9ba743108b097264d90ff2acf66bb5f2afa72c5682929ea3820ee36bf9010b25

Analysis

max time kernel
134s
max time network
130s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/10/2026, 17:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
GHXSTLY Tweaks 1.0.0.exe
Size 71.3MB
Sample261024-wfzb9awsd1
SHA256 9ba743108b097264d90ff2acf66bb5f2afa72c5682929ea3820ee36bf9010b25
MD5 e6b821da12cc011486f2ae5a023d3190
SHA1 82f3034d470ddf2ecb860c9c00ed2d99beefa84b
SHA512 b37ea74dc0e7420b22b229775bd6251f13aa66cd1ac40f628a2a4afbac3ed3ef2f710c038fc632e0413143d2ad286aa38d60de05d0c2aa2139c760cad99a8579
SSDEEP 1572864:Wt9IKPXbvqSuPKLjm4+HQMpNojc/68VYkisNMqhjCLA17:WUKPbvR4Kvm44Q2mCBMqhjCLA17
TLSH
T1E2F7334D95CC802BC46F5AF42AE3AB2251489BFD3D3B7C7A592C995C3F84991CCCC25A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 21 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
4476	powershell.exe
5476	powershell.exe
4860	powershell.exe
4056	powershell.exe
5068	powershell.exe
1960	powershell.exe
4724	powershell.exe
1852	powershell.exe
6048	powershell.exe
4472	powershell.exe
4900	powershell.exe
2292	powershell.exe
5768	powershell.exe
2632	powershell.exe
5772	powershell.exe
4668	powershell.exe
3080	powershell.exe
3292	powershell.exe
5052	powershell.exe
1848	powershell.exe
1116	powershell.exe

Executes dropped EXE 4 IoCs

pid	Process
4468	GHXSTLY Tweaks.exe
6092	GHXSTLY Tweaks.exe
1232	GHXSTLY Tweaks.exe
4512	GHXSTLY Tweaks.exe

Loads dropped DLL 12 IoCs

pid	Process
4448	GHXSTLY Tweaks 1.0.0.exe
4448	GHXSTLY Tweaks 1.0.0.exe
4448	GHXSTLY Tweaks 1.0.0.exe
4468	GHXSTLY Tweaks.exe
6092	GHXSTLY Tweaks.exe
1232	GHXSTLY Tweaks.exe
6092	GHXSTLY Tweaks.exe
6092	GHXSTLY Tweaks.exe
6092	GHXSTLY Tweaks.exe
6092	GHXSTLY Tweaks.exe
6092	GHXSTLY Tweaks.exe
4512	GHXSTLY Tweaks.exe

Discovers running processes 1 TTPs 9 IoCs

Running process information can be used to identify security tools or plan follow-on actions.

discovery

Process Discovery

T1057

pid	Process
4284	tasklist.exe
5040	tasklist.exe
4152	tasklist.exe
4908	tasklist.exe
5828	tasklist.exe
2684	tasklist.exe
552	tasklist.exe
3436	tasklist.exe
4816	tasklist.exe

Queries registry keys for unique system GUIDs 1 TTPs 1 IoCs

Queries the MachineGuid or HwProfileGuid value from the command line, commonly used to create a unique victim ID.

discovery

System Information Discovery

T1082

pid	Process
1600	reg.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 32 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2808	cmd.exe
3552	cmd.exe
5192	cmd.exe
460	cmd.exe
5188	cmd.exe
2732	cmd.exe
4600	cmd.exe
5484	cmd.exe
3840	cmd.exe
5920	cmd.exe
4336	cmd.exe
5460	cmd.exe
5980	cmd.exe
3284	cmd.exe
916	cmd.exe
2708	cmd.exe
676	cmd.exe
4732	cmd.exe
4460	cmd.exe
3816	cmd.exe
3184	cmd.exe
2064	cmd.exe
1300	cmd.exe
4036	cmd.exe
4616	cmd.exe
424	cmd.exe
3452	cmd.exe
2088	cmd.exe
3104	cmd.exe
3096	cmd.exe
2300	cmd.exe
4444	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	GHXSTLY Tweaks.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	GHXSTLY Tweaks.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	GHXSTLY Tweaks.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	GHXSTLY Tweaks.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GHXSTLY Tweaks 1.0.0.exe

System Time Discovery 1 TTPs 7 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4336	cmd.exe
2808	cmd.exe
4600	cmd.exe
3552	cmd.exe
3184	cmd.exe
2300	cmd.exe
2708	cmd.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 57 IoCs

pid	Process
1848	powershell.exe
1848	powershell.exe
1848	powershell.exe
4056	powershell.exe
4056	powershell.exe
4056	powershell.exe
1116	powershell.exe
1116	powershell.exe
1116	powershell.exe
2292	powershell.exe
2292	powershell.exe
2292	powershell.exe
5068	powershell.exe
5068	powershell.exe
5068	powershell.exe
1960	powershell.exe
1960	powershell.exe
1960	powershell.exe
4724	powershell.exe
4724	powershell.exe
4724	powershell.exe
1852	powershell.exe
1852	powershell.exe
1852	powershell.exe
5768	powershell.exe
5768	powershell.exe
5768	powershell.exe
2632	powershell.exe
2632	powershell.exe
2632	powershell.exe
4476	powershell.exe
4476	powershell.exe
4476	powershell.exe
6048	powershell.exe
6048	powershell.exe
6048	powershell.exe
5052	powershell.exe
5052	powershell.exe
5052	powershell.exe
4472	powershell.exe
4472	powershell.exe
4472	powershell.exe
5476	powershell.exe
5476	powershell.exe
5476	powershell.exe
5772	powershell.exe
5772	powershell.exe
5772	powershell.exe
4860	powershell.exe
4860	powershell.exe
4860	powershell.exe
4900	powershell.exe
4900	powershell.exe
4900	powershell.exe
4668	powershell.exe
4668	powershell.exe
4668	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeSecurityPrivilege	4448	GHXSTLY Tweaks 1.0.0.exe
Token: SeShutdownPrivilege	4468	GHXSTLY Tweaks.exe
Token: SeCreatePagefilePrivilege	4468	GHXSTLY Tweaks.exe
Token: SeShutdownPrivilege	4468	GHXSTLY Tweaks.exe
Token: SeCreatePagefilePrivilege	4468	GHXSTLY Tweaks.exe
Token: SeDebugPrivilege	4152	tasklist.exe
Token: SeDebugPrivilege	1848	powershell.exe
Token: SeShutdownPrivilege	4468	GHXSTLY Tweaks.exe
Token: SeCreatePagefilePrivilege	4468	GHXSTLY Tweaks.exe
Token: SeShutdownPrivilege	4468	GHXSTLY Tweaks.exe
Token: SeCreatePagefilePrivilege	4468	GHXSTLY Tweaks.exe
Token: SeShutdownPrivilege	4468	GHXSTLY Tweaks.exe
Token: SeCreatePagefilePrivilege	4468	GHXSTLY Tweaks.exe
Token: SeShutdownPrivilege	4468	GHXSTLY Tweaks.exe
Token: SeCreatePagefilePrivilege	4468	GHXSTLY Tweaks.exe
Token: SeDebugPrivilege	4056	powershell.exe
Token: SeShutdownPrivilege	4468	GHXSTLY Tweaks.exe
Token: SeCreatePagefilePrivilege	4468	GHXSTLY Tweaks.exe
Token: SeShutdownPrivilege	4468	GHXSTLY Tweaks.exe
Token: SeCreatePagefilePrivilege	4468	GHXSTLY Tweaks.exe
Token: SeIncreaseQuotaPrivilege	4056	powershell.exe
Token: SeSecurityPrivilege	4056	powershell.exe
Token: SeTakeOwnershipPrivilege	4056	powershell.exe
Token: SeLoadDriverPrivilege	4056	powershell.exe
Token: SeSystemProfilePrivilege	4056	powershell.exe
Token: SeSystemtimePrivilege	4056	powershell.exe
Token: SeProfSingleProcessPrivilege	4056	powershell.exe
Token: SeIncBasePriorityPrivilege	4056	powershell.exe
Token: SeCreatePagefilePrivilege	4056	powershell.exe
Token: SeBackupPrivilege	4056	powershell.exe
Token: SeRestorePrivilege	4056	powershell.exe
Token: SeShutdownPrivilege	4056	powershell.exe
Token: SeDebugPrivilege	4056	powershell.exe
Token: SeSystemEnvironmentPrivilege	4056	powershell.exe
Token: SeRemoteShutdownPrivilege	4056	powershell.exe
Token: SeUndockPrivilege	4056	powershell.exe
Token: SeManageVolumePrivilege	4056	powershell.exe
Token: 33	4056	powershell.exe
Token: 34	4056	powershell.exe
Token: 35	4056	powershell.exe
Token: 36	4056	powershell.exe
Token: SeIncreaseQuotaPrivilege	4056	powershell.exe
Token: SeSecurityPrivilege	4056	powershell.exe
Token: SeTakeOwnershipPrivilege	4056	powershell.exe
Token: SeLoadDriverPrivilege	4056	powershell.exe
Token: SeSystemProfilePrivilege	4056	powershell.exe
Token: SeSystemtimePrivilege	4056	powershell.exe
Token: SeProfSingleProcessPrivilege	4056	powershell.exe
Token: SeIncBasePriorityPrivilege	4056	powershell.exe
Token: SeCreatePagefilePrivilege	4056	powershell.exe
Token: SeBackupPrivilege	4056	powershell.exe
Token: SeRestorePrivilege	4056	powershell.exe
Token: SeShutdownPrivilege	4056	powershell.exe
Token: SeDebugPrivilege	4056	powershell.exe
Token: SeSystemEnvironmentPrivilege	4056	powershell.exe
Token: SeRemoteShutdownPrivilege	4056	powershell.exe
Token: SeUndockPrivilege	4056	powershell.exe
Token: SeManageVolumePrivilege	4056	powershell.exe
Token: 33	4056	powershell.exe
Token: 34	4056	powershell.exe
Token: 35	4056	powershell.exe
Token: 36	4056	powershell.exe
Token: SeIncreaseQuotaPrivilege	4056	powershell.exe
Token: SeSecurityPrivilege	4056	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4448 wrote to memory of 4468	4448	GHXSTLY Tweaks 1.0.0.exe	90
PID 4468 wrote to memory of 6092	4468	GHXSTLY Tweaks.exe	91
PID 4468 wrote to memory of 6092	4468	GHXSTLY Tweaks.exe	91
PID 4468 wrote to memory of 1232	4468	GHXSTLY Tweaks.exe	92
PID 4468 wrote to memory of 4512	4468	GHXSTLY Tweaks.exe	93
PID 4468 wrote to memory of 4512	4468	GHXSTLY Tweaks.exe	93
PID 4468 wrote to memory of 3840	4468	GHXSTLY Tweaks.exe	94
PID 3840 wrote to memory of 1600	3840	cmd.exe	96
PID 4468 wrote to memory of 2064	4468	GHXSTLY Tweaks.exe	97
PID 2064 wrote to memory of 1676	2064	cmd.exe	99
PID 1676 wrote to memory of 5452	1676	net.exe	100
PID 4468 wrote to memory of 1300	4468	GHXSTLY Tweaks.exe	101
PID 4468 wrote to memory of 5920	4468	GHXSTLY Tweaks.exe	102
PID 5920 wrote to memory of 1848	5920	cmd.exe	105
PID 1300 wrote to memory of 4152	1300	cmd.exe	106
PID 4468 wrote to memory of 2708	4468	GHXSTLY Tweaks.exe	108
PID 2708 wrote to memory of 4056	2708	cmd.exe	110
PID 4468 wrote to memory of 5188	4468	GHXSTLY Tweaks.exe	112
PID 5188 wrote to memory of 4284	5188	cmd.exe	114
PID 4468 wrote to memory of 4036	4468	GHXSTLY Tweaks.exe	115
PID 4036 wrote to memory of 1116	4036	cmd.exe	117
PID 4468 wrote to memory of 3452	4468	GHXSTLY Tweaks.exe	118
PID 3452 wrote to memory of 2292	3452	cmd.exe	120
PID 4468 wrote to memory of 4336	4468	GHXSTLY Tweaks.exe	121
PID 4336 wrote to memory of 5068	4336	cmd.exe	123
PID 4468 wrote to memory of 4460	4468	GHXSTLY Tweaks.exe	124
PID 4460 wrote to memory of 4908	4460	cmd.exe	126
PID 4468 wrote to memory of 4616	4468	GHXSTLY Tweaks.exe	127
PID 4616 wrote to memory of 1960	4616	cmd.exe	129
PID 4468 wrote to memory of 5460	4468	GHXSTLY Tweaks.exe	130
PID 5460 wrote to memory of 4724	5460	cmd.exe	132
PID 4468 wrote to memory of 2808	4468	GHXSTLY Tweaks.exe	133
PID 2808 wrote to memory of 1852	2808	cmd.exe	135
PID 4468 wrote to memory of 2732	4468	GHXSTLY Tweaks.exe	136
PID 2732 wrote to memory of 5828	2732	cmd.exe	138
PID 4468 wrote to memory of 424	4468	GHXSTLY Tweaks.exe	139
PID 424 wrote to memory of 5768	424	cmd.exe	141
PID 4468 wrote to memory of 5980	4468	GHXSTLY Tweaks.exe	142
PID 5980 wrote to memory of 5040	5980	cmd.exe	144
PID 4468 wrote to memory of 3816	4468	GHXSTLY Tweaks.exe	145
PID 3816 wrote to memory of 2632	3816	cmd.exe	147
PID 4468 wrote to memory of 4600	4468	GHXSTLY Tweaks.exe	148
PID 4600 wrote to memory of 4476	4600	cmd.exe	150
PID 4468 wrote to memory of 3104	4468	GHXSTLY Tweaks.exe	151
PID 3104 wrote to memory of 6048	3104	cmd.exe	153
PID 4468 wrote to memory of 3096	4468	GHXSTLY Tweaks.exe	154
PID 3096 wrote to memory of 2684	3096	cmd.exe	156
PID 4468 wrote to memory of 3284	4468	GHXSTLY Tweaks.exe	157
PID 3284 wrote to memory of 5052	3284	cmd.exe	159
PID 4468 wrote to memory of 3552	4468	GHXSTLY Tweaks.exe	160
PID 3552 wrote to memory of 4472	3552	cmd.exe	162
PID 4468 wrote to memory of 5484	4468	GHXSTLY Tweaks.exe	163
PID 5484 wrote to memory of 5476	5484	cmd.exe	165
PID 4468 wrote to memory of 676	4468	GHXSTLY Tweaks.exe	166
PID 676 wrote to memory of 552	676	cmd.exe	168
PID 4468 wrote to memory of 5192	4468	GHXSTLY Tweaks.exe	169
PID 5192 wrote to memory of 5772	5192	cmd.exe	171
PID 4468 wrote to memory of 3184	4468	GHXSTLY Tweaks.exe	172
PID 3184 wrote to memory of 4860	3184	cmd.exe	174
PID 4468 wrote to memory of 2088	4468	GHXSTLY Tweaks.exe	175
PID 2088 wrote to memory of 3436	2088	cmd.exe	177
PID 4468 wrote to memory of 460	4468	GHXSTLY Tweaks.exe	178
PID 460 wrote to memory of 4900	460	cmd.exe	180
PID 4468 wrote to memory of 916	4468	GHXSTLY Tweaks.exe	181

C:\Users\Admin\AppData\Local\Temp\GHXSTLY Tweaks 1.0.0.exe
"C:\Users\Admin\AppData\Local\Temp\GHXSTLY Tweaks 1.0.0.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4448
- C:\Users\Admin\AppData\Local\Temp\3KnJELCi1muR27afqJ58QZWk26Y\GHXSTLY Tweaks.exe
  "C:\Users\Admin\AppData\Local\Temp\3KnJELCi1muR27afqJ58QZWk26Y\GHXSTLY Tweaks.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Reads the TCP/IP host and domain name from the registry
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4468
- - C:\Users\Admin\AppData\Local\Temp\3KnJELCi1muR27afqJ58QZWk26Y\GHXSTLY Tweaks.exe
    "C:\Users\Admin\AppData\Local\Temp\3KnJELCi1muR27afqJ58QZWk26Y\GHXSTLY Tweaks.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\ghxstly-tweaks" --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=1764,i,11702911479229498544,5236396504102787236,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=1756 /prefetch:2
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:6092
- - C:\Users\Admin\AppData\Local\Temp\3KnJELCi1muR27afqJ58QZWk26Y\GHXSTLY Tweaks.exe
    "C:\Users\Admin\AppData\Local\Temp\3KnJELCi1muR27afqJ58QZWk26Y\GHXSTLY Tweaks.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\ghxstly-tweaks" --field-trial-handle=2004,i,11702911479229498544,5236396504102787236,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=2000 /prefetch:11
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Reads the TCP/IP host and domain name from the registry
    PID:1232
- - C:\Users\Admin\AppData\Local\Temp\3KnJELCi1muR27afqJ58QZWk26Y\GHXSTLY Tweaks.exe
    "C:\Users\Admin\AppData\Local\Temp\3KnJELCi1muR27afqJ58QZWk26Y\GHXSTLY Tweaks.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\ghxstly-tweaks" --app-path="C:\Users\Admin\AppData\Local\Temp\3KnJELCi1muR27afqJ58QZWk26Y\resources\app.asar" --enable-sandbox --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --field-trial-handle=3132,i,11702911479229498544,5236396504102787236,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=3128 /prefetch:1
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:4512
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SOFTWARE\Microsoft\Cryptography" /v MachineGuid"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3840
  - - C:\Windows\system32\reg.exe
      reg query "HKLM\SOFTWARE\Microsoft\Cryptography" /v MachineGuid
      4⤵
      Queries registry keys for unique system GUIDs
      PID:1600
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "net session"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2064
  - - C:\Windows\system32\net.exe
      net session
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1676
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        5⤵
        
        PID:5452
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist /FO CSV /NH"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1300
  - - C:\Windows\system32\tasklist.exe
      tasklist /FO CSV /NH
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:4152
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell -WindowStyle Hidden -NoProfile -Command "(Get-Counter '\Processor(_Total)\% Processor Time' -SampleInterval 1 -MaxSamples 2 | Select-Object -ExpandProperty CounterSamples | Select-Object -Last 1).CookedValue""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5920
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -WindowStyle Hidden -NoProfile -Command "(Get-Counter '\Processor(_Total)\% Processor Time' -SampleInterval 1 -MaxSamples 2 | Select-Object -ExpandProperty CounterSamples | Select-Object -Last 1).CookedValue"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1848
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell -WindowStyle Hidden -NoProfile -Command "$gw=(Get-NetRoute -DestinationPrefix '0.0.0.0/0' | Sort-Object RouteMetric | Select-Object -First 1).NextHop; Test-Connection -ComputerName $gw -Count 2 | Measure-Object -Property ResponseTime -Average | Select-Object -ExpandProperty Average""
    3⤵
    - Executes a command shell one-liner
    - System Time Discovery
    - Suspicious use of WriteProcessMemory
    PID:2708
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -WindowStyle Hidden -NoProfile -Command "$gw=(Get-NetRoute -DestinationPrefix '0.0.0.0/0' | Sort-Object RouteMetric | Select-Object -First 1).NextHop; Test-Connection -ComputerName $gw -Count 2 | Measure-Object -Property ResponseTime -Average | Select-Object -ExpandProperty Average"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4056
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist /FO CSV /NH"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5188
  - - C:\Windows\system32\tasklist.exe
      tasklist /FO CSV /NH
      4⤵
      Discovers running processes
      PID:4284
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell -WindowStyle Hidden -NoProfile -Command "Test-Connection -ComputerName '1.1.1.1' -Count 2 | Measure-Object -Property ResponseTime -Average | Select-Object -ExpandProperty Average""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4036
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -WindowStyle Hidden -NoProfile -Command "Test-Connection -ComputerName '1.1.1.1' -Count 2 | Measure-Object -Property ResponseTime -Average | Select-Object -ExpandProperty Average"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:1116
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell -WindowStyle Hidden -NoProfile -Command "(Get-Counter '\Processor(_Total)\% Processor Time' -SampleInterval 1 -MaxSamples 2 | Select-Object -ExpandProperty CounterSamples | Select-Object -Last 1).CookedValue""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3452
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -WindowStyle Hidden -NoProfile -Command "(Get-Counter '\Processor(_Total)\% Processor Time' -SampleInterval 1 -MaxSamples 2 | Select-Object -ExpandProperty CounterSamples | Select-Object -Last 1).CookedValue"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:2292
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell -WindowStyle Hidden -NoProfile -Command "$gw=(Get-NetRoute -DestinationPrefix '0.0.0.0/0' | Sort-Object RouteMetric | Select-Object -First 1).NextHop; Test-Connection -ComputerName $gw -Count 2 | Measure-Object -Property ResponseTime -Average | Select-Object -ExpandProperty Average""
    3⤵
    - Executes a command shell one-liner
    - System Time Discovery
    - Suspicious use of WriteProcessMemory
    PID:4336
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -WindowStyle Hidden -NoProfile -Command "$gw=(Get-NetRoute -DestinationPrefix '0.0.0.0/0' | Sort-Object RouteMetric | Select-Object -First 1).NextHop; Test-Connection -ComputerName $gw -Count 2 | Measure-Object -Property ResponseTime -Average | Select-Object -ExpandProperty Average"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:5068
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist /FO CSV /NH"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4460
  - - C:\Windows\system32\tasklist.exe
      tasklist /FO CSV /NH
      4⤵
      Discovers running processes
      PID:4908
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell -WindowStyle Hidden -NoProfile -Command "Test-Connection -ComputerName '1.1.1.1' -Count 2 | Measure-Object -Property ResponseTime -Average | Select-Object -ExpandProperty Average""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4616
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -WindowStyle Hidden -NoProfile -Command "Test-Connection -ComputerName '1.1.1.1' -Count 2 | Measure-Object -Property ResponseTime -Average | Select-Object -ExpandProperty Average"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:1960
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell -WindowStyle Hidden -NoProfile -Command "(Get-Counter '\Processor(_Total)\% Processor Time' -SampleInterval 1 -MaxSamples 2 | Select-Object -ExpandProperty CounterSamples | Select-Object -Last 1).CookedValue""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5460
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -WindowStyle Hidden -NoProfile -Command "(Get-Counter '\Processor(_Total)\% Processor Time' -SampleInterval 1 -MaxSamples 2 | Select-Object -ExpandProperty CounterSamples | Select-Object -Last 1).CookedValue"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:4724
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell -WindowStyle Hidden -NoProfile -Command "$gw=(Get-NetRoute -DestinationPrefix '0.0.0.0/0' | Sort-Object RouteMetric | Select-Object -First 1).NextHop; Test-Connection -ComputerName $gw -Count 2 | Measure-Object -Property ResponseTime -Average | Select-Object -ExpandProperty Average""
    3⤵
    - Executes a command shell one-liner
    - System Time Discovery
    - Suspicious use of WriteProcessMemory
    PID:2808
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -WindowStyle Hidden -NoProfile -Command "$gw=(Get-NetRoute -DestinationPrefix '0.0.0.0/0' | Sort-Object RouteMetric | Select-Object -First 1).NextHop; Test-Connection -ComputerName $gw -Count 2 | Measure-Object -Property ResponseTime -Average | Select-Object -ExpandProperty Average"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:1852
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist /FO CSV /NH"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2732
  - - C:\Windows\system32\tasklist.exe
      tasklist /FO CSV /NH
      4⤵
      Discovers running processes
      PID:5828
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell -WindowStyle Hidden -NoProfile -Command "Test-Connection -ComputerName '1.1.1.1' -Count 2 | Measure-Object -Property ResponseTime -Average | Select-Object -ExpandProperty Average""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:424
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -WindowStyle Hidden -NoProfile -Command "Test-Connection -ComputerName '1.1.1.1' -Count 2 | Measure-Object -Property ResponseTime -Average | Select-Object -ExpandProperty Average"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:5768
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist /FO CSV /NH"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5980
  - - C:\Windows\system32\tasklist.exe
      tasklist /FO CSV /NH
      4⤵
      Discovers running processes
      PID:5040
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell -WindowStyle Hidden -NoProfile -Command "(Get-Counter '\Processor(_Total)\% Processor Time' -SampleInterval 1 -MaxSamples 2 | Select-Object -ExpandProperty CounterSamples | Select-Object -Last 1).CookedValue""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3816
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -WindowStyle Hidden -NoProfile -Command "(Get-Counter '\Processor(_Total)\% Processor Time' -SampleInterval 1 -MaxSamples 2 | Select-Object -ExpandProperty CounterSamples | Select-Object -Last 1).CookedValue"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:2632
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell -WindowStyle Hidden -NoProfile -Command "$gw=(Get-NetRoute -DestinationPrefix '0.0.0.0/0' | Sort-Object RouteMetric | Select-Object -First 1).NextHop; Test-Connection -ComputerName $gw -Count 2 | Measure-Object -Property ResponseTime -Average | Select-Object -ExpandProperty Average""
    3⤵
    - Executes a command shell one-liner
    - System Time Discovery
    - Suspicious use of WriteProcessMemory
    PID:4600
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -WindowStyle Hidden -NoProfile -Command "$gw=(Get-NetRoute -DestinationPrefix '0.0.0.0/0' | Sort-Object RouteMetric | Select-Object -First 1).NextHop; Test-Connection -ComputerName $gw -Count 2 | Measure-Object -Property ResponseTime -Average | Select-Object -ExpandProperty Average"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:4476
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell -WindowStyle Hidden -NoProfile -Command "Test-Connection -ComputerName '1.1.1.1' -Count 2 | Measure-Object -Property ResponseTime -Average | Select-Object -ExpandProperty Average""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3104
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -WindowStyle Hidden -NoProfile -Command "Test-Connection -ComputerName '1.1.1.1' -Count 2 | Measure-Object -Property ResponseTime -Average | Select-Object -ExpandProperty Average"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:6048
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist /FO CSV /NH"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3096
  - - C:\Windows\system32\tasklist.exe
      tasklist /FO CSV /NH
      4⤵
      Discovers running processes
      PID:2684
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell -WindowStyle Hidden -NoProfile -Command "(Get-Counter '\Processor(_Total)\% Processor Time' -SampleInterval 1 -MaxSamples 2 | Select-Object -ExpandProperty CounterSamples | Select-Object -Last 1).CookedValue""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3284
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -WindowStyle Hidden -NoProfile -Command "(Get-Counter '\Processor(_Total)\% Processor Time' -SampleInterval 1 -MaxSamples 2 | Select-Object -ExpandProperty CounterSamples | Select-Object -Last 1).CookedValue"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:5052
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell -WindowStyle Hidden -NoProfile -Command "$gw=(Get-NetRoute -DestinationPrefix '0.0.0.0/0' | Sort-Object RouteMetric | Select-Object -First 1).NextHop; Test-Connection -ComputerName $gw -Count 2 | Measure-Object -Property ResponseTime -Average | Select-Object -ExpandProperty Average""
    3⤵
    - Executes a command shell one-liner
    - System Time Discovery
    - Suspicious use of WriteProcessMemory
    PID:3552
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -WindowStyle Hidden -NoProfile -Command "$gw=(Get-NetRoute -DestinationPrefix '0.0.0.0/0' | Sort-Object RouteMetric | Select-Object -First 1).NextHop; Test-Connection -ComputerName $gw -Count 2 | Measure-Object -Property ResponseTime -Average | Select-Object -ExpandProperty Average"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:4472
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell -WindowStyle Hidden -NoProfile -Command "Test-Connection -ComputerName '1.1.1.1' -Count 2 | Measure-Object -Property ResponseTime -Average | Select-Object -ExpandProperty Average""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5484
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -WindowStyle Hidden -NoProfile -Command "Test-Connection -ComputerName '1.1.1.1' -Count 2 | Measure-Object -Property ResponseTime -Average | Select-Object -ExpandProperty Average"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:5476
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist /FO CSV /NH"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:676
  - - C:\Windows\system32\tasklist.exe
      tasklist /FO CSV /NH
      4⤵
      Discovers running processes
      PID:552
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell -WindowStyle Hidden -NoProfile -Command "(Get-Counter '\Processor(_Total)\% Processor Time' -SampleInterval 1 -MaxSamples 2 | Select-Object -ExpandProperty CounterSamples | Select-Object -Last 1).CookedValue""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5192
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -WindowStyle Hidden -NoProfile -Command "(Get-Counter '\Processor(_Total)\% Processor Time' -SampleInterval 1 -MaxSamples 2 | Select-Object -ExpandProperty CounterSamples | Select-Object -Last 1).CookedValue"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:5772
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell -WindowStyle Hidden -NoProfile -Command "$gw=(Get-NetRoute -DestinationPrefix '0.0.0.0/0' | Sort-Object RouteMetric | Select-Object -First 1).NextHop; Test-Connection -ComputerName $gw -Count 2 | Measure-Object -Property ResponseTime -Average | Select-Object -ExpandProperty Average""
    3⤵
    - Executes a command shell one-liner
    - System Time Discovery
    - Suspicious use of WriteProcessMemory
    PID:3184
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -WindowStyle Hidden -NoProfile -Command "$gw=(Get-NetRoute -DestinationPrefix '0.0.0.0/0' | Sort-Object RouteMetric | Select-Object -First 1).NextHop; Test-Connection -ComputerName $gw -Count 2 | Measure-Object -Property ResponseTime -Average | Select-Object -ExpandProperty Average"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:4860
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist /FO CSV /NH"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2088
  - - C:\Windows\system32\tasklist.exe
      tasklist /FO CSV /NH
      4⤵
      Discovers running processes
      PID:3436
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell -WindowStyle Hidden -NoProfile -Command "Test-Connection -ComputerName '1.1.1.1' -Count 2 | Measure-Object -Property ResponseTime -Average | Select-Object -ExpandProperty Average""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:460
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -WindowStyle Hidden -NoProfile -Command "Test-Connection -ComputerName '1.1.1.1' -Count 2 | Measure-Object -Property ResponseTime -Average | Select-Object -ExpandProperty Average"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:4900
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell -WindowStyle Hidden -NoProfile -Command "(Get-Counter '\Processor(_Total)\% Processor Time' -SampleInterval 1 -MaxSamples 2 | Select-Object -ExpandProperty CounterSamples | Select-Object -Last 1).CookedValue""
    3⤵
    - Executes a command shell one-liner
    PID:916
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -WindowStyle Hidden -NoProfile -Command "(Get-Counter '\Processor(_Total)\% Processor Time' -SampleInterval 1 -MaxSamples 2 | Select-Object -ExpandProperty CounterSamples | Select-Object -Last 1).CookedValue"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:4668
- - C:\Users\Admin\AppData\Local\Temp\3KnJELCi1muR27afqJ58QZWk26Y\GHXSTLY Tweaks.exe
    "C:\Users\Admin\AppData\Local\Temp\3KnJELCi1muR27afqJ58QZWk26Y\GHXSTLY Tweaks.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --user-data-dir="C:\Users\Admin\AppData\Roaming\ghxstly-tweaks" --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=3716,i,11702911479229498544,5236396504102787236,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=3740 /prefetch:10
    3⤵
    PID:4264
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell -WindowStyle Hidden -NoProfile -Command "$gw=(Get-NetRoute -DestinationPrefix '0.0.0.0/0' | Sort-Object RouteMetric | Select-Object -First 1).NextHop; Test-Connection -ComputerName $gw -Count 2 | Measure-Object -Property ResponseTime -Average | Select-Object -ExpandProperty Average""
    3⤵
    - Executes a command shell one-liner
    - System Time Discovery
    PID:2300
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -WindowStyle Hidden -NoProfile -Command "$gw=(Get-NetRoute -DestinationPrefix '0.0.0.0/0' | Sort-Object RouteMetric | Select-Object -First 1).NextHop; Test-Connection -ComputerName $gw -Count 2 | Measure-Object -Property ResponseTime -Average | Select-Object -ExpandProperty Average"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:3080
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist /FO CSV /NH"
    3⤵
    - Executes a command shell one-liner
    PID:4732
  - - C:\Windows\system32\tasklist.exe
      tasklist /FO CSV /NH
      4⤵
      Discovers running processes
      PID:4816
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell -WindowStyle Hidden -NoProfile -Command "Test-Connection -ComputerName '1.1.1.1' -Count 2 | Measure-Object -Property ResponseTime -Average | Select-Object -ExpandProperty Average""
    3⤵
    - Executes a command shell one-liner
    PID:4444
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -WindowStyle Hidden -NoProfile -Command "Test-Connection -ComputerName '1.1.1.1' -Count 2 | Measure-Object -Property ResponseTime -Average | Select-Object -ExpandProperty Average"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:3292

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Process Discovery

T1057

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact