00438aee58f588a4b4199038020349da36a2b5def64041bad904454a3f5ea750

Analysis

user interaction
yes
max time kernel
151s
max time network
154s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
07/11/2026, 21:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
NodeNetLauncherSetup-1.0.24.exe
Size 106.7MB
Sample261107-zyex4sft4x
SHA256 00438aee58f588a4b4199038020349da36a2b5def64041bad904454a3f5ea750
MD5 1636de733d71299400cc3f40adb3e479
SHA1 67531d41dce4cb12c3097db31d98b958bc8b9bf3
SHA512 119c2313cce6c8db1f00e38176ee302a4a42bf4eed9019ecdcac23484b70150a85bf8228939b4d0bd8f628906c6a8b777c3936049ab2ed9c20ad34184c9ac408
SSDEEP 3145728:3yuSLFnONAKNkCg2ak1fG7pQageZ6x1CYxc6Dqldijv:CusFGoLk3avZukYqdA
TLSH
T1D638339807AD045FDBA7C9F083A900689F30DA0BD7FD008A1A75F55CB3D6E4ABF29591
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery execution spyware stealer

Malware Config

Signatures

Executes dropped EXE 10 IoCs

pid	Process
200	NodeNet Launcher.exe
2492	NodeNet Launcher.exe
2992	NodeNet Launcher.exe
5304	NodeNet Launcher.exe
3212	NodeNetLauncherSetup-1.0.25.exe
1868	old-uninstaller.exe
2960	NodeNet Launcher.exe
3596	NodeNet Launcher.exe
1300	NodeNet Launcher.exe
3288	NodeNet Launcher.exe

Loads dropped DLL 30 IoCs

pid	Process
4276	NodeNetLauncherSetup-1.0.24.exe
4276	NodeNetLauncherSetup-1.0.24.exe
4276	NodeNetLauncherSetup-1.0.24.exe
4276	NodeNetLauncherSetup-1.0.24.exe
4276	NodeNetLauncherSetup-1.0.24.exe
4276	NodeNetLauncherSetup-1.0.24.exe
4276	NodeNetLauncherSetup-1.0.24.exe
4276	NodeNetLauncherSetup-1.0.24.exe
4276	NodeNetLauncherSetup-1.0.24.exe
2992	NodeNet Launcher.exe
5304	NodeNet Launcher.exe
2992	NodeNet Launcher.exe
2992	NodeNet Launcher.exe
2992	NodeNet Launcher.exe
3212	NodeNetLauncherSetup-1.0.25.exe
3212	NodeNetLauncherSetup-1.0.25.exe
3212	NodeNetLauncherSetup-1.0.25.exe
3212	NodeNetLauncherSetup-1.0.25.exe
3212	NodeNetLauncherSetup-1.0.25.exe
1868	old-uninstaller.exe
1868	old-uninstaller.exe
1868	old-uninstaller.exe
1868	old-uninstaller.exe
1868	old-uninstaller.exe
3212	NodeNetLauncherSetup-1.0.25.exe
1300	NodeNet Launcher.exe
3288	NodeNet Launcher.exe
1300	NodeNet Launcher.exe
1300	NodeNet Launcher.exe
1300	NodeNet Launcher.exe

Reads ssh keys stored on the system 2 TTPs
Tries to access SSH used by SSH programs.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Command and Scripting Interpreter: PowerShell 1 TTPs 6 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
3476	powershell.exe
3784	powershell.exe
1840	powershell.exe
4932	powershell.exe
2088	powershell.exe
800	powershell.exe

Hide Artifacts: Ignore Process Interrupts 1 TTPs 3 IoCs

Command interpreters often include specific commands/flags that ignore errors and other hangups.

defense_evasion

Ignore Process Interrupts

T1564.011

pid	Process
2848	powershell.exe
4392	powershell.exe
3324	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 8 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	NodeNet Launcher.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	NodeNet Launcher.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	NodeNet Launcher.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	NodeNet Launcher.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	NodeNet Launcher.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	NodeNet Launcher.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	NodeNet Launcher.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	NodeNet Launcher.exe

System Location Discovery: System Language Discovery 1 TTPs 12 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NodeNetLauncherSetup-1.0.25.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	old-uninstaller.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NodeNetLauncherSetup-1.0.24.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5304	NodeNet Launcher.exe
3288	NodeNet Launcher.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	NodeNet Launcher.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	NodeNet Launcher.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	NodeNet Launcher.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	NodeNet Launcher.exe

Suspicious behavior: EnumeratesProcesses 30 IoCs

pid	Process
2848	powershell.exe
2848	powershell.exe
3476	powershell.exe
3476	powershell.exe
4276	NodeNetLauncherSetup-1.0.24.exe
4276	NodeNetLauncherSetup-1.0.24.exe
4932	powershell.exe
4932	powershell.exe
4392	powershell.exe
4392	powershell.exe
4392	powershell.exe
3784	powershell.exe
3784	powershell.exe
3784	powershell.exe
3212	NodeNetLauncherSetup-1.0.25.exe
3212	NodeNetLauncherSetup-1.0.25.exe
2088	powershell.exe
2088	powershell.exe
2088	powershell.exe
3324	powershell.exe
3324	powershell.exe
3324	powershell.exe
1840	powershell.exe
1840	powershell.exe
1840	powershell.exe
1868	old-uninstaller.exe
1868	old-uninstaller.exe
800	powershell.exe
800	powershell.exe
800	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2848	powershell.exe
Token: SeDebugPrivilege	3476	powershell.exe
Token: SeDebugPrivilege	4932	powershell.exe
Token: SeIncreaseQuotaPrivilege	4932	powershell.exe
Token: SeSecurityPrivilege	4932	powershell.exe
Token: SeTakeOwnershipPrivilege	4932	powershell.exe
Token: SeLoadDriverPrivilege	4932	powershell.exe
Token: SeSystemProfilePrivilege	4932	powershell.exe
Token: SeSystemtimePrivilege	4932	powershell.exe
Token: SeProfSingleProcessPrivilege	4932	powershell.exe
Token: SeIncBasePriorityPrivilege	4932	powershell.exe
Token: SeCreatePagefilePrivilege	4932	powershell.exe
Token: SeBackupPrivilege	4932	powershell.exe
Token: SeRestorePrivilege	4932	powershell.exe
Token: SeShutdownPrivilege	4932	powershell.exe
Token: SeDebugPrivilege	4932	powershell.exe
Token: SeSystemEnvironmentPrivilege	4932	powershell.exe
Token: SeRemoteShutdownPrivilege	4932	powershell.exe
Token: SeUndockPrivilege	4932	powershell.exe
Token: SeManageVolumePrivilege	4932	powershell.exe
Token: 33	4932	powershell.exe
Token: 34	4932	powershell.exe
Token: 35	4932	powershell.exe
Token: 36	4932	powershell.exe
Token: SeSecurityPrivilege	4276	NodeNetLauncherSetup-1.0.24.exe
Token: SeShutdownPrivilege	200	NodeNet Launcher.exe
Token: SeCreatePagefilePrivilege	200	NodeNet Launcher.exe
Token: SeShutdownPrivilege	200	NodeNet Launcher.exe
Token: SeCreatePagefilePrivilege	200	NodeNet Launcher.exe
Token: SeShutdownPrivilege	200	NodeNet Launcher.exe
Token: SeCreatePagefilePrivilege	200	NodeNet Launcher.exe
Token: SeShutdownPrivilege	200	NodeNet Launcher.exe
Token: SeCreatePagefilePrivilege	200	NodeNet Launcher.exe
Token: SeShutdownPrivilege	200	NodeNet Launcher.exe
Token: SeCreatePagefilePrivilege	200	NodeNet Launcher.exe
Token: SeShutdownPrivilege	200	NodeNet Launcher.exe
Token: SeCreatePagefilePrivilege	200	NodeNet Launcher.exe
Token: SeShutdownPrivilege	200	NodeNet Launcher.exe
Token: SeCreatePagefilePrivilege	200	NodeNet Launcher.exe
Token: SeShutdownPrivilege	200	NodeNet Launcher.exe
Token: SeCreatePagefilePrivilege	200	NodeNet Launcher.exe
Token: SeShutdownPrivilege	200	NodeNet Launcher.exe
Token: SeCreatePagefilePrivilege	200	NodeNet Launcher.exe
Token: SeShutdownPrivilege	200	NodeNet Launcher.exe
Token: SeCreatePagefilePrivilege	200	NodeNet Launcher.exe
Token: SeDebugPrivilege	4392	powershell.exe
Token: SeDebugPrivilege	3784	powershell.exe
Token: SeDebugPrivilege	2088	powershell.exe
Token: SeIncreaseQuotaPrivilege	2088	powershell.exe
Token: SeSecurityPrivilege	2088	powershell.exe
Token: SeTakeOwnershipPrivilege	2088	powershell.exe
Token: SeLoadDriverPrivilege	2088	powershell.exe
Token: SeSystemProfilePrivilege	2088	powershell.exe
Token: SeSystemtimePrivilege	2088	powershell.exe
Token: SeProfSingleProcessPrivilege	2088	powershell.exe
Token: SeIncBasePriorityPrivilege	2088	powershell.exe
Token: SeCreatePagefilePrivilege	2088	powershell.exe
Token: SeBackupPrivilege	2088	powershell.exe
Token: SeRestorePrivilege	2088	powershell.exe
Token: SeShutdownPrivilege	2088	powershell.exe
Token: SeDebugPrivilege	2088	powershell.exe
Token: SeSystemEnvironmentPrivilege	2088	powershell.exe
Token: SeRemoteShutdownPrivilege	2088	powershell.exe
Token: SeUndockPrivilege	2088	powershell.exe

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 4276 wrote to memory of 2848	4276	NodeNetLauncherSetup-1.0.24.exe	89
PID 4276 wrote to memory of 3476	4276	NodeNetLauncherSetup-1.0.24.exe	91
PID 4276 wrote to memory of 4932	4276	NodeNetLauncherSetup-1.0.24.exe	93
PID 200 wrote to memory of 2992	200	NodeNet Launcher.exe	98
PID 200 wrote to memory of 2492	200	NodeNet Launcher.exe	99
PID 200 wrote to memory of 5304	200	NodeNet Launcher.exe	100
PID 200 wrote to memory of 3212	200	NodeNet Launcher.exe	102
PID 3212 wrote to memory of 4392	3212	NodeNetLauncherSetup-1.0.25.exe	103
PID 3212 wrote to memory of 3784	3212	NodeNetLauncherSetup-1.0.25.exe	105
PID 3212 wrote to memory of 2088	3212	NodeNetLauncherSetup-1.0.25.exe	107
PID 3212 wrote to memory of 1868	3212	NodeNetLauncherSetup-1.0.25.exe	109
PID 1868 wrote to memory of 3324	1868	old-uninstaller.exe	110
PID 1868 wrote to memory of 1840	1868	old-uninstaller.exe	112
PID 1868 wrote to memory of 800	1868	old-uninstaller.exe	114
PID 2960 wrote to memory of 1300	2960	NodeNet Launcher.exe	120
PID 2960 wrote to memory of 3596	2960	NodeNet Launcher.exe	121
PID 2960 wrote to memory of 3288	2960	NodeNet Launcher.exe	122

C:\Users\Admin\AppData\Local\Temp\NodeNetLauncherSetup-1.0.24.exe
"C:\Users\Admin\AppData\Local\Temp\NodeNetLauncherSetup-1.0.24.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4276
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -C "if (Get-Command Get-CimInstance -ErrorAction SilentlyContinue) { exit 0 } else { exit 1 }"
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2848
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -C "if ((Get-ExecutionPolicy -Scope Process) -eq 'Restricted') { exit 1 } else { exit 0 }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3476
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -C "if ((Get-CimInstance -ClassName Win32_Process | ? {$_.Path -and $_.Path.StartsWith('C:\Users\Admin\AppData\Local\Programs\nodenet-launcher', 'CurrentCultureIgnoreCase')}).Count -gt 0) { exit 0 } else { exit 1 }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4932

C:\Users\Admin\AppData\Local\Programs\nodenet-launcher\NodeNet Launcher.exe
"C:\Users\Admin\AppData\Local\Programs\nodenet-launcher\NodeNet Launcher.exe"
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:200
- C:\Users\Admin\AppData\Local\Programs\nodenet-launcher\NodeNet Launcher.exe
  "C:\Users\Admin\AppData\Local\Programs\nodenet-launcher\NodeNet Launcher.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\NodeNet Launcher" --gpu-preferences=WAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAQAAAAAAAAAADAAAAAAAAADgAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAKAAAAAAAAAAoAAAAAAAAAAgAAAAAAAAAEAAAAAIAAAABAAAAAAAAAAgAAAAAAAAACAAAAAAAAAA= --field-trial-handle=1932,i,2024721609893599056,8930902695109755448,262144 --enable-features=PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1956,i,14992573586032770824,7601360062085408536,4 --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=1928 /prefetch:2
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:2992
- C:\Users\Admin\AppData\Local\Programs\nodenet-launcher\NodeNet Launcher.exe
  "C:\Users\Admin\AppData\Local\Programs\nodenet-launcher\NodeNet Launcher.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\NodeNet Launcher" --field-trial-handle=1932,i,2024721609893599056,8930902695109755448,262144 --enable-features=PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1956,i,14992573586032770824,7601360062085408536,4 --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=1992 /prefetch:11
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  PID:2492
- C:\Users\Admin\AppData\Local\Programs\nodenet-launcher\NodeNet Launcher.exe
  "C:\Users\Admin\AppData\Local\Programs\nodenet-launcher\NodeNet Launcher.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\NodeNet Launcher" --app-path="C:\Users\Admin\AppData\Local\Programs\nodenet-launcher\resources\app.asar" --enable-sandbox --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --launch-time-ticks=620204079 --field-trial-handle=1932,i,2024721609893599056,8930902695109755448,262144 --enable-features=PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1956,i,14992573586032770824,7601360062085408536,4 --trace-process-track-uuid=3190708990060038890 --mojo-platform-channel-handle=2512 /prefetch:1
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Time Discovery
  PID:5304
- C:\Users\Admin\AppData\Local\nodenet-launcher-updater\pending\NodeNetLauncherSetup-1.0.25.exe
  C:\Users\Admin\AppData\Local\nodenet-launcher-updater\pending\NodeNetLauncherSetup-1.0.25.exe --updated /S --force-run
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:3212
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -C "if (Get-Command Get-CimInstance -ErrorAction SilentlyContinue) { exit 0 } else { exit 1 }"
    3⤵
    - Hide Artifacts: Ignore Process Interrupts
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4392
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -C "if ((Get-ExecutionPolicy -Scope Process) -eq 'Restricted') { exit 1 } else { exit 0 }"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3784
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -C "if ((Get-CimInstance -ClassName Win32_Process | ? {$_.Path -and $_.Path.StartsWith('C:\Users\Admin\AppData\Local\Programs\nodenet-launcher', 'CurrentCultureIgnoreCase')}).Count -gt 0) { exit 0 } else { exit 1 }"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2088
- - C:\Users\Admin\AppData\Local\Temp\nsf1BA8.tmp\old-uninstaller.exe
    "C:\Users\Admin\AppData\Local\Temp\nsf1BA8.tmp\old-uninstaller.exe" /S /KEEP_APP_DATA /currentuser --keep-shortcuts --updated _?=C:\Users\Admin\AppData\Local\Programs\nodenet-launcher
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:1868
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -C "if (Get-Command Get-CimInstance -ErrorAction SilentlyContinue) { exit 0 } else { exit 1 }"
      4⤵
      Hide Artifacts: Ignore Process Interrupts
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      PID:3324
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -C "if ((Get-ExecutionPolicy -Scope Process) -eq 'Restricted') { exit 1 } else { exit 0 }"
      4⤵
      Command and Scripting Interpreter: PowerShell
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      PID:1840
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -C "if ((Get-CimInstance -ClassName Win32_Process | ? {$_.Path -and $_.Path.StartsWith('C:\Users\Admin\AppData\Local\Programs\nodenet-launcher', 'CurrentCultureIgnoreCase')}).Count -gt 0) { exit 0 } else { exit 1 }"
      4⤵
      Command and Scripting Interpreter: PowerShell
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      PID:800

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:676

C:\Users\Admin\AppData\Local\Programs\nodenet-launcher\NodeNet Launcher.exe
"C:\Users\Admin\AppData\Local\Programs\nodenet-launcher\NodeNet Launcher.exe" --updated
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- Checks processor information in registry
- Suspicious use of WriteProcessMemory
PID:2960
- C:\Users\Admin\AppData\Local\Programs\nodenet-launcher\NodeNet Launcher.exe
  "C:\Users\Admin\AppData\Local\Programs\nodenet-launcher\NodeNet Launcher.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\NodeNet Launcher" --gpu-preferences=WAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAQAAAAAAAAAADAAAAAAAAADgAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAKAAAAAAAAAAoAAAAAAAAAAgAAAAAAAAAEAAAAAIAAAABAAAAAAAAAAgAAAAAAAAACAAAAAAAAAA= --field-trial-handle=1960,i,2921835265025696393,4410725022014617261,262144 --enable-features=PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1964,i,5654476289835854794,3088740448901824343,4 --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=1956 /prefetch:2
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:1300
- C:\Users\Admin\AppData\Local\Programs\nodenet-launcher\NodeNet Launcher.exe
  "C:\Users\Admin\AppData\Local\Programs\nodenet-launcher\NodeNet Launcher.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\NodeNet Launcher" --field-trial-handle=1960,i,2921835265025696393,4410725022014617261,262144 --enable-features=PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1964,i,5654476289835854794,3088740448901824343,4 --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=2012 /prefetch:11
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  PID:3596
- C:\Users\Admin\AppData\Local\Programs\nodenet-launcher\NodeNet Launcher.exe
  "C:\Users\Admin\AppData\Local\Programs\nodenet-launcher\NodeNet Launcher.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\NodeNet Launcher" --app-path="C:\Users\Admin\AppData\Local\Programs\nodenet-launcher\resources\app.asar" --enable-sandbox --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --launch-time-ticks=655661946 --field-trial-handle=1960,i,2921835265025696393,4410725022014617261,262144 --enable-features=PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1964,i,5654476289835854794,3088740448901824343,4 --trace-process-track-uuid=3190708990060038890 --mojo-platform-channel-handle=2724 /prefetch:1
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Time Discovery
  PID:3288

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Ignore Process Interrupts

T1564.011

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact