c36199992b094393c6ad3905dde59a5a484e82648c2ab0aaacc85ee2264c68aa

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20250314-en
resource tags

arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system
submitted
31/03/2025, 15:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

123123123123212132.exe
Size

377KB
MD5

ecdd3ea3b8a4f725f9062ab8858ecca7
SHA1

239fc6d7ad2be57d0d67c5dd827a21776acdfae5
SHA256

c36199992b094393c6ad3905dde59a5a484e82648c2ab0aaacc85ee2264c68aa
SHA512

3a2242492ba9c53f49d3ba9033b37744f8bd7e1b5fe7948ab136a50b07663f9b1d1df86b77eb25ac892faa271570ae560cb4d40d7323166faac4acdde7eda443
SSDEEP

6144:pH2dNCgWu23+ppotfme6VlWT8b9IKxeMlr/y01bae6Szm/X:JCxPppguPVle8IMle0ke6+A

Score

10^/10

persistence privilege_escalation

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\System32\\userinit.exe,C:\\Windows\\Sage 50.exe"	123123123123212132.exe

Event Triggered Execution: AppInit DLLs 1 TTPs
Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
persistence privilege_escalation

AppInit DLLs
T1546.010

Loads dropped DLL 43 IoCs

pid	Process
2280	Process not Found
3920	Process not Found
4328	Process not Found
3944	Process not Found
3372	Process not Found
2640	Process not Found
4432	Process not Found
1252	Process not Found
5988	Process not Found
2532	Process not Found
60	Process not Found
3684	Process not Found
1384	Process not Found
4108	Process not Found
3776	Process not Found
4824	Process not Found
5416	Process not Found
4912	Process not Found
4596	Process not Found
3872	Process not Found
2368	Process not Found
1020	Process not Found
1600	Process not Found
4112	Process not Found
2116	Process not Found
1472	Process not Found
5392	Process not Found
392	Process not Found
4344	Process not Found
2932	Process not Found
4492	Process not Found
4740	Process not Found
5116	Process not Found
4976	Process not Found
4060	Process not Found
3200	Process not Found
6020	Process not Found
4356	Process not Found
3868	Process not Found
5372	Process not Found
3636	Process not Found
3152	Process not Found
4372	Process not Found

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-814918696-1585701690-3140955116-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Bootstrapper = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Autodesk AutoCAD Update.exe"	123123123123212132.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
36	pastebin.com
37	pastebin.com

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\Sage 50.exe	123123123123212132.exe
File opened for modification	C:\Windows\Sage 50.exe	123123123123212132.exe
File created	C:\Windows\xdwd.dll	123123123123212132.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 42 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2096	schtasks.exe
2196	schtasks.exe
4988	schtasks.exe
972	schtasks.exe
4108	schtasks.exe
4896	schtasks.exe
2172	schtasks.exe
404	schtasks.exe
2096	schtasks.exe
3948	schtasks.exe
952	schtasks.exe
6048	schtasks.exe
1312	schtasks.exe
3352	schtasks.exe
4352	schtasks.exe
5024	schtasks.exe
6096	schtasks.exe
4184	schtasks.exe
3976	schtasks.exe
3408	schtasks.exe
4612	schtasks.exe
4220	schtasks.exe
2312	schtasks.exe
3976	schtasks.exe
3084	schtasks.exe
3468	schtasks.exe
5364	schtasks.exe
1364	schtasks.exe
5212	schtasks.exe
1924	schtasks.exe
2672	schtasks.exe
3108	schtasks.exe
1472	schtasks.exe
1496	schtasks.exe
2192	schtasks.exe
4720	schtasks.exe
4768	schtasks.exe
5348	schtasks.exe
1756	schtasks.exe
2600	schtasks.exe
6120	schtasks.exe
4052	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1812	123123123123212132.exe
1812	123123123123212132.exe
1812	123123123123212132.exe
1812	123123123123212132.exe
1812	123123123123212132.exe
1812	123123123123212132.exe
1812	123123123123212132.exe
1812	123123123123212132.exe
1812	123123123123212132.exe
1812	123123123123212132.exe
1812	123123123123212132.exe
1812	123123123123212132.exe
1812	123123123123212132.exe
1812	123123123123212132.exe
1812	123123123123212132.exe
1812	123123123123212132.exe
1812	123123123123212132.exe
1812	123123123123212132.exe
1812	123123123123212132.exe
1812	123123123123212132.exe
1812	123123123123212132.exe
1812	123123123123212132.exe
1812	123123123123212132.exe
1812	123123123123212132.exe
1812	123123123123212132.exe
1812	123123123123212132.exe
1812	123123123123212132.exe
1812	123123123123212132.exe
1812	123123123123212132.exe
1812	123123123123212132.exe
1812	123123123123212132.exe
1812	123123123123212132.exe
1812	123123123123212132.exe
1812	123123123123212132.exe
1812	123123123123212132.exe
1812	123123123123212132.exe
1812	123123123123212132.exe
1812	123123123123212132.exe
1812	123123123123212132.exe
1812	123123123123212132.exe
1812	123123123123212132.exe
1812	123123123123212132.exe
1812	123123123123212132.exe
1812	123123123123212132.exe
1812	123123123123212132.exe
1812	123123123123212132.exe
1812	123123123123212132.exe
1812	123123123123212132.exe
1812	123123123123212132.exe
1812	123123123123212132.exe
1812	123123123123212132.exe
1812	123123123123212132.exe
1812	123123123123212132.exe
1812	123123123123212132.exe
1812	123123123123212132.exe
1812	123123123123212132.exe
1812	123123123123212132.exe
1812	123123123123212132.exe
1812	123123123123212132.exe
1812	123123123123212132.exe
1812	123123123123212132.exe
1812	123123123123212132.exe
1812	123123123123212132.exe
1812	123123123123212132.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1812	123123123123212132.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1812 wrote to memory of 5588	1812	123123123123212132.exe	96
PID 1812 wrote to memory of 5588	1812	123123123123212132.exe	96
PID 5588 wrote to memory of 6120	5588	CMD.exe	98
PID 5588 wrote to memory of 6120	5588	CMD.exe	98
PID 1812 wrote to memory of 5024	1812	123123123123212132.exe	99
PID 1812 wrote to memory of 5024	1812	123123123123212132.exe	99
PID 5024 wrote to memory of 4052	5024	CMD.exe	101
PID 5024 wrote to memory of 4052	5024	CMD.exe	101
PID 1812 wrote to memory of 3416	1812	123123123123212132.exe	102
PID 1812 wrote to memory of 3416	1812	123123123123212132.exe	102
PID 3416 wrote to memory of 3976	3416	CMD.exe	106
PID 3416 wrote to memory of 3976	3416	CMD.exe	106
PID 1812 wrote to memory of 920	1812	123123123123212132.exe	107
PID 1812 wrote to memory of 920	1812	123123123123212132.exe	107
PID 920 wrote to memory of 3352	920	CMD.exe	109
PID 920 wrote to memory of 3352	920	CMD.exe	109
PID 1812 wrote to memory of 1120	1812	123123123123212132.exe	110
PID 1812 wrote to memory of 1120	1812	123123123123212132.exe	110
PID 1120 wrote to memory of 4352	1120	CMD.exe	112
PID 1120 wrote to memory of 4352	1120	CMD.exe	112
PID 1812 wrote to memory of 3776	1812	123123123123212132.exe	113
PID 1812 wrote to memory of 3776	1812	123123123123212132.exe	113
PID 3776 wrote to memory of 1472	3776	CMD.exe	115
PID 3776 wrote to memory of 1472	3776	CMD.exe	115
PID 1812 wrote to memory of 2464	1812	123123123123212132.exe	116
PID 1812 wrote to memory of 2464	1812	123123123123212132.exe	116
PID 2464 wrote to memory of 1496	2464	CMD.exe	118
PID 2464 wrote to memory of 1496	2464	CMD.exe	118
PID 1812 wrote to memory of 1212	1812	123123123123212132.exe	119
PID 1812 wrote to memory of 1212	1812	123123123123212132.exe	119
PID 1212 wrote to memory of 2172	1212	CMD.exe	121
PID 1212 wrote to memory of 2172	1212	CMD.exe	121
PID 1812 wrote to memory of 4600	1812	123123123123212132.exe	126
PID 1812 wrote to memory of 4600	1812	123123123123212132.exe	126
PID 4600 wrote to memory of 2096	4600	CMD.exe	128
PID 4600 wrote to memory of 2096	4600	CMD.exe	128
PID 1812 wrote to memory of 6104	1812	123123123123212132.exe	134
PID 1812 wrote to memory of 6104	1812	123123123123212132.exe	134
PID 6104 wrote to memory of 5024	6104	CMD.exe	136
PID 6104 wrote to memory of 5024	6104	CMD.exe	136
PID 1812 wrote to memory of 1924	1812	123123123123212132.exe	137
PID 1812 wrote to memory of 1924	1812	123123123123212132.exe	137
PID 1924 wrote to memory of 3084	1924	CMD.exe	139
PID 1924 wrote to memory of 3084	1924	CMD.exe	139
PID 1812 wrote to memory of 2568	1812	123123123123212132.exe	140
PID 1812 wrote to memory of 2568	1812	123123123123212132.exe	140
PID 2568 wrote to memory of 1364	2568	CMD.exe	142
PID 2568 wrote to memory of 1364	2568	CMD.exe	142
PID 1812 wrote to memory of 1668	1812	123123123123212132.exe	143
PID 1812 wrote to memory of 1668	1812	123123123123212132.exe	143
PID 1668 wrote to memory of 6096	1668	CMD.exe	145
PID 1668 wrote to memory of 6096	1668	CMD.exe	145
PID 1812 wrote to memory of 2560	1812	123123123123212132.exe	146
PID 1812 wrote to memory of 2560	1812	123123123123212132.exe	146
PID 2560 wrote to memory of 3468	2560	CMD.exe	148
PID 2560 wrote to memory of 3468	2560	CMD.exe	148
PID 1812 wrote to memory of 3232	1812	123123123123212132.exe	149
PID 1812 wrote to memory of 3232	1812	123123123123212132.exe	149
PID 3232 wrote to memory of 4184	3232	CMD.exe	151
PID 3232 wrote to memory of 4184	3232	CMD.exe	151
PID 1812 wrote to memory of 2172	1812	123123123123212132.exe	152
PID 1812 wrote to memory of 2172	1812	123123123123212132.exe	152
PID 2172 wrote to memory of 404	2172	CMD.exe	154
PID 2172 wrote to memory of 404	2172	CMD.exe	154

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\123123123123212132.exe
"C:\Users\Admin\AppData\Local\Temp\123123123123212132.exe"
1⤵
- Modifies WinLogon for persistence
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1812
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /C SchTaSKs /CrEAte /F /sc OnLoGoN /rl HighEst /tn "Luna Cheat" /tr "C:\Windows\Sage 50.exe" & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5588
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /CrEAte /F /sc OnLoGoN /rl HighEst /tn "Luna Cheat" /tr "C:\Windows\Sage 50.exe"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:6120
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Access Update" /tr "C:\Windows\Sage 50.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5024
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Access Update" /tr "C:\Windows\Sage 50.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4052
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo 5 /tn "Microsoft PowerPoint Host" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\Autodesk AutoCAD Update.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3416
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo 5 /tn "Microsoft PowerPoint Host" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\Autodesk AutoCAD Update.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3976
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Access Update" /tr "C:\Windows\Sage 50.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:920
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Access Update" /tr "C:\Windows\Sage 50.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3352
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Access Update" /tr "C:\Windows\Sage 50.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1120
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Access Update" /tr "C:\Windows\Sage 50.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4352
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Access Update" /tr "C:\Windows\Sage 50.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3776
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Access Update" /tr "C:\Windows\Sage 50.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1472
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Access Update" /tr "C:\Windows\Sage 50.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2464
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Access Update" /tr "C:\Windows\Sage 50.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1496
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Access Update" /tr "C:\Windows\Sage 50.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1212
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Access Update" /tr "C:\Windows\Sage 50.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2172
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Access Update" /tr "C:\Windows\Sage 50.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4600
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Access Update" /tr "C:\Windows\Sage 50.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2096
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Access Update" /tr "C:\Windows\Sage 50.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:6104
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Access Update" /tr "C:\Windows\Sage 50.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5024
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Access Update" /tr "C:\Windows\Sage 50.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1924
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Access Update" /tr "C:\Windows\Sage 50.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3084
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Access Update" /tr "C:\Windows\Sage 50.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2568
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Access Update" /tr "C:\Windows\Sage 50.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1364
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Access Update" /tr "C:\Windows\Sage 50.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1668
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Access Update" /tr "C:\Windows\Sage 50.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:6096
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Access Update" /tr "C:\Windows\Sage 50.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2560
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Access Update" /tr "C:\Windows\Sage 50.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3468
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Access Update" /tr "C:\Windows\Sage 50.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3232
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Access Update" /tr "C:\Windows\Sage 50.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4184
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Access Update" /tr "C:\Windows\Sage 50.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2172
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Access Update" /tr "C:\Windows\Sage 50.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:404
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Access Update" /tr "C:\Windows\Sage 50.exe" /RL HIGHEST & exit
  2⤵
  PID:4340
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Access Update" /tr "C:\Windows\Sage 50.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5212
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Access Update" /tr "C:\Windows\Sage 50.exe" /RL HIGHEST & exit
  2⤵
  PID:4556
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Access Update" /tr "C:\Windows\Sage 50.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2096
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Access Update" /tr "C:\Windows\Sage 50.exe" /RL HIGHEST & exit
  2⤵
  PID:4368
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Access Update" /tr "C:\Windows\Sage 50.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2196
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Access Update" /tr "C:\Windows\Sage 50.exe" /RL HIGHEST & exit
  2⤵
  PID:5088
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Access Update" /tr "C:\Windows\Sage 50.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5364
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Access Update" /tr "C:\Windows\Sage 50.exe" /RL HIGHEST & exit
  2⤵
  PID:4060
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Access Update" /tr "C:\Windows\Sage 50.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4220
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Access Update" /tr "C:\Windows\Sage 50.exe" /RL HIGHEST & exit
  2⤵
  PID:1488
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Access Update" /tr "C:\Windows\Sage 50.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1924
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Access Update" /tr "C:\Windows\Sage 50.exe" /RL HIGHEST & exit
  2⤵
  PID:5984
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Access Update" /tr "C:\Windows\Sage 50.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4896
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Access Update" /tr "C:\Windows\Sage 50.exe" /RL HIGHEST & exit
  2⤵
  PID:4808
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Access Update" /tr "C:\Windows\Sage 50.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:952
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Access Update" /tr "C:\Windows\Sage 50.exe" /RL HIGHEST & exit
  2⤵
  PID:5368
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Access Update" /tr "C:\Windows\Sage 50.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2312
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Access Update" /tr "C:\Windows\Sage 50.exe" /RL HIGHEST & exit
  2⤵
  PID:1680
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Access Update" /tr "C:\Windows\Sage 50.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2192
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Access Update" /tr "C:\Windows\Sage 50.exe" /RL HIGHEST & exit
  2⤵
  PID:4140
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Access Update" /tr "C:\Windows\Sage 50.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:6048
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Access Update" /tr "C:\Windows\Sage 50.exe" /RL HIGHEST & exit
  2⤵
  PID:4320
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Access Update" /tr "C:\Windows\Sage 50.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1312
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Access Update" /tr "C:\Windows\Sage 50.exe" /RL HIGHEST & exit
  2⤵
  PID:5244
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Access Update" /tr "C:\Windows\Sage 50.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4720
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Access Update" /tr "C:\Windows\Sage 50.exe" /RL HIGHEST & exit
  2⤵
  PID:1564
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Access Update" /tr "C:\Windows\Sage 50.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4768
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Access Update" /tr "C:\Windows\Sage 50.exe" /RL HIGHEST & exit
  2⤵
  PID:3652
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Access Update" /tr "C:\Windows\Sage 50.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4988
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Access Update" /tr "C:\Windows\Sage 50.exe" /RL HIGHEST & exit
  2⤵
  PID:4580
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Access Update" /tr "C:\Windows\Sage 50.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5348
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Access Update" /tr "C:\Windows\Sage 50.exe" /RL HIGHEST & exit
  2⤵
  PID:6080
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Access Update" /tr "C:\Windows\Sage 50.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3948
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Access Update" /tr "C:\Windows\Sage 50.exe" /RL HIGHEST & exit
  2⤵
  PID:4380
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Access Update" /tr "C:\Windows\Sage 50.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3976
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Access Update" /tr "C:\Windows\Sage 50.exe" /RL HIGHEST & exit
  2⤵
  PID:876
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Access Update" /tr "C:\Windows\Sage 50.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2672
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Access Update" /tr "C:\Windows\Sage 50.exe" /RL HIGHEST & exit
  2⤵
  PID:5320
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Access Update" /tr "C:\Windows\Sage 50.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:972
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Access Update" /tr "C:\Windows\Sage 50.exe" /RL HIGHEST & exit
  2⤵
  PID:1120
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Access Update" /tr "C:\Windows\Sage 50.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4108
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Access Update" /tr "C:\Windows\Sage 50.exe" /RL HIGHEST & exit
  2⤵
  PID:1048
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Access Update" /tr "C:\Windows\Sage 50.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1756
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Access Update" /tr "C:\Windows\Sage 50.exe" /RL HIGHEST & exit
  2⤵
  PID:1536
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Access Update" /tr "C:\Windows\Sage 50.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2600
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Access Update" /tr "C:\Windows\Sage 50.exe" /RL HIGHEST & exit
  2⤵
  PID:4836
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Access Update" /tr "C:\Windows\Sage 50.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3408
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Access Update" /tr "C:\Windows\Sage 50.exe" /RL HIGHEST & exit
  2⤵
  PID:2860
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Access Update" /tr "C:\Windows\Sage 50.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3108
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Access Update" /tr "C:\Windows\Sage 50.exe" /RL HIGHEST & exit
  2⤵
  PID:2984
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Access Update" /tr "C:\Windows\Sage 50.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4612

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\Autodesk AutoCAD Update.exe
1⤵
PID:2416

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\xdwd.dll

Filesize
136KB

MD5
16e5a492c9c6ae34c59683be9c51fa31

SHA1
97031b41f5c56f371c28ae0d62a2df7d585adaba

SHA256
35c8d022e1d917f1aabdceae98097ccc072161b302f84c768ca63e4b32ac2b66

SHA512
20fd369172ef5e3e2fde388666b42e8fe5f0c2bfa338c0345f45e98af6561a249ba3ecc48c3f16efcc73f02ecb67b3ddb1e2e8f0e77d18fa00ac34e6379e50b6

Download Submit
memory/1812-0-0x00007FF982133000-0x00007FF982135000-memory.dmp

Filesize
8KB

Download
memory/1812-1-0x00000000002D0000-0x0000000000334000-memory.dmp

Filesize
400KB

Download
memory/1812-2-0x00007FF982133000-0x00007FF982135000-memory.dmp

Filesize
8KB

Download
memory/1812-25-0x00007FF982130000-0x00007FF982BF1000-memory.dmp

Filesize
10.8MB

Download
memory/1812-134-0x00007FF982130000-0x00007FF982BF1000-memory.dmp

Filesize
10.8MB

Download