Resubmissions
25/07/2024, 14:37
240725-rzbyvatfmn 1025/07/2024, 14:37
240725-ry8lesxarg 1025/07/2024, 14:37
240725-ry4mgaxarb 1025/07/2024, 14:36
240725-ryx5paxaqd 1025/07/2024, 14:36
240725-rytr9stfkj 1025/07/2024, 14:36
240725-ryqqlstfjq 1025/07/2024, 14:36
240725-rymc7axand 1025/07/2024, 14:35
240725-rydfaaterk 10Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows10-1703_x64 -
resource
win10-20240404-en -
resource tags
arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system -
submitted
25/07/2024, 14:37
Static task
static1
Behavioral task
behavioral1
Sample
Nursultan 3.0.exe
Resource
win10v2004-20240709-en
Behavioral task
behavioral2
Sample
Nursultan 3.0.exe
Resource
win10-20240404-en
Behavioral task
behavioral3
Sample
Nursultan 3.0.exe
Resource
win7-20240705-en
Behavioral task
behavioral4
Sample
Nursultan 3.0.exe
Resource
win10v2004-20240709-en
Behavioral task
behavioral5
Sample
Nursultan 3.0.exe
Resource
win11-20240709-en
General
-
Target
Nursultan 3.0.exe
-
Size
347KB
-
MD5
3500fc8f168c23e6170117e6b779ed52
-
SHA1
0109abb6ff102e3b8f17bfac07f599d787af8663
-
SHA256
ed2be8c7b8aa15f1e3bc399b9aaadbdbb16374e0be30d0200d4f39998f1f25a8
-
SHA512
3d1e2600f1e2b077ab24ed017dee2313f14b34a7c193d8db19a93bb3cc6cd95b620b50c2ab300e958afbeea1fa1d133758664282f60b97b583d748baf056e85f
-
SSDEEP
6144:igpFNojFilyzigCEcL6hl9he6VlWT8b9G3T8JUKvDbwmb0h6XW:T8Ri4h3hPVle84AWcIeXW
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\System32\\userinit.exe,C:\\Users\\Admin\\AppData\\Roaming\\xdwdMicrosoft SQL Server Management Studio.exe" Nursultan 3.0.exe -
Event Triggered Execution: AppInit DLLs 1 TTPs
Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
-
Credentials from Password Stores: Windows Credential Manager 1 TTPs
Suspicious access to Credentials History.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000\Software\Microsoft\Windows\CurrentVersion\Run\svchost = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\xdwdMicrosoft Project.exe" Nursultan 3.0.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File created C:\Windows\xdwd.dll Nursultan 3.0.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 43 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2328 schtasks.exe 2620 schtasks.exe 2916 schtasks.exe 2124 schtasks.exe 4804 schtasks.exe 2180 schtasks.exe 4276 schtasks.exe 5040 schtasks.exe 2196 schtasks.exe 656 schtasks.exe 1096 schtasks.exe 3016 schtasks.exe 4816 schtasks.exe 4508 schtasks.exe 4264 schtasks.exe 4600 schtasks.exe 4652 schtasks.exe 3640 schtasks.exe 3904 schtasks.exe 3704 schtasks.exe 1980 schtasks.exe 4552 schtasks.exe 4196 schtasks.exe 3132 schtasks.exe 4516 schtasks.exe 2140 schtasks.exe 2568 schtasks.exe 3116 schtasks.exe 828 schtasks.exe 4568 schtasks.exe 4712 schtasks.exe 4584 schtasks.exe 4488 schtasks.exe 4564 schtasks.exe 1916 schtasks.exe 1748 schtasks.exe 652 schtasks.exe 4032 schtasks.exe 3916 schtasks.exe 4508 schtasks.exe 820 schtasks.exe 4276 schtasks.exe 4360 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4512 Nursultan 3.0.exe 4512 Nursultan 3.0.exe 4512 Nursultan 3.0.exe 4512 Nursultan 3.0.exe 4512 Nursultan 3.0.exe 4512 Nursultan 3.0.exe 4512 Nursultan 3.0.exe 4512 Nursultan 3.0.exe 4512 Nursultan 3.0.exe 4512 Nursultan 3.0.exe 4512 Nursultan 3.0.exe 4512 Nursultan 3.0.exe 4512 Nursultan 3.0.exe 4512 Nursultan 3.0.exe 4512 Nursultan 3.0.exe 4512 Nursultan 3.0.exe 4512 Nursultan 3.0.exe 4512 Nursultan 3.0.exe 4512 Nursultan 3.0.exe 4512 Nursultan 3.0.exe 4512 Nursultan 3.0.exe 4512 Nursultan 3.0.exe 4512 Nursultan 3.0.exe 4512 Nursultan 3.0.exe 4512 Nursultan 3.0.exe 2228 WmiApSrv.exe 2228 WmiApSrv.exe 4512 Nursultan 3.0.exe 4512 Nursultan 3.0.exe 4512 Nursultan 3.0.exe 4512 Nursultan 3.0.exe 4512 Nursultan 3.0.exe 4512 Nursultan 3.0.exe 4512 Nursultan 3.0.exe 4512 Nursultan 3.0.exe 4512 Nursultan 3.0.exe 4512 Nursultan 3.0.exe 4512 Nursultan 3.0.exe 4512 Nursultan 3.0.exe 4512 Nursultan 3.0.exe 4512 Nursultan 3.0.exe 4512 Nursultan 3.0.exe 4512 Nursultan 3.0.exe 4512 Nursultan 3.0.exe 4512 Nursultan 3.0.exe 4512 Nursultan 3.0.exe 4512 Nursultan 3.0.exe 4512 Nursultan 3.0.exe 4512 Nursultan 3.0.exe 4512 Nursultan 3.0.exe 4512 Nursultan 3.0.exe 4512 Nursultan 3.0.exe 4512 Nursultan 3.0.exe 4512 Nursultan 3.0.exe 4512 Nursultan 3.0.exe 4512 Nursultan 3.0.exe 4512 Nursultan 3.0.exe 4512 Nursultan 3.0.exe 4512 Nursultan 3.0.exe 4512 Nursultan 3.0.exe 4512 Nursultan 3.0.exe 4512 Nursultan 3.0.exe 4512 Nursultan 3.0.exe 4512 Nursultan 3.0.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 4512 Nursultan 3.0.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4512 wrote to memory of 1900 4512 Nursultan 3.0.exe 74 PID 4512 wrote to memory of 1900 4512 Nursultan 3.0.exe 74 PID 1900 wrote to memory of 4652 1900 CMD.exe 76 PID 1900 wrote to memory of 4652 1900 CMD.exe 76 PID 4512 wrote to memory of 2688 4512 Nursultan 3.0.exe 77 PID 4512 wrote to memory of 2688 4512 Nursultan 3.0.exe 77 PID 2688 wrote to memory of 1748 2688 CMD.exe 79 PID 2688 wrote to memory of 1748 2688 CMD.exe 79 PID 4512 wrote to memory of 4448 4512 Nursultan 3.0.exe 80 PID 4512 wrote to memory of 4448 4512 Nursultan 3.0.exe 80 PID 4448 wrote to memory of 4196 4448 CMD.exe 82 PID 4448 wrote to memory of 4196 4448 CMD.exe 82 PID 4512 wrote to memory of 4064 4512 Nursultan 3.0.exe 84 PID 4512 wrote to memory of 4064 4512 Nursultan 3.0.exe 84 PID 4064 wrote to memory of 2196 4064 CMD.exe 87 PID 4064 wrote to memory of 2196 4064 CMD.exe 87 PID 4512 wrote to memory of 1108 4512 Nursultan 3.0.exe 88 PID 4512 wrote to memory of 1108 4512 Nursultan 3.0.exe 88 PID 1108 wrote to memory of 3640 1108 CMD.exe 90 PID 1108 wrote to memory of 3640 1108 CMD.exe 90 PID 4512 wrote to memory of 2632 4512 Nursultan 3.0.exe 91 PID 4512 wrote to memory of 2632 4512 Nursultan 3.0.exe 91 PID 2632 wrote to memory of 820 2632 CMD.exe 93 PID 2632 wrote to memory of 820 2632 CMD.exe 93 PID 4512 wrote to memory of 3268 4512 Nursultan 3.0.exe 94 PID 4512 wrote to memory of 3268 4512 Nursultan 3.0.exe 94 PID 3268 wrote to memory of 4712 3268 CMD.exe 96 PID 3268 wrote to memory of 4712 3268 CMD.exe 96 PID 4512 wrote to memory of 5052 4512 Nursultan 3.0.exe 97 PID 4512 wrote to memory of 5052 4512 Nursultan 3.0.exe 97 PID 5052 wrote to memory of 4276 5052 CMD.exe 99 PID 5052 wrote to memory of 4276 5052 CMD.exe 99 PID 4512 wrote to memory of 4904 4512 Nursultan 3.0.exe 100 PID 4512 wrote to memory of 4904 4512 Nursultan 3.0.exe 100 PID 4904 wrote to memory of 3132 4904 CMD.exe 102 PID 4904 wrote to memory of 3132 4904 CMD.exe 102 PID 4512 wrote to memory of 3724 4512 Nursultan 3.0.exe 103 PID 4512 wrote to memory of 3724 4512 Nursultan 3.0.exe 103 PID 3724 wrote to memory of 4584 3724 CMD.exe 105 PID 3724 wrote to memory of 4584 3724 CMD.exe 105 PID 4512 wrote to memory of 5044 4512 Nursultan 3.0.exe 106 PID 4512 wrote to memory of 5044 4512 Nursultan 3.0.exe 106 PID 5044 wrote to memory of 3904 5044 CMD.exe 108 PID 5044 wrote to memory of 3904 5044 CMD.exe 108 PID 4512 wrote to memory of 4568 4512 Nursultan 3.0.exe 109 PID 4512 wrote to memory of 4568 4512 Nursultan 3.0.exe 109 PID 4568 wrote to memory of 2620 4568 CMD.exe 111 PID 4568 wrote to memory of 2620 4568 CMD.exe 111 PID 4512 wrote to memory of 4032 4512 Nursultan 3.0.exe 112 PID 4512 wrote to memory of 4032 4512 Nursultan 3.0.exe 112 PID 4032 wrote to memory of 4488 4032 CMD.exe 114 PID 4032 wrote to memory of 4488 4032 CMD.exe 114 PID 4512 wrote to memory of 2124 4512 Nursultan 3.0.exe 115 PID 4512 wrote to memory of 2124 4512 Nursultan 3.0.exe 115 PID 2124 wrote to memory of 3016 2124 CMD.exe 117 PID 2124 wrote to memory of 3016 2124 CMD.exe 117 PID 4512 wrote to memory of 3020 4512 Nursultan 3.0.exe 118 PID 4512 wrote to memory of 3020 4512 Nursultan 3.0.exe 118 PID 3020 wrote to memory of 2916 3020 CMD.exe 120 PID 3020 wrote to memory of 2916 3020 CMD.exe 120 PID 4512 wrote to memory of 3160 4512 Nursultan 3.0.exe 121 PID 4512 wrote to memory of 3160 4512 Nursultan 3.0.exe 121 PID 3160 wrote to memory of 652 3160 CMD.exe 123 PID 3160 wrote to memory of 652 3160 CMD.exe 123 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\Nursultan 3.0.exe"C:\Users\Admin\AppData\Local\Temp\Nursultan 3.0.exe"1⤵
- Modifies WinLogon for persistence
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4512 -
C:\Windows\SYSTEM32\CMD.exe"CMD" /C SchTaSKs /CrEAte /F /sc OnLoGoN /rl HighEst /tn "Discord" /tr "C:\Users\Admin\AppData\Roaming\xdwdMicrosoft SQL Server Management Studio.exe" & exit2⤵
- Suspicious use of WriteProcessMemory
PID:1900 -
C:\Windows\system32\schtasks.exeSchTaSKs /CrEAte /F /sc OnLoGoN /rl HighEst /tn "Discord" /tr "C:\Users\Admin\AppData\Roaming\xdwdMicrosoft SQL Server Management Studio.exe"3⤵
- Scheduled Task/Job: Scheduled Task
PID:4652
-
-
-
C:\Windows\SYSTEM32\CMD.exe"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk AutoCAD" /tr "C:\Users\Admin\AppData\Roaming\xdwdMicrosoft SQL Server Management Studio.exe" /RL HIGHEST & exit2⤵
- Suspicious use of WriteProcessMemory
PID:2688 -
C:\Windows\system32\schtasks.exeSchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk AutoCAD" /tr "C:\Users\Admin\AppData\Roaming\xdwdMicrosoft SQL Server Management Studio.exe" /RL HIGHEST3⤵
- Scheduled Task/Job: Scheduled Task
PID:1748
-
-
-
C:\Windows\SYSTEM32\CMD.exe"CMD" /c SchTaSKs /create /f /sc minute /mo 5 /tn "Oracle VirtualBox" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdMicrosoft Project.exe" /RL HIGHEST & exit2⤵
- Suspicious use of WriteProcessMemory
PID:4448 -
C:\Windows\system32\schtasks.exeSchTaSKs /create /f /sc minute /mo 5 /tn "Oracle VirtualBox" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdMicrosoft Project.exe" /RL HIGHEST3⤵
- Scheduled Task/Job: Scheduled Task
PID:4196
-
-
-
C:\Windows\SYSTEM32\CMD.exe"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk AutoCAD" /tr "C:\Users\Admin\AppData\Roaming\xdwdMicrosoft SQL Server Management Studio.exe" /RL HIGHEST & exit2⤵
- Suspicious use of WriteProcessMemory
PID:4064 -
C:\Windows\system32\schtasks.exeSchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk AutoCAD" /tr "C:\Users\Admin\AppData\Roaming\xdwdMicrosoft SQL Server Management Studio.exe" /RL HIGHEST3⤵
- Scheduled Task/Job: Scheduled Task
PID:2196
-
-
-
C:\Windows\SYSTEM32\CMD.exe"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk AutoCAD" /tr "C:\Users\Admin\AppData\Roaming\xdwdMicrosoft SQL Server Management Studio.exe" /RL HIGHEST & exit2⤵
- Suspicious use of WriteProcessMemory
PID:1108 -
C:\Windows\system32\schtasks.exeSchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk AutoCAD" /tr "C:\Users\Admin\AppData\Roaming\xdwdMicrosoft SQL Server Management Studio.exe" /RL HIGHEST3⤵
- Scheduled Task/Job: Scheduled Task
PID:3640
-
-
-
C:\Windows\SYSTEM32\CMD.exe"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk AutoCAD" /tr "C:\Users\Admin\AppData\Roaming\xdwdMicrosoft SQL Server Management Studio.exe" /RL HIGHEST & exit2⤵
- Suspicious use of WriteProcessMemory
PID:2632 -
C:\Windows\system32\schtasks.exeSchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk AutoCAD" /tr "C:\Users\Admin\AppData\Roaming\xdwdMicrosoft SQL Server Management Studio.exe" /RL HIGHEST3⤵
- Scheduled Task/Job: Scheduled Task
PID:820
-
-
-
C:\Windows\SYSTEM32\CMD.exe"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk AutoCAD" /tr "C:\Users\Admin\AppData\Roaming\xdwdMicrosoft SQL Server Management Studio.exe" /RL HIGHEST & exit2⤵
- Suspicious use of WriteProcessMemory
PID:3268 -
C:\Windows\system32\schtasks.exeSchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk AutoCAD" /tr "C:\Users\Admin\AppData\Roaming\xdwdMicrosoft SQL Server Management Studio.exe" /RL HIGHEST3⤵
- Scheduled Task/Job: Scheduled Task
PID:4712
-
-
-
C:\Windows\SYSTEM32\CMD.exe"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk AutoCAD" /tr "C:\Users\Admin\AppData\Roaming\xdwdMicrosoft SQL Server Management Studio.exe" /RL HIGHEST & exit2⤵
- Suspicious use of WriteProcessMemory
PID:5052 -
C:\Windows\system32\schtasks.exeSchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk AutoCAD" /tr "C:\Users\Admin\AppData\Roaming\xdwdMicrosoft SQL Server Management Studio.exe" /RL HIGHEST3⤵
- Scheduled Task/Job: Scheduled Task
PID:4276
-
-
-
C:\Windows\SYSTEM32\CMD.exe"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk AutoCAD" /tr "C:\Users\Admin\AppData\Roaming\xdwdMicrosoft SQL Server Management Studio.exe" /RL HIGHEST & exit2⤵
- Suspicious use of WriteProcessMemory
PID:4904 -
C:\Windows\system32\schtasks.exeSchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk AutoCAD" /tr "C:\Users\Admin\AppData\Roaming\xdwdMicrosoft SQL Server Management Studio.exe" /RL HIGHEST3⤵
- Scheduled Task/Job: Scheduled Task
PID:3132
-
-
-
C:\Windows\SYSTEM32\CMD.exe"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk AutoCAD" /tr "C:\Users\Admin\AppData\Roaming\xdwdMicrosoft SQL Server Management Studio.exe" /RL HIGHEST & exit2⤵
- Suspicious use of WriteProcessMemory
PID:3724 -
C:\Windows\system32\schtasks.exeSchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk AutoCAD" /tr "C:\Users\Admin\AppData\Roaming\xdwdMicrosoft SQL Server Management Studio.exe" /RL HIGHEST3⤵
- Scheduled Task/Job: Scheduled Task
PID:4584
-
-
-
C:\Windows\SYSTEM32\CMD.exe"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk AutoCAD" /tr "C:\Users\Admin\AppData\Roaming\xdwdMicrosoft SQL Server Management Studio.exe" /RL HIGHEST & exit2⤵
- Suspicious use of WriteProcessMemory
PID:5044 -
C:\Windows\system32\schtasks.exeSchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk AutoCAD" /tr "C:\Users\Admin\AppData\Roaming\xdwdMicrosoft SQL Server Management Studio.exe" /RL HIGHEST3⤵
- Scheduled Task/Job: Scheduled Task
PID:3904
-
-
-
C:\Windows\SYSTEM32\CMD.exe"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk AutoCAD" /tr "C:\Users\Admin\AppData\Roaming\xdwdMicrosoft SQL Server Management Studio.exe" /RL HIGHEST & exit2⤵
- Suspicious use of WriteProcessMemory
PID:4568 -
C:\Windows\system32\schtasks.exeSchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk AutoCAD" /tr "C:\Users\Admin\AppData\Roaming\xdwdMicrosoft SQL Server Management Studio.exe" /RL HIGHEST3⤵
- Scheduled Task/Job: Scheduled Task
PID:2620
-
-
-
C:\Windows\SYSTEM32\CMD.exe"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk AutoCAD" /tr "C:\Users\Admin\AppData\Roaming\xdwdMicrosoft SQL Server Management Studio.exe" /RL HIGHEST & exit2⤵
- Suspicious use of WriteProcessMemory
PID:4032 -
C:\Windows\system32\schtasks.exeSchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk AutoCAD" /tr "C:\Users\Admin\AppData\Roaming\xdwdMicrosoft SQL Server Management Studio.exe" /RL HIGHEST3⤵
- Scheduled Task/Job: Scheduled Task
PID:4488
-
-
-
C:\Windows\SYSTEM32\CMD.exe"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk AutoCAD" /tr "C:\Users\Admin\AppData\Roaming\xdwdMicrosoft SQL Server Management Studio.exe" /RL HIGHEST & exit2⤵
- Suspicious use of WriteProcessMemory
PID:2124 -
C:\Windows\system32\schtasks.exeSchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk AutoCAD" /tr "C:\Users\Admin\AppData\Roaming\xdwdMicrosoft SQL Server Management Studio.exe" /RL HIGHEST3⤵
- Scheduled Task/Job: Scheduled Task
PID:3016
-
-
-
C:\Windows\SYSTEM32\CMD.exe"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk AutoCAD" /tr "C:\Users\Admin\AppData\Roaming\xdwdMicrosoft SQL Server Management Studio.exe" /RL HIGHEST & exit2⤵
- Suspicious use of WriteProcessMemory
PID:3020 -
C:\Windows\system32\schtasks.exeSchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk AutoCAD" /tr "C:\Users\Admin\AppData\Roaming\xdwdMicrosoft SQL Server Management Studio.exe" /RL HIGHEST3⤵
- Scheduled Task/Job: Scheduled Task
PID:2916
-
-
-
C:\Windows\SYSTEM32\CMD.exe"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk AutoCAD" /tr "C:\Users\Admin\AppData\Roaming\xdwdMicrosoft SQL Server Management Studio.exe" /RL HIGHEST & exit2⤵
- Suspicious use of WriteProcessMemory
PID:3160 -
C:\Windows\system32\schtasks.exeSchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk AutoCAD" /tr "C:\Users\Admin\AppData\Roaming\xdwdMicrosoft SQL Server Management Studio.exe" /RL HIGHEST3⤵
- Scheduled Task/Job: Scheduled Task
PID:652
-
-
-
C:\Windows\SYSTEM32\CMD.exe"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk AutoCAD" /tr "C:\Users\Admin\AppData\Roaming\xdwdMicrosoft SQL Server Management Studio.exe" /RL HIGHEST & exit2⤵PID:3568
-
C:\Windows\system32\schtasks.exeSchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk AutoCAD" /tr "C:\Users\Admin\AppData\Roaming\xdwdMicrosoft SQL Server Management Studio.exe" /RL HIGHEST3⤵
- Scheduled Task/Job: Scheduled Task
PID:656
-
-
-
C:\Windows\SYSTEM32\CMD.exe"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk AutoCAD" /tr "C:\Users\Admin\AppData\Roaming\xdwdMicrosoft SQL Server Management Studio.exe" /RL HIGHEST & exit2⤵PID:3816
-
C:\Windows\system32\schtasks.exeSchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk AutoCAD" /tr "C:\Users\Admin\AppData\Roaming\xdwdMicrosoft SQL Server Management Studio.exe" /RL HIGHEST3⤵
- Scheduled Task/Job: Scheduled Task
PID:2140
-
-
-
C:\Windows\SYSTEM32\CMD.exe"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk AutoCAD" /tr "C:\Users\Admin\AppData\Roaming\xdwdMicrosoft SQL Server Management Studio.exe" /RL HIGHEST & exit2⤵PID:3264
-
C:\Windows\system32\schtasks.exeSchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk AutoCAD" /tr "C:\Users\Admin\AppData\Roaming\xdwdMicrosoft SQL Server Management Studio.exe" /RL HIGHEST3⤵
- Scheduled Task/Job: Scheduled Task
PID:4816
-
-
-
C:\Windows\SYSTEM32\CMD.exe"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk AutoCAD" /tr "C:\Users\Admin\AppData\Roaming\xdwdMicrosoft SQL Server Management Studio.exe" /RL HIGHEST & exit2⤵PID:3004
-
C:\Windows\system32\schtasks.exeSchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk AutoCAD" /tr "C:\Users\Admin\AppData\Roaming\xdwdMicrosoft SQL Server Management Studio.exe" /RL HIGHEST3⤵
- Scheduled Task/Job: Scheduled Task
PID:2568
-
-
-
C:\Windows\SYSTEM32\CMD.exe"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk AutoCAD" /tr "C:\Users\Admin\AppData\Roaming\xdwdMicrosoft SQL Server Management Studio.exe" /RL HIGHEST & exit2⤵PID:1108
-
C:\Windows\system32\schtasks.exeSchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk AutoCAD" /tr "C:\Users\Admin\AppData\Roaming\xdwdMicrosoft SQL Server Management Studio.exe" /RL HIGHEST3⤵
- Scheduled Task/Job: Scheduled Task
PID:4032
-
-
-
C:\Windows\SYSTEM32\CMD.exe"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk AutoCAD" /tr "C:\Users\Admin\AppData\Roaming\xdwdMicrosoft SQL Server Management Studio.exe" /RL HIGHEST & exit2⤵PID:2908
-
C:\Windows\system32\schtasks.exeSchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk AutoCAD" /tr "C:\Users\Admin\AppData\Roaming\xdwdMicrosoft SQL Server Management Studio.exe" /RL HIGHEST3⤵
- Scheduled Task/Job: Scheduled Task
PID:2124
-
-
-
C:\Windows\SYSTEM32\CMD.exe"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk AutoCAD" /tr "C:\Users\Admin\AppData\Roaming\xdwdMicrosoft SQL Server Management Studio.exe" /RL HIGHEST & exit2⤵PID:4116
-
C:\Windows\system32\schtasks.exeSchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk AutoCAD" /tr "C:\Users\Admin\AppData\Roaming\xdwdMicrosoft SQL Server Management Studio.exe" /RL HIGHEST3⤵
- Scheduled Task/Job: Scheduled Task
PID:3116
-
-
-
C:\Windows\SYSTEM32\CMD.exe"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk AutoCAD" /tr "C:\Users\Admin\AppData\Roaming\xdwdMicrosoft SQL Server Management Studio.exe" /RL HIGHEST & exit2⤵PID:3808
-
C:\Windows\system32\schtasks.exeSchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk AutoCAD" /tr "C:\Users\Admin\AppData\Roaming\xdwdMicrosoft SQL Server Management Studio.exe" /RL HIGHEST3⤵
- Scheduled Task/Job: Scheduled Task
PID:2328
-
-
-
C:\Windows\SYSTEM32\CMD.exe"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk AutoCAD" /tr "C:\Users\Admin\AppData\Roaming\xdwdMicrosoft SQL Server Management Studio.exe" /RL HIGHEST & exit2⤵PID:956
-
C:\Windows\system32\schtasks.exeSchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk AutoCAD" /tr "C:\Users\Admin\AppData\Roaming\xdwdMicrosoft SQL Server Management Studio.exe" /RL HIGHEST3⤵
- Scheduled Task/Job: Scheduled Task
PID:4516
-
-
-
C:\Windows\SYSTEM32\CMD.exe"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk AutoCAD" /tr "C:\Users\Admin\AppData\Roaming\xdwdMicrosoft SQL Server Management Studio.exe" /RL HIGHEST & exit2⤵PID:1568
-
C:\Windows\system32\schtasks.exeSchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk AutoCAD" /tr "C:\Users\Admin\AppData\Roaming\xdwdMicrosoft SQL Server Management Studio.exe" /RL HIGHEST3⤵
- Scheduled Task/Job: Scheduled Task
PID:4508
-
-
-
C:\Windows\SYSTEM32\CMD.exe"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk AutoCAD" /tr "C:\Users\Admin\AppData\Roaming\xdwdMicrosoft SQL Server Management Studio.exe" /RL HIGHEST & exit2⤵PID:2196
-
C:\Windows\system32\schtasks.exeSchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk AutoCAD" /tr "C:\Users\Admin\AppData\Roaming\xdwdMicrosoft SQL Server Management Studio.exe" /RL HIGHEST3⤵
- Scheduled Task/Job: Scheduled Task
PID:828
-
-
-
C:\Windows\SYSTEM32\CMD.exe"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk AutoCAD" /tr "C:\Users\Admin\AppData\Roaming\xdwdMicrosoft SQL Server Management Studio.exe" /RL HIGHEST & exit2⤵PID:4568
-
C:\Windows\system32\schtasks.exeSchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk AutoCAD" /tr "C:\Users\Admin\AppData\Roaming\xdwdMicrosoft SQL Server Management Studio.exe" /RL HIGHEST3⤵
- Scheduled Task/Job: Scheduled Task
PID:1096
-
-
-
C:\Windows\SYSTEM32\CMD.exe"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk AutoCAD" /tr "C:\Users\Admin\AppData\Roaming\xdwdMicrosoft SQL Server Management Studio.exe" /RL HIGHEST & exit2⤵PID:3640
-
C:\Windows\system32\schtasks.exeSchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk AutoCAD" /tr "C:\Users\Admin\AppData\Roaming\xdwdMicrosoft SQL Server Management Studio.exe" /RL HIGHEST3⤵
- Scheduled Task/Job: Scheduled Task
PID:1980
-
-
-
C:\Windows\SYSTEM32\CMD.exe"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk AutoCAD" /tr "C:\Users\Admin\AppData\Roaming\xdwdMicrosoft SQL Server Management Studio.exe" /RL HIGHEST & exit2⤵PID:3448
-
C:\Windows\system32\schtasks.exeSchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk AutoCAD" /tr "C:\Users\Admin\AppData\Roaming\xdwdMicrosoft SQL Server Management Studio.exe" /RL HIGHEST3⤵
- Scheduled Task/Job: Scheduled Task
PID:4264
-
-
-
C:\Windows\SYSTEM32\CMD.exe"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk AutoCAD" /tr "C:\Users\Admin\AppData\Roaming\xdwdMicrosoft SQL Server Management Studio.exe" /RL HIGHEST & exit2⤵PID:2752
-
C:\Windows\system32\schtasks.exeSchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk AutoCAD" /tr "C:\Users\Admin\AppData\Roaming\xdwdMicrosoft SQL Server Management Studio.exe" /RL HIGHEST3⤵
- Scheduled Task/Job: Scheduled Task
PID:4276
-
-
-
C:\Windows\SYSTEM32\CMD.exe"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk AutoCAD" /tr "C:\Users\Admin\AppData\Roaming\xdwdMicrosoft SQL Server Management Studio.exe" /RL HIGHEST & exit2⤵PID:2784
-
C:\Windows\system32\schtasks.exeSchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk AutoCAD" /tr "C:\Users\Admin\AppData\Roaming\xdwdMicrosoft SQL Server Management Studio.exe" /RL HIGHEST3⤵
- Scheduled Task/Job: Scheduled Task
PID:4804
-
-
-
C:\Windows\SYSTEM32\CMD.exe"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk AutoCAD" /tr "C:\Users\Admin\AppData\Roaming\xdwdMicrosoft SQL Server Management Studio.exe" /RL HIGHEST & exit2⤵PID:4516
-
C:\Windows\system32\schtasks.exeSchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk AutoCAD" /tr "C:\Users\Admin\AppData\Roaming\xdwdMicrosoft SQL Server Management Studio.exe" /RL HIGHEST3⤵
- Scheduled Task/Job: Scheduled Task
PID:2180
-
-
-
C:\Windows\SYSTEM32\CMD.exe"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk AutoCAD" /tr "C:\Users\Admin\AppData\Roaming\xdwdMicrosoft SQL Server Management Studio.exe" /RL HIGHEST & exit2⤵PID:4508
-
C:\Windows\system32\schtasks.exeSchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk AutoCAD" /tr "C:\Users\Admin\AppData\Roaming\xdwdMicrosoft SQL Server Management Studio.exe" /RL HIGHEST3⤵
- Scheduled Task/Job: Scheduled Task
PID:4552
-
-
-
C:\Windows\SYSTEM32\CMD.exe"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk AutoCAD" /tr "C:\Users\Admin\AppData\Roaming\xdwdMicrosoft SQL Server Management Studio.exe" /RL HIGHEST & exit2⤵PID:2196
-
C:\Windows\system32\schtasks.exeSchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk AutoCAD" /tr "C:\Users\Admin\AppData\Roaming\xdwdMicrosoft SQL Server Management Studio.exe" /RL HIGHEST3⤵
- Scheduled Task/Job: Scheduled Task
PID:4360
-
-
-
C:\Windows\SYSTEM32\CMD.exe"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk AutoCAD" /tr "C:\Users\Admin\AppData\Roaming\xdwdMicrosoft SQL Server Management Studio.exe" /RL HIGHEST & exit2⤵PID:4392
-
C:\Windows\system32\schtasks.exeSchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk AutoCAD" /tr "C:\Users\Admin\AppData\Roaming\xdwdMicrosoft SQL Server Management Studio.exe" /RL HIGHEST3⤵
- Scheduled Task/Job: Scheduled Task
PID:4568
-
-
-
C:\Windows\SYSTEM32\CMD.exe"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk AutoCAD" /tr "C:\Users\Admin\AppData\Roaming\xdwdMicrosoft SQL Server Management Studio.exe" /RL HIGHEST & exit2⤵PID:3148
-
C:\Windows\system32\schtasks.exeSchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk AutoCAD" /tr "C:\Users\Admin\AppData\Roaming\xdwdMicrosoft SQL Server Management Studio.exe" /RL HIGHEST3⤵
- Scheduled Task/Job: Scheduled Task
PID:5040
-
-
-
C:\Windows\SYSTEM32\CMD.exe"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk AutoCAD" /tr "C:\Users\Admin\AppData\Roaming\xdwdMicrosoft SQL Server Management Studio.exe" /RL HIGHEST & exit2⤵PID:2112
-
C:\Windows\system32\schtasks.exeSchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk AutoCAD" /tr "C:\Users\Admin\AppData\Roaming\xdwdMicrosoft SQL Server Management Studio.exe" /RL HIGHEST3⤵
- Scheduled Task/Job: Scheduled Task
PID:4600
-
-
-
C:\Windows\SYSTEM32\CMD.exe"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk AutoCAD" /tr "C:\Users\Admin\AppData\Roaming\xdwdMicrosoft SQL Server Management Studio.exe" /RL HIGHEST & exit2⤵PID:2444
-
C:\Windows\system32\schtasks.exeSchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk AutoCAD" /tr "C:\Users\Admin\AppData\Roaming\xdwdMicrosoft SQL Server Management Studio.exe" /RL HIGHEST3⤵
- Scheduled Task/Job: Scheduled Task
PID:3704
-
-
-
C:\Windows\SYSTEM32\CMD.exe"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk AutoCAD" /tr "C:\Users\Admin\AppData\Roaming\xdwdMicrosoft SQL Server Management Studio.exe" /RL HIGHEST & exit2⤵PID:3260
-
C:\Windows\system32\schtasks.exeSchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk AutoCAD" /tr "C:\Users\Admin\AppData\Roaming\xdwdMicrosoft SQL Server Management Studio.exe" /RL HIGHEST3⤵
- Scheduled Task/Job: Scheduled Task
PID:3916
-
-
-
C:\Windows\SYSTEM32\CMD.exe"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk AutoCAD" /tr "C:\Users\Admin\AppData\Roaming\xdwdMicrosoft SQL Server Management Studio.exe" /RL HIGHEST & exit2⤵PID:1424
-
C:\Windows\system32\schtasks.exeSchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk AutoCAD" /tr "C:\Users\Admin\AppData\Roaming\xdwdMicrosoft SQL Server Management Studio.exe" /RL HIGHEST3⤵
- Scheduled Task/Job: Scheduled Task
PID:4564
-
-
-
C:\Windows\SYSTEM32\CMD.exe"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk AutoCAD" /tr "C:\Users\Admin\AppData\Roaming\xdwdMicrosoft SQL Server Management Studio.exe" /RL HIGHEST & exit2⤵PID:1712
-
C:\Windows\system32\schtasks.exeSchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk AutoCAD" /tr "C:\Users\Admin\AppData\Roaming\xdwdMicrosoft SQL Server Management Studio.exe" /RL HIGHEST3⤵
- Scheduled Task/Job: Scheduled Task
PID:4508
-
-
-
C:\Windows\SYSTEM32\CMD.exe"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk AutoCAD" /tr "C:\Users\Admin\AppData\Roaming\xdwdMicrosoft SQL Server Management Studio.exe" /RL HIGHEST & exit2⤵PID:4952
-
C:\Windows\system32\schtasks.exeSchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk AutoCAD" /tr "C:\Users\Admin\AppData\Roaming\xdwdMicrosoft SQL Server Management Studio.exe" /RL HIGHEST3⤵
- Scheduled Task/Job: Scheduled Task
PID:1916
-
-
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵
- Suspicious behavior: EnumeratesProcesses
PID:2228
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Event Triggered Execution
1AppInit DLLs
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Event Triggered Execution
1AppInit DLLs
1Scheduled Task/Job
1Scheduled Task
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
136KB
MD516e5a492c9c6ae34c59683be9c51fa31
SHA197031b41f5c56f371c28ae0d62a2df7d585adaba
SHA25635c8d022e1d917f1aabdceae98097ccc072161b302f84c768ca63e4b32ac2b66
SHA51220fd369172ef5e3e2fde388666b42e8fe5f0c2bfa338c0345f45e98af6561a249ba3ecc48c3f16efcc73f02ecb67b3ddb1e2e8f0e77d18fa00ac34e6379e50b6