2798dad008f62aace1841edfb43146147a9cade388c419c96da788fcaa2f76bc

Analysis

geolocation tags

nanew-jerseynorth-americaunited-statesususa
max time kernel
898s
max time network
438s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260513-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260513-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
20/07/2026, 02:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
MrsMajor-main/WinLogon.bat
Size 117B
Sample260720-cgp1escs8m
SHA256 2798dad008f62aace1841edfb43146147a9cade388c419c96da788fcaa2f76bc
MD5 870bce376c1b71365390a9e9aefb9a33
SHA1 176fdbdb8e5795fb5fddc81b2b4e1d9677779786
SHA512 f17c9898f81387daf42c9b858f507889919474ac2a17f96fc6d4606be94327e0b941b23a3ccc3f4af92b8abc0522e94745616da0564cdef1c3f20ee17ee31f53
TLSH
T180B092048F89D551B01630809321B550832164E4271B94B353DAE30B6183EEE8726F98
MD5 SHA1 SHA512 TLSH

Score

5^/10

execution

Malware Config

Signatures

Executes a VBScript file via the Windows Script Host. 1 TTPs 64 IoCs

execution

Visual Basic

T1059.005

pid	Process
2092	wscript.exe
2872	wscript.exe
4480	wscript.exe
2044	wscript.exe
4820	wscript.exe
4596	wscript.exe
2652	wscript.exe
2268	wscript.exe
4276	wscript.exe
1240	wscript.exe
1476	wscript.exe
3740	wscript.exe
568	wscript.exe
4492	wscript.exe
1492	wscript.exe
3728	wscript.exe
3012	wscript.exe
1236	wscript.exe
4184	wscript.exe
792	wscript.exe
3844	wscript.exe
2928	wscript.exe
832	wscript.exe
1976	wscript.exe
3476	wscript.exe
1672	wscript.exe
3068	wscript.exe
4192	wscript.exe
2836	wscript.exe
4148	wscript.exe
4704	wscript.exe
3128	wscript.exe
4324	wscript.exe
3852	wscript.exe
4788	wscript.exe
1860	wscript.exe
2244	wscript.exe
3616	wscript.exe
1680	wscript.exe
4348	wscript.exe
4644	wscript.exe
2128	wscript.exe
320	wscript.exe
4132	wscript.exe
3636	wscript.exe
4620	wscript.exe
4076	wscript.exe
2100	wscript.exe
4796	wscript.exe
1560	wscript.exe
1796	wscript.exe
4928	wscript.exe
224	wscript.exe
1536	wscript.exe
1108	wscript.exe
1076	wscript.exe
3388	wscript.exe
1536	wscript.exe
4948	wscript.exe
1744	wscript.exe
3132	wscript.exe
4356	wscript.exe
4272	wscript.exe
1012	wscript.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4228	cmd.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4228 wrote to memory of 2308	4228	cmd.exe	85
PID 4228 wrote to memory of 3556	4228	cmd.exe	91
PID 4228 wrote to memory of 2652	4228	cmd.exe	95
PID 4228 wrote to memory of 1560	4228	cmd.exe	96
PID 4228 wrote to memory of 1536	4228	cmd.exe	97
PID 4228 wrote to memory of 3312	4228	cmd.exe	99
PID 4228 wrote to memory of 468	4228	cmd.exe	100
PID 4228 wrote to memory of 3352	4228	cmd.exe	101
PID 4228 wrote to memory of 224	4228	cmd.exe	102
PID 4228 wrote to memory of 2236	4228	cmd.exe	103
PID 4228 wrote to memory of 3128	4228	cmd.exe	104
PID 4228 wrote to memory of 1696	4228	cmd.exe	105
PID 4228 wrote to memory of 4848	4228	cmd.exe	106
PID 4228 wrote to memory of 1860	4228	cmd.exe	107
PID 4228 wrote to memory of 1556	4228	cmd.exe	108
PID 4228 wrote to memory of 4856	4228	cmd.exe	109
PID 4228 wrote to memory of 4948	4228	cmd.exe	110
PID 4228 wrote to memory of 1744	4228	cmd.exe	111
PID 4228 wrote to memory of 1632	4228	cmd.exe	112
PID 4228 wrote to memory of 792	4228	cmd.exe	113
PID 4228 wrote to memory of 4744	4228	cmd.exe	114
PID 4228 wrote to memory of 3068	4228	cmd.exe	115
PID 4228 wrote to memory of 3844	4228	cmd.exe	116
PID 4228 wrote to memory of 320	4228	cmd.exe	117
PID 4228 wrote to memory of 3024	4228	cmd.exe	118
PID 4228 wrote to memory of 2244	4228	cmd.exe	119
PID 4228 wrote to memory of 4272	4228	cmd.exe	120
PID 4228 wrote to memory of 2196	4228	cmd.exe	121
PID 4228 wrote to memory of 3616	4228	cmd.exe	122
PID 4228 wrote to memory of 4952	4228	cmd.exe	123
PID 4228 wrote to memory of 2092	4228	cmd.exe	124
PID 4228 wrote to memory of 3016	4228	cmd.exe	125
PID 4228 wrote to memory of 612	4228	cmd.exe	126
PID 4228 wrote to memory of 4480	4228	cmd.exe	127
PID 4228 wrote to memory of 4132	4228	cmd.exe	128
PID 4228 wrote to memory of 2928	4228	cmd.exe	129
PID 4228 wrote to memory of 1536	4228	cmd.exe	130
PID 4228 wrote to memory of 4108	4228	cmd.exe	131
PID 4228 wrote to memory of 884	4228	cmd.exe	132
PID 4228 wrote to memory of 1680	4228	cmd.exe	133
PID 4228 wrote to memory of 4668	4228	cmd.exe	134
PID 4228 wrote to memory of 3672	4228	cmd.exe	135
PID 4228 wrote to memory of 832	4228	cmd.exe	136
PID 4228 wrote to memory of 1796	4228	cmd.exe	137
PID 4228 wrote to memory of 3128	4228	cmd.exe	138
PID 4228 wrote to memory of 1976	4228	cmd.exe	139
PID 4228 wrote to memory of 3772	4228	cmd.exe	140
PID 4228 wrote to memory of 4520	4228	cmd.exe	141
PID 4228 wrote to memory of 1240	4228	cmd.exe	142
PID 4228 wrote to memory of 3132	4228	cmd.exe	143
PID 4228 wrote to memory of 968	4228	cmd.exe	144
PID 4228 wrote to memory of 4184	4228	cmd.exe	145
PID 4228 wrote to memory of 3076	4228	cmd.exe	146
PID 4228 wrote to memory of 4496	4228	cmd.exe	147
PID 4228 wrote to memory of 1136	4228	cmd.exe	148
PID 4228 wrote to memory of 2488	4228	cmd.exe	149
PID 4228 wrote to memory of 4324	4228	cmd.exe	150
PID 4228 wrote to memory of 2440	4228	cmd.exe	151
PID 4228 wrote to memory of 2872	4228	cmd.exe	152
PID 4228 wrote to memory of 1668	4228	cmd.exe	153
PID 4228 wrote to memory of 1732	4228	cmd.exe	154
PID 4228 wrote to memory of 1012	4228	cmd.exe	155
PID 4228 wrote to memory of 3852	4228	cmd.exe	156
PID 4228 wrote to memory of 3068	4228	cmd.exe	157

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\MrsMajor-main\WinLogon.bat"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4228
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\CPUUsage.vbs"
  2⤵
  PID:2308
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\reStart.vbs"
  2⤵
  PID:3556
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\CPUUsage.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  PID:2652
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\reStart.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  PID:1560
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\CPUUsage.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  PID:1536
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\reStart.vbs"
  2⤵
  PID:3312
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\CPUUsage.vbs"
  2⤵
  PID:468
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\reStart.vbs"
  2⤵
  PID:3352
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\CPUUsage.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  PID:224
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\reStart.vbs"
  2⤵
  PID:2236
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\CPUUsage.vbs"
  2⤵
  PID:3128
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\reStart.vbs"
  2⤵
  PID:1696
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\CPUUsage.vbs"
  2⤵
  PID:4848
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\reStart.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  PID:1860
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\CPUUsage.vbs"
  2⤵
  PID:1556
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\reStart.vbs"
  2⤵
  PID:4856
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\CPUUsage.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  PID:4948
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\reStart.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  PID:1744
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\CPUUsage.vbs"
  2⤵
  PID:1632
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\reStart.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  PID:792
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\CPUUsage.vbs"
  2⤵
  PID:4744
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\reStart.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  PID:3068
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\CPUUsage.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  PID:3844
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\reStart.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  PID:320
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\CPUUsage.vbs"
  2⤵
  PID:3024
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\reStart.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  PID:2244
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\CPUUsage.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  PID:4272
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\reStart.vbs"
  2⤵
  PID:2196
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\CPUUsage.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  PID:3616
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\reStart.vbs"
  2⤵
  PID:4952
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\CPUUsage.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  PID:2092
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\reStart.vbs"
  2⤵
  PID:3016
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\CPUUsage.vbs"
  2⤵
  PID:612
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\reStart.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  PID:4480
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\CPUUsage.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  PID:4132
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\reStart.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  PID:2928
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\CPUUsage.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  PID:1536
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\reStart.vbs"
  2⤵
  PID:4108
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\CPUUsage.vbs"
  2⤵
  PID:884
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\reStart.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  PID:1680
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\CPUUsage.vbs"
  2⤵
  PID:4668
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\reStart.vbs"
  2⤵
  PID:3672
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\CPUUsage.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  PID:832
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\reStart.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  PID:1796
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\CPUUsage.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  PID:3128
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\reStart.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  PID:1976
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\CPUUsage.vbs"
  2⤵
  PID:3772
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\reStart.vbs"
  2⤵
  PID:4520
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\CPUUsage.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  PID:1240
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\reStart.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  PID:3132
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\CPUUsage.vbs"
  2⤵
  PID:968
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\reStart.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  PID:4184
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\CPUUsage.vbs"
  2⤵
  PID:3076
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\reStart.vbs"
  2⤵
  PID:4496
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\CPUUsage.vbs"
  2⤵
  PID:1136
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\reStart.vbs"
  2⤵
  PID:2488
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\CPUUsage.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  PID:4324
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\reStart.vbs"
  2⤵
  PID:2440
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\CPUUsage.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  PID:2872
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\reStart.vbs"
  2⤵
  PID:1668
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\CPUUsage.vbs"
  2⤵
  PID:1732
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\reStart.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  PID:1012
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\CPUUsage.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  PID:3852
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\reStart.vbs"
  2⤵
  PID:3068
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\CPUUsage.vbs"
  2⤵
  PID:4104
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\reStart.vbs"
  2⤵
  PID:1592
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\CPUUsage.vbs"
  2⤵
  PID:2616
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\reStart.vbs"
  2⤵
  PID:1192
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\CPUUsage.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  PID:4348
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\reStart.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  PID:4644
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\CPUUsage.vbs"
  2⤵
  PID:3048
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\reStart.vbs"
  2⤵
  PID:3388
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\CPUUsage.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  PID:2044
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\reStart.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  PID:1672
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\CPUUsage.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  PID:568
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\reStart.vbs"
  2⤵
  PID:3804
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\CPUUsage.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  PID:4192
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\reStart.vbs"
  2⤵
  PID:4780
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\CPUUsage.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  PID:1108
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\reStart.vbs"
  2⤵
  PID:2240
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\CPUUsage.vbs"
  2⤵
  PID:2920
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\reStart.vbs"
  2⤵
  PID:3616
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\CPUUsage.vbs"
  2⤵
  PID:4768
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\reStart.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  PID:4356
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\CPUUsage.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  PID:3636
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\reStart.vbs"
  2⤵
  PID:5060
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\CPUUsage.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  PID:4492
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\reStart.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  PID:4620
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\CPUUsage.vbs"
  2⤵
  PID:612
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\reStart.vbs"
  2⤵
  PID:3532
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\CPUUsage.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  PID:1492
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\reStart.vbs"
  2⤵
  PID:3812
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\CPUUsage.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  PID:2836
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\reStart.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  PID:3476
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\CPUUsage.vbs"
  2⤵
  PID:468
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\reStart.vbs"
  2⤵
  PID:1612
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\CPUUsage.vbs"
  2⤵
  PID:3600
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\reStart.vbs"
  2⤵
  PID:3104
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\CPUUsage.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  PID:3728
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\reStart.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  PID:2128
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\CPUUsage.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  PID:4076
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\reStart.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  PID:2100
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\CPUUsage.vbs"
  2⤵
  PID:4036
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\reStart.vbs"
  2⤵
  PID:836
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\CPUUsage.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  PID:3012
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\reStart.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  PID:1476
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\CPUUsage.vbs"
  2⤵
  PID:1324
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\reStart.vbs"
  2⤵
  PID:4648
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\CPUUsage.vbs"
  2⤵
  PID:4116
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\reStart.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  PID:4820
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\CPUUsage.vbs"
  2⤵
  PID:4932
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\reStart.vbs"
  2⤵
  PID:2564
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\CPUUsage.vbs"
  2⤵
  PID:4208
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\reStart.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  PID:4148
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\CPUUsage.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  PID:3740
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\reStart.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  PID:2268
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\CPUUsage.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  PID:4796
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\reStart.vbs"
  2⤵
  PID:4376
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\CPUUsage.vbs"
  2⤵
  PID:2436
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\reStart.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  PID:1076
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\CPUUsage.vbs"
  2⤵
  PID:3952
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\reStart.vbs"
  2⤵
  PID:4744
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\CPUUsage.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  PID:4788
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\reStart.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  PID:4704
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\CPUUsage.vbs"
  2⤵
  PID:2376
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\reStart.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  PID:4928
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\CPUUsage.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  PID:1236
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\reStart.vbs"
  2⤵
  PID:952
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\CPUUsage.vbs"
  2⤵
  PID:2796
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\reStart.vbs"
  2⤵
  PID:3568
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\CPUUsage.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  PID:4596
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\reStart.vbs"
  2⤵
  PID:2556
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\CPUUsage.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  PID:3388
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\reStart.vbs"
  2⤵
  PID:1144
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\CPUUsage.vbs"
  2⤵
  PID:1468
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\reStart.vbs"
  2⤵
  PID:2860
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\CPUUsage.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  PID:4276

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Visual Basic

T1059.005

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads