0ed3d06f11316eadaf26360dde7edc5ea0f0f726b8ef25e683c4f31fee25fa4e

Analysis

max time kernel
90s
max time network
94s
platform
windows11-21h2_x64
resource
win11-20240221-en
resource tags

arch:x64arch:x86image:win11-20240221-enlocale:en-usos:windows11-21h2-x64system
submitted
18-03-2024 15:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

idqwo.cmd
Size

156B
MD5

c1df2c77472f88d3489162cfe09a10d0
SHA1

6e7edcd60762a79f1b64ce36756b26491f942299
SHA256

0ed3d06f11316eadaf26360dde7edc5ea0f0f726b8ef25e683c4f31fee25fa4e
SHA512

83bc21b9f3baf15137cfa187f768c7fac63a61f6305dfa31643ff685ba2554481c8c795d333735cbe1c23ed36bfb29e91c7eeb493abe34c1c2f66ad136387e96

Score

1^/10

Malware Config

Signatures

Kills process with taskkill 64 IoCs

evasion

pid	Process
2600	taskkill.exe
1996	taskkill.exe
856	taskkill.exe
4208	taskkill.exe
4136	taskkill.exe
5024	taskkill.exe
1884	taskkill.exe
240	taskkill.exe
4696	taskkill.exe
696	taskkill.exe
1120	taskkill.exe
1444	taskkill.exe
3948	taskkill.exe
3680	taskkill.exe
4596	taskkill.exe
3940	taskkill.exe
2116	taskkill.exe
1000	taskkill.exe
2468	taskkill.exe
1572	taskkill.exe
4564	taskkill.exe
3196	taskkill.exe
3268	taskkill.exe
3684	taskkill.exe
4912	taskkill.exe
4584	taskkill.exe
2208	taskkill.exe
1552	taskkill.exe
1048	taskkill.exe
1188	taskkill.exe
2512	taskkill.exe
4008	taskkill.exe
1064	taskkill.exe
2616	taskkill.exe
1364	taskkill.exe
2100	taskkill.exe
3740	taskkill.exe
3636	taskkill.exe
5028	taskkill.exe
4184	taskkill.exe
5056	taskkill.exe
4612	taskkill.exe
984	taskkill.exe
1576	taskkill.exe
3956	taskkill.exe
1564	taskkill.exe
1264	taskkill.exe
1704	taskkill.exe
2152	taskkill.exe
480	taskkill.exe
2112	taskkill.exe
1936	taskkill.exe
1432	taskkill.exe
2436	taskkill.exe
4632	taskkill.exe
1044	taskkill.exe
3720	taskkill.exe
3596	taskkill.exe
2468	taskkill.exe
4404	taskkill.exe
3568	taskkill.exe
4908	taskkill.exe
2548	taskkill.exe
1420	taskkill.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4256	taskkill.exe
Token: SeDebugPrivilege	1884	taskkill.exe
Token: SeDebugPrivilege	2812	taskkill.exe
Token: SeDebugPrivilege	768	taskkill.exe
Token: SeDebugPrivilege	3948	taskkill.exe
Token: SeDebugPrivilege	1444	taskkill.exe
Token: SeDebugPrivilege	508	taskkill.exe
Token: SeDebugPrivilege	5116	taskkill.exe
Token: SeDebugPrivilege	2100	taskkill.exe
Token: SeDebugPrivilege	4512	taskkill.exe
Token: SeDebugPrivilege	2512	taskkill.exe
Token: SeDebugPrivilege	3596	taskkill.exe
Token: SeDebugPrivilege	3776	taskkill.exe
Token: SeDebugPrivilege	3424	taskkill.exe
Token: SeDebugPrivilege	1436	taskkill.exe
Token: SeDebugPrivilege	2548	taskkill.exe
Token: SeDebugPrivilege	1680	taskkill.exe
Token: SeDebugPrivilege	4864	taskkill.exe
Token: SeDebugPrivilege	4200	taskkill.exe
Token: SeDebugPrivilege	2984	taskkill.exe
Token: SeDebugPrivilege	1352	taskkill.exe
Token: SeDebugPrivilege	3740	taskkill.exe
Token: SeDebugPrivilege	1168	taskkill.exe
Token: SeDebugPrivilege	2208	taskkill.exe
Token: SeDebugPrivilege	1996	taskkill.exe
Token: SeDebugPrivilege	1644	taskkill.exe
Token: SeDebugPrivilege	856	taskkill.exe
Token: SeDebugPrivilege	1740	taskkill.exe
Token: SeDebugPrivilege	3196	taskkill.exe
Token: SeDebugPrivilege	2468	taskkill.exe
Token: SeDebugPrivilege	2768	taskkill.exe
Token: SeDebugPrivilege	480	taskkill.exe
Token: SeDebugPrivilege	892	taskkill.exe
Token: SeDebugPrivilege	2112	taskkill.exe
Token: SeDebugPrivilege	3728	taskkill.exe
Token: SeDebugPrivilege	1120	taskkill.exe
Token: SeDebugPrivilege	2116	taskkill.exe
Token: SeDebugPrivilege	3268	taskkill.exe
Token: SeDebugPrivilege	4756	taskkill.exe
Token: SeDebugPrivilege	1596	taskkill.exe
Token: SeDebugPrivilege	4208	taskkill.exe
Token: SeDebugPrivilege	2016	taskkill.exe
Token: SeDebugPrivilege	4632	taskkill.exe
Token: SeDebugPrivilege	5028	taskkill.exe
Token: SeDebugPrivilege	4624	taskkill.exe
Token: SeDebugPrivilege	3344	taskkill.exe
Token: SeDebugPrivilege	4000	taskkill.exe
Token: SeDebugPrivilege	4404	taskkill.exe
Token: SeDebugPrivilege	3684	taskkill.exe
Token: SeDebugPrivilege	4008	taskkill.exe
Token: SeDebugPrivilege	4672	taskkill.exe
Token: SeDebugPrivilege	2828	taskkill.exe
Token: SeDebugPrivilege	3808	taskkill.exe
Token: SeDebugPrivilege	1552	taskkill.exe
Token: SeDebugPrivilege	1936	taskkill.exe
Token: SeDebugPrivilege	3568	taskkill.exe
Token: SeDebugPrivilege	4912	taskkill.exe
Token: SeDebugPrivilege	1444	taskkill.exe
Token: SeDebugPrivilege	508	taskkill.exe
Token: SeDebugPrivilege	5116	taskkill.exe
Token: SeDebugPrivilege	2100	taskkill.exe
Token: SeDebugPrivilege	4512	taskkill.exe
Token: SeDebugPrivilege	2512	taskkill.exe
Token: SeDebugPrivilege	1000	taskkill.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 584 wrote to memory of 4256	584	cmd.exe	80
PID 584 wrote to memory of 4256	584	cmd.exe	80
PID 584 wrote to memory of 1884	584	cmd.exe	82
PID 584 wrote to memory of 1884	584	cmd.exe	82
PID 584 wrote to memory of 2812	584	cmd.exe	83
PID 584 wrote to memory of 2812	584	cmd.exe	83
PID 584 wrote to memory of 768	584	cmd.exe	84
PID 584 wrote to memory of 768	584	cmd.exe	84
PID 584 wrote to memory of 3948	584	cmd.exe	86
PID 584 wrote to memory of 3948	584	cmd.exe	86
PID 584 wrote to memory of 1444	584	cmd.exe	87
PID 584 wrote to memory of 1444	584	cmd.exe	87
PID 584 wrote to memory of 508	584	cmd.exe	88
PID 584 wrote to memory of 508	584	cmd.exe	88
PID 584 wrote to memory of 5116	584	cmd.exe	89
PID 584 wrote to memory of 5116	584	cmd.exe	89
PID 584 wrote to memory of 2100	584	cmd.exe	90
PID 584 wrote to memory of 2100	584	cmd.exe	90
PID 584 wrote to memory of 4512	584	cmd.exe	91
PID 584 wrote to memory of 4512	584	cmd.exe	91
PID 584 wrote to memory of 2512	584	cmd.exe	92
PID 584 wrote to memory of 2512	584	cmd.exe	92
PID 584 wrote to memory of 3596	584	cmd.exe	93
PID 584 wrote to memory of 3596	584	cmd.exe	93
PID 584 wrote to memory of 3776	584	cmd.exe	94
PID 584 wrote to memory of 3776	584	cmd.exe	94
PID 584 wrote to memory of 3424	584	cmd.exe	95
PID 584 wrote to memory of 3424	584	cmd.exe	95
PID 584 wrote to memory of 1436	584	cmd.exe	96
PID 584 wrote to memory of 1436	584	cmd.exe	96
PID 584 wrote to memory of 2548	584	cmd.exe	97
PID 584 wrote to memory of 2548	584	cmd.exe	97
PID 584 wrote to memory of 1680	584	cmd.exe	98
PID 584 wrote to memory of 1680	584	cmd.exe	98
PID 584 wrote to memory of 4864	584	cmd.exe	99
PID 584 wrote to memory of 4864	584	cmd.exe	99
PID 584 wrote to memory of 4200	584	cmd.exe	100
PID 584 wrote to memory of 4200	584	cmd.exe	100
PID 584 wrote to memory of 2984	584	cmd.exe	101
PID 584 wrote to memory of 2984	584	cmd.exe	101
PID 584 wrote to memory of 1352	584	cmd.exe	102
PID 584 wrote to memory of 1352	584	cmd.exe	102
PID 584 wrote to memory of 3740	584	cmd.exe	103
PID 584 wrote to memory of 3740	584	cmd.exe	103
PID 584 wrote to memory of 1168	584	cmd.exe	104
PID 584 wrote to memory of 1168	584	cmd.exe	104
PID 584 wrote to memory of 2208	584	cmd.exe	105
PID 584 wrote to memory of 2208	584	cmd.exe	105
PID 584 wrote to memory of 1996	584	cmd.exe	106
PID 584 wrote to memory of 1996	584	cmd.exe	106
PID 584 wrote to memory of 1644	584	cmd.exe	107
PID 584 wrote to memory of 1644	584	cmd.exe	107
PID 584 wrote to memory of 856	584	cmd.exe	108
PID 584 wrote to memory of 856	584	cmd.exe	108
PID 584 wrote to memory of 1740	584	cmd.exe	109
PID 584 wrote to memory of 1740	584	cmd.exe	109
PID 584 wrote to memory of 3196	584	cmd.exe	110
PID 584 wrote to memory of 3196	584	cmd.exe	110
PID 584 wrote to memory of 2468	584	cmd.exe	111
PID 584 wrote to memory of 2468	584	cmd.exe	111
PID 584 wrote to memory of 2768	584	cmd.exe	112
PID 584 wrote to memory of 2768	584	cmd.exe	112
PID 584 wrote to memory of 480	584	cmd.exe	113
PID 584 wrote to memory of 480	584	cmd.exe	113

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\idqwo.cmd"
1⤵
- Suspicious use of WriteProcessMemory
PID:584
- C:\Windows\system32\taskkill.exe
  taskkill /im ClassroomWindows.exe /F
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4256
- C:\Windows\system32\taskkill.exe
  taskkill /im ClassroomWindows.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1884
- C:\Windows\system32\taskkill.exe
  taskkill /im ClassroomWindows.exe /F
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2812
- C:\Windows\system32\taskkill.exe
  taskkill /im ClassroomWindows.exe /F
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:768
- C:\Windows\system32\taskkill.exe
  taskkill /im ClassroomWindows.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3948
- C:\Windows\system32\taskkill.exe
  taskkill /im ClassroomWindows.exe /F
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1444
- C:\Windows\system32\taskkill.exe
  taskkill /im ClassroomWindows.exe /F
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:508
- C:\Windows\system32\taskkill.exe
  taskkill /im ClassroomWindows.exe /F
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:5116
- C:\Windows\system32\taskkill.exe
  taskkill /im ClassroomWindows.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2100
- C:\Windows\system32\taskkill.exe
  taskkill /im ClassroomWindows.exe /F
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4512
- C:\Windows\system32\taskkill.exe
  taskkill /im ClassroomWindows.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2512
- C:\Windows\system32\taskkill.exe
  taskkill /im ClassroomWindows.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3596
- C:\Windows\system32\taskkill.exe
  taskkill /im ClassroomWindows.exe /F
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3776
- C:\Windows\system32\taskkill.exe
  taskkill /im ClassroomWindows.exe /F
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3424
- C:\Windows\system32\taskkill.exe
  taskkill /im ClassroomWindows.exe /F
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1436
- C:\Windows\system32\taskkill.exe
  taskkill /im ClassroomWindows.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2548
- C:\Windows\system32\taskkill.exe
  taskkill /im ClassroomWindows.exe /F
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1680
- C:\Windows\system32\taskkill.exe
  taskkill /im ClassroomWindows.exe /F
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4864
- C:\Windows\system32\taskkill.exe
  taskkill /im ClassroomWindows.exe /F
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4200
- C:\Windows\system32\taskkill.exe
  taskkill /im ClassroomWindows.exe /F
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2984
- C:\Windows\system32\taskkill.exe
  taskkill /im ClassroomWindows.exe /F
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1352
- C:\Windows\system32\taskkill.exe
  taskkill /im ClassroomWindows.exe /F
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3740
- C:\Windows\system32\taskkill.exe
  taskkill /im ClassroomWindows.exe /F
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1168
- C:\Windows\system32\taskkill.exe
  taskkill /im ClassroomWindows.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2208
- C:\Windows\system32\taskkill.exe
  taskkill /im ClassroomWindows.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1996
- C:\Windows\system32\taskkill.exe
  taskkill /im ClassroomWindows.exe /F
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1644
- C:\Windows\system32\taskkill.exe
  taskkill /im ClassroomWindows.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:856
- C:\Windows\system32\taskkill.exe
  taskkill /im ClassroomWindows.exe /F
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1740
- C:\Windows\system32\taskkill.exe
  taskkill /im ClassroomWindows.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3196
- C:\Windows\system32\taskkill.exe
  taskkill /im ClassroomWindows.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2468
- C:\Windows\system32\taskkill.exe
  taskkill /im ClassroomWindows.exe /F
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2768
- C:\Windows\system32\taskkill.exe
  taskkill /im ClassroomWindows.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:480
- C:\Windows\system32\taskkill.exe
  taskkill /im ClassroomWindows.exe /F
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:892
- C:\Windows\system32\taskkill.exe
  taskkill /im ClassroomWindows.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2112
- C:\Windows\system32\taskkill.exe
  taskkill /im ClassroomWindows.exe /F
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3728
- C:\Windows\system32\taskkill.exe
  taskkill /im ClassroomWindows.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1120
- C:\Windows\system32\taskkill.exe
  taskkill /im ClassroomWindows.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2116
- C:\Windows\system32\taskkill.exe
  taskkill /im ClassroomWindows.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3268
- C:\Windows\system32\taskkill.exe
  taskkill /im ClassroomWindows.exe /F
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4756
- C:\Windows\system32\taskkill.exe
  taskkill /im ClassroomWindows.exe /F
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1596
- C:\Windows\system32\taskkill.exe
  taskkill /im ClassroomWindows.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4208
- C:\Windows\system32\taskkill.exe
  taskkill /im ClassroomWindows.exe /F
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2016
- C:\Windows\system32\taskkill.exe
  taskkill /im ClassroomWindows.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4632
- C:\Windows\system32\taskkill.exe
  taskkill /im ClassroomWindows.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:5028
- C:\Windows\system32\taskkill.exe
  taskkill /im ClassroomWindows.exe /F
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4624
- C:\Windows\system32\taskkill.exe
  taskkill /im ClassroomWindows.exe /F
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3344
- C:\Windows\system32\taskkill.exe
  taskkill /im ClassroomWindows.exe /F
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4000
- C:\Windows\system32\taskkill.exe
  taskkill /im ClassroomWindows.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4404
- C:\Windows\system32\taskkill.exe
  taskkill /im ClassroomWindows.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3684
- C:\Windows\system32\taskkill.exe
  taskkill /im ClassroomWindows.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4008
- C:\Windows\system32\taskkill.exe
  taskkill /im ClassroomWindows.exe /F
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4672
- C:\Windows\system32\taskkill.exe
  taskkill /im ClassroomWindows.exe /F
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2828
- C:\Windows\system32\taskkill.exe
  taskkill /im ClassroomWindows.exe /F
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3808
- C:\Windows\system32\taskkill.exe
  taskkill /im ClassroomWindows.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1552
- C:\Windows\system32\taskkill.exe
  taskkill /im ClassroomWindows.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1936
- C:\Windows\system32\taskkill.exe
  taskkill /im ClassroomWindows.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3568
- C:\Windows\system32\taskkill.exe
  taskkill /im ClassroomWindows.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4912
- C:\Windows\system32\taskkill.exe
  taskkill /im ClassroomWindows.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1444
- C:\Windows\system32\taskkill.exe
  taskkill /im ClassroomWindows.exe /F
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:508
- C:\Windows\system32\taskkill.exe
  taskkill /im ClassroomWindows.exe /F
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:5116
- C:\Windows\system32\taskkill.exe
  taskkill /im ClassroomWindows.exe /F
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2100
- C:\Windows\system32\taskkill.exe
  taskkill /im ClassroomWindows.exe /F
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4512
- C:\Windows\system32\taskkill.exe
  taskkill /im ClassroomWindows.exe /F
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2512
- C:\Windows\system32\taskkill.exe
  taskkill /im ClassroomWindows.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1000
- C:\Windows\system32\taskkill.exe
  taskkill /im ClassroomWindows.exe /F
  2⤵
  PID:2892
- C:\Windows\system32\taskkill.exe
  taskkill /im ClassroomWindows.exe /F
  2⤵
  PID:4560
- C:\Windows\system32\taskkill.exe
  taskkill /im ClassroomWindows.exe /F
  2⤵
  - Kills process with taskkill
  PID:3680
- C:\Windows\system32\taskkill.exe
  taskkill /im ClassroomWindows.exe /F
  2⤵
  - Kills process with taskkill
  PID:3956
- C:\Windows\system32\taskkill.exe
  taskkill /im ClassroomWindows.exe /F
  2⤵
  PID:2096
- C:\Windows\system32\taskkill.exe
  taskkill /im ClassroomWindows.exe /F
  2⤵
  PID:3572
- C:\Windows\system32\taskkill.exe
  taskkill /im ClassroomWindows.exe /F
  2⤵
  - Kills process with taskkill
  PID:1564
- C:\Windows\system32\taskkill.exe
  taskkill /im ClassroomWindows.exe /F
  2⤵
  - Kills process with taskkill
  PID:4596
- C:\Windows\system32\taskkill.exe
  taskkill /im ClassroomWindows.exe /F
  2⤵
  - Kills process with taskkill
  PID:4184
- C:\Windows\system32\taskkill.exe
  taskkill /im ClassroomWindows.exe /F
  2⤵
  - Kills process with taskkill
  PID:3740
- C:\Windows\system32\taskkill.exe
  taskkill /im ClassroomWindows.exe /F
  2⤵
  PID:1168
- C:\Windows\system32\taskkill.exe
  taskkill /im ClassroomWindows.exe /F
  2⤵
  PID:2208
- C:\Windows\system32\taskkill.exe
  taskkill /im ClassroomWindows.exe /F
  2⤵
  PID:1996
- C:\Windows\system32\taskkill.exe
  taskkill /im ClassroomWindows.exe /F
  2⤵
  - Kills process with taskkill
  PID:1064
- C:\Windows\system32\taskkill.exe
  taskkill /im ClassroomWindows.exe /F
  2⤵
  - Kills process with taskkill
  PID:2616
- C:\Windows\system32\taskkill.exe
  taskkill /im ClassroomWindows.exe /F
  2⤵
  - Kills process with taskkill
  PID:1420
- C:\Windows\system32\taskkill.exe
  taskkill /im ClassroomWindows.exe /F
  2⤵
  PID:3196
- C:\Windows\system32\taskkill.exe
  taskkill /im ClassroomWindows.exe /F
  2⤵
  - Kills process with taskkill
  PID:2468
- C:\Windows\system32\taskkill.exe
  taskkill /im ClassroomWindows.exe /F
  2⤵
  - Kills process with taskkill
  PID:4136
- C:\Windows\system32\taskkill.exe
  taskkill /im ClassroomWindows.exe /F
  2⤵
  PID:4784
- C:\Windows\system32\taskkill.exe
  taskkill /im ClassroomWindows.exe /F
  2⤵
  PID:628
- C:\Windows\system32\taskkill.exe
  taskkill /im ClassroomWindows.exe /F
  2⤵
  - Kills process with taskkill
  PID:1432
- C:\Windows\system32\taskkill.exe
  taskkill /im ClassroomWindows.exe /F
  2⤵
  - Kills process with taskkill
  PID:2436
- C:\Windows\system32\taskkill.exe
  taskkill /im ClassroomWindows.exe /F
  2⤵
  PID:2192
- C:\Windows\system32\taskkill.exe
  taskkill /im ClassroomWindows.exe /F
  2⤵
  - Kills process with taskkill
  PID:1264
- C:\Windows\system32\taskkill.exe
  taskkill /im ClassroomWindows.exe /F
  2⤵
  - Kills process with taskkill
  PID:240
- C:\Windows\system32\taskkill.exe
  taskkill /im ClassroomWindows.exe /F
  2⤵
  - Kills process with taskkill
  PID:1572
- C:\Windows\system32\taskkill.exe
  taskkill /im ClassroomWindows.exe /F
  2⤵
  PID:884
- C:\Windows\system32\taskkill.exe
  taskkill /im ClassroomWindows.exe /F
  2⤵
  PID:3324
- C:\Windows\system32\taskkill.exe
  taskkill /im ClassroomWindows.exe /F
  2⤵
  PID:1844
- C:\Windows\system32\taskkill.exe
  taskkill /im ClassroomWindows.exe /F
  2⤵
  PID:3524
- C:\Windows\system32\taskkill.exe
  taskkill /im ClassroomWindows.exe /F
  2⤵
  PID:4932
- C:\Windows\system32\taskkill.exe
  taskkill /im ClassroomWindows.exe /F
  2⤵
  - Kills process with taskkill
  PID:5056
- C:\Windows\system32\taskkill.exe
  taskkill /im ClassroomWindows.exe /F
  2⤵
  - Kills process with taskkill
  PID:4584
- C:\Windows\system32\taskkill.exe
  taskkill /im ClassroomWindows.exe /F
  2⤵
  - Kills process with taskkill
  PID:5024
- C:\Windows\system32\taskkill.exe
  taskkill /im ClassroomWindows.exe /F
  2⤵
  PID:720
- C:\Windows\system32\taskkill.exe
  taskkill /im ClassroomWindows.exe /F
  2⤵
  - Kills process with taskkill
  PID:1704
- C:\Windows\system32\taskkill.exe
  taskkill /im ClassroomWindows.exe /F
  2⤵
  PID:1108
- C:\Windows\system32\taskkill.exe
  taskkill /im ClassroomWindows.exe /F
  2⤵
  PID:2560
- C:\Windows\system32\taskkill.exe
  taskkill /im ClassroomWindows.exe /F
  2⤵
  PID:3512
- C:\Windows\system32\taskkill.exe
  taskkill /im ClassroomWindows.exe /F
  2⤵
  - Kills process with taskkill
  PID:2152
- C:\Windows\system32\taskkill.exe
  taskkill /im ClassroomWindows.exe /F
  2⤵
  - Kills process with taskkill
  PID:4696
- C:\Windows\system32\taskkill.exe
  taskkill /im ClassroomWindows.exe /F
  2⤵
  - Kills process with taskkill
  PID:1364
- C:\Windows\system32\taskkill.exe
  taskkill /im ClassroomWindows.exe /F
  2⤵
  - Kills process with taskkill
  PID:4564
- C:\Windows\system32\taskkill.exe
  taskkill /im ClassroomWindows.exe /F
  2⤵
  PID:4816
- C:\Windows\system32\taskkill.exe
  taskkill /im ClassroomWindows.exe /F
  2⤵
  - Kills process with taskkill
  PID:3940
- C:\Windows\system32\taskkill.exe
  taskkill /im ClassroomWindows.exe /F
  2⤵
  - Kills process with taskkill
  PID:4612
- C:\Windows\system32\taskkill.exe
  taskkill /im ClassroomWindows.exe /F
  2⤵
  PID:428
- C:\Windows\system32\taskkill.exe
  taskkill /im ClassroomWindows.exe /F
  2⤵
  PID:4432
- C:\Windows\system32\taskkill.exe
  taskkill /im ClassroomWindows.exe /F
  2⤵
  - Kills process with taskkill
  PID:4908
- C:\Windows\system32\taskkill.exe
  taskkill /im ClassroomWindows.exe /F
  2⤵
  PID:2448
- C:\Windows\system32\taskkill.exe
  taskkill /im ClassroomWindows.exe /F
  2⤵
  PID:1356
- C:\Windows\system32\taskkill.exe
  taskkill /im ClassroomWindows.exe /F
  2⤵
  PID:4880
- C:\Windows\system32\taskkill.exe
  taskkill /im ClassroomWindows.exe /F
  2⤵
  - Kills process with taskkill
  PID:2600
- C:\Windows\system32\taskkill.exe
  taskkill /im ClassroomWindows.exe /F
  2⤵
  PID:4840
- C:\Windows\system32\taskkill.exe
  taskkill /im ClassroomWindows.exe /F
  2⤵
  PID:3560
- C:\Windows\system32\taskkill.exe
  taskkill /im ClassroomWindows.exe /F
  2⤵
  PID:2204
- C:\Windows\system32\taskkill.exe
  taskkill /im ClassroomWindows.exe /F
  2⤵
  - Kills process with taskkill
  PID:1188
- C:\Windows\system32\taskkill.exe
  taskkill /im ClassroomWindows.exe /F
  2⤵
  - Kills process with taskkill
  PID:696
- C:\Windows\system32\taskkill.exe
  taskkill /im ClassroomWindows.exe /F
  2⤵
  - Kills process with taskkill
  PID:984
- C:\Windows\system32\taskkill.exe
  taskkill /im ClassroomWindows.exe /F
  2⤵
  PID:3008
- C:\Windows\system32\taskkill.exe
  taskkill /im ClassroomWindows.exe /F
  2⤵
  - Kills process with taskkill
  PID:1048
- C:\Windows\system32\taskkill.exe
  taskkill /im ClassroomWindows.exe /F
  2⤵
  PID:3932
- C:\Windows\system32\taskkill.exe
  taskkill /im ClassroomWindows.exe /F
  2⤵
  PID:2984
- C:\Windows\system32\taskkill.exe
  taskkill /im ClassroomWindows.exe /F
  2⤵
  - Kills process with taskkill
  PID:3636
- C:\Windows\system32\taskkill.exe
  taskkill /im ClassroomWindows.exe /F
  2⤵
  PID:3700
- C:\Windows\system32\taskkill.exe
  taskkill /im ClassroomWindows.exe /F
  2⤵
  - Kills process with taskkill
  PID:1044
- C:\Windows\system32\taskkill.exe
  taskkill /im ClassroomWindows.exe /F
  2⤵
  PID:3548
- C:\Windows\system32\taskkill.exe
  taskkill /im ClassroomWindows.exe /F
  2⤵
  PID:2264
- C:\Windows\system32\taskkill.exe
  taskkill /im ClassroomWindows.exe /F
  2⤵
  - Kills process with taskkill
  PID:3720
- C:\Windows\system32\taskkill.exe
  taskkill /im ClassroomWindows.exe /F
  2⤵
  PID:4800
- C:\Windows\system32\taskkill.exe
  taskkill /im ClassroomWindows.exe /F
  2⤵
  - Kills process with taskkill
  PID:1576

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads