CYPHERLOCK, INC.

Malware doesn’t always need sophisticated tools to cause havoc. Sometimes, it’s as simple as leveraging WMIC—a quiet, native Windows utility that continues to wreak havoc in the digital world.

In recent weeks, we’ve observed a recurring trend across various ANY.RUN sandbox sessions: malware consistently resorts to WMIC to carry out its malicious actions.

In this article, we’ll dive into five key WMIC command categories that cybercriminals frequently exploit, and why they remain a critical concern for cybersecurity defenders.

Whether you’re tracking potential threats, investigating unusual system activity, or seeking to understand the inner workings of malware, this is your essential starting point.

What Is WMIC?

WMIC (Windows Management Instrumentation Command-line) is a native Windows utility that enables users and attackers to interact with various system components. It allows for actions such as querying hardware information, altering system settings, uninstalling software, and more.

Originally designed for system administrators, attackers are drawn to WMIC because:

• It comes pre-installed on most Windows systems
• It operates quietly without triggering immediate security alerts
• It can be easily scripted into malicious payloads

Now, let’s explore the WMIC commands that are most often seen in malware samples.

1. System Profiling: Malware’s Initial Reconnaissance

Before taking action, malware typically pauses to assess its environment. Is it running on a physical machine or a virtual one? What operating system is present? What hardware components are available?

This process, known as system profiling, helps attackers:

• Evade detection (e.g., sandboxes or security tools)
• Customize their attack based on the specific system environment
• Ensure the malware remains persistent only on machines that are worth exploiting

One of the most effective ways malware gathers this information is through the use of the built-in WMIC command-line tool.

Malware often runs commands like:

• wmic os get locale: This reveals the system’s language and region settings (e.g., en-US, ru-RU). Certain malware will avoid execution in specific regions to avoid detection.
• wmic csproduct get uuid: This retrieves a unique hardware identifier, helping malware determine if it’s running on a virtual machine—a common environment used for analysis.
• wmic os get Caption: This provides the operating system version (e.g., Windows 10 Pro), which aids attackers in evaluating whether the system is a valuable target.

Though these commands may appear minor, they offer significant insight into the malware’s early stages of infection. For example, during a recent ANY.RUN sandbox session, we observed the Trox malware execute the wmic csproduct get uuid command right after initial execution.

Take a closer look at the Trox session here.

In the Process Tree, you’ll see the execution of WMIC.exe. The command it runs is wmic csproduct get uuid:

This simple yet effective method is just one way attackers gather essential details before continuing with their malicious activities.

Detection of wmic csproduct get uuid Command in ANY.RUN Sandbox

Within the ANY.RUN sandbox environment, we observed the triggering of alerts related to the execution of the wmic csproduct get uuid command. This activity raised red flags under two prominent MITRE ATT&CK techniques:

• T1047 – Windows Management Instrumentation
• T1082 – System Information Discovery

ANY.RUN detects these behaviors in real time, enabling security analysts to quickly recognize that the malware is probing the system environment. Such behavior often indicates an attempt by malware to evade detection or adjust its actions based on the environment, such as a sandbox or virtual machine.

System profiling is typically the first step in a cyberattack. Identifying this early on can prevent the malware from advancing to more dangerous stages like data exfiltration, file encryption, or network infiltration.

While WMIC may be a legacy tool, it remains highly effective for both system administrators and malicious actors. Thanks to ANY.RUN’s rapid detection capabilities, these suspicious activities are easy to spot.

2. KMS Activation & System Information Harvesting: Malware Disguised as Software Installers

In this scenario, malware masquerades as a legitimate software activation tool. Similar to unauthorized Microsoft activation tools, malware often exploits these types of tools to:

• Disguise itself as part of regular software activation
• Stealthily collect system and licensing data without raising suspicion

This tactic is frequently observed in malware camouflaged as third-party activators or cracked software installers. While these programs may perform legitimate activation actions, they often carry out malicious functions in the background.

A typical command seen in this context is:

wmic path SoftwareLicensingService call InstallProductKey

While this is generally a standard action to install a product key, when used by malware, it serves several covert objectives:

• Blend in with legitimate software: By mimicking common activation behaviors, the malware appears less suspicious, resembling what users expect from cracked or unauthorized software.
• Test system privileges: This command can reveal whether the malware has the necessary permissions, such as administrative rights, to execute further malicious actions.
• Harvest licensing data: The response from this command can provide valuable information to help attackers identify the system or check if the device has been previously compromised.

Another command that may be executed is:

wmic call RefreshLicenseStatus

This checks the system’s license status, either reinforcing the malware’s legitimate appearance or quietly collecting important system information.

During a recent ANY.RUN sandbox session, multiple instances of the WMIC.exe process were triggered, associated with activation commands that clearly deviated from normal system operations.

Check out this task log to see the detailed execution of these commands.

Execution of Multiple WMIC Commands

In this particular sandbox analysis session, we observe several key behaviors:

• Frequent calls to both SoftwareLicensingProduct and SoftwareLicensingService paths
• Execution of commands such as InstallProductKey and RefreshLicenseStatus
• A hardcoded ApplicationID present across multiple commands, indicating automation

These commands appear in the process timeline in quick succession, suggesting a scripted execution or a stealthy attempt to mimic software activation behavior.

3. AV Evasion: Skirting Detection by Antivirus Software

Not all malware attempts to disable antivirus (AV) software. Some prefer a more subtle approach—avoiding detection entirely. A common method for this is to add malicious files to the list of exceptions that AV software ignores.

This technique, known as AV evasion, can be surprisingly effective. Malware doesn’t need to disable or interfere with the antivirus process; it simply asks Windows Defender to overlook certain files or directories, letting the malicious payload operate undetected.

For example, the following WMIC command can be used to evade detection:

wmic /Namespace:\\root\Microsoft\Windows\Defender class MSFT_MpPreference call Add ExclusionPath="C:\"

This command instructs Windows Defender to exclude the entire C:\ drive from any scans, essentially giving the malware free rein over the system.

Malware may also target specific folders with similar commands, such as:

Add ExclusionPath="C:\Users\Public"

This tactic can make detection nearly impossible unless additional defense mechanisms are in place.

In our analysis of a sandbox session with AsyncRat, this exact command was executed early in the malware’s lifecycle.

Take a closer look at the AsyncRat session in the sandbox.

Detection of WMIC Command in ANY.RUN Sandbox

Here’s what we observed in the ANY.RUN analysis:

Command Line Revealed in ANY.RUN Sandbox

In this analysis, the following key actions were detected:

• WMIC.exe is launched with an extended namespace path pointing to Microsoft Defender.
• The command adds C:\ as an exclusion path, effectively preventing Defender from scanning that drive.
• While the system doesn’t trigger any alerts, ANY.RUN sandbox successfully captures the behavior.

Additionally, the execution is associated with MITRE technique T1012 – Query Registry, as the command interacts with Defender’s internal settings.

Command Line Associated with T1012 – Query Registry

This approach avoids the need for malware to modify system files or disable antivirus software; instead, it simply requests that Windows Defender ignore certain files, and Defender complies without question.

It’s a subtle tactic—quiet and hard to detect. Without behavioral analysis, it can easily go unnoticed. However, in the ANY.RUN sandbox, this activity is instantly flagged:

• The command line reveals the precise exclusion path added.
• The process tree details the time and location of the action.
• It can be linked to established malware behaviors, such as AsyncRat, and tied to the attacker’s broader strategy.

4. Shadow Copy Deletion: Destroying the Last Line of Defense

Once malware has encrypted your files or compromised your system, it typically seeks to prevent any recovery efforts. One of the ways it does this is by deleting shadow copies.

Shadow copies are backup snapshots automatically created by Windows, often representing the last opportunity to recover data after a ransomware attack. Naturally, attackers eliminate these backups first to ensure that victims have no way to restore their files without paying the ransom.

Some common commands used for this purpose include:

• wmic bcdedit /set {default} recoveryenabled no: This command disables the Windows recovery environment, blocking the system from accessing recovery tools during startup.
• vssadmin delete shadows /all /quiet: Silently deletes all shadow copies, wiping out any backup data.
• wmic shadowcopy delete: Another method used to remove restore points, making it impossible to recover encrypted files.

By executing these commands, attackers ensure that their victims cannot recover their files without paying the ransom.

In a recent ANY.RUN sandbox session, the malware (identified as Chaos) used the wmic shadowcopy delete command to prevent recovery, locking the victim out of their backup files.

Detection of wmic shadowcopy delete Command in ANY.RUN Sandbox

In this ANY.RUN sandbox analysis, the following key actions are observed:

• WMIC.exe executes a command to disable the system’s recovery environment.
• The Process Tree clearly displays the sequence of command executions.
• The behavior mirrors common ransomware tactics, as it removes the user’s ability to restore files without backups.

By disabling recovery tools and deleting shadow copies, attackers exert pressure on victims to pay the ransom, as they are left with no recovery options.

These are subtle, yet highly destructive actions that don’t always trigger system alerts, particularly when carried out using built-in utilities like WMIC.

5. Uninstall / Persistence Removal: Erasing All Traces

Not all malware aims for long-term persistence. In some cases, attackers intend to execute their payload, steal data, and vanish without leaving a trace. To achieve this, they use tools like WMIC to clean up after themselves or disable any security defenses.

Other times, malware uses WMIC commands to eliminate competing malware processes or deactivate security software. This falls under the umbrella of persistence removal or post-exploitation cleanup.

One of the simplest commands used for this purpose is:

wmic process call terminate

This command attempts to end any running process that the malware has permission to terminate. Malware might use this to:

• Disable security monitoring tools
• Eliminate other malicious software
• Terminate its own processes once it’s completed its task

Attackers often refine this command by filtering for specific executables. For example:

wmic process where "name='svchost.exe'" call terminate

In a recent ANY.RUN sandbox session, malware used WMIC to issue a termination command targeting a suspicious file located in the Public directory.

Take a look at the session analysis for more details.

Process Termination Detected in ANY.RUN Sandbox

In this ANY.RUN sandbox session, the following was observed:

• The process path reveals C:\Users\Public\Program Files\svchost.exe, a location where svchost.exe should never be found.
• The command was executed via WMIC.exe, applying a specific process filter.
• ANY.RUN flagged this action with a warning: “Likely accesses (executes) a file from the Public directory.”

This behavior strongly suggests that the malware either executed its payload from an unconventional location and is now trying to eliminate evidence or is targeting a competing process or security tool running from that same path.

Why Early Detection of WMIC Activity Can Prevent Major Damage

One thing these command categories highlight is clear: WMIC remains a favored tool for malware, especially in the initial phases of an attack.

From gathering system information and bypassing antivirus protections to wiping out backup files and terminating critical processes, these WMIC commands may seem minor on their own, but together, they outline a comprehensive strategy that attackers use to:

• Maintain stealth
• Disable defenses
• Lock down systems
• Make recovery extremely difficult

This emphasizes the importance of real-time monitoring for WMIC activity to prevent further escalation.

How ANY.RUN Helps You Detect WMIC-Driven Threats

ANY.RUN provides an interactive sandbox that simplifies detecting and analyzing how malware uses WMIC. Here’s how it enhances your defense:

• Full command visibility: Track every executed WMIC command, including arguments and timestamps.
• Immediate detection of evasive tactics: From creating exclusions for Defender to deleting shadow copies, ANY.RUN identifies actions that traditional AV software might miss.
• Clear process relationship visualization: The process tree offers precise details on when WMIC is called and what follows.
• Mapping to MITRE ATT&CK: Behaviors are automatically linked to relevant ATT&CK techniques like T1082 (System Information Discovery) and T1490 (Inhibit System Recovery).
• Collaborative tools: Easily share live sessions, generate detailed reports, and work together with your team in real time.
• Speed up investigations: Observe malware behavior as it unfolds instead of sifting through logs after the attack.

Whether you’re part of a blue team, threat intelligence unit, or an incident response group, ANY.RUN enables you to transition from asking “What happened?” to understanding “Exactly what the malware did” in minutes, not hours.

Prevent Quiet Commands from Escalating Into Major Incidents

While WMIC may appear benign, in the hands of cybercriminals, it can be the quiet precursor to a much more severe breach.

By providing real-time insights into command-line operations, process behaviors, and post-exploitation tactics, ANY.RUN empowers you to identify and stop these threats before they escalate into ransomware attacks or full system compromises.