Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    148s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    03/10/2024, 17:41

General

  • Target

    3b8558d14b8bec08fe9f9ef78c1fb7c6.exe

  • Size

    8.7MB

  • MD5

    3b8558d14b8bec08fe9f9ef78c1fb7c6

  • SHA1

    d8cfe796e8a12b1c46598fe3daee9eb65a3aac0d

  • SHA256

    de7741a1b4e38e18f595621651df024e56db034c692190b5b6115d2b4b1033cb

  • SHA512

    d388d818a770a081b4d2cddfcc66a32f04357afa3905d63929fed9c77d723572436ab2d3efe2f2d3e4fcebb35fce5fd93100f9b31695fbeb5a28c6e49268941c

  • SSDEEP

    24576:XaVPwvlamIBIEurOuSmKAFdrQLY9MyUT/iMWSFHJNzjyfJV5v7KInxhygjsSL:XiPeAVIbSmKAFaWbUTRrzeft+Ixhrj

Score
10/10

Malware Config

Signatures

  • Process spawned unexpected child process 15 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Checks computer location settings 2 TTPs 17 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 16 IoCs
  • Drops file in Program Files directory 6 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 5 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

  • Modifies registry class 17 IoCs
  • Runs ping.exe 1 TTPs 5 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 15 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 17 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\3b8558d14b8bec08fe9f9ef78c1fb7c6.exe
    "C:\Users\Admin\AppData\Local\Temp\3b8558d14b8bec08fe9f9ef78c1fb7c6.exe"
    1⤵
    • Checks computer location settings
    • Drops file in Program Files directory
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3504
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\Kr9GNC90df.bat"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:112
      • C:\Windows\system32\chcp.com
        chcp 65001
        3⤵
          PID:3124
        • C:\Windows\system32\w32tm.exe
          w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
          3⤵
            PID:4876
          • C:\Recovery\WindowsRE\explorer.exe
            "C:\Recovery\WindowsRE\explorer.exe"
            3⤵
            • Checks computer location settings
            • Executes dropped EXE
            • Modifies registry class
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:1048
            • C:\Windows\System32\cmd.exe
              "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\Z0hIbOJQ8t.bat"
              4⤵
              • Suspicious use of WriteProcessMemory
              PID:680
              • C:\Windows\system32\chcp.com
                chcp 65001
                5⤵
                  PID:944
                • C:\Windows\system32\w32tm.exe
                  w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                  5⤵
                    PID:4212
                  • C:\Recovery\WindowsRE\explorer.exe
                    "C:\Recovery\WindowsRE\explorer.exe"
                    5⤵
                    • Checks computer location settings
                    • Executes dropped EXE
                    • Modifies registry class
                    • Suspicious use of AdjustPrivilegeToken
                    • Suspicious use of WriteProcessMemory
                    PID:1468
                    • C:\Windows\System32\cmd.exe
                      "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\581siQe8es.bat"
                      6⤵
                      • Suspicious use of WriteProcessMemory
                      PID:5004
                      • C:\Windows\system32\chcp.com
                        chcp 65001
                        7⤵
                          PID:636
                        • C:\Windows\system32\PING.EXE
                          ping -n 10 localhost
                          7⤵
                          • System Network Configuration Discovery: Internet Connection Discovery
                          • Runs ping.exe
                          PID:1744
                        • C:\Recovery\WindowsRE\explorer.exe
                          "C:\Recovery\WindowsRE\explorer.exe"
                          7⤵
                          • Checks computer location settings
                          • Executes dropped EXE
                          • Modifies registry class
                          • Suspicious use of AdjustPrivilegeToken
                          • Suspicious use of WriteProcessMemory
                          PID:1956
                          • C:\Windows\System32\cmd.exe
                            "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\rln2uypvqA.bat"
                            8⤵
                            • Suspicious use of WriteProcessMemory
                            PID:2240
                            • C:\Windows\system32\chcp.com
                              chcp 65001
                              9⤵
                                PID:780
                              • C:\Windows\system32\w32tm.exe
                                w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                9⤵
                                  PID:1368
                                • C:\Recovery\WindowsRE\explorer.exe
                                  "C:\Recovery\WindowsRE\explorer.exe"
                                  9⤵
                                  • Checks computer location settings
                                  • Executes dropped EXE
                                  • Modifies registry class
                                  • Suspicious use of AdjustPrivilegeToken
                                  • Suspicious use of WriteProcessMemory
                                  PID:2172
                                  • C:\Windows\System32\cmd.exe
                                    "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\QgWt8DckRd.bat"
                                    10⤵
                                    • Suspicious use of WriteProcessMemory
                                    PID:3356
                                    • C:\Windows\system32\chcp.com
                                      chcp 65001
                                      11⤵
                                        PID:1544
                                      • C:\Windows\system32\w32tm.exe
                                        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                        11⤵
                                          PID:4896
                                        • C:\Recovery\WindowsRE\explorer.exe
                                          "C:\Recovery\WindowsRE\explorer.exe"
                                          11⤵
                                          • Checks computer location settings
                                          • Executes dropped EXE
                                          • Modifies registry class
                                          • Suspicious use of AdjustPrivilegeToken
                                          • Suspicious use of WriteProcessMemory
                                          PID:1488
                                          • C:\Windows\System32\cmd.exe
                                            "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\E7ZnFR4Wgx.bat"
                                            12⤵
                                            • Suspicious use of WriteProcessMemory
                                            PID:3916
                                            • C:\Windows\system32\chcp.com
                                              chcp 65001
                                              13⤵
                                                PID:1400
                                              • C:\Windows\system32\w32tm.exe
                                                w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                13⤵
                                                  PID:4976
                                                • C:\Recovery\WindowsRE\explorer.exe
                                                  "C:\Recovery\WindowsRE\explorer.exe"
                                                  13⤵
                                                  • Checks computer location settings
                                                  • Executes dropped EXE
                                                  • Modifies registry class
                                                  • Suspicious use of AdjustPrivilegeToken
                                                  • Suspicious use of WriteProcessMemory
                                                  PID:3988
                                                  • C:\Windows\System32\cmd.exe
                                                    "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\6Nq0CBezpn.bat"
                                                    14⤵
                                                    • Suspicious use of WriteProcessMemory
                                                    PID:3720
                                                    • C:\Windows\system32\chcp.com
                                                      chcp 65001
                                                      15⤵
                                                        PID:4960
                                                      • C:\Windows\system32\w32tm.exe
                                                        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                        15⤵
                                                          PID:4632
                                                        • C:\Recovery\WindowsRE\explorer.exe
                                                          "C:\Recovery\WindowsRE\explorer.exe"
                                                          15⤵
                                                          • Checks computer location settings
                                                          • Executes dropped EXE
                                                          • Modifies registry class
                                                          • Suspicious use of AdjustPrivilegeToken
                                                          • Suspicious use of WriteProcessMemory
                                                          PID:1848
                                                          • C:\Windows\System32\cmd.exe
                                                            "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\rln2uypvqA.bat"
                                                            16⤵
                                                            • Suspicious use of WriteProcessMemory
                                                            PID:4732
                                                            • C:\Windows\system32\chcp.com
                                                              chcp 65001
                                                              17⤵
                                                                PID:3524
                                                              • C:\Windows\system32\w32tm.exe
                                                                w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                                17⤵
                                                                  PID:4992
                                                                • C:\Recovery\WindowsRE\explorer.exe
                                                                  "C:\Recovery\WindowsRE\explorer.exe"
                                                                  17⤵
                                                                  • Checks computer location settings
                                                                  • Executes dropped EXE
                                                                  • Modifies registry class
                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                  PID:4800
                                                                  • C:\Windows\System32\cmd.exe
                                                                    "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\QgWt8DckRd.bat"
                                                                    18⤵
                                                                      PID:4360
                                                                      • C:\Windows\system32\chcp.com
                                                                        chcp 65001
                                                                        19⤵
                                                                          PID:1760
                                                                        • C:\Windows\system32\w32tm.exe
                                                                          w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                                          19⤵
                                                                            PID:1084
                                                                          • C:\Recovery\WindowsRE\explorer.exe
                                                                            "C:\Recovery\WindowsRE\explorer.exe"
                                                                            19⤵
                                                                            • Checks computer location settings
                                                                            • Executes dropped EXE
                                                                            • Modifies registry class
                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                            PID:2776
                                                                            • C:\Windows\System32\cmd.exe
                                                                              "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\m961u58njg.bat"
                                                                              20⤵
                                                                                PID:4448
                                                                                • C:\Windows\system32\chcp.com
                                                                                  chcp 65001
                                                                                  21⤵
                                                                                    PID:4756
                                                                                  • C:\Windows\system32\PING.EXE
                                                                                    ping -n 10 localhost
                                                                                    21⤵
                                                                                    • System Network Configuration Discovery: Internet Connection Discovery
                                                                                    • Runs ping.exe
                                                                                    PID:3668
                                                                                  • C:\Recovery\WindowsRE\explorer.exe
                                                                                    "C:\Recovery\WindowsRE\explorer.exe"
                                                                                    21⤵
                                                                                    • Checks computer location settings
                                                                                    • Executes dropped EXE
                                                                                    • Modifies registry class
                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                    PID:396
                                                                                    • C:\Windows\System32\cmd.exe
                                                                                      "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\ex1oYQHqtZ.bat"
                                                                                      22⤵
                                                                                        PID:4316
                                                                                        • C:\Windows\system32\chcp.com
                                                                                          chcp 65001
                                                                                          23⤵
                                                                                            PID:2904
                                                                                          • C:\Windows\system32\w32tm.exe
                                                                                            w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                                                            23⤵
                                                                                              PID:3984
                                                                                            • C:\Recovery\WindowsRE\explorer.exe
                                                                                              "C:\Recovery\WindowsRE\explorer.exe"
                                                                                              23⤵
                                                                                              • Checks computer location settings
                                                                                              • Executes dropped EXE
                                                                                              • Modifies registry class
                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                              PID:3876
                                                                                              • C:\Windows\System32\cmd.exe
                                                                                                "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\0BhMlNgjsC.bat"
                                                                                                24⤵
                                                                                                  PID:208
                                                                                                  • C:\Windows\system32\chcp.com
                                                                                                    chcp 65001
                                                                                                    25⤵
                                                                                                      PID:3064
                                                                                                    • C:\Windows\system32\w32tm.exe
                                                                                                      w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                                                                      25⤵
                                                                                                        PID:4468
                                                                                                      • C:\Recovery\WindowsRE\explorer.exe
                                                                                                        "C:\Recovery\WindowsRE\explorer.exe"
                                                                                                        25⤵
                                                                                                        • Checks computer location settings
                                                                                                        • Executes dropped EXE
                                                                                                        • Modifies registry class
                                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                                        PID:1252
                                                                                                        • C:\Windows\System32\cmd.exe
                                                                                                          "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\diBg3fIzhe.bat"
                                                                                                          26⤵
                                                                                                            PID:4868
                                                                                                            • C:\Windows\system32\chcp.com
                                                                                                              chcp 65001
                                                                                                              27⤵
                                                                                                                PID:3048
                                                                                                              • C:\Windows\system32\PING.EXE
                                                                                                                ping -n 10 localhost
                                                                                                                27⤵
                                                                                                                • System Network Configuration Discovery: Internet Connection Discovery
                                                                                                                • Runs ping.exe
                                                                                                                PID:2120
                                                                                                              • C:\Recovery\WindowsRE\explorer.exe
                                                                                                                "C:\Recovery\WindowsRE\explorer.exe"
                                                                                                                27⤵
                                                                                                                • Checks computer location settings
                                                                                                                • Executes dropped EXE
                                                                                                                • Modifies registry class
                                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                                PID:4816
                                                                                                                • C:\Windows\System32\cmd.exe
                                                                                                                  "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\vTHQNFoTQv.bat"
                                                                                                                  28⤵
                                                                                                                    PID:1532
                                                                                                                    • C:\Windows\system32\chcp.com
                                                                                                                      chcp 65001
                                                                                                                      29⤵
                                                                                                                        PID:2912
                                                                                                                      • C:\Windows\system32\PING.EXE
                                                                                                                        ping -n 10 localhost
                                                                                                                        29⤵
                                                                                                                        • System Network Configuration Discovery: Internet Connection Discovery
                                                                                                                        • Runs ping.exe
                                                                                                                        PID:3736
                                                                                                                      • C:\Recovery\WindowsRE\explorer.exe
                                                                                                                        "C:\Recovery\WindowsRE\explorer.exe"
                                                                                                                        29⤵
                                                                                                                        • Checks computer location settings
                                                                                                                        • Executes dropped EXE
                                                                                                                        • Modifies registry class
                                                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                                                        PID:4044
                                                                                                                        • C:\Windows\System32\cmd.exe
                                                                                                                          "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\L4pr7KvdK9.bat"
                                                                                                                          30⤵
                                                                                                                            PID:1516
                                                                                                                            • C:\Windows\system32\chcp.com
                                                                                                                              chcp 65001
                                                                                                                              31⤵
                                                                                                                                PID:700
                                                                                                                              • C:\Windows\system32\w32tm.exe
                                                                                                                                w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                                                                                                31⤵
                                                                                                                                  PID:4720
                                                                                                                                • C:\Recovery\WindowsRE\explorer.exe
                                                                                                                                  "C:\Recovery\WindowsRE\explorer.exe"
                                                                                                                                  31⤵
                                                                                                                                  • Checks computer location settings
                                                                                                                                  • Executes dropped EXE
                                                                                                                                  • Modifies registry class
                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                  PID:2280
                                                                                                                                  • C:\Windows\System32\cmd.exe
                                                                                                                                    "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\szcAPjpm25.bat"
                                                                                                                                    32⤵
                                                                                                                                      PID:1084
                                                                                                                                      • C:\Windows\system32\chcp.com
                                                                                                                                        chcp 65001
                                                                                                                                        33⤵
                                                                                                                                          PID:3764
                                                                                                                                        • C:\Windows\system32\PING.EXE
                                                                                                                                          ping -n 10 localhost
                                                                                                                                          33⤵
                                                                                                                                          • System Network Configuration Discovery: Internet Connection Discovery
                                                                                                                                          • Runs ping.exe
                                                                                                                                          PID:3828
                                                                                                                                        • C:\Recovery\WindowsRE\explorer.exe
                                                                                                                                          "C:\Recovery\WindowsRE\explorer.exe"
                                                                                                                                          33⤵
                                                                                                                                          • Checks computer location settings
                                                                                                                                          • Executes dropped EXE
                                                                                                                                          • Modifies registry class
                                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                                          PID:5040
                                                                                                                                          • C:\Windows\System32\cmd.exe
                                                                                                                                            "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\HaE3Dx3E3n.bat"
                                                                                                                                            34⤵
                                                                                                                                              PID:760
                                                                                                                                              • C:\Windows\system32\chcp.com
                                                                                                                                                chcp 65001
                                                                                                                                                35⤵
                                                                                                                                                  PID:3232
                                                                                                                                                • C:\Windows\system32\w32tm.exe
                                                                                                                                                  w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                                                                                                                  35⤵
                                                                                                                                                    PID:764
                                                                              • C:\Windows\system32\schtasks.exe
                                                                                schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 5 /tr "'C:\Users\Admin\Saved Games\dllhost.exe'" /f
                                                                                1⤵
                                                                                • Process spawned unexpected child process
                                                                                • Scheduled Task/Job: Scheduled Task
                                                                                PID:3104
                                                                              • C:\Windows\system32\schtasks.exe
                                                                                schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Users\Admin\Saved Games\dllhost.exe'" /rl HIGHEST /f
                                                                                1⤵
                                                                                • Process spawned unexpected child process
                                                                                • Scheduled Task/Job: Scheduled Task
                                                                                PID:1544
                                                                              • C:\Windows\system32\schtasks.exe
                                                                                schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 13 /tr "'C:\Users\Admin\Saved Games\dllhost.exe'" /rl HIGHEST /f
                                                                                1⤵
                                                                                • Process spawned unexpected child process
                                                                                • Scheduled Task/Job: Scheduled Task
                                                                                PID:4896
                                                                              • C:\Windows\system32\schtasks.exe
                                                                                schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 9 /tr "'C:\Program Files\Mozilla Firefox\fonts\spoolsv.exe'" /f
                                                                                1⤵
                                                                                • Process spawned unexpected child process
                                                                                • Scheduled Task/Job: Scheduled Task
                                                                                PID:2356
                                                                              • C:\Windows\system32\schtasks.exe
                                                                                schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Program Files\Mozilla Firefox\fonts\spoolsv.exe'" /rl HIGHEST /f
                                                                                1⤵
                                                                                • Process spawned unexpected child process
                                                                                • Scheduled Task/Job: Scheduled Task
                                                                                PID:3324
                                                                              • C:\Windows\system32\schtasks.exe
                                                                                schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 6 /tr "'C:\Program Files\Mozilla Firefox\fonts\spoolsv.exe'" /rl HIGHEST /f
                                                                                1⤵
                                                                                • Process spawned unexpected child process
                                                                                • Scheduled Task/Job: Scheduled Task
                                                                                PID:2676
                                                                              • C:\Windows\system32\schtasks.exe
                                                                                schtasks.exe /create /tn "explorere" /sc MINUTE /mo 13 /tr "'C:\Program Files\Reference Assemblies\explorer.exe'" /f
                                                                                1⤵
                                                                                • Process spawned unexpected child process
                                                                                • Scheduled Task/Job: Scheduled Task
                                                                                PID:1488
                                                                              • C:\Windows\system32\schtasks.exe
                                                                                schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Program Files\Reference Assemblies\explorer.exe'" /rl HIGHEST /f
                                                                                1⤵
                                                                                • Process spawned unexpected child process
                                                                                • Scheduled Task/Job: Scheduled Task
                                                                                PID:4344
                                                                              • C:\Windows\system32\schtasks.exe
                                                                                schtasks.exe /create /tn "explorere" /sc MINUTE /mo 8 /tr "'C:\Program Files\Reference Assemblies\explorer.exe'" /rl HIGHEST /f
                                                                                1⤵
                                                                                • Process spawned unexpected child process
                                                                                • Scheduled Task/Job: Scheduled Task
                                                                                PID:1936
                                                                              • C:\Windows\system32\schtasks.exe
                                                                                schtasks.exe /create /tn "sysmons" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Windows Photo Viewer\fr-FR\sysmon.exe'" /f
                                                                                1⤵
                                                                                • Process spawned unexpected child process
                                                                                • Scheduled Task/Job: Scheduled Task
                                                                                PID:5008
                                                                              • C:\Windows\system32\schtasks.exe
                                                                                schtasks.exe /create /tn "sysmon" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Photo Viewer\fr-FR\sysmon.exe'" /rl HIGHEST /f
                                                                                1⤵
                                                                                • Process spawned unexpected child process
                                                                                • Scheduled Task/Job: Scheduled Task
                                                                                PID:4868
                                                                              • C:\Windows\system32\schtasks.exe
                                                                                schtasks.exe /create /tn "sysmons" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Windows Photo Viewer\fr-FR\sysmon.exe'" /rl HIGHEST /f
                                                                                1⤵
                                                                                • Process spawned unexpected child process
                                                                                • Scheduled Task/Job: Scheduled Task
                                                                                PID:2268
                                                                              • C:\Windows\system32\schtasks.exe
                                                                                schtasks.exe /create /tn "explorere" /sc MINUTE /mo 7 /tr "'C:\Recovery\WindowsRE\explorer.exe'" /f
                                                                                1⤵
                                                                                • Process spawned unexpected child process
                                                                                • Scheduled Task/Job: Scheduled Task
                                                                                PID:2764
                                                                              • C:\Windows\system32\schtasks.exe
                                                                                schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\explorer.exe'" /rl HIGHEST /f
                                                                                1⤵
                                                                                • Process spawned unexpected child process
                                                                                • Scheduled Task/Job: Scheduled Task
                                                                                PID:4788
                                                                              • C:\Windows\system32\schtasks.exe
                                                                                schtasks.exe /create /tn "explorere" /sc MINUTE /mo 10 /tr "'C:\Recovery\WindowsRE\explorer.exe'" /rl HIGHEST /f
                                                                                1⤵
                                                                                • Process spawned unexpected child process
                                                                                • Scheduled Task/Job: Scheduled Task
                                                                                PID:2528

                                                                              Network

                                                                              MITRE ATT&CK Enterprise v15

                                                                              Replay Monitor

                                                                              Loading Replay Monitor...

                                                                              Downloads

                                                                              • C:\Recovery\WindowsRE\explorer.exe

                                                                                Filesize

                                                                                8.7MB

                                                                                MD5

                                                                                3b8558d14b8bec08fe9f9ef78c1fb7c6

                                                                                SHA1

                                                                                d8cfe796e8a12b1c46598fe3daee9eb65a3aac0d

                                                                                SHA256

                                                                                de7741a1b4e38e18f595621651df024e56db034c692190b5b6115d2b4b1033cb

                                                                                SHA512

                                                                                d388d818a770a081b4d2cddfcc66a32f04357afa3905d63929fed9c77d723572436ab2d3efe2f2d3e4fcebb35fce5fd93100f9b31695fbeb5a28c6e49268941c

                                                                              • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\explorer.exe.log

                                                                                Filesize

                                                                                1KB

                                                                                MD5

                                                                                a24106fd92046ea9069a397ceb413237

                                                                                SHA1

                                                                                af763d3cdbcba493b8d4a1d67abd5d749933e26a

                                                                                SHA256

                                                                                c6893fabaf71b5e28c2ecf4c4d82043b0e331bef9af0170fed89f3f70fed169b

                                                                                SHA512

                                                                                334e89b77ddae354f8730ee7fa258b29025331a31f9bfa6ba5d61be08f2b62fd1c829c9e7ec45cd14665f4f2a94ddd13f70a782952b8e07def0cfc832fac7d00

                                                                              • C:\Users\Admin\AppData\Local\Temp\0BhMlNgjsC.bat

                                                                                Filesize

                                                                                210B

                                                                                MD5

                                                                                e9000967e96a6bb624331cdcddb3b5cc

                                                                                SHA1

                                                                                296fa0b091c79750e049be204f97d2d68ddab9ed

                                                                                SHA256

                                                                                33b7e3bafaa592e70be4f4664c30eeba07df08085d9f513ef2eee2740554c1cb

                                                                                SHA512

                                                                                a6fe596fcc1d4625b6c0ca1c602bca05afb8a6deb90b57de9f38f4e283f8a60d49518708758b2111f774ead25d5ee92e08d555bdf5dce20bb4b9f71d862fb04a

                                                                              • C:\Users\Admin\AppData\Local\Temp\581siQe8es.bat

                                                                                Filesize

                                                                                162B

                                                                                MD5

                                                                                c733d39a5c3c0216310e930460657a9b

                                                                                SHA1

                                                                                39304623f5ff67b36582b1639e021900669447f1

                                                                                SHA256

                                                                                8674fec6a6f079ecc1eac0ee07b25cebd15df5311f02802452f4957e88e24ee2

                                                                                SHA512

                                                                                4b27a8b125be30f8caa235324ae0b727cc14aca2d2c09779a783d58856a384f9bcc99cfdba1da326cb37d4c7086519f03ecc027c8ed12cfd726ebbe1dfd905a4

                                                                              • C:\Users\Admin\AppData\Local\Temp\6Nq0CBezpn.bat

                                                                                Filesize

                                                                                210B

                                                                                MD5

                                                                                617b6306ec318bc39b46fc36bd84f196

                                                                                SHA1

                                                                                fc127d26cb0502adbc8123a7c6fcfd817d651e8a

                                                                                SHA256

                                                                                572d3ef4e3f46ccc2f72299efe165d511270b3cb5b424ca1c0329f2ef4d4f534

                                                                                SHA512

                                                                                a17b787120f4b93b009b0359ea6c222a127bd23028f0ff0400f98984c3d5c1a4ad39656960b7923e5cf2a9105c7529756ee249177262e3a00c0b1cfc9cfc4b02

                                                                              • C:\Users\Admin\AppData\Local\Temp\E7ZnFR4Wgx.bat

                                                                                Filesize

                                                                                210B

                                                                                MD5

                                                                                962b62a5e3e7236e607f29633e966f7d

                                                                                SHA1

                                                                                aafa8224c4aa8e93c7eea0ceee18e369b58078b2

                                                                                SHA256

                                                                                dada731a3e79bb2e089c659d27c32ceb71a0bfeacfe2ed2afd53dd32981b037a

                                                                                SHA512

                                                                                72bd6845094dd63610e5b91cee91a802d994843d9cdd1077bf2bc4fdbb2585a7514d970ae0e6aba3262d975f01c4d1a36d8a3026959d7eeb362ced9521f49874

                                                                              • C:\Users\Admin\AppData\Local\Temp\HaE3Dx3E3n.bat

                                                                                Filesize

                                                                                210B

                                                                                MD5

                                                                                83250a64067d849a94bb295d125d2bee

                                                                                SHA1

                                                                                566281817446a5d8a1a67000d0f0f83c048fefaa

                                                                                SHA256

                                                                                7112cb4a209ef006f6ef813ca4bf0a0ea4e2a05420f6e8789d967577b044c2af

                                                                                SHA512

                                                                                f110d4fb50edb04fde4d8a586b98b8b6a149c63bbd4545634377d7fddefb7164896d4b421c4081111b7d31784d52436166c39829a5f4161667910dfa6b99a5be

                                                                              • C:\Users\Admin\AppData\Local\Temp\Kr9GNC90df.bat

                                                                                Filesize

                                                                                210B

                                                                                MD5

                                                                                b24ccd50645adaf203cb1731d76bedbb

                                                                                SHA1

                                                                                bead23ad71b3327c57b9945426fa3f424c5121f4

                                                                                SHA256

                                                                                680bef64f82987cea188be1fb63109a88b9d1badf31be0aaed4dcb93a22b8115

                                                                                SHA512

                                                                                1f65b121a2fb1c5245c367a0715e8a65b5e8c711118df61a06b3f5520371a2f1b4b9b479db8b3cacce4602be83a2a8ee1057dfea14cc774d9e0d2bdcc744758a

                                                                              • C:\Users\Admin\AppData\Local\Temp\L4pr7KvdK9.bat

                                                                                Filesize

                                                                                210B

                                                                                MD5

                                                                                a0098c85bb6dc02a58b824c9b12e8cab

                                                                                SHA1

                                                                                934125050a832d5498670611e63fc255e869e794

                                                                                SHA256

                                                                                1f17e675eb552f7d1610e8d32e8f3b5564e8a43027dcd87b9e76d4d5afaeb613

                                                                                SHA512

                                                                                f74d5495f777c269c257303efd7f846bf3cd483ff2036ea8536798afba8033baf6af0241d61b37969a63d535da2060b93557ac9bc9ce97a9d1c69e4498a4b0a8

                                                                              • C:\Users\Admin\AppData\Local\Temp\QgWt8DckRd.bat

                                                                                Filesize

                                                                                210B

                                                                                MD5

                                                                                07adfc61f349da0ebd9c4c5efca2f33b

                                                                                SHA1

                                                                                cf791d14a7a7db7c60c2e1680ed70f806e2b8827

                                                                                SHA256

                                                                                a9d40d70aecc7dce2e0df58674f7fc52cf179a7f513b72ec247afaabdf3cad61

                                                                                SHA512

                                                                                a56504906643d8a24cd2624c271191b023116edbdad63269dda6b1156a1c3e4345528435fc0aa8e57c0e1b61b286167c465ca59a16848af871d127fb9e2f659c

                                                                              • C:\Users\Admin\AppData\Local\Temp\Z0hIbOJQ8t.bat

                                                                                Filesize

                                                                                210B

                                                                                MD5

                                                                                cb8edd48edaab26915dc0ad070457686

                                                                                SHA1

                                                                                d2e393e809aa340c253a35119577ac537e6e2f6a

                                                                                SHA256

                                                                                953a27e4782b952859f723554881ed607bbce9cad7fd8e8132a267394764db25

                                                                                SHA512

                                                                                7252468f199818e7c0f6c5273e67f642183ce58d089f9562b502ae50637992311fe85c545642dcf8ae25d1a0c7de724a55bc575a7e2d03f8e2217905a5f25ddf

                                                                              • C:\Users\Admin\AppData\Local\Temp\diBg3fIzhe.bat

                                                                                Filesize

                                                                                162B

                                                                                MD5

                                                                                4e941b5b7bc45677b11f886714c8448d

                                                                                SHA1

                                                                                8a52686b305cd9db7d5d24087d7de2dcf7fe3092

                                                                                SHA256

                                                                                0911befadb2e5a81d371eb32a5eb17e5c33c1a8951cdb874764b180877d623ec

                                                                                SHA512

                                                                                16f0718df52eb2f330baee646141fdd26ef43df09b10b4ce2678348fa3e2b7c7c3186e7272ba2133548bf635047fda0fc61963e19ce07a02dd3c278a32939055

                                                                              • C:\Users\Admin\AppData\Local\Temp\ex1oYQHqtZ.bat

                                                                                Filesize

                                                                                210B

                                                                                MD5

                                                                                83b08f9d07b8dd90c2e1cb79ff746849

                                                                                SHA1

                                                                                e217128831e5e102285ad77af9de9ce5fe846161

                                                                                SHA256

                                                                                1098e1bcb8f4c2943b40e4a2ff79801b300259728b641e08d361492450acc5c6

                                                                                SHA512

                                                                                202a42b111148f344faae2eaf99b828c4a6e36d223d46bdbb239de50d938301d99bf436238dc8db8a279ae9d0746d60ce2fae9172c983926551a6edb25a5764b

                                                                              • C:\Users\Admin\AppData\Local\Temp\m961u58njg.bat

                                                                                Filesize

                                                                                162B

                                                                                MD5

                                                                                ea770b6f908bd579e0f34b49b930746e

                                                                                SHA1

                                                                                1461d2489e03c937711be634e1099412aa2f2c14

                                                                                SHA256

                                                                                5fc3f43bd1a6a9e2894b0a0b7c5ffd1eeb3339c16911b5b104c4388bf2d1a2f3

                                                                                SHA512

                                                                                81b4402defe199d6c9eac0b3d044c75d24de7be88d295061d4fa3e7e5bea41364618fec98cf682ce6566d4ad352d9394e75384be41791119dc167fd3f3ac52fe

                                                                              • C:\Users\Admin\AppData\Local\Temp\rln2uypvqA.bat

                                                                                Filesize

                                                                                210B

                                                                                MD5

                                                                                fbadd1e3d2943c2c1e0f299537874fcd

                                                                                SHA1

                                                                                805cf4f497c9f30dc719c1f447ba0c467b594b62

                                                                                SHA256

                                                                                c2d0e1912eb2cdcd6cc5e3a9194b8e927ec0aa218a70ac6eb04d912de8bdfb46

                                                                                SHA512

                                                                                3604347f2465da28053076da569202d8f85d4912932adbe7ec4a8afae260d0cb55a68aebc6bd96625a2203f0a265ca4cc05311c41826bd302c66d0661a064f59

                                                                              • C:\Users\Admin\AppData\Local\Temp\szcAPjpm25.bat

                                                                                Filesize

                                                                                162B

                                                                                MD5

                                                                                f5bb2bca39e242c09ef71955a70dbb0e

                                                                                SHA1

                                                                                cc54789cf44cb0ff4bdaa925af609349e9f91a90

                                                                                SHA256

                                                                                dd28aad70193be32f8cf9695f7c70eccfd94cd7d10d8d5b1ae1f80f27c9cc102

                                                                                SHA512

                                                                                a1d9a34d06e4d1809000d7fdc40f5b1f16ced9dcc4917708299211179fa803a5f2e868baa0dcb9c7d8d628bd838e1f63e094a461fb302d84ad2fb1a7776391f7

                                                                              • C:\Users\Admin\AppData\Local\Temp\vTHQNFoTQv.bat

                                                                                Filesize

                                                                                162B

                                                                                MD5

                                                                                bcbeef8b30742ef0d1e8351ab9b5a43e

                                                                                SHA1

                                                                                4de30e779395f8ee94bcc590b0bc85a24549eb9b

                                                                                SHA256

                                                                                d978d687e612a625fca7d8a78c1e76237a6ec2e2639fd858de7858fe32a15fd8

                                                                                SHA512

                                                                                70079c33ae7395f2408a6538a44a796c5aad049f48bc0be1bcadadee28e3f869e68dbb4e52bc3a73e83f40176707bbd3938c47228cc0b7f898478a13f0a08398

                                                                              • memory/396-125-0x000000001B0F0000-0x000000001B199000-memory.dmp

                                                                                Filesize

                                                                                676KB

                                                                              • memory/1048-43-0x000000001BAF0000-0x000000001BB99000-memory.dmp

                                                                                Filesize

                                                                                676KB

                                                                              • memory/1252-143-0x000000001C010000-0x000000001C0B9000-memory.dmp

                                                                                Filesize

                                                                                676KB

                                                                              • memory/1468-53-0x000000001BC50000-0x000000001BCF9000-memory.dmp

                                                                                Filesize

                                                                                676KB

                                                                              • memory/1488-80-0x000000001B3D0000-0x000000001B479000-memory.dmp

                                                                                Filesize

                                                                                676KB

                                                                              • memory/1848-98-0x000000001B850000-0x000000001B8F9000-memory.dmp

                                                                                Filesize

                                                                                676KB

                                                                              • memory/1956-62-0x000000001B4B0000-0x000000001B559000-memory.dmp

                                                                                Filesize

                                                                                676KB

                                                                              • memory/2172-71-0x000000001BA20000-0x000000001BAC9000-memory.dmp

                                                                                Filesize

                                                                                676KB

                                                                              • memory/2280-170-0x000000001B300000-0x000000001B3A9000-memory.dmp

                                                                                Filesize

                                                                                676KB

                                                                              • memory/2776-116-0x000000001B990000-0x000000001BA39000-memory.dmp

                                                                                Filesize

                                                                                676KB

                                                                              • memory/3504-23-0x00007FFFEC4A0000-0x00007FFFECF61000-memory.dmp

                                                                                Filesize

                                                                                10.8MB

                                                                              • memory/3504-9-0x00007FFFEC4A0000-0x00007FFFECF61000-memory.dmp

                                                                                Filesize

                                                                                10.8MB

                                                                              • memory/3504-31-0x00007FFFEC4A0000-0x00007FFFECF61000-memory.dmp

                                                                                Filesize

                                                                                10.8MB

                                                                              • memory/3504-30-0x000000001C0A0000-0x000000001C149000-memory.dmp

                                                                                Filesize

                                                                                676KB

                                                                              • memory/3504-1-0x0000000000CF0000-0x0000000000E9E000-memory.dmp

                                                                                Filesize

                                                                                1.7MB

                                                                              • memory/3504-27-0x00007FFFEC4A0000-0x00007FFFECF61000-memory.dmp

                                                                                Filesize

                                                                                10.8MB

                                                                              • memory/3504-0-0x00007FFFEC4A3000-0x00007FFFEC4A5000-memory.dmp

                                                                                Filesize

                                                                                8KB

                                                                              • memory/3504-22-0x00007FFFEC4A0000-0x00007FFFECF61000-memory.dmp

                                                                                Filesize

                                                                                10.8MB

                                                                              • memory/3504-17-0x00007FFFEC4A0000-0x00007FFFECF61000-memory.dmp

                                                                                Filesize

                                                                                10.8MB

                                                                              • memory/3504-2-0x00007FFFEC4A0000-0x00007FFFECF61000-memory.dmp

                                                                                Filesize

                                                                                10.8MB

                                                                              • memory/3504-14-0x00007FFFEC4A0000-0x00007FFFECF61000-memory.dmp

                                                                                Filesize

                                                                                10.8MB

                                                                              • memory/3504-3-0x00007FFFEC4A0000-0x00007FFFECF61000-memory.dmp

                                                                                Filesize

                                                                                10.8MB

                                                                              • memory/3504-8-0x0000000003060000-0x000000000306E000-memory.dmp

                                                                                Filesize

                                                                                56KB

                                                                              • memory/3504-4-0x00007FFFEC4A0000-0x00007FFFECF61000-memory.dmp

                                                                                Filesize

                                                                                10.8MB

                                                                              • memory/3504-6-0x0000000003050000-0x000000000305E000-memory.dmp

                                                                                Filesize

                                                                                56KB

                                                                              • memory/3876-134-0x000000001B7B0000-0x000000001B859000-memory.dmp

                                                                                Filesize

                                                                                676KB

                                                                              • memory/3988-89-0x000000001BBF0000-0x000000001BC99000-memory.dmp

                                                                                Filesize

                                                                                676KB

                                                                              • memory/4044-161-0x000000001BDF0000-0x000000001BE99000-memory.dmp

                                                                                Filesize

                                                                                676KB

                                                                              • memory/4800-107-0x000000001BF00000-0x000000001BFA9000-memory.dmp

                                                                                Filesize

                                                                                676KB

                                                                              • memory/4816-152-0x000000001B9A0000-0x000000001BA49000-memory.dmp

                                                                                Filesize

                                                                                676KB

                                                                              • memory/5040-179-0x000000001B490000-0x000000001B539000-memory.dmp

                                                                                Filesize

                                                                                676KB