Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
154s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
01/06/2024, 19:42
Static task
static1
Behavioral task
behavioral1
Sample
NulsultanLoader.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
NulsultanLoader.exe
Resource
win10v2004-20240508-en
General
-
Target
NulsultanLoader.exe
-
Size
459KB
-
MD5
94af4c079ad32d2f0667ad7949a482d6
-
SHA1
d4d513699b3b1a6348210e598b17527ff5aab2e9
-
SHA256
f8ed25d648227480c94c7002e27e8c09c3501b5898cb8fdbbf9df9d5eddf0f15
-
SHA512
a88526ff808518eb7a034a9add1a7004daa1b69fa98cd77aca859432f5ef76edc76ed1d5c1a18cc4cbab84063a676a7ce0fe48f777cc4a96f31c612e064a2b0c
-
SSDEEP
6144:SWR6MQer0SYX16re6VlWT8b9u9QLUOTo+MyXDv5AcJbEP41fMn:SJMQeoJ1mPVle8boko+HokfM
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\System32\\userinit.exe,C:\\Program Files\\xdwdSpotify.exe" NulsultanLoader.exe -
Modifies AppInit DLL entries 2 TTPs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in Program Files directory 2 IoCs
description ioc Process File created C:\Program Files\xdwdSpotify.exe NulsultanLoader.exe File opened for modification C:\Program Files\xdwdSpotify.exe NulsultanLoader.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File created C:\Windows\xdwd.dll NulsultanLoader.exe -
Creates scheduled task(s) 1 TTPs 39 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2536 schtasks.exe 1888 schtasks.exe 2916 schtasks.exe 1776 schtasks.exe 712 schtasks.exe 2792 schtasks.exe 1568 schtasks.exe 552 schtasks.exe 1092 schtasks.exe 576 schtasks.exe 2976 schtasks.exe 2296 schtasks.exe 2420 schtasks.exe 1484 schtasks.exe 2512 schtasks.exe 1736 schtasks.exe 2580 schtasks.exe 2812 schtasks.exe 2560 schtasks.exe 1144 schtasks.exe 1648 schtasks.exe 1744 schtasks.exe 2796 schtasks.exe 1652 schtasks.exe 2944 schtasks.exe 1112 schtasks.exe 1784 schtasks.exe 2912 schtasks.exe 2532 schtasks.exe 2636 schtasks.exe 2692 schtasks.exe 2192 schtasks.exe 2404 schtasks.exe 2656 schtasks.exe 1072 schtasks.exe 2892 schtasks.exe 1596 schtasks.exe 1104 schtasks.exe 2588 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1176 NulsultanLoader.exe 940 CMD.exe 2692 schtasks.exe 1176 NulsultanLoader.exe 1176 NulsultanLoader.exe 1176 NulsultanLoader.exe 1176 NulsultanLoader.exe 1176 NulsultanLoader.exe 1176 NulsultanLoader.exe 1176 NulsultanLoader.exe 1176 NulsultanLoader.exe 1176 NulsultanLoader.exe 1176 NulsultanLoader.exe 1176 NulsultanLoader.exe 1176 NulsultanLoader.exe 1176 NulsultanLoader.exe 1176 NulsultanLoader.exe 1176 NulsultanLoader.exe 1176 NulsultanLoader.exe 1368 WmiApSrv.exe 1176 NulsultanLoader.exe 1176 NulsultanLoader.exe 1176 NulsultanLoader.exe 1176 NulsultanLoader.exe 1176 NulsultanLoader.exe 1176 NulsultanLoader.exe 1660 CMD.exe 1176 NulsultanLoader.exe 1112 schtasks.exe 1176 NulsultanLoader.exe 1176 NulsultanLoader.exe 1176 NulsultanLoader.exe 1176 NulsultanLoader.exe 1176 NulsultanLoader.exe 1176 NulsultanLoader.exe 1176 NulsultanLoader.exe 1176 NulsultanLoader.exe 1176 NulsultanLoader.exe 1176 NulsultanLoader.exe 1176 NulsultanLoader.exe 1176 NulsultanLoader.exe 1176 NulsultanLoader.exe 1176 NulsultanLoader.exe 1696 CMD.exe 1144 schtasks.exe 1176 NulsultanLoader.exe 1176 NulsultanLoader.exe 1176 NulsultanLoader.exe 1176 NulsultanLoader.exe 1176 NulsultanLoader.exe 1176 NulsultanLoader.exe 1176 NulsultanLoader.exe 1176 NulsultanLoader.exe 1176 NulsultanLoader.exe 1176 NulsultanLoader.exe 1176 NulsultanLoader.exe 1176 NulsultanLoader.exe 1176 NulsultanLoader.exe 1176 NulsultanLoader.exe 1176 NulsultanLoader.exe 1184 CMD.exe 1072 schtasks.exe 1176 NulsultanLoader.exe 1176 NulsultanLoader.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1176 NulsultanLoader.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1176 wrote to memory of 2888 1176 NulsultanLoader.exe 29 PID 1176 wrote to memory of 2888 1176 NulsultanLoader.exe 29 PID 1176 wrote to memory of 2888 1176 NulsultanLoader.exe 29 PID 2888 wrote to memory of 2560 2888 CMD.exe 31 PID 2888 wrote to memory of 2560 2888 CMD.exe 31 PID 2888 wrote to memory of 2560 2888 CMD.exe 31 PID 1176 wrote to memory of 2544 1176 NulsultanLoader.exe 32 PID 1176 wrote to memory of 2544 1176 NulsultanLoader.exe 32 PID 1176 wrote to memory of 2544 1176 NulsultanLoader.exe 32 PID 2544 wrote to memory of 2420 2544 CMD.exe 34 PID 2544 wrote to memory of 2420 2544 CMD.exe 34 PID 2544 wrote to memory of 2420 2544 CMD.exe 34 PID 1176 wrote to memory of 2792 1176 NulsultanLoader.exe 35 PID 1176 wrote to memory of 2792 1176 NulsultanLoader.exe 35 PID 1176 wrote to memory of 2792 1176 NulsultanLoader.exe 35 PID 2792 wrote to memory of 552 2792 CMD.exe 37 PID 2792 wrote to memory of 552 2792 CMD.exe 37 PID 2792 wrote to memory of 552 2792 CMD.exe 37 PID 1176 wrote to memory of 940 1176 NulsultanLoader.exe 38 PID 1176 wrote to memory of 940 1176 NulsultanLoader.exe 38 PID 1176 wrote to memory of 940 1176 NulsultanLoader.exe 38 PID 940 wrote to memory of 2692 940 CMD.exe 40 PID 940 wrote to memory of 2692 940 CMD.exe 40 PID 940 wrote to memory of 2692 940 CMD.exe 40 PID 1176 wrote to memory of 1660 1176 NulsultanLoader.exe 44 PID 1176 wrote to memory of 1660 1176 NulsultanLoader.exe 44 PID 1176 wrote to memory of 1660 1176 NulsultanLoader.exe 44 PID 1660 wrote to memory of 1112 1660 CMD.exe 46 PID 1660 wrote to memory of 1112 1660 CMD.exe 46 PID 1660 wrote to memory of 1112 1660 CMD.exe 46 PID 1176 wrote to memory of 1696 1176 NulsultanLoader.exe 47 PID 1176 wrote to memory of 1696 1176 NulsultanLoader.exe 47 PID 1176 wrote to memory of 1696 1176 NulsultanLoader.exe 47 PID 1696 wrote to memory of 1144 1696 CMD.exe 49 PID 1696 wrote to memory of 1144 1696 CMD.exe 49 PID 1696 wrote to memory of 1144 1696 CMD.exe 49 PID 1176 wrote to memory of 1184 1176 NulsultanLoader.exe 50 PID 1176 wrote to memory of 1184 1176 NulsultanLoader.exe 50 PID 1176 wrote to memory of 1184 1176 NulsultanLoader.exe 50 PID 1184 wrote to memory of 1072 1184 CMD.exe 52 PID 1184 wrote to memory of 1072 1184 CMD.exe 52 PID 1184 wrote to memory of 1072 1184 CMD.exe 52 PID 1176 wrote to memory of 2760 1176 NulsultanLoader.exe 53 PID 1176 wrote to memory of 2760 1176 NulsultanLoader.exe 53 PID 1176 wrote to memory of 2760 1176 NulsultanLoader.exe 53 PID 2760 wrote to memory of 2892 2760 CMD.exe 55 PID 2760 wrote to memory of 2892 2760 CMD.exe 55 PID 2760 wrote to memory of 2892 2760 CMD.exe 55 PID 1176 wrote to memory of 1936 1176 NulsultanLoader.exe 56 PID 1176 wrote to memory of 1936 1176 NulsultanLoader.exe 56 PID 1176 wrote to memory of 1936 1176 NulsultanLoader.exe 56 PID 1936 wrote to memory of 1092 1936 CMD.exe 58 PID 1936 wrote to memory of 1092 1936 CMD.exe 58 PID 1936 wrote to memory of 1092 1936 CMD.exe 58 PID 1176 wrote to memory of 2512 1176 NulsultanLoader.exe 59 PID 1176 wrote to memory of 2512 1176 NulsultanLoader.exe 59 PID 1176 wrote to memory of 2512 1176 NulsultanLoader.exe 59 PID 2512 wrote to memory of 2536 2512 CMD.exe 61 PID 2512 wrote to memory of 2536 2512 CMD.exe 61 PID 2512 wrote to memory of 2536 2512 CMD.exe 61 PID 1176 wrote to memory of 2420 1176 NulsultanLoader.exe 62 PID 1176 wrote to memory of 2420 1176 NulsultanLoader.exe 62 PID 1176 wrote to memory of 2420 1176 NulsultanLoader.exe 62 PID 2420 wrote to memory of 1784 2420 CMD.exe 64 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\NulsultanLoader.exe"C:\Users\Admin\AppData\Local\Temp\NulsultanLoader.exe"1⤵
- Modifies WinLogon for persistence
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1176 -
C:\Windows\system32\CMD.exe"CMD" /C SchTaSKs /CrEAte /F /sc OnLoGoN /rl HighEst /tn "GIMP (GNU Image Manipulation Program)" /tr "C:\Program Files\xdwdSpotify.exe" & exit2⤵
- Suspicious use of WriteProcessMemory
PID:2888 -
C:\Windows\system32\schtasks.exeSchTaSKs /CrEAte /F /sc OnLoGoN /rl HighEst /tn "GIMP (GNU Image Manipulation Program)" /tr "C:\Program Files\xdwdSpotify.exe"3⤵
- Creates scheduled task(s)
PID:2560
-
-
-
C:\Windows\system32\CMD.exe"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk Revit" /tr "C:\Program Files\xdwdSpotify.exe" /RL HIGHEST & exit2⤵
- Suspicious use of WriteProcessMemory
PID:2544 -
C:\Windows\system32\schtasks.exeSchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk Revit" /tr "C:\Program Files\xdwdSpotify.exe" /RL HIGHEST3⤵
- Creates scheduled task(s)
PID:2420
-
-
-
C:\Windows\system32\CMD.exe"CMD" /c SchTaSKs /create /f /sc minute /mo 5 /tn "Zoom" /tr "C:\Users\Admin\AppData\Roaming\xdwdMalwarebytes Update.exe" /RL HIGHEST & exit2⤵
- Suspicious use of WriteProcessMemory
PID:2792 -
C:\Windows\system32\schtasks.exeSchTaSKs /create /f /sc minute /mo 5 /tn "Zoom" /tr "C:\Users\Admin\AppData\Roaming\xdwdMalwarebytes Update.exe" /RL HIGHEST3⤵
- Creates scheduled task(s)
PID:552
-
-
-
C:\Windows\system32\CMD.exe"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk Revit" /tr "C:\Program Files\xdwdSpotify.exe" /RL HIGHEST & exit2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:940 -
C:\Windows\system32\schtasks.exeSchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk Revit" /tr "C:\Program Files\xdwdSpotify.exe" /RL HIGHEST3⤵
- Creates scheduled task(s)
- Suspicious behavior: EnumeratesProcesses
PID:2692
-
-
-
C:\Windows\system32\CMD.exe"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk Revit" /tr "C:\Program Files\xdwdSpotify.exe" /RL HIGHEST & exit2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1660 -
C:\Windows\system32\schtasks.exeSchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk Revit" /tr "C:\Program Files\xdwdSpotify.exe" /RL HIGHEST3⤵
- Creates scheduled task(s)
- Suspicious behavior: EnumeratesProcesses
PID:1112
-
-
-
C:\Windows\system32\CMD.exe"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk Revit" /tr "C:\Program Files\xdwdSpotify.exe" /RL HIGHEST & exit2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1696 -
C:\Windows\system32\schtasks.exeSchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk Revit" /tr "C:\Program Files\xdwdSpotify.exe" /RL HIGHEST3⤵
- Creates scheduled task(s)
- Suspicious behavior: EnumeratesProcesses
PID:1144
-
-
-
C:\Windows\system32\CMD.exe"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk Revit" /tr "C:\Program Files\xdwdSpotify.exe" /RL HIGHEST & exit2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1184 -
C:\Windows\system32\schtasks.exeSchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk Revit" /tr "C:\Program Files\xdwdSpotify.exe" /RL HIGHEST3⤵
- Creates scheduled task(s)
- Suspicious behavior: EnumeratesProcesses
PID:1072
-
-
-
C:\Windows\system32\CMD.exe"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk Revit" /tr "C:\Program Files\xdwdSpotify.exe" /RL HIGHEST & exit2⤵
- Suspicious use of WriteProcessMemory
PID:2760 -
C:\Windows\system32\schtasks.exeSchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk Revit" /tr "C:\Program Files\xdwdSpotify.exe" /RL HIGHEST3⤵
- Creates scheduled task(s)
PID:2892
-
-
-
C:\Windows\system32\CMD.exe"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk Revit" /tr "C:\Program Files\xdwdSpotify.exe" /RL HIGHEST & exit2⤵
- Suspicious use of WriteProcessMemory
PID:1936 -
C:\Windows\system32\schtasks.exeSchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk Revit" /tr "C:\Program Files\xdwdSpotify.exe" /RL HIGHEST3⤵
- Creates scheduled task(s)
PID:1092
-
-
-
C:\Windows\system32\CMD.exe"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk Revit" /tr "C:\Program Files\xdwdSpotify.exe" /RL HIGHEST & exit2⤵
- Suspicious use of WriteProcessMemory
PID:2512 -
C:\Windows\system32\schtasks.exeSchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk Revit" /tr "C:\Program Files\xdwdSpotify.exe" /RL HIGHEST3⤵
- Creates scheduled task(s)
PID:2536
-
-
-
C:\Windows\system32\CMD.exe"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk Revit" /tr "C:\Program Files\xdwdSpotify.exe" /RL HIGHEST & exit2⤵
- Suspicious use of WriteProcessMemory
PID:2420 -
C:\Windows\system32\schtasks.exeSchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk Revit" /tr "C:\Program Files\xdwdSpotify.exe" /RL HIGHEST3⤵
- Creates scheduled task(s)
PID:1784
-
-
-
C:\Windows\system32\CMD.exe"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk Revit" /tr "C:\Program Files\xdwdSpotify.exe" /RL HIGHEST & exit2⤵PID:960
-
C:\Windows\system32\schtasks.exeSchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk Revit" /tr "C:\Program Files\xdwdSpotify.exe" /RL HIGHEST3⤵
- Creates scheduled task(s)
PID:1596
-
-
-
C:\Windows\system32\CMD.exe"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk Revit" /tr "C:\Program Files\xdwdSpotify.exe" /RL HIGHEST & exit2⤵PID:1824
-
C:\Windows\system32\schtasks.exeSchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk Revit" /tr "C:\Program Files\xdwdSpotify.exe" /RL HIGHEST3⤵
- Creates scheduled task(s)
PID:2192
-
-
-
C:\Windows\system32\CMD.exe"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk Revit" /tr "C:\Program Files\xdwdSpotify.exe" /RL HIGHEST & exit2⤵PID:1556
-
C:\Windows\system32\schtasks.exeSchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk Revit" /tr "C:\Program Files\xdwdSpotify.exe" /RL HIGHEST3⤵
- Creates scheduled task(s)
PID:712
-
-
-
C:\Windows\system32\CMD.exe"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk Revit" /tr "C:\Program Files\xdwdSpotify.exe" /RL HIGHEST & exit2⤵PID:1316
-
C:\Windows\system32\schtasks.exeSchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk Revit" /tr "C:\Program Files\xdwdSpotify.exe" /RL HIGHEST3⤵
- Creates scheduled task(s)
PID:1104
-
-
-
C:\Windows\system32\CMD.exe"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk Revit" /tr "C:\Program Files\xdwdSpotify.exe" /RL HIGHEST & exit2⤵PID:2768
-
C:\Windows\system32\schtasks.exeSchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk Revit" /tr "C:\Program Files\xdwdSpotify.exe" /RL HIGHEST3⤵
- Creates scheduled task(s)
PID:2912
-
-
-
C:\Windows\system32\CMD.exe"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk Revit" /tr "C:\Program Files\xdwdSpotify.exe" /RL HIGHEST & exit2⤵PID:108
-
C:\Windows\system32\schtasks.exeSchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk Revit" /tr "C:\Program Files\xdwdSpotify.exe" /RL HIGHEST3⤵
- Creates scheduled task(s)
PID:1484
-
-
-
C:\Windows\system32\CMD.exe"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk Revit" /tr "C:\Program Files\xdwdSpotify.exe" /RL HIGHEST & exit2⤵PID:1716
-
C:\Windows\system32\schtasks.exeSchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk Revit" /tr "C:\Program Files\xdwdSpotify.exe" /RL HIGHEST3⤵
- Creates scheduled task(s)
PID:2588
-
-
-
C:\Windows\system32\CMD.exe"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk Revit" /tr "C:\Program Files\xdwdSpotify.exe" /RL HIGHEST & exit2⤵PID:2472
-
C:\Windows\system32\schtasks.exeSchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk Revit" /tr "C:\Program Files\xdwdSpotify.exe" /RL HIGHEST3⤵
- Creates scheduled task(s)
PID:2512
-
-
-
C:\Windows\system32\CMD.exe"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk Revit" /tr "C:\Program Files\xdwdSpotify.exe" /RL HIGHEST & exit2⤵PID:2644
-
C:\Windows\system32\schtasks.exeSchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk Revit" /tr "C:\Program Files\xdwdSpotify.exe" /RL HIGHEST3⤵
- Creates scheduled task(s)
PID:576
-
-
-
C:\Windows\system32\CMD.exe"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk Revit" /tr "C:\Program Files\xdwdSpotify.exe" /RL HIGHEST & exit2⤵PID:2568
-
C:\Windows\system32\schtasks.exeSchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk Revit" /tr "C:\Program Files\xdwdSpotify.exe" /RL HIGHEST3⤵
- Creates scheduled task(s)
PID:2792
-
-
-
C:\Windows\system32\CMD.exe"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk Revit" /tr "C:\Program Files\xdwdSpotify.exe" /RL HIGHEST & exit2⤵PID:1768
-
C:\Windows\system32\schtasks.exeSchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk Revit" /tr "C:\Program Files\xdwdSpotify.exe" /RL HIGHEST3⤵
- Creates scheduled task(s)
PID:1648
-
-
-
C:\Windows\system32\CMD.exe"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk Revit" /tr "C:\Program Files\xdwdSpotify.exe" /RL HIGHEST & exit2⤵PID:788
-
C:\Windows\system32\schtasks.exeSchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk Revit" /tr "C:\Program Files\xdwdSpotify.exe" /RL HIGHEST3⤵
- Creates scheduled task(s)
PID:2976
-
-
-
C:\Windows\system32\CMD.exe"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk Revit" /tr "C:\Program Files\xdwdSpotify.exe" /RL HIGHEST & exit2⤵PID:280
-
C:\Windows\system32\schtasks.exeSchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk Revit" /tr "C:\Program Files\xdwdSpotify.exe" /RL HIGHEST3⤵
- Creates scheduled task(s)
PID:1888
-
-
-
C:\Windows\system32\CMD.exe"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk Revit" /tr "C:\Program Files\xdwdSpotify.exe" /RL HIGHEST & exit2⤵PID:2828
-
C:\Windows\system32\schtasks.exeSchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk Revit" /tr "C:\Program Files\xdwdSpotify.exe" /RL HIGHEST3⤵
- Creates scheduled task(s)
PID:1744
-
-
-
C:\Windows\system32\CMD.exe"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk Revit" /tr "C:\Program Files\xdwdSpotify.exe" /RL HIGHEST & exit2⤵PID:2208
-
C:\Windows\system32\schtasks.exeSchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk Revit" /tr "C:\Program Files\xdwdSpotify.exe" /RL HIGHEST3⤵
- Creates scheduled task(s)
PID:1736
-
-
-
C:\Windows\system32\CMD.exe"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk Revit" /tr "C:\Program Files\xdwdSpotify.exe" /RL HIGHEST & exit2⤵PID:1708
-
C:\Windows\system32\schtasks.exeSchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk Revit" /tr "C:\Program Files\xdwdSpotify.exe" /RL HIGHEST3⤵
- Creates scheduled task(s)
PID:2580
-
-
-
C:\Windows\system32\CMD.exe"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk Revit" /tr "C:\Program Files\xdwdSpotify.exe" /RL HIGHEST & exit2⤵PID:2676
-
C:\Windows\system32\schtasks.exeSchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk Revit" /tr "C:\Program Files\xdwdSpotify.exe" /RL HIGHEST3⤵
- Creates scheduled task(s)
PID:2812
-
-
-
C:\Windows\system32\CMD.exe"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk Revit" /tr "C:\Program Files\xdwdSpotify.exe" /RL HIGHEST & exit2⤵PID:2264
-
C:\Windows\system32\schtasks.exeSchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk Revit" /tr "C:\Program Files\xdwdSpotify.exe" /RL HIGHEST3⤵
- Creates scheduled task(s)
PID:2796
-
-
-
C:\Windows\system32\CMD.exe"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk Revit" /tr "C:\Program Files\xdwdSpotify.exe" /RL HIGHEST & exit2⤵PID:1596
-
C:\Windows\system32\schtasks.exeSchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk Revit" /tr "C:\Program Files\xdwdSpotify.exe" /RL HIGHEST3⤵
- Creates scheduled task(s)
PID:2532
-
-
-
C:\Windows\system32\CMD.exe"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk Revit" /tr "C:\Program Files\xdwdSpotify.exe" /RL HIGHEST & exit2⤵PID:1680
-
C:\Windows\system32\schtasks.exeSchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk Revit" /tr "C:\Program Files\xdwdSpotify.exe" /RL HIGHEST3⤵
- Creates scheduled task(s)
PID:1652
-
-
-
C:\Windows\system32\CMD.exe"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk Revit" /tr "C:\Program Files\xdwdSpotify.exe" /RL HIGHEST & exit2⤵PID:528
-
C:\Windows\system32\schtasks.exeSchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk Revit" /tr "C:\Program Files\xdwdSpotify.exe" /RL HIGHEST3⤵
- Creates scheduled task(s)
PID:2916
-
-
-
C:\Windows\system32\CMD.exe"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk Revit" /tr "C:\Program Files\xdwdSpotify.exe" /RL HIGHEST & exit2⤵PID:1248
-
C:\Windows\system32\schtasks.exeSchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk Revit" /tr "C:\Program Files\xdwdSpotify.exe" /RL HIGHEST3⤵
- Creates scheduled task(s)
PID:1568
-
-
-
C:\Windows\system32\CMD.exe"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk Revit" /tr "C:\Program Files\xdwdSpotify.exe" /RL HIGHEST & exit2⤵PID:1052
-
C:\Windows\system32\schtasks.exeSchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk Revit" /tr "C:\Program Files\xdwdSpotify.exe" /RL HIGHEST3⤵
- Creates scheduled task(s)
PID:1776
-
-
-
C:\Windows\system32\CMD.exe"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk Revit" /tr "C:\Program Files\xdwdSpotify.exe" /RL HIGHEST & exit2⤵PID:1616
-
C:\Windows\system32\schtasks.exeSchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk Revit" /tr "C:\Program Files\xdwdSpotify.exe" /RL HIGHEST3⤵
- Creates scheduled task(s)
PID:2296
-
-
-
C:\Windows\system32\CMD.exe"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk Revit" /tr "C:\Program Files\xdwdSpotify.exe" /RL HIGHEST & exit2⤵PID:1696
-
C:\Windows\system32\schtasks.exeSchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk Revit" /tr "C:\Program Files\xdwdSpotify.exe" /RL HIGHEST3⤵
- Creates scheduled task(s)
PID:2944
-
-
-
C:\Windows\system32\CMD.exe"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk Revit" /tr "C:\Program Files\xdwdSpotify.exe" /RL HIGHEST & exit2⤵PID:948
-
C:\Windows\system32\schtasks.exeSchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk Revit" /tr "C:\Program Files\xdwdSpotify.exe" /RL HIGHEST3⤵
- Creates scheduled task(s)
PID:2636
-
-
-
C:\Windows\system32\CMD.exe"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk Revit" /tr "C:\Program Files\xdwdSpotify.exe" /RL HIGHEST & exit2⤵PID:2360
-
C:\Windows\system32\schtasks.exeSchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk Revit" /tr "C:\Program Files\xdwdSpotify.exe" /RL HIGHEST3⤵
- Creates scheduled task(s)
PID:2404
-
-
-
C:\Windows\system32\CMD.exe"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk Revit" /tr "C:\Program Files\xdwdSpotify.exe" /RL HIGHEST & exit2⤵PID:1664
-
C:\Windows\system32\schtasks.exeSchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk Revit" /tr "C:\Program Files\xdwdSpotify.exe" /RL HIGHEST3⤵
- Creates scheduled task(s)
PID:2656
-
-
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵
- Suspicious behavior: EnumeratesProcesses
PID:1368
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Scheduled Task/Job
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
136KB
MD516e5a492c9c6ae34c59683be9c51fa31
SHA197031b41f5c56f371c28ae0d62a2df7d585adaba
SHA25635c8d022e1d917f1aabdceae98097ccc072161b302f84c768ca63e4b32ac2b66
SHA51220fd369172ef5e3e2fde388666b42e8fe5f0c2bfa338c0345f45e98af6561a249ba3ecc48c3f16efcc73f02ecb67b3ddb1e2e8f0e77d18fa00ac34e6379e50b6