb9awsd1
SHA256 9ba743108b097264d90ff2acf66bb5f2afa72c5682929ea3820ee36bf9010b25
MD5 e6b821da12cc011486f2ae5a023d3190
SHA1 82f3034d470ddf2ecb860c9c00ed2d99beefa84b
SHA512 b37ea74dc0e7420b22b229775bd6251f13aa66cd1ac40f628a2a4afbac3ed3ef2f710c038fc632e0413143d2ad286aa38d60de05d0c2aa2139c760cad99a8579
SSDEEP 1572864:Wt9IKPXbvqSuPKLjm4+HQMpNojc/68VYkisNMqhjCLA17:WUKPbvR4Kvm44Q2mCBMqhjCLA17
TLSH
T1E2F7334D95CC802BC46F5AF42AE3AB2251489BFD3D3B7C7A592C995C3F84991CCCC25A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 25 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
3924	powershell.exe
4992	powershell.exe
1092	powershell.exe
4060	powershell.exe
4424	powershell.exe
2460	powershell.exe
2724	powershell.exe
1840	powershell.exe
1584	powershell.exe
1880	powershell.exe
2260	powershell.exe
4900	powershell.exe
1580	powershell.exe
2948	powershell.exe
416	powershell.exe
1308	powershell.exe
2056	powershell.exe
684	powershell.exe
3352	powershell.exe
2512	powershell.exe
1880	powershell.exe
2868	powershell.exe
552	powershell.exe
3196	powershell.exe
2912	powershell.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\Control Panel\International\Geo\Nation	GHXSTLY Tweaks.exe
Key value queried	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\Control Panel\International\Geo\Nation	GHXSTLY Tweaks.exe

Executes dropped EXE 5 IoCs

pid	Process
3464	GHXSTLY Tweaks.exe
3112	GHXSTLY Tweaks.exe
716	GHXSTLY Tweaks.exe
5096	GHXSTLY Tweaks.exe
4844	GHXSTLY Tweaks.exe

Loads dropped DLL 14 IoCs

pid	Process
1044	GHXSTLY Tweaks 1.0.0.exe
1044	GHXSTLY Tweaks 1.0.0.exe
1044	GHXSTLY Tweaks 1.0.0.exe
3464	GHXSTLY Tweaks.exe
3112	GHXSTLY Tweaks.exe
3112	GHXSTLY Tweaks.exe
3112	GHXSTLY Tweaks.exe
3112	GHXSTLY Tweaks.exe
3112	GHXSTLY Tweaks.exe
3112	GHXSTLY Tweaks.exe
716	GHXSTLY Tweaks.exe
5096	GHXSTLY Tweaks.exe
4844	GHXSTLY Tweaks.exe
4844	GHXSTLY Tweaks.exe

Discovers running processes 1 TTPs 9 IoCs

Running process information can be used to identify security tools or plan follow-on actions.

discovery

Process Discovery

T1057

pid	Process
3512	tasklist.exe
932	tasklist.exe
3260	tasklist.exe
2852	tasklist.exe
3240	tasklist.exe
3016	tasklist.exe
388	tasklist.exe
2176	tasklist.exe
4360	tasklist.exe

Queries registry keys for unique system GUIDs 1 TTPs 1 IoCs

Queries the MachineGuid or HwProfileGuid value from the command line, commonly used to create a unique victim ID.

discovery

System Information Discovery

T1082

pid	Process
1788	reg.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 36 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1668	cmd.exe
5092	cmd.exe
4156	cmd.exe
4896	cmd.exe
4404	cmd.exe
1840	cmd.exe
2492	cmd.exe
3696	cmd.exe
1068	cmd.exe
3020	cmd.exe
1788	cmd.exe
2208	cmd.exe
1632	cmd.exe
1536	cmd.exe
4656	cmd.exe
1836	cmd.exe
5016	cmd.exe
3472	cmd.exe
4204	cmd.exe
5112	cmd.exe
2780	cmd.exe
2536	cmd.exe
3512	cmd.exe
3484	cmd.exe
1048	cmd.exe
4764	cmd.exe
4248	cmd.exe
4872	cmd.exe
4516	cmd.exe
2324	cmd.exe
3768	cmd.exe
2420	cmd.exe
4316	cmd.exe
5072	cmd.exe
968	cmd.exe
2724	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	GHXSTLY Tweaks.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	GHXSTLY Tweaks.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	GHXSTLY Tweaks.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	GHXSTLY Tweaks.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GHXSTLY Tweaks 1.0.0.exe

System Time Discovery 1 TTPs 8 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1536	cmd.exe
1048	cmd.exe
4896	cmd.exe
3696	cmd.exe
2420	cmd.exe
1840	cmd.exe
5016	cmd.exe
5072	cmd.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 62 IoCs

pid	Process
4900	powershell.exe
4900	powershell.exe
4900	powershell.exe
4424	powershell.exe
4424	powershell.exe
4424	powershell.exe
2460	powershell.exe
2460	powershell.exe
2460	powershell.exe
416	powershell.exe
416	powershell.exe
416	powershell.exe
1580	powershell.exe
1580	powershell.exe
1580	powershell.exe
1308	powershell.exe
1308	powershell.exe
1308	powershell.exe
2724	powershell.exe
2724	powershell.exe
2724	powershell.exe
2056	powershell.exe
2056	powershell.exe
2056	powershell.exe
684	powershell.exe
684	powershell.exe
684	powershell.exe
2868	powershell.exe
2868	powershell.exe
2868	powershell.exe
552	powershell.exe
552	powershell.exe
3352	powershell.exe
3352	powershell.exe
3196	powershell.exe
3196	powershell.exe
2912	powershell.exe
2912	powershell.exe
2512	powershell.exe
2512	powershell.exe
1840	powershell.exe
1840	powershell.exe
1584	powershell.exe
1584	powershell.exe
1880	powershell.exe
1880	powershell.exe
3924	powershell.exe
3924	powershell.exe
4992	powershell.exe
4992	powershell.exe
1092	powershell.exe
1092	powershell.exe
2260	powershell.exe
2260	powershell.exe
2948	powershell.exe
2948	powershell.exe
4844	GHXSTLY Tweaks.exe
4844	GHXSTLY Tweaks.exe
1880	powershell.exe
1880	powershell.exe
4060	powershell.exe
4060	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeSecurityPrivilege	1044	GHXSTLY Tweaks 1.0.0.exe
Token: SeShutdownPrivilege	3464	GHXSTLY Tweaks.exe
Token: SeCreatePagefilePrivilege	3464	GHXSTLY Tweaks.exe
Token: SeShutdownPrivilege	3464	GHXSTLY Tweaks.exe
Token: SeCreatePagefilePrivilege	3464	GHXSTLY Tweaks.exe
Token: SeShutdownPrivilege	3464	GHXSTLY Tweaks.exe
Token: SeCreatePagefilePrivilege	3464	GHXSTLY Tweaks.exe
Token: SeShutdownPrivilege	3464	GHXSTLY Tweaks.exe
Token: SeCreatePagefilePrivilege	3464	GHXSTLY Tweaks.exe
Token: SeShutdownPrivilege	3464	GHXSTLY Tweaks.exe
Token: SeCreatePagefilePrivilege	3464	GHXSTLY Tweaks.exe
Token: SeDebugPrivilege	3512	tasklist.exe
Token: SeDebugPrivilege	4900	powershell.exe
Token: SeShutdownPrivilege	3464	GHXSTLY Tweaks.exe
Token: SeCreatePagefilePrivilege	3464	GHXSTLY Tweaks.exe
Token: SeShutdownPrivilege	3464	GHXSTLY Tweaks.exe
Token: SeCreatePagefilePrivilege	3464	GHXSTLY Tweaks.exe
Token: SeShutdownPrivilege	3464	GHXSTLY Tweaks.exe
Token: SeCreatePagefilePrivilege	3464	GHXSTLY Tweaks.exe
Token: SeDebugPrivilege	4424	powershell.exe
Token: SeShutdownPrivilege	3464	GHXSTLY Tweaks.exe
Token: SeCreatePagefilePrivilege	3464	GHXSTLY Tweaks.exe
Token: SeIncreaseQuotaPrivilege	4424	powershell.exe
Token: SeSecurityPrivilege	4424	powershell.exe
Token: SeTakeOwnershipPrivilege	4424	powershell.exe
Token: SeLoadDriverPrivilege	4424	powershell.exe
Token: SeSystemProfilePrivilege	4424	powershell.exe
Token: SeSystemtimePrivilege	4424	powershell.exe
Token: SeProfSingleProcessPrivilege	4424	powershell.exe
Token: SeIncBasePriorityPrivilege	4424	powershell.exe
Token: SeCreatePagefilePrivilege	4424	powershell.exe
Token: SeBackupPrivilege	4424	powershell.exe
Token: SeRestorePrivilege	4424	powershell.exe
Token: SeShutdownPrivilege	4424	powershell.exe
Token: SeDebugPrivilege	4424	powershell.exe
Token: SeSystemEnvironmentPrivilege	4424	powershell.exe
Token: SeRemoteShutdownPrivilege	4424	powershell.exe
Token: SeUndockPrivilege	4424	powershell.exe
Token: SeManageVolumePrivilege	4424	powershell.exe
Token: 33	4424	powershell.exe
Token: 34	4424	powershell.exe
Token: 35	4424	powershell.exe
Token: 36	4424	powershell.exe
Token: SeIncreaseQuotaPrivilege	4424	powershell.exe
Token: SeSecurityPrivilege	4424	powershell.exe
Token: SeTakeOwnershipPrivilege	4424	powershell.exe
Token: SeLoadDriverPrivilege	4424	powershell.exe
Token: SeSystemProfilePrivilege	4424	powershell.exe
Token: SeSystemtimePrivilege	4424	powershell.exe
Token: SeProfSingleProcessPrivilege	4424	powershell.exe
Token: SeIncBasePriorityPrivilege	4424	powershell.exe
Token: SeCreatePagefilePrivilege	4424	powershell.exe
Token: SeBackupPrivilege	4424	powershell.exe
Token: SeRestorePrivilege	4424	powershell.exe
Token: SeShutdownPrivilege	4424	powershell.exe
Token: SeDebugPrivilege	4424	powershell.exe
Token: SeSystemEnvironmentPrivilege	4424	powershell.exe
Token: SeRemoteShutdownPrivilege	4424	powershell.exe
Token: SeUndockPrivilege	4424	powershell.exe
Token: SeManageVolumePrivilege	4424	powershell.exe
Token: 33	4424	powershell.exe
Token: 34	4424	powershell.exe
Token: 35	4424	powershell.exe
Token: 36	4424	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1044 wrote to memory of 3464	1044	GHXSTLY Tweaks 1.0.0.exe	93
PID 3464 wrote to memory of 3112	3464	GHXSTLY Tweaks.exe	94
PID 3464 wrote to memory of 3112	3464	GHXSTLY Tweaks.exe	94
PID 3464 wrote to memory of 716	3464	GHXSTLY Tweaks.exe	95
PID 3464 wrote to memory of 5096	3464	GHXSTLY Tweaks.exe	96
PID 3464 wrote to memory of 5096	3464	GHXSTLY Tweaks.exe	96
PID 3464 wrote to memory of 4656	3464	GHXSTLY Tweaks.exe	97
PID 4656 wrote to memory of 1788	4656	cmd.exe	99
PID 3464 wrote to memory of 5092	3464	GHXSTLY Tweaks.exe	100
PID 5092 wrote to memory of 1684	5092	cmd.exe	102
PID 1684 wrote to memory of 3540	1684	net.exe	103
PID 3464 wrote to memory of 1836	3464	GHXSTLY Tweaks.exe	104
PID 3464 wrote to memory of 3020	3464	GHXSTLY Tweaks.exe	105
PID 3020 wrote to memory of 4900	3020	cmd.exe	108
PID 1836 wrote to memory of 3512	1836	cmd.exe	109
PID 3464 wrote to memory of 5016	3464	GHXSTLY Tweaks.exe	110
PID 5016 wrote to memory of 4424	5016	cmd.exe	112
PID 3464 wrote to memory of 3472	3464	GHXSTLY Tweaks.exe	115
PID 3472 wrote to memory of 2460	3472	cmd.exe	117
PID 3464 wrote to memory of 1788	3464	GHXSTLY Tweaks.exe	118
PID 1788 wrote to memory of 388	1788	cmd.exe	120
PID 3464 wrote to memory of 4156	3464	GHXSTLY Tweaks.exe	121
PID 4156 wrote to memory of 416	4156	cmd.exe	123
PID 3464 wrote to memory of 5072	3464	GHXSTLY Tweaks.exe	124
PID 5072 wrote to memory of 1580	5072	cmd.exe	126
PID 3464 wrote to memory of 2536	3464	GHXSTLY Tweaks.exe	127
PID 2536 wrote to memory of 932	2536	cmd.exe	129
PID 3464 wrote to memory of 4872	3464	GHXSTLY Tweaks.exe	130
PID 4872 wrote to memory of 1308	4872	cmd.exe	132
PID 3464 wrote to memory of 1668	3464	GHXSTLY Tweaks.exe	133
PID 1668 wrote to memory of 2724	1668	cmd.exe	135
PID 3464 wrote to memory of 1536	3464	GHXSTLY Tweaks.exe	136
PID 1536 wrote to memory of 2056	1536	cmd.exe	138
PID 3464 wrote to memory of 3512	3464	GHXSTLY Tweaks.exe	139
PID 3512 wrote to memory of 2176	3512	cmd.exe	141
PID 3464 wrote to memory of 4204	3464	GHXSTLY Tweaks.exe	142
PID 4204 wrote to memory of 684	4204	cmd.exe	144
PID 3464 wrote to memory of 3484	3464	GHXSTLY Tweaks.exe	145
PID 3484 wrote to memory of 2868	3484	cmd.exe	147
PID 3464 wrote to memory of 1048	3464	GHXSTLY Tweaks.exe	148
PID 1048 wrote to memory of 552	1048	cmd.exe	150
PID 3464 wrote to memory of 2208	3464	GHXSTLY Tweaks.exe	151
PID 2208 wrote to memory of 3260	2208	cmd.exe	153
PID 3464 wrote to memory of 968	3464	GHXSTLY Tweaks.exe	154
PID 968 wrote to memory of 3352	968	cmd.exe	156
PID 3464 wrote to memory of 2492	3464	GHXSTLY Tweaks.exe	157
PID 2492 wrote to memory of 3196	2492	cmd.exe	159
PID 3464 wrote to memory of 4896	3464	GHXSTLY Tweaks.exe	160
PID 4896 wrote to memory of 2912	4896	cmd.exe	162
PID 3464 wrote to memory of 4516	3464	GHXSTLY Tweaks.exe	163
PID 4516 wrote to memory of 2852	4516	cmd.exe	165
PID 3464 wrote to memory of 2324	3464	GHXSTLY Tweaks.exe	166
PID 2324 wrote to memory of 2512	2324	cmd.exe	168
PID 3464 wrote to memory of 3768	3464	GHXSTLY Tweaks.exe	169
PID 3768 wrote to memory of 1840	3768	cmd.exe	171
PID 3464 wrote to memory of 3696	3464	GHXSTLY Tweaks.exe	172
PID 3696 wrote to memory of 1584	3696	cmd.exe	174
PID 3464 wrote to memory of 4404	3464	GHXSTLY Tweaks.exe	175
PID 4404 wrote to memory of 3240	4404	cmd.exe	177
PID 3464 wrote to memory of 1632	3464	GHXSTLY Tweaks.exe	178
PID 1632 wrote to memory of 1880	1632	cmd.exe	180
PID 3464 wrote to memory of 4248	3464	GHXSTLY Tweaks.exe	181
PID 4248 wrote to memory of 3924	4248	cmd.exe	183
PID 3464 wrote to memory of 2420	3464	GHXSTLY Tweaks.exe	184

C:\Users\Admin\AppData\Local\Temp\GHXSTLY Tweaks 1.0.0.exe
"C:\Users\Admin\AppData\Local\Temp\GHXSTLY Tweaks 1.0.0.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1044
- C:\Users\Admin\AppData\Local\Temp\3KnJELCi1muR27afqJ58QZWk26Y\GHXSTLY Tweaks.exe
  "C:\Users\Admin\AppData\Local\Temp\3KnJELCi1muR27afqJ58QZWk26Y\GHXSTLY Tweaks.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Loads dropped DLL
  - Reads the TCP/IP host and domain name from the registry
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3464
- - C:\Users\Admin\AppData\Local\Temp\3KnJELCi1muR27afqJ58QZWk26Y\GHXSTLY Tweaks.exe
    "C:\Users\Admin\AppData\Local\Temp\3KnJELCi1muR27afqJ58QZWk26Y\GHXSTLY Tweaks.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\ghxstly-tweaks" --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=1776,i,11625807981606551062,9195974322215886271,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=1768 /prefetch:2
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:3112
- - C:\Users\Admin\AppData\Local\Temp\3KnJELCi1muR27afqJ58QZWk26Y\GHXSTLY Tweaks.exe
    "C:\Users\Admin\AppData\Local\Temp\3KnJELCi1muR27afqJ58QZWk26Y\GHXSTLY Tweaks.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\ghxstly-tweaks" --field-trial-handle=2120,i,11625807981606551062,9195974322215886271,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=2116 /prefetch:3
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Reads the TCP/IP host and domain name from the registry
    PID:716
- - C:\Users\Admin\AppData\Local\Temp\3KnJELCi1muR27afqJ58QZWk26Y\GHXSTLY Tweaks.exe
    "C:\Users\Admin\AppData\Local\Temp\3KnJELCi1muR27afqJ58QZWk26Y\GHXSTLY Tweaks.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\ghxstly-tweaks" --app-path="C:\Users\Admin\AppData\Local\Temp\3KnJELCi1muR27afqJ58QZWk26Y\resources\app.asar" --enable-sandbox --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --field-trial-handle=3116,i,11625807981606551062,9195974322215886271,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=3112 /prefetch:1
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Loads dropped DLL
    PID:5096
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SOFTWARE\Microsoft\Cryptography" /v MachineGuid"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4656
  - - C:\Windows\system32\reg.exe
      reg query "HKLM\SOFTWARE\Microsoft\Cryptography" /v MachineGuid
      4⤵
      Queries registry keys for unique system GUIDs
      PID:1788
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "net session"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5092
  - - C:\Windows\system32\net.exe
      net session
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1684
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        5⤵
        
        PID:3540
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist /FO CSV /NH"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1836
  - - C:\Windows\system32\tasklist.exe
      tasklist /FO CSV /NH
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:3512
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell -WindowStyle Hidden -NoProfile -Command "(Get-Counter '\Processor(_Total)\% Processor Time' -SampleInterval 1 -MaxSamples 2 | Select-Object -ExpandProperty CounterSamples | Select-Object -Last 1).CookedValue""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3020
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -WindowStyle Hidden -NoProfile -Command "(Get-Counter '\Processor(_Total)\% Processor Time' -SampleInterval 1 -MaxSamples 2 | Select-Object -ExpandProperty CounterSamples | Select-Object -Last 1).CookedValue"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4900
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell -WindowStyle Hidden -NoProfile -Command "$gw=(Get-NetRoute -DestinationPrefix '0.0.0.0/0' | Sort-Object RouteMetric | Select-Object -First 1).NextHop; Test-Connection -ComputerName $gw -Count 2 | Measure-Object -Property ResponseTime -Average | Select-Object -ExpandProperty Average""
    3⤵
    - Executes a command shell one-liner
    - System Time Discovery
    - Suspicious use of WriteProcessMemory
    PID:5016
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -WindowStyle Hidden -NoProfile -Command "$gw=(Get-NetRoute -DestinationPrefix '0.0.0.0/0' | Sort-Object RouteMetric | Select-Object -First 1).NextHop; Test-Connection -ComputerName $gw -Count 2 | Measure-Object -Property ResponseTime -Average | Select-Object -ExpandProperty Average"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4424
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell -WindowStyle Hidden -NoProfile -Command "Test-Connection -ComputerName '1.1.1.1' -Count 2 | Measure-Object -Property ResponseTime -Average | Select-Object -ExpandProperty Average""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3472
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -WindowStyle Hidden -NoProfile -Command "Test-Connection -ComputerName '1.1.1.1' -Count 2 | Measure-Object -Property ResponseTime -Average | Select-Object -ExpandProperty Average"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:2460
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist /FO CSV /NH"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1788
  - - C:\Windows\system32\tasklist.exe
      tasklist /FO CSV /NH
      4⤵
      Discovers running processes
      PID:388
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell -WindowStyle Hidden -NoProfile -Command "(Get-Counter '\Processor(_Total)\% Processor Time' -SampleInterval 1 -MaxSamples 2 | Select-Object -ExpandProperty CounterSamples | Select-Object -Last 1).CookedValue""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4156
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -WindowStyle Hidden -NoProfile -Command "(Get-Counter '\Processor(_Total)\% Processor Time' -SampleInterval 1 -MaxSamples 2 | Select-Object -ExpandProperty CounterSamples | Select-Object -Last 1).CookedValue"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:416
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell -WindowStyle Hidden -NoProfile -Command "$gw=(Get-NetRoute -DestinationPrefix '0.0.0.0/0' | Sort-Object RouteMetric | Select-Object -First 1).NextHop; Test-Connection -ComputerName $gw -Count 2 | Measure-Object -Property ResponseTime -Average | Select-Object -ExpandProperty Average""
    3⤵
    - Executes a command shell one-liner
    - System Time Discovery
    - Suspicious use of WriteProcessMemory
    PID:5072
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -WindowStyle Hidden -NoProfile -Command "$gw=(Get-NetRoute -DestinationPrefix '0.0.0.0/0' | Sort-Object RouteMetric | Select-Object -First 1).NextHop; Test-Connection -ComputerName $gw -Count 2 | Measure-Object -Property ResponseTime -Average | Select-Object -ExpandProperty Average"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:1580
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist /FO CSV /NH"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2536
  - - C:\Windows\system32\tasklist.exe
      tasklist /FO CSV /NH
      4⤵
      Discovers running processes
      PID:932
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell -WindowStyle Hidden -NoProfile -Command "Test-Connection -ComputerName '1.1.1.1' -Count 2 | Measure-Object -Property ResponseTime -Average | Select-Object -ExpandProperty Average""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4872
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -WindowStyle Hidden -NoProfile -Command "Test-Connection -ComputerName '1.1.1.1' -Count 2 | Measure-Object -Property ResponseTime -Average | Select-Object -ExpandProperty Average"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:1308
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell -WindowStyle Hidden -NoProfile -Command "(Get-Counter '\Processor(_Total)\% Processor Time' -SampleInterval 1 -MaxSamples 2 | Select-Object -ExpandProperty CounterSamples | Select-Object -Last 1).CookedValue""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1668
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -WindowStyle Hidden -NoProfile -Command "(Get-Counter '\Processor(_Total)\% Processor Time' -SampleInterval 1 -MaxSamples 2 | Select-Object -ExpandProperty CounterSamples | Select-Object -Last 1).CookedValue"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:2724
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell -WindowStyle Hidden -NoProfile -Command "$gw=(Get-NetRoute -DestinationPrefix '0.0.0.0/0' | Sort-Object RouteMetric | Select-Object -First 1).NextHop; Test-Connection -ComputerName $gw -Count 2 | Measure-Object -Property ResponseTime -Average | Select-Object -ExpandProperty Average""
    3⤵
    - Executes a command shell one-liner
    - System Time Discovery
    - Suspicious use of WriteProcessMemory
    PID:1536
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -WindowStyle Hidden -NoProfile -Command "$gw=(Get-NetRoute -DestinationPrefix '0.0.0.0/0' | Sort-Object RouteMetric | Select-Object -First 1).NextHop; Test-Connection -ComputerName $gw -Count 2 | Measure-Object -Property ResponseTime -Average | Select-Object -ExpandProperty Average"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:2056
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist /FO CSV /NH"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3512
  - - C:\Windows\system32\tasklist.exe
      tasklist /FO CSV /NH
      4⤵
      Discovers running processes
      PID:2176
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell -WindowStyle Hidden -NoProfile -Command "Test-Connection -ComputerName '1.1.1.1' -Count 2 | Measure-Object -Property ResponseTime -Average | Select-Object -ExpandProperty Average""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4204
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -WindowStyle Hidden -NoProfile -Command "Test-Connection -ComputerName '1.1.1.1' -Count 2 | Measure-Object -Property ResponseTime -Average | Select-Object -ExpandProperty Average"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:684
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell -WindowStyle Hidden -NoProfile -Command "(Get-Counter '\Processor(_Total)\% Processor Time' -SampleInterval 1 -MaxSamples 2 | Select-Object -ExpandProperty CounterSamples | Select-Object -Last 1).CookedValue""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3484
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -WindowStyle Hidden -NoProfile -Command "(Get-Counter '\Processor(_Total)\% Processor Time' -SampleInterval 1 -MaxSamples 2 | Select-Object -ExpandProperty CounterSamples | Select-Object -Last 1).CookedValue"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:2868
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell -WindowStyle Hidden -NoProfile -Command "$gw=(Get-NetRoute -DestinationPrefix '0.0.0.0/0' | Sort-Object RouteMetric | Select-Object -First 1).NextHop; Test-Connection -ComputerName $gw -Count 2 | Measure-Object -Property ResponseTime -Average | Select-Object -ExpandProperty Average""
    3⤵
    - Executes a command shell one-liner
    - System Time Discovery
    - Suspicious use of WriteProcessMemory
    PID:1048
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -WindowStyle Hidden -NoProfile -Command "$gw=(Get-NetRoute -DestinationPrefix '0.0.0.0/0' | Sort-Object RouteMetric | Select-Object -First 1).NextHop; Test-Connection -ComputerName $gw -Count 2 | Measure-Object -Property ResponseTime -Average | Select-Object -ExpandProperty Average"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:552
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist /FO CSV /NH"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2208
  - - C:\Windows\system32\tasklist.exe
      tasklist /FO CSV /NH
      4⤵
      Discovers running processes
      PID:3260
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell -WindowStyle Hidden -NoProfile -Command "Test-Connection -ComputerName '1.1.1.1' -Count 2 | Measure-Object -Property ResponseTime -Average | Select-Object -ExpandProperty Average""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:968
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -WindowStyle Hidden -NoProfile -Command "Test-Connection -ComputerName '1.1.1.1' -Count 2 | Measure-Object -Property ResponseTime -Average | Select-Object -ExpandProperty Average"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:3352
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell -WindowStyle Hidden -NoProfile -Command "(Get-Counter '\Processor(_Total)\% Processor Time' -SampleInterval 1 -MaxSamples 2 | Select-Object -ExpandProperty CounterSamples | Select-Object -Last 1).CookedValue""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2492
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -WindowStyle Hidden -NoProfile -Command "(Get-Counter '\Processor(_Total)\% Processor Time' -SampleInterval 1 -MaxSamples 2 | Select-Object -ExpandProperty CounterSamples | Select-Object -Last 1).CookedValue"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:3196
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell -WindowStyle Hidden -NoProfile -Command "$gw=(Get-NetRoute -DestinationPrefix '0.0.0.0/0' | Sort-Object RouteMetric | Select-Object -First 1).NextHop; Test-Connection -ComputerName $gw -Count 2 | Measure-Object -Property ResponseTime -Average | Select-Object -ExpandProperty Average""
    3⤵
    - Executes a command shell one-liner
    - System Time Discovery
    - Suspicious use of WriteProcessMemory
    PID:4896
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -WindowStyle Hidden -NoProfile -Command "$gw=(Get-NetRoute -DestinationPrefix '0.0.0.0/0' | Sort-Object RouteMetric | Select-Object -First 1).NextHop; Test-Connection -ComputerName $gw -Count 2 | Measure-Object -Property ResponseTime -Average | Select-Object -ExpandProperty Average"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:2912
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist /FO CSV /NH"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4516
  - - C:\Windows\system32\tasklist.exe
      tasklist /FO CSV /NH
      4⤵
      Discovers running processes
      PID:2852
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell -WindowStyle Hidden -NoProfile -Command "Test-Connection -ComputerName '1.1.1.1' -Count 2 | Measure-Object -Property ResponseTime -Average | Select-Object -ExpandProperty Average""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2324
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -WindowStyle Hidden -NoProfile -Command "Test-Connection -ComputerName '1.1.1.1' -Count 2 | Measure-Object -Property ResponseTime -Average | Select-Object -ExpandProperty Average"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:2512
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell -WindowStyle Hidden -NoProfile -Command "(Get-Counter '\Processor(_Total)\% Processor Time' -SampleInterval 1 -MaxSamples 2 | Select-Object -ExpandProperty CounterSamples | Select-Object -Last 1).CookedValue""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3768
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -WindowStyle Hidden -NoProfile -Command "(Get-Counter '\Processor(_Total)\% Processor Time' -SampleInterval 1 -MaxSamples 2 | Select-Object -ExpandProperty CounterSamples | Select-Object -Last 1).CookedValue"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:1840
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell -WindowStyle Hidden -NoProfile -Command "$gw=(Get-NetRoute -DestinationPrefix '0.0.0.0/0' | Sort-Object RouteMetric | Select-Object -First 1).NextHop; Test-Connection -ComputerName $gw -Count 2 | Measure-Object -Property ResponseTime -Average | Select-Object -ExpandProperty Average""
    3⤵
    - Executes a command shell one-liner
    - System Time Discovery
    - Suspicious use of WriteProcessMemory
    PID:3696
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -WindowStyle Hidden -NoProfile -Command "$gw=(Get-NetRoute -DestinationPrefix '0.0.0.0/0' | Sort-Object RouteMetric | Select-Object -First 1).NextHop; Test-Connection -ComputerName $gw -Count 2 | Measure-Object -Property ResponseTime -Average | Select-Object -ExpandProperty Average"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:1584
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist /FO CSV /NH"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4404
  - - C:\Windows\system32\tasklist.exe
      tasklist /FO CSV /NH
      4⤵
      Discovers running processes
      PID:3240
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell -WindowStyle Hidden -NoProfile -Command "Test-Connection -ComputerName '1.1.1.1' -Count 2 | Measure-Object -Property ResponseTime -Average | Select-Object -ExpandProperty Average""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1632
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -WindowStyle Hidden -NoProfile -Command "Test-Connection -ComputerName '1.1.1.1' -Count 2 | Measure-Object -Property ResponseTime -Average | Select-Object -ExpandProperty Average"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:1880
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell -WindowStyle Hidden -NoProfile -Command "(Get-Counter '\Processor(_Total)\% Processor Time' -SampleInterval 1 -MaxSamples 2 | Select-Object -ExpandProperty CounterSamples | Select-Object -Last 1).CookedValue""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4248
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -WindowStyle Hidden -NoProfile -Command "(Get-Counter '\Processor(_Total)\% Processor Time' -SampleInterval 1 -MaxSamples 2 | Select-Object -ExpandProperty CounterSamples | Select-Object -Last 1).CookedValue"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:3924
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell -WindowStyle Hidden -NoProfile -Command "$gw=(Get-NetRoute -DestinationPrefix '0.0.0.0/0' | Sort-Object RouteMetric | Select-Object -First 1).NextHop; Test-Connection -ComputerName $gw -Count 2 | Measure-Object -Property ResponseTime -Average | Select-Object -ExpandProperty Average""
    3⤵
    - Executes a command shell one-liner
    - System Time Discovery
    PID:2420
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -WindowStyle Hidden -NoProfile -Command "$gw=(Get-NetRoute -DestinationPrefix '0.0.0.0/0' | Sort-Object RouteMetric | Select-Object -First 1).NextHop; Test-Connection -ComputerName $gw -Count 2 | Measure-Object -Property ResponseTime -Average | Select-Object -ExpandProperty Average"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:4992
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist /FO CSV /NH"
    3⤵
    - Executes a command shell one-liner
    PID:4316
  - - C:\Windows\system32\tasklist.exe
      tasklist /FO CSV /NH
      4⤵
      Discovers running processes
      PID:4360
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell -WindowStyle Hidden -NoProfile -Command "Test-Connection -ComputerName '1.1.1.1' -Count 2 | Measure-Object -Property ResponseTime -Average | Select-Object -ExpandProperty Average""
    3⤵
    - Executes a command shell one-liner
    PID:4764
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -WindowStyle Hidden -NoProfile -Command "Test-Connection -ComputerName '1.1.1.1' -Count 2 | Measure-Object -Property ResponseTime -Average | Select-Object -ExpandProperty Average"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:1092
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell -WindowStyle Hidden -NoProfile -Command "(Get-Counter '\Processor(_Total)\% Processor Time' -SampleInterval 1 -MaxSamples 2 | Select-Object -ExpandProperty CounterSamples | Select-Object -Last 1).CookedValue""
    3⤵
    - Executes a command shell one-liner
    PID:2724
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -WindowStyle Hidden -NoProfile -Command "(Get-Counter '\Processor(_Total)\% Processor Time' -SampleInterval 1 -MaxSamples 2 | Select-Object -ExpandProperty CounterSamples | Select-Object -Last 1).CookedValue"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:2260
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell -WindowStyle Hidden -NoProfile -Command "$gw=(Get-NetRoute -DestinationPrefix '0.0.0.0/0' | Sort-Object RouteMetric | Select-Object -First 1).NextHop; Test-Connection -ComputerName $gw -Count 2 | Measure-Object -Property ResponseTime -Average | Select-Object -ExpandProperty Average""
    3⤵
    - Executes a command shell one-liner
    - System Time Discovery
    PID:1840
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -WindowStyle Hidden -NoProfile -Command "$gw=(Get-NetRoute -DestinationPrefix '0.0.0.0/0' | Sort-Object RouteMetric | Select-Object -First 1).NextHop; Test-Connection -ComputerName $gw -Count 2 | Measure-Object -Property ResponseTime -Average | Select-Object -ExpandProperty Average"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:2948
- - C:\Users\Admin\AppData\Local\Temp\3KnJELCi1muR27afqJ58QZWk26Y\GHXSTLY Tweaks.exe
    "C:\Users\Admin\AppData\Local\Temp\3KnJELCi1muR27afqJ58QZWk26Y\GHXSTLY Tweaks.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --user-data-dir="C:\Users\Admin\AppData\Roaming\ghxstly-tweaks" --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=3472,i,11625807981606551062,9195974322215886271,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=3356 /prefetch:8
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    PID:4844
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist /FO CSV /NH"
    3⤵
    - Executes a command shell one-liner
    PID:1068
  - - C:\Windows\system32\tasklist.exe
      tasklist /FO CSV /NH
      4⤵
      Discovers running processes
      PID:3016
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell -WindowStyle Hidden -NoProfile -Command "Test-Connection -ComputerName '1.1.1.1' -Count 2 | Measure-Object -Property ResponseTime -Average | Select-Object -ExpandProperty Average""
    3⤵
    - Executes a command shell one-liner
    PID:5112
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -WindowStyle Hidden -NoProfile -Command "Test-Connection -ComputerName '1.1.1.1' -Count 2 | Measure-Object -Property ResponseTime -Average | Select-Object -ExpandProperty Average"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:1880
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell -WindowStyle Hidden -NoProfile -Command "(Get-Counter '\Processor(_Total)\% Processor Time' -SampleInterval 1 -MaxSamples 2 | Select-Object -ExpandProperty CounterSamples | Select-Object -Last 1).CookedValue""
    3⤵
    - Executes a command shell one-liner
    PID:2780
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -WindowStyle Hidden -NoProfile -Command "(Get-Counter '\Processor(_Total)\% Processor Time' -SampleInterval 1 -MaxSamples 2 | Select-Object -ExpandProperty CounterSamples | Select-Object -Last 1).CookedValue"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:4060

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...