Analysis

  • max time kernel
    148s
  • max time network
    151s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    22/03/2025, 06:09

General

  • Target

    34655ac11b4f6a8d6f1ea8e2fbbe0676.exe

  • Size

    1.9MB

  • MD5

    34655ac11b4f6a8d6f1ea8e2fbbe0676

  • SHA1

    d17ed388047ec77145ef4c96e3760ea94985caa7

  • SHA256

    75b2e0c469d7b50ea3a5f022b84db475f4009e17265ead71e5a68a9a90a44688

  • SHA512

    2c2bf7b06e1a6ddfc2bbfe21a9c1a21cea9a33015ad62837dd1dee81e8a096b951c1dae3f3a95ae052f014e563b040da9d3ee9c96565116933603a99ab9e61e2

  • SSDEEP

    24576:Uz4T3bMX0/0ZqSEaa3OVFu8VQTo8Ia29MSVyAXmFPf87ptY60/YYhdbh7JRj:UOMX0/08SVYTcxMXPxthD

Malware Config

Signatures

  • Process spawned unexpected child process 48 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • UAC bypass 3 TTPs 18 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 17 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

  • Drops file in Drivers directory 1 IoCs
  • Executes dropped EXE 5 IoCs
  • Checks whether UAC is enabled 1 TTPs 12 IoCs
  • Drops file in System32 directory 5 IoCs
  • Drops file in Program Files directory 35 IoCs
  • Drops file in Windows directory 10 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Scheduled Task/Job: Scheduled Task 1 TTPs 48 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 31 IoCs
  • Suspicious use of AdjustPrivilegeToken 23 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 18 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\34655ac11b4f6a8d6f1ea8e2fbbe0676.exe
    "C:\Users\Admin\AppData\Local\Temp\34655ac11b4f6a8d6f1ea8e2fbbe0676.exe"
    1⤵
    • UAC bypass
    • Drops file in Drivers directory
    • Checks whether UAC is enabled
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    • System policy modification
    PID:1992
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\34655ac11b4f6a8d6f1ea8e2fbbe0676.exe'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2000
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\1b8b1de2-69f6-11ef-9774-62cb582c238c\Idle.exe'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2412
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\Setup\State\OSPPSVC.exe'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2668
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Defender\es-ES\sppsvc.exe'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2884
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\System32\Dism\de-DE\dllhost.exe'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1708
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Photo Viewer\wininit.exe'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1736
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\PCHEALTH\spoolsv.exe'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2868
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Mozilla Firefox\uninstall\dwm.exe'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2068
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\1b8b1de2-69f6-11ef-9774-62cb582c238c\audiodg.exe'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2112
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\System.exe'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2240
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows Mail\en-US\WmiPrvSE.exe'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2972
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default\csrss.exe'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1300
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\smss.exe'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1488
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Microsoft Sync Framework\v1.0\Runtime\smss.exe'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1100
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows Journal\fr-FR\lsm.exe'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1088
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\10\Resources\1033\Idle.exe'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1244
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:\MSOCache\All Users\{90140000-0117-0409-0000-0000000FF1CE}-C\Access.en-us\lsm.exe'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:380
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\9f8anxKmvk.bat"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:588
      • C:\Windows\system32\w32tm.exe
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        3⤵
          PID:2432
        • C:\Program Files (x86)\Microsoft Sync Framework\v1.0\Runtime\smss.exe
          "C:\Program Files (x86)\Microsoft Sync Framework\v1.0\Runtime\smss.exe"
          3⤵
          • UAC bypass
          • Executes dropped EXE
          • Checks whether UAC is enabled
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          • System policy modification
          PID:2852
          • C:\Windows\System32\WScript.exe
            "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\5fd467f2-f981-4ce5-9c15-eb0131f457c7.vbs"
            4⤵
              PID:1048
              • C:\Program Files (x86)\Microsoft Sync Framework\v1.0\Runtime\smss.exe
                "C:\Program Files (x86)\Microsoft Sync Framework\v1.0\Runtime\smss.exe"
                5⤵
                • UAC bypass
                • Executes dropped EXE
                • Checks whether UAC is enabled
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                • System policy modification
                PID:2844
                • C:\Windows\System32\WScript.exe
                  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\32838046-f68e-403c-9c19-ab406fc5bd35.vbs"
                  6⤵
                    PID:2232
                    • C:\Program Files (x86)\Microsoft Sync Framework\v1.0\Runtime\smss.exe
                      "C:\Program Files (x86)\Microsoft Sync Framework\v1.0\Runtime\smss.exe"
                      7⤵
                      • UAC bypass
                      • Executes dropped EXE
                      • Checks whether UAC is enabled
                      • Suspicious behavior: EnumeratesProcesses
                      • Suspicious use of AdjustPrivilegeToken
                      • System policy modification
                      PID:2792
                      • C:\Windows\System32\WScript.exe
                        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\f1143a31-c3d8-449d-ad76-add433efd2a0.vbs"
                        8⤵
                          PID:3020
                          • C:\Program Files (x86)\Microsoft Sync Framework\v1.0\Runtime\smss.exe
                            "C:\Program Files (x86)\Microsoft Sync Framework\v1.0\Runtime\smss.exe"
                            9⤵
                            • UAC bypass
                            • Executes dropped EXE
                            • Checks whether UAC is enabled
                            • Suspicious behavior: EnumeratesProcesses
                            • Suspicious use of AdjustPrivilegeToken
                            • System policy modification
                            PID:2740
                            • C:\Windows\System32\WScript.exe
                              "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\84095836-1ded-4829-b4ac-735a41042d56.vbs"
                              10⤵
                                PID:880
                                • C:\Program Files (x86)\Microsoft Sync Framework\v1.0\Runtime\smss.exe
                                  "C:\Program Files (x86)\Microsoft Sync Framework\v1.0\Runtime\smss.exe"
                                  11⤵
                                  • UAC bypass
                                  • Executes dropped EXE
                                  • Checks whether UAC is enabled
                                  • Suspicious behavior: EnumeratesProcesses
                                  • Suspicious use of AdjustPrivilegeToken
                                  • System policy modification
                                  PID:984
                                  • C:\Windows\System32\WScript.exe
                                    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\81f23ab7-d5b7-4b7e-81da-9a358b2d6bd2.vbs"
                                    12⤵
                                      PID:1676
                                    • C:\Windows\System32\WScript.exe
                                      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\b29f6732-02de-4821-806e-5ce451fa7864.vbs"
                                      12⤵
                                        PID:2628
                                  • C:\Windows\System32\WScript.exe
                                    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\94e014af-1444-4c6a-9792-0e38410f7ee8.vbs"
                                    10⤵
                                      PID:2476
                                • C:\Windows\System32\WScript.exe
                                  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\833ea6be-0b2b-4c5f-a8e7-372c4e3aeb59.vbs"
                                  8⤵
                                    PID:1108
                              • C:\Windows\System32\WScript.exe
                                "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\b0eb7e2a-106f-4989-b450-4cf2126e6a6c.vbs"
                                6⤵
                                  PID:2120
                            • C:\Windows\System32\WScript.exe
                              "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\55f2e66b-aeef-4289-b7b1-73f26c383428.vbs"
                              4⤵
                                PID:932
                        • C:\Windows\system32\schtasks.exe
                          schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 5 /tr "'C:\Recovery\1b8b1de2-69f6-11ef-9774-62cb582c238c\Idle.exe'" /f
                          1⤵
                          • Process spawned unexpected child process
                          • Scheduled Task/Job: Scheduled Task
                          PID:2704
                        • C:\Windows\system32\schtasks.exe
                          schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Recovery\1b8b1de2-69f6-11ef-9774-62cb582c238c\Idle.exe'" /rl HIGHEST /f
                          1⤵
                          • Process spawned unexpected child process
                          • Scheduled Task/Job: Scheduled Task
                          PID:2852
                        • C:\Windows\system32\schtasks.exe
                          schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 11 /tr "'C:\Recovery\1b8b1de2-69f6-11ef-9774-62cb582c238c\Idle.exe'" /rl HIGHEST /f
                          1⤵
                          • Process spawned unexpected child process
                          • Scheduled Task/Job: Scheduled Task
                          PID:2640
                        • C:\Windows\system32\schtasks.exe
                          schtasks.exe /create /tn "OSPPSVCO" /sc MINUTE /mo 8 /tr "'C:\Windows\Setup\State\OSPPSVC.exe'" /f
                          1⤵
                          • Process spawned unexpected child process
                          • Scheduled Task/Job: Scheduled Task
                          PID:2716
                        • C:\Windows\system32\schtasks.exe
                          schtasks.exe /create /tn "OSPPSVC" /sc ONLOGON /tr "'C:\Windows\Setup\State\OSPPSVC.exe'" /rl HIGHEST /f
                          1⤵
                          • Process spawned unexpected child process
                          • Scheduled Task/Job: Scheduled Task
                          PID:2620
                        • C:\Windows\system32\schtasks.exe
                          schtasks.exe /create /tn "OSPPSVCO" /sc MINUTE /mo 11 /tr "'C:\Windows\Setup\State\OSPPSVC.exe'" /rl HIGHEST /f
                          1⤵
                          • Process spawned unexpected child process
                          • Scheduled Task/Job: Scheduled Task
                          PID:1996
                        • C:\Windows\system32\schtasks.exe
                          schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Windows Defender\es-ES\sppsvc.exe'" /f
                          1⤵
                          • Process spawned unexpected child process
                          • Scheduled Task/Job: Scheduled Task
                          PID:2424
                        • C:\Windows\system32\schtasks.exe
                          schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Defender\es-ES\sppsvc.exe'" /rl HIGHEST /f
                          1⤵
                          • Process spawned unexpected child process
                          • Scheduled Task/Job: Scheduled Task
                          PID:2316
                        • C:\Windows\system32\schtasks.exe
                          schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Windows Defender\es-ES\sppsvc.exe'" /rl HIGHEST /f
                          1⤵
                          • Process spawned unexpected child process
                          • Scheduled Task/Job: Scheduled Task
                          PID:1496
                        • C:\Windows\system32\schtasks.exe
                          schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 8 /tr "'C:\Windows\System32\Dism\de-DE\dllhost.exe'" /f
                          1⤵
                          • Process spawned unexpected child process
                          • Scheduled Task/Job: Scheduled Task
                          PID:2240
                        • C:\Windows\system32\schtasks.exe
                          schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Windows\System32\Dism\de-DE\dllhost.exe'" /rl HIGHEST /f
                          1⤵
                          • Process spawned unexpected child process
                          • Scheduled Task/Job: Scheduled Task
                          PID:2128
                        • C:\Windows\system32\schtasks.exe
                          schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 10 /tr "'C:\Windows\System32\Dism\de-DE\dllhost.exe'" /rl HIGHEST /f
                          1⤵
                          • Process spawned unexpected child process
                          • Scheduled Task/Job: Scheduled Task
                          PID:2340
                        • C:\Windows\system32\schtasks.exe
                          schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Windows Photo Viewer\wininit.exe'" /f
                          1⤵
                          • Process spawned unexpected child process
                          • Scheduled Task/Job: Scheduled Task
                          PID:1984
                        • C:\Windows\system32\schtasks.exe
                          schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Photo Viewer\wininit.exe'" /rl HIGHEST /f
                          1⤵
                          • Process spawned unexpected child process
                          • Scheduled Task/Job: Scheduled Task
                          PID:2864
                        • C:\Windows\system32\schtasks.exe
                          schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Windows Photo Viewer\wininit.exe'" /rl HIGHEST /f
                          1⤵
                          • Process spawned unexpected child process
                          • Scheduled Task/Job: Scheduled Task
                          PID:2660
                        • C:\Windows\system32\schtasks.exe
                          schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 13 /tr "'C:\Windows\PCHEALTH\spoolsv.exe'" /f
                          1⤵
                          • Process spawned unexpected child process
                          • Scheduled Task/Job: Scheduled Task
                          PID:2972
                        • C:\Windows\system32\schtasks.exe
                          schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Windows\PCHEALTH\spoolsv.exe'" /rl HIGHEST /f
                          1⤵
                          • Process spawned unexpected child process
                          • Scheduled Task/Job: Scheduled Task
                          PID:2868
                        • C:\Windows\system32\schtasks.exe
                          schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 10 /tr "'C:\Windows\PCHEALTH\spoolsv.exe'" /rl HIGHEST /f
                          1⤵
                          • Process spawned unexpected child process
                          • Scheduled Task/Job: Scheduled Task
                          PID:2056
                        • C:\Windows\system32\schtasks.exe
                          schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 14 /tr "'C:\Program Files\Mozilla Firefox\uninstall\dwm.exe'" /f
                          1⤵
                          • Process spawned unexpected child process
                          • Scheduled Task/Job: Scheduled Task
                          PID:396
                        • C:\Windows\system32\schtasks.exe
                          schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Program Files\Mozilla Firefox\uninstall\dwm.exe'" /rl HIGHEST /f
                          1⤵
                          • Process spawned unexpected child process
                          • Scheduled Task/Job: Scheduled Task
                          PID:1784
                        • C:\Windows\system32\schtasks.exe
                          schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 9 /tr "'C:\Program Files\Mozilla Firefox\uninstall\dwm.exe'" /rl HIGHEST /f
                          1⤵
                          • Process spawned unexpected child process
                          • Scheduled Task/Job: Scheduled Task
                          PID:1940
                        • C:\Windows\system32\schtasks.exe
                          schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 11 /tr "'C:\Recovery\1b8b1de2-69f6-11ef-9774-62cb582c238c\audiodg.exe'" /f
                          1⤵
                          • Process spawned unexpected child process
                          • Scheduled Task/Job: Scheduled Task
                          PID:768
                        • C:\Windows\system32\schtasks.exe
                          schtasks.exe /create /tn "audiodg" /sc ONLOGON /tr "'C:\Recovery\1b8b1de2-69f6-11ef-9774-62cb582c238c\audiodg.exe'" /rl HIGHEST /f
                          1⤵
                          • Process spawned unexpected child process
                          • Scheduled Task/Job: Scheduled Task
                          PID:1168
                        • C:\Windows\system32\schtasks.exe
                          schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 14 /tr "'C:\Recovery\1b8b1de2-69f6-11ef-9774-62cb582c238c\audiodg.exe'" /rl HIGHEST /f
                          1⤵
                          • Process spawned unexpected child process
                          • Scheduled Task/Job: Scheduled Task
                          PID:1172
                        • C:\Windows\system32\schtasks.exe
                          schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 8 /tr "'C:\Users\Admin\System.exe'" /f
                          1⤵
                          • Process spawned unexpected child process
                          • Scheduled Task/Job: Scheduled Task
                          PID:380
                        • C:\Windows\system32\schtasks.exe
                          schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Users\Admin\System.exe'" /rl HIGHEST /f
                          1⤵
                          • Process spawned unexpected child process
                          • Scheduled Task/Job: Scheduled Task
                          PID:2296
                        • C:\Windows\system32\schtasks.exe
                          schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 11 /tr "'C:\Users\Admin\System.exe'" /rl HIGHEST /f
                          1⤵
                          • Process spawned unexpected child process
                          • Scheduled Task/Job: Scheduled Task
                          PID:3048
                        • C:\Windows\system32\schtasks.exe
                          schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 6 /tr "'C:\Program Files\Windows Mail\en-US\WmiPrvSE.exe'" /f
                          1⤵
                          • Process spawned unexpected child process
                          • Scheduled Task/Job: Scheduled Task
                          PID:2492
                        • C:\Windows\system32\schtasks.exe
                          schtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\Program Files\Windows Mail\en-US\WmiPrvSE.exe'" /rl HIGHEST /f
                          1⤵
                          • Process spawned unexpected child process
                          • Scheduled Task/Job: Scheduled Task
                          PID:2580
                        • C:\Windows\system32\schtasks.exe
                          schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 8 /tr "'C:\Program Files\Windows Mail\en-US\WmiPrvSE.exe'" /rl HIGHEST /f
                          1⤵
                          • Process spawned unexpected child process
                          • Scheduled Task/Job: Scheduled Task
                          PID:2008
                        • C:\Windows\system32\schtasks.exe
                          schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 5 /tr "'C:\Users\Default\csrss.exe'" /f
                          1⤵
                          • Process spawned unexpected child process
                          • Scheduled Task/Job: Scheduled Task
                          PID:448
                        • C:\Windows\system32\schtasks.exe
                          schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Users\Default\csrss.exe'" /rl HIGHEST /f
                          1⤵
                          • Process spawned unexpected child process
                          • Scheduled Task/Job: Scheduled Task
                          PID:804
                        • C:\Windows\system32\schtasks.exe
                          schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 10 /tr "'C:\Users\Default\csrss.exe'" /rl HIGHEST /f
                          1⤵
                          • Process spawned unexpected child process
                          • Scheduled Task/Job: Scheduled Task
                          PID:2260
                        • C:\Windows\system32\schtasks.exe
                          schtasks.exe /create /tn "smsss" /sc MINUTE /mo 11 /tr "'C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\smss.exe'" /f
                          1⤵
                          • Process spawned unexpected child process
                          • Scheduled Task/Job: Scheduled Task
                          PID:952
                        • C:\Windows\system32\schtasks.exe
                          schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\smss.exe'" /rl HIGHEST /f
                          1⤵
                          • Process spawned unexpected child process
                          • Scheduled Task/Job: Scheduled Task
                          PID:1756
                        • C:\Windows\system32\schtasks.exe
                          schtasks.exe /create /tn "smsss" /sc MINUTE /mo 14 /tr "'C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\smss.exe'" /rl HIGHEST /f
                          1⤵
                          • Process spawned unexpected child process
                          • Scheduled Task/Job: Scheduled Task
                          PID:1100
                        • C:\Windows\system32\schtasks.exe
                          schtasks.exe /create /tn "smsss" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Microsoft Sync Framework\v1.0\Runtime\smss.exe'" /f
                          1⤵
                          • Process spawned unexpected child process
                          • Scheduled Task/Job: Scheduled Task
                          PID:1376
                        • C:\Windows\system32\schtasks.exe
                          schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft Sync Framework\v1.0\Runtime\smss.exe'" /rl HIGHEST /f
                          1⤵
                          • Process spawned unexpected child process
                          • Scheduled Task/Job: Scheduled Task
                          PID:1352
                        • C:\Windows\system32\schtasks.exe
                          schtasks.exe /create /tn "smsss" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Microsoft Sync Framework\v1.0\Runtime\smss.exe'" /rl HIGHEST /f
                          1⤵
                          • Process spawned unexpected child process
                          • Scheduled Task/Job: Scheduled Task
                          PID:1664
                        • C:\Windows\system32\schtasks.exe
                          schtasks.exe /create /tn "lsml" /sc MINUTE /mo 12 /tr "'C:\Program Files\Windows Journal\fr-FR\lsm.exe'" /f
                          1⤵
                          • Process spawned unexpected child process
                          • Scheduled Task/Job: Scheduled Task
                          PID:1536
                        • C:\Windows\system32\schtasks.exe
                          schtasks.exe /create /tn "lsm" /sc ONLOGON /tr "'C:\Program Files\Windows Journal\fr-FR\lsm.exe'" /rl HIGHEST /f
                          1⤵
                          • Process spawned unexpected child process
                          • Scheduled Task/Job: Scheduled Task
                          PID:2468
                        • C:\Windows\system32\schtasks.exe
                          schtasks.exe /create /tn "lsml" /sc MINUTE /mo 8 /tr "'C:\Program Files\Windows Journal\fr-FR\lsm.exe'" /rl HIGHEST /f
                          1⤵
                          • Process spawned unexpected child process
                          • Scheduled Task/Job: Scheduled Task
                          PID:1720
                        • C:\Windows\system32\schtasks.exe
                          schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\10\Resources\1033\Idle.exe'" /f
                          1⤵
                          • Process spawned unexpected child process
                          • Scheduled Task/Job: Scheduled Task
                          PID:2288
                        • C:\Windows\system32\schtasks.exe
                          schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\10\Resources\1033\Idle.exe'" /rl HIGHEST /f
                          1⤵
                          • Process spawned unexpected child process
                          • Scheduled Task/Job: Scheduled Task
                          PID:1836
                        • C:\Windows\system32\schtasks.exe
                          schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\10\Resources\1033\Idle.exe'" /rl HIGHEST /f
                          1⤵
                          • Process spawned unexpected child process
                          • Scheduled Task/Job: Scheduled Task
                          PID:1484
                        • C:\Windows\system32\schtasks.exe
                          schtasks.exe /create /tn "lsml" /sc MINUTE /mo 9 /tr "'C:\MSOCache\All Users\{90140000-0117-0409-0000-0000000FF1CE}-C\Access.en-us\lsm.exe'" /f
                          1⤵
                          • Process spawned unexpected child process
                          • Scheduled Task/Job: Scheduled Task
                          PID:2052
                        • C:\Windows\system32\schtasks.exe
                          schtasks.exe /create /tn "lsm" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0117-0409-0000-0000000FF1CE}-C\Access.en-us\lsm.exe'" /rl HIGHEST /f
                          1⤵
                          • Process spawned unexpected child process
                          • Scheduled Task/Job: Scheduled Task
                          PID:2528
                        • C:\Windows\system32\schtasks.exe
                          schtasks.exe /create /tn "lsml" /sc MINUTE /mo 14 /tr "'C:\MSOCache\All Users\{90140000-0117-0409-0000-0000000FF1CE}-C\Access.en-us\lsm.exe'" /rl HIGHEST /f
                          1⤵
                          • Process spawned unexpected child process
                          • Scheduled Task/Job: Scheduled Task
                          PID:1284
                        • C:\Windows\system32\wbem\WMIADAP.EXE
                          wmiadap.exe /F /T /R
                          1⤵
                            PID:2668

                          Network

                          MITRE ATT&CK Enterprise v15

                          Replay Monitor

                          Loading Replay Monitor...

                          Downloads

                          • C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\smss.exe

                            Filesize

                            1.9MB

                            MD5

                            836d115e976cf83437fe82ffd0221704

                            SHA1

                            7d9c0f16e35d6aae140e1715574a8f1206fece9a

                            SHA256

                            5d662f5b7246d3ed1d83c72b61ce3571ee397a794e5e7ab750dc5f053bba2797

                            SHA512

                            6d2640c048617a75801e030b9bd052734f6d50b9ccddfa7fbec9fc58a05e466e616b61e6a2f18e83ea60ac641ac4b1d00870aa1f89b46c7cfdb66a1328166ae1

                          • C:\MSOCache\All Users\{90140000-0117-0409-0000-0000000FF1CE}-C\Access.en-us\lsm.exe

                            Filesize

                            1.9MB

                            MD5

                            d382e2ceee4076193ead47f4a01d53ef

                            SHA1

                            16c21711fbf7a18cf9fafc6d3a3c9b3393f954ba

                            SHA256

                            7b307770d6b67b7419c19145f83f1993a20bef940705f913ed39140fb6da75a0

                            SHA512

                            c1b926840026432c0c583b57ffa4d0563f7fe647cbb4eb4ddcc8264820727bc8c22edb0d9458786fcbe717ad8b578880a985ab4f356254d9c6ac9072f134bd8b

                          • C:\Program Files (x86)\Windows Defender\es-ES\sppsvc.exe

                            Filesize

                            1.9MB

                            MD5

                            3d4b4a96fe5c0b7d0d52187d8a4f1f55

                            SHA1

                            797a802c640822ac6edb9e324552810474c25bf1

                            SHA256

                            5919ae73fafabc164e510a8c781ad695439899d2257e025bd40d2da9689f8fa8

                            SHA512

                            ecfdd204946da07f067b242f3d72920dbebea44d6cb24c3ae2e819d49f1b2dd720ec3d6c33d516dcf6c4d016e8962669bc2a5889cc496ba5bdc009ad1f90cf68

                          • C:\Program Files (x86)\Windows Photo Viewer\wininit.exe

                            Filesize

                            1.9MB

                            MD5

                            34655ac11b4f6a8d6f1ea8e2fbbe0676

                            SHA1

                            d17ed388047ec77145ef4c96e3760ea94985caa7

                            SHA256

                            75b2e0c469d7b50ea3a5f022b84db475f4009e17265ead71e5a68a9a90a44688

                            SHA512

                            2c2bf7b06e1a6ddfc2bbfe21a9c1a21cea9a33015ad62837dd1dee81e8a096b951c1dae3f3a95ae052f014e563b040da9d3ee9c96565116933603a99ab9e61e2

                          • C:\Users\Admin\AppData\Local\Temp\32838046-f68e-403c-9c19-ab406fc5bd35.vbs

                            Filesize

                            745B

                            MD5

                            398a2ce4adf48eabcb71dfff6ca850a8

                            SHA1

                            bcec9686e316df52af47e9ff4fc73c7e54e87be6

                            SHA256

                            04c0b98d93f1cfd4579fb1714970cc12004895d490b900ef5ba79b6aa3869d5c

                            SHA512

                            122beb090d61d9aa55af8ef916cbd1d3362f3c7c9211d000a772aabee14b803bef2d3c7624954d37e7dcd29c925912d3460f34efb06a7a685b4c55d29ab41b94

                          • C:\Users\Admin\AppData\Local\Temp\55f2e66b-aeef-4289-b7b1-73f26c383428.vbs

                            Filesize

                            521B

                            MD5

                            537d0a7c3410b6e5e1968093a5166824

                            SHA1

                            4ed7586eb548bcd5b67b46ba817e064c40e4356f

                            SHA256

                            08070c4ead8cdd8b8e1e086560b762215214cb8d08f91caabef5699ef126243a

                            SHA512

                            ea3817b8fd167b3ea8b4fde83f27b927128c0e7b1500678b8e9e4ef3660434233e71273b159a3fffa0bbbd59ed9758e1f3c841045137669a894998580d427dc5

                          • C:\Users\Admin\AppData\Local\Temp\5fd467f2-f981-4ce5-9c15-eb0131f457c7.vbs

                            Filesize

                            745B

                            MD5

                            2632e921e4420808f70e5ce511f00145

                            SHA1

                            c57abae35778dc325672dd4fc4c9b809f51a459f

                            SHA256

                            ea34ac05e73c656c2c555eed38da04b465890d253e1edaa18d80af72b5ec8942

                            SHA512

                            ef9bc5fa5e4cd1b4cb221c5d7277560fe4c7cc390fdfb7307cbdfa90ed128fae40d867a81a0379b1701a2d9f89ba39567dab99b0e7f57b5f363437bf2be27f78

                          • C:\Users\Admin\AppData\Local\Temp\81f23ab7-d5b7-4b7e-81da-9a358b2d6bd2.vbs

                            Filesize

                            744B

                            MD5

                            5028270313a4d8ee3778b5a19e29c996

                            SHA1

                            458cf14b301e40b1b0c80ec5a371cc61ca6e69fc

                            SHA256

                            8255cf4c16cc8e3352680a2041b06fd290f390f27da03b06336bd6d1de39494c

                            SHA512

                            b7ed317aece91a9d6d49d806af0e5843f806335f11dee4d2286a7e3b3ea43ccf57e961dedf3e438c54183614b0a349bfcf94492a256efe061057fca8b3fab6f5

                          • C:\Users\Admin\AppData\Local\Temp\84095836-1ded-4829-b4ac-735a41042d56.vbs

                            Filesize

                            745B

                            MD5

                            c01ee1f5ad3f33a9a2ab74f13fcb8c5c

                            SHA1

                            301a3cafa1518f9e7e1b0ef223f41366e5bd83a6

                            SHA256

                            967cb556862c5149dd8c823704cc1e9debb933918badf12422b3a5801d80a7a7

                            SHA512

                            ec90a0811c93d4791649bd02e337438a3c3c1846335e633677877c76767e4e31901f5caf768c41581924a523c0d5313b9041f063ed2f8d652039276cd6c1d218

                          • C:\Users\Admin\AppData\Local\Temp\9f8anxKmvk.bat

                            Filesize

                            234B

                            MD5

                            19e23ec8ba819b7af7776067b7a5047b

                            SHA1

                            cf8471f71a11e408ad42e18b7f967e2f73ddd250

                            SHA256

                            8dd8a2f239b1ee263d3f5ec1a4d5f395d5f93c264d97a07d357430724388003b

                            SHA512

                            5f1c33eef7b431ed622c9ee601789abf3077fe124d5d902c95a3a220afe7a62b11b654fc82591fcb0ca0ad7881c01bc1065b54edccc22f1d3c536df670f012c6

                          • C:\Users\Admin\AppData\Local\Temp\f1143a31-c3d8-449d-ad76-add433efd2a0.vbs

                            Filesize

                            745B

                            MD5

                            cbdf0aeb2fd0e27ad93cc5e33ae28477

                            SHA1

                            67f2f5b79af69972f2d3e769945efe1b393a2e9d

                            SHA256

                            c2b2d9ba4f7f5eea11bfcf4816d0cba59d955f5f20f80538e13c1275afb24dd1

                            SHA512

                            5ef7079667611d2fcf8a347fb2dd871577efe632d3dc40aa9265e3e094117fa068096d0001fa8bb64e590a648e562c63d2162b08ccb267fd56c949b56582894e

                          • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

                            Filesize

                            7KB

                            MD5

                            36df36f738fe4b7112c9c0c92b5f5707

                            SHA1

                            99e38392937e09d4c204505e5d58f9e0b3d9b3d6

                            SHA256

                            58c4776ab9d730bda31124288df69358065861b61eabcdfc98e2ce809a3ebd3e

                            SHA512

                            07bb1d25126f019b958bf64ae333e5b66d37c4a4d2bfd496eca9fd1425cf0a205bb75ed52c1aeeb4ccf8300e7f65e24baac20d14e4d070cc07e1f31b88cce4d4

                          • memory/380-276-0x000000001B750000-0x000000001BA32000-memory.dmp

                            Filesize

                            2.9MB

                          • memory/380-277-0x0000000001E70000-0x0000000001E78000-memory.dmp

                            Filesize

                            32KB

                          • memory/1992-207-0x000007FEF57F3000-0x000007FEF57F4000-memory.dmp

                            Filesize

                            4KB

                          • memory/1992-331-0x000007FEF57F0000-0x000007FEF61DC000-memory.dmp

                            Filesize

                            9.9MB

                          • memory/1992-9-0x00000000004B0000-0x00000000004BC000-memory.dmp

                            Filesize

                            48KB

                          • memory/1992-6-0x0000000000480000-0x0000000000496000-memory.dmp

                            Filesize

                            88KB

                          • memory/1992-4-0x0000000000370000-0x0000000000378000-memory.dmp

                            Filesize

                            32KB

                          • memory/1992-3-0x0000000000350000-0x000000000036C000-memory.dmp

                            Filesize

                            112KB

                          • memory/1992-5-0x0000000000380000-0x0000000000390000-memory.dmp

                            Filesize

                            64KB

                          • memory/1992-2-0x000007FEF57F0000-0x000007FEF61DC000-memory.dmp

                            Filesize

                            9.9MB

                          • memory/1992-13-0x0000000000560000-0x000000000056C000-memory.dmp

                            Filesize

                            48KB

                          • memory/1992-1-0x0000000001270000-0x000000000145A000-memory.dmp

                            Filesize

                            1.9MB

                          • memory/1992-15-0x0000000000B80000-0x0000000000B8E000-memory.dmp

                            Filesize

                            56KB

                          • memory/1992-16-0x0000000000B90000-0x0000000000B98000-memory.dmp

                            Filesize

                            32KB

                          • memory/1992-231-0x000007FEF57F0000-0x000007FEF61DC000-memory.dmp

                            Filesize

                            9.9MB

                          • memory/1992-10-0x0000000000520000-0x0000000000528000-memory.dmp

                            Filesize

                            32KB

                          • memory/1992-0-0x000007FEF57F3000-0x000007FEF57F4000-memory.dmp

                            Filesize

                            4KB

                          • memory/1992-7-0x00000000004A0000-0x00000000004AA000-memory.dmp

                            Filesize

                            40KB

                          • memory/1992-8-0x00000000004D0000-0x0000000000526000-memory.dmp

                            Filesize

                            344KB

                          • memory/1992-12-0x0000000000530000-0x0000000000542000-memory.dmp

                            Filesize

                            72KB

                          • memory/1992-17-0x0000000000BA0000-0x0000000000BAC000-memory.dmp

                            Filesize

                            48KB

                          • memory/1992-18-0x0000000000BB0000-0x0000000000BBC000-memory.dmp

                            Filesize

                            48KB

                          • memory/1992-14-0x0000000000B70000-0x0000000000B7A000-memory.dmp

                            Filesize

                            40KB

                          • memory/2740-374-0x0000000000620000-0x0000000000632000-memory.dmp

                            Filesize

                            72KB

                          • memory/2844-351-0x0000000001240000-0x000000000142A000-memory.dmp

                            Filesize

                            1.9MB

                          • memory/2852-339-0x0000000002080000-0x00000000020D6000-memory.dmp

                            Filesize

                            344KB

                          • memory/2852-340-0x0000000000660000-0x0000000000672000-memory.dmp

                            Filesize

                            72KB

                          • memory/2852-338-0x00000000000E0000-0x00000000002CA000-memory.dmp

                            Filesize

                            1.9MB