c0f57bfe8d8a19483cf6e2cbc7dd6bd0cbe15c60aec3ba13bf1da4ba76470c1b

Resubmissions

22-02-2025 04:36

250222-e77z2axpfy 10

22-02-2025 04:30

250222-e5b5ksymaj 10

22-02-2025 03:57

250222-eh157axrem 10

22-02-2025 03:49

250222-edlvpsxqgl 10

Analysis

max time kernel
251s
max time network
246s
platform
windows11-21h2_x64
resource
win11-20250217-en
resource tags

arch:x64arch:x86image:win11-20250217-enlocale:en-usos:windows11-21h2-x64system
submitted
22-02-2025 04:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

BootstrapperNew.exe
Size

534KB
MD5

64fdd7496eddeb222bea9a42fe6ed53d
SHA1

998dcd9b27a2120cc46f0e47d65d29af12944d27
SHA256

c0f57bfe8d8a19483cf6e2cbc7dd6bd0cbe15c60aec3ba13bf1da4ba76470c1b
SHA512

9e7c4401fb3e0cca134087a87b78ba9466182d9678eb6be356edbe52b5337e91dfdf3342b6671092e8215583d425cc696f608cd05d706673be499b928268fe27
SSDEEP

6144:Aa0ScUn4SkuC/Ee0lPYdue6VlWT8b9acd3YduIsan//fnss1OJb50D08I:AxfZ/9axPVle8kssX08I

Score

10^/10

persistence privilege_escalation

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\System32\\userinit.exe,C:\\Users\\Admin\\AppData\\Roaming\\System"	BootstrapperNew.exe

Event Triggered Execution: AppInit DLLs 1 TTPs
Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
persistence privilege_escalation

AppInit DLLs
T1546.010

Loads dropped DLL 64 IoCs

pid	Process
2528	Process not Found
3812	Process not Found
2988	Process not Found
3532	Process not Found
2576	WmiApSrv.exe
1828	Process not Found
2068	Process not Found
4020	Process not Found
2848	Process not Found
4652	Process not Found
3500	Process not Found
4980	Process not Found
1128	Process not Found
3520	Process not Found
3184	Process not Found
1476	Process not Found
4816	Process not Found
4564	Process not Found
224	Process not Found
4888	Process not Found
2152	Process not Found
712	Process not Found
2880	Process not Found
3840	Process not Found
4476	Process not Found
388	Process not Found
3124	Process not Found
4612	Process not Found
4452	Process not Found
3564	Process not Found
2712	Process not Found
3528	Process not Found
1004	Process not Found
2200	Process not Found
4472	Process not Found
4392	Process not Found
396	Process not Found
976	Process not Found
3132	Process not Found
3400	Process not Found
2152	Process not Found
956	Process not Found
4156	Process not Found
1188	Process not Found
5076	Process not Found
4020	BootstrapperNew.exe
2980	Process not Found
240	Process not Found
976	Process not Found
2808	WmiApSrv.exe
1384	Process not Found
1296	Process not Found
1440	Process not Found
2360	Process not Found
1080	Process not Found
452	Process not Found
3892	Process not Found
1388	Process not Found
4360	Process not Found
3856	Process not Found
1608	Process not Found
4564	Process not Found
4500	Process not Found
3048	Process not Found

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-112184765-1670301065-1210615588-1000\Software\Microsoft\Windows\CurrentVersion\Run\BootstrapperNew = "C:\\Users\\Admin\\AppData\\Roaming\\Windows"	BootstrapperNew.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\xdwd.dll	BootstrapperNew.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies data under HKEY_USERS 15 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4290799360"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365268"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "223"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292114432"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292114432"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365268"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1"	LogonUI.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = 99ebff004cc2ff000091f8000078d4000067c000003e9200001a6800f7630c00	LogonUI.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 64 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1996	schtasks.exe
2928	schtasks.exe
2912	schtasks.exe
5000	schtasks.exe
3644	schtasks.exe
432	schtasks.exe
4496	schtasks.exe
4044	schtasks.exe
3396	schtasks.exe
3984	schtasks.exe
4540	schtasks.exe
2608	schtasks.exe
4232	schtasks.exe
5056	schtasks.exe
2544	schtasks.exe
2152	schtasks.exe
2828	schtasks.exe
5096	schtasks.exe
1904	schtasks.exe
4416	schtasks.exe
3176	schtasks.exe
4908	schtasks.exe
1356	schtasks.exe
3796	schtasks.exe
4536	schtasks.exe
568	schtasks.exe
3680	schtasks.exe
5016	schtasks.exe
3152	schtasks.exe
2004	schtasks.exe
2856	schtasks.exe
3720	schtasks.exe
4880	schtasks.exe
2740	schtasks.exe
4176	schtasks.exe
1528	schtasks.exe
2468	schtasks.exe
4488	schtasks.exe
1120	schtasks.exe
2160	schtasks.exe
1640	schtasks.exe
3096	schtasks.exe
3620	schtasks.exe
2512	schtasks.exe
1356	schtasks.exe
4756	schtasks.exe
4888	schtasks.exe
4300	schtasks.exe
4912	schtasks.exe
3984	schtasks.exe
4448	schtasks.exe
3724	schtasks.exe
340	schtasks.exe
4120	schtasks.exe
760	schtasks.exe
4836	schtasks.exe
2712	schtasks.exe
644	schtasks.exe
1356	schtasks.exe
608	schtasks.exe
4728	schtasks.exe
4904	schtasks.exe
2212	schtasks.exe
2796	schtasks.exe

Suspicious behavior: EnumeratesProcesses 58 IoCs

pid	Process
5008	BootstrapperNew.exe
5008	BootstrapperNew.exe
5008	BootstrapperNew.exe
5008	BootstrapperNew.exe
5008	BootstrapperNew.exe
5008	BootstrapperNew.exe
5008	BootstrapperNew.exe
5008	BootstrapperNew.exe
5008	BootstrapperNew.exe
5008	BootstrapperNew.exe
5008	BootstrapperNew.exe
5008	BootstrapperNew.exe
5008	BootstrapperNew.exe
5008	BootstrapperNew.exe
5008	BootstrapperNew.exe
5008	BootstrapperNew.exe
5008	BootstrapperNew.exe
5008	BootstrapperNew.exe
5008	BootstrapperNew.exe
5008	BootstrapperNew.exe
5008	BootstrapperNew.exe
5008	BootstrapperNew.exe
5008	BootstrapperNew.exe
2576	WmiApSrv.exe
2576	WmiApSrv.exe
4020	BootstrapperNew.exe
4020	BootstrapperNew.exe
4020	BootstrapperNew.exe
4020	BootstrapperNew.exe
4020	BootstrapperNew.exe
4020	BootstrapperNew.exe
4020	BootstrapperNew.exe
4020	BootstrapperNew.exe
4020	BootstrapperNew.exe
4020	BootstrapperNew.exe
4020	BootstrapperNew.exe
4020	BootstrapperNew.exe
4020	BootstrapperNew.exe
4020	BootstrapperNew.exe
4020	BootstrapperNew.exe
4020	BootstrapperNew.exe
4020	BootstrapperNew.exe
4020	BootstrapperNew.exe
4020	BootstrapperNew.exe
4020	BootstrapperNew.exe
4020	BootstrapperNew.exe
4020	BootstrapperNew.exe
4020	BootstrapperNew.exe
4020	BootstrapperNew.exe
4020	BootstrapperNew.exe
4020	BootstrapperNew.exe
4020	BootstrapperNew.exe
2808	WmiApSrv.exe
2808	WmiApSrv.exe
4952	shutdown.exe
4952	shutdown.exe
2528	LogonUI.exe
2528	LogonUI.exe

Suspicious behavior: LoadsDriver 64 IoCs

pid	Process
3264	Process not Found
2608	Process not Found
388	Process not Found
1848	Process not Found
1236	Process not Found
4024	Process not Found
1356	Process not Found
1276	Process not Found
2664	Process not Found
4892	Process not Found
3520	Process not Found
2276	Process not Found
1052	Process not Found
2068	Process not Found
4856	Process not Found
3364	Process not Found
4080	Process not Found
3704	Process not Found
1444	Process not Found
4920	Process not Found
2116	Process not Found
3740	Process not Found
4940	Process not Found
5064	Process not Found
2028	Process not Found
2344	Process not Found
3904	Process not Found
852	Process not Found
700	Process not Found
1092	Process not Found
3436	Process not Found
4968	Process not Found
1796	Process not Found
3340	Process not Found
3024	Process not Found
4964	Process not Found
3492	Process not Found
5084	Process not Found
4812	Process not Found
2240	Process not Found
3736	Process not Found
1348	Process not Found
2592	Process not Found
3104	Process not Found
5116	Process not Found
3452	Process not Found
1600	Process not Found
3808	Process not Found
3252	Process not Found
3848	Process not Found
2896	Process not Found
1720	Process not Found
4540	Process not Found
3824	Process not Found
3948	Process not Found
2284	Process not Found
3448	Process not Found
484	Process not Found
228	Process not Found
4740	Process not Found
3096	Process not Found
1476	Process not Found
3464	Process not Found
2712	Process not Found

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	5008	BootstrapperNew.exe
Token: SeDebugPrivilege	4020	BootstrapperNew.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2528	LogonUI.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5008 wrote to memory of 1756	5008	BootstrapperNew.exe	82
PID 5008 wrote to memory of 1756	5008	BootstrapperNew.exe	82
PID 1756 wrote to memory of 3644	1756	CMD.exe	84
PID 1756 wrote to memory of 3644	1756	CMD.exe	84
PID 5008 wrote to memory of 4332	5008	BootstrapperNew.exe	85
PID 5008 wrote to memory of 4332	5008	BootstrapperNew.exe	85
PID 4332 wrote to memory of 2716	4332	CMD.exe	87
PID 4332 wrote to memory of 2716	4332	CMD.exe	87
PID 5008 wrote to memory of 868	5008	BootstrapperNew.exe	88
PID 5008 wrote to memory of 868	5008	BootstrapperNew.exe	88
PID 868 wrote to memory of 3176	868	CMD.exe	90
PID 868 wrote to memory of 3176	868	CMD.exe	90
PID 5008 wrote to memory of 4736	5008	BootstrapperNew.exe	93
PID 5008 wrote to memory of 4736	5008	BootstrapperNew.exe	93
PID 4736 wrote to memory of 3984	4736	CMD.exe	95
PID 4736 wrote to memory of 3984	4736	CMD.exe	95
PID 5008 wrote to memory of 4364	5008	BootstrapperNew.exe	98
PID 5008 wrote to memory of 4364	5008	BootstrapperNew.exe	98
PID 4364 wrote to memory of 1996	4364	CMD.exe	100
PID 4364 wrote to memory of 1996	4364	CMD.exe	100
PID 5008 wrote to memory of 4600	5008	BootstrapperNew.exe	101
PID 5008 wrote to memory of 4600	5008	BootstrapperNew.exe	101
PID 4600 wrote to memory of 2544	4600	CMD.exe	103
PID 4600 wrote to memory of 2544	4600	CMD.exe	103
PID 5008 wrote to memory of 4344	5008	BootstrapperNew.exe	104
PID 5008 wrote to memory of 4344	5008	BootstrapperNew.exe	104
PID 4344 wrote to memory of 4756	4344	CMD.exe	106
PID 4344 wrote to memory of 4756	4344	CMD.exe	106
PID 5008 wrote to memory of 3272	5008	BootstrapperNew.exe	107
PID 5008 wrote to memory of 3272	5008	BootstrapperNew.exe	107
PID 3272 wrote to memory of 432	3272	CMD.exe	109
PID 3272 wrote to memory of 432	3272	CMD.exe	109
PID 5008 wrote to memory of 4560	5008	BootstrapperNew.exe	110
PID 5008 wrote to memory of 4560	5008	BootstrapperNew.exe	110
PID 4560 wrote to memory of 4888	4560	CMD.exe	112
PID 4560 wrote to memory of 4888	4560	CMD.exe	112
PID 5008 wrote to memory of 2404	5008	BootstrapperNew.exe	113
PID 5008 wrote to memory of 2404	5008	BootstrapperNew.exe	113
PID 2404 wrote to memory of 2152	2404	CMD.exe	115
PID 2404 wrote to memory of 2152	2404	CMD.exe	115
PID 5008 wrote to memory of 2732	5008	BootstrapperNew.exe	116
PID 5008 wrote to memory of 2732	5008	BootstrapperNew.exe	116
PID 2732 wrote to memory of 2160	2732	CMD.exe	118
PID 2732 wrote to memory of 2160	2732	CMD.exe	118
PID 5008 wrote to memory of 852	5008	BootstrapperNew.exe	119
PID 5008 wrote to memory of 852	5008	BootstrapperNew.exe	119
PID 852 wrote to memory of 2212	852	CMD.exe	121
PID 852 wrote to memory of 2212	852	CMD.exe	121
PID 5008 wrote to memory of 1560	5008	BootstrapperNew.exe	122
PID 5008 wrote to memory of 1560	5008	BootstrapperNew.exe	122
PID 1560 wrote to memory of 2828	1560	CMD.exe	124
PID 1560 wrote to memory of 2828	1560	CMD.exe	124
PID 5008 wrote to memory of 2236	5008	BootstrapperNew.exe	125
PID 5008 wrote to memory of 2236	5008	BootstrapperNew.exe	125
PID 2236 wrote to memory of 1356	2236	CMD.exe	127
PID 2236 wrote to memory of 1356	2236	CMD.exe	127
PID 5008 wrote to memory of 2756	5008	BootstrapperNew.exe	128
PID 5008 wrote to memory of 2756	5008	BootstrapperNew.exe	128
PID 2756 wrote to memory of 1640	2756	CMD.exe	130
PID 2756 wrote to memory of 1640	2756	CMD.exe	130
PID 5008 wrote to memory of 1120	5008	BootstrapperNew.exe	131
PID 5008 wrote to memory of 1120	5008	BootstrapperNew.exe	131
PID 1120 wrote to memory of 3720	1120	CMD.exe	133
PID 1120 wrote to memory of 3720	1120	CMD.exe	133

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\BootstrapperNew.exe
"C:\Users\Admin\AppData\Local\Temp\BootstrapperNew.exe"
1⤵
- Modifies WinLogon for persistence
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5008
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /C SchTaSKs /CrEAte /F /sc OnLoGoN /rl HighEst /tn "Microsoft Publisher" /tr "C:\Users\Admin\AppData\Roaming\System" & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1756
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /CrEAte /F /sc OnLoGoN /rl HighEst /tn "Microsoft Publisher" /tr "C:\Users\Admin\AppData\Roaming\System"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3644
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "BootstrapperNew" /tr "C:\Users\Admin\AppData\Roaming\System" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4332
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "BootstrapperNew" /tr "C:\Users\Admin\AppData\Roaming\System" /RL HIGHEST
    3⤵
    PID:2716
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo 5 /tn "Camtasia" /tr "C:\Users\Admin\AppData\Roaming\Windows" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:868
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo 5 /tn "Camtasia" /tr "C:\Users\Admin\AppData\Roaming\Windows" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3176
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "BootstrapperNew" /tr "C:\Users\Admin\AppData\Roaming\System" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4736
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "BootstrapperNew" /tr "C:\Users\Admin\AppData\Roaming\System" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3984
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "BootstrapperNew" /tr "C:\Users\Admin\AppData\Roaming\System" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4364
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "BootstrapperNew" /tr "C:\Users\Admin\AppData\Roaming\System" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1996
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "BootstrapperNew" /tr "C:\Users\Admin\AppData\Roaming\System" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4600
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "BootstrapperNew" /tr "C:\Users\Admin\AppData\Roaming\System" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2544
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "BootstrapperNew" /tr "C:\Users\Admin\AppData\Roaming\System" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4344
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "BootstrapperNew" /tr "C:\Users\Admin\AppData\Roaming\System" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4756
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "BootstrapperNew" /tr "C:\Users\Admin\AppData\Roaming\System" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3272
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "BootstrapperNew" /tr "C:\Users\Admin\AppData\Roaming\System" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:432
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "BootstrapperNew" /tr "C:\Users\Admin\AppData\Roaming\System" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4560
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "BootstrapperNew" /tr "C:\Users\Admin\AppData\Roaming\System" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4888
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "BootstrapperNew" /tr "C:\Users\Admin\AppData\Roaming\System" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2404
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "BootstrapperNew" /tr "C:\Users\Admin\AppData\Roaming\System" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2152
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "BootstrapperNew" /tr "C:\Users\Admin\AppData\Roaming\System" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2732
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "BootstrapperNew" /tr "C:\Users\Admin\AppData\Roaming\System" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2160
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "BootstrapperNew" /tr "C:\Users\Admin\AppData\Roaming\System" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:852
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "BootstrapperNew" /tr "C:\Users\Admin\AppData\Roaming\System" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2212
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "BootstrapperNew" /tr "C:\Users\Admin\AppData\Roaming\System" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1560
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "BootstrapperNew" /tr "C:\Users\Admin\AppData\Roaming\System" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2828
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "BootstrapperNew" /tr "C:\Users\Admin\AppData\Roaming\System" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2236
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "BootstrapperNew" /tr "C:\Users\Admin\AppData\Roaming\System" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1356
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "BootstrapperNew" /tr "C:\Users\Admin\AppData\Roaming\System" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2756
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "BootstrapperNew" /tr "C:\Users\Admin\AppData\Roaming\System" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1640
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "BootstrapperNew" /tr "C:\Users\Admin\AppData\Roaming\System" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1120
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "BootstrapperNew" /tr "C:\Users\Admin\AppData\Roaming\System" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3720
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "BootstrapperNew" /tr "C:\Users\Admin\AppData\Roaming\System" /RL HIGHEST & exit
  2⤵
  PID:3400
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "BootstrapperNew" /tr "C:\Users\Admin\AppData\Roaming\System" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4300
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "BootstrapperNew" /tr "C:\Users\Admin\AppData\Roaming\System" /RL HIGHEST & exit
  2⤵
  PID:3348
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "BootstrapperNew" /tr "C:\Users\Admin\AppData\Roaming\System" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4912
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "BootstrapperNew" /tr "C:\Users\Admin\AppData\Roaming\System" /RL HIGHEST & exit
  2⤵
  PID:4696
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "BootstrapperNew" /tr "C:\Users\Admin\AppData\Roaming\System" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4908
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "BootstrapperNew" /tr "C:\Users\Admin\AppData\Roaming\System" /RL HIGHEST & exit
  2⤵
  PID:568
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "BootstrapperNew" /tr "C:\Users\Admin\AppData\Roaming\System" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2928
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "BootstrapperNew" /tr "C:\Users\Admin\AppData\Roaming\System" /RL HIGHEST & exit
  2⤵
  PID:3924
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "BootstrapperNew" /tr "C:\Users\Admin\AppData\Roaming\System" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3984
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "BootstrapperNew" /tr "C:\Users\Admin\AppData\Roaming\System" /RL HIGHEST & exit
  2⤵
  PID:1644
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "BootstrapperNew" /tr "C:\Users\Admin\AppData\Roaming\System" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3096
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "BootstrapperNew" /tr "C:\Users\Admin\AppData\Roaming\System" /RL HIGHEST & exit
  2⤵
  PID:1996
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "BootstrapperNew" /tr "C:\Users\Admin\AppData\Roaming\System" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1356
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "BootstrapperNew" /tr "C:\Users\Admin\AppData\Roaming\System" /RL HIGHEST & exit
  2⤵
  PID:1296
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "BootstrapperNew" /tr "C:\Users\Admin\AppData\Roaming\System" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4880
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "BootstrapperNew" /tr "C:\Users\Admin\AppData\Roaming\System" /RL HIGHEST & exit
  2⤵
  PID:3680
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "BootstrapperNew" /tr "C:\Users\Admin\AppData\Roaming\System" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2740
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "BootstrapperNew" /tr "C:\Users\Admin\AppData\Roaming\System" /RL HIGHEST & exit
  2⤵
  PID:948
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "BootstrapperNew" /tr "C:\Users\Admin\AppData\Roaming\System" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3796
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "BootstrapperNew" /tr "C:\Users\Admin\AppData\Roaming\System" /RL HIGHEST & exit
  2⤵
  PID:1392
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "BootstrapperNew" /tr "C:\Users\Admin\AppData\Roaming\System" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3620
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "BootstrapperNew" /tr "C:\Users\Admin\AppData\Roaming\System" /RL HIGHEST & exit
  2⤵
  PID:1104
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "BootstrapperNew" /tr "C:\Users\Admin\AppData\Roaming\System" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2796
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "BootstrapperNew" /tr "C:\Users\Admin\AppData\Roaming\System" /RL HIGHEST & exit
  2⤵
  PID:828
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "BootstrapperNew" /tr "C:\Users\Admin\AppData\Roaming\System" /RL HIGHEST
    3⤵
    PID:1192
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "BootstrapperNew" /tr "C:\Users\Admin\AppData\Roaming\System" /RL HIGHEST & exit
  2⤵
  PID:5056
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "BootstrapperNew" /tr "C:\Users\Admin\AppData\Roaming\System" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:608
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "BootstrapperNew" /tr "C:\Users\Admin\AppData\Roaming\System" /RL HIGHEST & exit
  2⤵
  PID:2060
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "BootstrapperNew" /tr "C:\Users\Admin\AppData\Roaming\System" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2512
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "BootstrapperNew" /tr "C:\Users\Admin\AppData\Roaming\System" /RL HIGHEST & exit
  2⤵
  PID:916
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "BootstrapperNew" /tr "C:\Users\Admin\AppData\Roaming\System" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4540
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "BootstrapperNew" /tr "C:\Users\Admin\AppData\Roaming\System" /RL HIGHEST & exit
  2⤵
  PID:1668
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "BootstrapperNew" /tr "C:\Users\Admin\AppData\Roaming\System" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4536
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "BootstrapperNew" /tr "C:\Users\Admin\AppData\Roaming\System" /RL HIGHEST & exit
  2⤵
  PID:2856
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "BootstrapperNew" /tr "C:\Users\Admin\AppData\Roaming\System" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5096
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "BootstrapperNew" /tr "C:\Users\Admin\AppData\Roaming\System" /RL HIGHEST & exit
  2⤵
  PID:3536
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "BootstrapperNew" /tr "C:\Users\Admin\AppData\Roaming\System" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4496
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "BootstrapperNew" /tr "C:\Users\Admin\AppData\Roaming\System" /RL HIGHEST & exit
  2⤵
  PID:752
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "BootstrapperNew" /tr "C:\Users\Admin\AppData\Roaming\System" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3152
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "BootstrapperNew" /tr "C:\Users\Admin\AppData\Roaming\System" /RL HIGHEST & exit
  2⤵
  PID:2120
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "BootstrapperNew" /tr "C:\Users\Admin\AppData\Roaming\System" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4044
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "BootstrapperNew" /tr "C:\Users\Admin\AppData\Roaming\System" /RL HIGHEST & exit
  2⤵
  PID:3404
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "BootstrapperNew" /tr "C:\Users\Admin\AppData\Roaming\System" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4120
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "BootstrapperNew" /tr "C:\Users\Admin\AppData\Roaming\System" /RL HIGHEST & exit
  2⤵
  PID:2288
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "BootstrapperNew" /tr "C:\Users\Admin\AppData\Roaming\System" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4176
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "BootstrapperNew" /tr "C:\Users\Admin\AppData\Roaming\System" /RL HIGHEST & exit
  2⤵
  PID:1460
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "BootstrapperNew" /tr "C:\Users\Admin\AppData\Roaming\System" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4448
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "BootstrapperNew" /tr "C:\Users\Admin\AppData\Roaming\System" /RL HIGHEST & exit
  2⤵
  PID:4072
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "BootstrapperNew" /tr "C:\Users\Admin\AppData\Roaming\System" /RL HIGHEST
    3⤵
    PID:2276
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "BootstrapperNew" /tr "C:\Users\Admin\AppData\Roaming\System" /RL HIGHEST & exit
  2⤵
  PID:3096
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "BootstrapperNew" /tr "C:\Users\Admin\AppData\Roaming\System" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1904
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "BootstrapperNew" /tr "C:\Users\Admin\AppData\Roaming\System" /RL HIGHEST & exit
  2⤵
  PID:1476
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "BootstrapperNew" /tr "C:\Users\Admin\AppData\Roaming\System" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5016
- C:\Users\Admin\AppData\Local\Temp\BootstrapperNew.exe
  "C:\Users\Admin\AppData\Local\Temp\BootstrapperNew.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4020
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "BootstrapperNew" /tr "C:\Users\Admin\AppData\Roaming\System" /RL HIGHEST & exit
    3⤵
    PID:1908
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "BootstrapperNew" /tr "C:\Users\Admin\AppData\Roaming\System" /RL HIGHEST
      4⤵
      PID:2740
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "BootstrapperNew" /tr "C:\Users\Admin\AppData\Roaming\System" /RL HIGHEST & exit
    3⤵
    PID:432
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "BootstrapperNew" /tr "C:\Users\Admin\AppData\Roaming\System" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:568
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "BootstrapperNew" /tr "C:\Users\Admin\AppData\Roaming\System" /RL HIGHEST & exit
    3⤵
    PID:1416
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "BootstrapperNew" /tr "C:\Users\Admin\AppData\Roaming\System" /RL HIGHEST
      4⤵
      PID:3776
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "BootstrapperNew" /tr "C:\Users\Admin\AppData\Roaming\System" /RL HIGHEST & exit
    3⤵
    PID:1392
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "BootstrapperNew" /tr "C:\Users\Admin\AppData\Roaming\System" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:1120
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "BootstrapperNew" /tr "C:\Users\Admin\AppData\Roaming\System" /RL HIGHEST & exit
    3⤵
    PID:4232
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "BootstrapperNew" /tr "C:\Users\Admin\AppData\Roaming\System" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:3724
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "BootstrapperNew" /tr "C:\Users\Admin\AppData\Roaming\System" /RL HIGHEST & exit
    3⤵
    PID:2836
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "BootstrapperNew" /tr "C:\Users\Admin\AppData\Roaming\System" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:2912
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "BootstrapperNew" /tr "C:\Users\Admin\AppData\Roaming\System" /RL HIGHEST & exit
    3⤵
    PID:2972
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "BootstrapperNew" /tr "C:\Users\Admin\AppData\Roaming\System" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:2004
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "BootstrapperNew" /tr "C:\Users\Admin\AppData\Roaming\System" /RL HIGHEST & exit
    3⤵
    PID:1192
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "BootstrapperNew" /tr "C:\Users\Admin\AppData\Roaming\System" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:340
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "BootstrapperNew" /tr "C:\Users\Admin\AppData\Roaming\System" /RL HIGHEST & exit
    3⤵
    PID:2852
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "BootstrapperNew" /tr "C:\Users\Admin\AppData\Roaming\System" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:760
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "BootstrapperNew" /tr "C:\Users\Admin\AppData\Roaming\System" /RL HIGHEST & exit
    3⤵
    PID:4220
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "BootstrapperNew" /tr "C:\Users\Admin\AppData\Roaming\System" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:1528
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "BootstrapperNew" /tr "C:\Users\Admin\AppData\Roaming\System" /RL HIGHEST & exit
    3⤵
    PID:4792
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "BootstrapperNew" /tr "C:\Users\Admin\AppData\Roaming\System" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:4904
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "BootstrapperNew" /tr "C:\Users\Admin\AppData\Roaming\System" /RL HIGHEST & exit
    3⤵
    PID:1588
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "BootstrapperNew" /tr "C:\Users\Admin\AppData\Roaming\System" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:4488
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "BootstrapperNew" /tr "C:\Users\Admin\AppData\Roaming\System" /RL HIGHEST & exit
    3⤵
    PID:2276
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "BootstrapperNew" /tr "C:\Users\Admin\AppData\Roaming\System" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:5056
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "BootstrapperNew" /tr "C:\Users\Admin\AppData\Roaming\System" /RL HIGHEST & exit
    3⤵
    PID:3520
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "BootstrapperNew" /tr "C:\Users\Admin\AppData\Roaming\System" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:5000
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "BootstrapperNew" /tr "C:\Users\Admin\AppData\Roaming\System" /RL HIGHEST & exit
    3⤵
    PID:1464
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "BootstrapperNew" /tr "C:\Users\Admin\AppData\Roaming\System" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:2608
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "BootstrapperNew" /tr "C:\Users\Admin\AppData\Roaming\System" /RL HIGHEST & exit
    3⤵
    PID:736
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "BootstrapperNew" /tr "C:\Users\Admin\AppData\Roaming\System" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:1356
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "BootstrapperNew" /tr "C:\Users\Admin\AppData\Roaming\System" /RL HIGHEST & exit
    3⤵
    PID:3000
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "BootstrapperNew" /tr "C:\Users\Admin\AppData\Roaming\System" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:4836
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "BootstrapperNew" /tr "C:\Users\Admin\AppData\Roaming\System" /RL HIGHEST & exit
    3⤵
    PID:2532
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "BootstrapperNew" /tr "C:\Users\Admin\AppData\Roaming\System" /RL HIGHEST
      4⤵
      PID:5016
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "BootstrapperNew" /tr "C:\Users\Admin\AppData\Roaming\System" /RL HIGHEST & exit
    3⤵
    PID:1720
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "BootstrapperNew" /tr "C:\Users\Admin\AppData\Roaming\System" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:4416
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "BootstrapperNew" /tr "C:\Users\Admin\AppData\Roaming\System" /RL HIGHEST & exit
    3⤵
    PID:660
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "BootstrapperNew" /tr "C:\Users\Admin\AppData\Roaming\System" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:2712
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "BootstrapperNew" /tr "C:\Users\Admin\AppData\Roaming\System" /RL HIGHEST & exit
    3⤵
    PID:3576
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "BootstrapperNew" /tr "C:\Users\Admin\AppData\Roaming\System" /RL HIGHEST
      4⤵
      PID:3156
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "BootstrapperNew" /tr "C:\Users\Admin\AppData\Roaming\System" /RL HIGHEST & exit
    3⤵
    PID:1360
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "BootstrapperNew" /tr "C:\Users\Admin\AppData\Roaming\System" /RL HIGHEST
      4⤵
      PID:4816
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "BootstrapperNew" /tr "C:\Users\Admin\AppData\Roaming\System" /RL HIGHEST & exit
    3⤵
    PID:768
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "BootstrapperNew" /tr "C:\Users\Admin\AppData\Roaming\System" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:4728
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "BootstrapperNew" /tr "C:\Users\Admin\AppData\Roaming\System" /RL HIGHEST & exit
    3⤵
    PID:2932
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "BootstrapperNew" /tr "C:\Users\Admin\AppData\Roaming\System" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:2856
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "BootstrapperNew" /tr "C:\Users\Admin\AppData\Roaming\System" /RL HIGHEST & exit
    3⤵
    PID:244
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "BootstrapperNew" /tr "C:\Users\Admin\AppData\Roaming\System" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:3396
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "BootstrapperNew" /tr "C:\Users\Admin\AppData\Roaming\System" /RL HIGHEST & exit
    3⤵
    PID:1924
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "BootstrapperNew" /tr "C:\Users\Admin\AppData\Roaming\System" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:3680
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "BootstrapperNew" /tr "C:\Users\Admin\AppData\Roaming\System" /RL HIGHEST & exit
    3⤵
    PID:1120
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "BootstrapperNew" /tr "C:\Users\Admin\AppData\Roaming\System" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:644
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "BootstrapperNew" /tr "C:\Users\Admin\AppData\Roaming\System" /RL HIGHEST & exit
    3⤵
    PID:4552
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "BootstrapperNew" /tr "C:\Users\Admin\AppData\Roaming\System" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:2468
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "BootstrapperNew" /tr "C:\Users\Admin\AppData\Roaming\System" /RL HIGHEST & exit
    3⤵
    PID:2912
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "BootstrapperNew" /tr "C:\Users\Admin\AppData\Roaming\System" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:4232
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c Shutdown /l /f
    3⤵
    PID:1412
  - - C:\Windows\system32\shutdown.exe
      Shutdown /l /f
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:4952

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:2576

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:2808

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa399e855 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2528

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\BootstrapperNew.exe.log

Filesize
1KB

MD5
512fc3c393f1d1c113289b495eb4f046

SHA1
46c2dd550181ea3a6277f9ef350dbdab9c3cc8a8

SHA256
0137623e9ee9ef3e4a4027e060d57e864de9f94c913bf95db6a70424798ab7d8

SHA512
da8cfc62db861e3b17162cb9d072c4dd8b690d6c284c4bda06043858531adfc5c3448c84e955576b1ddf9fd93858589d90afa335d8d77568dad17dca93d3bd74

Download Submit
C:\Users\Admin\AppData\Local\Temp\Admin.bmp

Filesize
588KB

MD5
908fa2dfb385771ecf5f8b2b3e7bff16

SHA1
1255fa1edbd2dbbcab6d9eb9f74b7d6783697a58

SHA256
60ff5131dba68a8ffe7ba0475bf3e192b432e1969e5ac52d7f217f6935f4035d

SHA512
573c9fde441fb8debaa44b6fa2d3763c3dc4714497089b82bedc8ef0720eea4a907f75cffb1c0ec4a77ac89cfecbef8e6182a2a8fea5b51a2e91920ceaad5f69

Download Submit
C:\Windows\xdwd.dll

Filesize
136KB

MD5
16e5a492c9c6ae34c59683be9c51fa31

SHA1
97031b41f5c56f371c28ae0d62a2df7d585adaba

SHA256
35c8d022e1d917f1aabdceae98097ccc072161b302f84c768ca63e4b32ac2b66

SHA512
20fd369172ef5e3e2fde388666b42e8fe5f0c2bfa338c0345f45e98af6561a249ba3ecc48c3f16efcc73f02ecb67b3ddb1e2e8f0e77d18fa00ac34e6379e50b6

Download Submit
memory/4020-1159-0x0000000002F90000-0x0000000002F98000-memory.dmp

Filesize
32KB

Download
memory/4020-1158-0x0000000002F10000-0x0000000002F1A000-memory.dmp

Filesize
40KB

Download
memory/4020-1156-0x0000000002E80000-0x0000000002E8A000-memory.dmp

Filesize
40KB

Download
memory/4020-1147-0x0000000002E70000-0x0000000002E82000-memory.dmp

Filesize
72KB

Download
memory/5008-95-0x000000001D390000-0x000000001D406000-memory.dmp

Filesize
472KB

Download
memory/5008-97-0x000000001B620000-0x000000001B63E000-memory.dmp

Filesize
120KB

Download
memory/5008-180-0x0000000002690000-0x00000000026A2000-memory.dmp

Filesize
72KB

Download
memory/5008-479-0x000000001BC10000-0x000000001BD72000-memory.dmp

Filesize
1.4MB

Download
memory/5008-831-0x00000000026A0000-0x00000000026AA000-memory.dmp

Filesize
40KB

Download
memory/5008-1021-0x000000001B640000-0x000000001B64A000-memory.dmp

Filesize
40KB

Download
memory/5008-1132-0x000000001B860000-0x000000001B86C000-memory.dmp

Filesize
48KB

Download
memory/5008-125-0x00007FF875D10000-0x00007FF8767D2000-memory.dmp

Filesize
10.8MB

Download
memory/5008-96-0x0000000002570000-0x000000000257C000-memory.dmp

Filesize
48KB

Download
memory/5008-1139-0x00007FF875D10000-0x00007FF8767D2000-memory.dmp

Filesize
10.8MB

Download
memory/5008-0-0x00007FF875D13000-0x00007FF875D15000-memory.dmp

Filesize
8KB

Download
memory/5008-35-0x00007FF875D10000-0x00007FF8767D2000-memory.dmp

Filesize
10.8MB

Download
memory/5008-2-0x00007FF875D13000-0x00007FF875D15000-memory.dmp

Filesize
8KB

Download
memory/5008-1-0x00000000003A0000-0x000000000042A000-memory.dmp

Filesize
552KB

Download