71131cc161bf19febc61f1174208529e9fc9de2a6fd2b60bcc78638657bd5692

Analysis

max time kernel
149s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
27/10/2026, 18:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a.ps1
Size 53KB
Sample261027-xc1lksty2n
SHA256 71131cc161bf19febc61f1174208529e9fc9de2a6fd2b60bcc78638657bd5692
MD5 f1382610aa28c3d496a99481719b1120
SHA1 33d290dd7ca4b7839e35e9d0aaff8f03107d6ce0
SHA512 7b7fc194d70ff79e3f91b199373e05c3fdba9079ebbe58b25e26eb9d6bddbfcbc1567d54f2f7ea90308d6766a91122825a82227253930ae235b707e38cf66bb7
SSDEEP 1536:8noTQ8eluK5RjjjQHCH8LQFgDaLROlhx5DKpiS:8t8pK5h4Ql4aLRO/vWiS
TLSH
T17C33F249AF8A0F59D244749C79A33B1C2D80B794D228CD99BFF740AE696C7C61937109
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery execution persistence privilege_escalation

Malware Config

Signatures

Badlisted process makes network request 1 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
5	756	PowerShell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 13 IoCs

Run Powershell to get system information as a root user.

execution

PowerShell

T1059.001

pid	Process
3356	powershell.exe
4316	powershell.exe
756	PowerShell.exe
5012	powershell.exe
4316	powershell.exe
2668	powershell.exe
4560	powershell.exe
772	powershell.exe
6060	powershell.exe
3984	powershell.exe
2448	powershell.exe
3356	powershell.exe
3972	powershell.exe

Creates a file in the Startup directory 1 TTPs 1 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftEdgeUpdate.cmd	node.exe

Executes dropped EXE 1 IoCs

pid	Process
5632	node.exe

Queries registry keys for unique system GUIDs 1 TTPs 2 IoCs

Queries the MachineGuid or HwProfileGuid value from the command line, commonly used to create a unique victim ID.

discovery

System Information Discovery

T1082

pid	Process
4620	reg.exe
4556	reg.exe

Executes a command shell one-liner 1 TTPs 16 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4444	cmd.exe
1388	cmd.exe
1380	cmd.exe
2572	cmd.exe
2292	cmd.exe
4660	cmd.exe
552	cmd.exe
5796	cmd.exe
2964	cmd.exe
1468	cmd.exe
5572	cmd.exe
4256	cmd.exe
256	cmd.exe
4828	cmd.exe
1204	cmd.exe
3708	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	node.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	node.exe

Checks processor information in registry 2 TTPs 24 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString	node.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\~MHz	node.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4	node.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\ProcessorNameString	node.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5	node.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\ProcessorNameString	node.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	node.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	node.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz	node.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\ProcessorNameString	node.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\~MHz	node.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\~MHz	node.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2	node.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\ProcessorNameString	node.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\ProcessorNameString	node.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7	node.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\ProcessorNameString	node.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	node.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\~MHz	node.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3	node.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\~MHz	node.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\~MHz	node.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6	node.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	node.exe

Runs net.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3880	schtasks.exe

Suspicious behavior: EnumeratesProcesses 32 IoCs

pid	Process
756	PowerShell.exe
756	PowerShell.exe
2668	powershell.exe
2668	powershell.exe
2668	powershell.exe
4560	powershell.exe
4560	powershell.exe
4560	powershell.exe
2448	powershell.exe
2448	powershell.exe
2448	powershell.exe
3356	powershell.exe
3356	powershell.exe
3356	powershell.exe
772	powershell.exe
772	powershell.exe
772	powershell.exe
3972	powershell.exe
3972	powershell.exe
3972	powershell.exe
5012	powershell.exe
5012	powershell.exe
5012	powershell.exe
4316	powershell.exe
4316	powershell.exe
4316	powershell.exe
6060	powershell.exe
6060	powershell.exe
6060	powershell.exe
3984	powershell.exe
3984	powershell.exe
3984	powershell.exe

Suspicious use of AdjustPrivilegeToken 53 IoCs

description	pid	Process
Token: SeDebugPrivilege	756	PowerShell.exe
Token: SeDebugPrivilege	2668	powershell.exe
Token: SeDebugPrivilege	4560	powershell.exe
Token: SeDebugPrivilege	2448	powershell.exe
Token: SeDebugPrivilege	3356	powershell.exe
Token: SeIncreaseQuotaPrivilege	3356	powershell.exe
Token: SeSecurityPrivilege	3356	powershell.exe
Token: SeTakeOwnershipPrivilege	3356	powershell.exe
Token: SeLoadDriverPrivilege	3356	powershell.exe
Token: SeSystemProfilePrivilege	3356	powershell.exe
Token: SeSystemtimePrivilege	3356	powershell.exe
Token: SeProfSingleProcessPrivilege	3356	powershell.exe
Token: SeIncBasePriorityPrivilege	3356	powershell.exe
Token: SeCreatePagefilePrivilege	3356	powershell.exe
Token: SeBackupPrivilege	3356	powershell.exe
Token: SeRestorePrivilege	3356	powershell.exe
Token: SeShutdownPrivilege	3356	powershell.exe
Token: SeDebugPrivilege	3356	powershell.exe
Token: SeSystemEnvironmentPrivilege	3356	powershell.exe
Token: SeRemoteShutdownPrivilege	3356	powershell.exe
Token: SeUndockPrivilege	3356	powershell.exe
Token: SeManageVolumePrivilege	3356	powershell.exe
Token: 33	3356	powershell.exe
Token: 34	3356	powershell.exe
Token: 35	3356	powershell.exe
Token: 36	3356	powershell.exe
Token: SeDebugPrivilege	772	powershell.exe
Token: SeDebugPrivilege	3972	powershell.exe
Token: SeDebugPrivilege	5012	powershell.exe
Token: SeDebugPrivilege	4316	powershell.exe
Token: SeIncreaseQuotaPrivilege	4316	powershell.exe
Token: SeSecurityPrivilege	4316	powershell.exe
Token: SeTakeOwnershipPrivilege	4316	powershell.exe
Token: SeLoadDriverPrivilege	4316	powershell.exe
Token: SeSystemProfilePrivilege	4316	powershell.exe
Token: SeSystemtimePrivilege	4316	powershell.exe
Token: SeProfSingleProcessPrivilege	4316	powershell.exe
Token: SeIncBasePriorityPrivilege	4316	powershell.exe
Token: SeCreatePagefilePrivilege	4316	powershell.exe
Token: SeBackupPrivilege	4316	powershell.exe
Token: SeRestorePrivilege	4316	powershell.exe
Token: SeShutdownPrivilege	4316	powershell.exe
Token: SeDebugPrivilege	4316	powershell.exe
Token: SeSystemEnvironmentPrivilege	4316	powershell.exe
Token: SeRemoteShutdownPrivilege	4316	powershell.exe
Token: SeUndockPrivilege	4316	powershell.exe
Token: SeManageVolumePrivilege	4316	powershell.exe
Token: 33	4316	powershell.exe
Token: 34	4316	powershell.exe
Token: 35	4316	powershell.exe
Token: 36	4316	powershell.exe
Token: SeDebugPrivilege	6060	powershell.exe
Token: SeDebugPrivilege	3984	powershell.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4892	conhost.exe

Suspicious use of WriteProcessMemory 37 IoCs

description	pid	Process	procid_target
PID 756 wrote to memory of 5632	756	PowerShell.exe	89
PID 5632 wrote to memory of 3880	5632	node.exe	91
PID 4892 wrote to memory of 3624	4892	conhost.exe	94
PID 5632 wrote to memory of 256	5632	node.exe	95
PID 256 wrote to memory of 2668	256	cmd.exe	97
PID 5632 wrote to memory of 4444	5632	node.exe	98
PID 4444 wrote to memory of 4560	4444	cmd.exe	100
PID 5632 wrote to memory of 1388	5632	node.exe	101
PID 1388 wrote to memory of 2448	1388	cmd.exe	103
PID 5632 wrote to memory of 4828	5632	node.exe	105
PID 4828 wrote to memory of 3356	4828	cmd.exe	107
PID 5632 wrote to memory of 2292	5632	node.exe	108
PID 2292 wrote to memory of 772	2292	cmd.exe	110
PID 5632 wrote to memory of 2964	5632	node.exe	111
PID 2964 wrote to memory of 3972	2964	cmd.exe	113
PID 5632 wrote to memory of 1380	5632	node.exe	114
PID 1380 wrote to memory of 3372	1380	cmd.exe	116
PID 3372 wrote to memory of 2376	3372	net.exe	117
PID 5632 wrote to memory of 1468	5632	node.exe	118
PID 1468 wrote to memory of 1112	1468	cmd.exe	120
PID 5632 wrote to memory of 4660	5632	node.exe	121
PID 4660 wrote to memory of 4620	4660	cmd.exe	123
PID 5632 wrote to memory of 552	5632	node.exe	124
PID 552 wrote to memory of 5012	552	cmd.exe	126
PID 5632 wrote to memory of 5572	5632	node.exe	127
PID 5572 wrote to memory of 4316	5572	cmd.exe	129
PID 5632 wrote to memory of 4256	5632	node.exe	130
PID 4256 wrote to memory of 6060	4256	cmd.exe	132
PID 5632 wrote to memory of 1204	5632	node.exe	133
PID 1204 wrote to memory of 3984	1204	cmd.exe	135
PID 5632 wrote to memory of 2572	5632	node.exe	137
PID 2572 wrote to memory of 4260	2572	cmd.exe	139
PID 4260 wrote to memory of 4544	4260	net.exe	140
PID 5632 wrote to memory of 5796	5632	node.exe	141
PID 5796 wrote to memory of 1152	5796	cmd.exe	143
PID 5632 wrote to memory of 3708	5632	node.exe	144
PID 3708 wrote to memory of 4556	3708	cmd.exe	146

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\a.ps1
1⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:756
- C:\Users\Admin\AppData\Local\Packages\Components\d014\node-v18.19.0-win-x64\node.exe
  "C:\Users\Admin\AppData\Local\Packages\Components\d014\node-v18.19.0-win-x64\node.exe" "C:\Users\Admin\AppData\Local\Packages\Components\d014\0155bfb2a8608f11.js"
  2⤵
  - Creates a file in the Startup directory
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - Checks processor information in registry
  - Suspicious use of WriteProcessMemory
  PID:5632
- - C:\Windows\System32\schtasks.exe
    C:\Windows\System32\schtasks.exe /Create /TN MicrosoftEdgeUpdateTask043b /TR "\"C:\Windows\System32\conhost.exe\" --headless \"C:\Users\Admin\AppData\Local\Packages\Components\d014\node-v18.19.0-win-x64\node.exe\" \"C:\Users\Admin\AppData\Local\Packages\Components\d014\0155bfb2a8608f11.js\"" /SC ONLOGON /RL LIMITED /F
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3880
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "[System.Globalization.CultureInfo]::InstalledUICulture.Name""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:256
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "[System.Globalization.CultureInfo]::InstalledUICulture.Name"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2668
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "[System.Globalization.CultureInfo]::InstalledUICulture.Name""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4444
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "[System.Globalization.CultureInfo]::InstalledUICulture.Name"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4560
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "(Get-WmiObject Win32_VideoController).Name -join ', '""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1388
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "(Get-WmiObject Win32_VideoController).Name -join ', '"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2448
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "try { (Get-CimInstance -Namespace root/SecurityCenter2 -ClassName AntivirusProduct -EA Stop).displayName -join ', ' } catch { 'none' }""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4828
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "try { (Get-CimInstance -Namespace root/SecurityCenter2 -ClassName AntivirusProduct -EA Stop).displayName -join ', ' } catch { 'none' }"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3356
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "(Get-WmiObject Win32_ComputerSystem).Domain""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2292
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "(Get-WmiObject Win32_ComputerSystem).Domain"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:772
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "(Get-WmiObject Win32_ComputerSystem).PartOfDomain""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2964
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "(Get-WmiObject Win32_ComputerSystem).PartOfDomain"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3972
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "net session"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1380
  - - C:\Windows\system32\net.exe
      net session
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3372
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        5⤵
        
        PID:2376
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion" /v ProductName"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1468
  - - C:\Windows\system32\reg.exe
      reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion" /v ProductName
      4⤵
      PID:1112
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SOFTWARE\Microsoft\Cryptography" /v MachineGuid"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4660
  - - C:\Windows\system32\reg.exe
      reg query "HKLM\SOFTWARE\Microsoft\Cryptography" /v MachineGuid
      4⤵
      Queries registry keys for unique system GUIDs
      PID:4620
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "(Get-WmiObject Win32_VideoController).Name -join ', '""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:552
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "(Get-WmiObject Win32_VideoController).Name -join ', '"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:5012
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "try { (Get-CimInstance -Namespace root/SecurityCenter2 -ClassName AntivirusProduct -EA Stop).displayName -join ', ' } catch { 'none' }""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5572
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "try { (Get-CimInstance -Namespace root/SecurityCenter2 -ClassName AntivirusProduct -EA Stop).displayName -join ', ' } catch { 'none' }"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4316
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "(Get-WmiObject Win32_ComputerSystem).Domain""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4256
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "(Get-WmiObject Win32_ComputerSystem).Domain"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:6060
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "(Get-WmiObject Win32_ComputerSystem).PartOfDomain""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1204
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "(Get-WmiObject Win32_ComputerSystem).PartOfDomain"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3984
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "net session"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2572
  - - C:\Windows\system32\net.exe
      net session
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4260
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        5⤵
        
        PID:4544
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion" /v ProductName"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5796
  - - C:\Windows\system32\reg.exe
      reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion" /v ProductName
      4⤵
      PID:1152
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SOFTWARE\Microsoft\Cryptography" /v MachineGuid"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3708
  - - C:\Windows\system32\reg.exe
      reg query "HKLM\SOFTWARE\Microsoft\Cryptography" /v MachineGuid
      4⤵
      Queries registry keys for unique system GUIDs
      PID:4556

C:\Windows\System32\conhost.exe
"C:\Windows\System32\conhost.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4892
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe
  2⤵
  PID:3624

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...