2798dad008f62aace1841edfb43146147a9cade388c419c96da788fcaa2f76bc

Analysis

geolocation tags

nanew-jerseynorth-americaunited-statesususa
max time kernel
898s
max time network
423s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
20/07/2026, 02:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
MrsMajor-main/WinLogon.bat
Size 117B
Sample260720-cgp1escs8m
SHA256 2798dad008f62aace1841edfb43146147a9cade388c419c96da788fcaa2f76bc
MD5 870bce376c1b71365390a9e9aefb9a33
SHA1 176fdbdb8e5795fb5fddc81b2b4e1d9677779786
SHA512 f17c9898f81387daf42c9b858f507889919474ac2a17f96fc6d4606be94327e0b941b23a3ccc3f4af92b8abc0522e94745616da0564cdef1c3f20ee17ee31f53
TLSH
T180B092048F89D551B01630809321B550832164E4271B94B353DAE30B6183EEE8726F98
MD5 SHA1 SHA512 TLSH

Score

5^/10

execution

Malware Config

Signatures

Executes a VBScript file via the Windows Script Host. 1 TTPs 64 IoCs

execution

Visual Basic

T1059.005

pid	Process
3256	wscript.exe
2632	wscript.exe
3984	wscript.exe
4828	wscript.exe
5204	wscript.exe
4300	wscript.exe
4324	wscript.exe
3428	wscript.exe
2180	wscript.exe
3388	wscript.exe
3972	wscript.exe
1184	wscript.exe
3732	wscript.exe
2236	wscript.exe
4072	wscript.exe
5456	wscript.exe
4428	wscript.exe
1484	wscript.exe
5356	wscript.exe
1912	wscript.exe
5696	wscript.exe
5624	wscript.exe
4496	wscript.exe
5616	wscript.exe
4228	wscript.exe
3204	wscript.exe
828	wscript.exe
5332	wscript.exe
1132	wscript.exe
208	wscript.exe
3760	wscript.exe
5808	wscript.exe
4848	wscript.exe
5860	wscript.exe
3256	wscript.exe
4764	wscript.exe
5136	wscript.exe
5444	wscript.exe
2568	wscript.exe
5164	wscript.exe
1464	wscript.exe
1528	wscript.exe
5480	wscript.exe
312	wscript.exe
2388	wscript.exe
3864	wscript.exe
5772	wscript.exe
2648	wscript.exe
1732	wscript.exe
6124	wscript.exe
4004	wscript.exe
2104	wscript.exe
5896	wscript.exe
1988	wscript.exe
2956	wscript.exe
6028	wscript.exe
6004	wscript.exe
5296	wscript.exe
3048	wscript.exe
5560	wscript.exe
2496	wscript.exe
952	wscript.exe
2184	wscript.exe
5032	wscript.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4376	cmd.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4376 wrote to memory of 3128	4376	cmd.exe	86
PID 4376 wrote to memory of 4828	4376	cmd.exe	92
PID 4376 wrote to memory of 5184	4376	cmd.exe	96
PID 4376 wrote to memory of 1940	4376	cmd.exe	97
PID 4376 wrote to memory of 3920	4376	cmd.exe	98
PID 4376 wrote to memory of 4004	4376	cmd.exe	102
PID 4376 wrote to memory of 3728	4376	cmd.exe	103
PID 4376 wrote to memory of 4788	4376	cmd.exe	104
PID 4376 wrote to memory of 2568	4376	cmd.exe	105
PID 4376 wrote to memory of 5880	4376	cmd.exe	106
PID 4376 wrote to memory of 1892	4376	cmd.exe	108
PID 4376 wrote to memory of 2236	4376	cmd.exe	109
PID 4376 wrote to memory of 5356	4376	cmd.exe	110
PID 4376 wrote to memory of 5164	4376	cmd.exe	111
PID 4376 wrote to memory of 3608	4376	cmd.exe	112
PID 4376 wrote to memory of 5568	4376	cmd.exe	113
PID 4376 wrote to memory of 4228	4376	cmd.exe	114
PID 4376 wrote to memory of 2180	4376	cmd.exe	115
PID 4376 wrote to memory of 5520	4376	cmd.exe	116
PID 4376 wrote to memory of 952	4376	cmd.exe	117
PID 4376 wrote to memory of 2104	4376	cmd.exe	118
PID 4376 wrote to memory of 5168	4376	cmd.exe	119
PID 4376 wrote to memory of 4616	4376	cmd.exe	120
PID 4376 wrote to memory of 2020	4376	cmd.exe	121
PID 4376 wrote to memory of 5896	4376	cmd.exe	122
PID 4376 wrote to memory of 3204	4376	cmd.exe	123
PID 4376 wrote to memory of 828	4376	cmd.exe	124
PID 4376 wrote to memory of 5696	4376	cmd.exe	125
PID 4376 wrote to memory of 3256	4376	cmd.exe	126
PID 4376 wrote to memory of 1336	4376	cmd.exe	127
PID 4376 wrote to memory of 5204	4376	cmd.exe	128
PID 4376 wrote to memory of 456	4376	cmd.exe	129
PID 4376 wrote to memory of 1912	4376	cmd.exe	130
PID 4376 wrote to memory of 2664	4376	cmd.exe	131
PID 4376 wrote to memory of 5296	4376	cmd.exe	132
PID 4376 wrote to memory of 3388	4376	cmd.exe	133
PID 4376 wrote to memory of 4072	4376	cmd.exe	134
PID 4376 wrote to memory of 5624	4376	cmd.exe	135
PID 4376 wrote to memory of 5456	4376	cmd.exe	136
PID 4376 wrote to memory of 6004	4376	cmd.exe	137
PID 4376 wrote to memory of 5332	4376	cmd.exe	138
PID 4376 wrote to memory of 4432	4376	cmd.exe	139
PID 4376 wrote to memory of 4428	4376	cmd.exe	140
PID 4376 wrote to memory of 4300	4376	cmd.exe	141
PID 4376 wrote to memory of 4956	4376	cmd.exe	142
PID 4376 wrote to memory of 4288	4376	cmd.exe	143
PID 4376 wrote to memory of 4480	4376	cmd.exe	144
PID 4376 wrote to memory of 2668	4376	cmd.exe	145
PID 4376 wrote to memory of 2404	4376	cmd.exe	146
PID 4376 wrote to memory of 3048	4376	cmd.exe	147
PID 4376 wrote to memory of 4324	4376	cmd.exe	148
PID 4376 wrote to memory of 4828	4376	cmd.exe	149
PID 4376 wrote to memory of 3216	4376	cmd.exe	150
PID 4376 wrote to memory of 4848	4376	cmd.exe	151
PID 4376 wrote to memory of 2424	4376	cmd.exe	152
PID 4376 wrote to memory of 5860	4376	cmd.exe	153
PID 4376 wrote to memory of 5416	4376	cmd.exe	154
PID 4376 wrote to memory of 3948	4376	cmd.exe	155
PID 4376 wrote to memory of 5320	4376	cmd.exe	156
PID 4376 wrote to memory of 4596	4376	cmd.exe	157
PID 4376 wrote to memory of 1464	4376	cmd.exe	158
PID 4376 wrote to memory of 1528	4376	cmd.exe	159
PID 4376 wrote to memory of 5560	4376	cmd.exe	160
PID 4376 wrote to memory of 684	4376	cmd.exe	161

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\MrsMajor-main\WinLogon.bat"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4376
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\CPUUsage.vbs"
  2⤵
  PID:3128
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\reStart.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  PID:4828
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\CPUUsage.vbs"
  2⤵
  PID:5184
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\reStart.vbs"
  2⤵
  PID:1940
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\CPUUsage.vbs"
  2⤵
  PID:3920
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\reStart.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  PID:4004
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\CPUUsage.vbs"
  2⤵
  PID:3728
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\reStart.vbs"
  2⤵
  PID:4788
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\CPUUsage.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  PID:2568
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\reStart.vbs"
  2⤵
  PID:5880
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\CPUUsage.vbs"
  2⤵
  PID:1892
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\reStart.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  PID:2236
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\CPUUsage.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  PID:5356
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\reStart.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  PID:5164
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\CPUUsage.vbs"
  2⤵
  PID:3608
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\reStart.vbs"
  2⤵
  PID:5568
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\CPUUsage.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  PID:4228
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\reStart.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  PID:2180
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\CPUUsage.vbs"
  2⤵
  PID:5520
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\reStart.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  PID:952
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\CPUUsage.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  PID:2104
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\reStart.vbs"
  2⤵
  PID:5168
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\CPUUsage.vbs"
  2⤵
  PID:4616
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\reStart.vbs"
  2⤵
  PID:2020
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\CPUUsage.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  PID:5896
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\reStart.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  PID:3204
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\CPUUsage.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  PID:828
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\reStart.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  PID:5696
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\CPUUsage.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  PID:3256
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\reStart.vbs"
  2⤵
  PID:1336
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\CPUUsage.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  PID:5204
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\reStart.vbs"
  2⤵
  PID:456
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\CPUUsage.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  PID:1912
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\reStart.vbs"
  2⤵
  PID:2664
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\CPUUsage.vbs"
  2⤵
  PID:5296
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\reStart.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  PID:3388
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\CPUUsage.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  PID:4072
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\reStart.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  PID:5624
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\CPUUsage.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  PID:5456
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\reStart.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  PID:6004
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\CPUUsage.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  PID:5332
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\reStart.vbs"
  2⤵
  PID:4432
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\CPUUsage.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  PID:4428
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\reStart.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  PID:4300
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\CPUUsage.vbs"
  2⤵
  PID:4956
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\reStart.vbs"
  2⤵
  PID:4288
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\CPUUsage.vbs"
  2⤵
  PID:4480
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\reStart.vbs"
  2⤵
  PID:2668
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\CPUUsage.vbs"
  2⤵
  PID:2404
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\reStart.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  PID:3048
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\CPUUsage.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  PID:4324
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\reStart.vbs"
  2⤵
  PID:4828
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\CPUUsage.vbs"
  2⤵
  PID:3216
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\reStart.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  PID:4848
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\CPUUsage.vbs"
  2⤵
  PID:2424
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\reStart.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  PID:5860
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\CPUUsage.vbs"
  2⤵
  PID:5416
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\reStart.vbs"
  2⤵
  PID:3948
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\CPUUsage.vbs"
  2⤵
  PID:5320
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\reStart.vbs"
  2⤵
  PID:4596
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\CPUUsage.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  PID:1464
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\reStart.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  PID:1528
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\CPUUsage.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  PID:5560
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\reStart.vbs"
  2⤵
  PID:684
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\CPUUsage.vbs"
  2⤵
  PID:2472
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\reStart.vbs"
  2⤵
  PID:1968
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\CPUUsage.vbs"
  2⤵
  PID:4456
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\reStart.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  PID:2184
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\CPUUsage.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  PID:5032
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\reStart.vbs"
  2⤵
  PID:1112
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\CPUUsage.vbs"
  2⤵
  PID:3656
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\reStart.vbs"
  2⤵
  PID:3796
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\CPUUsage.vbs"
  2⤵
  PID:860
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\reStart.vbs"
  2⤵
  PID:2416
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\CPUUsage.vbs"
  2⤵
  PID:1056
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\reStart.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  PID:5772
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\CPUUsage.vbs"
  2⤵
  PID:4608
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\reStart.vbs"
  2⤵
  PID:3572
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\CPUUsage.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  PID:2648
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\reStart.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  PID:1988
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\CPUUsage.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  PID:1484
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\reStart.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  PID:5480
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\CPUUsage.vbs"
  2⤵
  PID:5568
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\reStart.vbs"
  2⤵
  PID:5004
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\CPUUsage.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  PID:3428
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\reStart.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  PID:1132
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\CPUUsage.vbs"
  2⤵
  PID:5352
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\reStart.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  PID:2632
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\CPUUsage.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  PID:1732
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\reStart.vbs"
  2⤵
  PID:1116
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\CPUUsage.vbs"
  2⤵
  PID:5292
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\reStart.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  PID:208
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\CPUUsage.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  PID:3760
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\reStart.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  PID:5808
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\CPUUsage.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  PID:3984
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\reStart.vbs"
  2⤵
  PID:1772
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\CPUUsage.vbs"
  2⤵
  PID:1392
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\reStart.vbs"
  2⤵
  PID:5908
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\CPUUsage.vbs"
  2⤵
  PID:3476
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\reStart.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  PID:2496
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\CPUUsage.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  PID:312
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\reStart.vbs"
  2⤵
  PID:828
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\CPUUsage.vbs"
  2⤵
  PID:5696
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\reStart.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  PID:3256
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\CPUUsage.vbs"
  2⤵
  PID:2000
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\reStart.vbs"
  2⤵
  PID:1912
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\CPUUsage.vbs"
  2⤵
  PID:5400
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\reStart.vbs"
  2⤵
  PID:2752
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\CPUUsage.vbs"
  2⤵
  PID:4248
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\reStart.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  PID:5296
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\CPUUsage.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  PID:2956
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\reStart.vbs"
  2⤵
  PID:400
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\CPUUsage.vbs"
  2⤵
  PID:2532
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\reStart.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  PID:3972
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\CPUUsage.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  PID:6028
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\reStart.vbs"
  2⤵
  PID:4124
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\CPUUsage.vbs"
  2⤵
  PID:4180
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\reStart.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  PID:4496
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\CPUUsage.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  PID:1184
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\reStart.vbs"
  2⤵
  PID:4560
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\CPUUsage.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  PID:3732
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\reStart.vbs"
  2⤵
  PID:4284
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\CPUUsage.vbs"
  2⤵
  PID:2960
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\reStart.vbs"
  2⤵
  PID:2516
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\CPUUsage.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  PID:4764
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\reStart.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  PID:2388
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\CPUUsage.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  PID:5136
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\reStart.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  PID:5616
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\CPUUsage.vbs"
  2⤵
  PID:540
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\reStart.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  PID:5444
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\CPUUsage.vbs"
  2⤵
  PID:1952
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\reStart.vbs"
  2⤵
  PID:5892
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\CPUUsage.vbs"
  2⤵
  PID:4804
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\reStart.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  PID:3864
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\CPUUsage.vbs"
  2⤵
  PID:2924
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\reStart.vbs"
  2⤵
  PID:6140
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\CPUUsage.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  PID:6124

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Visual Basic

T1059.005

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads