Overview

overview

8

Static

static

3

2026-06-30...lc.exe

windows10-2004-x64

8

2026-06-30...lc.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    132s
  • max time network
    126s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260629-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    01/07/2026, 00:19

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-06-30_1ddfc485cbf5192c87eed4037c950a32_icedid_njrat_stealc.exe
  • Size 5.1MB
  • Sample260701-amcaeaaz5p
  • SHA256 378b082b40ccca38d40ab858041faf14f7a427ccc8662f509b6dcd5e4fc6d5de
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
adwaredefense_evasiondiscoveryexecutionpersistenceransomwarespyware

Malware Config

Signatures

  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution
  • Executes dropped EXE 2 IoCs
  • Enumerates connected drives 3 TTPs 2 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Enumerates processes with tasklist 1 TTPs 58 IoCs
    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks SCSI registry key(s) 3 TTPs 62 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Delays execution with timeout.exe 58 IoCs
    defense_evasion
  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
    adwarespyware
  • Modifies registry class 38 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 52 IoCs
  • Suspicious use of SendNotifyMessage 43 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-06-30_1ddfc485cbf5192c87eed4037c950a32_icedid_njrat_stealc.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-06-30_1ddfc485cbf5192c87eed4037c950a32_icedid_njrat_stealc.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2204
    • C:\Windows\SYSTEM32\cmd.exe
      cmd.exe /C "schtasks /Create /TN "PeerCreator" /TR "C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe" /SC ONLOGON /RL HIGHEST /F >nul 2>nul"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2176
      • C:\Windows\system32\schtasks.exe
        schtasks /Create /TN "PeerCreator" /TR "C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe" /SC ONLOGON /RL HIGHEST /F
        3⤵
        • Scheduled Task/Job: Scheduled Task
        PID:3100
    • C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe
      "C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:1396
      • C:\Windows\SYSTEM32\cmd.exe
        cmd.exe /C "powershell -Command "Add-MpPreference -ExclusionPath $env:APPDATA""
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:3964
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell -Command "Add-MpPreference -ExclusionPath $env:APPDATA"
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:4500
      • C:\Windows\SYSTEM32\cmd.exe
        cmd.exe /C "for /l %i in () do (tasklist | find /i "PeerService.exe" >nul || (copy /y "C:\Users\Admin\AppData\Local\Temp\\chw.aof" "C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe" & start "" "C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe" & exit) & timeout /t 5 >nul)"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:3244
        • C:\Windows\system32\tasklist.exe
          tasklist
          4⤵
          • Enumerates processes with tasklist
          • Suspicious use of AdjustPrivilegeToken
          PID:1676
        • C:\Windows\system32\find.exe
          find /i "PeerService.exe"
          4⤵
            PID:4552
          • C:\Windows\system32\timeout.exe
            timeout /t 5
            4⤵
            • Delays execution with timeout.exe
            PID:5944
          • C:\Windows\system32\tasklist.exe
            tasklist
            4⤵
            • Enumerates processes with tasklist
            • Suspicious use of AdjustPrivilegeToken
            PID:5668
          • C:\Windows\system32\find.exe
            find /i "PeerService.exe"
            4⤵
              PID:6080
            • C:\Windows\system32\timeout.exe
              timeout /t 5
              4⤵
              • Delays execution with timeout.exe
              PID:2464
            • C:\Windows\system32\tasklist.exe
              tasklist
              4⤵
              • Enumerates processes with tasklist
              • Suspicious use of AdjustPrivilegeToken
              PID:4384
            • C:\Windows\system32\find.exe
              find /i "PeerService.exe"
              4⤵
                PID:2196
              • C:\Windows\system32\timeout.exe
                timeout /t 5
                4⤵
                • Delays execution with timeout.exe
                PID:4748
              • C:\Windows\system32\tasklist.exe
                tasklist
                4⤵
                • Enumerates processes with tasklist
                • Suspicious use of AdjustPrivilegeToken
                PID:4812
              • C:\Windows\system32\find.exe
                find /i "PeerService.exe"
                4⤵
                  PID:1992
                • C:\Windows\system32\timeout.exe
                  timeout /t 5
                  4⤵
                  • Delays execution with timeout.exe
                  PID:1556
                • C:\Windows\system32\tasklist.exe
                  tasklist
                  4⤵
                  • Enumerates processes with tasklist
                  • Suspicious use of AdjustPrivilegeToken
                  PID:1292
                • C:\Windows\system32\find.exe
                  find /i "PeerService.exe"
                  4⤵
                    PID:5808
                  • C:\Windows\system32\timeout.exe
                    timeout /t 5
                    4⤵
                    • Delays execution with timeout.exe
                    PID:600
                  • C:\Windows\system32\tasklist.exe
                    tasklist
                    4⤵
                    • Enumerates processes with tasklist
                    • Suspicious use of AdjustPrivilegeToken
                    PID:6084
                  • C:\Windows\system32\find.exe
                    find /i "PeerService.exe"
                    4⤵
                      PID:3632
                    • C:\Windows\system32\timeout.exe
                      timeout /t 5
                      4⤵
                      • Delays execution with timeout.exe
                      PID:3948
                    • C:\Windows\system32\tasklist.exe
                      tasklist
                      4⤵
                      • Enumerates processes with tasklist
                      • Suspicious use of AdjustPrivilegeToken
                      PID:5376
                    • C:\Windows\system32\find.exe
                      find /i "PeerService.exe"
                      4⤵
                        PID:4344
                      • C:\Windows\system32\timeout.exe
                        timeout /t 5
                        4⤵
                        • Delays execution with timeout.exe
                        PID:2400
                      • C:\Windows\system32\tasklist.exe
                        tasklist
                        4⤵
                        • Enumerates processes with tasklist
                        • Suspicious use of AdjustPrivilegeToken
                        PID:1392
                      • C:\Windows\system32\find.exe
                        find /i "PeerService.exe"
                        4⤵
                          PID:5940
                        • C:\Windows\system32\timeout.exe
                          timeout /t 5
                          4⤵
                          • Delays execution with timeout.exe
                          PID:2080
                        • C:\Windows\system32\tasklist.exe
                          tasklist
                          4⤵
                          • Enumerates processes with tasklist
                          • Suspicious use of AdjustPrivilegeToken
                          PID:912
                        • C:\Windows\system32\find.exe
                          find /i "PeerService.exe"
                          4⤵
                            PID:3020
                          • C:\Windows\system32\timeout.exe
                            timeout /t 5
                            4⤵
                            • Delays execution with timeout.exe
                            PID:4520
                          • C:\Windows\system32\tasklist.exe
                            tasklist
                            4⤵
                            • Enumerates processes with tasklist
                            • Suspicious use of AdjustPrivilegeToken
                            PID:928
                          • C:\Windows\system32\find.exe
                            find /i "PeerService.exe"
                            4⤵
                              PID:124
                            • C:\Windows\system32\timeout.exe
                              timeout /t 5
                              4⤵
                              • Delays execution with timeout.exe
                              PID:3248
                            • C:\Windows\system32\tasklist.exe
                              tasklist
                              4⤵
                              • Enumerates processes with tasklist
                              PID:5028
                            • C:\Windows\system32\find.exe
                              find /i "PeerService.exe"
                              4⤵
                                PID:4596
                              • C:\Windows\system32\timeout.exe
                                timeout /t 5
                                4⤵
                                • Delays execution with timeout.exe
                                PID:5896
                              • C:\Windows\system32\tasklist.exe
                                tasklist
                                4⤵
                                • Enumerates processes with tasklist
                                PID:3952
                              • C:\Windows\system32\find.exe
                                find /i "PeerService.exe"
                                4⤵
                                  PID:4428
                                • C:\Windows\system32\timeout.exe
                                  timeout /t 5
                                  4⤵
                                  • Delays execution with timeout.exe
                                  PID:4820
                                • C:\Windows\system32\tasklist.exe
                                  tasklist
                                  4⤵
                                  • Enumerates processes with tasklist
                                  PID:5372
                                • C:\Windows\system32\find.exe
                                  find /i "PeerService.exe"
                                  4⤵
                                    PID:1792
                                  • C:\Windows\system32\timeout.exe
                                    timeout /t 5
                                    4⤵
                                    • Delays execution with timeout.exe
                                    PID:2232
                                  • C:\Windows\system32\tasklist.exe
                                    tasklist
                                    4⤵
                                    • Enumerates processes with tasklist
                                    PID:4360
                                  • C:\Windows\system32\find.exe
                                    find /i "PeerService.exe"
                                    4⤵
                                      PID:4364
                                    • C:\Windows\system32\timeout.exe
                                      timeout /t 5
                                      4⤵
                                      • Delays execution with timeout.exe
                                      PID:4624
                                    • C:\Windows\system32\tasklist.exe
                                      tasklist
                                      4⤵
                                      • Enumerates processes with tasklist
                                      PID:3080
                                    • C:\Windows\system32\find.exe
                                      find /i "PeerService.exe"
                                      4⤵
                                        PID:3788
                                      • C:\Windows\system32\timeout.exe
                                        timeout /t 5
                                        4⤵
                                        • Delays execution with timeout.exe
                                        PID:4816
                                      • C:\Windows\system32\tasklist.exe
                                        tasklist
                                        4⤵
                                        • Enumerates processes with tasklist
                                        PID:2240
                                      • C:\Windows\system32\find.exe
                                        find /i "PeerService.exe"
                                        4⤵
                                          PID:2088
                                        • C:\Windows\system32\timeout.exe
                                          timeout /t 5
                                          4⤵
                                          • Delays execution with timeout.exe
                                          PID:2232
                                        • C:\Windows\system32\tasklist.exe
                                          tasklist
                                          4⤵
                                          • Enumerates processes with tasklist
                                          PID:3952
                                        • C:\Windows\system32\find.exe
                                          find /i "PeerService.exe"
                                          4⤵
                                            PID:3920
                                          • C:\Windows\system32\timeout.exe
                                            timeout /t 5
                                            4⤵
                                            • Delays execution with timeout.exe
                                            PID:3940
                                          • C:\Windows\system32\tasklist.exe
                                            tasklist
                                            4⤵
                                            • Enumerates processes with tasklist
                                            PID:360
                                          • C:\Windows\system32\find.exe
                                            find /i "PeerService.exe"
                                            4⤵
                                              PID:2876
                                            • C:\Windows\system32\timeout.exe
                                              timeout /t 5
                                              4⤵
                                              • Delays execution with timeout.exe
                                              PID:2420
                                            • C:\Windows\system32\tasklist.exe
                                              tasklist
                                              4⤵
                                              • Enumerates processes with tasklist
                                              PID:2412
                                            • C:\Windows\system32\find.exe
                                              find /i "PeerService.exe"
                                              4⤵
                                                PID:4136
                                              • C:\Windows\system32\timeout.exe
                                                timeout /t 5
                                                4⤵
                                                • Delays execution with timeout.exe
                                                PID:5184
                                              • C:\Windows\system32\tasklist.exe
                                                tasklist
                                                4⤵
                                                • Enumerates processes with tasklist
                                                PID:4404
                                              • C:\Windows\system32\find.exe
                                                find /i "PeerService.exe"
                                                4⤵
                                                  PID:4268
                                                • C:\Windows\system32\timeout.exe
                                                  timeout /t 5
                                                  4⤵
                                                  • Delays execution with timeout.exe
                                                  PID:2136
                                                • C:\Windows\system32\tasklist.exe
                                                  tasklist
                                                  4⤵
                                                  • Enumerates processes with tasklist
                                                  PID:4500
                                                • C:\Windows\system32\find.exe
                                                  find /i "PeerService.exe"
                                                  4⤵
                                                    PID:4832
                                                  • C:\Windows\system32\timeout.exe
                                                    timeout /t 5
                                                    4⤵
                                                    • Delays execution with timeout.exe
                                                    PID:2328
                                                  • C:\Windows\system32\tasklist.exe
                                                    tasklist
                                                    4⤵
                                                    • Enumerates processes with tasklist
                                                    PID:4292
                                                  • C:\Windows\system32\find.exe
                                                    find /i "PeerService.exe"
                                                    4⤵
                                                      PID:4216
                                                    • C:\Windows\system32\timeout.exe
                                                      timeout /t 5
                                                      4⤵
                                                      • Delays execution with timeout.exe
                                                      PID:556
                                                    • C:\Windows\system32\tasklist.exe
                                                      tasklist
                                                      4⤵
                                                      • Enumerates processes with tasklist
                                                      PID:5572
                                                    • C:\Windows\system32\find.exe
                                                      find /i "PeerService.exe"
                                                      4⤵
                                                        PID:5740
                                                      • C:\Windows\system32\timeout.exe
                                                        timeout /t 5
                                                        4⤵
                                                        • Delays execution with timeout.exe
                                                        PID:1280
                                                      • C:\Windows\system32\tasklist.exe
                                                        tasklist
                                                        4⤵
                                                        • Enumerates processes with tasklist
                                                        PID:3052
                                                      • C:\Windows\system32\find.exe
                                                        find /i "PeerService.exe"
                                                        4⤵
                                                          PID:5064
                                                        • C:\Windows\system32\timeout.exe
                                                          timeout /t 5
                                                          4⤵
                                                          • Delays execution with timeout.exe
                                                          PID:2212
                                                        • C:\Windows\system32\tasklist.exe
                                                          tasklist
                                                          4⤵
                                                          • Enumerates processes with tasklist
                                                          PID:6060
                                                        • C:\Windows\system32\find.exe
                                                          find /i "PeerService.exe"
                                                          4⤵
                                                            PID:3492
                                                          • C:\Windows\system32\timeout.exe
                                                            timeout /t 5
                                                            4⤵
                                                            • Delays execution with timeout.exe
                                                            PID:3952
                                                          • C:\Windows\system32\tasklist.exe
                                                            tasklist
                                                            4⤵
                                                            • Enumerates processes with tasklist
                                                            PID:3696
                                                          • C:\Windows\system32\find.exe
                                                            find /i "PeerService.exe"
                                                            4⤵
                                                              PID:3160
                                                            • C:\Windows\system32\timeout.exe
                                                              timeout /t 5
                                                              4⤵
                                                              • Delays execution with timeout.exe
                                                              PID:836
                                                            • C:\Windows\system32\tasklist.exe
                                                              tasklist
                                                              4⤵
                                                              • Enumerates processes with tasklist
                                                              PID:2792
                                                            • C:\Windows\system32\find.exe
                                                              find /i "PeerService.exe"
                                                              4⤵
                                                                PID:2808
                                                              • C:\Windows\system32\timeout.exe
                                                                timeout /t 5
                                                                4⤵
                                                                • Delays execution with timeout.exe
                                                                PID:4876
                                                              • C:\Windows\system32\tasklist.exe
                                                                tasklist
                                                                4⤵
                                                                • Enumerates processes with tasklist
                                                                PID:4152
                                                              • C:\Windows\system32\find.exe
                                                                find /i "PeerService.exe"
                                                                4⤵
                                                                  PID:2412
                                                                • C:\Windows\system32\timeout.exe
                                                                  timeout /t 5
                                                                  4⤵
                                                                  • Delays execution with timeout.exe
                                                                  PID:3496
                                                                • C:\Windows\system32\tasklist.exe
                                                                  tasklist
                                                                  4⤵
                                                                  • Enumerates processes with tasklist
                                                                  PID:4616
                                                                • C:\Windows\system32\find.exe
                                                                  find /i "PeerService.exe"
                                                                  4⤵
                                                                    PID:3528
                                                                  • C:\Windows\system32\timeout.exe
                                                                    timeout /t 5
                                                                    4⤵
                                                                    • Delays execution with timeout.exe
                                                                    PID:2448
                                                            • C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe
                                                              C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe
                                                              1⤵
                                                              • Executes dropped EXE
                                                              • Suspicious use of WriteProcessMemory
                                                              PID:2520
                                                              • C:\Windows\System32\cmd.exe
                                                                cmd.exe /C "powershell -Command "Add-MpPreference -ExclusionPath $env:APPDATA""
                                                                2⤵
                                                                • Suspicious use of WriteProcessMemory
                                                                PID:832
                                                                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                  powershell -Command "Add-MpPreference -ExclusionPath $env:APPDATA"
                                                                  3⤵
                                                                  • Command and Scripting Interpreter: PowerShell
                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                  PID:4604
                                                              • C:\Windows\System32\cmd.exe
                                                                cmd.exe /C "for /l %i in () do (tasklist | find /i "PeerService.exe" >nul || (copy /y "C:\Users\Admin\AppData\Local\Temp\\chw.aof" "C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe" & start "" "C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe" & exit) & timeout /t 5 >nul)"
                                                                2⤵
                                                                • Suspicious use of WriteProcessMemory
                                                                PID:1748
                                                                • C:\Windows\System32\tasklist.exe
                                                                  tasklist
                                                                  3⤵
                                                                  • Enumerates processes with tasklist
                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                  PID:1152
                                                                • C:\Windows\System32\find.exe
                                                                  find /i "PeerService.exe"
                                                                  3⤵
                                                                    PID:5104
                                                                  • C:\Windows\System32\timeout.exe
                                                                    timeout /t 5
                                                                    3⤵
                                                                    • Delays execution with timeout.exe
                                                                    PID:4868
                                                                  • C:\Windows\System32\tasklist.exe
                                                                    tasklist
                                                                    3⤵
                                                                    • Enumerates processes with tasklist
                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                    PID:5292
                                                                  • C:\Windows\System32\find.exe
                                                                    find /i "PeerService.exe"
                                                                    3⤵
                                                                      PID:4884
                                                                    • C:\Windows\System32\timeout.exe
                                                                      timeout /t 5
                                                                      3⤵
                                                                      • Delays execution with timeout.exe
                                                                      PID:4772
                                                                    • C:\Windows\System32\tasklist.exe
                                                                      tasklist
                                                                      3⤵
                                                                      • Enumerates processes with tasklist
                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                      PID:6076
                                                                    • C:\Windows\System32\find.exe
                                                                      find /i "PeerService.exe"
                                                                      3⤵
                                                                        PID:2020
                                                                      • C:\Windows\System32\timeout.exe
                                                                        timeout /t 5
                                                                        3⤵
                                                                        • Delays execution with timeout.exe
                                                                        PID:524
                                                                      • C:\Windows\System32\tasklist.exe
                                                                        tasklist
                                                                        3⤵
                                                                        • Enumerates processes with tasklist
                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                        PID:1220
                                                                      • C:\Windows\System32\find.exe
                                                                        find /i "PeerService.exe"
                                                                        3⤵
                                                                          PID:5680
                                                                        • C:\Windows\System32\timeout.exe
                                                                          timeout /t 5
                                                                          3⤵
                                                                          • Delays execution with timeout.exe
                                                                          PID:2348
                                                                        • C:\Windows\System32\tasklist.exe
                                                                          tasklist
                                                                          3⤵
                                                                          • Enumerates processes with tasklist
                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                          PID:2440
                                                                        • C:\Windows\System32\find.exe
                                                                          find /i "PeerService.exe"
                                                                          3⤵
                                                                            PID:3700
                                                                          • C:\Windows\System32\timeout.exe
                                                                            timeout /t 5
                                                                            3⤵
                                                                            • Delays execution with timeout.exe
                                                                            PID:2496
                                                                          • C:\Windows\System32\tasklist.exe
                                                                            tasklist
                                                                            3⤵
                                                                            • Enumerates processes with tasklist
                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                            PID:4512
                                                                          • C:\Windows\System32\find.exe
                                                                            find /i "PeerService.exe"
                                                                            3⤵
                                                                              PID:5452
                                                                            • C:\Windows\System32\timeout.exe
                                                                              timeout /t 5
                                                                              3⤵
                                                                              • Delays execution with timeout.exe
                                                                              PID:1048
                                                                            • C:\Windows\System32\tasklist.exe
                                                                              tasklist
                                                                              3⤵
                                                                              • Enumerates processes with tasklist
                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                              PID:5828
                                                                            • C:\Windows\System32\find.exe
                                                                              find /i "PeerService.exe"
                                                                              3⤵
                                                                                PID:2648
                                                                              • C:\Windows\System32\timeout.exe
                                                                                timeout /t 5
                                                                                3⤵
                                                                                • Delays execution with timeout.exe
                                                                                PID:5740
                                                                              • C:\Windows\System32\tasklist.exe
                                                                                tasklist
                                                                                3⤵
                                                                                • Enumerates processes with tasklist
                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                PID:4192
                                                                              • C:\Windows\System32\find.exe
                                                                                find /i "PeerService.exe"
                                                                                3⤵
                                                                                  PID:1028
                                                                                • C:\Windows\System32\timeout.exe
                                                                                  timeout /t 5
                                                                                  3⤵
                                                                                  • Delays execution with timeout.exe
                                                                                  PID:3084
                                                                                • C:\Windows\System32\tasklist.exe
                                                                                  tasklist
                                                                                  3⤵
                                                                                  • Enumerates processes with tasklist
                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                  PID:5912
                                                                                • C:\Windows\System32\find.exe
                                                                                  find /i "PeerService.exe"
                                                                                  3⤵
                                                                                    PID:5232
                                                                                  • C:\Windows\System32\timeout.exe
                                                                                    timeout /t 5
                                                                                    3⤵
                                                                                    • Delays execution with timeout.exe
                                                                                    PID:1116
                                                                                  • C:\Windows\System32\tasklist.exe
                                                                                    tasklist
                                                                                    3⤵
                                                                                    • Enumerates processes with tasklist
                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                    PID:3904
                                                                                  • C:\Windows\System32\find.exe
                                                                                    find /i "PeerService.exe"
                                                                                    3⤵
                                                                                      PID:556
                                                                                    • C:\Windows\System32\timeout.exe
                                                                                      timeout /t 5
                                                                                      3⤵
                                                                                      • Delays execution with timeout.exe
                                                                                      PID:364
                                                                                    • C:\Windows\System32\tasklist.exe
                                                                                      tasklist
                                                                                      3⤵
                                                                                      • Enumerates processes with tasklist
                                                                                      PID:2172
                                                                                    • C:\Windows\System32\find.exe
                                                                                      find /i "PeerService.exe"
                                                                                      3⤵
                                                                                        PID:4120
                                                                                      • C:\Windows\System32\timeout.exe
                                                                                        timeout /t 5
                                                                                        3⤵
                                                                                        • Delays execution with timeout.exe
                                                                                        PID:2432
                                                                                      • C:\Windows\System32\tasklist.exe
                                                                                        tasklist
                                                                                        3⤵
                                                                                        • Enumerates processes with tasklist
                                                                                        PID:4664
                                                                                      • C:\Windows\System32\find.exe
                                                                                        find /i "PeerService.exe"
                                                                                        3⤵
                                                                                          PID:1364
                                                                                        • C:\Windows\System32\timeout.exe
                                                                                          timeout /t 5
                                                                                          3⤵
                                                                                          • Delays execution with timeout.exe
                                                                                          PID:3400
                                                                                        • C:\Windows\System32\tasklist.exe
                                                                                          tasklist
                                                                                          3⤵
                                                                                          • Enumerates processes with tasklist
                                                                                          PID:3396
                                                                                        • C:\Windows\System32\find.exe
                                                                                          find /i "PeerService.exe"
                                                                                          3⤵
                                                                                            PID:5900
                                                                                          • C:\Windows\System32\timeout.exe
                                                                                            timeout /t 5
                                                                                            3⤵
                                                                                            • Delays execution with timeout.exe
                                                                                            PID:3004
                                                                                          • C:\Windows\System32\tasklist.exe
                                                                                            tasklist
                                                                                            3⤵
                                                                                            • Enumerates processes with tasklist
                                                                                            PID:5596
                                                                                          • C:\Windows\System32\find.exe
                                                                                            find /i "PeerService.exe"
                                                                                            3⤵
                                                                                              PID:5920
                                                                                            • C:\Windows\System32\timeout.exe
                                                                                              timeout /t 5
                                                                                              3⤵
                                                                                              • Delays execution with timeout.exe
                                                                                              PID:4672
                                                                                            • C:\Windows\System32\tasklist.exe
                                                                                              tasklist
                                                                                              3⤵
                                                                                              • Enumerates processes with tasklist
                                                                                              PID:1916
                                                                                            • C:\Windows\System32\find.exe
                                                                                              find /i "PeerService.exe"
                                                                                              3⤵
                                                                                                PID:6124
                                                                                              • C:\Windows\System32\timeout.exe
                                                                                                timeout /t 5
                                                                                                3⤵
                                                                                                • Delays execution with timeout.exe
                                                                                                PID:5848
                                                                                              • C:\Windows\System32\tasklist.exe
                                                                                                tasklist
                                                                                                3⤵
                                                                                                • Enumerates processes with tasklist
                                                                                                PID:1680
                                                                                              • C:\Windows\System32\find.exe
                                                                                                find /i "PeerService.exe"
                                                                                                3⤵
                                                                                                  PID:5960
                                                                                                • C:\Windows\System32\timeout.exe
                                                                                                  timeout /t 5
                                                                                                  3⤵
                                                                                                  • Delays execution with timeout.exe
                                                                                                  PID:5552
                                                                                                • C:\Windows\System32\tasklist.exe
                                                                                                  tasklist
                                                                                                  3⤵
                                                                                                  • Enumerates processes with tasklist
                                                                                                  PID:5852
                                                                                                • C:\Windows\System32\find.exe
                                                                                                  find /i "PeerService.exe"
                                                                                                  3⤵
                                                                                                    PID:3396
                                                                                                  • C:\Windows\System32\timeout.exe
                                                                                                    timeout /t 5
                                                                                                    3⤵
                                                                                                    • Delays execution with timeout.exe
                                                                                                    PID:5592
                                                                                                  • C:\Windows\System32\tasklist.exe
                                                                                                    tasklist
                                                                                                    3⤵
                                                                                                    • Enumerates processes with tasklist
                                                                                                    PID:4920
                                                                                                  • C:\Windows\System32\find.exe
                                                                                                    find /i "PeerService.exe"
                                                                                                    3⤵
                                                                                                      PID:4164
                                                                                                    • C:\Windows\System32\timeout.exe
                                                                                                      timeout /t 5
                                                                                                      3⤵
                                                                                                      • Delays execution with timeout.exe
                                                                                                      PID:4220
                                                                                                    • C:\Windows\System32\tasklist.exe
                                                                                                      tasklist
                                                                                                      3⤵
                                                                                                      • Enumerates processes with tasklist
                                                                                                      PID:3016
                                                                                                    • C:\Windows\System32\find.exe
                                                                                                      find /i "PeerService.exe"
                                                                                                      3⤵
                                                                                                        PID:3328
                                                                                                      • C:\Windows\System32\timeout.exe
                                                                                                        timeout /t 5
                                                                                                        3⤵
                                                                                                        • Delays execution with timeout.exe
                                                                                                        PID:4352
                                                                                                      • C:\Windows\System32\tasklist.exe
                                                                                                        tasklist
                                                                                                        3⤵
                                                                                                        • Enumerates processes with tasklist
                                                                                                        PID:5568
                                                                                                      • C:\Windows\System32\find.exe
                                                                                                        find /i "PeerService.exe"
                                                                                                        3⤵
                                                                                                          PID:4504
                                                                                                        • C:\Windows\System32\timeout.exe
                                                                                                          timeout /t 5
                                                                                                          3⤵
                                                                                                          • Delays execution with timeout.exe
                                                                                                          PID:5088
                                                                                                        • C:\Windows\System32\tasklist.exe
                                                                                                          tasklist
                                                                                                          3⤵
                                                                                                          • Enumerates processes with tasklist
                                                                                                          PID:2676
                                                                                                        • C:\Windows\System32\find.exe
                                                                                                          find /i "PeerService.exe"
                                                                                                          3⤵
                                                                                                            PID:6032
                                                                                                          • C:\Windows\System32\timeout.exe
                                                                                                            timeout /t 5
                                                                                                            3⤵
                                                                                                            • Delays execution with timeout.exe
                                                                                                            PID:2848
                                                                                                          • C:\Windows\System32\tasklist.exe
                                                                                                            tasklist
                                                                                                            3⤵
                                                                                                            • Enumerates processes with tasklist
                                                                                                            PID:4640
                                                                                                          • C:\Windows\System32\find.exe
                                                                                                            find /i "PeerService.exe"
                                                                                                            3⤵
                                                                                                              PID:4624
                                                                                                            • C:\Windows\System32\timeout.exe
                                                                                                              timeout /t 5
                                                                                                              3⤵
                                                                                                              • Delays execution with timeout.exe
                                                                                                              PID:1832
                                                                                                            • C:\Windows\System32\tasklist.exe
                                                                                                              tasklist
                                                                                                              3⤵
                                                                                                              • Enumerates processes with tasklist
                                                                                                              PID:4300
                                                                                                            • C:\Windows\System32\find.exe
                                                                                                              find /i "PeerService.exe"
                                                                                                              3⤵
                                                                                                                PID:5856
                                                                                                              • C:\Windows\System32\timeout.exe
                                                                                                                timeout /t 5
                                                                                                                3⤵
                                                                                                                • Delays execution with timeout.exe
                                                                                                                PID:2984
                                                                                                              • C:\Windows\System32\tasklist.exe
                                                                                                                tasklist
                                                                                                                3⤵
                                                                                                                • Enumerates processes with tasklist
                                                                                                                PID:3984
                                                                                                              • C:\Windows\System32\find.exe
                                                                                                                find /i "PeerService.exe"
                                                                                                                3⤵
                                                                                                                  PID:364
                                                                                                                • C:\Windows\System32\timeout.exe
                                                                                                                  timeout /t 5
                                                                                                                  3⤵
                                                                                                                  • Delays execution with timeout.exe
                                                                                                                  PID:1072
                                                                                                                • C:\Windows\System32\tasklist.exe
                                                                                                                  tasklist
                                                                                                                  3⤵
                                                                                                                  • Enumerates processes with tasklist
                                                                                                                  PID:5552
                                                                                                                • C:\Windows\System32\find.exe
                                                                                                                  find /i "PeerService.exe"
                                                                                                                  3⤵
                                                                                                                    PID:2484
                                                                                                                  • C:\Windows\System32\timeout.exe
                                                                                                                    timeout /t 5
                                                                                                                    3⤵
                                                                                                                    • Delays execution with timeout.exe
                                                                                                                    PID:1792
                                                                                                                  • C:\Windows\System32\tasklist.exe
                                                                                                                    tasklist
                                                                                                                    3⤵
                                                                                                                    • Enumerates processes with tasklist
                                                                                                                    PID:5852
                                                                                                                  • C:\Windows\System32\find.exe
                                                                                                                    find /i "PeerService.exe"
                                                                                                                    3⤵
                                                                                                                      PID:6004
                                                                                                                    • C:\Windows\System32\timeout.exe
                                                                                                                      timeout /t 5
                                                                                                                      3⤵
                                                                                                                      • Delays execution with timeout.exe
                                                                                                                      PID:4196
                                                                                                                    • C:\Windows\System32\tasklist.exe
                                                                                                                      tasklist
                                                                                                                      3⤵
                                                                                                                      • Enumerates processes with tasklist
                                                                                                                      PID:4164
                                                                                                                    • C:\Windows\System32\find.exe
                                                                                                                      find /i "PeerService.exe"
                                                                                                                      3⤵
                                                                                                                        PID:3480
                                                                                                                      • C:\Windows\System32\timeout.exe
                                                                                                                        timeout /t 5
                                                                                                                        3⤵
                                                                                                                        • Delays execution with timeout.exe
                                                                                                                        PID:2356
                                                                                                                      • C:\Windows\System32\tasklist.exe
                                                                                                                        tasklist
                                                                                                                        3⤵
                                                                                                                        • Enumerates processes with tasklist
                                                                                                                        PID:3644
                                                                                                                      • C:\Windows\System32\find.exe
                                                                                                                        find /i "PeerService.exe"
                                                                                                                        3⤵
                                                                                                                          PID:3312
                                                                                                                        • C:\Windows\System32\timeout.exe
                                                                                                                          timeout /t 5
                                                                                                                          3⤵
                                                                                                                          • Delays execution with timeout.exe
                                                                                                                          PID:3580
                                                                                                                        • C:\Windows\System32\tasklist.exe
                                                                                                                          tasklist
                                                                                                                          3⤵
                                                                                                                          • Enumerates processes with tasklist
                                                                                                                          PID:4112
                                                                                                                        • C:\Windows\System32\find.exe
                                                                                                                          find /i "PeerService.exe"
                                                                                                                          3⤵
                                                                                                                            PID:1240
                                                                                                                          • C:\Windows\System32\timeout.exe
                                                                                                                            timeout /t 5
                                                                                                                            3⤵
                                                                                                                            • Delays execution with timeout.exe
                                                                                                                            PID:4360
                                                                                                                      • C:\Windows\system32\sihost.exe
                                                                                                                        sihost.exe
                                                                                                                        1⤵
                                                                                                                        • Suspicious use of FindShellTrayWindow
                                                                                                                        PID:5500
                                                                                                                        • C:\Windows\explorer.exe
                                                                                                                          explorer.exe /LOADSAVEDWINDOWS
                                                                                                                          2⤵
                                                                                                                          • Boot or Logon Autostart Execution: Active Setup
                                                                                                                          • Enumerates connected drives
                                                                                                                          • Checks SCSI registry key(s)
                                                                                                                          • Modifies Internet Explorer settings
                                                                                                                          • Modifies registry class
                                                                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                                                                          • Suspicious use of FindShellTrayWindow
                                                                                                                          • Suspicious use of SendNotifyMessage
                                                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                                                          PID:804
                                                                                                                      • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
                                                                                                                        "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
                                                                                                                        1⤵
                                                                                                                        • Modifies registry class
                                                                                                                        • Suspicious use of SetWindowsHookEx
                                                                                                                        PID:1684
                                                                                                                      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                                        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                                        1⤵
                                                                                                                        • Modifies registry class
                                                                                                                        • Suspicious use of SetWindowsHookEx
                                                                                                                        PID:1768

                                                                                                                      Network

                                                                                                                            MITRE ATT&CK Enterprise v16

                                                                                                                            Replay Monitor

                                                                                                                            Loading Replay Monitor...

                                                                                                                            Downloads

                                                                                                                            StartupProfileData-NonInteractive
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                            • Size 1KB
                                                                                                                            • SHA256 435471b87a1a97b0e29f7d5dd0878e63031511f063629d7e750852c068e7c4f5
                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                            Submit Download

                                                                                                                            prep_Activatable Class_Hermes_perf.cache
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
                                                                                                                            • Size 603B
                                                                                                                            • SHA256 76051c7134ef5b2b172ae67cc7317ea11daedcc3d11f55c52922e505f501568b
                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                            Submit Download

                                                                                                                            __PSScriptPolicyTest_c1eyxe1c.oth.ps1
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_c1eyxe1c.oth.ps1
                                                                                                                            • Size 60B
                                                                                                                            • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                            Submit Download

                                                                                                                            PeerService.exe
                                                                                                                            • Path C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe
                                                                                                                            • Size 6.3MB
                                                                                                                            • SHA256 3cb88be331bc304d393af43438311bd06c37b8bba18364877a62f60c8bed7278
                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                            Submit Download

                                                                                                                            memory/1684-47-0x000001C8801E0000-0x000001C8802E0000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/1684-60-0x000001C883D70000-0x000001C883D90000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/1684-55-0x000001C893E70000-0x000001C893F70000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/1684-53-0x000001C883A30000-0x000001C883A50000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/1684-70-0x000001C894230000-0x000001C894250000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/1768-194-0x000001E1ADEA0000-0x000001E1ADF74000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/1768-193-0x000001E271000000-0x000001E2712BC000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/4604-20-0x000001F763C00000-0x000001F763CB2000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/4604-23-0x000001F763FD0000-0x000001F763FDA000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/4604-19-0x000001F763BE0000-0x000001F763BFE000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/4604-12-0x000001F763B40000-0x000001F763B62000-memory.dmp
                                                                                                                            Download