description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe

pid	Process
760	schtasks.exe
3808	schtasks.exe
456	schtasks.exe
1500	schtasks.exe
4216	schtasks.exe
1596	schtasks.exe
232	schtasks.exe
2736	schtasks.exe
4888	schtasks.exe
4664	schtasks.exe
2232	schtasks.exe
1628	schtasks.exe
1536	schtasks.exe
2368	schtasks.exe
4916	schtasks.exe
4516	schtasks.exe
4744	schtasks.exe
3880	schtasks.exe
400	schtasks.exe
2116	schtasks.exe
568	schtasks.exe
1128	schtasks.exe
3276	schtasks.exe
4092	schtasks.exe
3924	schtasks.exe
4596	schtasks.exe
3488	schtasks.exe
1824	schtasks.exe
4828	schtasks.exe
3532	schtasks.exe
944	schtasks.exe
3108	schtasks.exe
2932	schtasks.exe
3636	schtasks.exe
2868	schtasks.exe
3940	schtasks.exe
2084	schtasks.exe
4904	schtasks.exe
3988	schtasks.exe
1408	schtasks.exe
4812	schtasks.exe
4700	schtasks.exe
3788	schtasks.exe
2840	schtasks.exe
3032	schtasks.exe
2644	schtasks.exe
3364	schtasks.exe
3120	schtasks.exe
3152	schtasks.exe
3504	schtasks.exe
3532	schtasks.exe
2180	schtasks.exe
4924	schtasks.exe
4584	schtasks.exe
4028	schtasks.exe
1184	schtasks.exe
4300	schtasks.exe
3892	schtasks.exe
2244	schtasks.exe
1588	schtasks.exe
1704	schtasks.exe
3588	schtasks.exe
4680	schtasks.exe
428	schtasks.exe

description	pid	Process
Token: SeIncreaseQuotaPrivilege	2864	WMIC.exe
Token: SeSecurityPrivilege	2864	WMIC.exe
Token: SeTakeOwnershipPrivilege	2864	WMIC.exe
Token: SeLoadDriverPrivilege	2864	WMIC.exe
Token: SeSystemProfilePrivilege	2864	WMIC.exe
Token: SeSystemtimePrivilege	2864	WMIC.exe
Token: SeProfSingleProcessPrivilege	2864	WMIC.exe
Token: SeIncBasePriorityPrivilege	2864	WMIC.exe
Token: SeCreatePagefilePrivilege	2864	WMIC.exe
Token: SeBackupPrivilege	2864	WMIC.exe
Token: SeRestorePrivilege	2864	WMIC.exe
Token: SeShutdownPrivilege	2864	WMIC.exe
Token: SeDebugPrivilege	2864	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2864	WMIC.exe
Token: SeRemoteShutdownPrivilege	2864	WMIC.exe
Token: SeUndockPrivilege	2864	WMIC.exe
Token: SeManageVolumePrivilege	2864	WMIC.exe
Token: 33	2864	WMIC.exe
Token: 34	2864	WMIC.exe
Token: 35	2864	WMIC.exe
Token: 36	2864	WMIC.exe
Token: SeIncreaseQuotaPrivilege	2864	WMIC.exe
Token: SeSecurityPrivilege	2864	WMIC.exe
Token: SeTakeOwnershipPrivilege	2864	WMIC.exe
Token: SeLoadDriverPrivilege	2864	WMIC.exe
Token: SeSystemProfilePrivilege	2864	WMIC.exe
Token: SeSystemtimePrivilege	2864	WMIC.exe
Token: SeProfSingleProcessPrivilege	2864	WMIC.exe
Token: SeIncBasePriorityPrivilege	2864	WMIC.exe
Token: SeCreatePagefilePrivilege	2864	WMIC.exe
Token: SeBackupPrivilege	2864	WMIC.exe
Token: SeRestorePrivilege	2864	WMIC.exe
Token: SeShutdownPrivilege	2864	WMIC.exe
Token: SeDebugPrivilege	2864	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2864	WMIC.exe
Token: SeRemoteShutdownPrivilege	2864	WMIC.exe
Token: SeUndockPrivilege	2864	WMIC.exe
Token: SeManageVolumePrivilege	2864	WMIC.exe
Token: 33	2864	WMIC.exe
Token: 34	2864	WMIC.exe
Token: 35	2864	WMIC.exe
Token: 36	2864	WMIC.exe

description	pid	Process	procid_target
PID 3068 wrote to memory of 2088	3068	cmd.exe	79
PID 3068 wrote to memory of 2088	3068	cmd.exe	79
PID 3068 wrote to memory of 956	3068	cmd.exe	80
PID 3068 wrote to memory of 956	3068	cmd.exe	80
PID 3068 wrote to memory of 3636	3068	cmd.exe	81
PID 3068 wrote to memory of 3636	3068	cmd.exe	81
PID 3636 wrote to memory of 4972	3636	net.exe	82
PID 3636 wrote to memory of 4972	3636	net.exe	82
PID 3068 wrote to memory of 1992	3068	cmd.exe	83
PID 3068 wrote to memory of 1992	3068	cmd.exe	83
PID 3068 wrote to memory of 556	3068	cmd.exe	84
PID 3068 wrote to memory of 556	3068	cmd.exe	84
PID 3068 wrote to memory of 2864	3068	cmd.exe	85
PID 3068 wrote to memory of 2864	3068	cmd.exe	85
PID 3068 wrote to memory of 2804	3068	cmd.exe	89
PID 3068 wrote to memory of 2804	3068	cmd.exe	89
PID 3068 wrote to memory of 1084	3068	cmd.exe	90
PID 3068 wrote to memory of 1084	3068	cmd.exe	90
PID 3068 wrote to memory of 1804	3068	cmd.exe	91
PID 3068 wrote to memory of 1804	3068	cmd.exe	91
PID 3068 wrote to memory of 3532	3068	cmd.exe	92
PID 3068 wrote to memory of 3532	3068	cmd.exe	92
PID 3068 wrote to memory of 3288	3068	cmd.exe	93
PID 3068 wrote to memory of 3288	3068	cmd.exe	93
PID 3068 wrote to memory of 944	3068	cmd.exe	94
PID 3068 wrote to memory of 944	3068	cmd.exe	94
PID 3068 wrote to memory of 720	3068	cmd.exe	95
PID 3068 wrote to memory of 720	3068	cmd.exe	95
PID 3068 wrote to memory of 4936	3068	cmd.exe	96
PID 3068 wrote to memory of 4936	3068	cmd.exe	96
PID 3068 wrote to memory of 2092	3068	cmd.exe	97
PID 3068 wrote to memory of 2092	3068	cmd.exe	97
PID 3068 wrote to memory of 2644	3068	cmd.exe	98
PID 3068 wrote to memory of 2644	3068	cmd.exe	98
PID 3068 wrote to memory of 2040	3068	cmd.exe	99
PID 3068 wrote to memory of 2040	3068	cmd.exe	99
PID 3068 wrote to memory of 240	3068	cmd.exe	100
PID 3068 wrote to memory of 240	3068	cmd.exe	100
PID 3068 wrote to memory of 2236	3068	cmd.exe	101
PID 3068 wrote to memory of 2236	3068	cmd.exe	101
PID 3068 wrote to memory of 4516	3068	cmd.exe	102
PID 3068 wrote to memory of 4516	3068	cmd.exe	102
PID 3068 wrote to memory of 248	3068	cmd.exe	103
PID 3068 wrote to memory of 248	3068	cmd.exe	103
PID 3068 wrote to memory of 3108	3068	cmd.exe	104
PID 3068 wrote to memory of 3108	3068	cmd.exe	104
PID 3068 wrote to memory of 328	3068	cmd.exe	105
PID 3068 wrote to memory of 328	3068	cmd.exe	105
PID 3068 wrote to memory of 4584	3068	cmd.exe	106
PID 3068 wrote to memory of 4584	3068	cmd.exe	106
PID 3068 wrote to memory of 4720	3068	cmd.exe	107
PID 3068 wrote to memory of 4720	3068	cmd.exe	107
PID 3068 wrote to memory of 2060	3068	cmd.exe	108
PID 3068 wrote to memory of 2060	3068	cmd.exe	108
PID 3068 wrote to memory of 1520	3068	cmd.exe	109
PID 3068 wrote to memory of 1520	3068	cmd.exe	109
PID 3068 wrote to memory of 232	3068	cmd.exe	110
PID 3068 wrote to memory of 232	3068	cmd.exe	110
PID 3068 wrote to memory of 3052	3068	cmd.exe	111
PID 3068 wrote to memory of 3052	3068	cmd.exe	111
PID 3068 wrote to memory of 1544	3068	cmd.exe	112
PID 3068 wrote to memory of 1544	3068	cmd.exe	112
PID 3068 wrote to memory of 2276	3068	cmd.exe	113
PID 3068 wrote to memory of 2276	3068	cmd.exe	113

pid	Process
2068	attrib.exe
3944	attrib.exe
2160	attrib.exe
2728	attrib.exe
3976	attrib.exe
3728	attrib.exe
2952	attrib.exe
3400	attrib.exe
1956	attrib.exe
1848	attrib.exe
2236	attrib.exe
4720	attrib.exe
3052	attrib.exe
2348	attrib.exe
1928	attrib.exe
4776	attrib.exe
1824	attrib.exe
3988	attrib.exe
5056	attrib.exe
3232	attrib.exe
1212	attrib.exe
852	attrib.exe
3796	attrib.exe
720	attrib.exe
248	attrib.exe
852	attrib.exe
1780	attrib.exe
4188	attrib.exe
2040	attrib.exe
2236	attrib.exe
1048	attrib.exe
5076	attrib.exe
4676	attrib.exe
3104	attrib.exe
4848	attrib.exe
900	attrib.exe
3420	attrib.exe
1144	attrib.exe
4900	attrib.exe
1848	attrib.exe
3728	attrib.exe
4968	attrib.exe
328	attrib.exe
4696	attrib.exe
3724	attrib.exe
3348	attrib.exe
4424	attrib.exe
1700	attrib.exe
2316	attrib.exe
2804	attrib.exe
2268	attrib.exe
1172	attrib.exe
2292	attrib.exe
2740	attrib.exe
1520	attrib.exe
1952	attrib.exe
4716	attrib.exe
3448	attrib.exe
1944	attrib.exe
1500	attrib.exe
2584	attrib.exe
4912	attrib.exe
2864	attrib.exe
4980	attrib.exe

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads