9d05854c95c6afa68911bd28af12282185e0fe34f2e58fddbc503ab22d1508d7

Resubmissions

24/05/2026, 03:23

260524-dxz11aaz7t3

22/04/2026, 04:38

260422-e9eq9scz5v3

Analysis

max time kernel
150s
max time network
124s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
22/04/2026, 04:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
notesreg.bat
Size 5KB
Sample260422-e9eq9scz5v
SHA256 9d05854c95c6afa68911bd28af12282185e0fe34f2e58fddbc503ab22d1508d7
MD5 c6d0f67db6a7dbf1f9394d98c1e13670
SHA1 6b2bb5287f6c7a217ad3263926603b50fd7f9662
SHA512 d191c830c0b538073fa10f8c4e7a1bdab66dc70b6055a7f6d4fc179fad8653843fcd6f44250bd55d22f9e77d287c06e325591529fb02eed35be3d2c841664a4a
SSDEEP 96:Pcvhwi1QLYsvkPwGiN3xL3XAOg8+9jnO/hWiKrMyz6ab64bA14bF4biGwW/TiSNT:9iCkSkPwfDLV1yvGwW/TiAIfPDc
TLSH
T1B6C19E241D4605E64546C95DCB8AB1DF3D65FACFC301EE68F89D64C9AF810CB8E629F0
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

System Time Discovery 1 TTPs 12 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3956	net.exe
2612	net1.exe
3220	net.exe
4656	net.exe
4860	net.exe
4144	net1.exe
896	net.exe
4716	net1.exe
3460	net1.exe
3924	net1.exe
3748	net1.exe
1336	net.exe

Modifies data under HKEY_USERS 15 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "253"	LogonUI.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271"	LogonUI.exe

Runs net.exe

Suspicious behavior: LoadsDriver 64 IoCs

pid	Process
3304	Process not Found
1092	Process not Found
4592	Process not Found
4892	Process not Found
988	Process not Found
776	Process not Found
1252	Process not Found
4864	Process not Found
4488	Process not Found
3492	Process not Found
3628	Process not Found
568	Process not Found
4532	Process not Found
1296	Process not Found
4756	Process not Found
2612	Process not Found
1004	Process not Found
1008	Process not Found
3460	Process not Found
2880	Process not Found
2272	Process not Found
4004	Process not Found
800	Process not Found
460	Process not Found
4180	Process not Found
3992	Process not Found
4624	Process not Found
4152	Process not Found
4328	Process not Found
1812	Process not Found
4176	Process not Found
5040	Process not Found
960	Process not Found
412	Process not Found
1828	Process not Found
4896	Process not Found
1396	Process not Found
3292	Process not Found
4992	Process not Found
3984	Process not Found
3916	Process not Found
3788	Process not Found
1804	Process not Found
3804	Process not Found
4200	Process not Found
4828	Process not Found
1928	Process not Found
3900	Process not Found
4632	Process not Found
3280	Process not Found
5088	Process not Found
2192	Process not Found
3888	Process not Found
4724	Process not Found
4196	Process not Found
2076	Process not Found
4504	Process not Found
4984	Process not Found
4204	Process not Found
1232	Process not Found
1156	Process not Found
2924	Process not Found
4788	Process not Found
628	Process not Found

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4392	LogonUI.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4468 wrote to memory of 1472	4468	cmd.exe	87
PID 4468 wrote to memory of 764	4468	cmd.exe	88
PID 4468 wrote to memory of 3188	4468	cmd.exe	89
PID 4468 wrote to memory of 2112	4468	cmd.exe	90
PID 4468 wrote to memory of 3680	4468	cmd.exe	91
PID 4468 wrote to memory of 4832	4468	cmd.exe	92
PID 4468 wrote to memory of 3200	4468	cmd.exe	93
PID 4468 wrote to memory of 2692	4468	cmd.exe	94
PID 4468 wrote to memory of 2540	4468	cmd.exe	95
PID 4468 wrote to memory of 3944	4468	cmd.exe	96
PID 4468 wrote to memory of 4556	4468	cmd.exe	97
PID 4468 wrote to memory of 2668	4468	cmd.exe	98
PID 4468 wrote to memory of 876	4468	cmd.exe	99
PID 4468 wrote to memory of 4172	4468	cmd.exe	100
PID 4468 wrote to memory of 1724	4468	cmd.exe	101
PID 4468 wrote to memory of 4512	4468	cmd.exe	102
PID 4468 wrote to memory of 4816	4468	cmd.exe	103
PID 4468 wrote to memory of 4652	4468	cmd.exe	104
PID 4468 wrote to memory of 1484	4468	cmd.exe	105
PID 4468 wrote to memory of 3160	4468	cmd.exe	106
PID 4468 wrote to memory of 2064	4468	cmd.exe	107
PID 4468 wrote to memory of 4700	4468	cmd.exe	108
PID 4468 wrote to memory of 4644	4468	cmd.exe	109
PID 4468 wrote to memory of 4436	4468	cmd.exe	110
PID 4468 wrote to memory of 1244	4468	cmd.exe	111
PID 4468 wrote to memory of 2952	4468	cmd.exe	112
PID 4468 wrote to memory of 4448	4468	cmd.exe	113
PID 4468 wrote to memory of 3288	4468	cmd.exe	114
PID 4468 wrote to memory of 4184	4468	cmd.exe	115
PID 4468 wrote to memory of 4344	4468	cmd.exe	116
PID 4468 wrote to memory of 3036	4468	cmd.exe	117
PID 4468 wrote to memory of 4192	4468	cmd.exe	118
PID 4468 wrote to memory of 2160	4468	cmd.exe	119
PID 4468 wrote to memory of 4496	4468	cmd.exe	120
PID 4496 wrote to memory of 1620	4496	cmd.exe	121
PID 1620 wrote to memory of 1976	1620	net.exe	122
PID 4468 wrote to memory of 3580	4468	cmd.exe	123
PID 4468 wrote to memory of 928	4468	cmd.exe	124
PID 4468 wrote to memory of 1992	4468	cmd.exe	125
PID 4468 wrote to memory of 1376	4468	cmd.exe	126
PID 4468 wrote to memory of 4028	4468	cmd.exe	127
PID 4468 wrote to memory of 3640	4468	cmd.exe	128
PID 4468 wrote to memory of 2284	4468	cmd.exe	129
PID 4468 wrote to memory of 3476	4468	cmd.exe	130
PID 4468 wrote to memory of 3856	4468	cmd.exe	131
PID 4468 wrote to memory of 1436	4468	cmd.exe	132
PID 4468 wrote to memory of 4628	4468	cmd.exe	133
PID 4468 wrote to memory of 4736	4468	cmd.exe	134
PID 4468 wrote to memory of 2252	4468	cmd.exe	135
PID 4468 wrote to memory of 2240	4468	cmd.exe	136
PID 4468 wrote to memory of 1220	4468	cmd.exe	137
PID 4468 wrote to memory of 2008	4468	cmd.exe	138
PID 4468 wrote to memory of 2628	4468	cmd.exe	139
PID 4468 wrote to memory of 3236	4468	cmd.exe	140
PID 4468 wrote to memory of 316	4468	cmd.exe	141
PID 4468 wrote to memory of 224	4468	cmd.exe	142
PID 4468 wrote to memory of 2116	4468	cmd.exe	143
PID 4468 wrote to memory of 4208	4468	cmd.exe	144
PID 4468 wrote to memory of 2024	4468	cmd.exe	145
PID 4468 wrote to memory of 408	4468	cmd.exe	146
PID 4468 wrote to memory of 3508	4468	cmd.exe	147
PID 4468 wrote to memory of 3996	4468	cmd.exe	148
PID 4468 wrote to memory of 952	4468	cmd.exe	149
PID 4468 wrote to memory of 1344	4468	cmd.exe	150

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\notesreg.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:4468
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c echo %YBr:~52,1%
  2⤵
  PID:1472
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c echo %YBr:~39,1%
  2⤵
  PID:764
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c echo %YBr:~2,1%
  2⤵
  PID:3188
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c echo %YBr:~33,1%
  2⤵
  PID:2112
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c echo %YBr:~19,1%
  2⤵
  PID:3680
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c echo %YBr:~26,1%
  2⤵
  PID:4832
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c echo %YBr:~22,1%
  2⤵
  PID:3200
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c echo %YBr:~27,1%
  2⤵
  PID:2692
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c echo %YBr:~60,1%
  2⤵
  PID:2540
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c echo %YBr:~55,1%
  2⤵
  PID:3944
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c echo %YBr:~34,1%
  2⤵
  PID:4556
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c echo %YBr:~61,1%
  2⤵
  PID:2668
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c echo %YBr:~4,1%
  2⤵
  PID:876
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c echo %YBr:~27,1%
  2⤵
  PID:4172
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c echo %YBr:~39,1%
  2⤵
  PID:1724
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c echo %YBr:~10,1%
  2⤵
  PID:4512
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c echo %YBr:~48,1%
  2⤵
  PID:4816
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c echo %YBr:~19,1%
  2⤵
  PID:4652
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c echo %YBr:~46,1%
  2⤵
  PID:1484
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c echo %YBr:~6,1%
  2⤵
  PID:3160
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c echo %YBr:~19,1%
  2⤵
  PID:2064
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c echo %YBr:~41,1%
  2⤵
  PID:4700
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c echo %YBr:~56,1%
  2⤵
  PID:4644
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c echo %YBr:~12,1%
  2⤵
  PID:4436
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c echo %YBr:~8,1%
  2⤵
  PID:1244
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c echo %YBr:~43,1%
  2⤵
  PID:2952
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c echo %YBr:~54,1%
  2⤵
  PID:4448
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c echo %YBr:~8,1%
  2⤵
  PID:3288
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c echo %YBr:~24,1%
  2⤵
  PID:4184
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c echo %YBr:~51,1%
  2⤵
  PID:4344
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c echo %YBr:~41,1%
  2⤵
  PID:3036
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c echo %YBr:~58,1%
  2⤵
  PID:4192
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c echo %YBr:~31,1%
  2⤵
  PID:2160
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c net user
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4496
- - C:\Windows\system32\net.exe
    net user
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1620
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user
      4⤵
      PID:1976
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c echo %YBr:~43,1%
  2⤵
  PID:3580
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c echo %YBr:~46,1%
  2⤵
  PID:928
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c echo %YBr:~14,1%
  2⤵
  PID:1992
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c echo %YBr:~2,1%
  2⤵
  PID:1376
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c echo %YBr:~6,1%
  2⤵
  PID:4028
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c echo %YBr:~17,1%
  2⤵
  PID:3640
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c echo %YBr:~43,1%
  2⤵
  PID:2284
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c echo %YBr:~46,1%
  2⤵
  PID:3476
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c echo %YBr:~30,1%
  2⤵
  PID:3856
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c echo %YBr:~49,1%
  2⤵
  PID:1436
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c echo %YBr:~15,1%
  2⤵
  PID:4628
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c echo %YBr:~61,1%
  2⤵
  PID:4736
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c echo %YBr:~16,1%
  2⤵
  PID:2252
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c echo %YBr:~24,1%
  2⤵
  PID:2240
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c echo %YBr:~35,1%
  2⤵
  PID:1220
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c echo %YBr:~28,1%
  2⤵
  PID:2008
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c echo %YBr:~30,1%
  2⤵
  PID:2628
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c echo %YBr:~51,1%
  2⤵
  PID:3236
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c echo %YBr:~44,1%
  2⤵
  PID:316
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c echo %YBr:~13,1%
  2⤵
  PID:224
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c echo %YBr:~2,1%
  2⤵
  PID:2116
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c echo %YBr:~57,1%
  2⤵
  PID:4208
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c echo %YBr:~25,1%
  2⤵
  PID:2024
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c echo %YBr:~7,1%
  2⤵
  PID:408
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c echo %YBr:~16,1%
  2⤵
  PID:3508
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c echo %YBr:~17,1%
  2⤵
  PID:3996
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c echo %YBr:~48,1%
  2⤵
  PID:952
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c echo %YBr:~46,1%
  2⤵
  PID:1344
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c echo %YBr:~35,1%
  2⤵
  PID:4864
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c echo %YBr:~46,1%
  2⤵
  PID:1780
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c echo %YBr:~59,1%
  2⤵
  PID:3404
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c echo %YBr:~41,1%
  2⤵
  PID:2972
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c echo %YBr:~36,1%
  2⤵
  PID:3728
- C:\Windows\system32\net.exe
  net user Admin 0NcHtAwB83I9eBNkWtUgtP4miR2iyZP6F /times:friday,01:00-02:00 /active:no
  2⤵
  - System Time Discovery
  PID:3956
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 user Admin 0NcHtAwB83I9eBNkWtUgtP4miR2iyZP6F /times:friday,01:00-02:00 /active:no
    3⤵
    - System Time Discovery
    PID:2612
- C:\Windows\system32\net.exe
  net user Administrator 0NcHtAwB83I9eBNkWtUgtP4miR2iyZP6F /times:friday,01:00-02:00 /active:no
  2⤵
  - System Time Discovery
  PID:3220
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 user Administrator 0NcHtAwB83I9eBNkWtUgtP4miR2iyZP6F /times:friday,01:00-02:00 /active:no
    3⤵
    - System Time Discovery
    PID:3460
- C:\Windows\system32\net.exe
  net user DefaultAccount 0NcHtAwB83I9eBNkWtUgtP4miR2iyZP6F /times:friday,01:00-02:00 /active:no
  2⤵
  - System Time Discovery
  PID:4656
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 user DefaultAccount 0NcHtAwB83I9eBNkWtUgtP4miR2iyZP6F /times:friday,01:00-02:00 /active:no
    3⤵
    - System Time Discovery
    PID:3924
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c echo %YBr:~8,1%
  2⤵
  PID:3992
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c echo %YBr:~30,1%
  2⤵
  PID:4152
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c echo %YBr:~12,1%
  2⤵
  PID:1812
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c echo %YBr:~60,1%
  2⤵
  PID:5040
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c echo %YBr:~54,1%
  2⤵
  PID:412
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c echo %YBr:~2,1%
  2⤵
  PID:4896
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c echo %YBr:~49,1%
  2⤵
  PID:3292
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c echo %YBr:~33,1%
  2⤵
  PID:3984
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c echo %YBr:~37,1%
  2⤵
  PID:3788
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c echo %YBr:~2,1%
  2⤵
  PID:3804
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c echo %YBr:~49,1%
  2⤵
  PID:4828
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c echo %YBr:~2,1%
  2⤵
  PID:3900
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c echo %YBr:~23,1%
  2⤵
  PID:3280
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c echo %YBr:~1,1%
  2⤵
  PID:2192
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c echo %YBr:~55,1%
  2⤵
  PID:4724
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c echo %YBr:~50,1%
  2⤵
  PID:2076
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c echo %YBr:~12,1%
  2⤵
  PID:4984
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c echo %YBr:~14,1%
  2⤵
  PID:2680
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c echo %YBr:~7,1%
  2⤵
  PID:3216
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c echo %YBr:~6,1%
  2⤵
  PID:1212
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c echo %YBr:~52,1%
  2⤵
  PID:2724
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c echo %YBr:~13,1%
  2⤵
  PID:5060
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c echo %YBr:~33,1%
  2⤵
  PID:4476
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c echo %YBr:~2,1%
  2⤵
  PID:2188
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c echo %YBr:~36,1%
  2⤵
  PID:5036
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c echo %YBr:~61,1%
  2⤵
  PID:2376
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c echo %YBr:~30,1%
  2⤵
  PID:2140
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c echo %YBr:~61,1%
  2⤵
  PID:2996
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c echo %YBr:~37,1%
  2⤵
  PID:4136
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c echo %YBr:~31,1%
  2⤵
  PID:5108
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c echo %YBr:~43,1%
  2⤵
  PID:3116
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c echo %YBr:~26,1%
  2⤵
  PID:4316
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c echo %YBr:~4,1%
  2⤵
  PID:2564
- C:\Windows\system32\net.exe
  net user Guest 0NcHtAwB83I9eBNkWtUgtP4miR2iyZP6F /times:friday,01:00-02:00 /active:no
  2⤵
  - System Time Discovery
  PID:4860
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 user Guest 0NcHtAwB83I9eBNkWtUgtP4miR2iyZP6F /times:friday,01:00-02:00 /active:no
    3⤵
    - System Time Discovery
    PID:4144
- C:\Windows\system32\net.exe
  net user WDAGUtilityAccount 0NcHtAwB83I9eBNkWtUgtP4miR2iyZP6F /times:friday,01:00-02:00 /active:no
  2⤵
  - System Time Discovery
  PID:896
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 user WDAGUtilityAccount 0NcHtAwB83I9eBNkWtUgtP4miR2iyZP6F /times:friday,01:00-02:00 /active:no
    3⤵
    - System Time Discovery
    PID:3748
- C:\Windows\system32\net.exe
  net user 0NcHtAwB83I9eBNkWtUgtP4miR2iyZP6F /times:friday,01:00-02:00 /active:no
  2⤵
  - System Time Discovery
  PID:1336
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 user 0NcHtAwB83I9eBNkWtUgtP4miR2iyZP6F /times:friday,01:00-02:00 /active:no
    3⤵
    - System Time Discovery
    PID:4716
- C:\Windows\system32\reg.exe
  reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v CachedLogonsCount /t REG_SZ /d 0 /f
  2⤵
  PID:2584
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ver
  2⤵
  PID:4524
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c qwinsta
  2⤵
  PID:3944
- - C:\Windows\system32\qwinsta.exe
    qwinsta
    3⤵
    PID:4544
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo USERNAME"
  2⤵
  PID:4128
- C:\Windows\system32\findstr.exe
  findstr /xr "[1-9][0-9]* 0"
  2⤵
  PID:4104
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo ID"
  2⤵
  PID:1120
- C:\Windows\system32\findstr.exe
  findstr /xr "[1-9][0-9]* 0"
  2⤵
  PID:1724
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo 0"
  2⤵
  PID:4236
- C:\Windows\system32\findstr.exe
  findstr /xr "[1-9][0-9]* 0"
  2⤵
  PID:1404
- C:\Windows\system32\logoff.exe
  logoff 0
  2⤵
  PID:1484
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo Disc"
  2⤵
  PID:3160
- C:\Windows\system32\findstr.exe
  findstr /xr "[1-9][0-9]* 0"
  2⤵
  PID:2428
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo Admin"
  2⤵
  PID:4700
- C:\Windows\system32\findstr.exe
  findstr /xr "[1-9][0-9]* 0"
  2⤵
  PID:3784
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo 1"
  2⤵
  PID:4436
- C:\Windows\system32\findstr.exe
  findstr /xr "[1-9][0-9]* 0"
  2⤵
  PID:2588
- C:\Windows\system32\logoff.exe
  logoff 1
  2⤵
  PID:2952

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa3965055 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:4392

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4392-1-0x000001C998080000-0x000001C99812D000-memory.dmp

Download