bce46dfea77df9cd1109c732b9a26a8888ecf8665116a94254b35341989ffc57

Analysis

max time kernel
149s
max time network
151s
platform
windows11-21h2_x64
resource
win11-20240412-en
resource tags

arch:x64arch:x86image:win11-20240412-enlocale:en-usos:windows11-21h2-x64system
submitted
25-04-2024 18:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ratnik.exe
Size

283KB
MD5

cd2549b04a34bfecaa580c13aad997ff
SHA1

9754b3f5443513d79c4df458eac36c8e6e31df4a
SHA256

bce46dfea77df9cd1109c732b9a26a8888ecf8665116a94254b35341989ffc57
SHA512

2a7a74bf8bdb79b36929e7384e16fcc186a9e5c5d65566068c9b69ea138737755861b1f7fc5158e085b731de2a7389c3c979ff85c2cd99ed9b89b38c8f05e39f
SSDEEP

6144:pEDbtVkjwfWi3Le6VlWT8b9EqP4Xo5qDmb1Ugp:p8XNPVle8SqSDkVp

Score

10^/10

persistence ransomware

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

Processes:

ratnik.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\System32\\userinit.exe,C:\\Users\\Admin\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\xdwdCorel VideoStudio Upgrade.exe"	ratnik.exe

Modifies AppInit DLL entries 2 TTPs
persistence

Registry Run Keys / Startup Folder
T1547.001

Modify Registry
T1112

Loads dropped DLL 47 IoCs

Processes:

WmiApSrv.exe

pid	process
2396
1884
4480
4812	WmiApSrv.exe
892
4804
3932
4688
4732
4156
436
1996
4812
3668
3932
1864
1416
4952
1348
1984
3132
3964
4688
2624
4796
3840
4020
4452
4644
684
4152
1696
3852
3928
2980
3828
1472
3132
2720
4164
1868
4852
2872
436
1816
1296
112

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

Processes:

ratnik.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3263309122-2820180308-3568046652-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\tmpB34E.tmp.png"	ratnik.exe

Drops file in Windows directory 1 IoCs

Processes:

ratnik.exe

description ioc process

File created C:\Windows\xdwd.dll ratnik.exe

description	ioc	process
File created	C:\Windows\xdwd.dll	ratnik.exe

Creates scheduled task(s) 1 TTPs 46 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

Processes:

schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exe

pid	process
3144	schtasks.exe
2448	schtasks.exe
4808	schtasks.exe
1268	schtasks.exe
2364	schtasks.exe
400	schtasks.exe
4572	schtasks.exe
5092	schtasks.exe
2060	schtasks.exe
1520	schtasks.exe
4588	schtasks.exe
3748	schtasks.exe
132	schtasks.exe
1628	schtasks.exe
3556	schtasks.exe
2824	schtasks.exe
916	schtasks.exe
2620	schtasks.exe
3340	schtasks.exe
596	schtasks.exe
4708	schtasks.exe
4380	schtasks.exe
2308	schtasks.exe
2392	schtasks.exe
2188	schtasks.exe
1316	schtasks.exe
2988	schtasks.exe
2820	schtasks.exe
5096	schtasks.exe
2836	schtasks.exe
3500	schtasks.exe
4560	schtasks.exe
1824	schtasks.exe
2056	schtasks.exe
1040	schtasks.exe
5092	schtasks.exe
4980	schtasks.exe
5108	schtasks.exe
4376	schtasks.exe
3852	schtasks.exe
1960	schtasks.exe
2836	schtasks.exe
1984	schtasks.exe
4752	schtasks.exe
648	schtasks.exe
2492	schtasks.exe

Modifies Control Panel 2 IoCs

evasion

Processes:

ratnik.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3263309122-2820180308-3568046652-1000\Control Panel\Desktop\TileWallpaper = "0"	ratnik.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3263309122-2820180308-3568046652-1000\Control Panel\Desktop\WallpaperStyle = "2"	ratnik.exe

Modifies registry class 1 IoCs

Processes:

MiniSearchHost.exe

description ioc process

Key created \REGISTRY\USER\S-1-5-21-3263309122-2820180308-3568046652-1000_Classes\Local Settings\MuiCache MiniSearchHost.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3263309122-2820180308-3568046652-1000_Classes\Local Settings\MuiCache	MiniSearchHost.exe

Suspicious behavior: EnumeratesProcesses 26 IoCs

Processes:

ratnik.exeWmiApSrv.exe

pid	process
1756	ratnik.exe
1756	ratnik.exe
1756	ratnik.exe
1756	ratnik.exe
1756	ratnik.exe
1756	ratnik.exe
1756	ratnik.exe
1756	ratnik.exe
1756	ratnik.exe
1756	ratnik.exe
1756	ratnik.exe
1756	ratnik.exe
1756	ratnik.exe
1756	ratnik.exe
1756	ratnik.exe
1756	ratnik.exe
1756	ratnik.exe
1756	ratnik.exe
1756	ratnik.exe
1756	ratnik.exe
1756	ratnik.exe
1756	ratnik.exe
1756	ratnik.exe
1756	ratnik.exe
4812	WmiApSrv.exe
4812	WmiApSrv.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

ratnik.exe

description pid process

Token: SeDebugPrivilege 1756 ratnik.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

MiniSearchHost.exe

pid process

3580 MiniSearchHost.exe

description	pid	process
Token: SeDebugPrivilege	1756	ratnik.exe

pid	process
3580	MiniSearchHost.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

ratnik.exeCMD.exeCMD.exeCMD.exeCMD.exeCMD.exeCMD.exeCMD.exeCMD.exeCMD.exeCMD.exeCMD.exeCMD.exeCMD.exeCMD.exeCMD.exeCMD.exe

description	pid	process	target process
PID 1756 wrote to memory of 1696	1756	ratnik.exe	CMD.exe
PID 1756 wrote to memory of 1696	1756	ratnik.exe	CMD.exe
PID 1696 wrote to memory of 3556	1696	CMD.exe	schtasks.exe
PID 1696 wrote to memory of 3556	1696	CMD.exe	schtasks.exe
PID 1756 wrote to memory of 1532	1756	ratnik.exe	CMD.exe
PID 1756 wrote to memory of 1532	1756	ratnik.exe	CMD.exe
PID 1532 wrote to memory of 2836	1532	CMD.exe	schtasks.exe
PID 1532 wrote to memory of 2836	1532	CMD.exe	schtasks.exe
PID 1756 wrote to memory of 1888	1756	ratnik.exe	CMD.exe
PID 1756 wrote to memory of 1888	1756	ratnik.exe	CMD.exe
PID 1888 wrote to memory of 3340	1888	CMD.exe	schtasks.exe
PID 1888 wrote to memory of 3340	1888	CMD.exe	schtasks.exe
PID 1756 wrote to memory of 1576	1756	ratnik.exe	CMD.exe
PID 1756 wrote to memory of 1576	1756	ratnik.exe	CMD.exe
PID 1576 wrote to memory of 4980	1576	CMD.exe	schtasks.exe
PID 1576 wrote to memory of 4980	1576	CMD.exe	schtasks.exe
PID 1756 wrote to memory of 236	1756	ratnik.exe	CMD.exe
PID 1756 wrote to memory of 236	1756	ratnik.exe	CMD.exe
PID 236 wrote to memory of 2308	236	CMD.exe	schtasks.exe
PID 236 wrote to memory of 2308	236	CMD.exe	schtasks.exe
PID 1756 wrote to memory of 4000	1756	ratnik.exe	CMD.exe
PID 1756 wrote to memory of 4000	1756	ratnik.exe	CMD.exe
PID 4000 wrote to memory of 3500	4000	CMD.exe	schtasks.exe
PID 4000 wrote to memory of 3500	4000	CMD.exe	schtasks.exe
PID 1756 wrote to memory of 1536	1756	ratnik.exe	CMD.exe
PID 1756 wrote to memory of 1536	1756	ratnik.exe	CMD.exe
PID 1536 wrote to memory of 4560	1536	CMD.exe	schtasks.exe
PID 1536 wrote to memory of 4560	1536	CMD.exe	schtasks.exe
PID 1756 wrote to memory of 4124	1756	ratnik.exe	CMD.exe
PID 1756 wrote to memory of 4124	1756	ratnik.exe	CMD.exe
PID 4124 wrote to memory of 2060	4124	CMD.exe	schtasks.exe
PID 4124 wrote to memory of 2060	4124	CMD.exe	schtasks.exe
PID 1756 wrote to memory of 2884	1756	ratnik.exe	CMD.exe
PID 1756 wrote to memory of 2884	1756	ratnik.exe	CMD.exe
PID 2884 wrote to memory of 4752	2884	CMD.exe	schtasks.exe
PID 2884 wrote to memory of 4752	2884	CMD.exe	schtasks.exe
PID 1756 wrote to memory of 1420	1756	ratnik.exe	CMD.exe
PID 1756 wrote to memory of 1420	1756	ratnik.exe	CMD.exe
PID 1420 wrote to memory of 596	1420	CMD.exe	schtasks.exe
PID 1420 wrote to memory of 596	1420	CMD.exe	schtasks.exe
PID 1756 wrote to memory of 2076	1756	ratnik.exe	CMD.exe
PID 1756 wrote to memory of 2076	1756	ratnik.exe	CMD.exe
PID 2076 wrote to memory of 1316	2076	CMD.exe	schtasks.exe
PID 2076 wrote to memory of 1316	2076	CMD.exe	schtasks.exe
PID 1756 wrote to memory of 5092	1756	ratnik.exe	CMD.exe
PID 1756 wrote to memory of 5092	1756	ratnik.exe	CMD.exe
PID 5092 wrote to memory of 5108	5092	CMD.exe	schtasks.exe
PID 5092 wrote to memory of 5108	5092	CMD.exe	schtasks.exe
PID 1756 wrote to memory of 4244	1756	ratnik.exe	CMD.exe
PID 1756 wrote to memory of 4244	1756	ratnik.exe	CMD.exe
PID 4244 wrote to memory of 4376	4244	CMD.exe	schtasks.exe
PID 4244 wrote to memory of 4376	4244	CMD.exe	schtasks.exe
PID 1756 wrote to memory of 4740	1756	ratnik.exe	CMD.exe
PID 1756 wrote to memory of 4740	1756	ratnik.exe	CMD.exe
PID 4740 wrote to memory of 1824	4740	CMD.exe	schtasks.exe
PID 4740 wrote to memory of 1824	4740	CMD.exe	schtasks.exe
PID 1756 wrote to memory of 4652	1756	ratnik.exe	CMD.exe
PID 1756 wrote to memory of 4652	1756	ratnik.exe	CMD.exe
PID 4652 wrote to memory of 1520	4652	CMD.exe	schtasks.exe
PID 4652 wrote to memory of 1520	4652	CMD.exe	schtasks.exe
PID 1756 wrote to memory of 3316	1756	ratnik.exe	CMD.exe
PID 1756 wrote to memory of 3316	1756	ratnik.exe	CMD.exe
PID 3316 wrote to memory of 4588	3316	CMD.exe	schtasks.exe
PID 3316 wrote to memory of 4588	3316	CMD.exe	schtasks.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\ratnik.exe
"C:\Users\Admin\AppData\Local\Temp\ratnik.exe"
1⤵
- Modifies WinLogon for persistence
- Sets desktop wallpaper using registry
- Drops file in Windows directory
- Modifies Control Panel
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1756
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /C SchTaSKs /CrEAte /F /sc OnLoGoN /rl HighEst /tn "Google Earth" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorel VideoStudio Upgrade.exe" & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1696
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /CrEAte /F /sc OnLoGoN /rl HighEst /tn "Google Earth" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorel VideoStudio Upgrade.exe"
    3⤵
    - Creates scheduled task(s)
    PID:3556
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk Maya Host" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorel VideoStudio Upgrade.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1532
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk Maya Host" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorel VideoStudio Upgrade.exe" /RL HIGHEST
    3⤵
    - Creates scheduled task(s)
    PID:2836
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo 5 /tn "Mozilla Firefox" /tr "C:\Users\Admin\Videos\xdwdSage 50.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1888
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo 5 /tn "Mozilla Firefox" /tr "C:\Users\Admin\Videos\xdwdSage 50.exe" /RL HIGHEST
    3⤵
    - Creates scheduled task(s)
    PID:3340
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk Maya Host" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorel VideoStudio Upgrade.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1576
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk Maya Host" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorel VideoStudio Upgrade.exe" /RL HIGHEST
    3⤵
    - Creates scheduled task(s)
    PID:4980
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk Maya Host" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorel VideoStudio Upgrade.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:236
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk Maya Host" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorel VideoStudio Upgrade.exe" /RL HIGHEST
    3⤵
    - Creates scheduled task(s)
    PID:2308
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk Maya Host" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorel VideoStudio Upgrade.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4000
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk Maya Host" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorel VideoStudio Upgrade.exe" /RL HIGHEST
    3⤵
    - Creates scheduled task(s)
    PID:3500
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk Maya Host" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorel VideoStudio Upgrade.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1536
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk Maya Host" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorel VideoStudio Upgrade.exe" /RL HIGHEST
    3⤵
    - Creates scheduled task(s)
    PID:4560
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk Maya Host" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorel VideoStudio Upgrade.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4124
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk Maya Host" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorel VideoStudio Upgrade.exe" /RL HIGHEST
    3⤵
    - Creates scheduled task(s)
    PID:2060
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk Maya Host" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorel VideoStudio Upgrade.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2884
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk Maya Host" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorel VideoStudio Upgrade.exe" /RL HIGHEST
    3⤵
    - Creates scheduled task(s)
    PID:4752
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk Maya Host" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorel VideoStudio Upgrade.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1420
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk Maya Host" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorel VideoStudio Upgrade.exe" /RL HIGHEST
    3⤵
    - Creates scheduled task(s)
    PID:596
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk Maya Host" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorel VideoStudio Upgrade.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2076
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk Maya Host" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorel VideoStudio Upgrade.exe" /RL HIGHEST
    3⤵
    - Creates scheduled task(s)
    PID:1316
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk Maya Host" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorel VideoStudio Upgrade.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5092
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk Maya Host" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorel VideoStudio Upgrade.exe" /RL HIGHEST
    3⤵
    - Creates scheduled task(s)
    PID:5108
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk Maya Host" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorel VideoStudio Upgrade.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4244
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk Maya Host" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorel VideoStudio Upgrade.exe" /RL HIGHEST
    3⤵
    - Creates scheduled task(s)
    PID:4376
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk Maya Host" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorel VideoStudio Upgrade.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4740
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk Maya Host" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorel VideoStudio Upgrade.exe" /RL HIGHEST
    3⤵
    - Creates scheduled task(s)
    PID:1824
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk Maya Host" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorel VideoStudio Upgrade.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4652
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk Maya Host" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorel VideoStudio Upgrade.exe" /RL HIGHEST
    3⤵
    - Creates scheduled task(s)
    PID:1520
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk Maya Host" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorel VideoStudio Upgrade.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3316
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk Maya Host" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorel VideoStudio Upgrade.exe" /RL HIGHEST
    3⤵
    - Creates scheduled task(s)
    PID:4588
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk Maya Host" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorel VideoStudio Upgrade.exe" /RL HIGHEST & exit
  2⤵
  PID:1268
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk Maya Host" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorel VideoStudio Upgrade.exe" /RL HIGHEST
    3⤵
    - Creates scheduled task(s)
    PID:648
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk Maya Host" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorel VideoStudio Upgrade.exe" /RL HIGHEST & exit
  2⤵
  PID:4020
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk Maya Host" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorel VideoStudio Upgrade.exe" /RL HIGHEST
    3⤵
    - Creates scheduled task(s)
    PID:2056
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk Maya Host" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorel VideoStudio Upgrade.exe" /RL HIGHEST & exit
  2⤵
  PID:5076
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk Maya Host" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorel VideoStudio Upgrade.exe" /RL HIGHEST
    3⤵
    - Creates scheduled task(s)
    PID:2392
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk Maya Host" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorel VideoStudio Upgrade.exe" /RL HIGHEST & exit
  2⤵
  PID:4424
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk Maya Host" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorel VideoStudio Upgrade.exe" /RL HIGHEST
    3⤵
    - Creates scheduled task(s)
    PID:2492
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk Maya Host" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorel VideoStudio Upgrade.exe" /RL HIGHEST & exit
  2⤵
  PID:4984
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk Maya Host" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorel VideoStudio Upgrade.exe" /RL HIGHEST
    3⤵
    - Creates scheduled task(s)
    PID:2988
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk Maya Host" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorel VideoStudio Upgrade.exe" /RL HIGHEST & exit
  2⤵
  PID:4152
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk Maya Host" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorel VideoStudio Upgrade.exe" /RL HIGHEST
    3⤵
    - Creates scheduled task(s)
    PID:2364
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk Maya Host" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorel VideoStudio Upgrade.exe" /RL HIGHEST & exit
  2⤵
  PID:1816
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk Maya Host" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorel VideoStudio Upgrade.exe" /RL HIGHEST
    3⤵
    - Creates scheduled task(s)
    PID:2824
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk Maya Host" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorel VideoStudio Upgrade.exe" /RL HIGHEST & exit
  2⤵
  PID:1860
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk Maya Host" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorel VideoStudio Upgrade.exe" /RL HIGHEST
    3⤵
    - Creates scheduled task(s)
    PID:3852
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk Maya Host" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorel VideoStudio Upgrade.exe" /RL HIGHEST & exit
  2⤵
  PID:5100
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk Maya Host" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorel VideoStudio Upgrade.exe" /RL HIGHEST
    3⤵
    - Creates scheduled task(s)
    PID:916
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk Maya Host" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorel VideoStudio Upgrade.exe" /RL HIGHEST & exit
  2⤵
  PID:1036
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk Maya Host" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorel VideoStudio Upgrade.exe" /RL HIGHEST
    3⤵
    - Creates scheduled task(s)
    PID:400
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk Maya Host" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorel VideoStudio Upgrade.exe" /RL HIGHEST & exit
  2⤵
  PID:464
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk Maya Host" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorel VideoStudio Upgrade.exe" /RL HIGHEST
    3⤵
    - Creates scheduled task(s)
    PID:2448
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk Maya Host" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorel VideoStudio Upgrade.exe" /RL HIGHEST & exit
  2⤵
  PID:1368
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk Maya Host" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorel VideoStudio Upgrade.exe" /RL HIGHEST
    3⤵
    - Creates scheduled task(s)
    PID:3748
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk Maya Host" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorel VideoStudio Upgrade.exe" /RL HIGHEST & exit
  2⤵
  PID:4816
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk Maya Host" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorel VideoStudio Upgrade.exe" /RL HIGHEST
    3⤵
    - Creates scheduled task(s)
    PID:4708
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk Maya Host" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorel VideoStudio Upgrade.exe" /RL HIGHEST & exit
  2⤵
  PID:2848
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk Maya Host" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorel VideoStudio Upgrade.exe" /RL HIGHEST
    3⤵
    - Creates scheduled task(s)
    PID:1040
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk Maya Host" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorel VideoStudio Upgrade.exe" /RL HIGHEST & exit
  2⤵
  PID:3556
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk Maya Host" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorel VideoStudio Upgrade.exe" /RL HIGHEST
    3⤵
    - Creates scheduled task(s)
    PID:4808
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk Maya Host" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorel VideoStudio Upgrade.exe" /RL HIGHEST & exit
  2⤵
  PID:2596
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk Maya Host" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorel VideoStudio Upgrade.exe" /RL HIGHEST
    3⤵
    - Creates scheduled task(s)
    PID:1268
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk Maya Host" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorel VideoStudio Upgrade.exe" /RL HIGHEST & exit
  2⤵
  PID:4620
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk Maya Host" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorel VideoStudio Upgrade.exe" /RL HIGHEST
    3⤵
    - Creates scheduled task(s)
    PID:132
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk Maya Host" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorel VideoStudio Upgrade.exe" /RL HIGHEST & exit
  2⤵
  PID:4920
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk Maya Host" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorel VideoStudio Upgrade.exe" /RL HIGHEST
    3⤵
    - Creates scheduled task(s)
    PID:1628
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk Maya Host" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorel VideoStudio Upgrade.exe" /RL HIGHEST & exit
  2⤵
  PID:3588
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk Maya Host" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorel VideoStudio Upgrade.exe" /RL HIGHEST
    3⤵
    - Creates scheduled task(s)
    PID:2188
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk Maya Host" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorel VideoStudio Upgrade.exe" /RL HIGHEST & exit
  2⤵
  PID:2392
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk Maya Host" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorel VideoStudio Upgrade.exe" /RL HIGHEST
    3⤵
    - Creates scheduled task(s)
    PID:4572
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk Maya Host" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorel VideoStudio Upgrade.exe" /RL HIGHEST & exit
  2⤵
  PID:3264
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk Maya Host" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorel VideoStudio Upgrade.exe" /RL HIGHEST
    3⤵
    - Creates scheduled task(s)
    PID:5092
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk Maya Host" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorel VideoStudio Upgrade.exe" /RL HIGHEST & exit
  2⤵
  PID:1152
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk Maya Host" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorel VideoStudio Upgrade.exe" /RL HIGHEST
    3⤵
    - Creates scheduled task(s)
    PID:3144
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk Maya Host" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorel VideoStudio Upgrade.exe" /RL HIGHEST & exit
  2⤵
  PID:2156
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk Maya Host" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorel VideoStudio Upgrade.exe" /RL HIGHEST
    3⤵
    - Creates scheduled task(s)
    PID:2820
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk Maya Host" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorel VideoStudio Upgrade.exe" /RL HIGHEST & exit
  2⤵
  PID:432
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk Maya Host" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorel VideoStudio Upgrade.exe" /RL HIGHEST
    3⤵
    - Creates scheduled task(s)
    PID:1960
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk Maya Host" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorel VideoStudio Upgrade.exe" /RL HIGHEST & exit
  2⤵
  PID:1696
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk Maya Host" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorel VideoStudio Upgrade.exe" /RL HIGHEST
    3⤵
    - Creates scheduled task(s)
    PID:5096
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk Maya Host" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorel VideoStudio Upgrade.exe" /RL HIGHEST & exit
  2⤵
  PID:3852
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk Maya Host" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorel VideoStudio Upgrade.exe" /RL HIGHEST
    3⤵
    - Creates scheduled task(s)
    PID:2836
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk Maya Host" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorel VideoStudio Upgrade.exe" /RL HIGHEST & exit
  2⤵
  PID:3728
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk Maya Host" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorel VideoStudio Upgrade.exe" /RL HIGHEST
    3⤵
    - Creates scheduled task(s)
    PID:4380
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk Maya Host" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorel VideoStudio Upgrade.exe" /RL HIGHEST & exit
  2⤵
  PID:4344
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk Maya Host" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorel VideoStudio Upgrade.exe" /RL HIGHEST
    3⤵
    - Creates scheduled task(s)
    PID:2620
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk Maya Host" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorel VideoStudio Upgrade.exe" /RL HIGHEST & exit
  2⤵
  PID:2596
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk Maya Host" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorel VideoStudio Upgrade.exe" /RL HIGHEST
    3⤵
    - Creates scheduled task(s)
    PID:1984
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk Maya Host" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorel VideoStudio Upgrade.exe" /RL HIGHEST & exit
  2⤵
  PID:3104
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk Maya Host" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorel VideoStudio Upgrade.exe" /RL HIGHEST
    3⤵
    - Creates scheduled task(s)
    PID:5092

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:4812

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe" -ServerName:MiniSearchUI.AppXj3y73at8fy1htwztzxs68sxx1v7cksp7.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3580

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Defacement

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorel VideoStudio Upgrade.exe

Filesize
709.3MB

MD5
f5a8a78a74552701ea2c422103122e8d

SHA1
433b0be41e0610c2cd55567d06b4eae5f2d46094

SHA256
2904cf5c517b9f2190eb8ffd4c895d76e6ac93a66a00e59ea26ded37535b5954

SHA512
d2439c5de2ae7d9923a1cadff82f3864c8dccb5539c9016be82ef8d23ca66a0149fd84501fe71c22621f6f6fbb763266a1ebe5d4c672c6b03be70510ce40091e

Download Submit
C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\SearchHoverUnifiedTileModelCache.dat

Filesize
11KB

MD5
e3e15a868a60c5bc28058860580772ff

SHA1
31e64db52bcf6826fb18556214cc11cfca9ef116

SHA256
4dfd6f56923734f981111a3fc4cf3e11b420522506dac49441312b2fe80c4db9

SHA512
2b0db39c132bf6df3945c6acf0bc656650051c9483f0f454afd4640dc252c964049f4338889ed1289334fb536ad27997ff19746af420d11eaabf95db0e89f11c

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpB34D.tmp.png

Filesize
1.0MB

MD5
52b282dfe0c9d9cf250c7b5e021fcc13

SHA1
6340a315c92a43346b69cc0515fda55fd57d0a68

SHA256
0fd3703fac3837f9ee980c97d154a7a064d0d516f06c37b4a242e0fe38a6b8de

SHA512
ced762766d7bea737ecb3de8fa5ba3ad7908c847429a0aebb223844ca8333899fecf2a744b8cd9d241ffb268154e81601b196e43a4a73a3a0dec93ae743697b6

Download Submit
C:\Windows\xdwd.dll

Filesize
136KB

MD5
16e5a492c9c6ae34c59683be9c51fa31

SHA1
97031b41f5c56f371c28ae0d62a2df7d585adaba

SHA256
35c8d022e1d917f1aabdceae98097ccc072161b302f84c768ca63e4b32ac2b66

SHA512
20fd369172ef5e3e2fde388666b42e8fe5f0c2bfa338c0345f45e98af6561a249ba3ecc48c3f16efcc73f02ecb67b3ddb1e2e8f0e77d18fa00ac34e6379e50b6

Download Submit
memory/1756-94-0x00007FFBF9510000-0x00007FFBF9FD2000-memory.dmp

Filesize
10.8MB

Download
memory/1756-0-0x0000000000670000-0x00000000006BC000-memory.dmp

Filesize
304KB

Download
memory/1756-208-0x000000001B970000-0x000000001B980000-memory.dmp

Filesize
64KB

Download
memory/1756-448-0x000000001BF40000-0x000000001BFB6000-memory.dmp

Filesize
472KB

Download
memory/1756-449-0x000000001B940000-0x000000001B94A000-memory.dmp

Filesize
40KB

Download
memory/1756-450-0x000000001BA30000-0x000000001BA4E000-memory.dmp

Filesize
120KB

Download
memory/1756-33-0x000000001B970000-0x000000001B980000-memory.dmp

Filesize
64KB

Download
memory/1756-1-0x00007FFBF9510000-0x00007FFBF9FD2000-memory.dmp

Filesize
10.8MB

Download
memory/4812-65-0x00007FFC1A350000-0x00007FFC1A351000-memory.dmp

Filesize
4KB

Download