Overview

overview

10

Static

static

10

f5ae5532f1...b5.exe

windows10-2004-x64

10

f5cb51ffdb...c0.exe

windows10-2004-x64

10

f5ed127464...bc.exe

windows10-2004-x64

10

f62837f3bc...7a.exe

windows10-2004-x64

10

f628fa20e8...3b.exe

windows10-2004-x64

10

f640f01e80...c5.exe

windows10-2004-x64

f66fa3036e...07.exe

windows10-2004-x64

7

f68f044685...50.exe

windows10-2004-x64

3

f6ac1ea5c1...25.exe

windows10-2004-x64

8

f6b7978847...1a.exe

windows10-2004-x64

7

f6e2978004...35.exe

windows10-2004-x64

10

f721adec82...71.exe

windows10-2004-x64

10

f736c152b3...c8.exe

windows10-2004-x64

10

f780377dd9...c9.exe

windows10-2004-x64

7

f7a96bf083...c8.exe

windows10-2004-x64

1

f812ad48d0...9b.exe

windows10-2004-x64

10

f8173be0fb...a4.exe

windows10-2004-x64

1

f835ddaf49...d7.exe

windows10-2004-x64

10

f846950431...1c.exe

windows10-2004-x64

10

f89219b77e...00.exe

windows10-2004-x64

10

f8a3f1d5a1...b0.exe

windows10-2004-x64

10

f908d30321...39.exe

windows10-2004-x64

10

f926cc363c...a8.exe

windows10-2004-x64

10

f947bf8f07...dd.exe

windows10-2004-x64

10

f97418dbfc...06.exe

windows10-2004-x64

7

f98ee08aed...cc.exe

windows10-2004-x64

10

f990d850e1...f8.exe

windows10-2004-x64

8

f99ae4a378...93.exe

windows10-2004-x64

10

f9a573b21a...18.exe

windows10-2004-x64

fa0d8e0c80...8e.exe

windows10-2004-x64

10

fa8e531e08...84.exe

windows10-2004-x64

10

fa942bbb98...d7.exe

windows10-2004-x64

10

Resubmissions

08/04/2025, 14:11

250408-rhjmcsvp15 10

22/03/2025, 06:18

250322-g2ywaay1fy 10

Analysis

  • max time kernel
    149s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20250314-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system
  • submitted
    08/04/2025, 14:11

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    f926cc363c27c542c23e14398096eda8.exe

  • Size

    1.9MB

  • MD5

    f926cc363c27c542c23e14398096eda8

  • SHA1

    03442d6ea4a9acd36987b916ffe0261810e6dbfd

  • SHA256

    ec0c9de9d6eef69bfe2c220f21971d4acc91004194cd8cf993a2bd34a04e31df

  • SHA512

    581d105843a37d51aed86b071aed97c4188cb4bc8aed8b8c9bd9f7c297d5b3ba79d1d93f0a3d9bb5da89dbb445385838f7df229bec27b36d46b13757eb16491f

  • SSDEEP

    24576:kz4T3bMX0/0ZqSEaa3OVFu8VQTo8Ia29MSVyAXmFPf87ptY60/YYhdbh7JRj:kOMX0/08SVYTcxMXPxthD

Score
10/10
defense_evasionexecutiontrojan

Malware Config

Signatures

  • Process spawned unexpected child process 24 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • UAC bypass 3 TTPs 33 IoCs
    defense_evasiontrojan
  • Command and Scripting Interpreter: PowerShell 1 TTPs 9 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution
  • Drops file in Drivers directory 1 IoCs
  • Checks computer location settings 2 TTPs 11 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 10 IoCs
  • Checks whether UAC is enabled 1 TTPs 22 IoCs
    defense_evasiontrojan
  • Drops file in Program Files directory 15 IoCs
  • Drops file in Windows directory 10 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 11 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 24 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 42 IoCs
  • Suspicious use of AdjustPrivilegeToken 20 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 33 IoCs
    defense_evasion
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\f926cc363c27c542c23e14398096eda8.exe
    "C:\Users\Admin\AppData\Local\Temp\f926cc363c27c542c23e14398096eda8.exe"
    1⤵
    • UAC bypass
    • Drops file in Drivers directory
    • Checks computer location settings
    • Checks whether UAC is enabled
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    • System policy modification
    PID:2744
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\f926cc363c27c542c23e14398096eda8.exe'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:5104
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\LiveKernelReports\Idle.exe'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1852
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\es-ES\OfficeClickToRun.exe'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:772
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\fontdrvhost.exe'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4652
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:\7330c8a20692d0b35002ea5a\backgroundTaskHost.exe'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2492
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\MSBuild\backgroundTaskHost.exe'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2028
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Common Files\System\uk-UA\f926cc363c27c542c23e14398096eda8.exe'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1736
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\edge_BITS_4740_303449538\f926cc363c27c542c23e14398096eda8.exe'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4288
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:\f170d29a37c9c9775251\dwm.exe'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1168
    • C:\7330c8a20692d0b35002ea5a\backgroundTaskHost.exe
      "C:\7330c8a20692d0b35002ea5a\backgroundTaskHost.exe"
      2⤵
      • UAC bypass
      • Checks computer location settings
      • Executes dropped EXE
      • Checks whether UAC is enabled
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      • System policy modification
      PID:3788
      • C:\Windows\System32\WScript.exe
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\e9397bc5-c320-4769-a139-5f9971bdb6ac.vbs"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:408
        • C:\7330c8a20692d0b35002ea5a\backgroundTaskHost.exe
          C:\7330c8a20692d0b35002ea5a\backgroundTaskHost.exe
          4⤵
          • UAC bypass
          • Checks computer location settings
          • Executes dropped EXE
          • Checks whether UAC is enabled
          • Modifies registry class
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          • System policy modification
          PID:5204
          • C:\Windows\System32\WScript.exe
            "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\da13614a-55cb-4335-aaf8-08db703e9de2.vbs"
            5⤵
            • Suspicious use of WriteProcessMemory
            PID:4408
            • C:\7330c8a20692d0b35002ea5a\backgroundTaskHost.exe
              C:\7330c8a20692d0b35002ea5a\backgroundTaskHost.exe
              6⤵
              • UAC bypass
              • Checks computer location settings
              • Executes dropped EXE
              • Checks whether UAC is enabled
              • Modifies registry class
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of WriteProcessMemory
              • System policy modification
              PID:1540
              • C:\Windows\System32\WScript.exe
                "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\0d3267ce-a830-4243-b63e-bcdeaf820fa3.vbs"
                7⤵
                • Suspicious use of WriteProcessMemory
                PID:4020
                • C:\7330c8a20692d0b35002ea5a\backgroundTaskHost.exe
                  C:\7330c8a20692d0b35002ea5a\backgroundTaskHost.exe
                  8⤵
                  • UAC bypass
                  • Checks computer location settings
                  • Executes dropped EXE
                  • Checks whether UAC is enabled
                  • Modifies registry class
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of AdjustPrivilegeToken
                  • Suspicious use of WriteProcessMemory
                  • System policy modification
                  PID:552
                  • C:\Windows\System32\WScript.exe
                    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\d38c01e2-6757-4bb4-9ca9-9c81f09760e3.vbs"
                    9⤵
                    • Suspicious use of WriteProcessMemory
                    PID:5596
                    • C:\7330c8a20692d0b35002ea5a\backgroundTaskHost.exe
                      C:\7330c8a20692d0b35002ea5a\backgroundTaskHost.exe
                      10⤵
                      • UAC bypass
                      • Checks computer location settings
                      • Executes dropped EXE
                      • Checks whether UAC is enabled
                      • Modifies registry class
                      • Suspicious behavior: EnumeratesProcesses
                      • Suspicious use of AdjustPrivilegeToken
                      • Suspicious use of WriteProcessMemory
                      • System policy modification
                      PID:4732
                      • C:\Windows\System32\WScript.exe
                        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\5b2df9d7-d1de-43e6-b506-7b4414234fb5.vbs"
                        11⤵
                        • Suspicious use of WriteProcessMemory
                        PID:5588
                        • C:\7330c8a20692d0b35002ea5a\backgroundTaskHost.exe
                          C:\7330c8a20692d0b35002ea5a\backgroundTaskHost.exe
                          12⤵
                          • UAC bypass
                          • Checks computer location settings
                          • Executes dropped EXE
                          • Checks whether UAC is enabled
                          • Modifies registry class
                          • Suspicious behavior: EnumeratesProcesses
                          • Suspicious use of AdjustPrivilegeToken
                          • Suspicious use of WriteProcessMemory
                          • System policy modification
                          PID:5104
                          • C:\Windows\System32\WScript.exe
                            "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\f61e1bb5-5b8d-4662-9298-c5bc2e67a194.vbs"
                            13⤵
                            • Suspicious use of WriteProcessMemory
                            PID:2848
                            • C:\7330c8a20692d0b35002ea5a\backgroundTaskHost.exe
                              C:\7330c8a20692d0b35002ea5a\backgroundTaskHost.exe
                              14⤵
                              • UAC bypass
                              • Checks computer location settings
                              • Executes dropped EXE
                              • Checks whether UAC is enabled
                              • Modifies registry class
                              • Suspicious behavior: EnumeratesProcesses
                              • Suspicious use of AdjustPrivilegeToken
                              • Suspicious use of WriteProcessMemory
                              • System policy modification
                              PID:2196
                              • C:\Windows\System32\WScript.exe
                                "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\67a87a13-d829-41aa-ad08-b257aafb3449.vbs"
                                15⤵
                                • Suspicious use of WriteProcessMemory
                                PID:5356
                                • C:\7330c8a20692d0b35002ea5a\backgroundTaskHost.exe
                                  C:\7330c8a20692d0b35002ea5a\backgroundTaskHost.exe
                                  16⤵
                                  • UAC bypass
                                  • Checks computer location settings
                                  • Executes dropped EXE
                                  • Checks whether UAC is enabled
                                  • Modifies registry class
                                  • Suspicious behavior: EnumeratesProcesses
                                  • Suspicious use of AdjustPrivilegeToken
                                  • Suspicious use of WriteProcessMemory
                                  • System policy modification
                                  PID:2232
                                  • C:\Windows\System32\WScript.exe
                                    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\d00a103f-f26d-4c9a-987b-0fe413da1f59.vbs"
                                    17⤵
                                      PID:4976
                                      • C:\7330c8a20692d0b35002ea5a\backgroundTaskHost.exe
                                        C:\7330c8a20692d0b35002ea5a\backgroundTaskHost.exe
                                        18⤵
                                        • UAC bypass
                                        • Checks computer location settings
                                        • Executes dropped EXE
                                        • Checks whether UAC is enabled
                                        • Modifies registry class
                                        • Suspicious behavior: EnumeratesProcesses
                                        • Suspicious use of AdjustPrivilegeToken
                                        • System policy modification
                                        PID:2584
                                        • C:\Windows\System32\WScript.exe
                                          "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\d203c21b-50d5-446f-b3a8-52f493e1ed5b.vbs"
                                          19⤵
                                            PID:5824
                                            • C:\7330c8a20692d0b35002ea5a\backgroundTaskHost.exe
                                              C:\7330c8a20692d0b35002ea5a\backgroundTaskHost.exe
                                              20⤵
                                              • UAC bypass
                                              • Checks computer location settings
                                              • Executes dropped EXE
                                              • Checks whether UAC is enabled
                                              • Modifies registry class
                                              • Suspicious behavior: EnumeratesProcesses
                                              • Suspicious use of AdjustPrivilegeToken
                                              • System policy modification
                                              PID:1604
                                              • C:\Windows\System32\WScript.exe
                                                "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\4992a835-842b-4c6d-94d1-093e49af5f4f.vbs"
                                                21⤵
                                                  PID:4796
                                                • C:\Windows\System32\WScript.exe
                                                  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\40e9dce0-3164-43ad-a12b-83f819e85c32.vbs"
                                                  21⤵
                                                    PID:4408
                                              • C:\Windows\System32\WScript.exe
                                                "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\2fab9edf-595a-4c91-89b3-2c773b7b4c88.vbs"
                                                19⤵
                                                  PID:5316
                                            • C:\Windows\System32\WScript.exe
                                              "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\2affd4c1-590a-44e9-8674-12acfae63a80.vbs"
                                              17⤵
                                                PID:4036
                                          • C:\Windows\System32\WScript.exe
                                            "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\707433ff-d3c9-480d-9bf8-3293969f1382.vbs"
                                            15⤵
                                              PID:1624
                                        • C:\Windows\System32\WScript.exe
                                          "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\b1c412c8-61a7-44a5-b061-fb5da84d9add.vbs"
                                          13⤵
                                            PID:5600
                                      • C:\Windows\System32\WScript.exe
                                        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\8faf350a-54a8-4127-b7a5-b26fb1fe8d22.vbs"
                                        11⤵
                                          PID:2028
                                    • C:\Windows\System32\WScript.exe
                                      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\7d1411dc-2a75-472b-b098-e11e95096467.vbs"
                                      9⤵
                                        PID:4776
                                  • C:\Windows\System32\WScript.exe
                                    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\458b9352-62f7-4c0e-8265-abc8e6d06076.vbs"
                                    7⤵
                                      PID:3976
                                • C:\Windows\System32\WScript.exe
                                  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\51ba6a41-3800-49b0-b26b-3e42e33a6305.vbs"
                                  5⤵
                                    PID:3644
                              • C:\Windows\System32\WScript.exe
                                "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\f889360a-5242-49b8-a196-38db1f1d2b48.vbs"
                                3⤵
                                  PID:3492
                            • C:\Windows\system32\schtasks.exe
                              schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 10 /tr "'C:\Windows\LiveKernelReports\Idle.exe'" /f
                              1⤵
                              • Process spawned unexpected child process
                              • Scheduled Task/Job: Scheduled Task
                              PID:4668
                            • C:\Windows\system32\schtasks.exe
                              schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Windows\LiveKernelReports\Idle.exe'" /rl HIGHEST /f
                              1⤵
                              • Process spawned unexpected child process
                              • Scheduled Task/Job: Scheduled Task
                              PID:3332
                            • C:\Windows\system32\schtasks.exe
                              schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 12 /tr "'C:\Windows\LiveKernelReports\Idle.exe'" /rl HIGHEST /f
                              1⤵
                              • Process spawned unexpected child process
                              • Scheduled Task/Job: Scheduled Task
                              PID:4712
                            • C:\Windows\system32\schtasks.exe
                              schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 9 /tr "'C:\Windows\es-ES\OfficeClickToRun.exe'" /f
                              1⤵
                              • Process spawned unexpected child process
                              • Scheduled Task/Job: Scheduled Task
                              PID:4784
                            • C:\Windows\system32\schtasks.exe
                              schtasks.exe /create /tn "OfficeClickToRun" /sc ONLOGON /tr "'C:\Windows\es-ES\OfficeClickToRun.exe'" /rl HIGHEST /f
                              1⤵
                              • Process spawned unexpected child process
                              • Scheduled Task/Job: Scheduled Task
                              PID:4780
                            • C:\Windows\system32\schtasks.exe
                              schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 12 /tr "'C:\Windows\es-ES\OfficeClickToRun.exe'" /rl HIGHEST /f
                              1⤵
                              • Process spawned unexpected child process
                              • Scheduled Task/Job: Scheduled Task
                              PID:4800
                            • C:\Windows\system32\schtasks.exe
                              schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 13 /tr "'C:\Recovery\WindowsRE\fontdrvhost.exe'" /f
                              1⤵
                              • Process spawned unexpected child process
                              • Scheduled Task/Job: Scheduled Task
                              PID:4776
                            • C:\Windows\system32\schtasks.exe
                              schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\fontdrvhost.exe'" /rl HIGHEST /f
                              1⤵
                              • Process spawned unexpected child process
                              • Scheduled Task/Job: Scheduled Task
                              PID:4796
                            • C:\Windows\system32\schtasks.exe
                              schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 6 /tr "'C:\Recovery\WindowsRE\fontdrvhost.exe'" /rl HIGHEST /f
                              1⤵
                              • Process spawned unexpected child process
                              • Scheduled Task/Job: Scheduled Task
                              PID:4892
                            • C:\Windows\system32\schtasks.exe
                              schtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 11 /tr "'C:\7330c8a20692d0b35002ea5a\backgroundTaskHost.exe'" /f
                              1⤵
                              • Process spawned unexpected child process
                              • Scheduled Task/Job: Scheduled Task
                              PID:4920
                            • C:\Windows\system32\schtasks.exe
                              schtasks.exe /create /tn "backgroundTaskHost" /sc ONLOGON /tr "'C:\7330c8a20692d0b35002ea5a\backgroundTaskHost.exe'" /rl HIGHEST /f
                              1⤵
                              • Process spawned unexpected child process
                              • Scheduled Task/Job: Scheduled Task
                              PID:4848
                            • C:\Windows\system32\schtasks.exe
                              schtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 14 /tr "'C:\7330c8a20692d0b35002ea5a\backgroundTaskHost.exe'" /rl HIGHEST /f
                              1⤵
                              • Process spawned unexpected child process
                              • Scheduled Task/Job: Scheduled Task
                              PID:6100
                            • C:\Windows\system32\schtasks.exe
                              schtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 14 /tr "'C:\Program Files\MSBuild\backgroundTaskHost.exe'" /f
                              1⤵
                              • Process spawned unexpected child process
                              • Scheduled Task/Job: Scheduled Task
                              PID:1792
                            • C:\Windows\system32\schtasks.exe
                              schtasks.exe /create /tn "backgroundTaskHost" /sc ONLOGON /tr "'C:\Program Files\MSBuild\backgroundTaskHost.exe'" /rl HIGHEST /f
                              1⤵
                              • Process spawned unexpected child process
                              • Scheduled Task/Job: Scheduled Task
                              PID:1596
                            • C:\Windows\system32\schtasks.exe
                              schtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 7 /tr "'C:\Program Files\MSBuild\backgroundTaskHost.exe'" /rl HIGHEST /f
                              1⤵
                              • Process spawned unexpected child process
                              • Scheduled Task/Job: Scheduled Task
                              PID:4376
                            • C:\Windows\system32\schtasks.exe
                              schtasks.exe /create /tn "f926cc363c27c542c23e14398096eda8f" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Common Files\System\uk-UA\f926cc363c27c542c23e14398096eda8.exe'" /f
                              1⤵
                              • Process spawned unexpected child process
                              • Scheduled Task/Job: Scheduled Task
                              PID:2196
                            • C:\Windows\system32\schtasks.exe
                              schtasks.exe /create /tn "f926cc363c27c542c23e14398096eda8" /sc ONLOGON /tr "'C:\Program Files (x86)\Common Files\System\uk-UA\f926cc363c27c542c23e14398096eda8.exe'" /rl HIGHEST /f
                              1⤵
                              • Process spawned unexpected child process
                              • Scheduled Task/Job: Scheduled Task
                              PID:5448
                            • C:\Windows\system32\schtasks.exe
                              schtasks.exe /create /tn "f926cc363c27c542c23e14398096eda8f" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Common Files\System\uk-UA\f926cc363c27c542c23e14398096eda8.exe'" /rl HIGHEST /f
                              1⤵
                              • Process spawned unexpected child process
                              • Scheduled Task/Job: Scheduled Task
                              PID:2684
                            • C:\Windows\system32\schtasks.exe
                              schtasks.exe /create /tn "f926cc363c27c542c23e14398096eda8f" /sc MINUTE /mo 8 /tr "'C:\Program Files\edge_BITS_4740_303449538\f926cc363c27c542c23e14398096eda8.exe'" /f
                              1⤵
                              • Process spawned unexpected child process
                              • Scheduled Task/Job: Scheduled Task
                              PID:2816
                            • C:\Windows\system32\schtasks.exe
                              schtasks.exe /create /tn "f926cc363c27c542c23e14398096eda8" /sc ONLOGON /tr "'C:\Program Files\edge_BITS_4740_303449538\f926cc363c27c542c23e14398096eda8.exe'" /rl HIGHEST /f
                              1⤵
                              • Process spawned unexpected child process
                              • Scheduled Task/Job: Scheduled Task
                              PID:4912
                            • C:\Windows\system32\schtasks.exe
                              schtasks.exe /create /tn "f926cc363c27c542c23e14398096eda8f" /sc MINUTE /mo 9 /tr "'C:\Program Files\edge_BITS_4740_303449538\f926cc363c27c542c23e14398096eda8.exe'" /rl HIGHEST /f
                              1⤵
                              • Process spawned unexpected child process
                              • Scheduled Task/Job: Scheduled Task
                              PID:4980
                            • C:\Windows\system32\schtasks.exe
                              schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 13 /tr "'C:\f170d29a37c9c9775251\dwm.exe'" /f
                              1⤵
                              • Process spawned unexpected child process
                              • Scheduled Task/Job: Scheduled Task
                              PID:5004
                            • C:\Windows\system32\schtasks.exe
                              schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\f170d29a37c9c9775251\dwm.exe'" /rl HIGHEST /f
                              1⤵
                              • Process spawned unexpected child process
                              • Scheduled Task/Job: Scheduled Task
                              PID:5032
                            • C:\Windows\system32\schtasks.exe
                              schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 11 /tr "'C:\f170d29a37c9c9775251\dwm.exe'" /rl HIGHEST /f
                              1⤵
                              • Process spawned unexpected child process
                              • Scheduled Task/Job: Scheduled Task
                              PID:5056

                            Network

                            MITRE ATT&CK Enterprise v16

                            Replay Monitor

                            Loading Replay Monitor...

                            Downloads

                            • C:\Program Files (x86)\Common Files\System\uk-UA\f926cc363c27c542c23e14398096eda8.exe
                              Filesize

                              1.9MB

                              MD5

                              c113a119a3270455193aec635206960f

                              SHA1

                              4b1c39d08f23769b350b1b6f99f93bf5bf95056c

                              SHA256

                              fda3627de405eeed10a8a6220457a0f55fc6f2468e14e5c41598e196f7bd5d68

                              SHA512

                              97c80d6e95395cca5b9ea6232450ef3c2d202104d93a14ec1c7566a76525b154f629a9851822e7c912221893c456646d6dcefe6e588392249ccc678186976da4

                              Download Submit

                            • C:\Program Files\MSBuild\backgroundTaskHost.exe
                              Filesize

                              1.9MB

                              MD5

                              f926cc363c27c542c23e14398096eda8

                              SHA1

                              03442d6ea4a9acd36987b916ffe0261810e6dbfd

                              SHA256

                              ec0c9de9d6eef69bfe2c220f21971d4acc91004194cd8cf993a2bd34a04e31df

                              SHA512

                              581d105843a37d51aed86b071aed97c4188cb4bc8aed8b8c9bd9f7c297d5b3ba79d1d93f0a3d9bb5da89dbb445385838f7df229bec27b36d46b13757eb16491f

                              Download Submit

                            • C:\Program Files\MSBuild\backgroundTaskHost.exe
                              Filesize

                              1.9MB

                              MD5

                              28225d0343ef06d5aa1476ec85a88f7b

                              SHA1

                              dbd91b215b042ca72fd92fefc2f47da800415fe4

                              SHA256

                              9097d81366e95fe7f728c613d4434c205d78b37a3791107b4f2f66bb13f5a78c

                              SHA512

                              fca28789e6e873e18a474507485638f47b7c57cdba7757da9a8949b321a3f6b60069707f10ed904bc833204999d5a2c92deeba31ba758eb55a20332d968878fe

                              Download Submit

                            • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\backgroundTaskHost.exe.log
                              Filesize

                              1KB

                              MD5

                              364147c1feef3565925ea5b4ac701a01

                              SHA1

                              9a46393ac3ffad3bb3c8f0e074b65d68d75e21ef

                              SHA256

                              38cf1ab1146ad24e88763fc0508c2a99478d8428b453ba8c8b830d2883a4562b

                              SHA512

                              bfec1d3f22abd5668def189259deb4d919ceb4d51ac965d0baf9b6cf8bea0db680d49a2b8d0b75524cc04c7803cdfd91e484b31dc8ddc3ff47d1e5c59a9e35cf

                              Download Submit

                            • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
                              Filesize

                              2KB

                              MD5

                              d85ba6ff808d9e5444a4b369f5bc2730

                              SHA1

                              31aa9d96590fff6981b315e0b391b575e4c0804a

                              SHA256

                              84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

                              SHA512

                              8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

                              Download Submit

                            • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                              Filesize

                              944B

                              MD5

                              4a7baa2b3c35d23eda09bdef4265fb47

                              SHA1

                              eda288e5c03a1b226ad16d487d71742ab2b94e35

                              SHA256

                              993d3f32343d257e089e83ca383bff11bf8ff41a01ead2e8ffddeceeff1039b8

                              SHA512

                              6a0d62d00857efc8333569fd3535bc89073213af4fe6c7ffc1d417299b6b377680e8114d80f09d679b12d452f2992a55ad0992f54cc21338b09459a53d654134

                              Download Submit

                            • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                              Filesize

                              944B

                              MD5

                              0c56ba5098c530bbd1cdb28d50090d39

                              SHA1

                              ff63178ea722ec2db118c81051bf85544fb6b316

                              SHA256

                              0299d374c4b984cb0475284b966dfbe8bb08e45b93dabdf327f96a60b05273d1

                              SHA512

                              cbbf27ac30e55f4df35ae5aae50d1a2f9475dc2ac0eecf9ce0ab19adef606fff08c26d0eef5686012d36566551179afe09b15c1da1840415b1696f76324a03f2

                              Download Submit

                            • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                              Filesize

                              944B

                              MD5

                              44ae12563d9f97ac1136baee629673df

                              SHA1

                              38790549497302c43bd3ff6c5225e8c7054829e2

                              SHA256

                              b09202e29f036511a075523ebcaecef0a43ceeb4f2c8029e5c7931a8e2e72beb

                              SHA512

                              07cf8ed791245485aae4ee05cd6b77eb0a36c8a839da6eae1554dc0487559c270241733ae8ed184c8d38a956452a2255169a3adeb40a0da1d9e2e487864a35e7

                              Download Submit

                            • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                              Filesize

                              944B

                              MD5

                              86ff644f9a06688655f1c9fab80c2287

                              SHA1

                              42a285e478bbf312195d5356f22064bc9195de97

                              SHA256

                              53c83b1ce3c2769f42b262235c766cdd07271385b0af9c295eee349418fa8834

                              SHA512

                              d26f6b7313d08ae832ed492c2a6fc60f83d0c1f2f444bd1d501a8d238c4772a9250e88405fc7a2a027e2d7a517a1f89f838096446f191349f7fa6df26457fd78

                              Download Submit

                            • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                              Filesize

                              944B

                              MD5

                              c88f5f103e9375dc09ed9111f780e6ac

                              SHA1

                              f4bfc56f2c79364a5a32ca575329de6d7f648661

                              SHA256

                              a159d1dfb8d72e4f3db774b7a7c841cb3fefc1655bf5a705c87ae022b9189ea5

                              SHA512

                              31d29b73dd24f1b223b7cfbeca129834f9eac0999bed647784bb933e0dfbb0ad70c003dd70b7cea1049d33d9d189bf80c285be45d4ffd8cf9fa0732be542a4d7

                              Download Submit

                            • C:\Users\Admin\AppData\Local\Temp\0d3267ce-a830-4243-b63e-bcdeaf820fa3.vbs
                              Filesize

                              726B

                              MD5

                              969c4e1b9cb36c57e0967a3d76050147

                              SHA1

                              ac708112bc6215522484f1967e54797dc5837d5a

                              SHA256

                              80328d3708c6f7c2941edb3df4761403b7d16d7b8743102035166ec4bb364e92

                              SHA512

                              74751635647d853da00e6c54879dbed460fc60d8d6e030d89284da0c69dffaf1327b06b2030c3df1e02232b1d41adec7bac7d50bd1e6488030cb6a755ec5bfbe

                              Download Submit

                            • C:\Users\Admin\AppData\Local\Temp\4992a835-842b-4c6d-94d1-093e49af5f4f.vbs
                              Filesize

                              726B

                              MD5

                              032872da2a64f936412c5b69b0a388bd

                              SHA1

                              5dbd58982cffff182321bb8516515932962446cf

                              SHA256

                              1016be8964573c0b6498104d60ffd0264c15e8809b7c4ccc5ebfff80bb0adcb9

                              SHA512

                              ae811cfa54c89990ed23cf0557365ef36f5f03d2d5e9a1dd3cd168970fa9124bfd48328add8ec5fbc943537ff8a2b33cb7db0b1163242486806f8990a7d7eef8

                              Download Submit

                            • C:\Users\Admin\AppData\Local\Temp\5b2df9d7-d1de-43e6-b506-7b4414234fb5.vbs
                              Filesize

                              726B

                              MD5

                              bd42374e0e6c43ca8cd730dae5688349

                              SHA1

                              bd815a89cf6e6d0da6c75872cb592415db652b1a

                              SHA256

                              5ce7b36602bd7106af5e5ac8c95a9b31c1910b56a7fb6f52000a7b336dac64ad

                              SHA512

                              3cb4d812e271d0306b97bcc19b03e6985ac0b9d2ad2d3c9c2bb301deab6ba514c54fdd27b6e03b651c6de1b9d07d9f8e6dca06a9efb7b8806b726d06b9ae829d

                              Download Submit

                            • C:\Users\Admin\AppData\Local\Temp\67a87a13-d829-41aa-ad08-b257aafb3449.vbs
                              Filesize

                              726B

                              MD5

                              790c0c90db7a3a5d249bd178d9ade73e

                              SHA1

                              96440bd1c1585673757b6067e3f945b6ff6ae3cc

                              SHA256

                              95ee2a191542b8d32cdbb475f0e7eefabee38e3193a153090de8f099468f536a

                              SHA512

                              769dc35f7a49d62b1e8f394c14cffe487c365eecdf73782a427472f75f80d009f687d036f20d75848ca6541a09384c1e3e8faa5304efa85d6cb6a72a60212627

                              Download Submit

                            • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_xmhr5szv.msr.ps1
                              Filesize

                              60B

                              MD5

                              d17fe0a3f47be24a6453e9ef58c94641

                              SHA1

                              6ab83620379fc69f80c0242105ddffd7d98d5d9d

                              SHA256

                              96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                              SHA512

                              5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                              Download Submit

                            • C:\Users\Admin\AppData\Local\Temp\d00a103f-f26d-4c9a-987b-0fe413da1f59.vbs
                              Filesize

                              726B

                              MD5

                              2671468335456831c88caeb275bce940

                              SHA1

                              4ff4bba6e10c842c943a007ca7769faa94e1bb8f

                              SHA256

                              38313411557bfba127aa16df9c355eb130980b3bc4b25d9616c81cbea917b372

                              SHA512

                              248b535510d2f02596c129b2bb721c7e3d2532160ceb1dbf96ca1f918b2e086d4df201e999552b6dffb4af98110c871869df83d68206e8a9e5d9b68a6737aa5c

                              Download Submit

                            • C:\Users\Admin\AppData\Local\Temp\d203c21b-50d5-446f-b3a8-52f493e1ed5b.vbs
                              Filesize

                              726B

                              MD5

                              782441d91c19e2c1de111e9b50c5d083

                              SHA1

                              9ec1e1d9c7fd4783d63fa49ab27087c8d56409ce

                              SHA256

                              8a1c48e65014ccf5d4a79c4cf43673be961b01e6fcc0e254afe3a5599b98dce1

                              SHA512

                              e1af0cc65411e016fd92dc0eeab7506449194ffe0f2d72677a150d2438253ebc08655a045f8c160c99804878f534656a9dd0d0a2a78af33890fd782ad9224d0f

                              Download Submit

                            • C:\Users\Admin\AppData\Local\Temp\d38c01e2-6757-4bb4-9ca9-9c81f09760e3.vbs
                              Filesize

                              725B

                              MD5

                              0f025c67e6a2e295a749d8964fbdbac3

                              SHA1

                              fcb2c00a8af58bbff983115e473e5900cab8941a

                              SHA256

                              4eebc7f6bfc71ad474cd06d9e280c79baad7582ffd141b447935a25e0328e2d6

                              SHA512

                              7fb22e291573fe65a2c194aaf691cec26a1f473f1401304a9f16211608a3497072ff086089821c9e12a65f5c00b5cdb2f494c360740b2c36ff73fe37909776c8

                              Download Submit

                            • C:\Users\Admin\AppData\Local\Temp\da13614a-55cb-4335-aaf8-08db703e9de2.vbs
                              Filesize

                              726B

                              MD5

                              2da4b6dba67325612eff49994eb052d3

                              SHA1

                              e9928539bd42fcaecb9a628f73cd634cfd233031

                              SHA256

                              e230259f5fe098a769421eeb59f2e28293999b223a03c2d87613eb4c293da27a

                              SHA512

                              79df85a9e83863b82e0eae39e17d1436fdbd3463242a88ac2a276a918df28c6b399f1f654cb8d7dd1862dc36cd182d3f0adb573bb21344cb818e4671b7a628b2

                              Download Submit

                            • C:\Users\Admin\AppData\Local\Temp\e9397bc5-c320-4769-a139-5f9971bdb6ac.vbs
                              Filesize

                              726B

                              MD5

                              c314851d3fce3a9548050b5a811c3428

                              SHA1

                              b1dfd73aa239d5ef37362b9922bb7e88141f7d9e

                              SHA256

                              efab571a6aa97f0e765442f3d48cdb0bfceb704df35162d36548917fba367952

                              SHA512

                              e698130e5b0f746631adfc29be4a49af5bb17605aa487fad996fb3de0ddb1e56bae4a80ec24cd6d6e3a2843c69e90ac5f5727d4741adea55e7ca428110e1ead5

                              Download Submit

                            • C:\Users\Admin\AppData\Local\Temp\f61e1bb5-5b8d-4662-9298-c5bc2e67a194.vbs
                              Filesize

                              726B

                              MD5

                              4789b891dfb5f542dbfa161e6ca17ad4

                              SHA1

                              b44f1a091f233411dee3fcd9c6332f8e0eaabd37

                              SHA256

                              8eab5de54bd06b469121f9a13a44f529d53dfe36b5e9bdf586c47dc5746d244e

                              SHA512

                              64a7d02ae0417af30f830b86e304df55a8a61f49b35b6ad8f84b5ebfa7561b2436b2778bfec056ac902acd1bf6ae24624c8085671575015babc4a0f1aeb827cd

                              Download Submit

                            • C:\Users\Admin\AppData\Local\Temp\f889360a-5242-49b8-a196-38db1f1d2b48.vbs
                              Filesize

                              502B

                              MD5

                              d481c1219cb92776180e3477403b2c73

                              SHA1

                              41fddb0d86983b3d7307e41c979c8b6b5c3e3791

                              SHA256

                              de7ebdf0e7163b983ce67e8fdd76adf1d937d3a807c7ef1e5844ad95a82879fe

                              SHA512

                              b0d38c3165bd02a5384916b9a003d6dad769b8f828476ab71bd4b3e28abd250daf8849dc1fdf37864394fdab76bc3a7d5bbe07bda2f5833cb8bd9e9e60095f44

                              Download Submit

                            • C:\Windows\es-ES\OfficeClickToRun.exe
                              Filesize

                              1.9MB

                              MD5

                              681658af48fbfc24cd24cdac8c722a98

                              SHA1

                              236049202eba8453b634874b51e084dca811c8fd

                              SHA256

                              d7fdc08b670837d11210a39d587ef1335a7181a54ba1f4952471e434a622b3d9

                              SHA512

                              dc50a3c00ab36bead1ed022d3cfa338990ebe30035cf0df816d57fe5b7137eb05a2468865be322fa3cd21d10d1c0f9af1806c272290ff284bbdda63ae0f7a063

                              Download Submit

                            • memory/552-330-0x000000001C1A0000-0x000000001C1F6000-memory.dmp

                              Filesize

                              344KB

                              Download

                            • memory/1540-318-0x000000001BA10000-0x000000001BA22000-memory.dmp

                              Filesize

                              72KB

                              Download

                            • memory/2744-20-0x000000001BF50000-0x000000001BF5C000-memory.dmp

                              Filesize

                              48KB

                              Download

                            • memory/2744-17-0x000000001B850000-0x000000001B85E000-memory.dmp

                              Filesize

                              56KB

                              Download

                            • memory/2744-5-0x0000000001360000-0x0000000001368000-memory.dmp

                              Filesize

                              32KB

                              Download

                            • memory/2744-7-0x0000000002D30000-0x0000000002D46000-memory.dmp

                              Filesize

                              88KB

                              Download

                            • memory/2744-14-0x000000001C8D0000-0x000000001CDF8000-memory.dmp

                              Filesize

                              5.2MB

                              Download

                            • memory/2744-15-0x000000001B830000-0x000000001B83C000-memory.dmp

                              Filesize

                              48KB

                              Download

                            • memory/2744-16-0x000000001B840000-0x000000001B84A000-memory.dmp

                              Filesize

                              40KB

                              Download

                            • memory/2744-18-0x000000001B870000-0x000000001B878000-memory.dmp

                              Filesize

                              32KB

                              Download

                            • memory/2744-0-0x00007FFD4B1C3000-0x00007FFD4B1C5000-memory.dmp

                              Filesize

                              8KB

                              Download

                            • memory/2744-1-0x0000000000900000-0x0000000000AEA000-memory.dmp

                              Filesize

                              1.9MB

                              Download

                            • memory/2744-19-0x000000001BF40000-0x000000001BF4C000-memory.dmp

                              Filesize

                              48KB

                              Download

                            • memory/2744-275-0x00007FFD4B1C0000-0x00007FFD4BC81000-memory.dmp

                              Filesize

                              10.8MB

                              Download

                            • memory/2744-4-0x000000001B7A0000-0x000000001B7F0000-memory.dmp

                              Filesize

                              320KB

                              Download

                            • memory/2744-10-0x0000000002DB0000-0x0000000002DBC000-memory.dmp

                              Filesize

                              48KB

                              Download

                            • memory/2744-3-0x0000000001340000-0x000000000135C000-memory.dmp

                              Filesize

                              112KB

                              Download

                            • memory/2744-11-0x000000001B7F0000-0x000000001B7F8000-memory.dmp

                              Filesize

                              32KB

                              Download

                            • memory/2744-13-0x000000001B800000-0x000000001B812000-memory.dmp

                              Filesize

                              72KB

                              Download

                            • memory/2744-9-0x0000000002D60000-0x0000000002DB6000-memory.dmp

                              Filesize

                              344KB

                              Download

                            • memory/2744-8-0x0000000002D50000-0x0000000002D5A000-memory.dmp

                              Filesize

                              40KB

                              Download

                            • memory/2744-6-0x0000000001370000-0x0000000001380000-memory.dmp

                              Filesize

                              64KB

                              Download

                            • memory/2744-2-0x00007FFD4B1C0000-0x00007FFD4BC81000-memory.dmp

                              Filesize

                              10.8MB

                              Download

                            • memory/4652-192-0x00000165E8250000-0x00000165E8272000-memory.dmp

                              Filesize

                              136KB

                              Download