2798dad008f62aace1841edfb43146147a9cade388c419c96da788fcaa2f76bc

Analysis

geolocation tags

nanew-jerseynorth-americaunited-statesususa
max time kernel
898s
max time network
478s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/07/2026, 02:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
MrsMajor-main/WinLogon.bat
Size 117B
Sample260720-cgp1escs8m
SHA256 2798dad008f62aace1841edfb43146147a9cade388c419c96da788fcaa2f76bc
MD5 870bce376c1b71365390a9e9aefb9a33
SHA1 176fdbdb8e5795fb5fddc81b2b4e1d9677779786
SHA512 f17c9898f81387daf42c9b858f507889919474ac2a17f96fc6d4606be94327e0b941b23a3ccc3f4af92b8abc0522e94745616da0564cdef1c3f20ee17ee31f53
TLSH
T180B092048F89D551B01630809321B550832164E4271B94B353DAE30B6183EEE8726F98
MD5 SHA1 SHA512 TLSH

Score

5^/10

execution

Malware Config

Signatures

Executes a VBScript file via the Windows Script Host. 1 TTPs 64 IoCs

execution

Visual Basic

T1059.005

pid	Process
5652	wscript.exe
1820	wscript.exe
2000	wscript.exe
4388	wscript.exe
1348	wscript.exe
1940	wscript.exe
5544	wscript.exe
1640	wscript.exe
5988	wscript.exe
2856	wscript.exe
2916	wscript.exe
5432	wscript.exe
5408	wscript.exe
5780	wscript.exe
5656	wscript.exe
5032	wscript.exe
2800	wscript.exe
5208	wscript.exe
1440	wscript.exe
200	wscript.exe
4328	wscript.exe
5096	wscript.exe
5824	wscript.exe
3964	wscript.exe
5336	wscript.exe
1576	wscript.exe
3140	wscript.exe
256	wscript.exe
2744	wscript.exe
3916	wscript.exe
3900	wscript.exe
5032	wscript.exe
4672	wscript.exe
4116	wscript.exe
1336	wscript.exe
2520	wscript.exe
5520	wscript.exe
4524	wscript.exe
2680	wscript.exe
724	wscript.exe
5764	wscript.exe
2024	wscript.exe
1148	wscript.exe
1300	wscript.exe
1008	wscript.exe
1468	wscript.exe
4356	wscript.exe
4664	wscript.exe
5848	wscript.exe
1160	wscript.exe
4248	wscript.exe
4852	wscript.exe
4852	wscript.exe
4600	wscript.exe
2644	wscript.exe
696	wscript.exe
5244	wscript.exe
5344	wscript.exe
5208	wscript.exe
4752	wscript.exe
1236	wscript.exe
4208	wscript.exe
4624	wscript.exe
5432	wscript.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4716	cmd.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4716 wrote to memory of 4100	4716	cmd.exe	90
PID 4716 wrote to memory of 1440	4716	cmd.exe	91
PID 4716 wrote to memory of 5520	4716	cmd.exe	92
PID 4716 wrote to memory of 5036	4716	cmd.exe	93
PID 4716 wrote to memory of 4384	4716	cmd.exe	94
PID 4716 wrote to memory of 4740	4716	cmd.exe	96
PID 4716 wrote to memory of 4752	4716	cmd.exe	97
PID 4716 wrote to memory of 3092	4716	cmd.exe	98
PID 4716 wrote to memory of 200	4716	cmd.exe	99
PID 4716 wrote to memory of 3444	4716	cmd.exe	100
PID 4716 wrote to memory of 960	4716	cmd.exe	101
PID 4716 wrote to memory of 4700	4716	cmd.exe	102
PID 4716 wrote to memory of 4508	4716	cmd.exe	103
PID 4716 wrote to memory of 3684	4716	cmd.exe	104
PID 4716 wrote to memory of 4484	4716	cmd.exe	105
PID 4716 wrote to memory of 5432	4716	cmd.exe	106
PID 4716 wrote to memory of 5824	4716	cmd.exe	107
PID 4716 wrote to memory of 1304	4716	cmd.exe	108
PID 4716 wrote to memory of 920	4716	cmd.exe	109
PID 4716 wrote to memory of 2004	4716	cmd.exe	110
PID 4716 wrote to memory of 4572	4716	cmd.exe	111
PID 4716 wrote to memory of 1516	4716	cmd.exe	112
PID 4716 wrote to memory of 5268	4716	cmd.exe	113
PID 4716 wrote to memory of 1164	4716	cmd.exe	114
PID 4716 wrote to memory of 4328	4716	cmd.exe	115
PID 4716 wrote to memory of 2860	4716	cmd.exe	116
PID 4716 wrote to memory of 5924	4716	cmd.exe	117
PID 4716 wrote to memory of 3344	4716	cmd.exe	118
PID 4716 wrote to memory of 4524	4716	cmd.exe	119
PID 4716 wrote to memory of 2208	4716	cmd.exe	120
PID 4716 wrote to memory of 2124	4716	cmd.exe	121
PID 4716 wrote to memory of 2776	4716	cmd.exe	122
PID 4716 wrote to memory of 5652	4716	cmd.exe	123
PID 4716 wrote to memory of 4852	4716	cmd.exe	124
PID 4716 wrote to memory of 1940	4716	cmd.exe	125
PID 4716 wrote to memory of 1820	4716	cmd.exe	126
PID 4716 wrote to memory of 1008	4716	cmd.exe	127
PID 4716 wrote to memory of 5032	4716	cmd.exe	128
PID 4716 wrote to memory of 4676	4716	cmd.exe	129
PID 4716 wrote to memory of 4688	4716	cmd.exe	130
PID 4716 wrote to memory of 4768	4716	cmd.exe	131
PID 4716 wrote to memory of 4600	4716	cmd.exe	132
PID 4716 wrote to memory of 1280	4716	cmd.exe	133
PID 4716 wrote to memory of 2176	4716	cmd.exe	134
PID 4716 wrote to memory of 5344	4716	cmd.exe	135
PID 4716 wrote to memory of 2856	4716	cmd.exe	136
PID 4716 wrote to memory of 1412	4716	cmd.exe	137
PID 4716 wrote to memory of 4664	4716	cmd.exe	138
PID 4716 wrote to memory of 5780	4716	cmd.exe	139
PID 4716 wrote to memory of 2680	4716	cmd.exe	140
PID 4716 wrote to memory of 2644	4716	cmd.exe	141
PID 4716 wrote to memory of 2300	4716	cmd.exe	142
PID 4716 wrote to memory of 4592	4716	cmd.exe	143
PID 4716 wrote to memory of 3964	4716	cmd.exe	150
PID 4716 wrote to memory of 5812	4716	cmd.exe	151
PID 4716 wrote to memory of 5848	4716	cmd.exe	153
PID 4716 wrote to memory of 1236	4716	cmd.exe	154
PID 4716 wrote to memory of 256	4716	cmd.exe	155
PID 4716 wrote to memory of 696	4716	cmd.exe	156
PID 4716 wrote to memory of 1160	4716	cmd.exe	157
PID 4716 wrote to memory of 1980	4716	cmd.exe	158
PID 4716 wrote to memory of 1164	4716	cmd.exe	159
PID 4716 wrote to memory of 4076	4716	cmd.exe	160
PID 4716 wrote to memory of 6020	4716	cmd.exe	161

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\MrsMajor-main\WinLogon.bat"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4716
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\CPUUsage.vbs"
  2⤵
  PID:4100
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\reStart.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  PID:1440
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\CPUUsage.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  PID:5520
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\reStart.vbs"
  2⤵
  PID:5036
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\CPUUsage.vbs"
  2⤵
  PID:4384
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\reStart.vbs"
  2⤵
  PID:4740
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\CPUUsage.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  PID:4752
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\reStart.vbs"
  2⤵
  PID:3092
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\CPUUsage.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  PID:200
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\reStart.vbs"
  2⤵
  PID:3444
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\CPUUsage.vbs"
  2⤵
  PID:960
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\reStart.vbs"
  2⤵
  PID:4700
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\CPUUsage.vbs"
  2⤵
  PID:4508
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\reStart.vbs"
  2⤵
  PID:3684
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\CPUUsage.vbs"
  2⤵
  PID:4484
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\reStart.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  PID:5432
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\CPUUsage.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  PID:5824
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\reStart.vbs"
  2⤵
  PID:1304
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\CPUUsage.vbs"
  2⤵
  PID:920
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\reStart.vbs"
  2⤵
  PID:2004
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\CPUUsage.vbs"
  2⤵
  PID:4572
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\reStart.vbs"
  2⤵
  PID:1516
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\CPUUsage.vbs"
  2⤵
  PID:5268
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\reStart.vbs"
  2⤵
  PID:1164
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\CPUUsage.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  PID:4328
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\reStart.vbs"
  2⤵
  PID:2860
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\CPUUsage.vbs"
  2⤵
  PID:5924
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\reStart.vbs"
  2⤵
  PID:3344
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\CPUUsage.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  PID:4524
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\reStart.vbs"
  2⤵
  PID:2208
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\CPUUsage.vbs"
  2⤵
  PID:2124
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\reStart.vbs"
  2⤵
  PID:2776
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\CPUUsage.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  PID:5652
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\reStart.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  PID:4852
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\CPUUsage.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  PID:1940
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\reStart.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  PID:1820
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\CPUUsage.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  PID:1008
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\reStart.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  PID:5032
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\CPUUsage.vbs"
  2⤵
  PID:4676
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\reStart.vbs"
  2⤵
  PID:4688
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\CPUUsage.vbs"
  2⤵
  PID:4768
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\reStart.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  PID:4600
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\CPUUsage.vbs"
  2⤵
  PID:1280
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\reStart.vbs"
  2⤵
  PID:2176
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\CPUUsage.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  PID:5344
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\reStart.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  PID:2856
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\CPUUsage.vbs"
  2⤵
  PID:1412
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\reStart.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  PID:4664
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\CPUUsage.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  PID:5780
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\reStart.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  PID:2680
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\CPUUsage.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  PID:2644
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\reStart.vbs"
  2⤵
  PID:2300
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\CPUUsage.vbs"
  2⤵
  PID:4592
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\reStart.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  PID:3964
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\CPUUsage.vbs"
  2⤵
  PID:5812
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\reStart.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  PID:5848
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\CPUUsage.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  PID:1236
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\reStart.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  PID:256
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\CPUUsage.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  PID:696
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\reStart.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  PID:1160
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\CPUUsage.vbs"
  2⤵
  PID:1980
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\reStart.vbs"
  2⤵
  PID:1164
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\CPUUsage.vbs"
  2⤵
  PID:4076
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\reStart.vbs"
  2⤵
  PID:6020
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\CPUUsage.vbs"
  2⤵
  PID:2676
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\reStart.vbs"
  2⤵
  PID:3276
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\CPUUsage.vbs"
  2⤵
  PID:2748
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\reStart.vbs"
  2⤵
  PID:2860
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\CPUUsage.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  PID:2000
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\reStart.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  PID:4388
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\CPUUsage.vbs"
  2⤵
  PID:3308
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\reStart.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  PID:4248
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\CPUUsage.vbs"
  2⤵
  PID:2124
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\reStart.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  PID:724
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\CPUUsage.vbs"
  2⤵
  PID:3900
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\reStart.vbs"
  2⤵
  PID:5492
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\CPUUsage.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  PID:5656
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\reStart.vbs"
  2⤵
  PID:2616
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\CPUUsage.vbs"
  2⤵
  PID:3736
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\reStart.vbs"
  2⤵
  PID:2336
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\CPUUsage.vbs"
  2⤵
  PID:1736
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\reStart.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  PID:5032
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\CPUUsage.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  PID:5208
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\reStart.vbs"
  2⤵
  PID:3768
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\CPUUsage.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  PID:4208
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\reStart.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  PID:5336
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\CPUUsage.vbs"
  2⤵
  PID:4600
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\reStart.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  PID:5764
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\CPUUsage.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  PID:2744
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\reStart.vbs"
  2⤵
  PID:5608
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\CPUUsage.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  PID:1576
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\reStart.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  PID:1468
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\CPUUsage.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  PID:2916
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\reStart.vbs"
  2⤵
  PID:3972
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\CPUUsage.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  PID:1148
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\reStart.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  PID:1300
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\CPUUsage.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  PID:5544
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\reStart.vbs"
  2⤵
  PID:2796
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\CPUUsage.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  PID:1336
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\reStart.vbs"
  2⤵
  PID:5560
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\CPUUsage.vbs"
  2⤵
  PID:1424
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\reStart.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  PID:5096
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\CPUUsage.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  PID:4672
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\reStart.vbs"
  2⤵
  PID:3624
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\CPUUsage.vbs"
  2⤵
  PID:5688
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\reStart.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  PID:4624
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\CPUUsage.vbs"
  2⤵
  PID:4800
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\reStart.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  PID:1348
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\CPUUsage.vbs"
  2⤵
  PID:3284
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\reStart.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  PID:2520
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\CPUUsage.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  PID:2800
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\reStart.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  PID:5432
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\CPUUsage.vbs"
  2⤵
  PID:4940
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\reStart.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  PID:5244
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\CPUUsage.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  PID:1640
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\reStart.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  PID:2024
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\CPUUsage.vbs"
  2⤵
  PID:4996
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\reStart.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  PID:4356
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\CPUUsage.vbs"
  2⤵
  PID:3620
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\reStart.vbs"
  2⤵
  PID:4328
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\CPUUsage.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  PID:3916
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\reStart.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  PID:3140
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\CPUUsage.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  PID:5988
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\reStart.vbs"
  2⤵
  PID:344
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\CPUUsage.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  PID:3900
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\reStart.vbs"
  2⤵
  PID:2756
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\CPUUsage.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  PID:4852
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\reStart.vbs"
  2⤵
  PID:3736
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\CPUUsage.vbs"
  2⤵
  PID:5080
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\reStart.vbs"
  2⤵
  PID:4148
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\CPUUsage.vbs"
  2⤵
  PID:5076
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\reStart.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  PID:5408
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\CPUUsage.vbs"
  2⤵
  PID:2252
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\reStart.vbs"
  2⤵
  PID:5032
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\CPUUsage.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  PID:5208
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\reStart.vbs"
  2⤵
  PID:4524
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\CPUUsage.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  PID:4116
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Program Files\mrsmajor\reStart.vbs"
  2⤵
  PID:5504

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:1692

C:\Windows\System32\SecurityHealthHost.exe
\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding
1⤵
PID:3196

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Visual Basic

T1059.005

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads