9d05854c95c6afa68911bd28af12282185e0fe34f2e58fddbc503ab22d1508d7

Resubmissions

24/05/2026, 03:23

260524-dxz11aaz7t3

22/04/2026, 04:38

260422-e9eq9scz5v3

Analysis

max time kernel
150s
max time network
149s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
22/04/2026, 04:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
notesreg.bat
Size 5KB
Sample260422-e9eq9scz5v
SHA256 9d05854c95c6afa68911bd28af12282185e0fe34f2e58fddbc503ab22d1508d7
MD5 c6d0f67db6a7dbf1f9394d98c1e13670
SHA1 6b2bb5287f6c7a217ad3263926603b50fd7f9662
SHA512 d191c830c0b538073fa10f8c4e7a1bdab66dc70b6055a7f6d4fc179fad8653843fcd6f44250bd55d22f9e77d287c06e325591529fb02eed35be3d2c841664a4a
SSDEEP 96:Pcvhwi1QLYsvkPwGiN3xL3XAOg8+9jnO/hWiKrMyz6ab64bA14bF4biGwW/TiSNT:9iCkSkPwfDLV1yvGwW/TiAIfPDc
TLSH
T1B6C19E241D4605E64546C95DCB8AB1DF3D65FACFC301EE68F89D64C9AF810CB8E629F0
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

System Time Discovery 1 TTPs 12 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2324	net.exe
2576	net1.exe
1868	net1.exe
904	net1.exe
4852	net.exe
2276	net.exe
2904	net1.exe
1724	net.exe
1068	net.exe
2448	net1.exe
5112	net1.exe
1016	net.exe

Modifies data under HKEY_USERS 15 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = 99ebff004cc2ff000091f8000078d4000067c000003e9200001a6800f7630c00	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292114432"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292114432"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365268"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "240"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4290799360"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365268"	LogonUI.exe

Runs net.exe

Suspicious behavior: LoadsDriver 64 IoCs

pid	Process
5092	Process not Found
232	Process not Found
4068	Process not Found
236	Process not Found
240	Process not Found
2196	Process not Found
4816	Process not Found
1052	Process not Found
824	Process not Found
664	Process not Found
3856	Process not Found
616	Process not Found
4660	Process not Found
2436	Process not Found
1852	Process not Found
4824	Process not Found
1372	Process not Found
4180	Process not Found
3712	Process not Found
4888	Process not Found
3876	Process not Found
1760	Process not Found
1784	Process not Found
4432	Process not Found
904	Process not Found
4820	Process not Found
460	Process not Found
3316	Process not Found
4148	Process not Found
2308	Process not Found
4676	Process not Found
3948	Process not Found
2620	Process not Found
4508	Process not Found
3688	Process not Found
1900	Process not Found
3548	Process not Found
2028	Process not Found
2036	Process not Found
4728	Process not Found
2148	Process not Found
4332	Process not Found
3448	Process not Found
1636	Process not Found
3748	Process not Found
1680	Process not Found
2368	Process not Found
4428	Process not Found
468	Process not Found
4556	Process not Found
1832	Process not Found
2132	Process not Found
788	Process not Found
4664	Process not Found
556	Process not Found
4652	Process not Found
3344	Process not Found
3788	Process not Found
3108	Process not Found
832	Process not Found
3952	Process not Found
4328	Process not Found
5116	Process not Found
4464	Process not Found

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2940	LogonUI.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1060 wrote to memory of 2920	1060	cmd.exe	81
PID 1060 wrote to memory of 4884	1060	cmd.exe	82
PID 1060 wrote to memory of 1448	1060	cmd.exe	83
PID 1060 wrote to memory of 2300	1060	cmd.exe	84
PID 1060 wrote to memory of 2140	1060	cmd.exe	85
PID 1060 wrote to memory of 1016	1060	cmd.exe	86
PID 1060 wrote to memory of 2904	1060	cmd.exe	87
PID 1060 wrote to memory of 3368	1060	cmd.exe	88
PID 1060 wrote to memory of 4012	1060	cmd.exe	89
PID 1060 wrote to memory of 1684	1060	cmd.exe	90
PID 1060 wrote to memory of 3356	1060	cmd.exe	91
PID 1060 wrote to memory of 4540	1060	cmd.exe	92
PID 1060 wrote to memory of 2776	1060	cmd.exe	93
PID 1060 wrote to memory of 3056	1060	cmd.exe	94
PID 1060 wrote to memory of 696	1060	cmd.exe	95
PID 1060 wrote to memory of 3384	1060	cmd.exe	96
PID 1060 wrote to memory of 2900	1060	cmd.exe	97
PID 1060 wrote to memory of 588	1060	cmd.exe	98
PID 1060 wrote to memory of 3524	1060	cmd.exe	99
PID 1060 wrote to memory of 2552	1060	cmd.exe	100
PID 1060 wrote to memory of 4840	1060	cmd.exe	101
PID 1060 wrote to memory of 2392	1060	cmd.exe	102
PID 1060 wrote to memory of 1324	1060	cmd.exe	103
PID 1060 wrote to memory of 4520	1060	cmd.exe	104
PID 1060 wrote to memory of 4048	1060	cmd.exe	105
PID 1060 wrote to memory of 3360	1060	cmd.exe	106
PID 1060 wrote to memory of 2096	1060	cmd.exe	107
PID 1060 wrote to memory of 2588	1060	cmd.exe	108
PID 1060 wrote to memory of 3104	1060	cmd.exe	109
PID 1060 wrote to memory of 3868	1060	cmd.exe	110
PID 1060 wrote to memory of 4668	1060	cmd.exe	111
PID 1060 wrote to memory of 956	1060	cmd.exe	112
PID 1060 wrote to memory of 2336	1060	cmd.exe	113
PID 1060 wrote to memory of 1000	1060	cmd.exe	114
PID 1000 wrote to memory of 3848	1000	cmd.exe	115
PID 3848 wrote to memory of 4276	3848	net.exe	116
PID 1060 wrote to memory of 5000	1060	cmd.exe	117
PID 1060 wrote to memory of 4920	1060	cmd.exe	118
PID 1060 wrote to memory of 4860	1060	cmd.exe	119
PID 1060 wrote to memory of 1168	1060	cmd.exe	120
PID 1060 wrote to memory of 828	1060	cmd.exe	121
PID 1060 wrote to memory of 808	1060	cmd.exe	122
PID 1060 wrote to memory of 656	1060	cmd.exe	123
PID 1060 wrote to memory of 1200	1060	cmd.exe	124
PID 1060 wrote to memory of 856	1060	cmd.exe	125
PID 1060 wrote to memory of 4684	1060	cmd.exe	126
PID 1060 wrote to memory of 1376	1060	cmd.exe	127
PID 1060 wrote to memory of 4656	1060	cmd.exe	128
PID 1060 wrote to memory of 4476	1060	cmd.exe	129
PID 1060 wrote to memory of 3764	1060	cmd.exe	130
PID 1060 wrote to memory of 3260	1060	cmd.exe	131
PID 1060 wrote to memory of 3184	1060	cmd.exe	132
PID 1060 wrote to memory of 388	1060	cmd.exe	133
PID 1060 wrote to memory of 3024	1060	cmd.exe	134
PID 1060 wrote to memory of 4160	1060	cmd.exe	135
PID 1060 wrote to memory of 5068	1060	cmd.exe	136
PID 1060 wrote to memory of 4248	1060	cmd.exe	137
PID 1060 wrote to memory of 3664	1060	cmd.exe	138
PID 1060 wrote to memory of 3364	1060	cmd.exe	139
PID 1060 wrote to memory of 3648	1060	cmd.exe	140
PID 1060 wrote to memory of 5092	1060	cmd.exe	141
PID 1060 wrote to memory of 4068	1060	cmd.exe	142
PID 1060 wrote to memory of 240	1060	cmd.exe	143
PID 1060 wrote to memory of 4724	1060	cmd.exe	144

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\notesreg.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:1060
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c echo %YBr:~52,1%
  2⤵
  PID:2920
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c echo %YBr:~19,1%
  2⤵
  PID:4884
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c echo %YBr:~30,1%
  2⤵
  PID:1448
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c echo %YBr:~49,1%
  2⤵
  PID:2300
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c echo %YBr:~62,1%
  2⤵
  PID:2140
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c echo %YBr:~18,1%
  2⤵
  PID:1016
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c echo %YBr:~16,1%
  2⤵
  PID:2904
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c echo %YBr:~33,1%
  2⤵
  PID:3368
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c echo %YBr:~29,1%
  2⤵
  PID:4012
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c echo %YBr:~5,1%
  2⤵
  PID:1684
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c echo %YBr:~34,1%
  2⤵
  PID:3356
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c echo %YBr:~61,1%
  2⤵
  PID:4540
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c echo %YBr:~24,1%
  2⤵
  PID:2776
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c echo %YBr:~58,1%
  2⤵
  PID:3056
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c echo %YBr:~59,1%
  2⤵
  PID:696
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c echo %YBr:~39,1%
  2⤵
  PID:3384
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c echo %YBr:~60,1%
  2⤵
  PID:2900
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c echo %YBr:~46,1%
  2⤵
  PID:588
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c echo %YBr:~43,1%
  2⤵
  PID:3524
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c echo %YBr:~24,1%
  2⤵
  PID:2552
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c echo %YBr:~60,1%
  2⤵
  PID:4840
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c echo %YBr:~11,1%
  2⤵
  PID:2392
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c echo %YBr:~27,1%
  2⤵
  PID:1324
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c echo %YBr:~60,1%
  2⤵
  PID:4520
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c echo %YBr:~43,1%
  2⤵
  PID:4048
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c echo %YBr:~22,1%
  2⤵
  PID:3360
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c echo %YBr:~14,1%
  2⤵
  PID:2096
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c echo %YBr:~39,1%
  2⤵
  PID:2588
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c echo %YBr:~5,1%
  2⤵
  PID:3104
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c echo %YBr:~12,1%
  2⤵
  PID:3868
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c echo %YBr:~35,1%
  2⤵
  PID:4668
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c echo %YBr:~18,1%
  2⤵
  PID:956
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c echo %YBr:~5,1%
  2⤵
  PID:2336
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c net user
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1000
- - C:\Windows\system32\net.exe
    net user
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3848
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user
      4⤵
      PID:4276
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c echo %YBr:~57,1%
  2⤵
  PID:5000
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c echo %YBr:~12,1%
  2⤵
  PID:4920
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c echo %YBr:~16,1%
  2⤵
  PID:4860
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c echo %YBr:~60,1%
  2⤵
  PID:1168
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c echo %YBr:~42,1%
  2⤵
  PID:828
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c echo %YBr:~8,1%
  2⤵
  PID:808
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c echo %YBr:~26,1%
  2⤵
  PID:656
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c echo %YBr:~47,1%
  2⤵
  PID:1200
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c echo %YBr:~60,1%
  2⤵
  PID:856
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c echo %YBr:~44,1%
  2⤵
  PID:4684
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c echo %YBr:~54,1%
  2⤵
  PID:1376
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c echo %YBr:~25,1%
  2⤵
  PID:4656
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c echo %YBr:~46,1%
  2⤵
  PID:4476
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c echo %YBr:~18,1%
  2⤵
  PID:3764
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c echo %YBr:~18,1%
  2⤵
  PID:3260
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c echo %YBr:~51,1%
  2⤵
  PID:3184
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c echo %YBr:~49,1%
  2⤵
  PID:388
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c echo %YBr:~18,1%
  2⤵
  PID:3024
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c echo %YBr:~47,1%
  2⤵
  PID:4160
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c echo %YBr:~36,1%
  2⤵
  PID:5068
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c echo %YBr:~28,1%
  2⤵
  PID:4248
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c echo %YBr:~4,1%
  2⤵
  PID:3664
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c echo %YBr:~23,1%
  2⤵
  PID:3364
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c echo %YBr:~14,1%
  2⤵
  PID:3648
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c echo %YBr:~11,1%
  2⤵
  PID:5092
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c echo %YBr:~31,1%
  2⤵
  PID:4068
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c echo %YBr:~21,1%
  2⤵
  PID:240
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c echo %YBr:~3,1%
  2⤵
  PID:4724
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c echo %YBr:~56,1%
  2⤵
  PID:2760
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c echo %YBr:~55,1%
  2⤵
  PID:3668
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c echo %YBr:~57,1%
  2⤵
  PID:596
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c echo %YBr:~20,1%
  2⤵
  PID:2260
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c echo %YBr:~57,1%
  2⤵
  PID:1852
- C:\Windows\system32\net.exe
  net user Admin 0tEXECHOsqHDfI9y67N8URy8lB8RwoNfmJsf /times:friday,01:00-02:00 /active:no
  2⤵
  - System Time Discovery
  PID:2324
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 user Admin 0tEXECHOsqHDfI9y67N8URy8lB8RwoNfmJsf /times:friday,01:00-02:00 /active:no
    3⤵
    - System Time Discovery
    PID:2576
- C:\Windows\system32\net.exe
  net user Administrator 0tEXECHOsqHDfI9y67N8URy8lB8RwoNfmJsf /times:friday,01:00-02:00 /active:no
  2⤵
  - System Time Discovery
  PID:1724
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 user Administrator 0tEXECHOsqHDfI9y67N8URy8lB8RwoNfmJsf /times:friday,01:00-02:00 /active:no
    3⤵
    - System Time Discovery
    PID:1868
- C:\Windows\system32\net.exe
  net user DefaultAccount 0tEXECHOsqHDfI9y67N8URy8lB8RwoNfmJsf /times:friday,01:00-02:00 /active:no
  2⤵
  - System Time Discovery
  PID:1068
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 user DefaultAccount 0tEXECHOsqHDfI9y67N8URy8lB8RwoNfmJsf /times:friday,01:00-02:00 /active:no
    3⤵
    - System Time Discovery
    PID:904
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c echo %YBr:~37,1%
  2⤵
  PID:1664
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c echo %YBr:~3,1%
  2⤵
  PID:4204
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c echo %YBr:~48,1%
  2⤵
  PID:576
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c echo %YBr:~2,1%
  2⤵
  PID:5084
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c echo %YBr:~29,1%
  2⤵
  PID:4292
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c echo %YBr:~44,1%
  2⤵
  PID:2028
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c echo %YBr:~28,1%
  2⤵
  PID:4372
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c echo %YBr:~52,1%
  2⤵
  PID:4352
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c echo %YBr:~20,1%
  2⤵
  PID:2484
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c echo %YBr:~3,1%
  2⤵
  PID:2896
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c echo %YBr:~25,1%
  2⤵
  PID:3148
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c echo %YBr:~57,1%
  2⤵
  PID:1844
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c echo %YBr:~31,1%
  2⤵
  PID:1532
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c echo %YBr:~29,1%
  2⤵
  PID:1512
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c echo %YBr:~49,1%
  2⤵
  PID:4652
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c echo %YBr:~32,1%
  2⤵
  PID:3788
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c echo %YBr:~50,1%
  2⤵
  PID:832
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c echo %YBr:~21,1%
  2⤵
  PID:4328
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c echo %YBr:~34,1%
  2⤵
  PID:4464
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c echo %YBr:~53,1%
  2⤵
  PID:5036
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c echo %YBr:~48,1%
  2⤵
  PID:1400
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c echo %YBr:~54,1%
  2⤵
  PID:2472
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c echo %YBr:~12,1%
  2⤵
  PID:1044
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c echo %YBr:~34,1%
  2⤵
  PID:3512
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c echo %YBr:~43,1%
  2⤵
  PID:2184
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c echo %YBr:~40,1%
  2⤵
  PID:4716
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c echo %YBr:~14,1%
  2⤵
  PID:3624
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c echo %YBr:~61,1%
  2⤵
  PID:1156
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c echo %YBr:~14,1%
  2⤵
  PID:864
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c echo %YBr:~16,1%
  2⤵
  PID:4792
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c echo %YBr:~13,1%
  2⤵
  PID:4348
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c echo %YBr:~35,1%
  2⤵
  PID:5064
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c echo %YBr:~12,1%
  2⤵
  PID:5016
- C:\Windows\system32\net.exe
  net user Guest 0tEXECHOsqHDfI9y67N8URy8lB8RwoNfmJsf /times:friday,01:00-02:00 /active:no
  2⤵
  - System Time Discovery
  PID:4852
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 user Guest 0tEXECHOsqHDfI9y67N8URy8lB8RwoNfmJsf /times:friday,01:00-02:00 /active:no
    3⤵
    - System Time Discovery
    PID:2448
- C:\Windows\system32\net.exe
  net user WDAGUtilityAccount 0tEXECHOsqHDfI9y67N8URy8lB8RwoNfmJsf /times:friday,01:00-02:00 /active:no
  2⤵
  - System Time Discovery
  PID:2276
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 user WDAGUtilityAccount 0tEXECHOsqHDfI9y67N8URy8lB8RwoNfmJsf /times:friday,01:00-02:00 /active:no
    3⤵
    - System Time Discovery
    PID:5112
- C:\Windows\system32\net.exe
  net user 0tEXECHOsqHDfI9y67N8URy8lB8RwoNfmJsf /times:friday,01:00-02:00 /active:no
  2⤵
  - System Time Discovery
  PID:1016
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 user 0tEXECHOsqHDfI9y67N8URy8lB8RwoNfmJsf /times:friday,01:00-02:00 /active:no
    3⤵
    - System Time Discovery
    PID:2904
- C:\Windows\system32\reg.exe
  reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v CachedLogonsCount /t REG_SZ /d 0 /f
  2⤵
  PID:3368
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ver
  2⤵
  PID:4012
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c qwinsta
  2⤵
  PID:1684
- - C:\Windows\system32\qwinsta.exe
    qwinsta
    3⤵
    PID:3356
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo USERNAME"
  2⤵
  PID:784
- C:\Windows\system32\findstr.exe
  findstr /xr "[1-9][0-9]* 0"
  2⤵
  PID:2776
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo ID"
  2⤵
  PID:3972
- C:\Windows\system32\findstr.exe
  findstr /xr "[1-9][0-9]* 0"
  2⤵
  PID:696
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo 0"
  2⤵
  PID:2124
- C:\Windows\system32\findstr.exe
  findstr /xr "[1-9][0-9]* 0"
  2⤵
  PID:2900
- C:\Windows\system32\logoff.exe
  logoff 0
  2⤵
  PID:4128
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo Disc"
  2⤵
  PID:2372
- C:\Windows\system32\findstr.exe
  findstr /xr "[1-9][0-9]* 0"
  2⤵
  PID:2552
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo Admin"
  2⤵
  PID:4812
- C:\Windows\system32\findstr.exe
  findstr /xr "[1-9][0-9]* 0"
  2⤵
  PID:2392
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo 1"
  2⤵
  PID:2668
- C:\Windows\system32\findstr.exe
  findstr /xr "[1-9][0-9]* 0"
  2⤵
  PID:4520
- C:\Windows\system32\logoff.exe
  logoff 1
  2⤵
  PID:3360

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa39d7055 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:2940

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads